Computer Miscellaneous

Solved/Enhancement: Fedora 11/Fedora 12 Speed Improvement for YUM updates

2009-11-20T11:10:00.000-06:00

Context:
The typical mechanism for updating (or even upgrading) Fedora 11 and Fedora 12 distributions is through Yum and/or it's graphic user interface counter-part gpk-update-viewer. In brief, Yum collects local installation information and comparies it to available updates through a series of mirror sites holding updates for Fedora installations.

Problem:
While running a Beta version of Fedora 12, at some point most the mirror sites that provided Fedora 12 with updates stopped working for me. And, because these sites were scattered around the world, it took a while for Yum to look through all of them to find one that worked.

Constraints:
None

Details:
It's not clear why the mirror sites stopped working. Some reported "404" errors, some "50x" errors and some returned unknown result codes. Eventually, either by retrying or getting lucky, Yum would succeed. I suspect that as Fedora 12 beta moved to Fedora 12 official release, some testing sites for upgrades were taken down.

Note: this problem also affected the GUI front end for Yum: gpk-update-viewer.

Solution:

As an initial step, I executed su -c "yum clean all". I do not know it this assisted with the process of correcting the issue but it is worthy of noting.
Next I executed su -c "yum install yum-fastestmirror". After a few tries, the package as located and installed.

Results:
On the next yum action, I found the following output:

Loaded plugins: fastestmirror, refresh-packagekit
Determining fastest mirrors
* fedora: fedora.xxxx.xxx
* updates: ftp.xxx.xxx
Setting up Update Process
...

Where the xxxx sites were geographically closer to my current location than the previous sites and were working as Yum expected. The completion of this Yum action and subsequent others was much faster and error free.

References:

Disclaimer
This solution worked for me. It may or may not work for you. I am not responsible for your actions nor your results of your actions should you act on what you read here. I do not claim expertise in this very specific area and only convey my experience. There is no warranty on this (and most) free information.

(Followup) Fedora 11: TCP Performance Tuning [script available]

2009-08-28T23:23:00.000-05:00

Context:
Using Fedora 11's default installation configuration, reliable network services are provided.

Problem:
No specific issue but performance-related improvements investigated. TCP settings, set for very small "data windows" (small packet sizes), require more packets, creating more network traffic. If set too small, the overhead for sending more packets could cause slower network performance and possibly higher CPU usage.

Constraints:
I had no specific constraints, although I did want a solution that did not require installation of third-party software or other non-standard elements for a Fedora 11 distribution.

Details:
For root or super user accounts, most Linux installations offer access to TCP settings. These settings tell the network card (NIC) and Linux kernel how to manage transmission data. By adjusting these settings, you can affect how much time the computer and NIC spend at these various networking tasks.

Solutions:
After doing some research, I found this site which describe changes that would or could improve network performance. Since I needed to apply these changes on more than one computer, I decided to script the process. Also, since this task was mostly a new domain for me, I decided to backup the existing TCP settings before writing new TCP settings.

The results is a "simple in nature" script for improving TCP performance. Rather than posting an almost 200 line BASH script on the blog, you can get it from this link:

http://www.mercuryws.biz/temp/tcpTuning.sh

In general terms, this script increases the size of the TCP packets being sent. There are other features enabled which I did not fully research, most explained in the first resource link.

Script Features:

Supports -h and --help command line arguments to get limited help
Simple to use: just execute the script and follow the directions (mostly pressing the space bar or CTRL C to quit)
Confirms necessary tools are available before starting the process
Backs up current settings into a uniquely named file [default name provided, uniqueness handled by the script and reported to the user]
Backup file is formatted (but not tested) to be executable for restoring previous settings
Detects the currently "in use" NIC to make any card-specific setting changes
Requires root via sudo access to execute changes. (not required to perform the setting backups)

Note:
Read this script thoroughly before executing it. If you do not understand it or you are not comfortable with it, I strongly suggest you do not execute it. This script was designed specifically for Fedora 11 distributions and it may or may not work on your Linux distribution. This script is platform-specific and is not expected to work on any other platform (i.e. Windows, Mac, etc)

Results:
I did not develop a metric for testing the results before hand. Here are my subjective observations afterward:

Web: it appears that before the changes I could sometimes see web pages loading individual elements. After it appears that web pages "snap" onto the screen quickly.
SSH: appears to have no significant impact on SSH. This most likely do to two issues with SSH it's self: limited packet size and single-threaded (de)encryption services.
Downloads (web): I don't have any specific impressions of previous speeds but I believe there is an improvement. I have a good ISP so I am seeing 1.7M (peaking at 2.2M) transfer rates per second from a relatively close-by commercial site, which seems higher than before.

References:

Additional reading here:

http://www.ubuntugeek.com/performance-tuning-with-system-control-sysctl-in-ubuntu.html

Disclaimer:
This solution worked for me. It may or may not work for you. I am not responsible for your actions nor your results of your actions should you act on what you read here or execution of the script I provided for this blog entry. I do not claim expertise in this very specific area and only convey my experience. There is no warranty on this (and most) free information.

Followup (August 30, 2009)
It appears that the default settings in the provided version 0.2 script may have introduced an issue with some web sites, most noticeably with streaming audio and video with Flash. Using a previous configuration I used that didn't appear to have this issue at the time, I have updated the script (0.4) with some less aggressive settings. This update also has a more execution-friendly backup file format. Additional testing so far seems more consistent.

Followup (September 2, 2009)
The problems I experienced seems to be related to a kernel update for Fedora 11. More details here:

https://bugzilla.redhat.com/show_bug.cgi?id=506075

As the problems I experienced are not related to the TCP Tuning, I plan to update the script to support multiple types of settings from minor to aggressive TCP tuning.

Followup (September 3, 2009)
I have updated the tcpTuning.sh script to 0.5. I have added 3 different tuning profiles:

-0 = tune TCP performance to near-default installation settings
-1 = tune moderate TCP performance settings
-2 = tune aggressive TCP performance settings

tcpTuning.sh still supports -h and --help in case you forget these options.

(Followup) Solved: Fedora 9 default settings for shared memory /tmp

2008-08-24T05:33:00.000-05:00

Context:
Using Fedora 9's default installation configuration, the "temp directory" (using another OS's terms) is utilized as /tmp. This special directory is a shared file system and resides in memory known as tmpfs.

Problem:
The default settings for a tmpfs is half of the available memory.

Constraints:
Fedora 9's default set up uses an in-memory solution for /tmp.

Details:
My system has 2 gigabyte of memory. However, the average usage for /tmp on my machine is less than one 1 megabyte. So, more then 1023 megabytes of memory was allocated and never used.

Solution:
I needed to control the size of the /tmp. This is mounted at boot time using the description in /etc/fstab. After a forum search, I looked at the man page for the mount command to determine the need to use the size option during mount /tmp. I decided to try only having 2 megabytes for /tmp.

Original /etc/fstab:

tmpfs    /dev/shm    tmpfs    defaults    0 0

New fstab:

tmpfs    /dev/shm    tmpfs    defaults,size=2097152    0 0

After making these changes as super user or root, I rebooted my system to get th e settings to become active.

References:

Note:
The other options for providing /tmp are:

disk based /tmp, mounting (via /etc/fstab) a disk partition at boot time (preferred)
directory based /tmp on the boot root partition (not preferred for security reasons)

tmpfs /dev/shm tmpfs defaults,size=10% 0 0

(Followup) Solved: Fedora 9, Skype for Linux 2.0x and the Microphone

2008-07-12T02:43:00.000-05:00

Context:
Using Fedora 9's new sound system Pulse, some sound-centric applications like Skype need to be configured differently from their default sound settings.

Problem:
Immediately after installation, Skype for Linux 2.0.x was able to connect to my account and I was able to hear the test calls with reliable clarity.

However, using the Skype Test Call, my microphone sound was very distorted with static, digitalization, and gaps. Enabling the "Display technical call info", showed very high "jitter" and some "cor" (assuming this means corruption) but a reliable connect speed.

As I was able to use Skype for Windows before moving to Fedora 9, I was able to remove the router as the cause of the problem. See the "jitter" for details if you think this might be your problem.

Constraints:
Fedora 9 uses the "Pulse" sound daemon. Skype is a closed ("black box") software application so it's constraints are vastly unknown.

Details:
While I was able to use my microphone without significant issue (the volume was a little low) with other applications ( Sound Recorder ), Skype did not provide a clean and clear sound processing from the microphone. I tried various solutions (listed below) before finding the correct one for me:

Note: After trying each of these solutions and each failed to solve the problem, I reversed most of changes before starting the next solution. I believe I left some of the solutions from the first reference in place.

Solution:

The solution what worked for me came in two parts:

Enhancing the Microphone Volume

Takes from the second post here:
"A. Right click at the volume control, choose preference.
B. File - Change Device - (OSS Mixer), which is the second one.
C. Below the microphone volume- click on the "microphone icon" until there is no cross on it.
D. File - Change Device - (Alsa Mixer), which is the first one.
E. Edit - preference - scroll down - click Mic Boost (+20 dB)
F. Click "Switches", which is next to Playback. Then click Mic Boost (+20 dB)"
This will result in a louder microphone for all of Fedora 9's sound applications using the microphone. If you find that it's too loud, you can unselect the microphone boost on the "Switches" panel of the sound mixer.

Setting the Hardware Microphone in Skype

Taken from the here:
"Firstly, add these lines:
default-fragments = 8
default-fragment-size-msec = 5
at the end of "/etc/pulse/daemon.conf"

Then, edit "~/.asoundrc" and add the following lines if they do not exist:
pcm.pulse { type pulse }
ctl.pulse { type pulse }
Finally, open Skype. Set the "Ringing" and "Sound Out" devices to "pulse", then set the "Sound In" to the plughw device of your microphone."
While the article has more steps, these are the only steps I executed from this reference.
I added the first modifications to /etc/pulse/daemond.conf as shown. I am uncertain exactly what these settings do.
I did not have a ~/.asoundrc file. I created on in my home directory but I do not think it added to the finally solution.
I believe the key part of the solution was the last step (possibly the only step needed): "set the 'Sound In' to the plughwd device of your microphone." The Skype "Sound In" settings are found on the Options dialog under "Sound Devices". Using the drop down box "Sound In", I did a bit of "trail and error" to find the correct setting and required a restart of X when I selected some of the incorrect options. In the end, my correct setting was "Intel ICH5 (hw:ICH6,0)" and yielded a very clear voice using the Skype Test Call" service. Your setting will probably be similar but different.
From other experimentation, I set the "Sound Out" and "Ringing" to "pulse".

References:

Disclaimer:
This solution worked for me. It may or may not work for you. I am not responsible for your actions nor the your results of your actions should you act on what you read here. I do not claim expertise in this very specific area and only convey my experience. There is no warranty on this (and most) free information.

Followup (July 26,2009):

Based on experiences with Fedora 10 and Fedora 11, the above suggestions are not absolute. In fast, they only highlight the "control points" but generally will not solve the problem. During subsequent testing, I found that a change in configuration required a reboot to truly get a definitive result. For Fedora 11, I finally gave up and configured directly against the hardware layer and not with PulseAudio.

Solved: Restoring the Master Boot Record (MBR) to the boot drive

2008-06-23T11:33:00.000-05:00

Context: Missing or corrupted Master Boot Record (or MBR) can and usually will prevent booting a computer.

Problem: Having botched a Linux installation, the Master Boot Record (MBR) was destroyed. To recover and boot the computer again, the MBR must be restored to work order.

Constraints:

No floppy drive
BIOS doesn't support USB booting
CD ROM limited on ability to read different CDs
Windows booted from the MBR directly so I could not use Microsoft's fdisk
Lilo was not found on the Fedora 9 Live CD
Grub-install on the Fedora 9 Live CD did not function according to expectation

Details: Installing Fedora 9 Live CD to an Dell Latitude C600, I didn't allow enough room for the Live CD install (I misremembered options for a selective install.) Additionally, a previous GRUB installation on the Master Boot Record was not clean off before installation started. Near the end of the installation, an error occurred (out of space.) The result was a damaged MBR record. The exact cause of the damage was not known.

Solution: Restore MBR from

Boot Fedora 9 Live CD
Confirm presents of file usr/lib/syslinux/mbr.bin
Open a Xterm or other shell
Log in as root or superuser
Umount the targeted drive partition. In my case:

umount /sda1

Write the replace MBR to the drive:

dd if=/usr/lib/syslinux/mbr.bin of=/dev/sda bs=1

reboot

Note!: This was a "long shot" action on my behalf and thus a risk on anyone following these instructions. The contents of the file mbr.bin were a guess on my part as was the correct use and application of dd. While this works, you should know that your results may vary greatly. Use these instructs only as a last resort! Please read the disclaimers section.

References:

Solved: Adding NVidia Support to Fedora 9

2008-06-22T02:57:00.000-05:00

Context: Installing correct, high performance NVida drivers for Fedora 9.

Problem: The default video drivers provided by the Fedora project work fine. However, enhancements such as 3D Desktop are only available with updated drivers. If you do not have an NVidia video card, this blog entry may not assist you with video card concerns.

Details: The Fedora project is stated that is wishes to avoid any contentious software, either from ownership or patent concerns. NVidia is a privately own company and thus their video drivers appear to fall under this concern. See the first link in the reference section for more details.

Solution: Add an additional third-party repository to your "Update Sources":

Do a full system update with existing installed software
Go to http://rpm.livna.org/rlowiki/
Download Fedora 9 repository RPM and install it
Perform an "Update System", search, and install "akmod-nvida-xx", where xx is the latest (or last known good) version of the drivers.
Follow the directions after the installation. I usually reboot after large installations since Fedora 9's update mechanism does not seem to be notifying or enforcing reboot-needed rules.

Note: the Livna source provides other package updates that Fedora 9's default repository sources do not provide.

Note: In general, adding additional repository sources is a security risk and should be under taken with this in mind.

Note!: I would advise that you limit the inclusion of software from third-party sites to only those specific items you want and only if they are well separated from other elements of your operating system. You can easily have conflicts between different built libraries which can cripple your operating system in the matter of a few button clicks. Know what you are installing, where it's from and how it will (or won't) "Play Nice" with other elements.

References:

Solved: Booting Fedora 9 Live CD on Dell Latitude C600

2008-06-21T09:21:00.000-05:00

Context: Booting Fedora 9 Live CD on Dell Latitude C600

Problem: split screen into 2 or three panels at 800x600.

Details: Fedora 9 Live CD detects built-in video card as "ATI Rage 128 M 2G and display type as "Autoconfigured".

Solution:

Note: this solution requires you to "deal with" the incorrect video settings for a brief period of time.

Boot from Fedora 9 Live CD and log in to default login

If the the screen is divided into sections and generally not working, continue. If it's perfect, you're done. Don't make any changes based on what I say in this blog entry.

Move Application panel to left hand side. This will allow you to see more of the menus. Do this by clicking in the grey area next to the mail icon, click and drag to the left side of the screen.

Go to menus "System | Administration | Display", then the "Hardware" tab. Make the following changes:

Display: "LCD Panel 800x600"
Video Driver: "Vesa -Generic VESA-compliant video cards"
Press Ok to commit these changes

Press keys CTRL ALT BACKSPACE to restart the X Window System only.

Do not reboot - any changes made will be lost during a reboot as they only reside in memory.

After you log in again, I was (you might be) able to see the screen correctly.

Note: I tried "LCD Panel 1024x768" the first time with no positive results.

References:
I located some information, ideas, clues or inspiration from the following locations. I am not responsible for external content nor it's availability:

http://ubuntuforums.org/archive/index.php/t-769002.html

When SELinux bites, tell SELinux to go bite it's self

2008-04-21T14:31:00.000-05:00

SELinux is a rather impressive, if not annoying efficient process and access-based security system for Linux. I currently enjoy the warm, affectionate glow of alerts on Fedora 8.

As useful as SELinux can be, there are easy ways to make it squeal like a stuck pig (i.e. complain frequently.) My last "stuck pig episode" included a few 25M log files of nothing but squealing. At issue, was a mislabeled file that sendmail wanted to access. After causing my internal email to queue up more than 4000 messages, I decided to work on it.

If I had the specific path to the offending object(s) listed in the alert message, I could have solved this problem with something like:

# Fedora 8: tell SELinux to restore
#   default security labels to a file
#   or directory:
/sbin/restorecon 'services'
/sbin/restorecon -R '.'

Common net-thinking is that the default labels are occasionally fouled when some updates occur. They are most likely fouled more frequently by users editing in their home directory and promoting them into a new location on the file system without handling the security labeling (which is actually the point of this kind of security: know what you are doing and tell the OS what is and isn't OK to do.)

After trying to use the alert system's recommendation, I finally looked for a more blunt instrument (the alert needed to have an absolute path for the offending element so that I could have a change to locate and fix it.)

So, I went to my friend, my buddy, my pal: Google. Google told me (indirectly) to look here for this pearl of wisdom:

# Fedora 8: tell SELinux to restore
#   security labels to all files:
touch /.autorelabel
reboot

This operation asks SELinux to reapply the default security labels to all files on the file systems after a reboot. This "relabel them all and let Root sort them out" approach may have solved more problems than I knew.

Note: I am not running any custom policies yet so there wasn't a conflict for me.

Using SSH and SOCKS to access the web [via Firefox] from remote computer

2008-04-07T03:38:00.000-05:00

Source(s)

Information provided in this post was originally located here:
http://www.noah.org/wiki/Category:SSH#SOCKS5_with_Firefox

Description

Occasionally, it is necessary to "web surf from afar". Less about security than about originating IPs, I found a need to create a secure connection so I may web surf as if I were on a different computer.
Use Case 1: Some corporations do not want access to popular or potentially harmful web sites.

Use Case 2: Some websites do not service users from some IP ranges, i.e. from out of the country of hosting.

Setup

SSH Tunnel
In this solution, will will use an encrypted connection between the local computer and a remote computer that you have access and is running and ssh daemon. This solution will create a local computer port that will allow anything sent to this port to be transported to the remote computer and on to it's destination as if it had originated from the remote computer.

On the local computer:
ssh -N -C -D 9999 USER_NAME@IP_ADDRESS
-N : do not open an interactive console on the remote computer [optional]
-C : use compression [optional]
-D : use SOCKS 5 [required]
9999 : local computer port to uses to access the SOCKS proxy [a port # is required, not necessarily 9999]
USER_NAME@IP_ADDRESS : the user name and remote computer information [require most likely]
Note: This connection will persist until the computer is rebooted or you find and kill the associated ssh task in the process list. That being said, be careful not to start more than one ssh tunnel to the same computer.

FireFox Proxy
Use menus Tools | Options
Click on Advanced icon
Select Network tab
Press Settings button
Select Manual Proxy Configuration radio button
Enter localhost and port 9999 on the SOCKS Host and Port.
Press Apply/OK until all extra dialog boxes are closed.
You are now ready to web surf though the remote computer.
Note: I recommend using a proxy switcher extension so you can enable and disable the use of the proxy without needing to go though the menus and dialogs, as shown above. Here is one for example.

How to create a Strong(er) password

2008-03-11T09:19:00.000-05:00

Generating a strong password is critical in today's highly networked societies. Yet, I often find that people don't use good passwords. They use a plain name of a person or a series of numbers, apparently thinking "it doesn't matter much." Having just spend 2 days looking at a friends computer because of problems related to a "break in" and untold information theft, I can tell you that security definitely matters.

Microsoft was it's own ideas about how to create strong passwords of course and so does Wikipedia. You can even find password strength checkers online like this one here.

Another problem is that most people "think predictably". I mean, its hard to "think randomly." In truth, I have the same problem. And it was impacting my ability to create a truly random and strong(ish) password without letting a machine create one for me. Following is a common technique I use for creating a "random and strong password".

The Problems

First, what are the top problems I encountered with creating new passwords, especially strong passwords? Here's my list:

hard to remember and so they usually end up short in length
based on words I could remember and so they could be broken easier
need of multiple passwords and so I tended to reuse the same password and write them down on the computer I was sitting in front of.

The Risks

Each one of these is in fact a security risk:

Short passwords take very little time to determine
Passwords based on words are very easy to determine
Once a system is compromised, that password can be tested at other target-related sights

These were the problems I wanted to solve and the best way to solve them is to avoid them all together.

The Key

The hardest thing for me was to not write my passwords down and referring to them often. Human memory isn't always perfect. So, my initial challenge was how to associate a strong password with something I would remember and, later, make it scale up for both small passwords and longer passwords. The key was "context".

The Process

By establish a context for password use, I was able to a "play ground" for creating stronger passwords. So what is a context? It's the name of the situation or object that best describes a group of elements which are relate to each other.

Example: chairs, table, plates, forks, spoons, stove, refrigerator = a context called "kitchen"

So, here is the basic process:

Note: this process is more easily done with a simple text editor on the computer than with pen and paper.

The Steps
With the context in mind:

Create a list of that are related to the context. Proper nouns are best, followed by obscure verbs.

Note: Each entry should be on it's own line. This is important.

Between every word, insert a blank line.
Between every other word, add a number related to the context. I there are no numbers associated with the context, apply 3 or 4 digit "random numbers."
Between every other word that has a blank line, add a number (as before) while holding the SHIFT key down. This will result in non-number characters of course.
Somewhere in the middle of the list, insert one or more words about how you feel about this context or other descriptive words. You might even use a random and unrelated word, number or series of characters.
Now, take the first character of each line and type them on a line. This is your random password.

If you run out of characters on a line, just skip that line from now on and continue with the next line.

Also skip spaces too as they can accumulate too quickly. One space in a password is OK but not recommended.
When you get to the bottom of the list, start again at the top with the next character.

Once you have more than 8 characters, you should have a medium strong password and 10 or more should be a stronger password. The longer the password word, the better.

Example:

As I said, context is the key. Let's pick a silly context for this example. Let's say we need a password for the refrigerator in the kitchen (apparently there is a midnight bandit eating the extra pieces of pie!) So, kitchen refrigerator is the context and I want a very strong password, 10 or more characters strong.

Note: Below, I have used an exaggerated list to show the idea behind using a context for strong and memorable password generation. A shorter list will work just as well or better.

list of words related to the context

house
Franklin
refrigerator
Whirlpool
kitchen
last piece of mom's apple pie
Midnight Invader

add blank lines

house
Franklin
refrigerator
Whirlpool
kitchen
last piece of mom's apple pie
Midnight Invader

add numbers between every second word

house
3391
Franklin
refrigerator
19
Whirlpool
kitchen
4
last piece of mom's apple pie
Midnight Invader
2

add more numbers with the SHIFT key held down

house
3391
Franklin
##(!
refrigerator
19
Whirlpool
$
kitchen
4
last piece of mom's apple pie
^%&-)
Midnight Invader
2

Insert a random word

house
3391
Franklin
##(!
refrigerator
19
Whirlpool
$
kitchen
4
last piece of mom's apple pie
^%&-)
Rotten Bastard
Midnight Invader
2

Create your strong passwords:

8 character, short and strong password: h2F#r1W$
11 character, medium and strong password: h2F#r1W$k4l
14 character, longer and stronger password: h2F#r1W$k4l^RM

Now, how is h3Fs#r1W more memorable? Well, no and yes. I found the more efforts I made into constructing the password, based on a context, the more likely I was to remember it.

The Variations

You can also add your own steps to the process: maybe you take two characters from line instead one each time; maybe you add a character from another language (Greek, Russian?)

Summary

Password security is becoming increasingly important and should be treated as important as what you do with your computer (or other mechanisms.) Because if you choose to ignore good password policies and "make it simple", chances are that whatever you are weakly protecting will be used by others with or without your permission and knowledge.