Tabla de contenidos
Aquí, describo los trucos fundamentales para configurar y gestionar sistemas, principalmente desde la consola.
Screen(1) es una herramienta muy útil para el acceso remoto a sitio con conexiones no confiables o intermitentes ya que permite conexiones con redes cuya conectividad es intermitente.
Tabla 9.1. Enumeración de programas que permiten conexiones de red intermitentes
paquete | popularidad | tamaño | descripción |
---|---|---|---|
screen
|
V:170, I:288 | 981 | Multiplexador de terminal con emulación de terminal VT100/ANSI |
Screen(1) no solo permite trabajar con múltiples procesos en un único terminal, si no que también que el proceso del intérprete de órdenes remoto sobreviva a la interrupción de las conexiones. Aquí está un escenario típico de utilización de screen(1).
Usted acceda a un equipo remoto.
Inici screen
en una única consola.
Ejecute múlitples programas en la ventana de screen
con
^A c
("Control-A" seguido por "c").
Puede cambiar entre las múltiples ventanas de screen
con
^A n
("Control-A" seguido de "n").
Si repentinamente necesita dejar su terminal, pero no quiere perder su trabajo activo por la mantener la conexión.
Se puede separar la sesión
screen
por cualquier método.
Desconexión forzada de su conexión de red
Pulse ^A d
("Control-A" seguido de "d") y cierre
manualmente la conexión remota
Pulse ^A DD
("Control-A" seguido de "DD") para que
screen
separe y cierre su sesión
Si inicia la sesión otra vez al mismo equipo remoto (incluso desde un terminal diferente).
Inicie screen
con "screen -r
".
Screen
magicamente reconecta con todas las ventanas anteriores de
screen
con todos los programas activos ejecutandose.
![]() |
Sugerencia |
---|---|
Puede guardar la entrada de la conexión con |
En una sesión de screen
, todas las entradas de teclado
son enviadas a la ventana actual excepto las que son combinaciones de
teclado de órdenes. Todas las combinaciones de teclas de órdenes
screen
se inician pulsando ^A
("Control-A") más otra tecla [más algunos parámetros]. Aquí estan algunos
importantes a recordar.
Tabla 9.2. Enumeración de los atajos de teclado para screen
Función | significado |
---|---|
^A ?
|
muestra la ayuda de screen (muestra los atajos de teclado) |
^A c
|
crea una nueva ventana y cambia a ella |
^A n
|
ir a la siguiente ventana |
^A p
|
ir a la ventana anterior |
^A 0
|
va a la ventana 0 |
^A 1
|
va a la ventana número 1 |
^A w
|
muestra una lista de las ventanas |
^A a
|
envia un Ctrl-A a la ventana actual como entrada de teclado |
^A h
|
escribe una copia de la ventana actual a un archivo |
^A H
|
inicia/finaliza la grabación de la ventana actual a un archivo |
^A ^X
|
bloquea la terminal (protegido por contraseña) |
^A d
|
separa la sesión de screen de la terminal |
^A DD
|
separa la sesión de screen y sale |
Para más detalles consulte screen(1).
Muchos programas registran sus actividades en el directorio
"/var/log/
".
El demonio de registro del núcleo: klogd(8)
El demonio de registro del sistema: rsyslogd(8)
Consulte Sección 3.2.9, “El sistema de mensajes” y Sección 3.2.10, “Los mensajes del núcleo”.
Aquí estan los analizadores de trazas más importantes
("~Gsecurity::log-analyzer
" en
aptitude(8)).
Tabla 9.3. Enumeración de analizadores de trazas del sistema
paquete | popularidad | tamaño | descripción |
---|---|---|---|
logwatch
|
V:19, I:21 | 2189 | analizador de trazas con una buena generación de salida escrito en Perl |
fail2ban
|
V:92, I:103 | 1253 | prohibición de las IPs con múltiples errores de acreditación |
analog
|
V:5, I:129 | 3529 | analizador de trazas para servidores web |
awstats
|
V:12, I:20 | 6588 | analizador de trazas para servidores web potente y con diversas funcionalidades |
sarg
|
V:6, I:6 | 432 | generador de informes de análisis de squid |
pflogsumm
|
V:1, I:4 | 110 | generador de resumenes de las trazas de postfix |
syslog-summary
|
V:1, I:5 | 30 | generador de resumenes del contenido del archivo de trazas de syslog |
fwlogwatch
|
V:0, I:0 | 474 | analizador de trazas de cortafuegos |
squidview
|
V:0, I:2 | 188 | controla y analiza los archivos access.log de squid |
swatch
|
V:0, I:1 | 112 | log file viewer with regexp matching, highlighting, and hooks |
crm114
|
V:0, I:1 | 1099 | Filtro de spam y filtro mediante expresiones regulares programables (CRM114) |
icmpinfo
|
V:0, I:1 | 39 | intérprete de mensajes ICMP |
![]() |
Nota |
---|---|
CRM114 tiene un lenguaje que permite escribir borrosos filtros con la biblioteca de expresines regulares TRE . Su uso más común es como filtro de correos no deseados pero puede ser utilizado también como analizador de trazas. |
La utilización para el registro de la actividad del intérprete de órdenes, sin más, de script(1) (see Sección 1.4.9, “Grabando las actividades de los intérpretes de órdenes”) produce un archivo con carácteres de control. Esto se puede evitar con la utilización de col(1) como se muestra.
$ script Script started, file is typescript
Haga lo que quiera ... y pulse Ctrl-D
para finalizar
script
.
$ col -bx <typescript >archivo_filtrado $ vim cleanedfile
Si no utiliza script
(por ejemplo, durante el proceso de
arranque en initramfs), puede utilizar lo siguiente.
$ sh -i 2>&1 | tee typescript
![]() |
Sugerencia |
---|---|
Algunos |
![]() |
Sugerencia |
---|---|
Puede utilizar
screen(1)
con " |
![]() |
Sugerencia |
---|---|
Puede usar
emacs(1)
con " |
Aunque las herramientas de paginación como more(1) y less(1) (consulte Sección 1.4.5, “El paginador”) y herramientas personalizadas para marcar y dar formato (see Sección 11.1.8, “Highlighting and formatting plain text data”) pueden visualizar los datos de texto de la forma correcta, los editores de propósito general (consulte Sección 1.4.6, “El editor de texto”) son más versátiles y personalizables.
![]() |
Sugerencia |
---|---|
En
vim(1)
y su modo de paginación conocido como
view(1),
" |
El formato de visualización del tiempo y la fecha de la órden "ls
-l
" depende de la configuración
regional (consulte sus valores en Sección 1.2.6, “Sellos de tiempo”). La variable "$LANG
" se tiene en
cuenta primero y puede ser sobreescrita por el valor de la variable
"$LC_TIME
".
El formato de visualización por defecto actual para cada configuración
regional depende de la versión de la biblioteca estándar C (el paquete
utilizado libc6
). Esto es, diferentes versiones de Debian
tienen diferentes valores por defecto.
Si de verdad quiere personalizar el formato de visualización de la hora y la
fecha independientemente de la configuración
regional, debería asignar el valor de
estilo de tiempo por el argumento
"--time-style
" o por el valor de
"$TIME_STYLE
" (consulte
ls(1),
date(1),
"info coreutils 'ls invocation'
").
Tabla 9.4. Son ejemplos de hora y fecha para la órden "ls -l
" en
wheezy
valor del estilo de la hora | configuración regional | visualización de la hora y la fecha |
---|---|---|
iso
|
cualquiera |
01-19 00:15
|
long-iso
|
cualquiera |
2009-01-19 00:15
|
full-iso
|
cualquiera |
2009-01-19 00:15:16.000000000 +0900
|
configuración regional
|
C
|
Jan 19 00:15
|
configuración regional
|
en_US.UTF-8
|
Jan 19 00:15
|
configuración regional
|
es_ES.UTF-8
|
ene 19 00:15
|
+%d.%m.%y %H:%M
|
cualquiera |
19.01.09 00:15
|
+%d.%b.%y %H:%M
|
C o en_US.UTF-8
|
19.Jan.09 00:15
|
+%d.%b.%y %H:%M
|
es_ES.UTF-8
|
19.ene.09 00:15
|
![]() |
Sugerencia |
---|---|
Puede evitar escribir largas opciones en las líneas de órdenes utilizando
alias de órdenes , p. ej. " |
![]() |
Sugerencia |
---|---|
ISO 8601 se sigue los siguientes formatos iso. |
En los mśa recientes terminales se pueden utilizar colores utilizando secuencias de escape ANSI (consulte
"/usr/share/doc/xterm/ctlseqs.txt.gz
").
Por ejemplo, intente lo siguiente
$ RED=$(printf "\x1b[31m") $ NORMAL=$(printf "\x1b[0m") $ REVERSE=$(printf "\x1b[7m") $ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"
Órdenes de colores son útiles para la comprobación visual de la salida en
entornos interactivos. Yo añado lo siguiente en mi
"~/.bashrc
".
if [ "$TERM" != "dumb" ]; then eval "`dircolors -b`" alias ls='ls --color=always' alias ll='ls --color=always -l' alias la='ls --color=always -A' alias less='less -R' alias ls='ls --color=always' alias grep='grep --color=always' alias egrep='egrep --color=always' alias fgrep='fgrep --color=always' alias zgrep='zgrep --color=always' else alias ll='ls -l' alias la='ls -A' fi
La utilización de alias limita los efectos del color en el uso de órdenes
interactivas. Tiene ventajas sobre las variables de entorno exportadas
"export GREP_OPTIONS='--color=auto'
" ya que el color
pueder verse en los programas de paginación como
less(1).
Si quiere eliminar el color cuando usa tuberías con otros programas, utilice
"--color=auto
" en su lugar en los ejemplos anteriores
"~/.bashrc
".
![]() |
Sugerencia |
---|---|
Puede deshabilitar los alias de color en un entorno interactivo llamando al
intérprete de órdenes con " |
Puede guardar las actividades del editor con repeticones complejas.
Para Vim, como sigue.
"qa
": comienza a grabar los carácteres escritos en un
registro llamado "a
".
… actividades del editor
"q
": finaliza la grabación de los carácteres escritos.
"@a
": ejecuta el contenido del registro
"a
".
Para Emacs, como sigue.
"C-x (
": comienza a definir una macro de teclado.
… actividades del editor
"C-x )
": termina definir una macro de teclado.
"C-x e
": ejecuta una macro de teclado.
Existen varias maneras de grabar una imagen gráfica de una aplicación X,
incluida una pantalla de xterm
.
Tabla 9.5. Enumeración de herramientas de manipulación de imágenes
paquete | popularidad | tamaño | orden |
---|---|---|---|
xbase-clients
|
I:76 | 46 | xwd(1) |
gimp
|
V:97, I:509 | 16255 | menú GUI |
imagemagick
|
V:154, I:544 | 191 | import(1) |
scrot
|
V:7, I:84 | 50 | scrot(1) |
Existen herramientas especializadas para guardar los cambios de los archivos de configuración con la ayuda de sistemas como DVCS.
Tabla 9.6. Enumeración de paquetes para guardar el histórico de configuraciones en VCS
paquete | popularidad | tamaño | descripción |
---|---|---|---|
etckeeper
|
V:22, I:26 | 151 | almacena los archivos de configuración y sus metadatos con Git (por defecto), Mercurial, o Bazaar (nuevo) |
changetrack
|
V:0, I:0 | 62 | almacena los archivos de configuración con RCS (antiguo) |
Recomiendo la utilización del paquete etckeeper
congit(1)
que incluye entero el directorio "/etc
" bajo control
CVS. Su guía de instalación y tutorial se puede encontrar en
"/usr/share/doc/etckeeper/README.gz
".
Fundamentalmente, ejecutando "sudo etckeeper init
" inicia
el repositorio git de "/etc
" tal como se explica enSección 10.6.5, “Git for recording configuration history” pero con algunos
archivos de órdenes para una configuración más minuciosa.
Cuando cambie su configuración, puede utilizar git(1) de forma normal para guardarla. También y de forma automática guarda los cambios cada vez que ejecuta órdenes de gestión de paquetes .
![]() |
Sugerencia |
---|---|
Puede navegar por el historial de cambios de " |
Las actividades de los programas pueden ser monitoreados y controlados utilizando herramientas especializadas.
Tabla 9.7. Enumeración de las herramientas de monitorización y control de las actividades de los programas
paquete | popularidad | tamaño | descripción |
---|---|---|---|
coreutils
|
V:876, I:999 | 14642 | nice(1): ejecuta un programa modificando su prioridad de planificación |
bsdutils
|
V:846, I:999 | 238 | renice(1): cambia la prioridad de planificación de un proceso en ejecución |
procps
|
V:800, I:999 | 690 |
"/proc " utilidades del sistema de archivos:
ps(1),
top(1),
kill(1),
watch(1),
…
|
psmisc
|
V:590, I:974 | 588 |
"/proc " utilidades del sistema de archivos:
killall(1),
fuser(1),
peekfd(1),
pstree(1)
|
time
|
V:43, I:842 | 81 | time(1): ejecuta un programa para crear un informe de los recursos del sistema utilizados a lo largo del tiempo |
sysstat
|
V:95, I:113 | 1332 | sar(1), iostat(1), mpstat(1), …: herramientas de optimización del sistema en Linux |
isag
|
V:0, I:4 | 106 | Graficador Interactivo de la Actividad del Sistema para sysstat |
lsof
|
V:361, I:944 | 440 | lsof(8):
enumera la lista de archivos abiertos por un proceso en ejecución utilizando
la opción "-p "
|
strace
|
V:23, I:165 | 1223 | strace(1): registro de las llamadas del sistema y señales |
ltrace
|
V:1, I:23 | 323 | ltrace(1): registro a las bibliotecas invocadas |
xtrace
|
V:0, I:1 | 336 | xtrace(1): registra las comunicaciones entre el cliente y el servidor en X11 |
powertop
|
V:6, I:229 | 563 | powertop(1): información sobre el uso de la potencia por parte del sistema |
cron
|
V:874, I:997 | 194 | ejecuta procesos en segundo plano de acuerdo a su planificación desde el dominio cron(8) |
anacron
|
V:452, I:539 | 62 | planficador de tareas similar a cron para los sistemas que no están activos 24 horas al dia |
at
|
V:500, I:850 | 145 | at(1) or batch(1): ejecuta un trabajo at en un momento determinado o por debajo de cierto nivel de carga |
![]() |
Sugerencia |
---|---|
El paquete |
Muestra el tiempo utilizado por un proceso invocado por la órden.
# time alguna_órden >/dev/null real 0m0.035s # timepo de reloj (tiempo real transcurrido) user 0m0.000s # tiempo en modo usuario sys 0m0.020s # tiempo en modo núcleo
Un valor de "nice" se utiliza para determinar la prioridad de planificación de los procesos.
Tabla 9.8. Lista de valores de nice para la prioridad de planificación
Valor de nice | prioridad de planificación |
---|---|
19 | proceso de menor prioridad (nice) |
0 | proceso de muy alta prioridad para el usuario |
-20 | proceso de superusuario (no nice) de muy alta prioridad |
# nice -19 top # muy nice # nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # muy rápido
Algunas veces un valor extremo de nice produce más mal que bien al sistema. Utilice esta órden con cuidado.
La órden ps(1) en un sistema Debian aportan tanto las funcionalidades de SystemV y BSD y ayuda a identificar la actividad estática del proceso.
Tabla 9.9. LIsta de estilo de la órden ps
estilo | órden típica | funcionalidad |
---|---|---|
BSD |
ps aux
|
muestra %CPU %MEM |
System V |
ps -efH
|
visualiza PPID |
Para los procesos hijos zombies (muertos) , los puede eliminar mediante el
identificador del proceso padre que corresponde al campo
"PPID
".
La órden pstree(1) muestra el árbol de procesos.
top(1) en el sistema Debian es rico desde el punto de vista funcional y ayuda a identificar que procesos actuan de forma extraña puntualmente.
Es un programa a pantalla completa interactivo. Puede obtener ayuda pulsando la tecla "h" y salir pulsando la tecla "q".
Puede enumerar los archivos abiertos por un proceso con el identificador de proceso (PID), p. ej. 1, con lo siguiente.
$ sudo lsof -p 1
PID=1 generalmente es del programa init
.
Puede trazar la actividad de un programa, invocaciones al sistema, señales, invocaciones a bibliotecas o comunicaciones entre el cliente y servidor X11, con strace(1), ltrace(1), o xtrace(1).
Puede seguir las invocaciones del sistema de la órden ls
con se muestra.
$ sudo strace ls
También puede identificar procesos utilizando archivos mediante
fuser(1),
p. ej. para "/var/log/mail.log
" como se muestra.
$ sudo fuser -v /var/log/mail.log USER PID ACCESS COMMAND /var/log/mail.log: root 2946 F.... rsyslogd
Puede ver que el archivo "/var/log/mail.log
" esta abierto
en escritura por la órden
rsyslogd(8).
También puede identificar un proceso por la utilización de sus conexiones
(sockets) mediante
fuser(1),
p. ej. para "smtp/tcp
" como se muestra.
$ sudo fuser -v smtp/tcp USER PID ACCESS COMMAND smtp/tcp: Debian-exim 3379 F.... exim4
Ahora sabe que su sistema ejecuta exim4(8) con el fin de gestionar las conexiones TCP del puerto SMTP (25).
watch(1) ejecuta un programa de forma reiterada a un intervalo constante mientras muestra la salida del programa a pantalla completa.
$ watch w
Esto muestra quién está acreditado en el sistema y lo actualiza cada 2 segundos.
Existen varias formas de repetir una órden en bucle sobre archivos que
cumplen una condición, p. ej, encajan en un patrón
"*.ext
".
Método del bucle for del intérprete de órdenes (see Sección 12.1.4, “Shell loops”):
for x in *.ext; do if [ -f "$x"]; then órden "$x" ; fi; done
Combinación de find(1) y xargs(1):
find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 órden
find(1)
con la ópcion "-exec
" y una órden:
find . -type f -maxdepth 1 -name '*.ext' -exec órden '{}' \;
find(1)
con la opción "-exec
" con un archivo de órdenes pequeño:
find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "órden '{}' && echo 'successful'" \;
Los ejemplos anteriores están escritos para asegurar el correcto tratamiento de los nombres de archivos que contienen carácteres raros como los espacios. Para usos avanzados de find(1) consulte Sección 10.1.5, “Idioms for the selection of files”.
Para el interfaz de órdenes en línea
(CLI), el programa ejecutado será el primero que encaja el nombre en
el directorio especificdo por la variable de entorno
$PATH
. Consulte Sección 1.5.3, “La variable "$PATH
"”.
Para el interfaz gráfico de usuario
(GUI) que cumple con el estándar de freedesktop.org, los archivos
*.desktop
en el directorio
/usr/share/applications/
proporciona los atributos
necesarios para la visualización de cada programa en el menú del interfaz
gráfico de usuario. Consulte Sección 7.2.2, “Menú de Freedesktop.org”.
Por ejemplo, el archivo chromium.desktop
define los
atributos para el "Navegador Web Chromium" como "Name" para el nombre del
programa, "Exec" para la ruta de ejecución del programa y argumentos, "Icon"
para el icono utilizado, etc. (consulte la Especificación de Entradas del Escritorio
(Desktop Entry Specification)) como sigue:
[Desktop Entry] Version=1.0 Name=Chromium Web Browser GenericName=Web Browser Comment=Access the Internet Comment[fr]=Explorer le Web Exec=/usr/bin/chromium %U Terminal=false X-MultipleArgs=false Type=Application Icon=chromium Categories=Network;WebBrowser; MimeType=text/html;text/xml;application/xhtml_xml;x-scheme-handler/http;x-scheme-handler/https; StartupWMClass=Chromium StartupNotify=true
Esta es una descripción muy simplificadao. Los archivos
*.desktop
son revisados como sigue.
El entorno de escritorio asigna las variables del entorno
$XDG_DATA_HOME
and $XDG_DATA_DIR
. Por
ejemplo, en GNOME 3:
$XDG_DATA_HOME
esta sin asignar. (El valor por defecto
que se utiliza es $HOME/.local/share
.)
$XDG_DATA_DIRS
se le asigna el valor
/usr/share/gnome:/usr/local/share/:/usr/share/
.
Así los directorios base (consulte XDG Base Directory
Specification) y los directorios de aplicaciones
quedan como sigue.
$HOME/.local/share/
→
$HOME/.local/share/applications/
/usr/share/gnome/
→
/usr/share/gnome/applications/
/usr/local/share/
→
/usr/local/share/applications/
/usr/share/
→ /usr/share/applications/
Los archivos *.desktop
se comprueban en estos
directorios de aplicaciones
siguiendo este órden.
![]() |
Sugerencia |
---|---|
Se puede crear una entrada personalizada al menú del interfaz gráfico de
usuario (GUI) añadiendo un archivo |
![]() |
Sugerencia |
---|---|
Igualmente, si se crea un archivo |
![]() |
Sugerencia |
---|---|
De igual manera, si un archivo |
Algunos programas inician otros programa de forma automática. Aquí estan los puntos a compribar para la personalización de este proceso.
Menú de configuración de aplicaciones:
GNOME3 desktop: "Settings" → "System" → "Details" → "Default Applications"
KDE desktop: "K" → "Control Center" → "KDE Components" → "Component Chooser"
Iceweasel browser: "Edit" → "Preferences" → "Applications"
mc(1):
"/etc/mc/mc.ext
"
Environment variables such as "$BROWSER
",
"$EDITOR
", "$VISUAL
", and
"$PAGER
" (see
eviron(7))
The
update-alternatives(8)
system for programs such as "editor
",
"view
", "x-www-browser
",
"gnome-www-browser
", and "www-browser
"
(see Sección 1.4.7, “Configurando el editor de texto por defecto”)
the "~/.mailcap
" and "/etc/mailcap
"
file contents which associate MIME type with
program (see
mailcap(5))
The "~/.mime.types
" and
"/etc/mime.types
" file contents which associate file name
extension with MIME type (see
run-mailcap(1))
![]() |
Sugerencia |
---|---|
update-mime(8)
updates the " |
![]() |
Sugerencia |
---|---|
The |
![]() |
Sugerencia |
---|---|
In order to run a console application such as |
# cat /usr/local/bin/mutt-term <<EOF #!/bin/sh gnome-terminal -e "mutt \$@" EOF chmod 755 /usr/local/bin/mutt-term
Use kill(1) to kill (or send a signal to) a process by the process ID.
Use killall(1) or pkill(1) to do the same by the process command name and other attributes.
Tabla 9.10. List of frequently used signals for kill command
signal value | signal name | función |
---|---|---|
1 | HUP | restart daemon |
15 | TERM | normal kill |
9 | KILL | kill hard |
Run the at(1) command to schedule a one-time job by the following.
$ echo 'command -args'| at 3:40 monday
Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).
You can schedule to run processes as a normal user,
e.g. foo
by creating a
crontab(5)
file as "/var/spool/cron/crontabs/foo
" with
"crontab -e
" command.
Here is an example of a crontab(5) file.
# use /bin/sh to run commands, no matter what /etc/passwd says SHELL=/bin/sh # mail any output to paul, no matter whose crontab this is MAILTO=paul # Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed) # run at 00:05, every day 5 0 * * * $HOME/bin/daily.job >> $HOME/tmp/out 2>&1 # run at 14:15 on the first of every month -- output mailed to paul 15 14 1 * * $HOME/bin/monthly # run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc: 0 22 * * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%% 23 */2 1 2 * echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1" 5 4 * * sun echo "run at 04:05 every Sunday" # run at 03:40 on the first Monday of each month 40 3 1-7 * * [ "$(date +%a)" == "Mon" ] && command -args
![]() |
Sugerencia |
---|---|
For the system not running continuously, install the
|
![]() |
Sugerencia |
---|---|
For scheduled system maintenance scripts, you can run them periodically from
root account by placing such scripts in
" |
Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system.
Tabla 9.11. List of SAK command keys
key following Alt-SysRq | description of action |
---|---|
r
|
restore the keyboard from raw mode after X crashes |
0
|
change the console loglevel to 0 to reduce error messages |
k
|
kill all processes on the current virtual console |
e
|
send a SIGTERM to all processes, except for init(8) |
i
|
send a SIGKILL to all processes, except for init(8) |
s
|
sync all mounted filesystems to avoid data corruption |
u
|
remount all mounted filesystems read-only (umount) |
b
|
reboot the system without syncing or unmounting |
![]() |
Sugerencia |
---|---|
Read the signal(7), kill(1), and sync(1) manpages to understand the description above. |
The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations and gaining usable keyboard access without stopping the system.
See
"/usr/share/doc/linux-doc-3.*/Documentation/sysrq.txt.gz
".
![]() |
Atención |
---|---|
The Alt-SysRq feature may be considered a security risk by allowing users
access to root-privileged functions. Placing " |
![]() |
Sugerencia |
---|---|
From SSH terminal etc., you can use the Alt-SysRq feature by writing to the
" |
You can check who is on the system by the following.
who(1) shows who is logged on.
w(1) shows who is logged on and what they are doing.
last(1) shows listing of last logged in user.
lastb(1) shows listing of last bad logged in users.
![]() |
Sugerencia |
---|---|
" |
You can send message to everyone who is logged on to the system with wall(1) by the following.
$ echo "We are shutting down in 1 hour" | wall
For the PCI-like devices (AGP, PCI-Express,
CardBus, ExpressCard, etc.),
lspci(8)
(probably with "-nn
" option) is a good start for the
hardware identification.
Alternatively, you can identify the hardware by reading contents of
"/proc/bus/pci/devices
" or browsing directory tree under
"/sys/bus/pci
" (see Sección 1.2.12, “procfs y sysfs”).
Tabla 9.12. List of hardware identification tools
paquete | popularidad | tamaño | descripción |
---|---|---|---|
pciutils
|
V:170, I:992 | 1220 | Linux PCI Utilities: lspci(8) |
usbutils
|
V:107, I:864 | 707 | Linux USB utilities: lsusb(8) |
pcmciautils
|
V:24, I:59 | 121 | PCMCIA utilities for Linux: pccardctl(8) |
scsitools
|
V:0, I:4 | 351 | collection of tools for SCSI hardware management: lsscsi(8) |
procinfo
|
V:1, I:17 | 183 |
system information obtained from "/proc ":
lsdev(8)
|
lshw
|
V:10, I:84 | 671 | information about hardware configuration: lshw(1) |
discover
|
V:43, I:921 | 122 | hardware identification system: discover(8) |
Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.
Tabla 9.13. List of hardware configuration tools
paquete | popularidad | tamaño | descripción |
---|---|---|---|
console-setup
|
V:456, I:926 | 437 | Linux console font and keytable utilities |
x11-xserver-utils
|
V:372, I:591 | 479 | X server utilities: xset(1), xmodmap(1) |
acpid
|
V:527, I:914 | 137 | daemon to manage events delivered by the Advanced Configuration and Power Interface (ACPI) |
acpi
|
V:42, I:880 | 71 | utility to display information on ACPI devices |
apmd
|
V:0, I:11 | 94 | daemon to manage events delivered by the Advanced Power Management (APM) |
sleepd
|
V:0, I:0 | 77 | daemon to put a laptop to sleep during inactivity |
hdparm
|
V:239, I:398 | 236 | hard disk access optimization (see Sección 9.5.9, “Optimization of hard disk”) |
smartmontools
|
V:107, I:195 | 1716 | control and monitor storage systems using S.M.A.R.T. |
setserial
|
V:5, I:12 | 109 | collection of tools for serial port management |
memtest86+
|
V:1, I:40 | 2391 | collection of tools for memory hardware management |
scsitools
|
V:0, I:4 | 351 | collection of tools for SCSI hardware management |
setcd
|
V:0, I:1 | 28 | compact disc drive access optimization |
big-cursor
|
I:0 | 27 | larger mouse cursors for X |
Here, ACPI is a newer framework for the power management system than APM.
![]() |
Sugerencia |
---|---|
CPU frequency scaling on modern system is governed by kernel modules such as
|
The following sets system and hardware time to MM/DD hh:mm, CCYY.
# date MMDDhhmmCCYY # hwclock --utc --systohc # hwclock --show
Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UTC(GMT).
If the hardware (BIOS) time is set to UTC, change the setting to
"UTC=yes
" in the "/etc/default/rcS
".
The following reconfigure the timezone used by the Debian system.
# dpkg-reconfigure tzdata
If you wish to update system time via network, consider to use the NTP service with the packages such as
ntp
, ntpdate
, and
chrony
.
![]() |
Sugerencia |
---|---|
Under systemd, use
|
See the following.
The ntp-doc
package
![]() |
Sugerencia |
---|---|
ntptrace(8)
in the |
There are several components to configure character console and ncurses(3) system features.
The "/etc/terminfo/*/*
" file
(terminfo(5))
The "$TERM
" environment variable
(term(7))
setterm(1), stty(1), tic(1), and toe(1)
If the terminfo
entry for xterm
doesn't work with a non-Debian xterm
, change your
terminal type, "$TERM
", from "xterm
"
to one of the feature-limited versions such as "xterm-r6
"
when you log in to a Debian system remotely. See
"/usr/share/doc/libncurses5/FAQ
" for more.
"dumb
" is the lowest common denominator for
"$TERM
".
Device drivers for sound cards for current Linux are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.
![]() |
Sugerencia |
---|---|
Use " |
![]() |
Sugerencia |
---|---|
If you can not get sound, your speaker may be connected to a muted output.
Modern sound system has many outputs.
alsamixer(1)
in the |
Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.
Tabla 9.14. List of sound packages
paquete | popularidad | tamaño | descripción |
---|---|---|---|
alsa-base
|
I:491 | 83 | ALSA driver configuration files |
alsa-utils
|
V:383, I:536 | 2115 | utilities for configuring and using ALSA |
oss-compat
|
V:5, I:49 | 7 |
OSS compatibility under ALSA preventing "/dev/dsp not
found " errors
|
jackd
|
V:3, I:27 | 32 | JACK Audio Connection Kit. (JACK) server (low latency) |
libjack0
|
V:1, I:21 | 135 | JACK Audio Connection Kit. (JACK) library (low latency) |
nas
|
V:0, I:0 | 235 | Network Audio System (NAS) server |
libaudio2
|
V:61, I:566 | 161 | Network Audio System (NAS) library |
pulseaudio
|
V:353, I:495 | 5526 | PulseAudio server, replacement for ESD |
libpulse0
|
V:253, I:655 | 937 | PulseAudio client library, replacement for ESD |
libgstreamer1.0-0
|
V:222, I:468 | 4741 | GStreamer: GNOME sound engine |
libphonon4
|
I:228 | 588 | Phonon: KDE sound engine |
There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.
For disabling the screen saver, use following commands.
Tabla 9.15. List of commands for disabling the screen saver
entorno | orden |
---|---|
The Linux console |
setterm -powersave off
|
The X Window (turning off screensaver) |
xset s off
|
The X Window (disabling dpms) |
xset -dpms
|
The X Window (GUI configuration of screen saver) |
xscreensaver-command -prefs
|
One can always unplug the PC speaker to disable beep sounds. Removing
pcspkr
kernel module does this for you.
The following prevents the readline(3) program used by bash(1) to beep when encountering an alert character (ASCII=7).
$ echo "set bell-style none">> ~/.inputrc
There are 2 resources available for you to get the memory usage situation.
The kernel boot message in the "/var/log/dmesg
" contains
the total exact size of available memory.
free(1) and top(1) display information on memory resources on the running system.
Here is an example.
# grep '\] Memory' /var/log/dmesg [ 0.004000] Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init) $ free -k total used free shared buffers cached Mem: 997184 976928 20256 0 129592 171932 -/+ buffers/cache: 675404 321780 Swap: 4545576 4 4545572
You may be wondering "dmesg tells me a free of 990 MB, and free -k says 320 MB is free. More than 600 MB missing …".
Do not worry about the large size of "used
" and the small
size of "free
" in the "Mem:
" line, but
read the one under them (675404 and 321780 in the example above) and relax.
For my MacBook with 1GB=1048576k DRAM (video system steals some of this), I see the following.
Tabla 9.16. List of memory sizes reported
report | tamaño |
---|---|
Total size in dmesg | 1016784k = 1GB - 31792k |
Free in dmesg | 990528k |
Total under shell | 997184k |
Free under shell | 20256k (but effectively 321780k) |
Poor system maintenance may expose your system to external exploitation.
For system security and integrity check, you should start with the following.
The debsums
package, see
debsums(1)
and Sección 2.5.2, “Archivo "Versión" del nivel superior y autenticación”.
The chkrootkit
package, see
chkrootkit(1).
The clamav
package family, see
clamscan(1)
and
freshclam(1).
Tabla 9.17. List of tools for system security and integrity check
paquete | popularidad | tamaño | descripción |
---|---|---|---|
logcheck
|
V:12, I:15 | 216 | daemon to mail anomalies in the system logfiles to the administrator |
debsums
|
V:6, I:37 | 118 | utility to verify installed package files against MD5 checksums |
chkrootkit
|
V:8, I:29 | 948 | rootkit detector |
clamav
|
V:18, I:71 | 873 | anti-virus utility for Unix - command-line interface |
tiger
|
V:3, I:4 | 2581 | report system security vulnerabilities |
tripwire
|
V:3, I:4 | 11471 | file and directory integrity checker |
john
|
V:3, I:14 | 448 | active password cracking tool |
aide
|
V:1, I:2 | 1981 | Advanced Intrusion Detection Environment - static binary |
integrit
|
V:0, I:0 | 440 | file integrity verification program |
crack
|
V:0, I:0 | 128 | password guessing program |
Here is a simple script to check for typical world writable incorrect file permissions.
# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)
![]() |
Atención |
---|---|
Since the |
Booting your system with Linux live CDs or debian-installer CDs in rescue mode makes it easy for you to reconfigure data storage on your boot device.
The disk space usage can be evaluated by programs provided by the
mount
, coreutils
, and
xdu
packages:
mount(8) reports all mounted filesystems (= disks).
df(1) reports the disk space usage for the file system.
du(1) reports the disk space usage for the directory tree.
![]() |
Sugerencia |
---|---|
You can feed the output of
du(8)
to
xdu(1x)
to produce its graphical and interactive presentation with " |
For disk partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.
Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).
![]() |
Nota |
---|---|
Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector. |
Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.
Tabla 9.18. List of disk partition management packages
paquete | popularidad | tamaño | GPT | descripción |
---|---|---|---|---|
util-linux
|
V:876, I:999 | 3552 | No soportado | miscellaneous system utilities including fdisk(8) and cfdisk(8) |
parted
|
V:327, I:529 | 279 | Soporte | GNU Parted disk partition resizing program |
gparted
|
V:26, I:147 | 6519 | Soporte |
GNOME partition editor based on libparted
|
gdisk
|
V:17, I:453 | 746 | Soporte | partition editor for the GPT disk |
kpartx
|
V:13, I:28 | 76 | Soporte | program to create device mappings for partitions |
![]() |
Atención |
---|---|
Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), mkfs.ext4(8), …) and resize2fs(8). |
![]() |
Nota |
---|---|
In order to switch between GPT and MBR, you need to erase first few blocks of disk contents
directly (see Sección 9.7.6, “Clearing file contents”) and use
" |
Although reconfiguration of your partition or activation order of removable storage media may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.
mount(8)
with "-U
" option can mount a block device using UUID, instead of using its file name such as
"/dev/sda3
".
"/etc/fstab
" (see
fstab(5))
can use UUID.
Boot loaders (Sección 3.1.2, “Fase 2: el cargador de arranque”) may use UUID too.
![]() |
Sugerencia |
---|---|
You can probe UUID of a block special device with blkid(8). |
![]() |
Sugerencia |
---|---|
Device nodes of devices such as removable storage media can be made static by using udev rules, if needed. See Sección 3.3, “El sistema udev”. |
LVM2 is a logical volume manager for the Linux kernel. With LVM2, disk partitions can be created on logical volumes instead of the physical harddisks.
LVM requires the following.
device-mapper support in the Linux kernel (default for Debian kernels)
the userspace device-mapper support library
(libdevmapper*
package)
the userspace LVM2 tools (lvm2
package)
Please start learning LVM2 from the following manpages.
lvm(8): Basics of LVM2 mechanism (list of all LVM2 commands)
lvm.conf(5): Configuration file for LVM2
lvs(8): Report information about logical volumes
vgs(8): Report information about volume groups
pvs(8): Report information about physical volumes
For ext4 filesystem, the
e2fsprogs
package provides the following.
The
mkfs(8)
and
fsck(8)
commands are provided by the e2fsprogs
package as
front-ends to various filesystem dependent programs
(mkfs.fstype
and fsck.fstype
). For
ext4 filesystem, they are
mkfs.ext4(8)
and
fsck.ext4(8)
(they are symlinked to
mke2fs(8)
and
e2fsck(8)).
Similar commands are available for each filesystem supported by Linux.
Tabla 9.19. List of filesystem management packages
paquete | popularidad | tamaño | descripción |
---|---|---|---|
e2fsprogs
|
V:428, I:999 | 3851 | utilities for the ext2/ext3/ext4 filesystems |
reiserfsprogs
|
V:5, I:22 | 882 | utilities for the Reiserfs filesystem |
dosfstools
|
V:80, I:574 | 236 | utilities for the FAT filesystem. (Microsoft: MS-DOS, Windows) |
xfsprogs
|
V:19, I:78 | 3748 | utilities for the XFS filesystem. (SGI: IRIX) |
ntfs-3g
|
V:185, I:569 | 1335 | utilities for the NTFS filesystem. (Microsoft: Windows NT, …) |
jfsutils
|
V:1, I:13 | 1533 | utilities for the JFS filesystem. (IBM: AIX, OS/2) |
reiser4progs
|
V:0, I:5 | 1657 | utilities for the Reiser4 filesystem |
hfsprogs
|
V:0, I:9 | 295 | utilities for HFS and HFS Plus filesystem. (Apple: Mac OS) |
btrfs-tools
|
V:12, I:40 | 24 | utilities for the Btrfs filesystem |
zerofree
|
V:2, I:47 | 25 | program to zero free blocks from ext2/3/4 filesystems |
![]() |
Sugerencia |
---|---|
Ext4 filesystem is the default filesystem for the Linux system and strongly recommended to use it unless you have some specific reasons not to. |
![]() |
Sugerencia |
---|---|
Btrfs filesystem is available in Linux kernel
3.2 (Debian |
![]() |
Aviso |
---|---|
You should not use the Btrfs filesystem for your critical data yet before it acquires the live kernel space fsck(8) feature and the boot loader support. |
![]() |
Sugerencia |
---|---|
Some tools allow access to filesystem without Linux kernel support (see Sección 9.7.2, “Manipulating files without mounting disk”). |
The mkfs(8) command creates the filesystem on a Linux system. The fsck(8) command provides the filesystem integrity check and repair on a Linux system.
Debian now defaults to no periodic fsck
after filesystem
creation.
![]() |
Atención |
---|---|
It is generally not safe to run |
![]() |
Sugerencia |
---|---|
You can run the
fsck(8)
command safely on all filesystems including root filesystem on reboot by
setting " |
![]() |
Sugerencia |
---|---|
Check files in " |
The basic static filesystem configuration is given by
"/etc/fstab
". For example,
# <file system> <mount point> <type> <options> <dump> <pass> proc /proc proc defaults 0 0 UUID=709cbe4c-80c1-56db-8ab1-dbce3146d2f7 / ext4 noatime,errors=remount-ro 0 1 UUID=817bae6b-45d2-5aca-4d2a-1267ab46ac23 none swap sw 0 0 /dev/scd0 /media/cdrom0 udf,iso9660 user,noauto 0 0
![]() |
Sugerencia |
---|---|
UUID (see Sección 9.5.3, “Accessing partition using UUID”) may be used to identify a block
device instead of normal block device names such as
" |
Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). Notable ones are the following.
"defaults
" option implies default options:
"rw,suid,dev,exec,auto,nouser,async
". (general)
"noatime
" or "relatime
" option is very
effective for speeding up the read access. (general)
"user
" option allows an ordinary user to mount the
filesystem. This option implies "noexec,nosuid,nodev
"
option combination. (general, used for CDs or usb storage devices)
"noexec,nodev,nosuid
" option combination is used to
enhance security. (general)
"noauto
" option limits mounting by explicit operation
only. (general)
"data=journal
" option for ext3fs can enhance data
integrity against power failure with some loss of write speed.
![]() |
Sugerencia |
---|---|
You need to provide kernel boot parameter (see Sección 3.1.2, “Fase 2: el cargador de arranque”),
e.g. " |
Characteristics of a filesystem can be optimized via its superblock using the tune2fs(8) command.
Execution of "sudo tune2fs -l /dev/hda1
" displays the
contents of the filesystem superblock on "/dev/hda1
".
Execution of "sudo tune2fs -c 50 /dev/hda1
" changes
frequency of filesystem checks (fsck
execution during
boot-up) to every 50 boots on "/dev/hda1
".
Execution of "sudo tune2fs -j /dev/hda1
" adds journaling
capability to the filesystem, i.e. filesystem conversion from ext2 to ext3 on
"/dev/hda1
". (Do this on the unmounted filesystem.)
Execution of "sudo tune2fs -O extents,uninit_bg,dir_index /dev/hda1
&& fsck -pf /dev/hda1
" converts it from ext3 to ext4 on
"/dev/hda1
". (Do this on the unmounted filesystem.)
![]() |
Aviso |
---|---|
Please check your hardware and read manpage of hdparam(8) before playing with hard disk configuration because this may be quite dangerous for the data integrity. |
You can test disk access speed of a hard disk,
e.g. "/dev/hda
", by "hdparm -tT
/dev/hda
". For some hard disk connected with (E)IDE, you can speed
it up with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda
" by
enabling the "(E)IDE 32-bit I/O support", enabling the "using_dma flag",
setting "interrupt-unmask flag", and setting the "multiple 16 sector I/O"
(dangerous!).
You can test write cache feature of a hard disk,
e.g. "/dev/sda
", by "hdparm -W
/dev/sda
". You can disable its write cache feature with
"hdparm -W 0 /dev/sda
".
You may be able to read badly pressed CDROMs on modern high speed CD-ROM
drive by slowing it down with "setcd -x 2
".
Performance and disk wear of the solid state drive (SSD) can be optimized as follows.
Use the latest Linux kernel. (>= 3.2)
Reduce disk writes for read disk accesses.
Set "noatime
" or "relatime
" mount
option in /etc/fstab
.
Enable the TRIM command.
Enable the SSD optimized disk space allocation scheme.
Set "ssd
" mount option in /etc/fstab
for the Btrfs.
Make system flush data to the disk every 10 minutes for laptop PCs.
Set "commit=600
" mount option in
/etc/fstab
. See
fstab(5).
Set pm-utils to use laptop-mode even under AC operation. See Debian BTS #659260.
![]() |
Aviso |
---|---|
Changing flushing interval from normal 5 seconds to 10 minutes makes your data vulnerable to the power failure. |
You can monitor and log your hard disk which is compliant to SMART with the smartd(8) daemon.
Install the smartmontools
package.
Identify your hard disk drives by listing them with df(1).
Let's assume a hard disk drive to be monitored as
"/dev/hda
".
Check the output of "smartctl -a /dev/hda
" to see if
SMART feature is actually enabled.
If not, enable it by "smartctl -s on -a /dev/hda
".
Enable smartd(8) daemon to run by the following.
uncomment "start_smartd=yes
" in the
"/etc/default/smartmontools
" file.
restart the
smartd(8)
daemon by "sudo /etc/init.d/smartmontools restart
".
![]() |
Sugerencia |
---|---|
The
smartd(8)
daemon can be customized with the |
Applications create temporary files normally under the temporary storage
directory "/tmp
". If "/tmp
" does not
provide enough space, you can specify such temporary storage directory via
the $TMPDIR
variable for well-behaving programs.
For partitions created on Logical Volume Manager (LVM) (Linux feature) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.
If you have an empty partition (e.g., "/dev/sdx
"), you
can format it with
mkfs.ext4(1)
and
mount(8)
it to a directory where you need more space. (You need to copy original data
contents.)
$ sudo mv work-dir old-dir $ sudo mkfs.ext4 /dev/sdx $ sudo mount -t ext4 /dev/sdx work-dir $ sudo cp -a old-dir/* work-dir $ sudo rm -rf old-dir
![]() |
Sugerencia |
---|---|
You may alternatively mount an empty disk image file (see Sección 9.6.5, “Making the empty disk image file”) as a loop device (see Sección 9.6.3, “Mounting the disk image file”). The actual disk usage grows with the actual data stored. |
If you have an empty directory (e.g., "/path/to/emp-dir
")
on another partition with usable space, you can mount(8) it with
"--bind
" option to a directory (e.g.,
"work-dir
") where you need more space.
$ sudo mount --bind /path/to/emp-dir work-dir
![]() |
Sugerencia |
---|---|
This is a deprecated method. Use Sección 9.5.15, “Expansion of usable storage space by bind-mounting another directory” instead, if possible. |
If you have an empty directory (e.g., "/path/to/emp-dir
")
in another partition with usable space, you can create a symlink to the
directory with
ln(8).
$ sudo mv work-dir old-dir $ sudo mkdir -p /path/to/emp-dir $ sudo ln -sf /path/to/emp-dir work-dir $ sudo cp -a old-dir/* work-dir $ sudo rm -rf old-dir
![]() |
Aviso |
---|---|
Do not use "symlink to a directory" for directories managed by the system
such as " |
![]() |
Atención |
---|---|
Some software may not function well with "symlink to a directory". |
If you have usable space in another partition (e.g.,
"/path/to/empty
" and "/path/to/work
"),
you can create a directory in it and stack that on to an old directory
(e.g., "/path/to/old
") where you need space with OverlayFS with Linux kernel 3.18 or newer (Debian
Stetch 9.0 or newer).
$ sudo mount -t overlay overlay \ -olowerdir=/path/to/old-dir,upperdir=/path/to/empty,workdir=/path/to/work
Here, "/path/to/empty
" and
"/path/to/work
" should be on the RW-enabled partition to
write on "/path/to/old
".
Here, we discuss manipulations of the disk image.
The disk image file, "disk.img
", of an unmounted device,
e.g., the second SCSI or serial ATA drive "/dev/sdb
", can
be made using
cp(1)
or
dd(1)
by the following.
# cp /dev/sdb disk.img # dd if=/dev/sdb of=disk.img
The disk image of the traditional PC's master boot record (MBR) (see Sección 9.5.2, “Disk partition configuration”) which reside on the first sector on the primary IDE disk can be made by using dd(1) by the following.
# dd if=/dev/hda of=mbr.img bs=512 count=1 # dd if=/dev/hda of=mbr-nopart.img bs=446 count=1 # dd if=/dev/hda of=mbr-part.img skip=446 bs=1 count=66
"mbr.img
": The MBR with the partition table
"mbr-nopart.img
": The MBR without the partition table
"mbr-part.img
": The partition table of the MBR only
If you have an SCSI or serial ATA device as the boot disk, substitute
"/dev/hda
" with "/dev/sda
".
If you are making an image of a disk partition of the original disk,
substitute "/dev/hda
" with "/dev/hda1
"
etc.
The disk image file, "disk.img
" can be written to an
unmounted device, e.g., the second SCSI drive "/dev/sdb
"
with matching size, by the following.
# dd if=disk.img of=/dev/sdb
Similarly, the disk partition image file, "partition.img
"
can be written to an unmounted partition, e.g., the first partition of the
second SCSI drive "/dev/sdb1
" with matching size, by the
following.
# dd if=partition.img of=/dev/sdb1
The disk image "partition.img
" containing a single
partition image can be mounted and unmounted by using the loop device as follows.
# losetup -v -f partition.img Loop device is /dev/loop0 # mkdir -p /mnt/loop0 # mount -t auto /dev/loop0 /mnt/loop0 ...hack...hack...hack # umount /dev/loop0 # losetup -d /dev/loop0
This can be simplified as follows.
# mkdir -p /mnt/loop0 # mount -t auto -o loop partition.img /mnt/loop0 ...hack...hack...hack # umount partition.img
Each partition of the disk image "disk.img
" containing
multiple partitions can be mounted by using the loop device. Since the loop device does not
manage partitions by default, we need to reset it as follows.
# modinfo -p loop # verify kernel capability max_part:Maximum number of partitions per loop device max_loop:Maximum number of loop devices # losetup -a # verify nothing using the loop device # rmmod loop # modprobe loop max_part=16
Now, the loop device can manage up to 16 partitions.
# losetup -v -f disk.img Loop device is /dev/loop0 # fdisk -l /dev/loop0 Disk /dev/loop0: 5368 MB, 5368709120 bytes 255 heads, 63 sectors/track, 652 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk identifier: 0x452b6464 Device Boot Start End Blocks Id System /dev/loop0p1 1 600 4819468+ 83 Linux /dev/loop0p2 601 652 417690 83 Linux # mkdir -p /mnt/loop0p1 # mount -t ext4 /dev/loop0p1 /mnt/loop0p1 # mkdir -p /mnt/loop0p2 # mount -t ext4 /dev/loop0p2 /mnt/loop0p2 ...hack...hack...hack # umount /dev/loop0p1 # umount /dev/loop0p2 # losetup -d /dev/loop0
Alternatively, similar effects can be done by using the device mapper devices created by
kpartx(8)
from the kpartx
package as follows.
# kpartx -a -v disk.img ... # mkdir -p /mnt/loop0p2 # mount -t ext4 /dev/mapper/loop0p2 /mnt/loop0p2 ... ...hack...hack...hack # umount /dev/mapper/loop0p2 ... # kpartx -d /mnt/loop0
![]() |
Nota |
---|---|
You can mount a single partition of such disk image with loop device using offset to skip MBR etc., too. But this is more error prone. |
A disk image file, "disk.img
" can be cleaned of all
removed files into clean sparse image "new.img
" by the
following.
# mkdir old; mkdir new # mount -t auto -o loop disk.img old # dd bs=1 count=0 if=/dev/zero of=new.img seek=5G # mount -t auto -o loop new.img new # cd old # cp -a --sparse=always ./ ../new/ # cd .. # umount new.img # umount disk.img
If "disk.img
" is in ext2, ext3 or ext4, you can also use
zerofree(8)
from the zerofree
package as follows.
# losetup -f -v disk.img Loop device is /dev/loop3 # zerofree /dev/loop3 # cp --sparse=always disk.img new.img
The empty disk image "disk.img
" which can grow up to 5GiB
can be made using
dd(1)
as follows.
$ dd bs=1 count=0 if=/dev/zero of=disk.img seek=5G
You can create an ext4 filesystem on this disk image
"disk.img
" using the loop
device as follows.
# losetup -f -v disk.img Loop device is /dev/loop1 # mkfs.ext4 /dev/loop1 ...hack...hack...hack # losetup -d /dev/loop1 $ du --apparent-size -h disk.img 5.0G disk.img $ du -h disk.img 83M disk.img
For "disk.img
", its file size is 5.0 GiB and its actual
disk usage is mere 83MiB. This discrepancy is possible since ext4 can hold sparse
file.
![]() |
Sugerencia |
---|---|
The actual disk usage of sparse file grows with data which are written to it. |
Using similar operation on devices created by the loop device or the device mapper devices as Sección 9.6.3, “Mounting the disk image file”, you can partition this disk image
"disk.img
" using
parted(8)
or
fdisk(8),
and can create filesystem on it using
mkfs.ext4(8),
mkswap(8),
etc.
The ISO9660 image file,
"cd.iso
", from the source directory tree at
"source_directory
" can be made using
genisoimage(1)
provided by cdrkit by the following.
# genisoimage -r -J -T -V volume_id -o cd.iso source_directory
Similarly, the bootable ISO9660 image file, "cdboot.iso
",
can be made from debian-installer
like directory tree at
"source_directory
" by the following.
# genisoimage -r -o cdboot.iso -V volume_id \ -b isolinux/isolinux.bin -c isolinux/boot.cat \ -no-emul-boot -boot-load-size 4 -boot-info-table source_directory
Here Isolinux boot loader (see Sección 3.1.2, “Fase 2: el cargador de arranque”) is used for booting.
You can calculate the md5sum value and make the ISO9660 image directly from the CD-ROM device as follows.
$ isoinfo -d -i /dev/cdrom CD-ROM is in ISO 9660 format ... Logical block size is: 2048 Volume size is: 23150592 ... # dd if=/dev/cdrom bs=2048 count=23150592 conv=notrunc,noerror | md5sum # dd if=/dev/cdrom bs=2048 count=23150592 conv=notrunc,noerror > cd.iso
![]() |
Aviso |
---|---|
You must carefully avoid ISO9660 filesystem read ahead bug of Linux as above to get the right result. |
![]() |
Sugerencia |
---|---|
DVD is only a large CD to wodim(1) provided by cdrkit. |
You can find a usable device by the following.
# wodim --devices
Then the blank CD-R is inserted to the CD drive, and the ISO9660 image file,
"cd.iso
" is written to this device, e.g.,
"/dev/hda
", using
wodim(1)
by the following.
# wodim -v -eject dev=/dev/hda cd.iso
If CD-RW is used instead of CD-R, do this instead by the following.
# wodim -v -eject blank=fast dev=/dev/hda cd.iso
![]() |
Sugerencia |
---|---|
If your desktop system mounts CDs automatically, unmount it by
" |
If "cd.iso
" contains an ISO9660 image, then the following
manually mounts it to "/cdrom
".
# mount -t iso9660 -o ro,loop cd.iso /cdrom
![]() |
Sugerencia |
---|---|
Modern desktop system may mount removable media such as ISO9660 formatted CD automatically (see Sección 10.1.7, “Removable storage device”). |
Here, we discuss direct manipulations of the binary data on storage media.
The most basic viewing method of binary data is to use "od -t
x1
" command.
Tabla 9.20. List of packages which view and edit binary data
paquete | popularidad | tamaño | descripción |
---|---|---|---|
coreutils
|
V:876, I:999 | 14642 | basic package which has od(1) to dump files (HEX, ASCII, OCTAL, …) |
bsdmainutils
|
V:860, I:998 | 557 | utility package which has hd(1) to dump files (HEX, ASCII, OCTAL, …) |
hexedit
|
V:1, I:11 | 61 | binary editor and viewer (HEX, ASCII) |
bless
|
V:0, I:5 | 973 | full featured hexadecimal editor (GNOME) |
okteta
|
V:2, I:23 | 382 | full featured hexadecimal editor (KDE4) |
ncurses-hexedit
|
V:0, I:2 | 126 | binary editor and viewer (HEX, ASCII, EBCDIC) |
beav
|
V:0, I:1 | 121 | binary editor and viewer (HEX, ASCII, EBCDIC, OCTAL, …) |
![]() |
Sugerencia |
---|---|
HEX is used as an acronym for hexadecimal format with radix 16. OCTAL is for octal format with radix 8. ASCII is for American Standard Code for Information Interchange, i.e., normal English text code. EBCDIC is for Extended Binary Coded Decimal Interchange Code used on IBM mainframe operating systems. |
There are tools to read and write files without mounting disk.
Software RAID systems offered by the Linux kernel provide data redundancy in the kernel filesystem level to achieve high levels of storage reliability.
There are tools to add data redundancy to files in application program level to achieve high levels of storage reliability, too.
Tabla 9.22. List of tools to add data redundancy to files
paquete | popularidad | tamaño | descripción |
---|---|---|---|
par2
|
V:2, I:12 | 231 | Parity Archive Volume Set, for checking and repair of files |
dvdisaster
|
V:0, I:2 | 1481 | data loss/scratch/aging protection for CD/DVD media |
dvbackup
|
V:0, I:0 | 412 | backup tool using MiniDV camcorders (providing rsbep(1)) |
vdmfec
|
V:0, I:0 | 88 | recover lost blocks using Forward Error Correction |
There are tools for data file recovery and forensic analysis.
Tabla 9.23. List of packages for data file recovery and forensic analysis
paquete | popularidad | tamaño | descripción |
---|---|---|---|
testdisk
|
V:4, I:38 | 1344 | utilities for partition scan and disk recovery |
magicrescue
|
V:0, I:3 | 220 | utility to recover files by looking for magic bytes |
scalpel
|
V:0, I:4 | 82 | frugal, high performance file carver |
myrescue
|
V:0, I:2 | 38 | rescue data from damaged harddisks |
extundelete
|
V:1, I:10 | 140 | utility to undelete files on the ext3/4 filesystem |
ext4magic
|
V:0, I:2 | 232 | utility to undelete files on the ext3/4 filesystem |
ext3grep
|
V:0, I:3 | 278 | tool to help recover deleted files on the ext3 filesystem |
scrounge-ntfs
|
V:0, I:2 | 45 | data recovery program for NTFS filesystems |
gzrt
|
V:0, I:0 | 57 | gzip recovery toolkit |
sleuthkit
|
V:0, I:5 | 1114 | tools for forensics analysis. (Sleuthkit) |
autopsy
|
V:0, I:2 | 1021 | graphical interface to SleuthKit |
foremost
|
V:0, I:6 | 123 | forensics application to recover data |
guymager
|
V:0, I:0 | 1104 | forensic imaging tool based on Qt |
dcfldd
|
V:0, I:5 | 90 |
enhanced version of dd for forensics and security
|
![]() |
Sugerencia |
---|---|
You can undelete files on the ext2 filesystem using
|
When a data is too big to backup as a single file, you can backup its content after splitting it into, e.g. 2000MiB chunks and merge those chunks back into the original file later.
$ split -b 2000m large_file $ cat x* >large_file
![]() |
Atención |
---|---|
Please make sure you do not have any files starting with
" |
In order to clear the contents of a file such as a log file, do not use rm(1) to delete the file and then create a new empty file, because the file may still be accessed in the interval between commands. The following is the safe way to clear the contents of the file.
$ :>file_to_be_cleared
The following commands create dummy or empty files.
$ dd if=/dev/zero of=5kb.file bs=1k count=5 $ dd if=/dev/urandom of=7mb.file bs=1M count=7 $ touch zero.file $ : > alwayszero.file
You should find following files.
"5kb.file
" is 5KB of zeros.
"7mb.file
" is 7MB of random data.
"zero.file
" may be a 0 byte file. If it existed, its
mtime
is updated while its content and its length are
kept.
"alwayszero.file
" is always a 0 byte file. If it
existed, its mtime
is updated and its content is reset.
There are several ways to completely erase data from an entire hard disk
like device, e.g., USB memory stick at "/dev/sda
".
![]() |
Atención |
---|---|
Check your USB memory stick location with
mount(8)
first before executing commands here. The device pointed by
" |
Erase all the disk content by resetting data to 0 with the following.
# dd if=/dev/zero of=/dev/sda
Erase everything by overwriting with random data as follows.
# dd if=/dev/urandom of=/dev/sda
Erase everything by overwriting with random data very efficiently as follows.
# shred -v -n 1 /dev/sda
Since
dd(1)
is available from the shell of many bootable Linux CDs such as Debian
installer CD, you can erase your installed system completely by running an
erase command from such media on the system hard disk, e.g.,
"/dev/hda
", "/dev/sda
", etc.
Unused area on an hard disk (or USB memory stick),
e.g. "/dev/sdb1
" may still contain erased data themselves
since they are only unlinked from the filesystem. These can be cleaned by
overwriting them.
# mount -t auto /dev/sdb1 /mnt/foo # cd /mnt/foo # dd if=/dev/zero of=junk dd: writing to `junk': No space left on device ... # sync # umount /dev/sdb1
![]() |
Aviso |
---|---|
This is usually good enough for your USB memory stick. But this is not perfect. Most parts of erased filenames and their attributes may be hidden and remain in the filesystem. |
Even if you have accidentally deleted a file, as long as that file is still being used by some application (read or write mode), it is possible to recover such a file.
Por ejemplo, intente lo siguiente
$ echo foo > bar $ less bar $ ps aux | grep ' less[ ]' bozo 4775 0.0 0.0 92200 884 pts/8 S+ 00:18 0:00 less bar $ rm bar $ ls -l /proc/4775/fd | grep bar lr-x------ 1 bozo bozo 64 2008-05-09 00:19 4 -> /home/bozo/bar (deleted) $ cat /proc/4775/fd/4 >bar $ ls -l -rw-r--r-- 1 bozo bozo 4 2008-05-09 00:25 bar $ cat bar foo
Execute on another terminal (when you have the lsof
package installed) as follows.
$ ls -li bar 2228329 -rw-r--r-- 1 bozo bozo 4 2008-05-11 11:02 bar $ lsof |grep bar|grep less less 4775 bozo 4r REG 8,3 4 2228329 /home/bozo/bar $ rm bar $ lsof |grep bar|grep less less 4775 bozo 4r REG 8,3 4 2228329 /home/bozo/bar (deleted) $ cat /proc/4775/fd/4 >bar $ ls -li bar 2228302 -rw-r--r-- 1 bozo bozo 4 2008-05-11 11:05 bar $ cat bar foo
Files with hardlinks can be identified by "ls -li
".
$ ls -li total 0 2738405 -rw-r--r-- 1 root root 0 2008-09-15 20:21 bar 2738404 -rw-r--r-- 2 root root 0 2008-09-15 20:21 baz 2738404 -rw-r--r-- 2 root root 0 2008-09-15 20:21 foo
Both "baz
" and "foo
" have link counts
of "2" (>1) showing them to have hardlinks. Their inode numbers are common "2738404". This means they
are the same hardlinked file. If you do not happen to find all hardlinked
files by chance, you can search it by the inode, e.g., "2738404" as the following.
# find /path/to/mount/point -xdev -inum 2738404
With physical access to your PC, anyone can easily gain root privilege and access all the files on your PC (see Sección 4.7.4, “Asegurando la contraseña de root”). This means that login password system can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although GNU privacy guard (see Sección 10.3, “Data security infrastructure”) can encrypt files, it takes some user efforts.
dm-crypt and eCryptfs facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.
Tabla 9.24. List of data encryption utilities
paquete | popularidad | tamaño | descripción |
---|---|---|---|
cryptsetup
|
V:20, I:71 | 343 | utilities for encrypted block device (dm-crypt / LUKS) |
cryptmount
|
V:1, I:3 | 219 | utilities for encrypted block device (dm-crypt / LUKS) with focus on mount/unmount by normal users |
ecryptfs-utils
|
V:5, I:9 | 393 | utilities for encrypted stacked filesystem (eCryptfs) |
Dm-crypt is a cryptographic filesystem using device-mapper. Device-mapper maps one block device to another.
eCryptfs is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.
![]() |
Atención |
---|---|
Data encryption costs CPU time etc. Please weigh its benefits and costs. |
![]() |
Nota |
---|---|
Entire Debian system can be installed on a encrypted disk by the debian-installer (lenny or newer) using dm-crypt/LUKS and initramfs. |
![]() |
Sugerencia |
---|---|
See Sección 10.3, “Data security infrastructure” for user space encryption utility: GNU Privacy Guard. |
You can encrypt contents of removable mass devices, e.g. USB memory stick on
"/dev/sdx
", using dm-crypt/LUKS. You
simply format it as the following.
# badblocks -c 1024 -s -w -t random -v /dev/sdx # fdisk /dev/sdx ... "n" "p" "1" "return" "return" "w" # cryptsetup luksFormat /dev/sdx1 ... # cryptsetup open --type luks /dev/sdx1 sdx1 ... # ls -l /dev/mapper/ total 0 crw-rw---- 1 root root 10, 60 2008-10-04 18:44 control brw-rw---- 1 root disk 254, 0 2008-10-04 23:55 sdx1 # mkfs.vfat /dev/mapper/sdx1 ... # cryptsetup luksClose sdx1
Then, it can be mounted just like normal one on to
"/media/<disk_label>
", except for asking password
(see Sección 10.1.7, “Removable storage device”) under modern desktop
environment, such as GNOME using
gnome-mount(1).
The difference is that every data written to it is encrypted. You may
alternatively format media in different filesystem, e.g., ext4 with
"mkfs.ext4 /dev/mapper/sdx1
".
![]() |
Nota |
---|---|
If you are really paranoid for the security of data, you may need to
overwrite multiple times (the " |
Let's assume that your original "/etc/fstab
" contains the
following.
/dev/sda7 swap sw 0 0
You can enable encrypted swap partition using dm-crypt by as the following.
# aptitude install cryptsetup # swapoff -a # echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab # perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab # /etc/init.d/cryptdisks restart ... # swapon -a
An encrypted disk partition created with dm-crypt/LUKS on
"/dev/sdc5
" can be mounted onto "/mnt
"
as follows:
$ sudo cryptsetup open /dev/sdc5 ninja --type luks Enter passphrase for /dev/sdc5: **** $ sudo lvm lvm> lvscan inactive '/dev/ninja-vg/root' [13.52 GiB] inherit inactive '/dev/ninja-vg/swap_1' [640.00 MiB] inherit ACTIVE '/dev/goofy/root' [180.00 GiB] inherit ACTIVE '/dev/goofy/swap' [9.70 GiB] inherit lvm> lvchange -a y /dev/ninja-vg/root lvm> exit Exiting. $ sudo mount /dev/ninja-vg/root /mnt
You can encrypt files written under "~/Private/
"
automatically using eCryptfs and the
ecryptfs-utils
package.
Run
ecryptfs-setup-private(1)
and set up "~/Private/
" by following prompts.
Activate "~/Private/
" by running
ecryptfs-mount-private(1).
Move sensitive data files to "~/Private/
" and make
symlinks as needed.
Candidates: "~/.fetchmailrc
",
"~/.ssh/identity
", "~/.ssh/id_rsa
",
"~/.ssh/id_dsa
" and other files with
"go-rwx
"
Move sensitive data directories to a subdirectory in
"~/Private/
" and make symlinks as needed.
Candidates: "~/.gnupg
" and other directories with
"go-rwx
"
Create symlink from "~/Desktop/Private/
" to
"~/Private/
" for easier desktop operations.
Deactivate "~/Private/
" by running
ecryptfs-umount-private(1).
Activate "~/Private/
" by issuing
"ecryptfs-mount-private
" as you need encrypted data.
If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via PAM (Pluggable Authentication Modules).
Insert the following line just before "pam_permit.so
" in
"/etc/pam.d/common-auth
".
auth required pam_ecryptfs.so unwrap
Insert the following line just at the last line in
"/etc/pam.d/common-session
".
session optional pam_ecryptfs.so unwrap
Insert the following line at first active line in
"/etc/pam.d/common-password
".
password required pam_ecryptfs.so
This is quite convenient.
![]() |
Aviso |
---|---|
Configuration errors of PAM may lock you out of your own system. See Capítulo 4, Acreditación. |
![]() |
Atención |
---|---|
If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see Sección 4.3, “Buenas contraseñas”). Unless you are careful to set up a strong password, your data is at risk when someone runs password cracking software after stealing your laptop (see Sección 4.7.4, “Asegurando la contraseña de root”). |
Debian distributes modularized Linux kernel as packages for supported architectures.
There are few notable features on Linux kernel 2.6/3.x compared to 2.4.
Devices are created by the udev system (see Sección 3.3, “El sistema udev”).
Read/write accesses to IDE CD/DVD devices do not use the
ide-scsi
module.
Network packet filtering functions use iptables
kernel
modules.
The version bump from Linux 2.6.39 to Linux 3.0 is not about major technological changes but about the 20th anniversary.
Many Linux features are configurable via kernel parameters as follows.
Kernel parameters initialized by the bootloader (see Sección 3.1.2, “Fase 2: el cargador de arranque”)
Kernel parameters changed by sysctl(8) at runtime for ones accessible via sysfs (see Sección 1.2.12, “procfs y sysfs”)
Module parameters set by arguments of modprobe(8) when a module is activated (see Sección 9.6.3, “Mounting the disk image file”)
See "kernel-parameters.txt(.gz)
" and other related
documents in the Linux kernel documentation
("/usr/share/doc/linux-doc-3.*/Documentation/filesystems/*
")
provided by the linux-doc-3.*
package.
Most normal programs don't need kernel
headers and in fact may break if you use them directly for compiling. They
should be compiled against the headers in
"/usr/include/linux
" and
"/usr/include/asm
" provided by the
libc6-dev
package (created from the
glibc
source package) on the Debian system.
![]() |
Nota |
---|---|
For compiling some kernel-specific programs such as the kernel modules from
the external source and the automounter daemon ( |
Debian has its own method of compiling the kernel and related modules.
Tabla 9.25. List of key packages to be installed for the kernel recompilation on the Debian system
paquete | popularidad | tamaño | descripción |
---|---|---|---|
build-essential
|
I:450 | 20 |
essential packages for building Debian packages: make ,
gcc , …
|
bzip2
|
V:251, I:931 | 84 | compress and decompress utilities for bz2 files |
libncurses5-dev
|
V:14, I:151 | 1027 | developer's libraries and docs for ncurses |
git
|
V:246, I:413 | 27879 | git: distributed revision control system used by the Linux kernel |
fakeroot
|
V:36, I:498 | 216 | provide fakeroot environment for building package as non-root |
initramfs-tools
|
V:189, I:990 | 102 | tool to build an initramfs (Debian specific) |
dkms
|
V:70, I:214 | 282 | dynamic kernel module support (DKMS) (generic) |
devscripts
|
V:10, I:66 | 2055 | helper scripts for a Debian Package maintainer (Debian specific) |
If you use initrd
in Sección 3.1.2, “Fase 2: el cargador de arranque”, make sure to read the related
information in
initramfs-tools(8),
update-initramfs(8),
mkinitramfs(8)
and
initramfs.conf(5).
![]() |
Aviso |
---|---|
Do not put symlinks to the directories in the source tree
(e.g. " |
![]() |
Nota |
---|---|
When compiling the latest Linux kernel on the Debian
|
![]() |
Nota |
---|---|
The dynamic kernel module support (DKMS) is a new distribution independent framework designed to allow individual kernel modules to be upgraded without changing the whole kernel. This is used for the maintenance of out-of-tree modules. This also makes it very easy to rebuild modules as you upgrade kernels. |
For building custom kernel binary packages from the upstream kernel source,
you should use the "deb-pkg
" target provided by it.
$ sudo apt-get build-dep linux $ cd /usr/src $ wget http://www.kernel.org/pub/linux/kernel/v3.11/linux-<version>.tar.bz2 $ tar -xjvf linux-<version>.tar.bz2 $ cd linux-<version> $ cp /boot/config-<version> .config $ make menuconfig ... $ make deb-pkg
![]() |
Sugerencia |
---|---|
The linux-source-<version> package provides the Linux kernel source
with Debian patches as
" |
For building specific binary packages from the Debian kernel source package,
you should use the
"binary-arch_<architecture>_<featureset>_<flavour>
"
targets in "debian/rules.gen
".
$ sudo apt-get build-dep linux $ apt-get source linux $ cd linux-3.* $ fakeroot make -f debian/rules.gen binary-arch_i386_none_686
See further information:
Debian Wiki: KernelFAQ
Debian Wiki: DebianKernel
Debian Linux Kernel Handbook: http://kernel-handbook.alioth.debian.org
The hardware driver is the code running on the target system. Most hardware
drivers are available as free software now and are included in the normal
Debian kernel packages in the main
area.
The firmware is the code or data loaded on the device (e.g., CPU microcode, rendering code running on GPU, or FPGA / CPLD data, …). Some firmware packages are available as free software but many firmware packages are not available as free software since they contain sourceless binary data.
firmware-linux-free (main
)
firmware-linux-nonfree (non-free
)
firmware-linux-* (non-free
)
*-firmware (non-free
)
intel-microcode (non-free
)
amd64-microcode (non-free
)
Please note that non-free
and contrib
packages are not part of the Debian system. The access configuration to
enable and to disable the non-free
and
contrib
areas is described in Sección 2.1.4, “Fundamentos de repositorios Debian”. You should be aware of negatives
associated with the use of the non-free
and
contrib
packages as described in Sección 2.1.5, “Debian es 100% software libre”.
Use of virtualized system enables us to run multiple instances of system simultaneously on a single hardware.
![]() |
Sugerencia |
---|---|
There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.
Tabla 9.26. List of virtualization tools
paquete | popularidad | tamaño | descripción |
---|---|---|---|
schroot
|
V:6, I:10 | 2651 | specialized tool for executing Debian binary packages in chroot |
sbuild
|
V:1, I:3 | 277 | tool for building Debian binary packages from Debian sources |
pbuilder
|
V:2, I:18 | 950 | personal package builder for Debian packages |
debootstrap
|
V:7, I:69 | 258 | bootstrap a basic Debian system (written in sh) |
cdebootstrap
|
V:0, I:4 | 111 | bootstrap a Debian system (written in C) |
virt-manager
|
V:8, I:30 | 7426 | Virtual Machine Manager: desktop application for managing virtual machines |
libvirt-clients
|
V:24, I:45 | 1876 | programs for the libvirt library |
bochs
|
V:0, I:1 | 4086 | Bochs: IA-32 PC emulator |
qemu
|
I:42 | 501 | QEMU: fast generic processor emulator |
qemu-system
|
I:44 | 89 | QEMU: full system emulation binaries |
qemu-user
|
V:3, I:43 | 57857 | QEMU: user mode emulation binaries |
qemu-utils
|
V:10, I:93 | 4767 | QEMU: utilities |
qemu-kvm
|
V:20, I:68 | 98 | KVM: full virtualization on x86 hardware with the hardware-assisted virtualization |
virtualbox
|
V:59, I:74 | 71418 | VirtualBox: x86 virtualization solution on i386 and amd64 |
xen-tools
|
V:0, I:7 | 791 | tools to manage debian XEN virtual server |
wine
|
V:28, I:108 | 163 | Wine: Windows API Implementation (standard suite) |
dosbox
|
V:3, I:20 | 2654 | DOSBox: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS |
dosemu
|
V:0, I:4 | 4885 | DOSEMU: The Linux DOS Emulator |
vzctl
|
V:2, I:4 | 1058 | OpenVZ server virtualization solution - control tools |
vzquota
|
V:2, I:5 | 252 | OpenVZ server virtualization solution - quota tools |
lxc
|
V:7, I:13 | 1297 | Linux containers user space tools |
See Wikipedia article Comparison of platform virtual machines for detail comparison of different platform virtualization solutions.
![]() |
Nota |
---|---|
Some functionalities described here are only available in
|
![]() |
Nota |
---|---|
Default Debian kernels support KVM since
|
Typical work flow for virtualization involves several steps.
Create an empty filesystem (a file tree or a disk image).
The file tree can be created by "mkdir -p
/path/to/chroot
".
The raw disk image file can be created with dd(1) (see Sección 9.6.1, “Making the disk image file” and Sección 9.6.5, “Making the empty disk image file”).
qemu-img(1) can be used to create and convert disk image files supported by QEMU.
The raw and VMDK file format can be used as common format among virtualization tools.
Mount the disk image with mount(8) to the filesystem (optional).
For the raw disk image file, mount it as loop device or device mapper devices (see Sección 9.6.3, “Mounting the disk image file”).
For disk images supported by QEMU, mount them as network block device (see Sección 9.10.3, “Mounting the virtual disk image file”).
Populate the target filesystem with required system data.
The use of programs such as debootstrap
and
cdebootstrap
helps with this process (see Sección 9.10.4, “Chroot system”).
Use installers of OSs under the full system emulation.
Run a program under a virtualized environment.
chroot provides basic virtualized environment enough to compile programs, run console applications, and run daemons in it.
QEMU provides cross-platform CPU emulation.
QEMU with KVM provides full system emulation by the hardware-assisted virtualization.
VirtualBox provides full system emulation on i386 and amd64 with or without the hardware-assisted virtualization.
For the raw disk image file, see Sección 9.6, “The disk image”.
For other virtual disk image files, you can use
qemu-nbd(8)
to export them using network block
device protocol and mount them using the nbd
kernel module.
qemu-nbd(8) supports disk formats supported by QEMU: QEMU supports following disk formats: raw, qcow2, qcow, vmdk, vdi, bochs, cow (user-mode Linux copy-on-write), parallels, dmg, cloop, vpc, vvfat (virtual VFAT), and host_device.
The network block device can
support partitions in the same way as the loop
device (see Sección 9.6.3, “Mounting the disk image file”). You
can mount the first partition of "disk.img
" as follows.
# modprobe nbd max_part=16 # qemu-nbd -v -c /dev/nbd0 disk.img ... # mkdir /mnt/part1 # mount /dev/nbd0p1 /mnt/part1
![]() |
Sugerencia |
---|---|
You may export only the first partition of " |
chroot(8) offers most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting.
![]() |
Atención |
---|---|
Examples below assumes both parent system and chroot system share the same CPU architecture. |
You can learn how to setup and use chroot(8) by running pbuilder(8) program under script(1) as follows.
$ sudo mkdir /sid-root $ sudo pbuilder --create --no-targz --debug --buildplace /sid-root
You see how
debootstrap(8)
or
cdebootstrap(1)
populate system data for sid
environment under
"/sid-root
".
![]() |
Sugerencia |
---|---|
These debootstrap(8) or cdebootstrap(1) are used to install Debian by the Debian Installer. These can also be used to install Debian to a system without using a Debian install disk, but instead from another GNU/Linux distribution. |
$ sudo pbuilder --login --no-targz --debug --buildplace /sid-root
You see how a system shell running under sid
environment
is created as the following.
Copy local configuration ("/etc/hosts
",
"/etc/hostname
", "/etc/resolv.conf
")
Mount "/proc
" filesystem
Mount "/dev/pts
" filesystem
Create "/usr/sbin/policy-rc.d
" which always exits with
101
Run "chroot /sid-root bin/bash -c 'exec -a -bash
bin/bash'
"
![]() |
Nota |
---|---|
Some programs under chroot may require access to more files from the parent
system to function than |
![]() |
Nota |
---|---|
The " |
![]() |
Sugerencia |
---|---|
The original purpose of the specialized chroot package,
|
![]() |
Sugerencia |
---|---|
Similar |
I recommend you to use QEMU or VirtualBox on a Debian stable
system to run multiple desktop systems safely using virtualization. These enable you to run
desktop applications of Debian unstable
and
testing
without usual risks associated with them.
Since pure QEMU is very slow, it is recommended to accelerate it with KVM when the host system support it.
The virtual disk image "virtdisk.qcow2
" containing a
Debian system for QEMU can be created using
debian-installer: Small CDs
as follows.
$ wget http://cdimage.debian.org/debian-cd/5.0.3/amd64/iso-cd/debian-503-amd64-netinst.iso $ qemu-img create -f qcow2 virtdisk.qcow2 5G $ qemu -hda virtdisk.qcow2 -cdrom debian-503-amd64-netinst.iso -boot d -m 256 ...
See more tips at Debian wiki: QEMU.
VirtualBox comes with Qt GUI tools and quite intuitive. Its GUI and command line tools are explained in VirtualBox User Manual and VirtualBox User Manual (PDF).
![]() |
Sugerencia |
---|---|
Running other GNU/Linux distributions such as Ubuntu and Fedora under virtualization is a great way to learn configuration tips. Other proprietary OSs may be run nicely under this GNU/Linux virtualization, too. |