Capítulo 9. Trucos del sistema

Tabla de contenidos

9.1. El programa screen
9.1.1. Escenario de uso de screen(1)
9.1.2. Atajos de teclado para la órden screen
9.2. Registro de datos y presentación
9.2.1. El demonio de registro
9.2.2. Analizador de registros
9.2.3. Registro correcto de las actividades del intérprete de órdenes
9.2.4. Personalizar la visualización de datos de texto
9.2.5. Personalización de la visualización de la fecha y hora
9.2.6. Intérprete de órdenes en color
9.2.7. Órdenes coloreadas
9.2.8. Grabación de las actividades del editor con repeticiones complejas
9.2.9. Captura una imagen gráfica en un aplicación X
9.2.10. Guardando cambios en los archivos de configuración
9.3. Monitoreando, controlando e iniciando lo que hacer los programas
9.3.1. Temporización de un proceso
9.3.2. La prioridad de planificación
9.3.3. La órden ps
9.3.4. La órden top
9.3.5. Enumeración de los archivos abiertos por un proceso
9.3.6. Trazando la actividad de un programa
9.3.7. Identificación de procesos utlizando archivos o conexiones (sockets)
9.3.8. Repetición de una órden a intervalos constantes
9.3.9. Repetición de una órden sobre archivos
9.3.10. Iniciar un programa desde el interfaz gráfico de usuario
9.3.11. Personalizando el inicio de un programa
9.3.12. Killing a process
9.3.13. Scheduling tasks once
9.3.14. Scheduling tasks regularly
9.3.15. Alt-SysRq key
9.4. System maintenance tips
9.4.1. Who is on the system?
9.4.2. Warning everyone
9.4.3. Hardware identification
9.4.4. Hardware configuration
9.4.5. System and hardware time
9.4.6. The terminal configuration
9.4.7. The sound infrastructure
9.4.8. Disabling the screen saver
9.4.9. Disabling beep sounds
9.4.10. Memory usage
9.4.11. System security and integrity check
9.5. Data storage tips
9.5.1. Disk space usage
9.5.2. Disk partition configuration
9.5.3. Accessing partition using UUID
9.5.4. LVM2
9.5.5. Filesystem configuration
9.5.6. Filesystem creation and integrity check
9.5.7. Optimization of filesystem by mount options
9.5.8. Optimization of filesystem via superblock
9.5.9. Optimization of hard disk
9.5.10. Optimization of solid state drive
9.5.11. Using SMART to predict hard disk failure
9.5.12. Specify temporary storage directory via $TMPDIR
9.5.13. Expansion of usable storage space via LVM
9.5.14. Expansion of usable storage space by mounting another partition
9.5.15. Expansion of usable storage space by bind-mounting another directory
9.5.16. Expansion of usable storage space using symlink
9.5.17. Expansion of usable storage space using overlayfs
9.6. The disk image
9.6.1. Making the disk image file
9.6.2. Writing directly to the disk
9.6.3. Mounting the disk image file
9.6.4. Cleaning a disk image file
9.6.5. Making the empty disk image file
9.6.6. Making the ISO9660 image file
9.6.7. Writing directly to the CD/DVD-R/RW
9.6.8. Mounting the ISO9660 image file
9.7. The binary data
9.7.1. Viewing and editing binary data
9.7.2. Manipulating files without mounting disk
9.7.3. Data redundancy
9.7.4. Data file recovery and forensic analysis
9.7.5. Splitting a large file into small files
9.7.6. Clearing file contents
9.7.7. Dummy files
9.7.8. Erasing an entire hard disk
9.7.9. Erasing unused area of an hard disk
9.7.10. Undeleting deleted but still open files
9.7.11. Searching all hardlinks
9.7.12. Invisible disk space consumption
9.8. Data encryption tips
9.8.1. Removable disk encryption with dm-crypt/LUKS
9.8.2. Encrypted swap partition with dm-crypt
9.8.3. Mounting encrypted disk with dm-crypt/LUKS
9.8.4. Automatically encrypting files with eCryptfs
9.8.5. Automatically mounting eCryptfs
9.9. The kernel
9.9.1. Linux kernel 2.6/3.x
9.9.2. Kernel parameters
9.9.3. Kernel headers
9.9.4. Compiling the kernel and related modules
9.9.5. Compiling the kernel source: Debian Kernel Team recommendation
9.9.6. Hardware drivers and firmware
9.10. Virtualized system
9.10.1. Virtualization tools
9.10.2. Virtualization work flow
9.10.3. Mounting the virtual disk image file
9.10.4. Chroot system
9.10.5. Multiple desktop systems

Aquí, describo los trucos fundamentales para configurar y gestionar sistemas, principalmente desde la consola.

Screen(1) es una herramienta muy útil para el acceso remoto a sitio con conexiones no confiables o intermitentes ya que permite conexiones con redes cuya conectividad es intermitente.


La utilización para el registro de la actividad del intérprete de órdenes, sin más, de script(1) (see Sección 1.4.9, “Grabando las actividades de los intérpretes de órdenes”) produce un archivo con carácteres de control. Esto se puede evitar con la utilización de col(1) como se muestra.

$ script
Script started, file is typescript

Haga lo que quiera ... y pulse Ctrl-D para finalizar script.

$ col -bx <typescript >archivo_filtrado
$ vim cleanedfile

Si no utiliza script (por ejemplo, durante el proceso de arranque en initramfs), puede utilizar lo siguiente.

$ sh -i 2>&1 | tee typescript
[Sugerencia] Sugerencia

Algunos emuladores de terminales x como gnome-terminal tienen la capacidad de regsitro de la actividad. Puede que quiera extender el buffer de la línea para mejorar la capacidad de ir hacia atrás.

[Sugerencia] Sugerencia

Puede utilizar screen(1) con "^A H" (consulte Sección 9.1.2, “Atajos de teclado para la órden screen”) para personalizar como se guarda la información de la consola.

[Sugerencia] Sugerencia

Puede usar emacs(1) con "M-x shell", "M-x shell", o "M-x term" para personalizar el registro de la consola. Más tarde puede utilizar "C-x C-w" para guardar el buffer a un archivo.

Aunque las herramientas de paginación como more(1) y less(1) (consulte Sección 1.4.5, “El paginador”) y herramientas personalizadas para marcar y dar formato (see Sección 11.1.8, “Highlighting and formatting plain text data”) pueden visualizar los datos de texto de la forma correcta, los editores de propósito general (consulte Sección 1.4.6, “El editor de texto”) son más versátiles y personalizables.

[Sugerencia] Sugerencia

En vim(1) y su modo de paginación conocido como view(1), ":set hls" permite la búsqueda de textos resaltados.

El formato de visualización del tiempo y la fecha de la órden "ls -l" depende de la configuración regional (consulte sus valores en Sección 1.2.6, “Sellos de tiempo”). La variable "$LANG" se tiene en cuenta primero y puede ser sobreescrita por el valor de la variable "$LC_TIME".

El formato de visualización por defecto actual para cada configuración regional depende de la versión de la biblioteca estándar C (el paquete utilizado libc6). Esto es, diferentes versiones de Debian tienen diferentes valores por defecto.

Si de verdad quiere personalizar el formato de visualización de la hora y la fecha independientemente de la configuración regional, debería asignar el valor de estilo de tiempo por el argumento "--time-style" o por el valor de "$TIME_STYLE" (consulte ls(1), date(1), "info coreutils 'ls invocation'").


[Sugerencia] Sugerencia

Puede evitar escribir largas opciones en las líneas de órdenes utilizando alias de órdenes , p. ej. "alias ls='ls --time-style=+%d.%m.%y\ %H:%M'" (consulte Sección 1.5.9, “Alias de órdenes”).

[Sugerencia] Sugerencia

ISO 8601 se sigue los siguientes formatos iso.

En los mśa recientes terminales se pueden utilizar colores utilizando secuencias de escape ANSI (consulte "/usr/share/doc/xterm/ctlseqs.txt.gz").

Por ejemplo, intente lo siguiente

$ RED=$(printf "\x1b[31m")
$ NORMAL=$(printf "\x1b[0m")
$ REVERSE=$(printf "\x1b[7m")
$ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"

Puede guardar las actividades del editor con repeticones complejas.

Para Vim, como sigue.

  • "qa": comienza a grabar los carácteres escritos en un registro llamado "a".

  • … actividades del editor

  • "q": finaliza la grabación de los carácteres escritos.

  • "@a": ejecuta el contenido del registro "a".

Para Emacs, como sigue.

  • "C-x (": comienza a definir una macro de teclado.

  • … actividades del editor

  • "C-x )": termina definir una macro de teclado.

  • "C-x e": ejecuta una macro de teclado.

Las actividades de los programas pueden ser monitoreados y controlados utilizando herramientas especializadas.

Tabla 9.7. Enumeración de las herramientas de monitorización y control de las actividades de los programas

paquete popularidad tamaño descripción
coreutils V:876, I:999 14642 nice(1): ejecuta un programa modificando su prioridad de planificación
bsdutils V:846, I:999 238 renice(1): cambia la prioridad de planificación de un proceso en ejecución
procps V:800, I:999 690 "/proc" utilidades del sistema de archivos: ps(1), top(1), kill(1), watch(1), …
psmisc V:590, I:974 588 "/proc" utilidades del sistema de archivos: killall(1), fuser(1), peekfd(1), pstree(1)
time V:43, I:842 81 time(1): ejecuta un programa para crear un informe de los recursos del sistema utilizados a lo largo del tiempo
sysstat V:95, I:113 1332 sar(1), iostat(1), mpstat(1), …: herramientas de optimización del sistema en Linux
isag V:0, I:4 106 Graficador Interactivo de la Actividad del Sistema para sysstat
lsof V:361, I:944 440 lsof(8): enumera la lista de archivos abiertos por un proceso en ejecución utilizando la opción "-p"
strace V:23, I:165 1223 strace(1): registro de las llamadas del sistema y señales
ltrace V:1, I:23 323 ltrace(1): registro a las bibliotecas invocadas
xtrace V:0, I:1 336 xtrace(1): registra las comunicaciones entre el cliente y el servidor en X11
powertop V:6, I:229 563 powertop(1): información sobre el uso de la potencia por parte del sistema
cron V:874, I:997 194 ejecuta procesos en segundo plano de acuerdo a su planificación desde el dominio cron(8)
anacron V:452, I:539 62 planficador de tareas similar a cron para los sistemas que no están activos 24 horas al dia
at V:500, I:850 145 at(1) or batch(1): ejecuta un trabajo at en un momento determinado o por debajo de cierto nivel de carga

[Sugerencia] Sugerencia

El paquete procps provee lo fundamental para la monitorización, control e inicio de las actividades de los programas. Usted podría aprender acerca de todo ello.

Existen varias formas de repetir una órden en bucle sobre archivos que cumplen una condición, p. ej, encajan en un patrón "*.ext".

for x in *.ext; do if [ -f "$x"]; then órden "$x" ; fi; done
  • Combinación de find(1) y xargs(1):

find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 órden
  • find(1) con la ópcion "-exec" y una órden:

find . -type f -maxdepth 1 -name '*.ext' -exec órden '{}' \;
  • find(1) con la opción "-exec" con un archivo de órdenes pequeño:

find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "órden '{}' && echo 'successful'" \;

Los ejemplos anteriores están escritos para asegurar el correcto tratamiento de los nombres de archivos que contienen carácteres raros como los espacios. Para usos avanzados de find(1) consulte Sección 10.1.5, “Idioms for the selection of files”.

Para el interfaz de órdenes en línea (CLI), el programa ejecutado será el primero que encaja el nombre en el directorio especificdo por la variable de entorno $PATH. Consulte Sección 1.5.3, “La variable "$PATH"”.

Para el interfaz gráfico de usuario (GUI) que cumple con el estándar de freedesktop.org, los archivos *.desktop en el directorio /usr/share/applications/ proporciona los atributos necesarios para la visualización de cada programa en el menú del interfaz gráfico de usuario. Consulte Sección 7.2.2, “Menú de Freedesktop.org”.

Por ejemplo, el archivo chromium.desktop define los atributos para el "Navegador Web Chromium" como "Name" para el nombre del programa, "Exec" para la ruta de ejecución del programa y argumentos, "Icon" para el icono utilizado, etc. (consulte la Especificación de Entradas del Escritorio (Desktop Entry Specification)) como sigue:

[Desktop Entry]
Version=1.0
Name=Chromium Web Browser
GenericName=Web Browser
Comment=Access the Internet
Comment[fr]=Explorer le Web
Exec=/usr/bin/chromium %U
Terminal=false
X-MultipleArgs=false
Type=Application
Icon=chromium
Categories=Network;WebBrowser;
MimeType=text/html;text/xml;application/xhtml_xml;x-scheme-handler/http;x-scheme-handler/https;
StartupWMClass=Chromium
StartupNotify=true

Esta es una descripción muy simplificadao. Los archivos *.desktop son revisados como sigue.

El entorno de escritorio asigna las variables del entorno $XDG_DATA_HOME and $XDG_DATA_DIR. Por ejemplo, en GNOME 3:

  • $XDG_DATA_HOME esta sin asignar. (El valor por defecto que se utiliza es $HOME/.local/share.)

  • $XDG_DATA_DIRS se le asigna el valor /usr/share/gnome:/usr/local/share/:/usr/share/.

Así los directorios base (consulte XDG Base Directory Specification) y los directorios de aplicaciones quedan como sigue.

  • $HOME/.local/share/$HOME/.local/share/applications/

  • /usr/share/gnome//usr/share/gnome/applications/

  • /usr/local/share//usr/local/share/applications/

  • /usr/share//usr/share/applications/

Los archivos *.desktop se comprueban en estos directorios de aplicaciones siguiendo este órden.

[Sugerencia] Sugerencia

Se puede crear una entrada personalizada al menú del interfaz gráfico de usuario (GUI) añadiendo un archivo *.desktop al directorio $HOME/.local/share/applications/.

[Sugerencia] Sugerencia

Igualmente, si se crea un archivo *.desktop en el directorio autostart por debajo de estos directorios base, el programa que se especifique en el archivo *.desktop se ejecuta automáticamente cuando el entorno de escritorio se inicia. Consulte Especificación de Inicio Automático de Aplicaciones de Escritorio.

[Sugerencia] Sugerencia

De igual manera, si un archivo *.desktop se crea en el directorio $HOME/Desktop y se ha configurado el entorno de escritorio con la funcionalidad del lanzador del icono, el programa especificado en el se ejecutará cuando se pulse sobre el icono. Dese cuenta que el nombre real del directorio $HOME/Desktop depende de la configuración regional. Consulte xdg-user-dirs-update(1).

Algunos programas inician otros programa de forma automática. Aquí estan los puntos a compribar para la personalización de este proceso.

[Sugerencia] Sugerencia

update-mime(8) updates the "/etc/mailcap" file using "/etc/mailcap.order" file (see mailcap.order(5)).

[Sugerencia] Sugerencia

The debianutils package provides sensible-browser(1), sensible-editor(1), and sensible-pager(1) which make sensible decisions on which editor, pager, and web browser to call, respectively. I recommend you to read these shell scripts.

[Sugerencia] Sugerencia

In order to run a console application such as mutt under X as your preferred application, you should create an X application as following and set "/usr/local/bin/mutt-term" as your preferred application to be started as described.

# cat /usr/local/bin/mutt-term <<EOF
#!/bin/sh
gnome-terminal -e "mutt \$@"
EOF
chmod 755 /usr/local/bin/mutt-term

Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).

You can schedule to run processes as a normal user, e.g. foo by creating a crontab(5) file as "/var/spool/cron/crontabs/foo" with "crontab -e" command.

Here is an example of a crontab(5) file.

# use /bin/sh to run commands, no matter what /etc/passwd says
SHELL=/bin/sh
# mail any output to paul, no matter whose crontab this is
MAILTO=paul
# Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed)
# run at 00:05, every day
5  0  *  * *   $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
# run at 14:15 on the first of every month -- output mailed to paul
15 14 1  * *   $HOME/bin/monthly
# run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc:
0 22 *   * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%%
23 */2 1 2 *   echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1"
5  4 *   * sun echo "run at 04:05 every Sunday"
# run at 03:40 on the first Monday of each month
40 3 1-7 * *   [ "$(date +%a)" == "Mon" ] && command -args
[Sugerencia] Sugerencia

For the system not running continuously, install the anacron package to schedule periodic commands at the specified intervals as closely as machine-uptime permits. See anacron(8) and anacrontab(5).

[Sugerencia] Sugerencia

For scheduled system maintenance scripts, you can run them periodically from root account by placing such scripts in "/etc/cron.hourly/", "/etc/cron.daily/", "/etc/cron.weekly/", or "/etc/cron.monthly/". Execution timings of these scripts can be customized by "/etc/crontab" and "/etc/anacrontab".

Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system.


[Sugerencia] Sugerencia

Read the signal(7), kill(1), and sync(1) manpages to understand the description above.

The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations and gaining usable keyboard access without stopping the system.

See "/usr/share/doc/linux-doc-3.*/Documentation/sysrq.txt.gz".

[Atención] Atención

The Alt-SysRq feature may be considered a security risk by allowing users access to root-privileged functions. Placing "echo 0 >/proc/sys/kernel/sysrq" in "/etc/rc.local" or "kernel.sysrq = 0" in "/etc/sysctl.conf" disables the Alt-SysRq feature.

[Sugerencia] Sugerencia

From SSH terminal etc., you can use the Alt-SysRq feature by writing to the "/proc/sysrq-trigger". For example, "echo s > /proc/sysrq-trigger; echo u > /proc/sysrq-trigger" from the root shell prompt syncs and umounts all mounted filesystems.

Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.


Here, ACPI is a newer framework for the power management system than APM.

[Sugerencia] Sugerencia

CPU frequency scaling on modern system is governed by kernel modules such as acpi_cpufreq.

The following sets system and hardware time to MM/DD hh:mm, CCYY.

# date MMDDhhmmCCYY
# hwclock --utc --systohc
# hwclock --show

Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UTC(GMT).

If the hardware (BIOS) time is set to UTC, change the setting to "UTC=yes" in the "/etc/default/rcS".

The following reconfigure the timezone used by the Debian system.

# dpkg-reconfigure tzdata

If you wish to update system time via network, consider to use the NTP service with the packages such as ntp, ntpdate, and chrony.

[Sugerencia] Sugerencia

Under systemd, use systemd-timesyncd for the network time synchronization instead. See systemd-timesyncd(8).

See the following.

[Sugerencia] Sugerencia

ntptrace(8) in the ntp package can trace a chain of NTP servers back to the primary source.

Device drivers for sound cards for current Linux are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.

[Sugerencia] Sugerencia

Use "cat /dev/urandom > /dev/audio" or speaker-test(1) to test speaker (^C to stop).

[Sugerencia] Sugerencia

If you can not get sound, your speaker may be connected to a muted output. Modern sound system has many outputs. alsamixer(1) in the alsa-utils package is useful to configure volume and mute settings.

Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.


There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.

Poor system maintenance may expose your system to external exploitation.

For system security and integrity check, you should start with the following.


Here is a simple script to check for typical world writable incorrect file permissions.

# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)
[Atención] Atención

Since the debsums package uses MD5 checksums stored locally, it can not be fully trusted as the system security audit tool against malicious attacks.

Booting your system with Linux live CDs or debian-installer CDs in rescue mode makes it easy for you to reconfigure data storage on your boot device.

For disk partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.

Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).

[Nota] Nota

Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector.

Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.


[Atención] Atención

Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), mkfs.ext4(8), …) and resize2fs(8).

[Nota] Nota

In order to switch between GPT and MBR, you need to erase first few blocks of disk contents directly (see Sección 9.7.6, “Clearing file contents”) and use "parted /dev/sdx mklabel gpt" or "parted /dev/sdx mklabel msdos" to set it. Please note "msdos" is use here for MBR.

LVM2 is a logical volume manager for the Linux kernel. With LVM2, disk partitions can be created on logical volumes instead of the physical harddisks.

LVM requires the following.

  • device-mapper support in the Linux kernel (default for Debian kernels)

  • the userspace device-mapper support library (libdevmapper* package)

  • the userspace LVM2 tools (lvm2 package)

Please start learning LVM2 from the following manpages.

  • lvm(8): Basics of LVM2 mechanism (list of all LVM2 commands)

  • lvm.conf(5): Configuration file for LVM2

  • lvs(8): Report information about logical volumes

  • vgs(8): Report information about volume groups

  • pvs(8): Report information about physical volumes

For ext4 filesystem, the e2fsprogs package provides the following.

  • mkfs.ext4(8) to create new ext4 filesystem

  • fsck.ext4(8) to check and to repair existing ext4 filesystem

  • tune2fs(8) to configure superblock of ext4 filesystem

  • debugfs(8) to debug ext4 filesystem interactively. (It has undel command to recover deleted files.)

The mkfs(8) and fsck(8) commands are provided by the e2fsprogs package as front-ends to various filesystem dependent programs (mkfs.fstype and fsck.fstype). For ext4 filesystem, they are mkfs.ext4(8) and fsck.ext4(8) (they are symlinked to mke2fs(8) and e2fsck(8)).

Similar commands are available for each filesystem supported by Linux.


[Sugerencia] Sugerencia

Ext4 filesystem is the default filesystem for the Linux system and strongly recommended to use it unless you have some specific reasons not to.

[Sugerencia] Sugerencia

Btrfs filesystem is available in Linux kernel 3.2 (Debian wheezy). It is expected to be the next default filesystem after the ext4 filesystem.

[Aviso] Aviso

You should not use the Btrfs filesystem for your critical data yet before it acquires the live kernel space fsck(8) feature and the boot loader support.

[Sugerencia] Sugerencia

Some tools allow access to filesystem without Linux kernel support (see Sección 9.7.2, “Manipulating files without mounting disk”).

The basic static filesystem configuration is given by "/etc/fstab". For example,

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    defaults        0       0
UUID=709cbe4c-80c1-56db-8ab1-dbce3146d2f7 / ext4 noatime,errors=remount-ro 0 1
UUID=817bae6b-45d2-5aca-4d2a-1267ab46ac23 none swap sw  0       0
/dev/scd0       /media/cdrom0   udf,iso9660 user,noauto 0       0
[Sugerencia] Sugerencia

UUID (see Sección 9.5.3, “Accessing partition using UUID”) may be used to identify a block device instead of normal block device names such as "/dev/sda1", "/dev/sda2", …

Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). Notable ones are the following.

  • "defaults" option implies default options: "rw,suid,dev,exec,auto,nouser,async". (general)

  • "noatime" or "relatime" option is very effective for speeding up the read access. (general)

  • "user" option allows an ordinary user to mount the filesystem. This option implies "noexec,nosuid,nodev" option combination. (general, used for CDs or usb storage devices)

  • "noexec,nodev,nosuid" option combination is used to enhance security. (general)

  • "noauto" option limits mounting by explicit operation only. (general)

  • "data=journal" option for ext3fs can enhance data integrity against power failure with some loss of write speed.

[Sugerencia] Sugerencia

You need to provide kernel boot parameter (see Sección 3.1.2, “Fase 2: el cargador de arranque”), e.g. "rootflags=data=journal" to deploy a non-default journaling mode for the root filesystem. For lenny, the default jounaling mode is "rootflags=data=ordered". For squeeze, it is "rootflags=data=writeback".

Performance and disk wear of the solid state drive (SSD) can be optimized as follows.

  • Use the latest Linux kernel. (>= 3.2)

  • Reduce disk writes for read disk accesses.

    • Set "noatime" or "relatime" mount option in /etc/fstab.

  • Enable the TRIM command.

    • Set "discard" mount option in /etc/fstab for the ext4 filesystem, swap partition, Btrfs, etc. See fstab(5).

    • Set "discard" option in /etc/lvm/lvm.conf for LVM. See lvm.conf(5).

    • Set "discard" option in /etc/crypttab for dm-crypt. See crypttab(5).

  • Enable the SSD optimized disk space allocation scheme.

    • Set "ssd" mount option in /etc/fstab for the Btrfs.

  • Make system flush data to the disk every 10 minutes for laptop PCs.

    • Set "commit=600" mount option in /etc/fstab. See fstab(5).

    • Set pm-utils to use laptop-mode even under AC operation. See Debian BTS #659260.

[Aviso] Aviso

Changing flushing interval from normal 5 seconds to 10 minutes makes your data vulnerable to the power failure.

You can monitor and log your hard disk which is compliant to SMART with the smartd(8) daemon.

  1. Enable SMART feature in BIOS.

  2. Install the smartmontools package.

  3. Identify your hard disk drives by listing them with df(1).

    • Let's assume a hard disk drive to be monitored as "/dev/hda".

  4. Check the output of "smartctl -a /dev/hda" to see if SMART feature is actually enabled.

    • If not, enable it by "smartctl -s on -a /dev/hda".

  5. Enable smartd(8) daemon to run by the following.

    • uncomment "start_smartd=yes" in the "/etc/default/smartmontools" file.

    • restart the smartd(8) daemon by "sudo /etc/init.d/smartmontools restart".

[Sugerencia] Sugerencia

The smartd(8) daemon can be customized with the /etc/smartd.conf file including how to be notified of warnings.

For partitions created on Logical Volume Manager (LVM) (Linux feature) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.

If you have usable space in another partition (e.g., "/path/to/empty" and "/path/to/work"), you can create a directory in it and stack that on to an old directory (e.g., "/path/to/old") where you need space with OverlayFS with Linux kernel 3.18 or newer (Debian Stetch 9.0 or newer).

$ sudo mount -t overlay overlay \
  -olowerdir=/path/to/old-dir,upperdir=/path/to/empty,workdir=/path/to/work

Here, "/path/to/empty" and "/path/to/work" should be on the RW-enabled partition to write on "/path/to/old".

Here, we discuss manipulations of the disk image.

The disk image file, "disk.img", of an unmounted device, e.g., the second SCSI or serial ATA drive "/dev/sdb", can be made using cp(1) or dd(1) by the following.

# cp /dev/sdb disk.img
# dd if=/dev/sdb of=disk.img

The disk image of the traditional PC's master boot record (MBR) (see Sección 9.5.2, “Disk partition configuration”) which reside on the first sector on the primary IDE disk can be made by using dd(1) by the following.

# dd if=/dev/hda of=mbr.img bs=512 count=1
# dd if=/dev/hda of=mbr-nopart.img bs=446 count=1
# dd if=/dev/hda of=mbr-part.img skip=446 bs=1 count=66
  • "mbr.img": The MBR with the partition table

  • "mbr-nopart.img": The MBR without the partition table

  • "mbr-part.img": The partition table of the MBR only

If you have an SCSI or serial ATA device as the boot disk, substitute "/dev/hda" with "/dev/sda".

If you are making an image of a disk partition of the original disk, substitute "/dev/hda" with "/dev/hda1" etc.

The disk image "partition.img" containing a single partition image can be mounted and unmounted by using the loop device as follows.

# losetup -v -f partition.img
Loop device is /dev/loop0
# mkdir -p /mnt/loop0
# mount -t auto /dev/loop0 /mnt/loop0
...hack...hack...hack
# umount /dev/loop0
# losetup -d /dev/loop0

This can be simplified as follows.

# mkdir -p /mnt/loop0
# mount -t auto -o loop partition.img /mnt/loop0
...hack...hack...hack
# umount partition.img

Each partition of the disk image "disk.img" containing multiple partitions can be mounted by using the loop device. Since the loop device does not manage partitions by default, we need to reset it as follows.

# modinfo -p loop # verify kernel capability
max_part:Maximum number of partitions per loop device
max_loop:Maximum number of loop devices
# losetup -a # verify nothing using the loop device
# rmmod loop
# modprobe loop max_part=16

Now, the loop device can manage up to 16 partitions.

# losetup -v -f disk.img
Loop device is /dev/loop0
# fdisk -l /dev/loop0

Disk /dev/loop0: 5368 MB, 5368709120 bytes
255 heads, 63 sectors/track, 652 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x452b6464

      Device Boot      Start         End      Blocks   Id  System
/dev/loop0p1               1         600     4819468+  83  Linux
/dev/loop0p2             601         652      417690   83  Linux
# mkdir -p /mnt/loop0p1
# mount -t ext4 /dev/loop0p1 /mnt/loop0p1
# mkdir -p /mnt/loop0p2
# mount -t ext4 /dev/loop0p2 /mnt/loop0p2
...hack...hack...hack
# umount /dev/loop0p1
# umount /dev/loop0p2
# losetup -d /dev/loop0

Alternatively, similar effects can be done by using the device mapper devices created by kpartx(8) from the kpartx package as follows.

# kpartx -a -v disk.img
...
# mkdir -p /mnt/loop0p2
# mount -t ext4 /dev/mapper/loop0p2 /mnt/loop0p2
...
...hack...hack...hack
# umount /dev/mapper/loop0p2
...
# kpartx -d /mnt/loop0
[Nota] Nota

You can mount a single partition of such disk image with loop device using offset to skip MBR etc., too. But this is more error prone.

The empty disk image "disk.img" which can grow up to 5GiB can be made using dd(1) as follows.

$ dd bs=1 count=0 if=/dev/zero of=disk.img seek=5G

You can create an ext4 filesystem on this disk image "disk.img" using the loop device as follows.

# losetup -f -v disk.img
Loop device is /dev/loop1
# mkfs.ext4 /dev/loop1
...hack...hack...hack
# losetup -d /dev/loop1
$ du  --apparent-size -h disk.img
5.0G  disk.img
$ du -h disk.img
83M disk.img

For "disk.img", its file size is 5.0 GiB and its actual disk usage is mere 83MiB. This discrepancy is possible since ext4 can hold sparse file.

[Sugerencia] Sugerencia

The actual disk usage of sparse file grows with data which are written to it.

Using similar operation on devices created by the loop device or the device mapper devices as Sección 9.6.3, “Mounting the disk image file”, you can partition this disk image "disk.img" using parted(8) or fdisk(8), and can create filesystem on it using mkfs.ext4(8), mkswap(8), etc.

The ISO9660 image file, "cd.iso", from the source directory tree at "source_directory" can be made using genisoimage(1) provided by cdrkit by the following.

#  genisoimage -r -J -T -V volume_id -o cd.iso source_directory

Similarly, the bootable ISO9660 image file, "cdboot.iso", can be made from debian-installer like directory tree at "source_directory" by the following.

#  genisoimage -r -o cdboot.iso -V volume_id \
   -b isolinux/isolinux.bin -c isolinux/boot.cat \
   -no-emul-boot -boot-load-size 4 -boot-info-table source_directory

Here Isolinux boot loader (see Sección 3.1.2, “Fase 2: el cargador de arranque”) is used for booting.

You can calculate the md5sum value and make the ISO9660 image directly from the CD-ROM device as follows.

$ isoinfo -d -i /dev/cdrom
CD-ROM is in ISO 9660 format
...
Logical block size is: 2048
Volume size is: 23150592
...
# dd if=/dev/cdrom bs=2048 count=23150592 conv=notrunc,noerror | md5sum
# dd if=/dev/cdrom bs=2048 count=23150592 conv=notrunc,noerror > cd.iso
[Aviso] Aviso

You must carefully avoid ISO9660 filesystem read ahead bug of Linux as above to get the right result.

Here, we discuss direct manipulations of the binary data on storage media.

With physical access to your PC, anyone can easily gain root privilege and access all the files on your PC (see Sección 4.7.4, “Asegurando la contraseña de root”). This means that login password system can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although GNU privacy guard (see Sección 10.3, “Data security infrastructure”) can encrypt files, it takes some user efforts.

dm-crypt and eCryptfs facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.


Dm-crypt is a cryptographic filesystem using device-mapper. Device-mapper maps one block device to another.

eCryptfs is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.

[Atención] Atención

Data encryption costs CPU time etc. Please weigh its benefits and costs.

[Nota] Nota

Entire Debian system can be installed on a encrypted disk by the debian-installer (lenny or newer) using dm-crypt/LUKS and initramfs.

[Sugerencia] Sugerencia

See Sección 10.3, “Data security infrastructure” for user space encryption utility: GNU Privacy Guard.

You can encrypt contents of removable mass devices, e.g. USB memory stick on "/dev/sdx", using dm-crypt/LUKS. You simply format it as the following.

# badblocks -c 1024 -s -w -t random -v /dev/sdx
# fdisk /dev/sdx
... "n" "p" "1" "return" "return" "w"
# cryptsetup luksFormat /dev/sdx1
...
# cryptsetup open --type luks /dev/sdx1 sdx1
...
# ls -l /dev/mapper/
total 0
crw-rw---- 1 root root  10, 60 2008-10-04 18:44 control
brw-rw---- 1 root disk 254,  0 2008-10-04 23:55 sdx1
# mkfs.vfat /dev/mapper/sdx1
...
# cryptsetup luksClose sdx1

Then, it can be mounted just like normal one on to "/media/<disk_label>", except for asking password (see Sección 10.1.7, “Removable storage device”) under modern desktop environment, such as GNOME using gnome-mount(1). The difference is that every data written to it is encrypted. You may alternatively format media in different filesystem, e.g., ext4 with "mkfs.ext4 /dev/mapper/sdx1".

[Nota] Nota

If you are really paranoid for the security of data, you may need to overwrite multiple times (the "badblocks" command in the above example). This operation is very time consuming though.

Let's assume that your original "/etc/fstab" contains the following.

/dev/sda7 swap sw 0 0

You can enable encrypted swap partition using dm-crypt by as the following.

# aptitude install cryptsetup
# swapoff -a
# echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab
# perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab
# /etc/init.d/cryptdisks restart
 ...
# swapon -a

You can encrypt files written under "~/Private/" automatically using eCryptfs and the ecryptfs-utils package.

  • Run ecryptfs-setup-private(1) and set up "~/Private/" by following prompts.

  • Activate "~/Private/" by running ecryptfs-mount-private(1).

  • Move sensitive data files to "~/Private/" and make symlinks as needed.

    • Candidates: "~/.fetchmailrc", "~/.ssh/identity", "~/.ssh/id_rsa", "~/.ssh/id_dsa" and other files with "go-rwx"

  • Move sensitive data directories to a subdirectory in "~/Private/" and make symlinks as needed.

    • Candidates: "~/.gnupg" and other directories with "go-rwx"

  • Create symlink from "~/Desktop/Private/" to "~/Private/" for easier desktop operations.

  • Deactivate "~/Private/" by running ecryptfs-umount-private(1).

  • Activate "~/Private/" by issuing "ecryptfs-mount-private" as you need encrypted data.

[Sugerencia] Sugerencia

Since eCryptfs selectively encrypt only the sensitive files, its system cost is much less than using dm-crypt on the entire root or "/home" device. It does not require any special on-disk storage allocation effort but cannot keep all filesystem metadata confidential.

If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via PAM (Pluggable Authentication Modules).

Insert the following line just before "pam_permit.so" in "/etc/pam.d/common-auth".

auth required pam_ecryptfs.so unwrap

Insert the following line just at the last line in "/etc/pam.d/common-session".

session optional pam_ecryptfs.so unwrap

Insert the following line at first active line in "/etc/pam.d/common-password".

password required pam_ecryptfs.so

This is quite convenient.

[Aviso] Aviso

Configuration errors of PAM may lock you out of your own system. See Capítulo 4, Acreditación.

[Atención] Atención

If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see Sección 4.3, “Buenas contraseñas”). Unless you are careful to set up a strong password, your data is at risk when someone runs password cracking software after stealing your laptop (see Sección 4.7.4, “Asegurando la contraseña de root”).

Debian distributes modularized Linux kernel as packages for supported architectures.

There are few notable features on Linux kernel 2.6/3.x compared to 2.4.

The version bump from Linux 2.6.39 to Linux 3.0 is not about major technological changes but about the 20th anniversary.

Many Linux features are configurable via kernel parameters as follows.

See "kernel-parameters.txt(.gz)" and other related documents in the Linux kernel documentation ("/usr/share/doc/linux-doc-3.*/Documentation/filesystems/*") provided by the linux-doc-3.* package.

Debian has its own method of compiling the kernel and related modules.


If you use initrd in Sección 3.1.2, “Fase 2: el cargador de arranque”, make sure to read the related information in initramfs-tools(8), update-initramfs(8), mkinitramfs(8) and initramfs.conf(5).

[Aviso] Aviso

Do not put symlinks to the directories in the source tree (e.g. "/usr/src/linux*") from "/usr/include/linux" and "/usr/include/asm" when compiling the Linux kernel source. (Some outdated documents suggest this.)

[Nota] Nota

When compiling the latest Linux kernel on the Debian stable system, the use of backported latest tools from the Debian unstable may be needed.

[Nota] Nota

The dynamic kernel module support (DKMS) is a new distribution independent framework designed to allow individual kernel modules to be upgraded without changing the whole kernel. This is used for the maintenance of out-of-tree modules. This also makes it very easy to rebuild modules as you upgrade kernels.

The hardware driver is the code running on the target system. Most hardware drivers are available as free software now and are included in the normal Debian kernel packages in the main area.

  • GPU driver

    • Intel GPU driver (main)

    • AMD/ATI GPU driver (main)

    • NVIDIA GPU driver (main for nouveau driver, and non-free for binary-only drivers supported by the vendor.)

  • Softmodem driver

    • martian-modem and sl-modem-dkms packages (non-free)

The firmware is the code or data loaded on the device (e.g., CPU microcode, rendering code running on GPU, or FPGA / CPLD data, …). Some firmware packages are available as free software but many firmware packages are not available as free software since they contain sourceless binary data.

  • firmware-linux-free (main)

  • firmware-linux-nonfree (non-free)

  • firmware-linux-* (non-free)

  • *-firmware (non-free)

  • intel-microcode (non-free)

  • amd64-microcode (non-free)

Please note that non-free and contrib packages are not part of the Debian system. The access configuration to enable and to disable the non-free and contrib areas is described in Sección 2.1.4, “Fundamentos de repositorios Debian”. You should be aware of negatives associated with the use of the non-free and contrib packages as described in Sección 2.1.5, “Debian es 100% software libre”.

Use of virtualized system enables us to run multiple instances of system simultaneously on a single hardware.

There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.

Tabla 9.26. List of virtualization tools

paquete popularidad tamaño descripción
schroot V:6, I:10 2651 specialized tool for executing Debian binary packages in chroot
sbuild V:1, I:3 277 tool for building Debian binary packages from Debian sources
pbuilder V:2, I:18 950 personal package builder for Debian packages
debootstrap V:7, I:69 258 bootstrap a basic Debian system (written in sh)
cdebootstrap V:0, I:4 111 bootstrap a Debian system (written in C)
virt-manager V:8, I:30 7426 Virtual Machine Manager: desktop application for managing virtual machines
libvirt-clients V:24, I:45 1876 programs for the libvirt library
bochs V:0, I:1 4086 Bochs: IA-32 PC emulator
qemu I:42 501 QEMU: fast generic processor emulator
qemu-system I:44 89 QEMU: full system emulation binaries
qemu-user V:3, I:43 57857 QEMU: user mode emulation binaries
qemu-utils V:10, I:93 4767 QEMU: utilities
qemu-kvm V:20, I:68 98 KVM: full virtualization on x86 hardware with the hardware-assisted virtualization
virtualbox V:59, I:74 71418 VirtualBox: x86 virtualization solution on i386 and amd64
xen-tools V:0, I:7 791 tools to manage debian XEN virtual server
wine V:28, I:108 163 Wine: Windows API Implementation (standard suite)
dosbox V:3, I:20 2654 DOSBox: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS
dosemu V:0, I:4 4885 DOSEMU: The Linux DOS Emulator
vzctl V:2, I:4 1058 OpenVZ server virtualization solution - control tools
vzquota V:2, I:5 252 OpenVZ server virtualization solution - quota tools
lxc V:7, I:13 1297 Linux containers user space tools

See Wikipedia article Comparison of platform virtual machines for detail comparison of different platform virtualization solutions.

[Nota] Nota

Some functionalities described here are only available in squeeze or later.

[Nota] Nota

Default Debian kernels support KVM since lenny.

Typical work flow for virtualization involves several steps.

For the raw disk image file, see Sección 9.6, “The disk image”.

For other virtual disk image files, you can use qemu-nbd(8) to export them using network block device protocol and mount them using the nbd kernel module.

qemu-nbd(8) supports disk formats supported by QEMU: QEMU supports following disk formats: raw, qcow2, qcow, vmdk, vdi, bochs, cow (user-mode Linux copy-on-write), parallels, dmg, cloop, vpc, vvfat (virtual VFAT), and host_device.

The network block device can support partitions in the same way as the loop device (see Sección 9.6.3, “Mounting the disk image file”). You can mount the first partition of "disk.img" as follows.

# modprobe nbd max_part=16
# qemu-nbd -v -c /dev/nbd0 disk.img
...
# mkdir /mnt/part1
# mount /dev/nbd0p1 /mnt/part1
[Sugerencia] Sugerencia

You may export only the first partition of "disk.img" using "-P 1" option to qemu-nbd(8).

chroot(8) offers most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting.

[Atención] Atención

Examples below assumes both parent system and chroot system share the same CPU architecture.

You can learn how to setup and use chroot(8) by running pbuilder(8) program under script(1) as follows.

$ sudo mkdir /sid-root
$ sudo pbuilder --create --no-targz --debug --buildplace /sid-root

You see how debootstrap(8) or cdebootstrap(1) populate system data for sid environment under "/sid-root".

[Sugerencia] Sugerencia

These debootstrap(8) or cdebootstrap(1) are used to install Debian by the Debian Installer. These can also be used to install Debian to a system without using a Debian install disk, but instead from another GNU/Linux distribution.

$ sudo pbuilder --login --no-targz  --debug --buildplace /sid-root

You see how a system shell running under sid environment is created as the following.

  1. Copy local configuration ("/etc/hosts", "/etc/hostname", "/etc/resolv.conf")

  2. Mount "/proc" filesystem

  3. Mount "/dev/pts" filesystem

  4. Create "/usr/sbin/policy-rc.d" which always exits with 101

  5. Run "chroot /sid-root bin/bash -c 'exec -a -bash bin/bash'"

[Nota] Nota

Some programs under chroot may require access to more files from the parent system to function than pbuilder provides. For example, "/sys", "/etc/passwd", "/etc/group", "/var/run/utmp", "/var/log/wtmp", etc. may need to be bind-mounted or copied.

[Nota] Nota

The "/usr/sbin/policy-rc.d" file prevents daemon programs to be started automatically on the Debian system. See "/usr/share/doc/sysv-rc/README.policy-rc.d.gz".

[Sugerencia] Sugerencia

The original purpose of the specialized chroot package, pbuilder is to construct a chroot system and builds a package inside the chroot. It is an ideal system to use to check that a package's build-dependencies are correct, and to be sure that unnecessary and wrong build dependencies do not exist in the resulting package.

[Sugerencia] Sugerencia

Similar schroot package may give you an idea to run i386 chroot system under amd64 parent system.

I recommend you to use QEMU or VirtualBox on a Debian stable system to run multiple desktop systems safely using virtualization. These enable you to run desktop applications of Debian unstable and testing without usual risks associated with them.

Since pure QEMU is very slow, it is recommended to accelerate it with KVM when the host system support it.

The virtual disk image "virtdisk.qcow2" containing a Debian system for QEMU can be created using debian-installer: Small CDs as follows.

$ wget http://cdimage.debian.org/debian-cd/5.0.3/amd64/iso-cd/debian-503-amd64-netinst.iso
$ qemu-img create -f qcow2 virtdisk.qcow2 5G
$ qemu -hda virtdisk.qcow2 -cdrom debian-503-amd64-netinst.iso -boot d -m 256
...

See more tips at Debian wiki: QEMU.

VirtualBox comes with Qt GUI tools and quite intuitive. Its GUI and command line tools are explained in VirtualBox User Manual and VirtualBox User Manual (PDF).

[Sugerencia] Sugerencia

Running other GNU/Linux distributions such as Ubuntu and Fedora under virtualization is a great way to learn configuration tips. Other proprietary OSs may be run nicely under this GNU/Linux virtualization, too.