ssh2 library for php

Most extensions for php (PEAR or PECL packages) are generally available through yum and apt-get on red-hat and debian distros respectively.

Extensions installed: snmp, curl, mysql, mysqli, pdo, pdo-mysql

On Ubuntu 7.10, apt-get of any of these php extensions does the following:

1. Copies the name.so (e.g. snmp.so) file in /usr/lib/php5/20060613/ directory.

(No idea why is the directory name a date, instead of 'ext' as mentioned in several forums. Anyways, in /usr/bin/php-config5, you can find the line:
entension_dir=/usr/lib/php5/20060613/)

2. In /etc/php5/conf.d, creates a file name.ini (e.g. snmp.ini), with a single line: extension=snmp.so

The php ssh2 library was not found using apt-get. The following steps were followed in install it. (assuming that openssl, pear, pecl are already installed)

(prerequisite: install the libssh2 library)
1. wget http://surfnet.dl.sourceforge.net/
sourceforge/libssh2/libssh2-0.14.tar.gz
2. tar -zxvf libssh2-0.14.tar.gz
3. cd libssh2-0.14/
4. ./configure
5. sudo make all install

(now, php ssh2)
6. sudo pecl install -f ssh2 - this created ssh2.so in /usr/lib/php5/20060613/
7. created a file /etc/php5/conf.d/ssh2.ini with a line: extension=ssh2.so

Most of the instructions were followed from this page. PHP's own documentation page for ssh2 couldn't help much, but the rest of the documentation can be found there.

Sudo access for apache user

Web-based admin interfaces, like a network management web console, often require to execute certain commands with elevated previleges. Adding an entry in the sudoers file is one straight forward way to do this.

The apache user on debian is 'www-data' and on fedora it is 'apache'. Let apache_user denote the web server user, irrespective of the distro.

In /etc/sudoers, we need to add:
%apache_user ALL=NOPASSWD: ALL

This seems very naive from security perspective.Apache has a feature suEXEC for such purposes. But -

• It does not support if the target user is root (work around – let the target user be userx, such that userx is configured to have admin previleges)
• It requries re-compiling the apache server, and a very careful and complex configuration. Not really suitable for people who use off-the-shelf apache, with default configurations, like me :)

We can modify the line in 'sudoers' file to enhance security a little bit. Instead of sudo access to all commands, we can restrict the sudo access for very few number of commands.

%apache_user ALL=NOPASSWD: /bin/ls, /bin/cat

In my project – php based wireless-mesh network management suite – I've used this :-

%apache_user ALL=NOPASSWD: /usr/bin/php -f /path/to/my/script/daemon.php *

where, daemon.php handles all the tasks requiring admin previleges. The '*' at the end of the line is used to pass command line arguments to the daemon. This type of usage of the sudoers file gives enough security for most practical purposes. After all, I'm not managing a bank here!

Links: Useful thread on apache forum

Uploading files to blogs

Blogger does not have any direct feature to upload and share files (other than images). For PDF and PPT files I would recommend using slideshare.

For other files, you need to use an online storage service which allows access through blogs.

In the previous post, I've used the service of Box.net.
Create an account, upload files. Go to the services tab, and add export to blogs service. Currently it supports WordPress, Blogger and LiveJournal. Then right click on the uploaded file, you'll find an option to export the file to these sites.

In case of Blogger, just enter your blogger username and password, and the name of the post. In case you have multiple blogs, it itself decides which blog to post to.

Note: Even if there exists a post with the name you entered there, Box.net will create a new post with the name provided. So you should start by uploading and exporting files for your post, and edit that post to add your contents.

MRTG RRD Log Querying Tool

There are a lot of free MRTG front-end tools available on the web, but most of them are for the traditional MRTG logs and not for the rrd (round-robin database) log format. Though not as straight forward as sql, some complex queries can nevertheless be issued on the rrd log files using rrdtool.

This tool is a php-based rrd log querying tool developed as a part of my M.Tech thesis.

Requirements

1. A functional web server, preferably apache
2. MRTG and RRDTOOL should be installed on the system.
3. In the mrtg configuration file, add LogFormat: rrdtool
4. Enable passwordless sudo access for apache user (DEBIAN:www-data or REDHAT:apache) if you wish to add interfaces to the mrtg config through the web interface. (Read this post for the right way to do this step)
   

Installation

1. In the queryMrtg.php:
• Set $mrtgdir to the location where mrtg is configured to store its rrd logs, e.g. /var/www/mrtg
• Set $mrtgcfg to the absolute path of the mrtg configuration file, e.g. /etc/mrtg.cfg
• Set $rrdcommand to the rrdtool binary, e.g. /usr/bin/rrdtool
• Set $cfgmaker to the cfgmaker binary, e.g. /usr/bin/cfgmaker
• Set $imgdir to the directory where images will be stored. Create this as a sub-directory of the exported directory in apache (e.g. /var/www/html/images). Add the path relative to the exported directory i.e. if /var/www/html is exported in httpd.conf, then simply write 'images'.
• In the $interfaces array, add all the interfaces that you wish to monitor and query.
2. Copy queryMrtg.php to the web-exported directory. e.g. /var/www/html/queryMrtg.php
   

Usage

1. On your browser, type - http://localhost/queryMrtg.php
2. First time usage - Just click 'Submit'. It would report that MRTG configuration has not been added for the specified interface, and will show a button to add it. Just click!
3. Once you have added interfaces to MRTG configuration, just play around with queries.

Contact
mailto: venkatesh@iitg.ernet.in OR rvenkatesh25@users.sourceforge.net

Screen Shots

Download

querymrtg.tar.gz

Downloading mp3 from Internet - the google way

For music, google -

intitle:"index of" (mp3|mp4|wav) name.of.file -html -htm -asp -jsp -cf -php

Explanation: you are searching for directory listings only. All web pages (html, php etc) are filtered out. Apache's directory listings have "Index of" in the title.

vimrc

This is the vimrc I use:

" Set syntax on
syntax on

" Indent automatically depending on filetype
filetype indent on
set autoindent

" Case insensitive search
set ic

" Higlhight search
set hls

" Incremental search
set incsearch

" Wrap text instead of being on one line
set lbr

" Change colorscheme from default to delek
colorscheme delek

" statusline shown in blue
highlight StatusLine ctermfg=darkblue ctermbg=white

" Show ruler
set ruler

" Set the shell to use
set shell=bash

" Show brace matching as you edit
set showmatch

" Show working mode
set showmode

" Show the command
set showcmd

" Display a status bar
set laststatus=2

" Number of screen lines to use for the command-line
set cmdheight=1

" Shift width when you press <<>> to indent a line.
set shiftwidth=3

" Set Shift rounding off
set shiftround

" Patten matching
set magic

" Switch buffer to edit a new file, and use open file if it already open
set switchbuf=useopen,split

" Changes how backspace works.
set bs=2

" Expand Tab
set expandtab

" Number of spaces for a tab
set tabstop=8

" lines longer than the width of the window will not wrap
set wrap

" Searches does not wrap around the end of the file
set nowrapscan

"Not always equal
set noequalalways

"F2 to Save file
map :w
map B :w

map! :wa
map! B :wa

"F6 to switch window
map w

"Ctrl-Shift-F6 to show only curent file for editing in many windows
map :only!

"- to decrease the current window height
map - -

"= to increase the current window height
map = +

"_ to decrease the current window width
map _ <

"+ to increase the current window width
map + >

"Alt-Up to go to upper window
map k

"Alt-Down to go to the lower window
map j

"Alt-Left to go to the left window
map h

"Alt-Down to go to the right window
map l

Acknowledgments to my friend and mentor Shriram V. This vimrc is the set of those lines which I understood from his highly sophisticated version :)

SSH too slow?

Does it take too long for ssh to ask for password after you've entered ssh user@host?

Edit /etc/ssh/sshd_config

Uncomment this line if present, add it otherwise -
UseDNS no

restart sshd
/etc/init.d/ssh restart

Done!

Some essential packages for ubuntu

To mount and read/write ntfs partitions => ntfs-3g

Installed gparted. To enable create/resize ntfs partitions => ntfsprogs

To enable mp3 support for rythmbox and other gstreamer based players => gstreamerX.YZ-fluendo-mp3
(e.g. gstreamer0.10-fluendo-mp3 or gstreamer0.8-fluendo-mp3)

To install flash player in 64-bit browsers => nspluginwrapper and flashplayer-nonfree (for Ubuntu Gutsy onwards. Others refer here)

exec and shell_exec

In php, both exec() and shell_exec() are used to execute shell commands. When to use which one?

shell_exec() is same as backtick operator. i.e.

echo `ls -l`; is same as
$r = shell_exec("ls -l"); echo $r;

use this when you don't need the return value (0 or some number) of the command.


exec() takes three parameters:
1. command
2. address of the array where the output will be stored
3. address of a integer variable in which the return value will be stored
e.g:

$output = array();
exec("ls -l", &$output, &$ret);

exec returns only the last line of the output, so if you need to process the output, use the $output array.

Here are the manuals for shell_exec and exec.

Passwordless ssh

1. generate keys
localhost$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/localuser/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/localuser/.ssh/id_rsa.
Your public key has been saved in /home/localuser/.ssh/id_rsa.pub.
The key fingerprint is:
1d:75:9f:51:3d:16:40:85:7c:aa:17:84:38:2

c:4e:6b localuser@localhost

2. copy public key to remote host
localhost$ cat ~/.ssh/id_rsa.pub | ssh remoteuser@remotehost "cat - >> ~/.ssh/authorized_keys"

3. now test
localhost$ ssh remoteuser@remotehost

remotehost$



Troubleshooting
1. ensure the following on the remote host

chmod 700 /home/remoteuser
chmod 700 /home/remoteuser/.ssh
chmod 644 /home/remoteuser/.ssh/authorized_keys

In /etc/ssh/sshd_config

RSAAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

Setting GRUB password after installation

$> sudo grub

grub> md5crypt

Password: (enter password here)
Encrypted: (a hash will be generated here. copy this hash)

grub> quit

$> vi /boot/grub/grub.conf

In the grub.conf file, add a line below the splashimage line -
password --md5

Reboot and your grub password should take effect

Screen resolution problem after ubuntu installation

The live CD detects everything correctly, but after installation the resolution is set to 800x600
and there are no higher options.

This problem and its solutions are well discussed here.

This is the solution that worked:

Launch a Terminal window by going Applications > Terminal
Type this at the command prompt:

sudo gedit /etc/X11/xorg.conf
Find the text:

Section "Monitor"
Create the entries for "HorizSync" and "VertRefresh" each on a separate line with the values corresponding to your monitor.
For example, I have a generic 17 inch monitor at 1024x768 and my section looks like this:

Section "Monitor"
Identifier "HWP" # this is my monitor name
Option "DPMS" # default options, leave these alone
HorizSync 28-60 # horizontal refresh frequencies
VertRefresh 43-60 # vertical refresh frequencies
EndSection
Reboot your computer and your resolution should be all set

The official Ubuntu help for this problem is here.

Equipments

PoE standards - here

Access point, DWL 2700AP
It has an in-build data/power splitter

White PoE device is just the base unit.

The new PoE adapter includes a base unit and a terminal unit.

The terminal kit is not needed

DC++ for Linux

yum install linuxdcpp

In active mode, the linux firewall blocks the incoming connections for dc++ , it only works in passive mode
(details about active and passive modes is given here. In a nutshell, in active mode the user directly establishes a connection with the peer and downloads data, whereas in passive mode all data transfer is routed through the hub. So the passive mode is slower)

In effect, you can connect open filelists, search, others can download from you but you can't download from others.

Reason - outgoing connections are allowed, incoming connections are blocked. You initiate a connection to the hub, so its allowed. Opening a filelist and searching, are done through the hub, so that happens. When someone tries to download from you, the hub directs your machine to establish a connection with that peer and send the requested file, so that's allowed too. But when you try to download from peer X, the hub asks peer X to establish a connection with you, peer X (poor honest fellow) tries, but incoming connections on your machine are blocked except on some trusted ports.

Solution - DC++ in active mode will choose any random port for incoming connections. In order to specify a particular port so that you can allow your firewall to let that connection through, select the "firewall with manual port forward" connection mode and enter any port number between 1024 and 65535. Update your firewall settings.. you're done!

Error in loading shared libraries

The application is not able to find the shared library files (.lib .so or .so.*)

Technique #1
export LD_LIBRARY_PATH=/path/to/the/library
add this line to bashrc if you want to avoid typing it everytime

Technique #2
vi /etc/ld.so.conf
add a line: /path/to/the/library
save
run ldconfig

Setting up CVS

Steps:

1. Download and install CVS (check if your existing installation already has it installed). Here's a nice howto
2. Add these to your bashrc
$ export CVSROOT=/home/cvsroot
$ export EDITOR=/bin/vi

3. Create groups and users
$ groupadd cvs
$ useradd -g cvs -d $CVSROOT cvs

4. Initialize a repository
$ cvs init

This creates a repository in $CVSROOT (here, in /home/cvsroot)

5. Start a project. In your home directory:
$ mkdir mesh
$ cd mesh
$ cvs import -d mesh iitg ver_1_0 #iitg is vendor tag, ver_1_0 is release tag

6. Add directories and files
$ cvs add directory
$ cvs add file
$ cvs commit -m "file added"

Checking out in a remote location:

1. Add these to bashrc
export CVSROOT=:ext:root@172.16.26.45:/home/cvs

root
export CVS_RSH=ssh
export EDITOR=/bin/vi

2. Checkout
$ cvs co mesh/kernel

Loadable Module HOWTOs

1. http://tldp.org/HOWTO/Module-HOWTO/index.html by Bryan Henderson
2. http://www.tldp.org/LDP/lkmpg/2.6/html/index.html by Peter Jay Salzman, Michael Burian, Ori Pomerantz for 2.6 kernel

Compilation problems with 2.4 kernel

Downloaded kernel 2.4.21

steps:

1. make clean
2. make mrproper
3. make menuconfig
4. make dep
5. make && make modules
6. make modules_install
7. make bzImage
8. cp arch/i386/boot/bzImage /boot/vmlinuz-2.4.21
9. mkinitrd /boot/initrd-2.4.21.img 2.4.21
10. added entry in /etc/grub.conf

Problem on booting:

mounting /proc filesystem
creating block devices
mounting root filesystem
mount : erro 19 mounting exts
pivotroot : pivot_root (/sysroot, /sysroot/initrd) failed:2
umount /initrd/proc failed :2
freeing unused kernel memory : 128k freed
Kernel panic: no init found. Try passing init= option to kernel

Googled solutions that didn't work:

1. add init=3 in the booting options
2. add init=/bin/sh (or your default shell)
3. replace "root=LABEL=/" by "root=/dev/hdX"
4. add rhgb quiet

What finally worked

1. ext3 file system was included as a module, changed it to be a part of the kernel
2. added options while creating initrd -> mkinitrd --fstab=/etc/fstab -v -f /boot/initrd-2.4.21 2.4.21

Compiling Linux Kernel 2.6

A Google search on “HOWTO compile linux kernel” will give you 1,160,000 pages in 0.23 seconds. Yet when I was stuck with one of my assignments, none of those pages (that is, top 20 of them.. nobody goes beyond that anyway!) contained everything that I was looking for. This simple-how-to (S-HOWTO) aims to summarize the basic minimum steps required, leaving the details to the interest of an individual.

The example taken here is to add NTFS support (read/write) to the linux kernel. The kernel version I’ve worked on is 2.6.19.1, on i386 architecture (though this should be fine for any 2.6.x and other architectures)

1. You can either work on your existing kernel, provided you’ve installed it with source; or you can download the latest kernel tar ball from www.kernel.org

2. In case you’ve downloaded, untar the package in the /usr/src dir, using the command -

$> tar xvjf linux-2.6.19.1.tar.bz2

3. This step is not required in your first try, but in the subsequent experiments, you should probably clean up your earlier changes by using -

$> make mrproper

4. To enable NTFS support, type -

$> make menuconfig

In the menu display that comes up, navigate through - File Systems ---> DOS/FAT/NT Filesystems. Select NTFS file system support and press ‘Y’. Press ‘Y’ for debugging support and/or write support based on your requirements.

5. In general, you can navigate though all the options and make whatever changes that you want. To know about a particular option, select it and press ‘?’ to see the description.
Or use 'make defconfig' to get the default configuration (according to some rumours, these are Linus Torvalds' configuration :) )

6. Use to come out of the menu. Press “Yes” when it prompts to save the changes.

7. The next step is – make

8. If you have not added/removed/modified any module (that is, if you have not touched anything with a ‘M’ on it) you can simply write – $> make vmlinux (this would just compile the kernel)

Conversely, if you have just modified the modules, and not changed anything with a ‘*’ marked on it, write –

$> make modules (this would just compile the modules)

A simple ‘make’ does ‘make vmlinux’ followed by ‘make modules’.
Note: ‘make dep’ is not required (as it was with 2.4.x kernels)

9. If you have touched the modules (i.e. used ‘make’ or ‘make modules’) write –

$> make modules_install (This installs the modules in /lib/modules/2.6.x.y directory)

10. Last step is -

$> make install


This step does the following things:

a. Creates a bzImage of the compiled kernel (in arch/i386/boot/ dir)
b. Copies that iamge to /boot dir (renames it as vmlinuz-2.6.x.y)
c. Creates the initrd (initial RAM disk) image and stores it in the /boot dir
d. Creates the System.map file (mapping modules to their memory location) in the /boot dir
e. Modifies the grub.conf/lilo.conf

Reboot, and select the new kernel version while booting. Tathastu! Xtra:
What is initrd?
Why is initrd required?

Module Compiling Makefile Changes from 2.4 to 2.6

2.4 method of compiling a module:

 KERNELDIR = /usr/src/linux
 CFLAGS = -D__KERNEL__ -DMODULE -I$(KERNELDIR)/include -O

    all: module.o

And done. To add on to this, somthing more is required in 2.6

In 2.6, all loadable modules now need to go through a linking step. The link brings in init/vermagic.o from the kernel source tree; this object creates a special section in the loadable module describing the environment in which it was built. It includes the compiler version used, whether the kernel was built for SMP, whether kernel preemption is enabled, the architecture which was compiled for, and, of course, the kernel version. A difference in any of these parameters can render a module incompatible with a given running kernel; rather than fail in mysterious ways, the new module loader opts to detect these compatibilities and refuse to load the module.

New way:

obj-m :=module.o
module-objs := file1.o file2.o

To get the make command call the kernel build system to read this makefile, add:

make -C /path/to/source SUBDIRS=$PWD modules

The makefile is read in two passes, in the first time it will simply invoke the kernel build system, while the actual work will get done in the second pass.


Reference: http://lwn.net/Articles/21823/