Soar High with Pi: We complete

FR D
+

DV
EE
our maker-tech flight simulator

ISSUE 279 – FEBRUARY 2024

Intrusion
Detection
Protect your home network
with a Raspberry Pi

Passive Reconnaissance: DNS Hijacking: A poorly

Discover the tools intruders use
to prepare for an attack
VeraCrypt: Lock Down your Data
Mining Crypto on Linux:
You can still get in the
game with Monero and a
not-too-enhanced Debian rig
W W W. L I N U X - M A G A Z I N E . C O M
managed DNS server could
give up your IP address
SSH Best Practices:
Limit access and be careful
with the keys!
INCREDIBLE
10 FOSS FINDS
 
 * !*$'#$*
 *%(&** "*

  


   

)*!'*''*
 *(&** "*

  



  


$&( "( (#(
(  !($  #(


 #'( '(($!(

   

 
 (( '(  ( " (% '(

 ( ($ (
 
    
 EDITORIAL
Welcome

HOW DEEP IS YOUR CHAT?

Dear Reader,
Books, academic journals, tech blogs, and social media posts
have been trumpeting dire warnings about super-intelligent
AI systems snuffing out civilization. This certainly is a real
problem – I don’t want to make light of it. But another serious,
and perhaps more immediate, problem is really stupid, inept
AI systems messing things up through sheer incompetence.
The Washington Post had a story recently [1] about a study
by a European nonprofit [2] on the trouble AI chatbots had
with answering basic questions about political elections.
According to the story, Bing’s AI chatbot, which is now
called Microsoft Copilot, “gave inaccurate answers to one
out of every three basic questions about candidates, polls,
scandals, and voting in a pair of recent election cycles in
Germany and Switzerland.”
Before you write this off as yet another Linux guy ranting
about Microsoft, I should add, the reason why the study fo-
cused on Microsoft’s chat tool is because Copilot can output
its sources along with its chat responses, which made it
easier to check. The story points out that “Preliminary test-
ing of the same prompts on OpenAI’s GPT-4, for instance,
turned up the same kinds of inaccuracies.” Google Bard
wasn’t tested because it isn’t yet available in Europe.
The errors cited in the study included giving incorrect dates
for elections, misstating poll numbers, and failing to men-
tion when a candidate dropped out of the race. The study
even documents cases of the chatbot “inventing contro-
versies” about a candidate.
Note that I’m not talking about some arcane anomaly
buried deep in the program logic. The bot literally
couldn’t read the very articles it was citing as sources.
Of course, Copilot got many of the answers right. “Two
out of three” wouldn’t have been too bad for an experi-
mental system 10 years ago maintained by experts who
knew what they were getting. The problem is that we have
endured a year of continuous hype about the wonders of
generative AI, and people are actually starting to believe it.
It is one thing to ask an AI to write a limerick – it is quite
another to ask it to chase down information you will use
for voting in a critical election. Many elections are decided
by one- to three-percent margins. The implications of a
chatbot acting as a source for voters and getting 30 per-
cent of the answers wrong are enormous.
The study also points out that accuracy varies with the lan-
guage. Questions asked in German led to inaccurate re-
sponses 37 percent of the time, whereas English answers
were only wrong 20 percent of the time (that’s still way too
many mistakes). French weighed in at a 24-percent error rate.
AI proponents answer that this is all a process, and the an-
swers will get more accurate in time. The general sense is
that this is just a matter of bug hunting. You make a list of
the problems, then tick them off one by one. But it isn’t
clear that these complex issues will be solved in some
pleasingly linear fashion. The AI industry made surpris-
ingly little progress for years and slow-walked through
most of its history before the recent breakthroughs that
led to the latest generation. It is possible we’ll need to wait
for another breakthrough to make another incremental
step, and in the meantime, we could do a lot of damage by
encouraging people to put their trust in all the bots that
are currently getting hyped in the press.
If you want to get an AI to draw a picture of your boss, go
ahead and play. But it looks like, at least for now, questions
about which candidate to vote for
might require a human.
Joe Casad,
Editor in Chief

Info
[1] “AI Chatbot Got Election Info Wrong 30 Percent of the Time,
European Study Finds” by Will Oremus, Washington Post,
December 15, 2023: https://www.washingtonpost.com/
technology/2023/12/15/microsoft-copilot-bing-ai-
hallucinations-elections/ (paywalled)
[2] “Prompting Elections: The Reliability of Generative AI in the 2023
Swiss and German Elections,” AI Forensics: https://aiforensics.
org/work/bing-chat-elections

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 3

 FEBRUARY 2024
ON THE COVER
36 DNS Subdomain Hijacking
Protect yourself from the dangers of dangling
DNS records with DNS Reaper.
38 Passive Reconnaissance
Find out what intruders already know about
your network.
48 Mining Monero
We’ll show you how to mine crypto without
expensive hardware or a bulky interface.
NEWS
8 News
• Hundreds of Consumer and Enterprise Devices
Vulnerable to LogoFAIL
• Linux Mint 21.3 Beta Available
• Arch Linux 2023.12.01 Released
• Zorin OS 17 Beta Available for Testing
• Red Hat Migrates RHEL from Xorg to Wayland
• PipeWire 1.0 Officially Released
• Rocky Linux 9.3 Available for Download
• Ubuntu Budgie Shifts How to Tackle Wayland
• TUXEDO’s New Ultraportable Linux Workstation Released
12 Kernel News
• Fonts in the Kernel
• IA-64 Removed from the Kernel (Not)
• Jitter Patches
COVER STORY
16 Building a Rasp Pi IDS
An intrusion detection system was once considered too
complicated and too expensive for a home network, but
nowadays, you can use a Raspberry Pi and the Suricata IDS
for real-time notice of an incoming attack.
@linux_pro Linux Magazine
@linuxpromagazine @linuxmagazine
ERRATUM: BCPL for the Raspberry Pi, Linux Magazine 278, p. 74.
We published an incorrect link to the article listings and “A
User Guide to BCPL for the Raspberry Pi.” The correct link is:
https://linuxnewmedia.thegood.cloud/s/5Rzx9tQW2FJ6N3Z
4 FEBRUARY 2024 ISSUE 279
54 VeraCrypt
Save your secrets with this powerful disk
encryption tool.
70 Flight Simulator
Sophisticated simulator for would-be aviators
in the maker space.
92 SSH Keys
These keys to SSH safety will keep your
communications private.
REVIEWS
22 Distro Walk – Peppermint OS
Peppermint OS promotes user choice every step of the
way. Bruce talks to the Peppermint OS team about how
the project has evolved over more than a decade.
26 Organizational Tools
If you need help staying organized, Linux does not let you
down with its large collection of organization and
scheduling tools.
IN-DEPTH
32 Command Line – tldr
A simplified alternative to man pages, tldr provides the
most common command options at a glance.
36 DNS Subdomain Hijacking
Attackers can use poorly maintained DNS records to gain
access to your IP address. The open source DNS Reaper lets
you monitor your records to ward off attacks.
38 Passive Reconnaissance
Cyberattacks often start with preliminary research on
network assets and the people who use them. We'll show
you some of the tools attackers use to get information.
44 Formatting with LibreOffice
Learning how to use styles in LibreOffice can save you
hours of formatting and let you focus on your writing.
48 Mining Monero
The Monero cryptocurrency lets you get in the game without
spending thousands on hardware. We’ll show you how.
LINUX-MAGAZINE.COM
16 Intrusion
Detection
You don’t need a fancy
appliance to watch for 77 Welcome
This month in Linux Voice.
intruders – just Suricata
79 Doghouse – Choosing an OS
and a Raspberry Pi. A few considerations can help you choose the right OS.

80 Oh My Posh
Adapt the terminal’s appearance and feature set with
IN-DEPTH the Oh My Posh prompt theme engine.

54 VeraCrypt 82 System Monitoring Center

Protect your data and operating system from prying eyes The System Monitoring Center combines all the
with VeraCrypt. important information you need to monitor a
computer in a single state-of-the-art interface.
58 Programming Snapshot – Google Drive
Search Tool 86 FOSSPicks
To check his Google Drive files with three different pattern This month Graham looks at Cardinal, Celestia 1.7.0,
matchers, Mike builds a command-line tool in Go to Friture, Wavetable, Helix Editor, Brogue CE, and more!
maintain a meta cache.
92 Tutorial – SSH Keys
MakerSpace Verifying the security of your SSH configuration and
performing regular audits are critical practices in
maintaining a secure Linux environment.
66 Sensor Shootout
Any application that collects a large number of measurements
is bound to have some anomalous measurements, but good
sensor breakouts should not output such values all the
time. We tested eight temperature and humidity
sensors for accuracy.

70 Pi Flight Simulator
A Raspberry Pi 4B with Linux can solve the equations TWO TERRIFIC DISTROS
for real-time aircraft simulation, including emulation
of modern aircraft flight displays.
DOUBLE-SIDED DVD!
SEE PAGE 6 FOR DETAILS
95 Back Issues 97 Call for Papers
96 Events 98 Coming Next Month

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 5

DVD
This Month’s DVD
EndeavourOS 11 and Arch Linux 2023.12.01
Two Terrific Distros on a Double-Sided DVD!
EndeavourOS 11
64-bit
EndeavourOS is an ideal choice for users who want
to experience Arch Linux but not the challenges of
installing it. EndeavourOS replaces Arch’s traditional
manual install with Calamares, a popular graphic
installer used by many modern distributions,
making it more accessible than even the latest Arch
release.
Code-named Galileo, EndeavourOS 11 is a
housekeeping release, intended to make the
distribution easier to both maintain and use. For the
first time, community editions and multiple desktops
are not available through the installer, and the
default desktop is KDE Plasma instead of Xfce.
Galileo also restructures package selection as well
as the installer, offers stronger LUKS encryption, and
improves dual booting with Windows, while also
providing the usual application upgrades of most
general releases. The overall result is an even more
user-friendly distribution than earlier releases.
Defective discs will be replaced. Please send an email to subs@linux-magazine.com.
Although this Linux Magazine disc has been tested and is to the best of our knowledge free of malicious software and defects, Linux Magazine
cannot be held responsible and is not liable for any disruption, loss, or damage to data and computer systems related to the use of this disc.
6 FEBRUARY 2024 ISSUE 279
Arch Linux 2023.12.01
64-bit
Arch Linux is one of the oldest and most popular
distributions, as well as one of the first rolling
releases. For years it has had a formidable reputation
for its manual install, which requires patience and
documentation for new users to master.
Arch Linux 2023.12.01 represents a mild departure
from this tradition. Although it lacks a graphical
installer, it includes a text-based guided installer,
which has only been available for the last couple of
years. When typing archinstall at the root prompt,
users can search for the latest version of the installer
and then select via the keyboard a series of choices
at each step. Guidance is minimal, without instruction
or any more feedback than what is selected, but it is
enough that anyone who has installed Linux before
is likely to have few problems.
Other new features include a unified kernel image
(UKI) to boot easily from UEFI or bootloaders and
support for proprietary NVIDIA drivers, but archinstall
remains the outstanding feature of the release.
Thanks to archinstall, installing Arch Linux remains a
useful way to learn more about the structure of Linux.
Although Arch Linux 2023.12.01 requires less
expertise than earlier releases, it still offers a
hands-on experience that assumes at least some
familiarity with Linux.
LINUX-MAGAZINE.COM
 NEWS
Updates on technologies, trends, and tools
THIS MONTH’S NEWS
08 • Hundreds of Consumer
and Enterprise Devices
Vulnerable to LogoFAIL
• Linux Mint 21.3 Beta
Available with Latest
Version of Cinnamon
09 • Arch Linux 2023.12.01
Released with a Much-
Improved Installer
• Zorin OS 17 Beta
Available for Testing
• More Online
10 • Red Hat Migrates RHEL
from Xorg to Wayland
• PipeWire 1.0 Officially
Released
• Rocky Linux 9.3 Available
for Download
11 • Ubuntu Budgie Shifts
How to Tackle Wayland
• TUXEDO’s New
Ultraportable Linux
Workstation Released
8 FEBRUARY 2024 ISSUE 279
Hundreds of Consumer and Enterprise
Devices Vulnerable to LogoFAIL
At Black Hat Europe 2023, Fabio Pagani shared a presentation (https://www.blackhat.
com/eu-23/briefings/schedule/index.html#logofail-security-implications-of-image-pars-
ing-during-system-boot-35042) about a newly discovered collection of vulnerabilities
being used against Linux and Windows systems that involves, believe it or not, logos.
LogoFAIL is a group of vulnerabilities that targets UEFI code from various firm-
ware/BIOS vendors through high-impact flaws in the image parsing libraries within
the firmware.
According to Binarly (https://binarly.io/posts/The_Far_Reaching_Consequences_
of_LogoFAIL/index.html ), “One of the most important discoveries is that LogoFAIL
is not silicon-specific and can impact x86 and ARM-based devices. LogoFAIL is
UEFI and IBV-specific because of the specifics of vulnerable image parsers that
have been used. That shows a much broader impact from the perspective of the
discoveries that will be presented on Dec 6th.”
The vulnerability was originally discovered on Lenovo devices with Insyde, AMI,
and Phoenix reference code and was reported under the advisory BRLY-2023-006.
After the research group was able to demonstrate a number of attack surfaces from
image-parsing firmware components, it became a “massive industry-wide disclosure.”
LogoFAIL allows attackers to store malicious images on either the EFI system
partition or inside unsigned sections of firmware updates. When the images are
parsed at boot, the vulnerability is triggered and the payload can then be executed
to hijack the process and bypass security features.
Hundreds of consumer and enterprise devices (from numerous vendors) are vul-
nerable. As of now, there’s no indication of when this vulnerability will be patched.
Linux Mint 21.3 Beta Available with Latest
Version of Cinnamon
Christmas came early for Linux Mint fans because version 21.3 (aka “Virginia”) is
now available for download and testing.
The big ticket item for 21.3 is Cinnamon 6, which offers a Wayland session
(for those interested in testing). The Wayland session for Cinnamon 6 includes
support for fractional scaling (with HiDPI screens) and plenty of other improve-
ments/new features, such as an updated Sound applet (with support for the
Telegram Desktop), support for AVIF images as desktop wallpapers, better han-
dling of YouTube in Hypnotix IPTV player, window resizing from with the menu
editor, window resizing and keybinding updates from within the Menu Editor,
and plenty of bug fixes.
All of the in-house apps have received plenty of attention and the “Romeo” unstable
software repository will be available to use to install bleeding-edge releases of apps.
Linux Mint 21.3 is based on Ubuntu 22.04, is powered by the 5.15 LTS kernel, and
will receive updates until 2027.
You can download an ISO of the beta version (https://mirrors.edge.kernel.org/
linuxmint/testing/linuxmint-21.3-cinnamon-64bit-beta.iso) and test it yourself. To
learn more about the latest release from Linux Mint, check out the official release
notes (https://www.linuxmint.com/rel_virginia.php).
LINUX-MAGAZINE.COM
 NEWS
Linux News

Arch Linux 2023.12.01 Released with a

MORE ONLINE
Much-Improved Installer
Linux Magazine
Arch Linux is well known for not only being one of the most stable operating www.linux-magazine.com
systems on the market but also for being a bit complicated to install. With the
December release (available now), that all changes. ADMIN HPC
Although Arch Linux still doesn’t use a GUI installer, the archinstall command http://www.admin-magazine.com/HPC/
makes installing the open source OS much simpler than previous iterations. With Linux Software RAID
a text-based menu installer, you’ll find getting Arch Linux up and running a far less • Jeff Layton
“painful” process. Manage storage by building software RAID
As first reported by 9to5Linux (https://9to5linux.com/arch-linuxs-december- with the Linux mdadm command.
2023-iso-release-brings-linux-6-6-lts-updated-installer), the latest version of
archinstall (version 2.7) also adds a few important features: support for unified ADMIN Online
kernel image (UKI), the ability to check for a new version of archinstall during http://www.admin-magazine.com/
the installation process, support for the nvidia-dkms package (when installing Dockerizing Legacy Applications
the NVIDIA proprietary graphics driver); and plenty of bug fixes. • Artur Skura
The latest version of Arch Linux also includes kernel 6.6 LTS. Sooner or later, you’ll want to convert
Anyone looking to install the latest version of Arch Linux can head to the official your legacy application to a containerized
download page (https://archlinux.org/download/ ), select the mirror nearest to your environment. Docker offers the tools for a
location, and download the ISO image for installation. smooth and efficient transition.
Unlike many Linux distributions, Arch Linux doesn’t publish official release notes.
Integrating a Linux system with Active
Instead, you’ll find information shared by the team with the public for the latest re-
Directory
lease at https://archlinux.org/releng/releases/2023.12.01/ . • Ali Imran Nagori
Of course, you can always join the Arch-announce mailing list (https://lists.arch- Your Active Directory system doesn’t have to
linux.org/postorius/lists/arch-announce.lists.archlinux.org/ ) to keep abreast of what’s be a walled garden. A few easy steps are all
going on with the distribution. you need to integrate Linux with AD.

Network Security in the Google Cloud

Zorin OS 17 Beta Available for Testing Platform
• Guido Söldner
The team behind Zorin OS proudly announces the release of the beta for version
Creating complex network infrastructures
17 of the popular Linux distribution. The developers and designers behind Zorin on the Google Cloud Platform is quick and
OS listened to community feedback when creating the new release to bring easy with virtual private clouds, but fast
what they are calling the “greatest and most refined computing experience doesn’t always mean right. We look at the
ever.” on-board tools you need to heighten your
New features found in Zorin OS 17 Beta include a universal search in the main cloud security.
menu, which allows you to search for apps, files, calendar appointments, con-
tacts, world clocks, apps that can be installed from the Software store, and even
use it as a calculator. It’s also possible to customize the search providers within
Settings | Search Panel.
Zorin OS 17 Beta also refines multitasking with a nod to GNOME 45 by arrang-
ing workspaces horizontally. Users also can open the overview with a three-finger
up or down swipe on a touchpad and switch between workspaces with a three-
finger swipe to the left or right. When you double-tap the Super key, the app grid
expands so you can open a new app by dragging and dropping its launcher to the
desired workspace.
There also is the new Spatial Desktop, which gives you better contextual
awareness of what’s on your desktop. The Spatial Desktop includes two fea-
tures: Spatial Window Switcher (which replaces the old, flat switcher with a 3D
option) and Desktop Cube (which resembles the old Cube desktop from Com-
piz). Both of these new options are not only an easier way to interact with your
workspaces but also add enough eye candy to wow users.
Other improvements include performance optimizations at every level, a re-
freshed Software store, advanced window tiling, improved Quick Settings, a
new Power Modes option, new screenshot and screen recording tools, a rede-
signed weather app, and (coming soon) two new desktop layers.
If you’d like to test the beta of Zorin OS 17, you can download it here
(https://zrn.co/17corebeta ).

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 9

NEWS
Linux News

Red Hat Migrates RHEL from Xorg to Wayland

With the release of RHEL 10, Red Hat plans on making the migration from Xorg to
Wayland, thereby closing the door on the out-of-date Linux windowing service for good.
On November 27th, developer Carlos Sanchez posted this in the official announce-
ment (https://www.redhat.com/en/blog/rhel-10-plans-wayland-and-xorg-server):
“...We’ve decided to remove Xorg server and other X servers (except
Xwayland) from RHEL 10 and the following releases. Xwayland should be able
to handle most X11 clients that won’t immediately be ported to Wayland, and if
needed, our customers will be able to stay on RHEL 9 for its full life cycle while
resolving the specifics needed for transitioning to a Wayland ecosystem.”
The announcement continues, “It’s important to note that ‘Xorg Server’ and ‘X11’
are not synonymous, X11 is a protocol that will continue to be supported through
Xwayland, while the Xorg Server is one of the implementations of the X11 protocol.”
This move will help Red Hat (and other distributions) take care of numerous is-
sues, especially those regarding security (as Xorg cannot meet today’s heightened
needs for a more secure windowing protocol). Beyond security, Wayland also ad-
dresses things like better GPU/Display hot-plugging, improved gestures and
scrolling, better support for high-density displays, and more.
Although not every distribution has made the switch, when Red Hat finally mi-
grates to Wayland, it would come as no surprise that those distributions that have
hesitated will make the jump as well. And given that Xorg development has gone
nearly stagnant, this shift should come as no surprise.

PipeWire 1.0 Officially Released

Most likely, you use a Linux distribution that employs PipeWire, which is the subsys-
tem that handles audio and video on modern Linux desktop computers. It has been
a long time coming, but the release of version 1.0 is finally here.
Version 1.0 enables jackdbus support by default; retains API/ABI compatibility; solves
the jitter issue in ALSA (when using IRQ mode); offers plenty of module bug fixes;
vastly improves Bluetooth LC3 codec compatibility as well as JACK transport and time
handling; optimizes buffer reuse with JACK; better socket permissions; MIDI event re-
cording preview in Ardour; improved resume from suspend in ALSA; and much more.
There are relatively few new features for PipeWire 1.0. You will find a new option
for exposing ALSA controls as prop parameters as well as support for XDG-base
directories (when loading ACP configurations).
In addition, the update includes support for pause and resume in pipe-tunnel, fil-
ter-chain support for new linear/clamp/recip/exp/log/mult/sing plugins, the ability
to handle NULL values from mmap_areas in the ALSA plugin, and support for uclamp
(to allow the PipeWire scheduler to make better-informed decisions about task
placement).
Read the full details on the PipeWire GitHub page for the “El Presidente” release
(https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.0.0) and wait for your
distribution of choice to update to the latest version of the sound subsystem.

Rocky Linux 9.3 Available for Download

Rocky Linux 9.3 is ready to download and install. This latest release includes en-
hancements to the AWS EC2 AMD and Intel architecture AMI image to support
UEFI boot, as well as the legacy BIOS option.
Get the latest news There have been plenty of security improvements, including a Keylime rebase to
version 7.3.0; OpenSSH was migrated from the less secure SHA-1 message digest;
in your inbox every improvements to support the Extended Master Secret (EMS) extension that is re-
week quired by the FIPS-140-3 standard for TLS 1.2 connections; SELinux tools were re-
based to version 4.4.2; OpenSCAP rebased to 1.3.8; and the SCAP Security Guide
Subscribe FREE rebased to version 0.1.69.
to Linux Update As for programming languages and toolchains, you’ll find Redis 7.0, Node.js
bit.ly/Linux-Update 20, GCC 11.4.1, Valgrind 3.21, SystemTap 4.9, elfutils 0.189, the addition of the

10 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 NEWS
Linux News

GCC Toolset (version 13), LLVM Toolset 16.0.6, Rust Toolset 1.71.1, and Go Tool-
set 1.20.6.
A number of issues also have been fixed for the installer and image creator, secu-
rity, software management, shells and CLI tools, networking, and more.
One thing to keep in mind with this release is that there is no upgrade path to 9.3
from version 8. If you’re running Rocky Linux 8.x, you’ll need to do a fresh install to
migrate to version 9.3.
You can download an ISO of Rocky Linux 9.3 (https://rockylinux.org/download )
and read the full release notes (https://docs.rockylinux.org/release_notes/9_3/ ) for
more information.

Ubuntu Budgie Shifts How to Tackle Wayland

Up to now, Ubuntu Budgie has held fast to Xorg as their windowing system. They fo-
cused their efforts with the help of Enlightenment, but, with that relationship souring
(due to very slow development on the Wayland/Enlightenment front), the Ubuntu
Budgie team has decided to part ways and are now considering Xfce as their guide.
The current Enlightenment/Wayland support is far from suitable for end users,
which puts Ubuntu Budgie at an impasse, as they want to make the switch.
To that end, the team started exploring different routes to success and decided
Xfce’s work with libxfce4windowing offers them the best chance for success. The
libxfce4windowing layer serves as a bridge between X11 and Wayland to make the
transition as seamless as possible.
The two teams have decided to collaborate on the Wayland mission to build a
robust, seamless experience for users and, hopefully, will be able to deliver
much sooner than they would have previously. And with elementary OS prepping
to migrate to Wayland for version 8 of their distribution, it’s becoming more and
more important for other distributions to follow suit.
X11 is an insecure and inefficient protocol and the project’s development has hit
an all-time low.
Because of those two reasons alone, every Linux distribution must find a way to
make the switch to the more modern, secure windowing system.
This was originally reported on both The Register (https://www.theregister.
com/2023/11/20/budgie_switches_wayland_approach/ ) and ISP.PAGE (https://isp.
page/news/ubuntu-budgie-switches-its-approach-to-wayland/#gsc.tab=0).

TUXEDO’s New Ultraportable Linux

Workstation Released
If you’re looking for an ultraportable, Linux-based laptop that doesn’t skimp on power,
TUXEDO has an option just for you.
The Pulse 14 features an AMD Ryzen 7 7840HS CPU with 8-cores and 16-threads
that surpasses the Intel Core i7 14-core CPU.
Thanks to the AMD Ryzen CPU’s efficiency – and the 60Wh battery – you can
expect up to 11 hours of local video playback on a single charge.
There also is an integrated Radeon 780M GPU with 12 cores and up to 2700 MHz
clock speeds and 32GB LPDDR5-6400 RAM (a first for a TUXEDO device) to help
boost the laptop’s performance.
Other specs include a 14" LPTS 3K display with 100 percent sRGB coverage
with a 120Hz refresh rate and a 180-degree opening angle, up to 8TB SSD M.2
storage, USB-C charging, dual DisplayPort 1.4, four USB ports, one HDMI port
aluminum chassis, Bluetooth 5.2, and Intel Wi-Fi 6 AX200.
The Pulse 14 can be customized to fit your needs and the base model starts at
EUR1,111. You can spec the laptop up with more storage and even select from your
favorite Linux distribution (such as TUXEDO OS, Ubuntu, Kubuntu, Ubuntu Budgie,
Ubuntu Mate, Xubuntu, and more.
You can order the TUXEDO Pulse 14 Gen 3 from at (https://www.tuxedocomput-
ers.com/en/TUXEDO-Pulse-14-Gen3).

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 11

NEWS
Kernel News
Zack’s Kernel News
Chronicler Zack Brown reports
on the latest news, views,
dilemmas, and developments
within the Linux kernel
community.
By Zack Brown
Author
The Linux kernel mailing list comprises
the core of Linux development activities.
Traffic volumes are immense, often
reaching 10,000 messages in a week, and
keeping up to date with the entire scope
of development is a virtually impossible
task for one person. One of the few brave
souls to take on this task is Zack Brown.
12 FEBRUARY 2024 ISSUE 279
Fonts in the Kernel
Recently, Bagas Sanjaya said, “The
Linux kernel documentation is primarily
composed of text (both prose and code
snippets) and a few images. Hence, mak-
ing the text easy to read by proper typog-
raphy choices is crucial.” He went on,
“The problem is depending on the serif
font selected by system, the docs text
(especially long passages) can be hard
and uncomfortable to read. For develop-
ers reading the docs on multiple devices,
the appearence may look inconsistent.”
To solve this, he proposed, “Uniform
the font choices by leveraging web fonts.
Most of people reading the kernel docs
should already have modern browser
that supports this feature (e.g. Chrome/
Chromium and Firefox). The fonts are
downloaded automatically when loading
the page, but only if the reader [doesn’t]
already have ones installed locally. Sub-
sequent docs page loading will use the
browser cache to retrieve the fonts. If for
some reasons the fonts fail to load, the
browser will fall back to fallback fonts
commonly seen on other sites.”
Therefore, he said, in terms of which
fonts to include in the kernel source tree,
“we settle down on IBM Plex Sans (sans-
serif), IBM Plex Mono (monospace), and
Newsreader (serif). All these fonts are li-
censed under OFL 1.1 [SIL Open Font Li-
cense] and can be distributed alongside
the kernel docs.”
In a later thread, Bagas attempted to
add a new license to the Linux kernel: the
SIL OFL v1.1. SIL International (formerly
Summer Institute of Linguistics) is a reli-
gious nonprofit that does a lot of work in
helping people learn to read, preserving
languages in danger of falling into disuse,
and other global projects of that sort. A
lot of fonts used in the open source world
are released under the OFL. However, it is
not necessarily fully compatible with the
GNU General Public License (GPL) under
which the Linux kernel is released, be-
cause of certain clauses that do things
like reserve certain font names.
Bagas’s patch did not go over well, for
a couple of reasons. Greg Kroah-Hartman
was the gatekeeper, and he explained sev-
eral points. First, he said, Bagas’s patch
attempted to dual-license various fonts
under both the OFL and the GPL. But it’s
actually not okay to simply add a new li-
cense to something. Whether it’s a font or
a kernel patch, only the copyright holder
for that font or piece of kernel code can
choose to release their contribution under
some other license. This doesn’t apply in
cases like the BSD license, which allows
users to distribute BSD licensed projects
under the terms of any other license the
user chooses. But for licenses such as the
GPL and OFL that require all distributions
to use the same license, simply adding
new license terms is a no-no. It’s a viola-
tion of the terms specified by the copy-
right holder.
Richard Fontana from Red Hat re-
marked, “I think it should be beyond
dispute that OFL-1.1 is incompatible
with the GPL (over at the Fedora project
we don’t even classify it as a FOSS li-
cense), not that that is likely to matter
for the kernel.”
Bagas replied, “I was thinking of put-
ting OFL in LICENSES/exceptions in-
stead due to this nature.” He added,
“Another alternative is to put license no-
tice on CSS code that includes the font.”
Greg was not having any of this. He
said, “Anyway, this is independent of the
issue if we actually should take these fonts
into the kernel tree, and mandate their use
(my opinion is no, that’s not for us to use,
and especially for any action that might
cause a web browser to look elsewhere
outside of our documentation).”
Greg also went on to say that, in fact,
the Linux kernel project should not be
including fonts in its source tree at all.
He said, “no, let’s not deal with that
mess for now.”
Bagas knew when to give up. For now
at least, the Linux kernel will apparently
not ship with any fonts for its documen-
tation – or at least none that require an
additional or GPL-incompatible license.
I’m always interested when licensing
discussions crop up among kernel devel-
opers. For example, I believe it’s actually
LINUX-MAGAZINE.COM

virtually impossible for the kernel to
ever be released under a license other
than the GPL v2. The GNU project sug-
gests releasing code under the terms of a
particular version, “or any later ver-
sion.” But Linus Torvalds chose not to
trust the future of the GNU project in
that way. And with each developer hold-
ing the copyright to their own patches,
the effort to find all of those people and
get their permission to relicense their
kernel patches would be a completely
overwhelming task. It simply couldn’t be
done. Like it or not, the Linux kernel is
now and forever subject to the terms of
the GPL v2. So whenever something like
Bagas’s font issue comes up, I’m always
curious about how it will all be resolved.
As I said before, BSD code can be reli-
censed, and for sure there is BSD code in
Linux that has been relicensed under the
terms of the GPL v2. There are other
“GPL-compatible” licenses that have
code under their terms in the kernel as
well. The final result in any particular
case is never obvious ahead of time, and
it’s always fascinating to watch the de-
bates play out.
IA-64 Removed from the
Kernel (Not)
Arnd Bergmann posted a patch, an-
nouncing, “The ia64 architecture gets its
well-earned retirement as planned.” His
patch removed all IA-64 support in the
kernel. The IA-64 platform is the Intel
Itanium chip, developed with Hewlett-
Packard in the early 2000s. It had a
pretty good run. In fact, it represented a
whole series of chips and a significant
and ambitious departure from Intel’s
previous approach to chip design, but it
was discontinued by Intel in 2019.
Arnd’s patch was accepted immedi-
ately, to the dumbfounded dismay of
Frank Scheiner, who posted the follow-
ing response:
“So the ia64 removal happened despite
the efforts – not only from us – to keep it
alive in Linux. That is a – sad – fact
now.
“There was no real breakage for ia64
in the kernel that I know of since
[db3e33d] was merged five months ago
and _if it ain’t broke, don’t fix it_.
“Well, it’s really broken now.
“We built upon what others had accom-
plished before in the kernel and outside
of the kernel. We started to take care of
LINUX-MAGAZINE.COM
NEWS
Kernel News
existing problems (glibc, gcc) and others
also did their part in getting things fixed
for ia64 (grub). We gathered people
around us that have both the required
machines and the interest to help out.
And despite what others claim, we are
users of this architecture and continue to
be and we are not alone.
“We simply tried to take care of the ar-
chitecture in and outside of kernel space
with the assumption that this was what
was needed to keep an architecture alive.
But apparently that was either not good
enough, not wanted or simply not
enough to prevent its removal.
“At the moment I am out of ideas what
other options there are, actually I’m re-
ally puzzled here. Because what we tried
to accomplish, isn’t that what you want
for Linux: to arouse people’s interest in
working on the kernel and ecosytem?
Well, you were successful with that for
ia64, but removed it anyhow.
“So I ask the simple question:
“What needs to be done to get ia64
back into Linux?”
This response came as a surprise to
Linus Torvalds, who had been under the
impression the architecture was well and
truly dead. He replied to Frank:
“Well, I’d have personally been willing
to resurrect it, but I was told several times
that other projects were basically just
waiting for the kernel support to die.
“Has the itanium situation really
changed?
“The thing is, nobody doing new kernel
code wants to deal with itanium, so rele-
gating it to the same situation that i386
support was (‘it still works in old ker-
nels’) doesn’t seem to be a huge issue for
the people who actually want to use those
machines.
“That said, I’d be willing to resurrect
itanium support, even though I person-
ally despise the architecture with a pas-
sion for being fundamentally based on
faulty design premises, and an imple-
mentation based on politics rather than
good technical design.
“But only if it turns out to actually
have some long-term active interest (ie
I’d compare it to the situation with m68k
etc – clearly dead architectures that we
still support despite them being not rele-
vant – because some people care and they
don’t cause pain).
“So I’d be willing to come back to the
‘can we resurrect it’ discussion, but not
ISSUE 279 FEBRUARY 2024 13
NEWS
Kernel News
immediately – more along the lines of a
‘look, we’ve been maintaining it out of
tree for a year, the other infrastructure is
still alive, there is no impact on the rest
of the kernel, can we please try again’?”
John Paul Adrian Glaubitz replied to
this with a whoop of glee, remarking, “I
think this is a very reasonable approach.
If keeping the architecture alive is sus-
tainable, it should be possible to do that
out of tree for a given period of time.”
And Tomáŝ Glozar also remarked to
Linus, “I agree with Adrian, that sounds
very reasonable to me. If we want Ita-
nium to stay in kernel and it is a burden
to other developers, it is fair that we take
the burden on us for the time being even
if it means overhead from maintaining
an out-of-tree patch.”
Breathing a sigh of relief, Frank said,
“That is really something. We’ll see
where this goes. I always hope for the
best. (-:”
So there you have it. From the ashes of
doom has arisen the Itanium phoenix
once again, breathing fiery life.
This whole thread strikes me as hav-
ing been a very public misunderstanding
that would normally not have occurred.
An architecture with users and maintain-
ers does not fall out of the Linux kernel.
So it’s interesting for me to see how
quickly the situation was addressed and
resolved, even granting that there will
now be a new onus on the Itanium
maintainers to do solid work for a period
of time before their code can go back
into the official source tree.
Jitter Patches
Herbert Xu ran afoul of Linus Torvalds
when he posted an update to the crypto
code. In fact it was not a simple patch,
but a large collection of patches by many
people – a perfectly normal code sub-
mission from Herbert – except for one
group that caught Linus’s attention. Spe-
cifically, these patches dealt with Jitter.
Jitter is one of the crypto darlings: It
uses the unpredictable microscopic de-
lays between instructions to generate
cryptographically secure random num-
bers. These in turn can be used to do
useful things like randomize virtual
memory addresses so that attackers are
less able to predict where to launch
their attacks.
In this case, however, Linus felt that the
jitter patches rendered some of the
14 FEBRUARY 2024 ISSUE 279
compile-time user configuration questions
too hard for users to answer. Linus said:
“This is beyond annoying.
“These are adding Kconfig questions
that don’t make sense. The whole jitter
thing is debatably useful in the first
place, and now you just annoy users with
random questions.
“And I mean truly random – the whole
jitter entropy is voodoo programming to
begin with, and having some crazy 8MB
buffer for it is just ridiculous.
“Honestly, this all smells like some-
body’s PhD thesis, not a real life thing.
“And no, we don’t make our Kconfig
questions more annoying for some PhD
thesis.
“We also don’t ask people questions
that don’t have valid answers. Just be-
cause the whole ‘what is entropy in the
first place’ isn’t clear-cut, we don’t then
punt some tweaking question to the user.
“We have a very simple and stupid jitter
entropy thing AT BOOT TIME just to try to
generate some amount of entropy to make
boots non-repeatable (see ‘try_to_gener-
ate_entropy()‘ in drivers/char/random.c).
“Honestly, the whole crypto layer one is
ridiculous overkill in the first place, but
the annoying new questions have now
literally made me consider just removing
it entirely.
“Because no, IT IS NOT OK TO ASK
CRAZY QUESTIONS. If some developer
cannot come up with a reasonable an-
swer, a random user sure as hell cannot.
“And no, any question that says ‘do
you want to use 8MB of memory for jitter
entropy’ is just batsh*t crazy.
“This kind of crap needs to stop.
“If somebody wants to do this kind of
thing, just do it in user space. It’s ridicu-
lously pointless in the kernel.
“Convince me I’m wrong. But there is
no way in *hell* you will convince me
that we should ask users about some jit-
ter memory sizing. Allocating memory
for timing analysis is silly to begin with,
since any kernel thing could just use the
physical memory mapping we already
have in the kernel. I suspect strongly that
all this code has been influenced by code
running in user space, where it belongs,
and where you do need to allocate mem-
ory to have it available.
“Please just make this noise go away.”
Herbert replied, “Fair enough. How
about adding an EXPERT dependency
on this?”
To which Linus grudgingly agreed,
saying:
“I think that would help the situation,
but I assume the sizing for the jitter buf-
fer is at least partly due to trying to ac-
count for cache sizing or similar issues?
“Which really means that I assume any
static compile-time answer to that ques-
tion is always wrong – whether you are an
expert or not. Unless you are just building
the thing for one particular machine.
“So I do think the problem is deeper
than ‘this is a question only for experts’. I
definitely don’t think you should ask a
regular user (or even a distro kernel
package manager). I suspect it’s likely
that the question is just wrong in general
– because any particular one buffer size
for any number of machines simply can-
not be the right answer.
“I realize that the commit says ‘*allow*
for configuration of memory size’, but I
really question the whole approach.
“But yes – hiding these questions from
any reasonable normal user is at least a
good first step.”
And that was the end of that.
Linus’s attitude toward a lot of secu-
rity features is one of great skepticism.
There seem to be at least two schools of
thought. Linus seems to feel that secu-
rity patches should fix actual security ex-
ploits. If there is not a known exploit for
something, Linus considers that there is
not actually a security problem.
On the other side, various developers
seem to believe that some aspects of
the kernel present tempting targets for
attackers who don’t yet themselves
know if there’s an exploitable bug or
not, but who will poke and prod the
kernel in that area until they find
something. These developers advocate,
for example, randomizing virtual mem-
ory, making it as difficult as possible
for any attacker to even know what
part of the kernel they might be poking
and prodding. They argue that this
kind of protection reduces the size of
the “attack surface” that an attacker
might explore.
It’s an ongoing and nearly religious
debate. Linus has shown that he’s will-
ing to compromise and accept patches
that reduce attack surfaces, but he has
also shown that there are significant
limits to what he’ll accept in the ab-
sence of an actual known exploitable
bug. Q Q Q
LINUX-MAGAZINE.COM
 vOp s | Cloud Native
D e | De
u x| vel
op
L in er
d
an |E
m
i o be
a d
R

dd
M

ed
HA

|H
e|

om
tur

eA
ruc

u to
ra s t

mati
Systems and Inf

o n | I o T | Ke r n e l | L
i t y |
ur

o
c

w
S e

Le
|

v
es

e l
t

Sy
n e

s
e r

em t
u b
K

s
| |O
n t bs
e er
nm r va
e bil
ov G ity
| Ar p e n
ti
ci
al Intelligence | O

Don't miss North America's largest annual

community organized Open Source gathering!

 LM50
     
socallinuxexpo.org

SOUTHERN CALIFORNIA LINUX EXPO  SponsorExhibit Volunteer  

  sponsorship@socallinuxexpo.org
COVER STORY
Building a Rasp Pi IDS

Detecting intruders with a Raspberry Pi IDS

Smoke Alarm
An intrusion detection system was once considered too complicated and
too expensive for a home network, but nowadays you can use a Raspberry
Pi and the Suricata IDS for real-time notice of an incoming attack.

By Markus Stubbig

A
n intrusion detection system (IDS) works like a smoke to take on additional tasks, which might slow it down, depend-
detector. It detects a risk, issues a warning, but does ing on the make and model, but in a low-traffic setting like a
not take any further steps to prevent the attack. A full- home network, you might not notice the difference.
blown intrusion prevention system (IPS), on the other
hand, can take additional steps to stop the attack. However, an Equipment
IPS is much more elaborate (and often expensive), and it is The IDS needs compute power for its investigations. You will
often overkill for a small home network. For many users on want to use at least a Raspberry Pi 3B+, or preferably a fourth-
small networks, the notification is the most important part, generation Rasp Pi model. If you want to try some another
and an IDS can deliver that notification for far less trouble mini PC, you’ll need at least 1GB RAM and a dual-core CPU.
and a smaller learning curve. A recent Raspberry Pi OS or Debian without a graphical user
An IDS takes a deep look at the IP packets passing through. interface is fine as the operating system.
If the analyzed content appears suspicious, the system alerts After installing Raspberry Pi OS, the Raspberry Pi no longer
the user. The IDS references a database populated with needs a local console. You can configure it via SSH. As for the
known attack patterns to decide whether or not a packet choice of software: Make sure you reduce the power and flash
contains a possible attack. This makes it similar to a virus requirements. A 500MB IDS logfile will slow the system down
scanner, which examines data and compares the data and make it almost unusable. Elasticsearch might be the right
against known patterns. choice of back end for large installations, but a lightweight
An IDS is part of the standard equipment at any data center SQLite database is better suited for a Rasp Pi IDS.
today. At a modern data center, a fast appliance fields data
streams from all servers via a multi-gigabit network interface Suricata
card and reports its discoveries to the network operations Suricata [1] is an open source IDS tool that will serve as the
team. This might sound like an expensive solution, but the foundation for this Rasp Pi IDS. Suricata listens on a network
technology can just as easily be applied to home networks. adapter and compares the IP packets passing through with its
This article describes how to set up a simple Raspberry Pi or signature database. If the examined packet matches a signa-
comparable single-board system to act as an IDS. The down- ture, Suricata responds with the defined action, which could
sized IDS receives a copy of the incoming packets from the be, say, firing off an alert. This analysis depends heavily on the
router. You’ll need a router that is capable of capturing and for- quality of the signatures.
warding incoming packets to the Rasp Pi for monitoring pur- You first need to install the Suricata software on the Rasp Pi
poses. Some routers might include this feature directly. In other (Listing 1, line 1). The repository contains a recent version,
cases, you can set up forwarding on the router if it comes with which is fine for your home IDS. One special thing about
Bash scripting support. The examples in
this article are based on a Fritz!Box 7583 Listing 1: Install and Update Suricata
router. 01 # apt install suricata
Like many Rasp Pi scenarios, the setup 02 # sed -i -e 's/interface: eth0/interface: ids0/' /etc/suricata/suricata.yaml
presented in this article is more of a life
03 # ln -s /var/lib/suricata/rules/suricata.rules /etc/suricata/rules/
hack than an industrial-strength solu-
04 # suricata-update
tion, but it does the job. When you’re
05 # systemctl stop suricata
finished configuring it, you might find
06 [... see Listing 2 ...]
that you know a little more about IDS
07 # suricata -c /etc/suricata/suricata.yaml -i ids0 -v
systems and how they work. One note to
08 # systemctl start suricata
keep in mind: You are asking the router

16 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

Suricata is that it does not reference the physical network advantage that more analysis tools can be added without mak-
adapter eth0 but the virtual adapter ids0 (line 2). The update ing any changes (e.g., Tcpdump).
command (line 4) fetches the free signatures – this can take a Suricata saves its results as a text file in JSON format. The
few minutes depending on the speed of your Internet connec- graphical processing is handled by EveBox [2]. The EveBox
tion. As an example, loading and testing 43,000 rules on a tool disassembles the JSON lines, extracts the essential con-
Raspberry Pi 3B+ took about three minutes. tent, and serves everything up as a fancy web page.
Then stop Suricata for the time being (line 5). When first
launched in a live scenario, Surricata has to wait until the com- Fritz!Box and Fritzdump
mands in Listing 2 have fired up the ids0 interface – but more The Bash wizardry for the Fritz!Box and PCAP has already
on that later. Once this is complete, you need to restart Suricata been scripted by other people and is available on GitHub [3] in
manually (Listing 1, lines 7 and 8). Suricata then sniffs the the form of the fritzdump.sh file. The target system is not an
packets from the ids0 interface and checks them against the IDS but is, instead, the Ntop NG monitoring package; however,
enabled signatures. If one of the rules matches, an entry is converting this script to work with an IDS is surprisingly sim-
added to the eve.json file – again, more on that later. If you ple. If you have another router with similar scripting support,
see any error messages at system startup, it makes sense to adapt the script as needed.
use the verbose option -v. Because Raspberry Pi OS includes NetworkManager, the
You will need to be patient, because it can take up to two setup only needs a one-liner (Listing 2, first line). The dummy
minutes for Suricata to load the signatures. The application network adapter provides the link between Fritzdump and Su-
logfile is available in /var/log/suricata/. ricata. The two systemctl lines at the end of the listing make
sure that NetworkManager is running and take care of the new
Workflow interface ids0.
The Rasp Pi system will need some way of reading the packets Back to the Fritz!Box: The Fritz!Box must support the hidden
that pass through the router. Some routers have a mirror port packet recording function. You can easily check this; if your
that creates copies of packets and forwards them via a different
LAN port to a server for analysis. If your router does not have
this feature (and many home routers don’t), the Rasp Pi IDS
will need to request the data. In the case of my Fritz!Box router
(Figure 1), all it takes is Wget and some Bash wizardry. Note
that it usually doesn’t work to cache the collected packets (that
would kill off the SD card relatively quickly). The goal is in-
stead to feed the data to the IDS process.
Unfortunately, pipe magic is not going to help here. Suricata
stops working if there is no data flow through the pipe (i.e.,
whenever the Fritz!Box is idle). The solution is a dummy net-
work adapter that behaves like a second loopback interface.
More specifically, Wget fetches PCAP files from the Fritz!Box
and sends the IP packets they contain to the dummy interface.
Suricata listens to this dummy NIC, which means that it re-
ceives a copy of all the packets that flow through your Internet
connection. Suricata rummages through the packages for sus- Figure 1: The Rasp Pi resides on the home network and
picious content. Detouring via the dummy interface offers the gets the copies of all IP packets from the Fritz!Box.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 17

COVER STORY
Building a Rasp Pi IDS

Listing 2: Setting up a Dummy Interface Listing 4: Creating an Exception List

# nmcli con add type dummy ifname ids0 ipv4.method disabled ipv6.method disabled # cat <<EOF > /etc/suricata/disable.conf

# systemctl enable NetworkManager group:stream-events.rules

# systemctl start NetworkManager group:decoder-events.rules

group:emerging-info.rules

EOF
Listing 3: Packet Forwarding
# suricata-update
01 # apt install tcpreplay

02 # wget https://raw.githubusercontent.com/ntop/ntopng/dev/tools/fritzdump.sh
username for the script is dslf-config or
03 # sed -i -e 's/ntopng.*/nice tcpreplay --mbps 1000 -i ids0 -/' fritzdump.sh
fritz3103.
04 # install --mode=755 fritzdump.sh /usr/bin/
The script immediately starts pushing
05 # fritzdump.sh dslf-config
packets to the dummy NIC. You can use
06 # systemctl restart suricata
Tcpdump to check whether this is work-
07 # tcpdump -nnli ids0
ing; the command displays the pack-
ages on the terminal (line 7). For Fritz-
Fritz!Box has this feature, it will open up a web page if you type dump to resume its work after a reboot, you need an entry
http://fritz.box/html/capture.html in your browser (Figure 2). On in the /etc/rc.local file before the final exit statement.
the other hand, things look bad if you see a 404 error instead.
Given such a wide choice of interfaces, the question is, Ruleset
which one is the right one? Basically, an IDS examines the By default, the IDS uses all available signatures, including sig-
packets on the LAN side, as attacks are relatively normal on natures for protocols that are uncommon on home networks.
the WAN side. Accordingly, the right choice is the lan or This means that the IP packet scan goes through an unneces-
wifi0 interface. sary number of checks, which in turn slows down the IDS.
Inconveniently, the interface has another name internally, What’s even worse: Some signatures even complain about un-
and Fritzdump needs the exact notation. If you don’t want to expected values in the TCP header, bloating the eve.json log-
browse the HTML source code, click Start on the web page for file. This adds about 500MB to the file every day, which is way
the right interface and then look at the download link. The link too much for the Rasp Pi IDS.
contains the ifaceorminor parameter in the URL, followed by As a rule of thumb: Enable only the most important rules,
the name of the selected interface. otherwise eve.json will burst at the seams and EveBox will
Last but not least, you need to mod the script. It’s on GitHub stop responding. But what are the most important rules? You
and requires very little customization to fill its new role. Listing will simply have to try this out, because every home network
3 shows the installation and customization of the script to the uses different applications. If a specific alert from Suricata
Rasp Pi IDS. In the fritzdump.sh script, you need to enter the keeps getting posted in the log and the post is irrelevant or for
interface name from the previous section for the IFACE variable. information only, you can add the matching rule or rule group
The sed command from Line 3 removes Ntop NG and re- to the exception list. The example from Listing 4 disables three
places it with Tcpreplay, a tool that feeds packages from PCAP rule groups with purely informational content and then up-
files back into the network. When this happens, the packets dates the new streamlined signature list.
are routed beyond the
dummy interface to Su-
ricata. Since Tcpreplay
burns a massive
amount of compute
power, the nice process
management utility
slows it down and
makes the overall sys-
tem seem less sluggish.
Once the preparations
are complete, you can
launch fritzdump.sh and
Suricata (lines 5 and 6).
The script expects the
Fritz!Box username and
password as command
line arguments. If you
log in to your Fritz!Box
with a password, the
recommended Figure 2: If the Fritz!Box offers packet capture, the IDS can sniff and analyze the packets.

18 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 COVER STORY
Building a Rasp Pi IDS

A minimal configura-
tion for the EveBox is
shown in Listing 6; you
need to store the con-
tents in the /etc/eve-
box/evebox.yaml file.
The values were chosen
carefully and are suit-
able for a Raspberry Pi.
After saving the file,
you need to tell EveBox
to restart by typing sys-
temctl restart evebox.
The web page http://pi_
ip_here:5636 is ready
and will notify you of
alerts in the future.
Strictly speaking, you
will not see the original
alerts from Suricata but
the list processed by
Figure 3: EveBox gives you a graphical view of the alert list from Suricata. EveBox.

Listing 5: Setting Up Repository and GPG Keys IDS Test

# apt install gnupg apt-transport-https
Everything is ready to go, but you will want to test
# wget -qO - https://evebox.org/files/GPG-KEY-evebox | apt-key add -
the setup to make sure that your home IDS is work-
ing correctly. Much like EICAR for virus scanners,
# cat <<EOF > /etc/apt/sources.list.d/evebox.list
there is a prepared web page that should attract the
deb http://evebox.org/files/debian stable main
attention of any active IDS.
EOF
For this test, a client on the home network
# apt update
needs to access the website on http://testmynids.
# apt install evebox
org/uid/index.html. It doesn’t matter whether you
do this in a web browser or use curl, as long as
EveBox you access the website via the Fritz!Box. The important
What packages did Suricata alert on? If you don’t want to work thing is that Suricata detects the pseudo attack and EveBox
through long lines of JSON, install the web-based EveBox
event management tool for Suricata and browse through the
messages, as shown in Figure 3. The team behind EveBox pro-
vides its own repository for the installation, which is useful for
updates later on. Setting up the repository and GPG key turns
out to be almost more complicated than the actual installation,
as Listing 5 shows.

Listing 6: EveBox Configuration

http:

tls:

enabled: false

host: 0.0.0.0

port: 5636

database:

type: sqlite

retention:

days: 7

size: "500 MB"

input:

enabled: true

paths:
Figure 4: Suricata detects the test website, and EveBox
- "/var/log/suricata/eve.json*"
reports the pseudo-alarm.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 19

COVER STORY
Building a Rasp Pi IDS

displays it as GPL ATTACK_RESPONSE id check returned root more alarms that Listing 7: Setting Up M/Monit
(Figure 4). are false, unneces- # apt install monit
sary, or simply a # cat <<EOF >> /etc/monit/monitrc
Slimming Down nuisance, you can
set httpd port 2812 and
By default, Suricata stores a huge amount of information and add an entry to
use address 0.0.0.0
statistics, which bloats the logfiles in next to no time. On top the disable.conf
allow admin:monit
of this, the bloat makes it more difficult for EveBox to find the file and then up-
EOF
genuine alerts, and this results in more disk I/O to the flash date the signature
# systemctl restart monit
memory device. A RAM disk can help, but it definitely makes database.
more sense simply not to store the values you don’t need. If the Rasp Pi is
To do this, you have to modify the suricata.yaml configuration still sluggish after the cleanup, it makes sense to empty Eve-
file. The YAML format uses indentations and reads like an out- Box’s SQLite database in /var/lib/evebox/ or to create a new
line, with topics and bullet points. Suricata lists everything in- eve.json in /var/log/suricata/. In both cases, you will need to
tended for the eve.json logfile below outputs in the eve-log sub- restart the service using Systemctl.
section. For use on a Raspberry Pi, the recommendation is to Last but not least, check the load on the Fritz!Box when the
comment out all output formats listed in types, or to set them to IDS is enabled. Older models might be overtaxed by the contin-
false, with the exception of alert, anomaly, and drop (Figure 5). uous PCAP file download, leading to a reduced throughput
The next savings relate to the signatures. In the previous sec- rate. For example, a Fritz!Box 6591 on a 100Mbit/s cable con-
tion, I already ditched three control groups. If EveBox reports nection from Vodafone still achieves about 75Mbit/s in the
download direction with the home IDS
running. Obviously, the upload rate is
not affected at all. It is important to
weigh up whether security or perfor-
mance is your priority.
The IDS only works when the Fritz-
dump and Suricata processes are run-
ning. If not, the intrusion detection net-
work is worthless and dangerous IP
packets remain undetected. A small
monitoring tool like M/Monit [4] can
check for the critical processes and re-
start them if necessary (Listing 7).
A configuration file for all the home
IDS’s services is available in the down-
load section for this article [5]. You
need to store the monit_ids.conf file in
the /etc/monit/conf.d/ directory. M/
Monit uses it automatically on restart.
If you access the page at http://Ras_Pi_
IP:2812, or if you run the monit summary
CLI command, your watcher will give
Figure 5: Modifying the configuration files tells Suricata to ignore less you information about the status of the
important things, which in turn reduces the load on the Rasp Pi. services it is looking after (Figure 6).

Evaluating Alerts
EveBox uses color highlighting to show
the meaning of a message. Hints are
shown in turquoise in the Light Theme,
attacks in orange, and critical conditions
in red (Figure 3). The dark theme makes
it difficult to see the colors; important
messages no longer stand out suffi-
ciently. Clicking on the message takes
you to the detailed view with all the in-
formation that Suricata has recorded. Su-
ricata uses the Severity value to indicate
how threatening it considers an alert to
Figure 6: The Monit Service Manager monitors the IDS processes and be. EveBox uses this numerical value to
restarts them if necessary. color highlight the message.

20 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


The next step is to find out which cli-
ent triggered the alarm. The Source and
Destination fields show the offending IP
addresses, including port numbers, but
without resolving to a hostname or ap-
plication. If the alert title is unclear, the
signature ID can help; you can use the
signature ID to find the rule in the signa-
ture files. If you need more details on a
signature, grep will give them:
$ grep signature_ID /etc/suricata/rules/*
The result is the syntax of the signature
as Suricata reads and processes it. Edi-
tors with appropriate syntax highlight-
ing, such as Visual Studio Code, make
the content more readable.
For example, a message such as Figure 7: A DNS query for the pw top-level domain prompted
ALERT: ET CINS Active Threat Intelli- Suricata to sound the alarm. In this case, it was just a user updating
gence Poor Reputation IP group 48 points her password manager, which queries its servers in the pw domain.
to a suspicious incoming HTTP packet
on the LAN. It appears that there is a public web server on the
local network that can be accessed from any IP address on the
Internet. Neither Suricata nor EveBox recommend any specific
action in this case, but both tools at least make the admin
aware of the issue. In the simplest case, this might mean a
forgotten port forward. However, the message suggests that
the company’s own web server is under attack. Meaningful
responses include using a GeoIP blocker or a DDoS tool such
as Fail2Ban [6].
False Alerts?
Not every attack has to be dangerous. The orange message
ALERT: ET DNS Query to a *.pw domain – Likely Hostile warns
users against accessing a web page with the pw top-level do-
main. A quick search shows that someone updated a Buttercup
password manager via the buttercup.pw website (Figure 7).
There is no immediate danger from this.
No machines running, but the IDS still reports something?
No panic: How many smartphones, laptops, and smart home
devices use your Fritz!Box? Every device on the network has
an IP address, and every Suricata message contains that de-
vice’s source and destination addresses. A quick look at the
Fritz!Box subscriber list reveals which terminal this address be-
longs to. Granted: Once Suricata has annoyed you with the
same message for about the hundredth time, you might want
to remove this signature.
Security
An IDS does add a little more security, but the installation
shown in this article is the beginning of any serious intrusion
detection project. Some additions would still be required for ro-
bust enterprise use. The EveBox and M/Monit websites require
HTTPS access with alert-free certificates. And you would need
authentication, unless you want everyone to be able to view
the logs.
Fritzdump expects the Fritz!Box password, but you would
definitely not want this to be visible in the process list. It is
LINUX-MAGAZINE.COM
COVER STORY
Building a Rasp Pi IDS
better to store security-relevant information in variables or files
with restrictive rights. And running Suricata with root privi-
leges is questionable practice. You can change this in the
run-as: section of the configuration file and use a dedicated
IDS account instead.
A Raspberry Pi running Linux is not completely unprotected,
but you would still want to enable a local firewall. Raspberry Pi
OS offers the usual suspects: iptables, nftables, and firewalld.
A firewall lets you restrict access to the required applications
(SSH and HTTPS) and keep things within the boundaries of the
local network. Finally, integration with an existing alerting sys-
tem can be useful. If you lose sight of critical messages in the
mass of files on the Rasp Pi, the IDS is not going to be a big
help. Messages need to be displayed in good time on the ad-
min’s smartphone.
Conclusions
No IDS is capable of solving every imaginable security prob-
lem, but a good IDS is an important component for securing
your network. Even on a low budget, a Raspberry Pi and the
free Suricata software can handle intrusion detection, in con-
junction with a compatible router like Fritz!Box. Q Q Q
Info
[1] Suricata: https://suricata.io
[2] EveBox: https://evebox.org
[3] Fritzdump:
https://github.com/ntop/ntopng/blob/dev/tools/fritzdump.sh
[4] M/Monit: https://mmonit.com
[5] M/Monit configuration for monitoring Suricata, EveBox, and
Fritzdump:
https://linuxnewmedia.thegood.cloud/s/5Rzx9tQW2FJ6N3Z
[6] Fail2Ban: https://www.fail2ban.org/wiki/index.php/Main_Page
Author
Markus Stubbig is a system developer with a focus on network-
ing and Linux in the automotive environment.
ISSUE 279 FEBRUARY 2024 21
REVIEW
Distro Walk – Peppermint OS

A choice-driven hybrid distro

Peppermint OS
Peppermint OS promotes user choice every step of the way. Bruce talks to Peppermint OS
about how the project has evolved over more than a decade. By Bruce Byfield

F
ew distributions have had the ups as LibreOffice are not included by de- Peppermint OS’s security is enhanced,
and downs of Peppermint OS [1] fault. Instead, a variety of options are because users know exactly what is in-
(Figure 1). Founded in 2010 dur- offered including six different web stalled. The result is one of the fastest
ing a pub discussion in North browsers (Figure 2), a choice of init distributions I have installed, aided by
Carolina, Peppermint OS enjoyed initial tools, and a selection of Snap, Flatpak, the default Xfce desktop and extensive
success only to decline after the death and AppImage packages repositories. use of Qt for development.
of one of its founders. A few years ago, At every point user choice is stressed – Peppermint began with the goal of
the project had shrunk to a single main- for instance, which LibreOffice mod- producing a hybrid of desktop and cloud
tainer, but the last few years have seen ules to install – even though the space services. That goal is most obvious in its
a resurgence of effort with the develop- saved is minimal. As a bonus, site-specific browsers (SSBs) [2], which
ment of a closely knit and active
community.
Throughout its history, though, Pep-
permint’s releases have shown several
points of continuity. Its source has al-
ways been a Debian derivative – cur-
rently, Debian and Devuan. In addi-
tion, it has always had a minimal in-
stallation in which standard apps such

Author
Lead Image © pixelrobot, 123RF.com

Bruce Byfield is a computer journalist and

a freelance writer and editor specializing
in free and open source software. In
addition to his writing projects, he also
teaches live and e-learning courses. In his
spare time, Bruce writes about Northwest
Coast art (http://brucebyfield.wordpress.
com). He is also co-founder of Prentice
Pieces, a blog about writing and fantasy at
https://prenticepieces.com/. Figure 1: Peppermint OS’s default desktop.

22 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


Figure 2: Peppermint leaves the choice of most applications to the user,
including the web browser.
convert URLs to desktop objects. Origi-
nally, this conversion was done by an
application called ICE, which has since
been replace by Kumo (Figure 3).
Requests for information about Pep-
permint OS produced answers from
cavy, the communications spokesman,
and Tommy, the development lead, with
input from other main developers.
Linux Magazine (LM): How has Pep-
permint evolved over the years?
cavy: There have been four distinct eras:
• 2010-2014: The Shane Remington and
Kendall Weaver period. Shane and
Kendall picked up LXDE from Linux
Mint, who had dropped it from their
desktop range. In May 2010, their goal
was to produce a mini desktop with
only system tools and allow the user
to choose what software and apps they
would want to have. Soon after in
June 2010, they released Peppermint
ICE (SSB) to distinguish it from their
initial release.
• 2014: During this period LXDE saw a
gradual demise, slipping into a dor-
mant state, due to most of the LXDE
maintainers leaving to join the Qt-ori-
ented team that went on to develop
LXQt. PCNetSpec (Mark Greaves) car-
ried out numerous experiments with
VinDSL and other lead members of his
LINUX-MAGAZINE.COM
Distro Walk – Peppermint OS
front-line team to test and determine
which components could or would
perform successfully within the modu-
lar LXDE desktop environment as it
gradually evolved into a functional hy-
brid environment.
• 2019-2021: A transition period, begin-
ning the initial attempts to build a
working desktop utilizing LXDE and
Ubuntu. Both had their foibles, making
this task harder, due to the Canonical
decision to insist snaps be the de facto
software solution. Determining neither
was a viable approach, then began the
long and contentious debate [about
Figure 3: SSBs create a desktop object for a URL.
ISSUE 279
REVIEW
whether] to employ and use the
Debian base with the Xfce desktop.
• 2021: Our goal at this point was to pro-
duce a tribute release to PCNetSpec,
one of the original founders and a
long-time leader. At this point, we
managed to overcome several late is-
sues that we faced with changes to im-
prove the Calamares theme, technical
gremlins, and that nagging issue of an
Ubuntu fan base unable to accept the
migration to Debian. Even after our
launch was welcomed by the wider
public, that received critical praise
from the Linux news media.
• Circa May 2022: We began to look at
our image to place our stamp on Pep-
permint OS. We rebranded ourselves
for Debian Bookworm, with new icons
and name banners. We also released
our network install ISO, and both
Debian and Devuan ARM iterations. A
server is our next objective.
LM: What are the advantages of Kumo
and SSBs?
Tommy: Kumo allows for easier backup
and restore needs, as well as sharing
apps with other Kumo users. For many
users, having a single web view of a site
that they use is, in some ways, helpful
for a user to focus on the content. What
I hear from some users is that SSBs are
useful for banking, for example, and not
getting distracted by other tabs of the
browser.
LM: Peppermint has been described as
a hybrid between the LXDE and Xfce
FEBRUARY 2024 23
REVIEW
Distro Walk – Peppermint OS
desktops. What does it borrow from
each? What is original with
Peppermint?
cavy: Originally Peppermint was a mini
LXDE. Later when the LXDE team left
to join the LXQt team, it was left in a
dormant state, with little being done to
it between 2015 and 2020. PCNetSpec
introduced various Xfce, MATE, and
Cinnamon components in an attempt to
prolong the LXDE base and created what
became our signature custom look for
Peppermint. Today, apart from the trib-
ute to PCNetSpec in February 2022 with
the custom component of the Nemo file
manager, we have reverted to a full
blown Xfce.
LM: How is Peppermint OS associated
with the Portugese distribution AcorOS [3]?
Tommy & cavy: Manuel Rosa is a part
of the Peppermint team as well as the
project lead for AcorOS. Peppermint
has a concept of choice as the value
that we provide. Therefore, the things
that we ship with sometimes do not
fully fit that out-of-the-box experience
that some users may want. AcorOS
fills that missing link, due to its focus
on an out-of-the-box fully functional
experience, with preinstalled applica-
tions, configurations, and settings that
some users may prefer. In many ways
our build processes are similar
enough that we are able to work to-
gether and help each other’s commu-
nities, as well as collaborate with
ideas and testing.
LM: How is Peppermint organized? How
are decisions made?
24 FEBRUARY 2024 ISSUE 279
Tommy: Peppermint does have a struc-
ture, with a project lead, a spokesman, a
webmaster, and a group of core develop-
ers. Features, issues, and direction are
openly discussed in the community on
many occasions, but mainly with the
core team. Sometimes things are voted
on for decisions. If agreements cannot be
met, compromises are proposed to help
meet that middle ground.
cavy: Even with all the good will in the
world, being a benign dictator is the
only course of action.
LM: Who is the target audience?
Tommy & cavy: Anyone who has an in-
terest in wanting a choice of how they
equip their computer, like the option of ei-
ther a systemd or a non-systemd-init OS.
LM: Why should users try Peppermint
OS?
cavy: It is intuitive and straightforward
to use. It puts you in control of what
goes into your computer.
LM: Can you provide any stats about the
distro, such as the number of downloads
or commits?
cavy: Peppermint OS averages approxi-
mately over 20,000 downloads per
month, with 60,775 in the last three
months, from September 5 to December
3, 2023.
LM: Is there a future roadmap?
Tommy: The goal from the beginning in
the transition from Ubuntu to Debian
has been to provide maximum choice
where acceptable – in other words, not so
minimum that lots of time is consumed to
build the system, and not so many pack-
ages that a user is losing time undoing
the things we implemented. There are not
really too many distributions out there
that give a user that nice in-between; they
either focus solely on new users or solely
on the veteran user.
Really, Peppermint is not just a desk-
top distro at all. It is a starting point for
what the user needs, be it desktop or
server – not too much stuff installed
where time is lost removing things but
just enough stuff to generally have a
plug-and-play working system to get
them going.
We value choice. The user should
be able to do the following with gen-
eral ease:
• Use Peppermint as a server system if
they want. We are currently working
to help users deploy Peppermint as a
server environment.
• Use Peppermint as a desktop and build
it with ease to the user’s specs.
• Spin their version of Peppermint using
the ISO build tools we have.
• Choose init systems, hence the
Devuan spin.
We believe that these principles will help
Peppermint OS’s community grow and
continue as we roll into the future. Q Q Q
Info
[1] Peppermint OS:
https://peppermintos.com/
[2] SSBs: https://en.wikipedia.org/wiki/
Site-specific_browser
[3] AcorOS: https://sourceforge.net/
projects/acor-os/files/AcorOS-6.0/
QQQ
LINUX-MAGAZINE.COM
FEBRUARY 26 & 27 2024
ANNUAL EUROPEAN
STRATEGY & NETWORKING EUROPE

| TRENDS | INVESTMENTS | CLOUD |

| CONNECTIVITY | DATA CENTERS |

AMSTERDAM RAI
REVIEW
Organizational Tools
Scheduling tools for Linux
Get Organized
If you need help staying organized, Linux does not let you down with its large collection of
organization and scheduling tools. By Erik Bärwaldt
P
lanning tools for the desktop
have long since replaced the di-
ary-style organizers that were
often given away as promos in
the past. These electronic organizers
offer several advantages over their paper
counterparts. They can’t be misplaced,
illegible entries are a thing of the past,
and thanks to reminder functions you’ll
never miss an appointment or deadline.
Users are spoiled for choice: There are
numerous graphical appointment calen-
dars, some of which are preinstalled on
desktop environments. Their feature sets
differ considerably, potentially consum-
ing your storage media. This article ex-
amines some of the leading free graphi-
cal schedulers for individual worksta-
tions. Not considered in this roundup are
cloud-based personal information man-
agers (PIMs), groupware calendars, and
schedulers integrated into email clients.
Features
The basic functions of an appointment
scheduler include a daily, weekly, and
monthly overview, where you can enter
important dates. It should also be possi-
ble to set the time and duration of the
event if needed. In addition, most orga-
nizers include some kind of reminder
26 FEBRUARY 2024 ISSUE 279
function that draws your attention to up-
coming appointments.
The tools in this review are also capa-
ble of organizing individual events in
freely definable categories to distinguish
between private and business appoint-
ments. To let you transfer appointment
data to other applications, including
project management tools, the software
needs export options with standard for-
mats and import routines to match.
BORG Calendar
The BORG Calendar [1] desktop calendar
solution is written in Java, making it plat-
form-independent. Two variants of BORG
are available for Linux: a DEB package for
64-bit systems and a ZIP archive. The ZIP
archive does not contain a Java runtime
environment, so you’ll need Java in place
on your Linux system. The output from
the java -version command in a terminal
window will tell you if this is the case. If
no detailed version information appears,
you first need to add a Java runtime to
the system using your distribution’s pack-
age manager.
Download the BORG ZIP package
from the project page on GitHub and
unzip it. Next, change to the newly cre-
ated application directory and either run
the ./run_borg.sh script at the prompt or
launch the application by typing
java -jar borg.jar
After a short wait, the software opens a
window where you can see a monthly
calendar based off the current week.
Above the calendar is a small buttonbar
and a large menubar (Figure 1).
You can use the buttonbar to switch be-
tween the different views. There are sepa-
rate buttons for the daily, weekly, and
yearly views. Each of these opens a new
tab while the previously opened tabs re-
main active, allowing you to jump back
and forth between views. To the right of
the buttons that display the calendar
views you’ll find a group of buttons for
an addressbook, a to-do list, tasks, notes,
and checklists. Tasks can be defined in
Lead Image © Rachata Teyparsit, 123RF.com
the scope of projects, which can consist
of several sub-projects (in a tree view).
All of the dialog boxes appear in separate
tabs, and the tab structure extends to two
lines if there are many active lists.
On the left side of the menubar, the
Action item reflects the functions of the
buttonbar. This is followed by the Op-
tions dialog for settings. Categories lets
you assign the appointments to different
LINUX-MAGAZINE.COM
 REVIEW
Organizational Tools

desired reminder options to specify how

often and at what intervals you want
BORG Calendar to remind you of the ap-
pointment. Then, in the Recurrence sec-
tion, you can use Frequency to define
whether the appointment is a one-time
event or takes place on multiple days. If
you want to link external files to the
entry, for example, to have important
documents at hand during a phone call,
use the Link file button in the Links area
and select the file in question in the file
browser. If needed, you can link several
files to the task. The files then appear in
the window segment and can be opened
at any time using the external applica-
tions available on your system. Finally,
save the new entry by pressing Save or
Figure 1: In BORG Calendar the buttonbar and menubar demonstrate Save & Close. The application then closes
its feature scope. the settings window (Figure 2) and dis-
plays the appointment in the primary
groups to improve the calendar views’ disables the time selection. You can un- window’s calendar.
clarity. Individual categories can be check to set a specific time. The Proper- Sometimes an appointment cannot be
shown or hidden. The Import/Export ties section also relies on checkmarks. precisely scheduled and does not require
button (to the right of the category dia- You can use them to assign the appoint- additional configuration such as setting
log) can be used to integrate or transfer ment to one of the predefined categories: up reminders. In this case, you can right-
data from other calendar applications. Holiday, Private, Vacation, Half Day, or click on the daily display and select the
BORG Calendar uses XML as its file for- To Do. Your own categories are listed in Appointment Quick Entry option to open
mat. Sync lets you synchronize files with the Category field. a small window that only prompts you
different services. You can choose be- In the Popup Reminders section you for the name of the event. OK confirms
tween CalDAV, ICS, vCard, and Google. can press Change and then check the the new entry, which the application
Go to the configuration dialog below
Options | Edit Preferences to customize
BORG. Popup Reminders lets you specify
the intervals at which the calendar dis-
plays appointment reminders on the
desktop.
Startup Views lets you decide which
tab to open automatically when you
launch the program. Miscellaneous is for
the system tray settings and other items.
BORG Calendar disappears into the
desktop’s system tray, remaining active
when the actual program window is
closed. You also define backups and log-
ging behavior.
The Email Parameters dialog includes
settings for configuring automatic email
notifications.
Once you complete the configuration,
you can enter some initial appointments.
To do this, right-click on the desired date
and time in the daily, weekly, or monthly
view and select Add New from the con-
text menu. Then enter a description in
the description field below Subject in the
Appointment Text area. Under the Ap-
pointment Time section, the No Specific
Time box is initially checked; this Figure 2: The settings options for appointments are extensive.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 27

REVIEW
Organizational Tools
then adds to the calendar. While conven-
tional appointments are assigned a time,
a red dot appears to the left of appoint-
ments for which no further details exist.
BORG Calendar displays today’s events
in a mixed order. Double-clicking on an
entry without additional details takes
you to the detailed configuration dialog
for conventional appointments.
If you want to delete an appointment,
just right-click it, declare the task done,
and delete it. Entries marked as done
that have not been removed are dis-
played in a strikethrough font.
In a busy calendar, it’s easy to lose
track of things. You can use the binocu-
lars icon in the buttonbar to search for
appointments. If necessary, you can nar-
row down the matches by also defining
what type of event it is and whether it
belongs to one of the categories you
specified. After clicking Search, the ap-
plication shows a list of all the events
that match the search criteria.
The software summarizes the appoint-
ments for a single day in the Appoint-
ment List column in the settings dialog.
Below this are buttons that you can use
to delete or manage entries in the list.
Repeat appointments can be duplicated
using Copy Appointment. After that, you
only need to change the date in a sepa-
rate window and the duplicated entry
with all its settings is added to the open
calendar overview.
Gnome Calendar
Gnome Calendar [2] is a software com-
ponent of the Gnome graphical desktop
environment. However, the GTK-based
application runs just as well on other
desktops. When you launch the pro-
gram, a three-panel window appears. A
view of the current month is on the
right, with a reduced overview of the
month at top left and a free area with to-
day’s appointments below it (Figure 3).
Gnome Calendar is based on the
Gnome desktop, so it does not have a
buttonbar or a conventional menubar.
Instead, the few controls are located in
the titlebar. Use the titlebar to switch the
monthly view to a daily or weekly view
using the buttons in the center. Unlike
most Gnome applications, Calendar does
not have a settings menu. To configure
the program, click the hamburger menu
in the titlebar. You are then taken to a
spartan dialog where your only option to
28 FEBRUARY 2024 ISSUE 279
Figure 3: The Gnome Calendar interface looks very neat.
decide is whether the application should a blue circle in the scaled-down monthly
show you the weather in the daily dis- view. The application visualizes appoint-
play based on the automatic location ments extending over several days on the
finder that is also enabled. Beyond that, right with a continuous gray line in the
the settings menu only contains an over- large monthly overview (Figure 5).
view of the preset keyboard shortcuts To delete an appointment, left-click on it
and an info window for the program it- and choose Edit. You are then taken to the
self. The Online accounts option takes conventional edit window, which shows a
you nowhere and is probably still under Delete appointment button bottom right.
development. Gnome Calendar minimizes and disap-
To enter appointments, click on the pears into the system tray by default; it
plus sign in the titlebar to open a dialog.
You can edit the individual text fields by
clicking on each field and entering the
title and location. Under Schedule, you
can enter start and end dates for your
task. If you want to mark the event as
All Day, use the slider to the right of it.
The Repeat input area lets you define
whether and when the task will repeat.
You cannot create custom settings, only
select from fixed intervals and days.
If you want to receive a reminder, Re-
minders offers several options. Gnome
Calendar then outputs an audible warn-
ing signal reminding you of the upcom-
ing appointment. Notes is where you can
store notes about the appointment. The
free text input field offers the option of
transferring data from the clipboard or a
file to the note field (Figure 4).
The green Done button finishes the
configuration and adds the appointment,
which now appears bottom left in the Figure 4: The entry dialog for new
main program window’s free panel. The appointments in Gnome Calendar
day of the appointment is also marked by is quite spartan.
LINUX-MAGAZINE.COM
 REVIEW
Organizational Tools

important details,
such as a field for
free text entry. You
can also define key-
words to help you
find the entry again.
In the lower area
there are several
configuration fields
in an integrated tab
structure, where you
can specify whether
the appointment re-
peats and add re-
minders. Enter addi-
tional participants in
a separate tab. How-
Figure 5: Filling out the schedule improves the task overview. ever, you can only
use this option if
is shown there whenever the computer buttonbar with just as much detail below KDE Plasma is installed, along with
is rebooted. Reminders appear as pop- it for quick access to the most important any specific programs you wish to ref-
ups on the desktop, while a mouse click functions. On the left, there is a monthly erence. If you want to link content to
on the calendar icon in the system tray overview consisting of three or four tiles the appointment, use the Attachments
displays a separate window with a list of arranged vertically. Below, in a free area, tab to link documents from external
reminders reflecting your configuration. you can see the details of the appoint- and local sources or embed files in the
Right-clicking on the icon opens a small ments you added and a list of the active dialog (Figure 7). A click on OK con-
settings window that helps you custom- categories. On the right side, KOrganizer firms the entry.
ize the icon functions. displays the actual calendar. By default, To manage your appointments, just
The main program window cannot be the software shows you the upcoming right-click on the desired calendar entry.
dragged from the system tray to the week, but you can change the view to You can then edit or delete the entry via
desktop. If you have closed the window, other time spans (Figure 6). the context menu and print the entry or
it can only be called up again using the The New Event button opens a win- enable the reminder function. To remove
desktop menu. dow to let you save an event. In addi- past appointments in a single step, you
tion to name, location, and time infor- can call the matching command in the
KOrganizer mation, an event record includes other File menu.
KOrganizer [3] is the
KDE Plasma Desk-
top’s calendar applica-
tion. You can use the
application with other
desktop environ-
ments, too, but KOr-
ganizer accesses other
KDE Plasma Desktop
applications that may
not be available on
other desktops.
The KOrganizer
window seems a little
cluttered. At first
glance, you will note
that KOrganizer is not
just a calendar appli-
cation, but a complete
organizer for several
users. This explains
why the program win-
dow has an extensive
menubar and a Figure 6: KOrganizer offers very sophisticated functionality.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 29

REVIEW
Organizational Tools
audible signal for
reminders, or set
up an email ad-
dress used to no-
tify other partici-
pants (this re-
quires a group-
ware connection).
If you set up re-
minders, the ap-
plication outputs
them in a separate
window as a plain
list when the trig-
ger event occurs.
If you also speci-
fied an audio file,
an audible signal
Figure 7: Appointments can be entered in detail in is output.
KOrganizer.
Osmo
File | Import lets you import datasets Osmo [4] is a personal information man-
from other task planners. KOrganizer ager – developed independently of desktop
supports data in the ICS and VCS for- environments – with a focus on appoint-
mats. To export datasets from another ment management and with additional
calendar application, use the File | Ex- task and contact management features.
port dialog. You can then convert the Osmo has been developed with great at-
desired data to iCalendar format. For tention to detail, and it has already made
access to past events later on, create an its way into the repositories of most pack-
archive in File | Archive Old Incidences. age managers. As a cross-platform applica-
Settings | Configure KOrganizer lets tion, Osmo is available for Linux and BSD.
you access the program’s configuration You’ll find the appearance of Osmo’s
options. The developers based this on interface a little out of the ordinary. Al-
the operating conventions defined by though there are typical controls with a
KDE Plasma. On the left of the settings conventional menubar and a buttonbar,
dialog, you will find a vertical category Osmo splits the main window segment
bar; you then make the changes on the into two sections. On the left, you will
right. You can define color coding, set an find this month’s calendar with today’s
Figure 8: Osmo uses an unconventional interface design for the pro-
gram window.
30 FEBRUARY 2024 ISSUE 279
date marked, while smaller versions of
the previous and next months appear
below. On the right side of the program
window, after the first launch, a large
info area appears, showing you today’s
details (Figure 8). The installation rou-
tine also creates a small launcher in the
desktop environment’s system tray to let
you quickly access the application.
Right-clicking on the desired date in
the current monthly calendar on the left
opens a context menu where you can se-
lect New task. An entry dialog in a sepa-
rate window then prompts you for the
data required for the appointment, in-
cluding its priority. In addition, there is a
free text input field for notes. You can
configure reminders in the Advanced tab.
By default, a reminder window on the
desktop and an audible signal are en-
abled for each entry (Figure 9).
As soon as you close the appointment
configuration, Osmo displays the new ap-
pointment on the right in the info area
below the general information. It lists
several entries, one below the other. On
the left of the calendar display, today’s
date is circled in red, while a green dot on
the date denotes days with task entries.
Osmo displays completed or finished ap-
pointments in a strikethrough font.
You can enter notes for an appointment
by double-clicking on it. In the right part
of the window, Osmo then displays a free
area where you can enter or edit notes.
The application’s buttonbar adapts to
reflect the function you called. In the
Calendar tab, Osmo offers various navi-
gation options in the calendar, and you
also select the varying time periods for
the calendar view. Print jobs can be
started in Calendar. A backup and re-
store function supports convenient back
up and restoration of data files.
Tasks returns the entries, with a
checkmark indicating completed en-
tries. If you have completed a task
ahead of time, you can select it manu-
ally by checking the box to the left of
the entry. Clicking on an event in the
list displayed on the left calls up its de-
tails (Figure 10).
The task list, along with the Notes and
Contacts tabs, all have a backup and re-
store function in the buttonbar. The Con-
tacts tab lets you include photos and store
birthdays. Osmo then automatically
transfers birthdays to the calendar view
and marks them with a yellow ellipse.
LINUX-MAGAZINE.COM
 REVIEW
Organizational Tools

both applications require a longer training

period. The reward for this, though, is
that they massively facilitate appointment
management once you complete the
learning curve. Q Q Q

Info
[1] BORG Calendar: https://github.com/
mikeberger/borg_calendar
[2] Gnome Calendar: https://apps.gnome.
org/app/org.gnome.Calendar/
[3] KOrganizer: https://apps.kde.org/
en-gb/korganizer/
[4] Osmo: https://osmo-pim.sourceforge.net/

Author
Erik Bärwaldt is a self-employed IT admin
Figure 9: The entry dialog for appointments in Osmo is limited to the and technical author living in the United
bare essentials. Kingdom. He writes for several IT
magazines.
Osmo lets you import and export data
and can be combined with other similar ap- Table 1: Graphical Scheduler Features
plications. You can export appointments by BORG Gnome KOrganizer Osmo
opening a file manager in Tasks | Export Calendar Calender
tasks and specifying the file name and path. License GPLv2 GPLv3 GPLv2 GPLv2
The application converts the data to ICS for- Different calendar views + + + +
mat before storing it in the target path. Categorization of appointments + Restrictions + +
Contacts can also be imported and ex- Data import + – + +
ported. When importing, use a file man- Data export + – + +
ager to select the desired file in CSV for- Notes for tasks + + + +
mat. To let you export a file, the applica- To-do lists + – – –
tion opens a separate dialog, where you Synchronization function + – – –
not only enter the name and path for the Optical reminder + + + +
file to be converted, but also select the Audible reminder + + + +
data fields you want Osmo to include in Variable reminder intervals + + + +
the file. Then Export the file to CSV, Data encryption + – – +
XHTML, or VCF format. Data backup + – Restrictions +
File attachments + + + –
Conclusions Search function (appointments/terms) + + + +
As Table 1 demonstrates, the graphical
schedulers available for Linux serve quite
different needs. If you are only looking for
a simple appointment management tool
without additional features, Gnome Cal-
endar is a good choice.
In terms of functionally, Osmo is a little
more sophisticated. This distribution-in-
dependent tool’s interface is very appeal-
ing, and the calendar offers contact man-
agement and a notes area for free text en-
tries linked to the appointments.
KOrganizer and BORG Calendar are suit-
able for professional groupware connec-
tions, which is why they come with many
additional features. Both of these tools can
send emails and add multiple participants
to appointments; both are useful as rudi-
mentary project planners thanks to their Figure 10: In a separate view, you can also see details of appointments
categorization functions. On the downside, in Osmo.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 31

IN-DEPTH
Command Line – tldr
A simplified documentation command
Cheat Sheet
A simplified alternative to man pages, tldr provides the most common command options at a glance.
By Bruce Byfield
T
oo long; didn’t read (TL;DR) is a
flippant Internet acronym for a
summary that first came into use
about a decade ago. It seems to
be falling out of fashion but survives in
tldr, the newest command and format
for computer documentation. It is far
from the first documentation command,
but it fills a niche as a cheat sheet for the
most common options for commands.
Figure 1: The beginning of the ls man page.
32 FEBRUARY 2024 ISSUE 279
The most common documentation for-
mat, of course, is the man page, which
dates back to 1971 (Figure 1). Man pages
cover commands, libraries, and configu-
ration files, usually aiming for an ency-
clopedia-like summary of their topics.
One great advantage is that the pages are
highly organized, arranged in nine sec-
tions ranging from user commands and
system calls to system administration
calls, kernel routines, and daemons.
Each page presents information in a rigid
format divided into further sections (see
Table 1), although not all sections are
mandatory. The Examples, Notes, and
Bugs sections, for example, are fre-
quently omitted. This consistent struc-
ture compensates for the often over-
whelming detail of some man pages,
which can be over 1,000 lines long.
Lead Image © toonzzz, 123RF.com
LINUX-MAGAZINE.COM
 IN-DEPTH
Command Line – tldr

Table 1: Man Page Sections similar functions. Similar to whatis, tldr command or its own tldr command, or
NAME provides documentation closer to GNU – ironically – from a man page.
SYNOPSIS Info and man pages in the amount of de-
CONFIGURATION tail given. Writing tldr Pages
DESCRIPTION Like man, tldr benefits from a well-de-
OPTIONS Using tldr as a Reference fined structure (Figure 2). However, tl-
EXIT STATUS
Created by Romain Prieto in 2013, tldr dr’s structure is much simpler, making it
became one of the most popular projects clear that tldr is a supplement to man, not
RETURN VALUE
on GitHub by 2015. It received large a replacement. Only commands are in-
ERRORS
boosts in such a short period as to suggest cluded in the pages, with only the most
ENVIRONMENT
an organized promotional campaign. common use cases for each command.
FILES
Whatever the case, the project has re- Contributors wishing to set up a tldr
VERSIONS
mained popular ever since, and the com- page are encouraged to use the following
CONFORMING TO
mand is now readily available in many guidelines from the tldr GitHub page [2]:
NOTES
distributions. It is also available for An- “1. Try to keep pages at around 5 exam-
BUGS
droid, macOS, SunOS, and Windows. ples. Pages can be longer or shorter
EXAMPLES When used for the first time, tldr uses when appropriate, but don't exceed 8
AUTHORS online pages, resulting in a noticeable examples. Remember, it's OK if the
SEE ALSO lapse before results are displayed. How- page doesn't cover everything; that's
ever, the option --update (-u), with an what man is for.
GNU projects provide Info pages that optional LOCALE at the end, creates a local “2. When in doubt, keep new command-
have a similar purpose to man pages and cache in the current account at .local/ line users in mind. Err on the side of
often use more user-friendly language. share/tldr. The same option can be used clarity rather than terseness. For exam-
However, they can be less structured and to update the cache periodically with ple, commands that require sudo
concise and have not caught on nearly should include it directly in the
as much. In fact, even GNU projects --auto-update-interval DAYS examples.
often maintain both formats. The main “3. Try to incorporate the spelled-out ver-
advantage of Info pages is that they can With --platform (-p) PLATFORM, an operat- sion of single-letter options in the exam-
be read in Emacs using a mouse. ing system’s pages can be specified, but ple's description. The goal is to allow
Less common but useful in their own in practice this is rarely needed. By de- people to understand the syntax of the
way are whatis, which returns a one-sen- fault, results are printed in color, but the commands, not just memorize it.
tence definition of a command, and (ap- color can be turned off with --no-colors. “4. Introduce options gradually, starting
ropos) which, which lists commands with Help is on a summary listed by the bare with the simplest command

Figure 2: While much simpler than a man page, tldr offers a well-defined structure.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 33

IN-DEPTH
Command Line – tldr

Figure 3: More complex commands are broken into subcommands on their base pages.

invocations, and using more complex preferred – for instance, denylist/allow- are entered in an order that is checked
examples progressively. list instead of blacklist/whitelist. The de- when a page is submitted for approval.
“5. Focus on details specific to the com- fault language is English, although other
mand, and avoid explaining general languages are encouraged. The Limits of tldr
Unix concepts that could apply to any Because tldr is written in Markdown, It is important not to expect too much
command (ex: relative/absolute the page structure is easy to learn – a ne- from tldr. The command is not a replace-
paths, glob patterns/wildcards, spe- cessity for a project that depends so heav- ment for man or GNU Info so much as a
cial character escaping, ...).” ily on outside contributions (Figure 4). quick reference guide. Just like many
In addition, more complex commands Input is done by lines. General information desktop applications, it makes no attempt
may be broken into subcommands, such can simply be entered as a line. Specific to cover every option. In fact, with com-
as git-commit and git-push (Figure 3). types of lines are identified by their first plicated commands, it can be less useful
These divisions should be listed on the character (Table 2), just as an initial # indi- than a man or Info page, becoming cum-
base page. Also, inclusive language is cates a comment in a text file. These lines bersome, even with base pages. More-
over, in some cases, a tldr page can
Table 2: tldr Syntax sometimes appear at first glance as ob-
Character Line Type scure as the command structure at the
# The name of the command. Alternatively, the first line that is not an top of a man page. Some might also dis-
example. like the lack of developer credit, both be-
> Other information including a general description (one to two lines cause credit is the traditional reward for
long) and a link to additional information – often but not always to a writing free software and for the practical
man page. reason that a developer’s credit can be
- An example followed by a general line that gives the example. Up to handy for those who want more detailed
eight examples can be included, with the most common use cases first. information or to file a bug.
Despite these limitations, tldr fills a
niche that was previously empty. Some-
times, what users need is only a quick
reminder that takes them away from
their work for the least time possible.
When that happens, tldr is the com-
mand to use. Q Q Q

Info
[1] tldr: https://github.com/tldr-pages
[2] Guidelines:
https://github.com/tldr-pages/tldr/
Figure 4: The template for tldr pages. blob/main/CONTRIBUTING.md
QQQ

34 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

  
         
     

        

   
 
 

IN-DEPTH
DNS Subdomain Hijacking
Preventing DNS subdomain hijacking
Domains Gone Astray
Attackers can use poorly maintained DNS records to gain access to your IP address. The open source
DNS Reaper lets you monitor your records to ward off attacks. By Matthias Wübbeling
T
he Domain Name System (DNS),
comparable to an address book,
forms the backbone of today’s
communication on the Internet.
With IPv4, IT administrators could mem-
orize their most important servers’ IPv4
addresses, but there is no alternative to
DNS with IPv6. In this article, I will
show you how attackers exploit old DNS
records to hijack parts of your domain,
as well as show you how to protect your-
self against these attacks.
DNS is divided into zones (a portion
of the DNS namespace) managed by in-
dividual organizations or administra-
tions. New entries are quickly created,
and many projects sometimes result in
36 FEBRUARY 2024 ISSUE 279
very large zone files. Often, remnants of
test setups or projects will remain in a
zone even after they are no longer in
use. Combine this with external services,
such as external hosting or cloud service
providers, and outdated entries can be-
come dangerous.
Subdomain Hijacking
A simple example involves an A or
AAAA entry from a subdomain on a
cloud provider’s IP address. When a
project ends, all paid services are can-
celed with no further access to the cloud
server. If this DNS entry does not result
in explicit costs, users often simply for-
get to delete the entry. Because the entry
still points to the provider’s IP address,
this entry becomes a dangling record –
at least as long as the resource is not ac-
cessible. If a potential attacker gets the
newly freed IP address for their server,
the address can also be reached through
your company’s subdomain, but the ser-
vices or content offered at the IP address
are no longer under your control.
If you rely on cloud providers for your
Photo by cdd20 on Unsplash
projects’ resources, your subdomains
will come from the provider’s zone. A
generic domain such as xyz.example.
com is then made available to let you ac-
cess your files. Of course, you could now
resolve the IP address and add it as an A
record for cloud.linux-magazine.com to
LINUX-MAGAZINE.COM

your DNS. However, cloud providers
usually operate a content delivery net-
work (CDN), so your file is usually ac-
cessible from multiple IP addresses, and
these addresses can change.
To avoid dealing with these underlying
provider-side infrastructure changes, it
makes sense not to use A records. In-
stead, you can use a CNAME record that
points directly to xyz.example.com.
Much like a shortcut on a filesystem, this
changes the name resolution for your
subdomain when the entries for xyz.ex-
ample.com change. By doing this, you
can still benefit from the dynamics of-
fered by your cloud provider without
having to worry about name resolution
yourself. When you use your own do-
main name, you will not even notice the
difference, because the resolving name
server takes care of everything and sim-
ply returns the IP address that you need
to access the files.
Name Assignments in the
Cloud
Your data in the cloud is stored along-
side data from your provider’s other cus-
tomers. The provider evaluates the host-
name transmitted in the request in order
to determine what information needs to
be delivered when the data is accessed.
However, this hostname is no longer xyz.
example.com but the name of your sub-
domain, which resolves to the IP address
of xyz.example.com thanks to the
CNAME record.
Once you have finished the project
and released the resources from the
cloud, the assignment to your subdo-
main also disappears from the provider’s
system. Access is now no longer possible
using the hostnames from your subdo-
main. In many cases, however, the
admin responsible for the DNS zone is
not notified, and the CNAME record con-
tinues to exist – your provider’s xyz sub-
domain is so long and random that it
would probably never be assigned to
anyone a second time.
If an attacker sees that you connect to
your cloud provider via your domain’s
CNAME record (e.g., by assigning the IP
address resolved by your subdomain to
your provider), the attacker could at-
tempt to store the hostnames originally
used in your company’s subdomain
under the attacker’s account with the
same provider. Depending on your
LINUX-MAGAZINE.COM
DNS Subdomain Hijacking
provider, checks may not be performed
to ascertain whether use of the stored
name is actually legitimate. In addition,
the name can only be used if a CNAME
record is stored for it in DNS.
Rebound Attack
While the attacker will not get the same
subdomain xyz.example.com as you did
for your projects, it could be something
like zyx. In fact, a real A record for your
xyz entry in your provider’s DNS zone
has never existed. Instead, wildcards
(*.example.com) simply resolve all the
requested subdomains to the availble IP
addresses in your provider’s CDN. Your
provider handles the actual assignment
to the data via the hostname supplied
with the request – and this hostname is
now stored under the attacker’s account.
With the data available in the attack-
er’s project, which can be accessed
through your company’s domain, the at-
tacker can now disseminate information
claiming to be your company. They can
also specifically attack your company or
your customers, for example, by embed-
ding manipulated content from this do-
main via a vulnerability in a web appli-
cation. By using your subdomain, the
same-origin policies of modern web
browsers may allow active content to be
executed in the context of your website.
In addition to attacks based on stored
files, the same techniques can be used
for access by other services. CNAME re-
cords can be created for any type of
server, including the names of
namespace (NS) or mail exchange (MX)
records. Armed with these, an attacker
can then control an entire subdomain or
use one of your company’s subdomains
to send and receive email.
Taking Countermeasures
In an ideal world, the DNS zone’s ad-
ministrators would immediately be noti-
fied upon completion of a project and
subsequently would remove the CNAME
record, ensuring these attacks couldn’t
happen. Unfortunately, this sometimes
does not happen in real life. On a posi-
tive note, there are a number of tools to
help admins to check active and passive
DNS entries.
Punk Security’s DNS Reaper [1], an
actively maintained open source tool, is
one such solution. You can download
DNS Reaper from GitHub and install it
ISSUE 279
IN-DEPTH
on your system. Punk Security also of-
fers a pre-built image for use in a Docker
container, which lets you use DNS
Reaper directly without managing the
runtime environment and any depen-
dencies yourself. To view DNS Reaper’s
options and download the Docker image,
simply use the following command:
docker run -ti U
--rm punksecurity/dnsreaper --help
You can use the output to get oriented
and identify potential arguments for
your use case. Of course, DNS Reaper
needs a way to check all the existing
entries in your zone. A black box check
(i.e., without further knowledge of your
DNS zone’s structure) is not possible.
While there are techniques to determine
different entries in the DNS, applying
them will not give you all of the exist-
ing entries.
For a comprehensive check, your best
bet is to export your entire zone from the
DNS server and make it available to DNS
Reaper. If this is available in a BIND DNS
compatible format, the software can use
it directly. To use a zone file named do-
main.zone in the Docker container, you
need to mount it as a volume in the
image. You can then start it using the fol-
lowing command:
docker run -it --rm -v ./domain.zone:/U
domain.zone punksecurity/dnsreaper U
bind --bind-zone-file /domain.zone
Alternatively, you also use providers
supported by DNS Reaper, such as AWS
or Azure, by passing in your access cre-
dentials with the call. Transferring the
zone directly from a DNS server is also
possible, but this requires intervention in
the server’s configuration to allow a
zone transfer.
Conclusions
Poorly maintained DNS records are more
dangerous than they might appear at
first glance. Attackers can use dangling
records to run attacks that look like they
originated in your organization. DNS
Reaper helps you monitor your DNS re-
cords to protect against attackers. Q Q Q
Info
[1] DNS Reaper: https://github.com/
punk-security/dnsReaper
FEBRUARY 2024 37
IN-DEPTH
Passive Reconnaissance

Researching a target with passive reconnaissance tools

Hunting and
Gathering
Cyberattacks often start with preliminary research on network assets and the people who use them.
We’ll show you some of the tools attackers use to get information. By Chris Binnie

W
hen sizing up potential tar- Google stated authoritatively (as the not be subject to eavesdropping, man-in-
gets, attackers try to get as main player in the search space): “Brows- the-middle attacks, or data modification.”
much information as pos- ing the web should be a private experience And, while this announcement pro-
sible without raising any between the user and the website and must vided an excellent incentive for website
alarms. The ability to passively research
the details of online resources and
their associated humans has never
been easier. If you’re wondering what
kind of information about you and
your network is available online right
now, the best way to find out is to look
for it yourself.
This article examines some online ser-
vices that tabulate known information
on users and websites. Some of these Figure 1: This website has used a number of different certificates.
services use information that is freely
available through online sources; others
delve into the dark web to find data that
has turned up in security breaches. For
privacy, and in order to demonstrate
richer examples, identifying information
in the output of the tools described in
Photo by Goh Rhy Yan on Unsplash

this article will be redacted.

Certifiable
A few years ago, the mighty Google
announced [1] that it was putting more
weight on websites running HTTPS, as
opposed to the unencrypted HTTP al-
ternative, for its search engine index-
ing results. Figure 2: There’s a lot of information stored at crt.sh.

38 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


owners to move to solely using HTTPS,
it had an unwelcome side effect that
made life a little easier for attackers. At-
tackers soon realized that, if each web-
site uses HTTPS, the SSL certificates
(now TLS certificates) for every website
could be captured and scrutinized. Un-
like a simple DNS entry, certificates hold
much more information.
The first online tool that I will look at
is called crt.sh. The crt.sh service [2],
which is run by the certificate company
Sectigo Limited [3], maintains a massive
Figure 3: A redacted example of DNSDumpster in action.
Figure 4: DNSDumpster offers clever visualizations.
Figure 5: OSINT Framework delivering on suggested DNS tools.
LINUX-MAGAZINE.COM
database of certificates that were discov-
ered on websites (and potentially other
services). Its splash page [2] tempts
users with broad search criteria: “Enter
an Identity (Domain Name, Organization
Name, etc), a Certificate Fingerprint
(SHA-1 or SHA-256), or a crt.sh ID.”
In other words, it is possible to search
for companies (not just domain names),
as well as by certificate fingerprints and
other criteria. There are also a number
of advanced search options that I’d rec-
ommend testing. It is possible to
ISSUE 279
IN-DEPTH
Passive Reconnaissance
automate usage of the tool by passing
the search query directly to the main
URL, such as:
https://crt.sh/?q=domain.tld
Figure 1 shows an example of a search.
For a relatively quiet website, there’s lots
of information available for an attacker.
It is immediately obvious that over the
years, the site used a variety of certifi-
cate providers, including Let’s Encrypt,
DigiCert, and RapidSSL.
The wealth of information available
just from the abbreviated output in
Figure 1 would surprise most crt.sh
users. Click on a link on the right side
of Figure 1, and you’ll see a tiny sam-
ple of what is known, including infor-
mation on which applications can
make use of the certificate authority
(Figure 2).
Back to the results in Figure 1, the
column entitled Common Name pro-
vides a plethora of information that just
keeps on giving. The field reports hun-
dreds, maybe thousands, of hostnames
that certificates have supported over the
years, along with timestamps to check
for the likely status. These hostnames
could include valuable information on
the domain path, such as accounts.do-
main.com or mail3.domain.org.
Each of these fully qualified names
present an attack surface that you can
extract from crt.sh. I’d encourage you to
try tools like this yourself to see if your
website has publicly leaked any unwel-
come information.
Digging into DNS
Another tool that can reveal a lot of in-
formation about resources related to a
domain name is called DNSDumpster [4]
by Hacker Target Pty Ltd. According to
the website, this service offers “…a
FREE domain research tool that can dis-
cover hosts related to a domain. Finding
visible hosts from the attackers perspec-
tive is an important part of the security
assessment process.”
Figure 3 shows what happens when you
add a domain name to the DNSDumpster
search box.
Even querying against a relatively
quiet domain name, DNSDumpster can
fill the screen with information that
points the user in all sorts of directions.
Figure 4 shows a visualization of the
FEBRUARY 2024 39
IN-DEPTH
Passive Reconnaissance

apparently obsolete and no longer public

IP Addresses might currently have other
live systems using them.
The sophisticated DNS History service
also displays easy-to-read representa-
tions of the number of registrations for
domain names. As shown in Figure 8, a
new feature, currently in Beta, shows a
heat map of where on the planet regis-
trations are taking place. DNS History is
an impressive site that deserves much
more time dedicated to exploring it.

Going Dark
So far I have focused on certificates and
DNS, along with the outstanding OSINT
Framework, which is a topic all of its
own. If you’re willing to take a step
Figure 6: You should experiment with the clever DNS History service. down into the darkness, you can also
find information by rummaging deeper
relationships among the discovered re- Scroll a little further down the search on the dark web. Suppose I wanted to
sources in the form of graph. page to see some historical record refer- find information relating to a specific
If you are new to the term, OSINT ences that might be useful to you or an user via their email address. There are a
(Open Source Intelligence) provides “le- attacker (Figure 7). In some cases, number of services that collect
gally gathered information about an indi-
vidual or organization from free, public
sources.” If you discover intriguing infor-
mation within DNS for a domain name, I
recommend visiting an excellent OSINT
resource called OSINT Framework [5].
OSINT Framework is an eye-watering re-
source that you could spend several days
exploring. The site pulls together a vast
array of free online tools and resources.
Consider PassiveDNS as an example.
Figure 5 shows that, by expanding vari-
ous menu options relating to DNS, you
can see there are many pointers to free
online tools to help you perform passive
reconnaissance for DNS queries.
Click the DNS History button on the
right side of Figure 5, and you are
pointed at a site called DNS History [6],
which is run by 8086 Consultancy [7]. Figure 8: A heat map lets you see where domain names are commonly
Figure 6 shows how simple it is to use registered. (Source http://dnshistory.org/p/heatmaps)
the site if you need to query when
changes took place for a DNS entry.

Figure 7: Useful DNS A records

with IP Addresses and the dates Figure 9: Dehashed: That’s a lot of assets. (Source: https://www.
they were in use. dehashed.com)

40 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 IN-DEPTH
Passive Reconnaissance

Pwn Check
Entering a problematic email address
into Have I Been Pwned returns lots of
information about each breach associ-
ated with the address. For the address
used in this article, I also received this
warning: “Pwned in 18 data breaches
and found 2 pastes (subscribe to
search sensitive breaches)”. That’s re-
ally not good news, and if you didn’t
have unique passwords, it could be
even worse.
Have I Been Pwned also lets you set up
an alert to notify you if your email ad-
dress shows up in a data breach [10]
(see Figure 10).

information from the dark web for secu-

rity professionals (and attackers obvi-
ously) to query. One service I’ve used
professionally is Dehashed [8]. Figure 9
shows the mind-blowing number of com-
promised resources visible to Dehashed.
You need to register for a free account
to query the database. Signing up for a
reasonably priced subscription will pro-
vide much more information in relation
to the queries you perform.
Figure 10: Using Have I Been Pwned. (Source https://haveibeenpwned.com)
To demonstrate what is available for When I checked the email address in
free, I have used an email I know has been Dehashed, I got the results shows in Fig-
exposed a number of times, thanks to the ure 11. Figure 12 shows some of the details
inimitable Have I Been Pwned website [9] from the 31 results Figure 11 mentions.
(for more on Have I Been Pwned, see the A careful look at Figure 12 shows
box entitled “Pwn Check”) some of the Sourced from data sources.
IN-DEPTH
Passive Reconnaissance
These sources are well-known data
breaches that contained the email ad-
dress. (If you’re interested, check out the
article at the CSO site on the 15 biggest
data breaches this century [11].)
Back to Dehashed, if you have an ac-
tive subscription, you can click on any of
the items relating to breaches on the left
side of the screen, and the service will
reveal what data was present in the data
breach (relating to the email address).
Findings can include all sorts of data,
including: usernames, email addresses,
IP Addresses, postal addresses, tele-
phone numbers, passwords (hashed and
in plain text), and human names. The
Figure 11: Dehashed has found some worrying data relating to the email address. (Source: https://www.
dehashed.com)
Figure 12: The breaches where the findings were discovered. (Source:
https://www.dehashed.com)
Figure 13: The breaches that Dehashed references (Source: https://
dehashed.com/data): The “17 Database Breach,” where apparently, in
2016, data related to a streaming app was exposed, including informa-
tion about four million users.
42 FEBRUARY 2024 ISSUE 279
data is not just alluded to either – the
findings are displayed for all to see.
Dehashed lets you request that an
entry be removed from its database, but
of course, the data could still be present
in many other places online, including
the dark web. Removing the visibility of
the data in Dehashed only hides it from
some security researchers and others
who are using Dehashed.
Dehashed also provides a comprehen-
sive (subscription-based) monitoring
service, alongside a fully fledged API.
The Dehashed Data Wells page [12]
shows how much data was retrieved
from specific data breaches, along with a
Info
narrative that provides some additional
and useful context.
Conclusion
There are many ways of performing recon
online without ever going near a potential
target. Attackers will take advantage of
tools like the ones described in this article.
If you’re serious about thinking like an at-
tacker, you can use these tools to do your
own reconnaissance and determine how
much of your data is exposed online. I en-
courage you to spend lots of time on the
OSINT Framework site to gain a better un-
derstanding of the passive reconnaissance
tools currently in use. Q Q Q
[1] “Indexing HTTPS Pages by Default”:
https://developers.google.com/search/
blog/2015/12/indexing-https-pages-
by-default
[2] crt.sh: https://crt.sh
[3] Sectigo: https://sectigo.com
[4] DNSDumpster:
https://dnsdumpster.com
[5] OSINT Framework:
https://osintframework.com
[6] DNS History: http://dnshistory.org
[7] 8086 Consultancy:
http://www.8086.net
[8] Dehashed:
https://www.dehashed.com
[9] Have I Been Pwned?:
https://haveibeenpwned.com
[10] Notification at Have I Been Pwned?:
https://haveibeenpwned.com/
NotifyMe
[11] “The 15 Biggest Data Breaches of the
21st Century”: https://www.csoonline.
com/article/2130877/the-biggest-data-
breaches-of-the-21st-century.html
[12] Dehashed Data Wells: https://
dehashed.com/data
Author
Chris Binnie is a Cloud Native Security
consultant and coauthor of the book Cloud
Native Security: https://www.amazon.com/
Cloud-Native-Security-Chris-Binnie/dp/
1119782236.
QQQ
LINUX-MAGAZINE.COM
IN-DEPTH
Formatting with LibreOffice
A more consistent, time-saving formatting option
The case for style
Learning how to use styles in LibreOffice can save you hours of
formatting and let you focus on your writing. By Bruce Byfield
W
hy does LibreOffice Writer
need a how-to? Aren’t mil-
lions familiar with it
through daily use? Not ex-
actly – many use LibreOffice inef-
ficiently, ignoring the tools designed to
make work easier, and do everything the
hard way. It’s like dragging your feet in-
stead of using the brakes.
When using LibreOffice, or any word
processor, most people type some text,
pause to format the text before typing
more, and then repeat the process, which
is slow and likely to interrupt one’s train
of thought. To change the format, a user
must go through the document individu-
ally updating every instance of the old
format. This method of working is known
as direct or manual formatting.
Word processors in general, and Libre-
Office Writer in particular, are not pri-
marily designed for direct formatting.
They can be used that way and even
have tools to help users who insist on di-
rect formatting. However, LibreOffice is
most efficient when using styles, its
equivalent of programming variables.
Styles is a collection of formatting op-
tions, where one paragraph style might
be Times Roman 12-point bold italic and
another Helvetica Regular 18-point.
44 FEBRUARY 2024 ISSUE 279
and a toolbar item to display the most
commonly used styles. The Styles win-
dow is particularly useful because it can
be repositioned and offers different
Styles can be set up to be applied auto- views of the available styles, including a
matically. When styles are used, a for- view of the styles used in the document.
mat only needs to be changed once, in- At first, setting a Writer style may seem
stead of individually. Although styles a daunting task that requires dozens of
can take time to set up, they can be choices. However, Writer includes dozens
saved as templates and reused. By using of defaults that can be customized with
styles, users can focus on developing only minimal changes. For instance, if
their thoughts, as well as save them- you do not want a particular feature, such
selves time formatting their documents. as a background color, you can simply ig-
These benefits apply especially to Li- nore it. Moreover, a style can be used for
breOffice Writer. Most word processors
have paragraph and character styles, but
Writer also has page, list, frame, and table
styles. The story goes that when StarDiv-
ision, LibreOffice’s original ancestor, was
developed, the programmers were told
they would have to use it to document
their efforts. As a result, they added every
useful tool they could think of, especially
for styles. The developers were so thor-
ough that many publishers today set their
books using Writer. In fact, thanks to
styles, Writer is not so much a word
Photo by Nick Morrison on Unsplash
processor as a desktop publisher.
The Structure of Styles
Styles can be edited through Writer’s
Styles window by pressing F11 (Fig-
ure 1). The Styles window is also the Figure 1: Writer’s Styles window is
most convenient way to apply styles, al- the most convenient place to
though you can also use the Styles menu apply styles.
LINUX-MAGAZINE.COM
 IN-DEPTH
Formatting with LibreOffice

years, so the effort upfront can save time have many features in common, this ar- example, if the First Page style is followed
and effort each time you use the style in rangement saves considerable time. by the Left Page style, and the Left Page
the future. In fact, a well-customized style Another useful field on the Organizer style followed by the Right Page, a docu-
can save you hours over the years. I still tab is the Next style field, which assigns ment is formatted in the background as
use a template with styles that I created the style that follows the current one. For you write (Figure 4). Once you apply the
20 years ago that probably has saved me
days of work.
When you are writing, the features of a
style are applied automatically. If, for in-
stance, a paragraph style indents the first
line, there is no need for a tab. Similarly,
if there are spaces following a paragraph
rather than an initial indent, the spaces
are applied when you press the Enter
key. In addition, on the Organizer tab of
any style (Figure 2), you can use the In-
herited from field to base a style on an
existing one, a feature that is useful
when creating related styles. In fact, sev-
eral groups of files are hierarchical, such
as the Heading, Table of Contents, Index,
and Text Body styles. Edit the Heading
style, for example, and your changes are
automatically applied to Heading 1
through Heading 10 (Figure 3). You only
need to edit Heading 1 through Heading
10 individually for their unique features.
Because such hierarchical styles usually Figure 2: The Organizer tab helps to automate the use of styles.
IN-DEPTH
Formatting with LibreOffice

Figure 4: One style can be set to succeed another automatically.

Figure 3: Because styles can be
hierarchical, changes to the top
style are inherited by styles lower
in the hierarchy.
First Page style, the rest is taken care of
for you. In the same way, you can set a
Title style to be followed by a Subtitle
style and then Text Body.
Because setting all the styles in a docu-
ment can take several hours, you won’t
want to do this each time you start a doc-
ument. Instead, when the styles are per-
fected, you can save your effort in a tem-
plate via File | Templates | Save As Tem-
plate. To reuse the template, select it from
Files | New | Templates (Figure 5). You
might also use File | Templates | Edit Tem-
plates to add other automatic features
such as Fields to complement the styles.
finalize the styles, you will make so
many changes that creating styles is
mostly wasted effort.
• The document’s formatting is ex-
tremely simple, like an essay.
On the other hand, I recommend using
styles for the following cases:
• A document is long (over three pages).
• A document will be used over and
over.
• A document will be edited by more
than one person.
• A document will be edited weeks,
months, or even years after the first
version.
• A document belongs to a standard class
of documents, such as a letter or memo.
• A document must match that of other
documents from you or your company
or organization.
• A document will be used in a number
of different ways, each of which re-
quires some minor changes (e.g.,
printing it on both a white and a red
background).
• A document is highly formatted, like a
brochure.
The more circumstances that apply, the
clearer your decision will be.
A Different Way to Write
You may need time to get used to the
idea of styles. Instead of jumping right
into writing, using styles involves more
preplanning than manual formatting.
However, using styles allows you to con-
centrate on developing your thoughts
rather than focusing on formatting. Once
you are used to the change, you should
start to see that word processing is more
than an electric typewriter. Moreover,
you’ll be working with LibreOffice,
rather than against it. Q Q Q
Author
Bruce Byfield is a computer journalist and
a freelance writer and editor specializing
in free and open source software. In
addition to his writing projects, he also
teaches live and e-learning courses. In his
spare time, Bruce writes about Northwest
Coast art (http://brucebyfield.wordpress.
com). He is also co-founder of Prentice
Pieces, a blog about writing and fantasy at
https://prenticepieces.com/.

When to Use Styles?

Ideally, the answer would be always.
However, unless you develop a template
for each kind of document you fre-
quently write, that may not be practical.
I suggest the following guidelines for
manual formatting:
• The document is short (one-two pages).
• The document will be used once and
never reused.
• The document will be edited by only
one person.
• The document will only be edited
soon after it is written.
• The document will be edited by people
who have no idea how to use styles
and refuse to learn.
• A consistent format doesn’t matter for
some other reason.
• You are experimenting with styles
while building a template. Until you Figure 5: Templates store styles (and therefore layout) for reuse.

46 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

IN-DEPTH
Mining Monero

Mining the Monero cryptocurrency the CLI way

Mini Miner
The Monero cryptocurrency lets you get in the game without spending thousands on
hardware. We’ll show you how. By Daniel LaSalle

W
hen I started mining Bitcoin article describes how to start mining Technical Requirements
13 years ago, the hardware XMR on a Debian-based Linux system. The most important asset for mining
standard was a bunch of cryptocurrencies is electricity. The sec-
Windows computers built A Little Bit More on XMR ond most important asset is a fast CPU
up around the best possible video cards The value of Monero is nowhere near chip [5] that you can overclock. You’ll
and power supplies. The end goal was to the range of Bitcoin’s value. The price of also need a means for dissipating the
achieve the most hashes per second (H/ XMR at the time I wrote this article was heat and keeping your environment dust
s, or sometimes expressed as kH/s or $142.30, whereas the price of Bitcoin free. Because mining is a process that
mH/s) [1]. To this day, it is easy to find ar- was $25,851.07. Some have wondered never sleeps and demands full capacity,
ticles explaining how to mine Bitcoin whether XMR would ever reach the it will be important to leave room for
using this classic setup. But few of the value of BTC, but since its inception in your hardware to remain in a cool,
mining tools are command-line based, 2014, it has failed to even reach the $500 friendly zone for the time it will be
which is a problem for Linux veterans mark [4]. However, projections are look- crunching its life away. While it does,
who wish to avoid GUI clutter. But rest ing solid, and Monero shouldn’t disap- and if it runs as dedicated, it will emit a
assured: A basic Debian system, with the pear any time soon. vast quantity of heat. The final factor
fastest CPU you can get your hands on,
is all you need to start mining
cryptocurrencies.
In the highly competitive universe of
crypto mining, major currencies like Bit-
coin are typically mined using specially
built Application-Specific Integrated Cir-
cuit (ASIC) systems, which require a sig-
nificant investment of the miner’s time
and money.
Lead Image © Chode, 123RF.com

Alternative currencies offer a lower

barrier of entry. One alternative crypto-
currency that has gained some recent at-
tention is Monero (abbreviated XMR).
Monero stands out because it is truly
anonymous [2] and because of its resis-
tance to ASIC hardware mining [3]. This Figure 1: You’ll need SSH and the standard system utilities.

48 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 IN-DEPTH
Mining Monero

affecting hashing performance is the This process will take a while – and even now and then, in order to avoid all this
clock speed of the RAM, although the longer if you are working with a slow hard synchronization.
RAM speed is less important than the drive. Alternatively, specifying Whatever you attempt to do while the
other features I’ve mentioned. blockchain finishes updating could end
A minimal system for mining XMR --data-dir /path/of/.bitmonero up not working immediately. Therefore
would have a 250GB SSD, 4GBs of RAM, the wisest thing to do is to allow it to
and the cheapest video card available. will simply download the delta since last complete. However, this process will
The high-grade components need to be update. That way you can always back take several hours and can take days,
the CPU and the power supply unit. In- up your downloaded blockchain every depending on your Internet connection.
vesting in a good mother-
board is optional yet vital if
you wish for your system to
beat the clock. Be advised
that, as time goes on, the
size of the decentralized
blockchain copy that you’ll
need to host locally will
eventually expand to over
250GB. Currently, it weighs
about 164GB, so it is safe to
say that a 250GB drive will
hold for another three to
four years at the very least –
unless there is a huge in-
crease in transactions.

Getting Started
The first step is to get the
system up. For that, you’ll
need to install the latest
Debian (bookworm) [6].
All you really need is the
SSH server and standard Figure 2: Monero v0.18.2.2 is the latest current version; it contains both the daemon
system utilities from the and the wallet binaries that are pivotal to mining Monero.
latest Debian netinstall
(Figure 1).
Once you’ve installed the
OS and logged into the
freshly installed system,
the work with Monero can
begin. Start by download-
ing the latest Monero dae-
mon [7] and extracting it
under the folder of your
choice (Figure 2). Then in-
stall the CPU miner (Fig-
ure 3).
The next steps truly initiate
the Monero footprint. The
very first thing is to download
the ~164Gbs blockchain,
and for that, a simple execu-
tion of ./monerod will handle
the task (Figure 4).
Launching the monerod
command without an existing
blockchain in your home
folder will result in it down- Figure 3: Even if last the update dates back to 2020, xmr-stak is still one of the
loading the entire blockchain. best cross-platform CPU miners for XMR.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 49

IN-DEPTH
Mining Monero

By default monerod puts everything
blockchain related under /home/you-
ruser/.bitmonero. The last operation is to
port forward TCP/18081 if you wish to
have no errors, but those errors will not
void some functions.
Even when you have already down-
loaded 99 percent of the blockchain
and have not updated in 10 days, it can
take up to an hour for your
node to be synchronized
again. Because I am living
dangerously, I will proceed
immediately with the next
step: setting up a wallet
(Figure 5). In this case, I’ll
be running

~/Downloads/monero-x86_U
64-linux-gnu-v0.18.2.2/U
monero-wallet-cli

Upon first launch you are

asked to create a wallet, se-
cure it via a password, and
then configure it. Then you
are handed a 96-character
alphanumerical expression
that represents the actual
wallet address used for all of
your future transactions.
You are also provided
with 25 words that can be
used to recover access to
Figure 4: Downloading the blockchain with monerod. your wallet. Update your
password manager with that
information and take really
good care of it!
At the end of the creation
process, you will see your
balance and can start mak-
ing transfers, as long as the
node is in sync with the
Monero network. In the
event that everything went
smoothly, there will be two
mywallet files under pwd.
The next step is setting up
the miner, which you simply
execute and answer a couple
of questions. After you
choose the desired currency,
pool address, and wallet ad-
dress, the system gives the
infamous “MEMORY ALLOC
FAILED” (Figure 6), but you
can fix that right now.

System Tweaks
Because the general idea
behind mining is to maxi-
mize all available re-
sources, you need to be
sure to go big. For that,
Figure 5: You’ll need to set up a wallet. you will need to switch to

50 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 IN-DEPTH
Mining Monero

Listing 1: /etc/sysctl.conf Listing 3: crontab Entries

vm.nr_hugepages=1280 @reboot /opt/crypto/monero-latest/monerod --data-dir /opt/crypto/.bitmonero --detach

@reboot cd /opt/crypto/xmr-stak-latest && ./xmr-stak-rx --noTest

Listing 2: /etc/security/limits.conf
* soft memlock 262144
* hard memlock 262144

root and add values in both

/etc/sysctl.conf (Listing 1) and
/etc/security/limits.conf (List-
ing 2). Do not forget to enter
sysctl -p for the change to take
effect immediately. However, at
this point, due to the nature of
what’s coming, I like to save the
changes for a final reboot to test
it all out.
For the sake of coverage, Fig-
ure 7 shows how xmr-stak-rx
should properly behave once ev-
erything is nice and tidy.
Only when shortcuts are ap-
plied will cpu.txt be populated
and no errors shown at the con-
sole prompt.

And Then
Because I am building a dedicated
mining rig that runs 100 percent at
all times, I first need to confirm
that the values in cpu.txt match Figure 6: Questions answered, but you’ll need to make some changes before
the actual machine values. the miner is error free.
It’s also possible that I was in-
trepid in pursuit of enrichment
and immediately added the
--noTest switch to the first
launch of the xmr-stak-rx com-
mand. If no self test was done,
the cpu.txt never populated. Or
perhaps something worse hap-
pened? By nature, the content of
the cpu.txt file is very basic most
of the time (Figure 8).
Each CPU thread that you wish
to dedicate to mining XMR will
need to have a value defined
where the first core counts as 0.
Therefore, a 64-thread dedicated
mining machine would have 64
lines starting with 0 and ending
with 63. However, in this case, I
will make the educated guess that
this machine has 12 threads off,
and only the last 8 were config-
ured to be usable by xmr-stak-rx.
If you wish to know how many
usable threads your system can
run, enter: Figure 7: A better outcome after the changes.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 51

IN-DEPTH
Mining Monero
# dmidecode -t processor
and look for the thread count, which is
at the bottom, or simply run htop and
look at the number of cores that are
shown at the top.
Another thing I like doing is making
sure a mining rig requires minimal inter-
vention (e.g., when there is a power loss
and your UPS can’t hold on long enough
for the power to come back). Also, I like
the boxes to have minimal cabling, which
implies just the power and the network.
Lastly, the systems will need room to
breath and adequate ventilation.
To make sure I never lose a beat, I set
the crontab entries in Listing 3 under
my own user.
When you’re finished with these steps,
shutdown the system and unplug every-
thing. Set up the power and network ca-
bles as required for your configuration,
and then plug the system in, power it
up, and feel it getting warmer and its
fans working harder. Congratulations,
you are now mining Monero.
Along with the
Cryptoriches!
Money doesn’t come easily and the same
applies to cryptocurrency. I decided to use
Nanopool as the mining pool, but there
Figure 8: Inside the cpu.txt file.
Figure 9: First results appear with an unconfirmed balance.
52 FEBRUARY 2024 ISSUE 279
are many other choices [8] to decide from,
each with its own specifications.
The next step is to visit https://xmr.
nanopool.org/account/ followed by the
(very long) wallet name. For instance:
https://xmr.nanopool.org/account/U
43wnFgp65TxiexxMmKshejBjRZY5ckv987U
DQR4PMLKFuM5du8GWM8q56Ac3xZAYoELE1U
Tz8TxFzA6SZYWCVKiN9Z57NGfsh
After about 15 minutes, you will see the
first results posted as an unconfirmed
balance (Figure 9).
Even though the option for solo min-
ing is a possibility, it is a good idea to
join a mining pool to combine the com-
puting power with other users. This
method is generally the fastest way for
crypto enthusiasts to get better payouts,
as each pool has its own terms of use.
In the case of Nanopool, you need to
have mined a full (that’s 1.00000000) XMR
unit, which will then be automatically
cashed in your wallet, given that your
local blockchain is fully up to date.
If you also happen to have unlimited
electricity, CPU power, and room for venti-
lation, and you wish to dedicate a mining
room, you can deploy additional systems,
but avoid installing monerod on them, as it
is only needed once in any environment.
Just make sure you
configure
xmr-stak-rx to use
your wallet ad-
dress, and it won’t
be too long until
you get your first
payout.
If disaster
strikes one day
and you need to
start back from
scratch, the only pieces required to re-
sume your XMR activities is a copy of
both the wallet file and its key alongside
the password or the 25 recovery words
that were generated at wallet generation.
Be warned however, that if you stop
mining from a pool while you haven’t
met the minimum payout and you do not
contact them, you risk losing all of your
accumulated balance.
With Nanopool, you can always get a
non-checkout balance value transferred to
you. For that to happen, you need to have
been inactive for 24 hours and contact
them [9]. You will want to learn a little bit
more about joining a mining pool; this is
perhaps the best advice that I can give you
for starting your mining journey.
Conclusion
There are many considerations you’ll need
to address if you wish to claim a piece of
the cryptocurrency pie. But whichever
path you choose, it always comes back
to the basics: The Plan. Q Q Q
Info
[1] “What is Crypto Hash Rate and Why Is
It Important”: https://www.makeuseof.
com/crypto-hash-rate-what-is-it/
[2] “Why Monero Is the Best”:
https://gomonero.com/why-monero/
[3] ASIC-resistant mining algorithm:
https://cointelegraph.com/news/
monero-implements-hard-fork-
including-new-asic-resistant-mining-
algorithm
[4] Monero price on CoinMarketCap:
https://coinmarketcap.com/currencies/
monero/
[5] The Best CPUs for Mining Monero:
https://vicadia.com/best-cpu-for-
mining-monero/
[6] Netinstall with Debian:
https://www.debian.org/CD/netinst/
[7] Monero downloads: https://www.
getmonero.org/downloads/
[8] Mining pool options: https://
miningpoolstats.stream/monero
[9] Nanopool FAQ:
https://help.nanopool.org/hc/en-us/
articles/4898382873629-FAQ
Author
Daniel LaSalle was introduced to the
command prompt while in his 5th grade.
But his addiction to technology spans
over 30 years. In the last decade he's
been using Linux every day and freelanc-
ing as an infrastructure specialist. https://
www.linkedin.com/in/daniellasalle/
LINUX-MAGAZINE.COM
IN-DEPTH
VeraCrypt
Encryption with VeraCrypt
Keeping
Secrets
Protect your data and operating system from prying
eyes with VeraCrypt. By Matthias Wübbeling
C
onfidentiality and integrity are
increasingly important when it
comes to security. The ability to
encrypt data carriers is decisive
in this battle, especially for mobile de-
vices. This article shows you how to re-
liably protect your data and operating
system with the open source VeraCrypt
tool, as well as how to completely hide
the encrypted containers if necessary.
In response to the increase in aware-
ness of IT security, Microsoft began de-
veloping the software later known as
BitLocker [1] for encrypting files, parti-
tions, or entire hard disks in 2004. Bit-
Locker came under suspicion during the
Snowden incident, when it was sus-
pected of possibly providing backdoors
or master keys for intelligence services.
However, this has never been confirmed
and is unlikely to be confirmed any time
soon. BitLocker is therefore often used in
corporate settings because it gives ad-
ministrators the ability to create backup
keys and store them in Active Directory,
for example.
Created at virtually the same time, the
free TrueCrypt [2] encryption tool was
based on Encryption for the Masses
(E4M) source code (which was allegedly
stolen from SecurStar) [3]. While it took
BitLocker another three years to find its
54 FEBRUARY 2024 ISSUE 279
way into Windows, TrueCrypt enjoyed
great popularity right from the start, al-
though the developers remained anony-
mous for a long time and its source code
was not freely available. Rumors later
confirmed that TrueCrypt’s development
originally came from criminal circles.
TrueCrypt announced the end of devel-
opment in 2014.
In 2013, VeraCrypt, a fork based on an
older, audited version of TrueCrypt, was
launched. Today, VeraCrypt is developed
by the open source community. Of par-
ticular interest, VeraCrypt supports the
different Linux derivatives and macOS
as operating systems in addition to
Windows. As an added bonus, legacy
TrueCrypt containers can easily be re-
cycled thanks to VeraCrypt.
Encryption for Data
Protection
Data confidentiality and system integrity
are fundamental protection goals of IT
security and must therefore be taken into
account whenever an operating system
is installed. Regardless of the industry,
virtually everywhere you look there is
sensitive data that needs protecting
(often for legal reasons). Whether con-
struction plans, customer data, customer
projects, or simply internal documents
and communication, you don’t want this
information falling into the wrong
hands.
Mobile devices and data carriers in
particular are exposed to a greater risk of
loss or theft, especially if you have to
hand the device over briefly, say, during
international travel. In these cases, an
encrypted system partition protects
against uncontrolled manipulation, such
as the installation of malware or spy-
ware. Above all, however, it protects
against unauthorized access, for exam-
ple, to industrial secrets or personal data
on the hard drive.
Of course, confidentiality and integrity
are only ensured when the computer is
switched off. If a device is switched on
and the encrypted data is unlocked for
daily work with a password, access is
possible. A loss of confidentiality due to
user error or manipulation by malware is
then possible.
Lead Image © Stefan Redel, fotolia.com
Setup and First Steps
Some corporate environments already
use VeraCrypt. There are different con-
figurations, depending on the intended
use. Various scenarios are outlined
below. To get started, you first need to
download VeraCrypt for installation on
your operating system. Use the official
LINUX-MAGAZINE.COM

download page [4] provided by the
IDRIX developers. This way you can
count on having a valid, signed version
and avoid the trickery of dubious down-
load platforms.
The installation is child’s play: Launch
the downloaded file with admin authori-
zation or confirm the prompt during the
install. Then select the language that
suits you and install VeraCrypt with the
standard options. Alternatively, you can
download the source code provided on
GitHub [5] and create VeraCrypt on your
own system.
When you launch VeraCrypt, the pro-
gram comes up with a tidy interface
(Figure 1). You will see an overview of
the mounted drives; VeraCrypt uses the
classic drive letters from A to Z on Win-
dows and also offers the option of
mounting or creating a container or an
encrypted partition.
Pressing the Create Volume button
opens a dialog that guides you through
the process. The first step is to select the
type of storage you want for the volume.
You can choose between a container file,
an encrypted partition on your hard
disk, or an encrypted system partition of
your Windows operating system. For
first time users, it makes sense to create
an encrypted container.
Next you need to define your contain-
er’s volume type. You have two volume
options: standard and hidden (Figure 2).
Hidden volumes support two protection
objectives: plausible deniability and con-
fidentiality. A hidden volume makes it
Figure 1: VeraCrypt comes up with a very tidy inter-
face when first launched.
LINUX-MAGAZINE.COM
possible to deny the very existence of
the encrypted data if someone tries to
force you to hand over the data. To do
this, you need to create a hidden volume
on a standard volume. VeraCrypt creates
the matching structures in the container
headers regardless of which volume type
you choose, so the existence of these
structures alone is not credible proof of
the existence of a hidden volume. Tech-
nically, the internal volume is simply a
storage area within a standard volume
and is protected with another secret.
If you enter both secrets when mount-
ing the volumes, VeraCrypt determines
the byte limits of the two volumes within
the container and you can safely access
both volumes as required. If you only
specify the secret for decrypting the
outer volume, there is a risk of overwrit-
ing the hidden volume. VeraCrypt then
knows nothing about the corresponding
byte limits and simply fills up the con-
tainer, possibly also using up the area
containing the hidden volume.
Security vs. Performance
For my example, I’ll select Standard Ve-
raCrypt volume and then press Next.
Then I need to select the container file’s
storage location and specify the encryp-
tion parameters. VeraCrypt offers a
choice of algorithms. AES is the globally
recognized standard for block encryp-
tion. The alternatives, Serpent and
Twofish, were also candidates for the
AES standard at the time, so they are
comparatively secure.
If you do not
trust any algo-
rithm on its own,
you can also select
a cascade of
Figure 2: Plausible deniability is definitely an option
with VeraCrypt.
ISSUE 279
IN-DEPTH
VeraCrypt
several methods. You have to decide for
yourself whether this makes sense cryp-
tographically and for your application.
Ultimately, cascading increases key ma-
terial and eliminates the mathematical
uncertainties of individual procedures in
an attack scenario. The same applies to
the choice of the hash method; again dif-
ferent variants are available. Under nor-
mal circumstances, AES and SHA-512 are
safe choices that achieve a good compro-
mise between security and performance.
I will use these two methods in my
example.
As the next step, you need to define
the size of the volume based on your es-
timated needs. Otherwise, you might use
up a large amount of storage space on
your data carrier just to encrypt a few
files or a bunch of small files. VeraCrypt
also offers dynamic containers if you
can’t estimate the exact requirements
right now. These containers do not grab
the entire storage space when they are
created, but simply grow to the specified
maximum size as required. Incidentally,
you need to choose dynamic containers
carefully, because if they end up exceed-
ing the actual hard disk capacity, there is
a risk of data loss. I will be using a con-
tainer size of 1GB.
You now need to select the secret for
accessing the volume you created by fill-
ing out the two input fields with your
choice of password. Be sure to read the
info at the bottom of the dialog to help
you choose a secure password. Good
passwords should not only consist of
many different characters, but should
also be as long as possible. Password
length has a major influence on security
(see the “Password Security” box), al-
though you are likely to find different
FEBRUARY 2024 55
IN-DEPTH
VeraCrypt

recommendations for this in different
places. VeraCrypt warns you if your
password has fewer than 20 characters.
As an alternative or in addition to the
password, you can select further “se-
crets” to protect your volume. In addi-
tion to a smartcard, any file or the files
of an entire folder can be defined as key-
files (Figure 3). Of course, this increases
the size of the input variable for encryp-
tion immensely, but limits the secret to
be remembered to this one file or the se-
lected combination of files. Because an
attacker with access to your computer
could try out any file as a secret, it is not
a good idea to solely rely on one file as
the secret.
You can enhance security even fur-
ther by defining the Personal Iterations
Multiplier (PIM) yourself and selecting
the Use PIM option. This lets you
change the number of iterations of the
key derivation function that generates
cryptographic keys from your input,
thus making brute force attacks more
difficult. Having said this, the default
number of iterations (500,000 rounds)
offers a good compromise between per-
formance and security, so I wouldn’t
change anything here.
FAT, exFAT, or NTFS?
Once you have defined a good password
and clicked Next, you can move on to se-
lecting the volume’s filesystem. FAT or
exFAT can be mounted on almost any
other system later. NTFS gives you the
ability to use additional authorizations
or file attributes on Windows. Choose secret in order to mount it directly. The
the filesystem that best suits your re- container’s outer volume is not dis-
quirements. If required, check the boxes played or changed. However, if you want
for quick formatting and the option to to include the outer volume (e.g., to
dynamically grow the volume. Next, keep up appearances and store files)
move your mouse pointer to give the enter the secret for this outer volume
pseudo-random number generator for here. In Options, make sure you also
the crypto operations further random specify the secret of the hidden volume
data. Once the bar at the bottom of the for protection to avoid it being acciden-
window turns green, press Format. After tally overwritten (Figure 4).
a short time, your volume is ready, and
you can press Exit to close the dialog. Encrypting Partitions and
After creating your container, you are Hard Disks
taken back to the VeraCrypt start win- If you want to encrypt entire partitions
dow. Now search for your previously or data carriers, select the Encrypt a Par-
created container by clicking on Select tition/Drive option when creating a new
File, select the desired drive letter in the volume. In Windows, again confirm the
area above, and then press Mount. Enter User Account Control (UAC) dialog to let
the password in the dialog box or browse VeraCrypt access your data carriers. As
to the keyfiles you selected previously in a container, you can also create hid-
for the secret in Keyfiles. Clicking on OK den volumes. Then select the data
tells the disk man-
ager to automati-
cally mount the
volume, which
you can access
directly.
If you created a
hidden volume in
the previous step,
you will now see
two options when
mounting. If you
want to access the
contents of the
hidden volume, Figure 3: Keyfiles can also be used in addition to
you need to enter passwords.
the matching

Password Security
Secure passwords are long. They are designed to provide pro-
tection against brute force attacks (i.e., attacks in which all pos-
sible character combinations are tested in an automated pro-
cess). This complexity results from the number of characters
that the attacker must try in all possible combinations. The
more characters you combine, the exponentially more difficult
the password becomes to crack.
However, a password’s security is not only determined by the
choice and number of characters, but also by the degree of
secrecy. Sufficiently complex, yet easy to remember pass-
words do not need to be written down. The sheer number of
password characters plays a greater role than the largest
possible character set: An 18-character password in which
you only use lowercase letters and numbers (i.e., 36 possible
characters each) has more combinations than a 14-character
password with 100 possible characters. To keep the secret, do
not use your passwords for multiple purposes, but create an
individual password for each account. Otherwise, the number
of attempts required to access your files will be exactly one if
your password falls into an attacker’s hands (i.e., if another Figure 4: Protect existing hidden volumes against
account that uses the same password is hacked).
accidental overwrites.

56 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


carrier to be encrypted. In my example, I
will encrypt a USB memory stick. In this
case, it is not necessary to partition the
storage space in advance; you can en-
crypt the entire drive directly. The parti-
tioning can then be changed within the
encrypted area. VeraCrypt shows you
available storage and partitions for
selection.
Next you can choose whether to con-
tinue using the files that are already on
the data carrier in the encrypted volume
(the in-place encryption option). Vera-
Crypt can create encrypted storage
media without you needing to manually
temporarily store the files and transfer
them back. Note that this only works
with NTFS on Windows, because the op-
erating system is only capable of shrink-
ing NTFS filesystems on the fly, which is
necessary to free up space for the en-
crypted volume on the data carrier.
If you want to continue without in-
place encryption, select the other option
and press Next. Before formatting, you
will be warned once again that all data
currently on the medium will be perma-
nently deleted. If you are using a USB
memory stick, you are also told that a
drive letter will still be assigned on Win-
dows. However, you must not use the
drive in this way. Windows does not rec-
ognize any content and offers to format
the stick directly when you connect it,
which would delete the encrypted
volume.
Protecting the System
Partition
Now that you have some experience
with VeraCrypt, you can encrypt your
entire operating system. To do this, se-
lect Encrypt System Partition/Drive from
the System menu at the top.
VeraCrypt even offers to install a hid-
den operating system. This gives plausi-
ble deniability at the operating system
level to deny the existence of a hidden
operating system installation.
For my example, I will use normal en-
cryption and then opt to encrypt the en-
tire data carrier and not just the system
partition. The entire data carrier then also
includes any recovery or boot partitions,
which is why VeraCrypt recommends that
you only encrypt the system partition for
the recovery. Otherwise, depending on
the BIOS configuration, you could lose ac-
cess to your system completely.
LINUX-MAGAZINE.COM
Backup and Recovery
Now is a good time to think about back-
ing up the contents of your hard disk. If
something goes wrong with the encryp-
tion process, you will want to keep a
backup of your files in order to be able
to restore the system. The files can (or
should) of course also be stored on an
encrypted data carrier that can be easily
mounted by a booted system.
Next, select whether you have one or
several operating systems installed on
your data carrier. Then click Next and
set the encryption parameters as de-
scribed above. You are then taken to
the PIN entry screen. Of course, you
cannot select any files here, because
you do not have access to the hard disk
at system boot time.
VeraCrypt sets the keyboard layout to
English when you enter the password.
This is because only the BIOS settings are
available at boot time before the operat-
ing system possibly adopts your choice of
keyboard layout. You need to take this
into account, especially if you want to
use nonstandard characters in your pass-
word. You will normally have an English
keyboard layout, but to be on the safe
side and make sure that the BIOS is not
playing tricks on you with a country-spe-
cific language setting, it is a good idea to
display the password so that you can
enter the password with your local key-
board layout in case of an emergency.
VeraCrypt also lets you create your
own VeraCrypt rescue medium. This
helps you to repair a defective VeraCrypt
bootloader and also – with the correct
password, of course – to permanently
decrypt the system partition again, for
example, to repair a defective Windows
system. You need to burn the ISO image
you create to a CD/DVD or transfer it to
a USB stick. If you encrypt several sys-
tems with VeraCrypt, you will need an
individual rescue medium for each
system.
Before the encryption process starts,
you need to define the delete options
for the existing system files. You can
overwrite files multiple times to pre-
vent an attacker from restoring them –
even after overwriting the free disk
areas with the encrypted volume. Now
take note of the recovery instructions
and warnings before starting the
obligatory pre-test. The computer re-
boots and Windows launches again
ISSUE 279
IN-DEPTH
VeraCrypt
after you enter the password. Vera-
Crypt displays a success message for
the test after the reboot.
Click on Encrypt and say yes to warn-
ing prompts. The encryption process
then starts. You will need some patience,
depending on the size of your data car-
rier. Once the process has completed,
you can close the dialog box and will see
your system partition mounted in the
drive overview. Of course, you cannot
eject the drive. To protect your data, shut
down the system.
After restarting, you will be prompted
to enter the key. Remember that you
must type the key with an English key-
board layout. In addition to the pass-
word, you will be asked to enter a PIM if
you set one. If you have not set a PIM,
you can simply press Enter to confirm,
otherwise you need to enter the correct
value here. The operating system then
boots in the usual way, and you can
work with virtually no loss of
performance.
Conclusions
Encrypting data, especially on mobile
devices, is essential in the corporate en-
vironment. As an alternative to Bit-
Locker, VeraCrypt offers a sophisticated
approach to encrypting data carriers. It
protects USB memory sticks, hard disks,
and your system partition (though only
when the computer is switched off or
not connected). Hidden volumes also
give users the ability to credibly deny the
existence of any such volumes, should
someone attempt to force you to hand
over your data.
With the steps covered in this article,
you can encrypt your computer with
VeraCrypt. Keep in mind, however, that
secure passwords are an important se-
curity aspect. Q Q Q
Info
[1] BitLocker:
https://learn.microsoft.com/en-us/
windows/security/operating-system-
security/data-protection/bitlocker/
[2] TrueCrypt:
https://truecrypt.sourceforge.net/
[3] E4M:
https://en.wikipedia.org/wiki/E4M
[4] VeraCrypt download: https://www.
veracrypt.fr/en/Downloads.html
[5] VeraCrypt on GitHub: https://github.
com/veracrypt/VeraCrypt
FEBRUARY 2024 57
IN-DEPTH
Programming Snapshot – Google Drive Search Tool
Query your Google Drive
with a Go command-line tool
Patterns
in the
Archive
To help him check his Google Drive files with three
different pattern matchers, Mike builds a command-line
tool in Go to maintain a meta cache. By Mike Schilli
M
y digital library of scanned
paper books is stashed away
as PDF files in an account on
Google Drive. So far, Google
has done an exemplary job of keeping
my data available, but I just can’t make
friends with their search interface. In
typical Google style, the browser shows
you a search field that can be used to
quickly browse the indexed full text of
all the files in all the folders. However,
getting a simple answer to the question
of whether I already have a certain book
in my archive is more difficult. To do
this, I have to select the file names only
and restrict the search to specific folders.
Fortunately, though, Google provides
an intuitive API [1] to access user data
in the Google Drive cloud. For quick
checks, a command-line tool comes in
handy. While we’re at it, it’s worth
Author
Mike Schilli works as a
software engineer in the
San Francisco Bay Area,
California. Each month
in his column, which has
been running since 1997,
he researches practical applications of
various programming languages. If you
email him at mschilli@perlmeister.com
he will gladly answer any questions.
58 FEBRUARY 2024 ISSUE 279
taking a trip into the world of pattern Regular Expressions (PCRE) [2] used in
matchers, of which there are, as we all programming languages. Funnily enough,
know, a wide variety. For example, the they originated with the Perl scripting
shell relies on a glob mechanism for language many years ago, but all modern
matching, while programming languages languages from Python to Java and C++
typically rely on regular expressions (re-to Go support them as well.
gexes). And sometimes, a simple string On the other hand, the wildcard of the
matcher like the grep command is the regex world, .*, matches any string. The
most practical solution. dot in the pattern allows arbitrary char-
acters, and the subsequent asterisk
Parallel Regex Worlds stands for any number of occurrences
If you type ls *.jpg on the command (including none). The equivalent in shell
line, you expect the shell’s match mecha- globbing would be * as I explained in the
nism to find all files with a .jpg exten- *.jpg example, but note the caveat: The
sion. This pattern matching is fundamen- shell never matches beyond the path
tally different from Perl Compatible separator. Consequently, /tmp/f* does
not match /tmp/
foo/bar.
In contrast, the
Unix grep com-
mand matches
strings such as
foobarbaz with a
search pattern of
bar. It does not in-
Lead Image © Alphaspirit, 123RF.com
terpret slashes in
any special way
and is satisfied if
the pattern
matches even a
fraction of an
input line. In other
Figure 1: Three different pattern matchers in action. words, grep does
LINUX-MAGAZINE.COM
 IN-DEPTH
Programming Snapshot – Google Drive Search Tool

without anchoring; no need to pad the choose your matching strategy for Listing 1: gdls
pattern with *bar* as you would have to Google Drive data, Listing 1 provides 01 package main
in a shell pattern match. the --match command-line flag. It can 02 import (
take the values contains (default), 03 "flag"
Matches on Demand glob, or regex. Starting in line 29, the 04 "log"
To enable using the gdls binary com- code branches to a plain vanilla sub- 05 "os"
piled from the sources in this article to string match (using the strings. 06 "path"

07 "path/filepath"

08 "regexp"

09 "strings"

10 )

11 func main() {

12 matchMethod := flag.String("match",
"contains", "match method
(contains, glob, regex)")

13 update := flag.Bool("update", false,

"Update from Google Drive")

14 flag.Parse()

15 gddb := NewGdDb()

16 defer gddb.Close()

17 if *update {
Figure 2: An SQLite database stores all the file paths on Google Drive.
18 gddb.Init()

19 updater(gddb)

20 return

21 }

22 pattern := ""

23 if flag.NArg() == 1 {

24 pattern = flag.Arg(0)

25 }

26 gddb.RegexFu = func(re, s string)

(bool, error) {

27 var matches bool

28 var err error

29 switch *matchMethod {

30 case "contains":

31 matches = strings.Contains(s, re)

32 case "glob":

33 matches, err =
filepath.Match(re, s)

34 case "regex":
Figure 3: Enabling the Google Drive API before using it. 35 matches, err = regexp.
MatchString(re, s)

36 default:

37 log.Fatalf("Unknown: %s",
*matchMethod)

38 }

39 if err != nil {

40 return false, err

41 }

42 return matches, nil

43 }

44 gddb.Search(pattern)

45 }

46 func dbPath() string {

47 dir, err := os.UserHomeDir()

48 if err != nil {

49 panic(err)

50 }

51 return path.Join(dir, ".gdrive.db")

52 }
Figure 4: Registering the app on the Google Cloud console.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 59

IN-DEPTH
Programming Snapshot – Google Drive Search Tool
Contains() library function), a shell matching name, regardless of the
glob match (using Match() from the folder in which they reside. In contrast,
standard filepath package), or a full the glob match with the shell-style as-
regex match from the Go regexp library terisk syntax and path restrictions in
via regexp.MatchString(). the last line only finds files located in
Figure 1 shows the newly created the books/ folder. There is something
gdls program in action. A substring there for everyone’s taste.
match on bukowski will find all the To make the search commands in
books by American writer Charles Bu- Figure 1 produce usable results, the Go
kowski, of which there are no fewer program does not reach out to Google
than 15 in my library. To limit the Drive directly every time but uses a
number of matches displayed, the third local cache with the file names in an
command pipes the matches into a SQLite database on the executing ma-
trailing grep command in good old chine. You can refresh this local cache
Unix style. Matching on the substring whenever needed by calling gdls --up-
mad, the search leaves me with just one date. Then gdls contacts your Google
book out of 15 from the original search Drive account, retrieves the names of
whose title contains the string mad. all currently stored files, and feeds
Alternatively, the regex match with them into the files table of an SQLite
bukowski.*mad in the fourth command database in the local ~/.gdrive.db file
filters out the single match in advance. (Figure 2).
The expression finds files with a Listing 1 wraps the three different
queries as library
calls inside the
RegexFu() func-
tion (starting in
line 26). Later,
Listing 4 will reg-
ister it with the
SQLite database
engine. The
SQLite session in
Figure 2 still
searches manu-
ally and in typical
SQL style for like
%bukowski% – a
fourth pattern
matching
method! Later,
the Go program’s
search queries
will be using
Figure 5: The Client ID and Client secret act as ID SQLite’s built-in
badges for the app. regexp() function,
Figure 6: Fetching the access token on the first call.
60 FEBRUARY 2024 ISSUE 279
which we will have with this custom
RegexFu function by then.
Show Your ID!
So how does the metadata from
Google Drive end up in the SQLite da-
tabase? Google allows access to Drive
data to authorized users only. This
means that a program that wants to
fetch the names of the files stored in
the cloud needs some form of
authentication.
To do this, you first need to create a
project on the Google Cloud console [1],
enable the Google Drive API (Figure 3),
and add a new client application (Fig-
ure 4). The server responds with a newly
generated Client ID and a Client secret
(Figure 5).
The client secret does not authorize
access to the data, but it lets you re-
trieve an access token from the Google
API server. Later, if you include a
token of this kind with the request to
Google Drive API calls, the server will
hand over the data. The access token is
only valid for a limited period of time,
but it can be refreshed multiple times
with the refresh token, obtained along-
side the access token. The Client secret
is available for download in JSON for-
mat from the dialog in Figure 5; you
need to store it in the creds.json file in
the local directory.
When called for the first time with
gdls --update the program reads the
creds.json credentials file with the cli-
ent ID and client secret (Figure 6). At
this point, there is no access token, so
gdls calls the getTokenFromWeb() func-
tion from Listing 2 (starting in line 20).
It writes the credential activation URL
to the standard output and prompts
you to type the address into your web
browser’s input box. When contacted
LINUX-MAGAZINE.COM
 IN-DEPTH
Programming Snapshot – Google Drive Search Tool

in this way, the Google server then first
ensures that the Google Drive owner is
logged into their own account. Then it
asks in a dialog if it is OK to grant the
new application appropriate rights.
To do this, Google first posts a warn-
ing (Figure 7) and then an OAuth Con-
sent dialog (Figure 8) that you must
sign off on. This lets the API server
know that you agree to allow an un-
registered and therefore highly suspi-
cious application to read your private
Drive data.
It’s Complicated
If you agree to the process despite the
dire warnings (after all, the app is un-
signed and the developer is not pub-
licly known), the server points the
browser to a predefined URL on local-
host. Alas, nothing is listening there in
this instance, because the local config-
uration is missing. The browser right-
fully reports an error (Figure 9).
But never fear: The URL now dis-
played in the input window contains
the authorization code in the code
parameter. You can simply copy this
code string into the input of the wait-
ing gdls program running in the termi-
nal (Figure 6). The program then con-
tacts the Google server and then re-
ceives the eagerly awaited access token
in exchange for the code. Armed with
this, you can now access the cloud
data, and gdls will start the sync pro-
cess immediately.
To avoid this rigamarole going for-
ward, gdls uses saveToken() (Listing 2,
starting in line 30) to store the access
token along with the refresh token in

Figure 8: Signing the agreement

Figure 7: Google warns about potentially dangerous apps. in the browser.

Listing 2: Token Query

01 package main 20 func getTokenFromWeb(config *oauth2.Config) *oauth2.Token

02 import ( 21 {

03 "context" 22 authURL := config.AuthCodeURL("state-token", oauth2.

04 "encoding/json" AccessTypeOffline)

05 "fmt" 23 fmt.Printf("Launch in browser and copy auth code:

\n%v\n", authURL)
06 "golang.org/x/oauth2"
24 var authCode string
07 "os"
25 fmt.Scan(&authCode)
08 )
26 tok, err := config.Exchange(context.TODO(), authCode)
09 const tokenFile = "token.json"

10 func readToken() (*oauth2.Token, error) { 27 panicOnErr(err)

11 f, err := os.Open(tokenFile) 28 return tok

12 if err != nil { 29 }

13 return nil, err 30 func saveToken(token *oauth2.Token) {

14 } 31 f, err := os.Create(tokenFile)

15 defer f.Close() 32 panicOnErr(err)

16 tok := &oauth2.Token{} 33 defer f.Close()

17 err = json.NewDecoder(f).Decode(tok) 34 err = json.NewEncoder(f).Encode(token)

18 return tok, err 35 panicOnErr(err)

19 } 36 }

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 61

IN-DEPTH
Programming Snapshot – Google Drive Search Tool

would return errors to the calling parts

of the program, instead of dropping ev-
erything and running away in panic().

Preserving the Catch

Figure 9: The browser reports an error because the local configuration
is missing.
the token.json file. This is where read-
Token() in line 10 will load it from
again later. The next time the program
is called, it uses the still valid access
token behind the scenes or submits the
refresh token to get a new access
token. You won’t notice anything, ex-
cept maybe that it occasionally takes a
few seconds longer to access your
Google Drive.
By the way, all the listings in this
month’s column rely on the panicOn-
Err() utility function to handle errors
in order to save space. Fully mature
applications would instead use the log
module for helpful messages and
Armed with the access credentials, the
updater() function in Listing 3 can now
fetch the names of all the files scattered
across your Google Drive by calling
listAllFiles() (starting in line 32).
To do this, the google.ConfigFromJSON()
library function in line 17 first reads the
client ID and client secret from the config-
uration file. Then getClient() starting in
line 24 first tries to find a valid access
token. If that fails, getTokenFromWeb() in
line 27 starts the previously mentioned
token dance with the browser.
The newly created client then uses the
drive/v3 library imported in line 11 to
handle the OAuth-specific communica-
tion. This library, officially released by
Google, makes it surprisingly tricky to

Listing 3: Google Drive Access

01 package main 31 }

02 import ( 32 func listAllFiles(service *drive.Service, gddb GdDb,

03 "context" folderID, parentPath string) {

33 query := fmt.Sprintf("trashed=false and '%s' in

04 "fmt"
parents", folderID)
05 "io/ioutil"
34 pageToken := ""
06 "net/http"
35 for {
07 "path/filepath"
36 r, err := service.Files.List().Q(query).
08 _ "github.com/mattn/go-sqlite3"
Fields("nextPageToken, files(id, name,
09 "golang.org/x/oauth2" mimeType)").PageToken(pageToken).Do()

10 "golang.org/x/oauth2/google" 37 panicOnErr(err)

11 "google.golang.org/api/drive/v3" 38 for _, file := range r.Files {

12 ) 39 fullPath := filepath.Join(parentPath, file.Name)

13 func updater(gddb GdDb) { 40 if file.MimeType == "application/vnd.google-apps.

14 credentialsFile := "creds.json" folder" {

15 data, err := ioutil.ReadFile(credentialsFile) 41 listAllFiles(service, gddb, file.Id, fullPath)

16 panicOnErr(err) 42 } else {

17 config, err := google.ConfigFromJSON 43 fmt.Printf("Adding %s\n", fullPath)

(data, drive.DriveReadonlyScope) 44 gddb.Add(fullPath)

18 panicOnErr(err) 45 }

19 client := getClient(config) 46 }

20 service, err := drive.New(client) 47 pageToken = r.NextPageToken

21 panicOnErr(err) 48 if pageToken == "" {

22 listAllFiles(service, gddb, "root", "") 49 break

23 } 50 }

24 func getClient(config *oauth2.Config) *http.Client { 51 }

25 tok, err := readToken() 52 }

26 if err != nil { 53 func panicOnErr(err error) {

27 tok = getTokenFromWeb(config) 54 if err != nil {

28 saveToken(tok) 55 panic(err)

29 } 56 }

30 return config.Client(context.Background(), tok) 57 }

62 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


scan all files on the Google Drive while
keeping the folder structure in mind.
To do this, the listAllFiles() function
starts at the top folder (with the root ID)
to retrieve all the entries with the query
in line 33. It recognizes any directories
found there thanks to the type check in
line 40 and calls itself recursively in this
case to drill down further into the hierar-
chy. It syncs the names of normal files to
the local SQLite cache with the gddb ob-
ject and its Add() function in line 44.
Thanks to the folder paths looped
through on the call stack by the recur-
sive flow, the absolute file paths on
Google Drive are now available.
Little by Little
However, the Google API does not auto-
matically return all the files in a folder in
response to a search query. It starts pagi-
nating the results by default if there are
more than 100 matches. If there is a
nextPageToken in a server response’s
JSON, it’s the caller’s responsibility to
keep fetching page after page until all re-
sults are in.
Programming Snapshot – Google Drive Search Tool
By the way, the server is somewhat
surprisingly not obligated to return ex-
actly 100 results per answer. This preset
size acts as a maximum value, although
the service can also go lower for effi-
ciency reasons – a fairly common occur-
rence, especially for API servers with
distributed data storage. Clients that
only request a continuation page after
finding 100 results (or that fail to check
for continuation pages) will return in-
complete data without an error message.
This would leave users in the dark for-
ever, so make sure to cover this case in
your applications.
Filed and Archived
The tool then stores the file names and
paths found on Google Drive in the
SQLite .gdls.db file in the user’s home
directory. Listing 4 presents the func-
tions that access the database in an ob-
ject-oriented format. The NewGdDb() con-
structor starting in line 12 opens the
connection to the database and stores
the handle in a structure of type GdDb
(defined starting in line 7). When done,
IN-DEPTH
it returns it to the caller for future func-
tion calls from the package.
When the client calls gddb.Init() later
(starting in line 20), the code uses an
SQL command to delete the files table
(if an old version from previous runs ex-
ists) and create a new one that maps the
full paths of the files in the drive to auto-
matically created unique IDs. Figure 2
shows you the database schema.
The Add() function starting in line 31
adds newly found paths to the table as
rows using the INSERT SQL command,
while Search() starting in line 35
searches the entries using the pre-
defined match algorithms and returns
any matches to the caller. To do this,
the function registers the user-defined
regex() function in the SQLite engine
and sets it to the Go function with the
three match algorithms passed into the
constructor. Of these, one was already
preselected by the main program at
this point.
When searching with SELECT in the
SQL database, the engine then defers
to the user-defined function to
IN-DEPTH
Programming Snapshot – Google Drive Search Tool

evaluate the where clause and filters the
matches accordingly. The for loop
starting in line 56 iterates over the ap-
proved matches and writes them to
standard output.
Wrapping Up
As always, the hat-trick of commands
shown in Figure 10 results in an execut-
able program after the Go compiler has
loaded the libraries referenced in the code
from the network and precompiled them.
If necessary, you can further customize the
search functions. For example, it would be
a good idea to ignore upper and lowercase.
As always with DIY programs, there are
no limits to what you can do. Q Q Q

Info
[1] Google Cloud APIs: https://console.
cloud.google.com/apis
[2] PCRE:
https://en.wikipedia.org/wiki/Perl_
Figure 10: These three build commands create the Go binary. Compatible_Regular_Expressions

Listing 4: Database Access

01 package main 33 return 0, err

02 import ( 34 }

03 "database/sql" 35 func (gddb GdDb) Search(pattern string) {

04 "fmt" 36 sql.Register("sqlite3_FunctionRegistration", &sqlite3.

SQLiteDriver{
05 "github.com/mattn/go-sqlite3"
37 ConnectHook: func(conn *sqlite3.SQLiteConn) error {
06 )
38 if err := conn.RegisterFunc("regex", gddb.RegexFu,
07 type GdDb struct {
true); err != nil {
08 Db *sql.DB
39 return 0, err
09 RegexFu func(re, s string) (bool, error)
40 }
10 TableName string
41 return nil
11 }
42 }})
12 func NewGdDb() GdDb {
43 db, err := sql.Open("sqlite3_FunctionRegistration",
13 db, err := sql.Open("sqlite3", dbPath()) dbPath())
14 panicOnErr(err) 44 panicOnErr(err)
15 return GdDb{Db: db, TableName: "files"} 45 defer db.Close()
16 } 46 query := fmt.Sprintf("SELECT path FROM %s", gddb.
17 func (gddb GdDb) Close() { TableName)

18 gddb.Db.Close() 47 var rows *sql.Rows

19 } 48 if pattern == "" {

20 func (gddb GdDb) Init() { 49 rows, err = db.Query(query)

21 sql := `DROP TABLE If EXISTS ` + gddb.TableName 50 } else {

22 _, err := gddb.Db.Exec(sql) 51 query += fmt.Sprintf(" WHERE regex(?, path)")

23 panicOnErr(err) 52 rows, err = db.Query(query, pattern)

24 sql = `CREATE TABLE ` + gddb.TableName + ` ( 53 }

25 id INTEGER PRIMARY KEY AUTOINCREMENT, 54 panicOnErr(err)

26 path TEXT 55 defer rows.Close()

27 );` 56 for rows.Next() {

28 _, err = gddb.Db.Exec(sql) 57 var name string

29 panicOnErr(err) 58 panicOnErr(rows.Scan(&name))

30 } 59 fmt.Printf("%s\n", name)

31 func (gddb GdDb) Add(path string) error { 60 }

32 _, err := gddb.Db.Exec("INSERT INTO "+gddb.TableName+" 61 panicOnErr(rows.Err())

(path) VALUES (?)", path) 62 }

QQQ

64 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

MAKERSPACE Sensor Shootout

MakerSpace
Temperature and humidity
sensor comparison

Remeasured
Any application that collects a large number of measurements
is bound to have some anomalous measurements, but good
sensor breakouts should not output such values all the time.
We tested eight temperature and humidity sensors for
accuracy. By Bernhard Bablok

T
he data sheets of common
temperature and humidity
sensors tend to brag about
accuracies in the range of a
tenth of a degree. A closer look at 21
cases with eight different sensors
shows which claims are true and which
are just hot air from marketing.
It isn’t complicated to wire up a sensor
and read the values cyclically. If you’ve
ever done so, you’ve probably had the
feeling at some point that the numbers
didn’t add up. Deploying a second de-
vice only adds to the confusion, with
deviations of up two units, which
quickly gives rise to suspicions that your
sensor lacks quality or was just too
cheap, leaving you to wonder whether
mysteriously high measured values are
the result of a poor product or if the data
sheets are incorrect.
I looked into both lines of thought and
try to offer some recommendations. Up
to four examples of eight common sen-
sor devices lined up to face the test (Fig-
ure 1). Most devices are from BerryBase
or Pimoroni and some of them have
been around for quite a while. Table 1 Lead Image © Jian Fan, 123RF.com

Figure 1: Some of the test candidates have been in my tinkering collection for quite some time.

66 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 Sensor Shootout MAKERSPACE

Table 1: Test Candidates

Sensor I2C Address Temperature (°C)a Humidity (%rH)a Pressure (hPa) Price Number
BMP280 0x76/0x77 (-40) 0-65 (850)±1 – 300-1,100±1 EUR1.60 ($2) 4
BME280 0x76/0x77 (-40) 0-65 (85)±1 0-100±3 300-1,100±1 EUR5.60 ($4) 4
AHT20 0x38 (-40) 0-60 (85)±0.3 (0) 10-80 (100)±2 – EUR5.25 ($5) 4
MCP9808 0x18-0x20 -40 to 125±0.25) – – EUR5.90 ($5) 3
AM2320 0xB8 -40 to 80±0.5 0-99.9±3 – EUR4.18 ($4) 2
HTU31D 0x40 (-40) 0-100 (125)±0.2 (0) 20-100±2 – EUR7.10 ($4) 2
SHT45 0x44 (-40) 0-60 (120)±0.1 0-100/±1 – EUR14.90 ($13) 1
DS18B20 – (-55) -10 to 85 (155)±0.5 – – EUR2.40 ($10) 3
aThe values in parenthesis are the full measurement range. The internal range is the accuracy and precision guaranteed by the manufacturer.

shows an overview of the features, tech- of all specimens fall within the “typical” three-sigma limit is exemplary. On the
nical values, and prices. or “maximum” curve. other hand, the DS18B20 curve lacks tol-
In addition to temperature, many of the Figure 3 for the DS18B20, on the other erance values for borderline cases.
sensors measure humidity, and the Bosch hand, uses three-sigma values, and Additionally, numerous factors influ-
sensors can also measure air pressure. 99.73% of the sensors are within these ence accuracy, such as the type of quality
The BMP280 costs very little, which sug- limits [1]. Many vendors use the two- control, dependence on the supply volt-
gests that it is maybe a cheap clone. One sigma limit (95.45%), which makes the age, age of the sensors, structure of the
exotic candidate on the list is the sensor look better, so adopting a board (including additional components),
DS18B20: It does not have an I2C inter-
face and does not come as a breakout,
but as an integrated circuit (IC) in the
TO-92 format used in semiconductor
packages, mainly for transistors. The con-
nection uses a single-wire protocol.
In the lab, I tried to obtain as many ex-
amples of each product as possible, but
this effort was tricky because of cost and
time constraints. That said, I always sent
at least two examples into the fray, with
the exception of the most expensive sen-
sor, the SHT45. Additionally, the prod-
ucts do not cover all the application sce-
narios. If you want to build your own
soldering oven, for example, you need a
sensor with a completely different tem-
perature range. At the bottom of the tem-
perature scale, the selection’s range ends Figure 2: The accuracy curve of the HTU31D does not reveal the per-
at -40°C at the latest. centage of all specimens that lie within the curves. © TE Connectivity
Ltd. (data sheet HTU31D)
Accuracy and Precision
The terms “accuracy” and “precision”
appear in the data sheets – but not with-
out a risk of confusion. Accuracy refers
to the typical deviation from the true
value. Precision is the amount by which
repeat measurements of the same value
vary. The values in the data sheets are
difficult to compare because they typi-
cally use two expressions to define the
“typical” and “maximum” accuracy.
The providers often give you addi-
tional graphics, but without additional
information, these curves are incomplete
and leave room for interpretation. Nei-
ther Figure 2 nor the HTU31D data sheet Figure 3: The accuracy curve of the DS18B20 includes three-sigma values,
provide information on what percentage which makes it more accurate. © Maxim Integrated Products (data sheet DS18B20)

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 67

MAKERSPACE Sensor Shootout
and soldering process. Sometimes you
will find crucial information in footnotes.
Bosch notes, for example, that the tem-
perature readings of its sensors typically
lie above the ambient temperature.
After studying numerous data sheets,
you begin to realize that you need to
treat the accuracy values as a guide
rather than hard facts.
Measuring Setup
Theory aside, the sensors had to prove
their value in various measurements. As-
sessing the absolute accuracy would
have required a high-precision thermom-
eter or a measuring chamber with pre-
cisely adjustable temperature and hu-
midity. With neither available, my test is
by no means a scientific investigation.
You have to evaluate the measured val-
ues compared with the average of all
sensors. The theory behind this process
is known as “crowdsensing,” which ba-
sically means that the average of many
Figure 4: The example of the overall view of the AHT20 reveals that the individual sensors are difficult to
distinguish.
Figure 5: The section for the AHT20 sensors reveals variations of 0.5°C.
68 FEBRUARY 2024 ISSUE 279
independent measurements is more ac-
curate than any single measurement.
I distributed the 21 sensors in the test
across four I2C buses and one, one-wire
bus. Two Pi Picos with their two I2C
buses each acted as data collectors. Con-
trolled by a real-time clock (RTC), data
acquisition took place almost simultane-
ously. The data ended up on microSD
cards and were later merged. A data log-
ger [2] provided the necessary tools.
However, I had to create the readout rou-
tines for some sensors, which was
quickly done thanks to online examples.
Pandas [3] was used for the computa-
tions and Matplotlib [4] for the display.
The measurements took place indoors,
away from heat sources or drafts. Addi-
tionally, I put the sensors in the refriger-
ator and in the oven. These phases can
be clearly identified in the evaluation. As
a side note: The oven was set to its low-
est temperature of 50°C (122°F). How-
ever, as the graphs show, the oven
thermostat turned off the heat too late,
which caused some damage to the sen-
sor brackets.
Results
The data and comparison graphs with
the results could fill many pages. This
article is therefore limited to a few inter-
esting insights. The details can be found
in the associated GitHub project [5].
In two words, the results can be de-
scribed as “positively boring,” which
means the sensors in the measurement
range of the test fulfill the promises
made by their data sheets. If you look
at the entire measurement period, it is
difficult to identify the individual test
specimens (Figure 4, AHT20). Zooming
in makes individual gradients recog-
nizable. Figure 5 shows that the mea-
surement results of the four AHT20
sensors are within 0.5°C (0.9°F). The
data sheet promises ~0.3°C (0.5°F),
so that is OK.
LINUX-MAGAZINE.COM

A comparison of the mean values for
all sensors proves to be interesting. In
Figure 6, you can see that the AHT20
test specimens tended to underestimate
the temperature. It would be unreliable
to draw a general conclusion from these
results because only four sensors were in
the test.
When looking at the deviation from
the mean, the most expensive sensor
(SHT45) performed best, but the inex-
pensive DS18B20 also achieved similar
precision values. Differences in humidity
were somewhat greater, but even the
poorest performers were no more than
six percentage points off the average.
Only the Bosch sensors measure the air
pressure, and they do it very well, typi-
cally deviating from the official air pres-
sure by only 1-2 hectopascals (hPa).
Recommendations and
Conclusions
Your choice of sensor must be based on
the measuring range and the required
accuracy. The price is less important for
home use. Going for an expensive model
probably has less effect on the measure-
ment results than the way you operate
the sensor. If you want a second opinion,
deploying a few of the affordable
DS18B20 models is a good idea.
Be sure to isolate sensors from sources
of interference. A sensor on a Pi HAT
will always return incorrect data. Even a
sensor connected to the Raspberry Pi by
Figure 6: Compared with the average of the other test candidates, the AHT20 models tend to return too low
a temperature value.
LINUX-MAGAZINE.COM
Sensor Shootout MAKERSPACE
cable will be exposed to too much waste
heat in the long run. The single-board
computer is not a good basis for mea-
surements, even if many suppliers offer
complete solutions for this purpose.
Ideally, you would want the measur-
ing computer to switch off between
measuring intervals. If this is not an op-
tion, it is best at least to switch the sen-
sor to sleep mode because many sen-
sors lose accuracy if they are forced to
run constantly in measurement mode.
A closer look at the data sheets will
help you in this regard. If in doubt,
check the driver, because it sometimes
sets a few well-meant settings during
initialization that are less than perfect
for the intended use case. Info
Operated correctly, all of the sensors [1] Normal distribution:
tested are good for measuring tempera- https://en.wikipedia.org/wiki/Normal_
ture, humidity, and air pressure. The distribution
SHT45 is the measurement king of the [2] Data loggers: https://github.com/
hill, with the BME280 winning the prize bablokb/pcb-pico-datalogger
for the best all-rounder (with some sacri-
[3] Pandas: https://pandas.pydata.org
fices in terms of accuracy). The DS18B20
offers the best price-performance ratio. If [4] Matplotlib: https://matplotlib.org
you use the BMx280, it is essential that [5] Test results:
you check the initialization in the driver. https://github.com/bablokb/sensor-test
Arduino sets a good example with a
number of selectable presets that follow Author
the recommendations of the data sheet. Bernhard Bablok retired from Allianz
More informative results will be pro- Technology SE as an SAP HR developer.
vided by a second measurement cam- When he is not listening to music, riding
paign planned for the winter with its far his bike, or walking, he focuses on Linux,
lower temperatures. You will find the re- programming, and small computers. You
sults in the GitHub project [5]. Q Q Q can reach him at mail@bablokb.de.
QQQ
ISSUE 279 FEBRUARY 2024 69
MAKERSPACE Pi Flight Simulator

MakerSpace
Flight simulation on the
Raspberry Pi

<ISMWЄ
A Raspberry Pi 4B with Linux can solve the equations for a
real-time nonlinear aircraft simulation, including the
emulation of modern aircraft flight displays. By Dave Allerton

F
light simulators range from
games to airline operations,
and generally, you cannot (or
you are not permitted to)
modify the software. Often, the code is
proprietary and not accessible, or the
acquisition of data used in the simula-
tor is very costly, and the developers of
these simulators are understandably
protective of their software. However,
for a class of simulator known as an
engineering flight simulator (EFS) –
used by aircraft manufacturers, avion-
ics companies, research organizations,
and universities to develop and evalu-
ate aircraft designs and aircraft sys-
tems – it is essential to have access to
the source code to modify the simula-
tor for a range of studies.
Table 1: Module Functions
Computer Function
I/O system Data acquisition of analog and digital inputs from the flight controls
and USB inputs
Flight model Aerodynamic model, undercarriage model, equations of motion,
Flight simulators have two important
characteristics. First, the accuracy of the
simulation (known as fidelity) should
ensure that the performance and dy-
namics of the simulator closely matches
the aircraft it simulates. For many flight
simulator games, the models are simpli-
fied, reducing the fidelity to a level un-
acceptable in engineering applications.
Second, the software must respond in
real time to inputs and solve all the un-
derlying equations at a sufficient rate
(known as the frame rate), so that the
perceived motion is smooth and contin-
uous, without any noticeable lag. If the
computations in simulation software are
complex, the frame rate may not be sus-
tained, and delays (latency), which fur-
ther reduce fidelity, are apparent. To
ameliorate this situation, a high-perfor-
mance computer with a state-of-the-art
graphics card may be needed to achieve
the required frame rate.
Having developed real-time software
for flight simulators at the universities
Lead Image © Oleksiy Tsupe, 123RF.com

flight control laws, primary flight display, and engine-indicating and of Southampton, Cranfield, and Shef-
crew-alerting system display field; Queen Mary University (Lon-
Engine model Engine dynamics and sound generation don); and the University of Newcastle
Navigation and Navigation equations, avionics, flight control unit, radio manage- (Australia), I evaluated the capabilities
avionics ment panel, and navigation flight display of the Raspberry Pi (RPi) computer
Instructor station Session control and monitoring, user interface and display, charts, with Linux to provide an acceptable
and flight data recording EFS. Details of the software for this EFS
Image generator Image generation of the external view by OpenSceneGraph (3 channels) are described in a recent textbook [1].
Matlab An optional interface that connects Matlab to the simulator The software referred to in this article

70 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


Figure 1: Flight simulator organization.
is open source and can be downloaded
from the Wiley Student Companion
Site [2]. The existing simulator soft-
ware, which was developed for PCs
and mostly written in C, ran under
Linux and, for compatibility with
Linux, also ran under the MSYS2 pro-
gramming environment on Windows.
The software for the aircraft displays
was originally written in legacy
OpenGL but has been rewritten for
OpenGL v4 for the RPi to exploit the
power of the Broadcom graphics pro-
cessing unit (GPU), increasing the ren-
dering rate of the graphics for the dis-
plays by a factor of more than 10. The
performance of the RPi has enabled the
PCs to be replaced with off-the-shelf
RPi computers.
A Distributed Architecture
By computing a simulation on n com-
puters, the potential increase in perfor-
mance is a factor of n compared with a
single computer. However, this simplifi- OpenGL has been used in 2D and 3D
cation is based on two assumptions:
First, the problem can be partitioned to the 1990s. However, since version 3,
run efficiently on n computers; second,
any overhead from managing communi-
cations between the computers is negli-
gible. The architecture of most flight
simulators is particularly suited to a
configuration of
parallel pro-
cesses. Figure 1
shows a typical
organization of
simulator mod-
ules, where the
functions of the
computers are
summarized in Figure 2: The second column shows the timing of UDP broadcast transfers (in seconds) of
Table 1. five RPi computers during one frame.
LINUX-MAGAZINE.COM
Pi Flight Simulator
Data is broadcast by modules at the
start of every frame as Ethernet packets
using a token-passing protocol based on
the User Datagram Protocol (UDP). A
computer only broadcasts a packet
when it holds the token and otherwise
listens for incoming UDP packets. In
fact, the token is simply the arrival of a
broadcast packet from the preceding
node in the chain of transfers. Typically,
these transfers occupy less than 2ms of
the 20ms frame (Figure 2).
The advantage of using broadcast
UDPs is that the simulator data is trans-
mitted in five packet transfers (2,388
bytes/frame). Additionally, Ethernet pro-
vides a 32-bit checksum to ensure data
integrity. Although a UDP packet trans-
fer has no acknowledgement, with a
dedicated network and a relatively low
level of traffic, the data error rate is
negligible.
OpenGL and GPUs
computer graphics applications since
OpenGL was repurposed to exploit the
power of the GPUs found on modern
graphics cards. In particular, GPUs pro-
vide fast rendering of textured triangles.
In addition to the software for rendering
ISSUE 279
MAKERSPACE
dots, lines, and triangles, shader pro-
grams must also be provided to define
how objects are rendered (the vertex
shader) and how the pixels are written
to a frame store (the fragment shader).
To reduce the amount of detail in terms
of GPU programming, a library glib was
developed specifically to emulate air-
craft displays that includes functions for
the rendering of vectors (lines) and tri-
angles and for applying textures to tri-
angles. Although OpenGL does not di-
rectly support the rendering of text,
standard fonts can be organized as tex-
tures, known as a texture atlas, reduc-
ing text generation to the rendering of
sub-textures of a texture atlas.
Whereas objects rendered one-by-one
in legacy OpenGL considerably slowed
the interface between the host proces-
sor and the graphics card, with OpenGL
v4, objects can be written to a cache in
the host computer and transferred to
the GPU as a single block when the
cache needs to be flushed. For aircraft
displays, this organization of caching
graphics reduces the computations in
the host to a minimum, enabling the
parallel processing of the GPUs to maxi-
mize the rendering speed. From a pro-
grammer’s perspective, glib provides a
small set of primitives to draw lines and
FEBRUARY 2024 71
MAKERSPACE Pi Flight Simulator

triangles, load and render textures, load

fonts and render text, and apply graph-
ics transformations, including transla-
tion, rotation, scaling, and clipping of
graphics objects, but without any ex-
plicit calls to OpenGL.

Flight Simulator Displays

Figure 3: Boeing 747-400 flight displays.
Figure 4: Light aircraft flight displays.
Figure 5: IOS displays. (a) Pop-up menus are implemented by OpenGL and (b)
drop-down menus by the GTK widget toolkit.
Figure 3 shows the primary flight display
(PFD) and the navigation flight display
(NFD) produced by a Raspberry Pi 4B
(RPi4B) for a Boeing 747-400. The PFD
uses vectors for the sliding scales and
text rendering for the digits. The rotating
digits in the airspeed and altitude win-
dows are implemented by clipping the
characters to the small windows. The
gray segments of the engine displays are
produced offline as SVG textures and
then rotated and clipped. Note the clear
lines of the engine displays, which are
also produced from SVG textures rather
than vectors.
The NFD also contains vectors and
text for the navigation display. The flight
control unit (FCU) panel, which provides
mouse or touchscreen interaction, is ren-
dered as a texture, with character gener-
ation applied to the three small panels.
The rendering of each display takes less
than 3ms of the 20ms frame.
Similar methods are used to emulate
the more classic displays found in light
aircraft (Figure 4). The instrument be-
zels, static scales, and pointers are ren-
dered as textures. The compass card is
also a single texture, which is rotated in
a single operation, rather than rotating
all the characters and vec-
tors of the card. The artifi-
cial horizon is rendered as
a 3D sphere, which is illu-
minated to emphasize the
curvature of the sphere,
and the magnetic compass
in the top right corner of
the display is handled
similarly.
In airline flight simula-
tors, military simulators,
and an EFS, the instructor
plays an important role,
setting conditions, initiat-
ing events such as an en-
gine failure, and monitor-
ing the activity of the flight
crew. In an EFS, a further
requirement is to acquire,
display, and record flight

72 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


data produced during testing. From the
graphics perspective, these requirements
imply a user interface to control and
monitor simulator sessions and the dis-
play of charts and flight data. The graph-
ics library glib, developed for aircraft dis-
plays, is also used for the instructor oper-
ating station (IOS; Figure 5).
In both displays, the lines for charts
and plotting are rendered as vectors, and
the navigation symbols are rendered
from a texture atlas by glib functions.
The IOS also captures data from the
other simulator computers for the plot-
ting and recording of flight data. In this
case, raw 1KB blocks of data are written
to memory every frame (3MB/min) and
subsequently copied to disk. The attrac-
tion of this method is that the frame rate
is unaffected, the data can also be
viewed off-line by a similar set of plot-
ting tools, and the packets can be re-
trieved from a disk file, providing inputs
to the simulator software to replay any
test or exercise.
LINUX-MAGAZINE.COM
Pi Flight Simulator
Octave and Matlab
During development of an EFS, particu-
larly for flight control laws, sometimes
it is more convenient to develop algo-
rithms with tools like Matlab or Octave,
rather than coding directly in C. Be-
cause both Matlab and Octave are inter-
preted languages, care is needed to en-
sure that any latency introduced by
these packages does not affect the simu-
lator frame rate. Although the develop-
ment of detailed real-time nonlinear
flight models in Matlab may be imprac-
ticable, small modules, such as auto-
matic flight control laws can be devel-
oped and tested in Matlab, where a
Matlab module acquires inputs from the
simulator and generates outputs for the
simulator flight controls.
A wrapper was developed with Matlab
mex functions so Matlab could read flight
data from broadcast packets and transmit
a packet to the simulator. The network
protocol was adapted to enable Matlab to
connect to, and disconnect from, the net-
work without affecting the
integrity or speed of the
network protocol. The
template in Listing 1 al-
lows a controller written in
Matlab to be integrated
with the simulator.
Flight Simulator
on a Single RPi
Having developed real-
time simulator software
running on five RPi com-
puters with three displays,
Figure 6: RPi4B computation times (standalone version).
ISSUE 279
MAKERSPACE
a further development was to combine
this software for a single RPi with a sin-
gle monitor (1920x1080 resolution),
where the PFD is rendered on the left-
hand side of the display and either the
NFD or the IOS is rendered on the right-
hand side, as selected by the user. To
maximize reuse of the simulator soft-
ware, packet passing was emulated by
copying the relevant regions of memory
associated with each module. Although
the parallelism could be retained by
treating the modules as POSIX threads, it
is simpler to execute the simulator code
sequentially, cycling through the mod-
ules. The main concern with this ap-
proach is that the RPi is further loaded
with computations of the simulation,
particularly the additional graphics ren-
dering, compared with the multiple-pro-
cessor version.
Figure 6 shows the overall frame time
for the single RPi version for 1,000 frames
(20s) of simulation, where the display
changes several times in response to in-
structor actions. The lower trace shows
the graphics rendering time and occupies
less than 6ms/frame. The upper trace
shows the overall computing time and oc-
cupies less than 10ms/frame, leaving a
margin of approximately 10ms. The large
excursions occurred when the simulator
files were loaded at the start of the simu-
lation and when the aircraft position was
reset after 140 frames.
Offline Simulation
Development of prototype software can
take up a considerable amount of
FEBRUARY 2024 73
MAKERSPACE Pi Flight Simulator

Figure 7: An offline simulator: (a) The inputs are the pilot inputs to the flight controls, and the outputs are the
flight displays and the visual system imagery; (b) the inputs are specified in a script file, and the outputs are
files containing data and plotting information.

Listing 2: Simulator Script variables to be plotted, and the details wake vortex, derived from detailed vor-
set altitude 3000 ft
of the plots. The autotrim command tex data. Figure 9(a) shows the wake
set TAS 200 kts
sets the aircraft in the trimmed state at vortices shed by an aircraft, which were
set flaps 0.0
the start of the exercise. The plots implemented as billboards in the visual
set gear 0.0
show the response of the aircraft to an scene. Figure 9(b) shows the air flows
elevator pulse input of -10° for 2s, ap- and aircraft loading during a wake
plot pitch degs -5 20
plied after 2s. In
plot pitch_rate deg/s -10 10
addition to the
plot altitude ft 2500 3500
output data, a
plot elevator degs -20 20
further script is
time 120 secs
generated for
input elevator pulse 22 -10
gnuplot, so plots
autotrim
can be produced
as PNG files.
simulator time. In this situation, access
to an off-line desktop simulator, with Visualization
software that is identical to the flight Although an
simulator, can provide a valuable de- image generator
sign asset. Consider the two configura- (IG) is normally
tions shown in Figure 7. Two significant used to render the
points can be drawn from this example. external view seen
First, the main modules are identical from the flight
and can be interchanged between the deck, for an EFS,
flight simulator and the offline simula- the IG can also be
tor, and vice versa, without modifica- used to visualize
tion. Second, there are no real-time data in real time.
deadlines with an offline simulator, For example, in a
which can run faster than real time study of wake vor-
(e.g., simulating several hours of flight tex encounters, a
in a few minutes, typically as part of dedicated com-
automated testing). puter was con-
A typical output plot is shown in nected to the
Figure 8. Listing 2 is the script file to flight simulator
run the simulation, which defines the network to com-
initial conditions of the aircraft, the pute the flows of a Figure 8: Output for conditions defined in Listing 2.

74 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


vortex encounter. This visualization il-
lustrates the direction and magnitude of
the air flows given by the white vectors;
the loading on the wings and tail result-
ing from the encounter, which is color-
coded; and the extremities of the vortex
field shown as a red wireframe volume.
Figure 10(a) is generated by Open-
SceneGraph on an RPi with an Open-
Flight visual database of Bristol Lulsgate
airport and achieves a frame rate of 69
frames/s (fps) for a display resolution of
1280x1024. Figure 10(b) shows a similar
scene, which includes a head-up display
(HUD) rendered in OpenGL as a 2D
overlay on the visual scene.
Conclusions
The RPi4B with Linux is clearly capable
of solving the equations for a real-time
highly nonlinear simulation of a four-en-
gine wide-body transport aircraft at 50fps,
including the emulation of modern
Figure 9: Wake vortex encounter.
Figure 10: Raspberry Pi OpenSceneGraph images.
LINUX-MAGAZINE.COM
Pi Flight Simulator
electronic flight instrument system (EFIS)
displays. By providing the complete
source code, the simulator modules and
aircraft displays can be modified for a
range of applications. With the addition
of the acquisition, display, and recording
of flight data during simulations, an EFS
running on a single RPi can provide a
particularly valuable test bed for the de-
sign and analysis of aircraft and aircraft
systems. In a university, the EFS provides
both a powerful facility for student proj-
ects and a totally programmable simula-
tion environment for research in aircraft
design and system validation. Q Q Q
Info
[1] Allerton, D J. Flight Simulation Soft-
ware: Design, Development and
Testing. Wiley, 2022
[2] Flight simulation software:
https://www.wiley.com/go/flightsim-
ulationsoftware
ISSUE 279
MAKERSPACE
Author
Dave Allerton
obtained a PhD from
the University of
Cambridge in 1977
and worked in the
defense industry
before spending 10
years at the University
of Southampton as a
lecturer in computing. He was the
Professor of Avionics at Cranfield
University before moving to the University
of Sheffield as Professor of Computer
Systems Engineering, where he is
currently an Emeritus Professor. He is also
a Visiting Professor at Cranfield University
and at Queen Mary University of London.
His research activities include flight
simulation, computer graphics, and real-
time computing. He is author of two
textbooks, Principles of Flight Simulation
(Wiley, 2009, ISBN 978-0-470-75436-8) and
Flight Simulation Software: Design,
Development and Testing (Wiley, 2022,
ISBN 978-1-11973-767-4).
FEBRUARY 2024 75
 INTRODUCTION LINUX VOICE

The command line has a stark and austere beauty all its
own, but many of us need a little more color and cheer. If
you want the simplicity of the terminal without the taxing
two-tone boredom, why not jazz it up a little with Oh My
Posh? The Oh My Posh prompt theme engine lets you
define a visual theme for your command-line environment,
which perks up the view and also makes the details easier Doghouse – Choosing an OS 79
Jon “maddog” Hall
to read and understand. Also in this month’s Linux Voice, A few considerations can help you choose
we dive down into System Monitoring Center and spell out the right OS.
some best practices for working Oh My Posh 80
with the SSH. Thorsten Scherf
Adapt the terminal’s appearance and
feature set with the Oh My Posh prompt
theme engine.
System Monitoring Center 82
Erik Bärwaldt
The System Monitoring Center combines
all the important information you need to
monitor a computer in a single state-of-the-
Image © Olexandr Moroz, 123RF.com

art interface.
FOSSPicks 86
Graham Morrison
This month Graham looks at Cardinal,
Celestia 1.7.0, Friture, Wavetable, Helix
Editor, Brogue CE, and more!
Tutorial – SSH Keys 92
Marcin Gastol
Verifying the security of your SSH
EQPƒIWTCVKQPCPFRGTHQTOKPITGIWNCT
audits are critical practices in maintaining
a secure Linux environment.

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 77


MADDOG’S
DOGHOUSE
A few considerations can help you choose the right OS.
BY JON “MADDOG” HALL
Which OS do you use?
t is inevitable that at every conference, every talk, I get
I asked the same question: “What distribution of GNU/Linux
do you use?”
I always answer back that I refuse to answer that question.
The question was asked again less than a week ago, during a
talk on GNU/Linux to a class of undergraduate college students.
First of all, typically they are not really asking that specific
question. They are really asking the question “What distribution
should I use?” And the reason I do not answer is that I do not
know enough about them to give them a good answer.
I have been a consultant since I left Compaq (having come
to the company when it acquired Digital Equipment Corpora-
tion) in 1999. I use the distribution that my customer uses,
so I can duplicate the issues that they are having with their
systems.
The things I need and look for in a distribution would probably
be different than the things the beginning person might desire.
For example, I typically work on different architectures, not
just Intel/AMD. Therefore a distribution that supports multiple
architectures is attractive to me.
I do a fair amount of video capture and editing work, probably
more than the typical office worker whose main needs can be
met with a good office package and a web browser.
However, I do give the questioner hints.
First of all, think about your particular situation and what you
want and need from your software. Are your needs simple or do
you need specialized applications that may be supported better
by some specialized distribution?
In certain situations I also recommend an investigation of
your surroundings. For example, if you are a student, your
school may have a computer club where some (or all) of the
members use GNU/Linux and may all be using the same distri-
bution of GNU/Linux. Choosing the distribution they use may
get you a lot of help if you need it.
Also, there may be local Linux User Groups (LUGs) in your
area that have meetings or mailing lists where you may get ad-
vice or help with your distribution. As an example, I recently had
a reason to see if there was a local user group in a particular
area. I typed into my browser’s search bar “Linux user group in
<name of the city>” and up popped a web page telling about the
user group and when and where they were going to have their
LINUX-MAGAZINE.COM
DOGHOUSE – CHOOSING AN OS LINUX VOICE
Jon “maddog” Hall is an author,
educator, computer scientist,
and free software pioneer
who has been a passionate
advocate for Linux since 1994
when he first met Linus Torvalds
and facilitated the port of
Linux to a 64-bit system. He
serves as president of Linux
International®.
next meeting. There is no guarantee that you will be so lucky,
but in my estimation it is worth the effort.
After this you can search the Internet for articles with queries
like “Linux distributions for beginners.” This might return 9 or 10
articles comparing different distributions and their advantages
and disadvantages. Take the time to read them and take notes
on each distribution they mention. Make sure the distributions
they mention work well on your hardware with regards to the
architecture type (Intel/AMD, ARM, etc.), 32- or 64-bit, main
memory size, etc. If the computer you will be using for GNU/
Linux has a small main memory, you may wish to look for
distributions that are considered “lightweight.”
You can also look for a distribution that allows you to run it as
a “live distribution,” either off a CD or DVD or a USB thumb drive,
so you can test it on your hardware without disturbing your cur-
rent operating system.
Now that you have a short list of the distributions you might
use, go to the distributions’ websites and see what documenta-
tion they might have for beginners. Many of the distributions
considered to be oriented toward beginners usually have a doc-
ument that suggests how you can get started with that distribu-
tion. You may also find books (either online, electronic, or hard
copy) offered for beginners that will help you learn about GNU/
Linux using that distribution. Make sure the articles you are
reading are fairly recent.
Next you can go to DistroWatch.com (https://distrowatch.com/)
and see an index of many distributions. Here you can find a dis-
tribution, click on the name, and read something about it. You
should pay attention to how active and popular the distribution
is. Make sure that the distribution you are looking at is still being
downloaded, used, and developed.
The next step is just to pick one, follow the instructions for
downloading the distribution, and make a live distribution from
it using the software that runs on your current system.
Boot that live distribution, checking to make sure it works with
all of your hardware and services. You can easily try another
distribution later if this does not do what you want.
Once you are sure, you can take the next step of installing it as a
dual-boot (maintaining your current operating system) or replacing
your current operating system (after backing up your data).
Carpe diem! Q Q Q
ISSUE 279 FEBRUARY 2024 79
LINUX VOICE OH MY POSH
Prettify the Terminal with Oh My Posh
Beautiful Colors
Adapt the terminal’s available feature set and appearance with the Oh My Posh
prompt theme engine. BY THORSTEN SCHERF
o matter which shell you use in a termi-
N nal, the prompt probably looks very dull in
the vast majority of cases and only pro-
vides basic information – typically just telling you
the current working directory. Fortunately, the vast
majority of shells offer users a function for cus-
tomizing the prompt. Prompt engines such as
Powerline or Oh My Zsh take advantage of this. As
a rule, they use various themes that give the envi-
ronment a more appealing look.
These engines can also display useful informa-
tion in the input line. The is then typically broken
down into different segments, which gives you the
opportunity to populate these segments with the
kind of information you actually need. In the sim-
plest case, you might display the date or time in
one segment. More complex configurations let
you embed almost any kind of data. For example,
in Git directories, you could use a segment to dis-
play the kind of information that you need for Git,
such as the status of the current repository.
Theme Engines and Nerd Fonts
Powerline [1] provides a very powerful engine and
not only for customizing the shell prompt. Instead,
Listing 1: Install Oh My Posh and Themes
01 sudo wget https://github.com/JanDeDobbeleer/oh-my-posh/releases/
latest/download/posh-linux-amd64 -O /usr/local/bin/oh-my-posh
02
03 sudo chmod +x /usr/local/bin/oh-my-posh
04
05 mkdir ~/.poshthemes
06
07 wget https://github.com/JanDeDobbeleer/oh-my-posh/releases/ latest/
download/themes.zip -O ~/.poshthemes/themes.zip
08
09 unzip ~/.poshthemes/themes.zip -d
10 ; ~/.poshthemes
11
12 chmod u+rw ~/.poshthemes/*.omp.*
13
14 rm ~/.poshthemes/themes.zip
80 FEBRUARY 2024 ISSUE 279
the software can customize a variety of different
status lines, also in the Vim editor. Oh My Zsh [2]
is a popular configuration tool for the Zsh. Similar
to Oh My Zsh, Oh My Posh [3] lets you customize
the shell prompt. Unlike Oh My Zsh, however, it
doesn’t matter which shell you actually use in
your environment.
Like with most other prompt engines, it makes
sense to use Nerd Fonts [4] in combination with
Oh My Posh. Nerd Fonts extends the regular char-
acter set to include a variety of icons that you can
then use within each shell segment. Oh My Posh
recommends the use of Meslo LGM [5], but you
can use any other font as long as it comes with a
good supply of icons. You can install the desired
font manually or via Oh My Posh – but more about
that later.
Cross-Platform Support
Oh My Posh is a cross-platform tool; you can use
it on Linux, macOS, and in PowerShell on Win-
dows. On macOS, simply install the engine using
the Homebrew package manager:
brew install jandedobbeleer/oh-my-posh/oh-my-posh
The call installs both the Oh My Posh tool and the
available themes (Figure 1). On Linux, first down-
load the software and then an archive with all the
themes, which you then unpack (Listing 1).
Activating the Shell Prompt
Now, to enable Oh My Posh in the shell you are
using, initialize the prompt engine in the shell’s
configuration file. For example, if you use Bash,
add the following line to the ~/.bashrc file:
eval "$(oh-my-posh init bash)"
To activate the changes, either start a new shell or
reload the modified configuration file with the
source ~/.bashrc command. The procedure is
similar if you use Zsh. Of course, in this case you
need to pass in Zsh as the init argument. A
LINUX-MAGAZINE.COM

Figure 1: Even with the default theme, Oh My Posh already gives you an appealing prompt.
complete overview showing you the configura-
tions of all the shells supported by Oh My Posh is
available in the documentation [6].
You can also call up the Oh My Posh tool inter-
actively to define a whole bunch of configuration
settings. For example, if you want to install a Nerd
Font on your system, simply run:
oh-my-posh font install
In the drop-down menu, select the font you
want to download. However, you will need to han-
dle the configuration manually in the terminal you
are using later.
Selecting and Customizing Themes
To customize the prompt’s look, select a different
theme as the first step. If you saved the design
templates in the ~/ .poshthemes/ directory, select
the theme you want in the configuration file of the
shell you are using when initializing the prompt
engine:
eval "$(oh-my-posh init bash U users a comprehensive prompt engine for a va-
--config ~/blue-owl.omp.json)"
After parsing the changes, the new theme is en-
abled. The design configuration is based on
blocks where you define one or more segments.
In the segments, you then need to provide the de-
sired information. JSON is used for this by default.
However, you can also choose to write the defini-
tion of the themes in YAML or TOML.
To customize a theme, you can create a copy of
the associated file and make the desired modifi-
cations to the copy. Alternatively, you also have
the option to call the Oh My Posh tool with the
config export option to create a copy of the cur-
rent theme:
# oh-my-posh config export U
--output ~/.my-theme.omp.json
In the copy, you can then modify the existing
blocks and segments or add new ones. Each
block contains one or more segments. In the
block configuration, you can then define, say,
LINUX-MAGAZINE.COM
OH MY POSH LINUX VOICE
whether you want the segments to appear on
the left or right in the terminal or if you want to
distribute them across a single line or multiple
lines. You then determine the segment proper-
ties in the segments. In the simplest case, this
is the color in which you want to display the
segment.
The segments can be of different types; this
means that you can define the logic to be used
within a segment. For example, the Git type lets
you display status information about a Git reposi-
tory in a segment. You then use templates and
type-specific options to precisely define the de-
tails of the segment’s appearance. The documen-
tation lists all the available segment types and the
configuration options available for them. You will
also find an example of Git integration on the Oh
My Posh site [7].
Conclusions
Working at the command line can become bor-
ing over time, at least visually. And prompts are
not always very informative. Oh My Posh gives
riety of platforms and shells. Themes help you
achieve appealing results very quickly, and
modifying the designs is a surprisingly simple
experience. Q Q Q
Info
[1] Powerline:
https://powerline.readthedocs.io/en/master/
[2] Oh My Zsh: https://ohmyz.sh
[3] Oh My Posh: https://ohmyposh.dev
[4] Nerd Fonts: https://www.nerdfonts.com
[5] Meslo LGM Nerd Font:
https://github.com/ryanoasis/nerd-fonts/
releases/download/v3.0.2/Meslo.zip
[6] Oh My Posh documentation:
https://ohmyposh.dev/docs/installation/
prompt
[7] Git configuration:
https://ohmyposh.dev/docs/segments/git
QQQ
ISSUE 279 FEBRUARY 2024 81
LINUX VOICE SYSTEM MONITORING CENTER
Monitor your computers with System Monitoring Center
Everything under Control
The System Monitoring Center combines all the important information you need
to monitor a computer in a single state-of-the-art interface.
inux comes with more system control ap-
L
BY ERIK BÄRWALDT
plications than any other operating system.
But the individual tools typically only focus
on specific components of a computer. For exam-
ple, programs such as the Gnome disk utility or
the KDE partition manager take care of the con-
nected mass storage devices. The system moni-
tor for the KDE Plasma desktop environment and
the system monitoring tools for other desktop en-
vironments such as MATE or LXDE keep an eye on
the CPU, RAM, and network throughput, but no
more. Many of the tools integrated into the re-
spective environments for monitoring individual
components also look a little jaded.
Compared to them, System Monitoring Center
[1], which is available as a Flatpak and can
therefore be used independently of your choice
of distribution, offers a comprehensive overview
of all important system statuses. A DEB pack-
age with an older version of the 1.43.x branch is
available for download from the project’s
GitHub page [2].
Figure 1: System Monitoring Center is visually up-to-date and functional.
82 FEBRUARY 2024 ISSUE 279
Installation
To install the Flatpak you need the appropriate
runtime environment on the system. You can set
this up on most distributions using the built-in
package manager. Then search for System Moni-
toring Center in KDE Plasma Discover, Gnome
Software, or mintinstall and set it up by clicking In-
stall. The routine also creates a starter in the desk-
top environment’s menu. Clicking on the starter
opens the main application window (Figure 1).
(For the graphical app stores Gnome Software
and KDE Plasma Discover, there are plugins that
let you integrate the Flatpak infrastructure. The
Flatpak packages available on Flathub are dis-
played there after doing so.)
Interface
The startup window first shows you an overview
of the critical system data (i.e., the CPU and RAM
utilization levels). The application displays this in-
formation on a dial gage in the central area of the
window and continuously updates the values. To
the right, you can see the mass storage device
data transfer rates at the top and the network in-
terface upload and download rates below them.
On the left side of the program window you will
also find the CPU, Memory, Disk, Network, GPU,
and Sensors categories. Clicking on one of the
buttons displays a line diagram in the window
panel to the right of it; the status values for the
component in question appear here. In the CPU
display, for example, the System Monitor breaks
down the utilization of the individual processor
cores separately, while the overview simply pro-
vides an overview for all CPU cores. You will also
find more detailed data here, such as the CPU’s
clock speed and the cache sizes (Figure 2).
The detailed display for the RAM shows both the
utilization and the RAM size. In the storage area, you
can see what volumes of data have already been
transferred to or read from the medium. These val-
ues are particularly important for modern SSDs be-
cause they can be used to predict failures caused by
a high number of write cycles. The software also
lists the read and write speeds for the current
LINUX-MAGAZINE.COM

Figure 2: When you call up the various categories, the software shows you
detailed information about the components in question.
partition. Here, too, values that deviate significantly
from the norm can indicate impending doom.
In the upper part of the program window, you
will also find buttons that help you access infor-
mation on the software and its versions. The pro-
cess and service information, which you can ac-
cess via Processes and Services, not only provides
SYSTEM MONITORING CENTER LINUX VOICE
Figure 3: The System Monitoring Center also provides detailed information
about processes and services.
information about the names, PID numbers, sta-
tus, and users of the respective processes, but
also about their memory requirements. The Pro-
cess view also shows you the read and write
speeds (Figure 3).
System shows you useful information about the
computer system, such as the vendor and
LINUX VOICE SYSTEM MONITORING CENTER
architecture. In addition, data on the operating
system such as the current kernel version, the
desktop environment, and the number of installed
packages appear here. The software lists Flatpaks
separately.
Settings
The titlebar has a pretty unusual design. It dis-
plays the current CPU and RAM load in small
bar graphs on the left, while the network data
Figure 4: This section lets users set the language locale,
among other things. However, this did not work during testing.
Figure 5: The software provides detailed information on
processes and services.
84 FEBRUARY 2024 ISSUE 279
and storage throughputs are shown as figures
on the right.
There is a hamburger menu on the right side of
the titlebar. It branches to a submenu where you
can set up some basic features of the application
in General Settings. They include the ability to
change the display update intervals and define the
startup settings and the language locale (Figure
4). By default, the language specified as the sys-
tem default should be enabled. However, this did
not work in our lab. Despite explicitly selecting a
local language, the locale failed to activate even
after restarting the program.
Management
To manage individual processes and services, right-
click on the desired process or service. You can use
the context menu to stop, restart, or even reload ser-
vices. The Details entry in the context menu provides
detailed information about the selected service. This
is where you can find out, for example, which depen-
dencies exist. Details in the context menu also gives
you more detailed information for processes. Select
this option to view the RAM usage, CPU usage, and
hard disk space usage.
The application also outputs the file names
and paths of the respective process. You will also
see the files used by the process along with the
names of the users who opened them. This
means that, in case of problems, you can look
forward to a precise overview of the process’s
environment, which is a big help in troubleshooting.
The System Monitoring Center displays the indi-
vidual pieces of information grouped clearly in a
tab structure (Figure 5).
Conclusions
System Monitoring Center combines all the crit-
ical details of your Linux system in a state-of-
the-art and clear-cut interface. The application
also lets you manage processes and services,
making it possible to cleanly terminate hanging
applications. The application’s only potential
shortcoming is the lack of language support.
Having said this, the interface is largely self-ex-
planatory and the terms used here follow com-
mon standards – which lets users quickly find
their way around, even if their preferred lan-
guage happens to be missing. Q Q Q
Info
[1] System Monitoring Center on Flathub:
https://flathub.org/apps/io.github.
hakandundar34coding.system-monitoring-
center
[2] DEB package:
https://github.com/hakandundar34coding/
system-monitoring-center/releases
LINUX-MAGAZINE.COM
LINUX VOICE FOSSPICKS

FOSSPicks Sparkling gems and new

releases from the world of
Free and Open Source Software

After four years of Kickstarter and component delays, Graham finally gets
to build his dream Oberheim OB-X clone synthesizer. Don’t expect to see or
hear from him for another six months, however. BY GRAHAM MORRISON
Modular synth rack library expanded into its own store modules. But the base was still open source, and the ideal

Cardinal
where commercial and proprietary
recreations could be offered
alongside the community-devel-
hysical Eurorack modules oped one. VCV Rack then became
community solution was to create a fork that would reflect
their values while also hopefully staying on friendly terms
with the original project. Cardinal is that fork.
It’s been over two years since then. Cardinal is now a

P can be expensive, and you

need the space and time
to build your own configuration.
VCV Rack Pro, which ultimately
became closed source. The proj-
ect’s ambition started to generate
well-established VCV alternative that puts open source at
the heart of its mission. It’s been able to do this by com-
pletely re-engineering the external module system to cre-
The software emulation of Euro- some friction within the original ate a self-contained single binary system that’s better
rack created by VCV Rack solved community, especially when con- suited to both the spirit of open source and the way audio
all these problems, and conse- versations turned towards expan- plugins are expected to work. The Linux-friendly LV2 for-
quently became hugely popular. sions and reworking VCV into a pl- mat, for example, has been supported from the very be-
Many physical modules were rec- ugin that could be used within ginning, and Cardinal is now available as a CLAP, VST2,
reated within VCV. Thanks to so your favorite audio software. The VST3, and Audio Unit plugin, across Linux, Windows, and
many being open source, soft- external module library made this macOS. There are different plugin types too, depending on
ware recreations could run exactly difficult, and also allowed the host which kind of sounds you want to play with. These are
the same firmware as their physi- project, VCV Rack, to exert a level “main,” “synth,” and “fx,” designed to enable the full version
cal counterparts. VCV became of control that felt out of balance with eight outputs, or with two output versions built for
very successful, and the module with the developers creating the sound design and effects processing respectively. There’s
also a “mini” variant with a limited module selection. This
self-contained approach means Cardinal can better sup-
port multiple architectures, including builds for ARMHF
and ARM64, RISC64, and even FreeBSD!
This doesn’t mean you’ll need to forgo the huge VCV Rack
library, either, because Cardinal bundles 1,079 modules into
a single file, including replacement for all the core Rack
modules, some internal utilities, and many third-party mod-
ules. Creating and processing sounds in Cardinal is also
the same experience, albeit within a completely different
themed and rebranded environment. Inputs and outputs
consist of audio, MIDI, and control voltages (CVs). While
every module is different, oscillator modules will have the
same CV control for frequency and waveform control. There
are hundreds of variants, and you can connect and intercon-
nect everything with virtual patch cables and save your con-
figuration in a way that’s just not possible with the real hard-
ware. There’s even a dark theme, which the original doesn’t
offer, and support for control voltage in and out to real hard-
ware, outside the software realm. If you have a compatible
1. MIDI and CV: Native MIDI, audio, and even CV control are supported if you have the CV or audio interface, this means you can integrate the con-
hardware. 2. Light and dark themes: Change the entire UI for all the modules with a trol signals from your external Eurorack modules with the
simple switch. 3. Standalone or plugin: Cardinal does not use a plugin system and control signals in your virtual software Eurorack, which is
installs as a single binary or plugin. 4. Audio threading: Audio and MIDI locked to the another amazing addition, making Cardinal the default
host. 5. 1,079: The number of modules included in the latest release. 6. Open source: choice if you want to play with virtual Eurorack modules.
Cardinal is open source first, making it the ideal platform for open source Eurorack
modules from Mutable Instruments. 7. Beyond physical: With MPE support and Project Website
unlimited space, many modules go farther than their hardware-bound counterparts. https://github.com/DISTRHO/Cardinal

86 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


Programming editor
Geany 2
e see so many new
W text editors come and
go, it can be difficult to
focus on the well-established edi-
tors that have been quietly doing
their thing for decades. Geany is
one of those editors. This major
2.0 release not only includes some
magnificent new features, but it
also coincides with the project’s
18th birthday. Happy Birthday,
Geany! While aiming for speed and
efficiency, Geany has also endeav-
ored to be more than a simple
graphical text editor. In particular,
it’s always combined many of the
best language-specific features
you find in an IDE without itself be-
coming a fully fledged IDE. It does
this by understanding the syntax
of 200 separate languages, offer-
ing best-in-class highlighting,
code-completion, automatic open
Space exploration
Celestia 1.7.0
elestia is an old project, fit-
C tingly started in 2001. It
was one of the first astron-
omy applications that portrayed
space as infinitely more than a two-
dimensional projection onto a sky-
box. Celestia empowered the ob-
server to leave their two-dimen-
sional viewpoint and terrestrial
homes to explore the stars through
both space and time, letting them
see the solar system in three di-
mensions (or four!) from Jupiter’s
viewpoint, from across the inter-
stellar divide, or from almost any-
where you could imagine. Graphics
acceleration had only just made
this possible in 2001, but the appli-
cation successfully tracked and up-
dated GPU upgrades, utilizing any
extra memory with sublime planet
and nebula textures that could be
layered for parallax or to simulate
LINUX-MAGAZINE.COM
FOSSPICKS LINUX VOICE
and closure of XML and HTML
tags, symbol lists, code navigation,
and many other language-specific
features.
Geany has been able to add these
features while successfully re-
maining light on system re-
sources, as well as being fast and
easy to use. The new release has
put particular effort into this by
splitting configuration files; updat-
ing GTK, Scintilla, and Lexilla ver-
sions; and updating file-types sup-
port, including AutoIt, GDScript,
and Markdown. The editor looks
fantastic, even on a non-GTK
desktop, and supports many dif- Like a Vim or Emacs for the desktop, Geany has become a powerful
ferent layouts, from adding IDE-re- and supremely adaptable text editor for all kinds of projects.
lated functions such as project,
code, and symbol navigation on on, for example, and there’s a plugin system to add new ele-
the left, to folding code views on ments to the core functionality. This personal configurability
the right with compiler output follows a long tradition for powerful programmers editors,
below. In common with many such as Sublime Text or TextMate, that are more usually
other powerful editors, extra com- proprietary and available only on other operating systems.
mands require user-configuration. Geany 2 is now as good as any of them.
The Build menu is designed to in-
clude your own custom com- Project Website
mands for the projects you work https://www.geany.org
volume. More performance also
meant more stars in the sky, which
could be zoomed through as you
traveled at many times the speed
of light through the universe.
While often breathtaking, Celes-
tia was also educational. It was
one of the best ways to show that
constellations were made mostly
from stars in different planes, Unlike astronomy apps like Stellarium, Celestia is a true 3D-model
across vast distances and scales. of the solar system and the universe beyond.
Similarly, it showed the sun’s loca-
tion along a fragile arm of the a code transfer to GitHub. Now an all-new website and a
Milky Way, and the celestial dance new stable binary release will hopefully reawaken the proj-
of our various solar system pas- ect. This is great news because Celestia could truly thrive in
sengers as they rotate around a new world of super GPUs, augmented reality, and astro-
themselves, the sun, and the black nomical imagery. If not, then a similar project built for the
hole at the center of our galaxy. web (https://www.ivoyager.dev/planetarium/) is worth book-
Unfortunately, Celestia then be- marking as a backup plan for those of us who are still look-
came cryogenically frozen and de- ing at the stars. But we’re pinning our hopes on Celestia.
velopment slowed to a crawl.
Then more recently came a fork Project Website
(Celestia Origin), a new owner, and https://celestiaproject.space
ISSUE 279 FEBRUARY 2024 87
LINUX VOICE FOSSPICKS

Audio analysis

Friture
udio analysis software Friture contains five different

A isn’t just useful for audio

engineers who may need
to study room acoustics or digital
signal processing. It’s just as use-
ful for anyone who may want to
check their input or playback
quality, or whether an audio re-
cording contains elements that
can’t be heard, or even what the
frequency response of the hard-
ware may be. Despite this, there
aren’t too many open source op-
tions available. Audacity is likely
the best known, but its audio anal-
ysis is only available after you’ve
made a recording, and not if you
need to monitor the live sound
input for your system. It’s also rel-
atively limited in scope (pun in-
tended). Friture, however, is an
audio analysis application that
doesn’t have any such limitations.
audio visualization and analysis
tools that can be arranged into a
dynamic interface that can focus
on one or more of these tools.
The most useful is the 2D spec-
trogram, which is very similar to
the spectrogram included in Au-
dacity. It plots the input audio fre-
quency over time so you can see
any changes in pitch, but also the Friture can analyze mono and stereo signals directly from your
pitch of any hum or background audio inputs, from either ALSA or Jack.
noise. These are also visible in
the spectrum widget, which pro- any given moment. Additionally, there’s a delay estimator
vides a real-time slice of the for calculating the latency between the left and right in-
same data. The octave spectrum puts, which is useful for speaker alignment, and a general
view shows a similar view with level view for peak power. This selection is perfect for
spectrum data grouped into col- most nonprofessional tasks. Even if you don’t know what
umns that represent a fraction of you’re doing, they make excellent desktop eye candy or
an octave (and octave is a dou- music-visualization tools.
bling of frequency). A scope view
is also available, which shows Project Website
the shape of the waveform at https://friture.org/features.html

Secure Boot manager

sbctl
nless you’re a security The problem is that accessing

U expert, you can often do

more harm than good
when trying to administrate en-
cryption and security yourself.
This isn’t usually a problem when
you can pay an expert, but we
don’t have that luxury on our own
systems. This is why it can be so
helpful when distributions set up
encryption automatically or han-
dle the secure nature of our keys
and drives without requiring our
input. But the same isn’t true of
Secure Boot, the boot-loader pro-
tocol that guarantees the integ-
rity of your installation with keys
held within a Trusted Platform
Module (TPM). Like many such
security systems, Secure Boot's
management from a user’s per-
spective is best described as
opaque.
whatever Secure Boot functional-
ity your system supports is typi-
cally dependent on your main-
board manufacturer and the fea-
tures they include in the BIOS or
UEFI options. This makes it diffi-
cult to document and difficult to
maintain, but is also the perfect
motivator for a project that
wants to make it all a little easier.
This is what sbctl, the Secure
Boot Manager, has been devel-
oped to do. It’s a command-line
tool that enables you to access
and configure your Secure Boot
configuration from your stan-
dard user environment. This usu-
ally starts with the creation and
enrollment of your own keys,
which are then incorporated into
your EFI-bound Secure Boot con-
figuration on reboot. The sbctl
Use sbctl to create a
Secure Boot configura- command accomplishes this
tion for your system and easily and can then be used to
to give you confidence in check on the status of your con-
its integrity. figuration, as well as sign files
with the keys you have regis-
tered in your Secure Boot config-
uration and then generate EFI
stub bundles. This is the signed
bundle of kernel and boot utilities
needed to start your system, and
sbctl can both generate these
and verify their validity.
Project Website
https://github.com/Foxboron/sbctl

88 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM


Modular synth tracker
Sointu
oundTracker applications
S are undoubtedly a product
of the late 1980s, when they
flourished as music creators for the
demo and cracking scenes. But the
idea behind encoding music as col-
umns of data has persisted and
has even become resurgent in re-
cent years. Their popularity is such
that the appearance of a new open
source clone isn’t that unique.
Sointu is the exception. It’s a fork of
another project, called 4klang, and
they both take the same approach
to the SoundTracker interface with
a couple of absolutely unique fea-
tures. The first is that they’re audio
trackers designed specifically to
output YML or ASM files, which
can then be compiled into 4K exe-
cutables. These 4K executables
Wavetable synth
Wavetable
here are lots of different
T kinds of synthesizers, but
the vast majority create
their sounds from either a VCO
or a DCO. These are the sound
generators at the beginning of
the signal path, and they both es-
sentially create the same set of
sounds: sawtooth, pulse, and tri-
angle waveforms, and some-
times sine. These sources are
then filtered and manipulated to
create what most people would
consider the classic synth sound.
But there are different forms of
synthesis too. There’s frequency
modulation (FM), made popular
by Yamaha and early PC sound
cards, and sample-based synthe-
sis is another. And then there are
wavetables. Wavetables replace
the VCOs and DCOs with a two-
or three-dimensional slice of
data that can be moved through
and controlled separately.
LINUX-MAGAZINE.COM
FOSSPICKS LINUX VOICE
are an artifact of the original demo
scene, where hackers needed to fit
their incredible creations into the
limited capabilities of the hardware,
building an executable that in-
cludes the music within just 16, 32,
or 64K. In the modern-era, the high-
est accolade goes to those who
can squeeze their code into just 4K,
which is just enough space to con-
tain the raw text of this page.
Not only is Sointu a tracker de-
signed to produce a 4K music file,
it also has its own unique modular
synth sound engine. It’s simplistic Alongside ASM output and a modular synth engine, Sointu includes
when compared to something like bitcrusher, clip, compressor, and gain effects.
Cardinal, but it’s a lot more power-
ful than most trackers’ simple music data, all of which comes from the column view of
sample playback. You create a numbers and controls, much like any other tracker. The
sound by adding units, such as an sound and capabilities are, however, completely different
oscillator, filter, and envelope, and and entirely worth the learning curve if you’re looking for a
joining them with send and receive diminutive music tool with a unique feature set.
opcodes. Sointu uses about 386
bytes when compressed, leaving Project Website
you with just enough room for the https://github.com/vsariola/sointu
Despite originating in the
1950s, and briefly flourishing in
the 1980s, wavetables remained
esoteric until the modern era
when electronic musicians dis-
covered that they could be
brasher, more dynamic, and
thicker than those original VCO
sources. The foundation of this
movement is a software synthe- Unlike the equally brilliant Vital, you don’t need an online account to
sizer called Serum, but there’s get the most from Wavetable.
also the incredible and open
source Vital, from the same de- UI shows a 3D view of each wavetable, and the location
veloper behind the more tradi- within each wavetable can be modulated with the mouse
tional Helm synthesizer. And now or any other control. Wavetable even supports MPE to en-
we can add this eponymous Wa- able a compatible keyboard to control such aspects of
vetable synth to the list. First, the sound with individual keys. There’s a good range of
and most important, Wavetable presets, classic filters, and a standard set of envelopes,
sounds amazing. It captures that LFOs, and effects, presenting a much simpler environ-
huge sawtooth and bass sound ment than Vital, for example. But this also makes it easier
that EDM has made famous. It to tweak and create great sounds and the perfect entry
has two separate wavetable os- point for anyone interested in wavetable synthesis.
cillators and includes a huge
range of wavetables that hint at Project Website
their sources in their names. The https://github.com/FigBug/Wavetable
ISSUE 279 FEBRUARY 2024 89
LINUX VOICE FOSSPICKS
Code editor
Helix Editor
ven when we have a multi-
E verse of other text editors,
including Geany, there is
always room for another. But it’s a
brave project that takes on the
decades-long command-line
dominance of Vim and Emacs.
This is exactly what Helix is trying
to do, first by adding all kinds of
unique features those older edi-
tors may never be capable of, and
second by gamely calling itself a
“postmodern text editor.” This last
part seems to come from Helix
being written in Rust, a program-
ming language that also seems
to position itself as a post-mod-
ern version of C/C++. This at
least means there are no other
dependencies, and the editor will
work just as well over SSH as it
will locally.
Ironically for an editor that
wants to improve long-standing
shortcomings, newcomers will
find the text-based UI unfathom-
able. There are no hints on what
special keys may be required to
save your file, or even to quit.
These can be learnt by typing
:tutor, which both initiates the
in-editor tutorial and tells you
that the command mode is in-
voked with the very Vim-friendly :
Even from the terminal, Helix includes many built-in themes that can be
dynamically tested from its command mode.
90 FEBRUARY 2024
key. When this is pressed, Helix
starts to list context options for
what you need, and it then be-
comes very intuitive to use, with
many of the features inspired by
Vim and some of its most useful
plugins. These include bracket
substitution, multiple selections,
processing text objects, lan-
guage documentation, and syn-
tax tables. There are also short-
cuts to help you traverse code
trees, through language-specific
server definitions and functions.
Code project navigation is
central to Helix’s advantage over
other more generalist and estab-
lished editors, because the ap-
plication itself is able to take so
much from desktop-based de-
velopment environments. Press-
ing the space bar before a for-
ward slash will start a global
search, for instance, and any re-
sults in your project are listed in
a new split-panel view with the
file name on the right and a pre-
view of the found location on
the right. Central, too, is the idea
that Helix is a “multi cursor
modal editor,” which means it
can process multiple locations
at once. You may have encoun-
tered a need for this when
ISSUE 279
Global operations, such as search, can operate on a set of
documents, allowing you to preview and dynamically open
results in multiple editing buffers.
searching for multiple instances
of a term and then wanting to
edit them all simultaneously.
Helix does this by adding a new
cursor at the current location
with the Shift+C command. You
can then press n for the next
search result, followed by
Shift+C to create a new cursor.
When you have multiple cursors
on screen, anything you do at
the main cursor will be copied to
all other cursor locations. This
can be more convenient and in-
tuitive than a global text pro-
cess, for example, and is ideal
when you need to add the same
function or arguments to differ-
ent locations. Pressing ,
(comma) will restore the single
cursor again. Multi-cursor or
modal editing is one of those
features you can’t go without
when you get used to it.
Helix does all of this without
supporting additional plugins,
which works in its favor because
it’s easier to build momentum
behind its standard set of fea-
tures. And it seems to be work-
ing. Many developers are now
using hx on the command line in-
stead of vim, even if its just to
work on code projects where it
might otherwise be too difficult
to set up your typical editor envi-
ronment. Helix will do it all from a
single binary.
Project Website
https://helix-editor.com
LINUX-MAGAZINE.COM

Classic Roguelike
Brogue CE
rom a developer’s per-
F spective, Roguelike games
are difficult to get right,
but a lot of fun if they succeed.
They need to balance the player’s
natural desire for exploration and
adventure with fairness and prog-
ress in a randomly generated
world of random encounters. The
genre’s progenitor, Rogue, obvi-
ously got this right, and there have
been many popular descendants
since its original release in 1980.
Brogue CE is one of these, and is
itself the Community Edition of a
project that started in 2009. De-
spite being relatively recent, how-
ever, Brogue captures the true
spirit of the original with its beauti-
fully executed and deceptively im-
mersive ASCII-based text graph-
ics, making it a great first experi-
ence for players who have yet to
Arcade emulator
MAME 0.260
ou already know MAME.
Y It’s the multi-platform
emulation behemoth
that’s famous for running most
of the original arcade games
from the 1970s onwards. It re-
quires legal access to the origi-
nal ROMs, but when you have
these, MAME is unrivaled. Devel-
opers have even gone to the
trouble of slicing and scanning
the original chips in order to
work out the logic and timing,
and in many cases they’ve me-
ticulously recreated every nu-
ance of the original hardware in
their software emulations. As a
result, MAME has become one
of the most important open
source projects and a vital ar-
chive of late 20th-century and
early 21st-century gaming. But
it’s also a lot of fun.
LINUX-MAGAZINE.COM
FOSSPICKS LINUX VOICE
get themselves hooked on proce-
durally generated entertainment.
Your quest in Brogue is to reach
the 26th level of the dungeon. As
you move, new areas and re-
sources become visible, with text
descriptions that expand upon
what you see, prompt you to take
potions, and ask when you need
to interact with an object or per-
son. It feels authentic but at the
same time contemporary as Press g to replace the ASCII rendering with graphics tiles, although
areas light up and move dynami- this also removes a little of the original’s charm.
cally. You can use the mouse and
even set paths through previously permadeath always just a dive or an encounter away. But
explored areas of the map. As this is also what makes Rogue games like these so unique,
with the original Rogue, you soon and Brogue is undoubtedly one of the best modern imple-
create a connection with your en- mentations of that original idea. If you’ve never played one
vironment, your progress, and any of these kinds of games before, Brogue is the best way to
monkeys which you’ve freed and get started.
who have chosen to become your
friends. Progress is always diffi- Project Website
cult and dangerous, with https://github.com/tmewett/BrogueCE
MAME 0.260 is a particularly
exciting release, not just because
it includes synthesizer emulation
for the first time, in the shape of
Casio’s humble CZ-101 complete
with MIDI and SysEx support, but
because MAME finally allows for
CHD delta. MAME can consume
over a terabyte of CHD files to
hold the disk images of many of This is a major release for MAME, including synth emulation, CHD
the more advanced games, and deltas, and, most important, emulation of the Acorn Electron’s
being able to use deltas across Cumana DFS floppy disk image.
many different variants makes
things much easier to manage. months of development effort. Alongside all these techni-
Another big feature for shader cal innovations, of course, more and more games are
support is that MAME can now continually being added to the compatibility database.
use BGFX video output with Way- MAME can now emulate over 32,000 individual systems
land. This follows on from recent from the last five decades. It’s utterly overwhelming and re-
support for hard-sectored floppy markable what MAME has achieved in its mission to play
formats, Namco’s quiz games, old games, and the best place to start is to just dive in.
Psion Series 3 clamshell PDAs,
and even the Motorola 88000 Project Website
CPU. And that’s barely the last six https://www.mamedev.org/
ISSUE 279 FEBRUARY 2024 91
LINUX VOICE TUTORIAL – SSH KEYS
SSH key management demands a rigorous protocol
Enhanced Security
Verifying the security of your SSH configuration and performing regular audits
are critical practices in maintaining a secure Linux environment.
ecure Shell, better known as SSH, has be-
S
BY MARCIN GASTOL
come an indispensable tool in the toolkit of
any IT professional, especially in the Linux
world. At its core, SSH is a protocol that allows for
encrypted communications between two sys-
tems. While its applications are diverse, ranging
from remote command execution to secure file
transfers, its primary value lies in its ability to se-
cure data in transit, protecting it from eavesdrop-
ping and potential breaches.
In the realm of Linux, where open source reigns
supreme, SSH stands tall as the de facto method
for remote access. Whether you’re administering
a cloud-based Linux server or performing routine
maintenance tasks, SSH is the bridge that con-
nects you securely to that system. But as with any
powerful tool, its potential can be a double-edged
sword. Misconfigurations, weak key management,
and lax security practices can turn SSH into a po-
tential vulnerability – which underscores the need
for rigorous best practices.
Understanding SSH in Linux
Originating in the late ‘90s as a response to the
insecure Telnet, SSH was created as a crypto-
graphic network protocol that emphasized se-
curity. In a Linux environment, the operational
mechanism of SSH can be divided into two
main components: the client (ssh) and the
server (sshd).
When a client wishes to establish a connection,
it begins by sending a request to the server. Upon
receiving this request, the server presents its pub-
lic key to the client. If this is the first time the cli-
ent is connecting to the server, it prompts the user
to verify the authenticity of the key. Once verified,
the client generates a random session key, en-
crypts it using the server’s public key, and sends it
back. The server, using its private key, decrypts
the session key. Both entities now possess a
shared secret (the session key) without it ever
being transmitted in the clear. This process,
known as asymmetric encryption, forms the bed-
rock of SSH’s security mechanism.
92 FEBRUARY 2024 ISSUE 279
Beyond the encryption scheme, SSH in Linux
offers versatility. Using the protocol, professionals
can run commands remotely (ssh user@hostname),
set up tunneling to encrypt other application’s
data, securely transfer files with SCP or SFTP,
and even mount remote directories with SSHFS.
Why SSH Is Crucial for Linux Systems
In today’s cybersecurity landscape, the importance
of securing communications cannot be overstated.
With threats ranging from man-in-the-middle at-
tacks to advanced persistent threats, the need for
a robust, secure method of accessing and admin-
istering systems remotely is paramount.
SSH fills this need perfectly for several reasons:
Q Everything transmitted over an SSH session,
whether command outputs, configuration de-
tails, or sensitive files, is encrypted. This means
that even if the data is intercepted, deciphering
the actual content without the encryption key is
next to impossible.
Q SSH doesn’t just rely on passwords. With key-
based authentication, users can set up a pri-
vate-public key pair, offering an authentication
method that’s considerably harder to breach
than traditional passwords.
Q Beyond just a secure shell, SSH offers port for-
warding, tunneling, and a suite of utilities such
as SCP and SFTP, making it a Swiss Army knife
for IT professionals.
Q While native to Unix-based systems, SSH clients
and servers exist for a multitude of platforms,
reinforcing its position as a universal remote ac-
cess tool.
In the context of Linux, with its diverse array of
distributions, server setups, and use cases, SSH
offers a unified method of secure access and ad-
ministration. Because it is the backbone of remote
Linux administration, understanding and securing
SSH is not just advisable, it’s imperative.
Key Management Best Practices
Proper key management is at the heart of SSH
security. Adopting stringent practices can
LINUX-MAGAZINE.COM

significantly reduce the chances of unauthorized
access. The following are some of those prac-
tices and the code to implement them.
Generating Strong SSH Keys
RSA with at least 4,096 bits provides a formidable
level of encryption, ensuring that brute-force at-
tacks become computationally unfeasible. For pro-
fessionals managing sensitive infrastructure, the
strength of the key directly correlates to the secu-
rity of the system. To generate strong keys, use:
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_custom
Storing and Backing Up Private Keys Securely
A private key, as the name suggests, must remain
private. Any inadvertent exposure can compro-
mise the entire system it’s associated with. Set-
ting restrictive permissions ensures that only the
rightful user can access it, mitigating the risks of
internal breaches. Use:
chmod 600 ~/.ssh/id_rsa_custom
For backups, consider encrypting the key using
tools such as GPG before storing in a safe location.
Periodic Key Rotation
Key rotation is like changing the locks on your
doors periodically. Even if someone has a copy of
your key, it becomes useless after the change.
This is especially vital for businesses where staff
turnover might be high or where keys might be
shared among teams.
Using Agents and Agent Forwarding Safely
SSH agents store decrypted private keys and pro-
vide them to clients without exposing the private
key itself. However, agent forwarding should be
used judiciously, because it can be exploited in
chained attacks. Start the agent with:
eval $(ssh-agent)
ssh-add ~/.ssh/id_rsa_custom
SSH Configuration Tuning for Optimal
Security
The configuration file, sshd_config, located typi-
cally in /etc/ssh/, dictates the behavior of the SSH
daemon. Fine-tuning this file enhances security.
Disabling Root Login
The root user is the superuser with absolute pow-
ers. Allowing direct root login is akin to leaving the
keys to your kingdom outside the castle. Disabling
it forces attackers to guess both a valid username
and its password/key. To disable root login, use:
PermitRootLogin no
LINUX-MAGAZINE.COM
TUTORIAL – SSH KEYS LINUX VOICE
Limiting Allowed Ciphers and Key Exchange
Algorithms
Not all encryption methods are created equal. As the
digital landscape evolves, some older ciphers be-
come vulnerable. It’s vital to keep abreast of and use
only the most secure and updated ciphers, such as:
ciphers aes256-gcm@openssh.com,chacha20-U
poly1305@openssh.com
kexAlgorithms curve25519-sha256,curve25519-U
sha256@libssh.org
Enabling and Configuring AllowUsers and
AllowGroups
Allow only the necessary users or groups, using:
AllowUsers user1 user2
AllowGroups sshgroup
Setting Up 2FA
The principle of least privilege dictates that only
essential personnel should have access. By allow-
ing specific users or groups, you’re minimizing po-
tential entry points. After ensuring you have a
PAM module for two-factor authentication (2FA)
such as Google Authenticator, add:
AuthenticationMethods publickey,password U
publickey,keyboard-interactive
Regularly Updating SSH
Software isn’t static. Vulnerabilities are discov-
ered and patches are released. Regular updates
ensure you’re shielded from known exploits. Keep
the SSH package up-to-date to ensure vulnerabili-
ties are patched:
sudo apt update && sudo apt upgrade openssh-server
Limiting User Access via SSH
Every user with SSH access is a potential door-
way, either for productive work or, if compro-
mised, for malicious intent.
Firewalls and SSH’s Built-In Features
A firewall acts as a sentinel, allowing or denying
traffic based on set rules. Restricting SSH access
to specific IPs ensures that even if credentials are
compromised, only allowed IPs can initiate a con-
nection. Uncomplicated Firewall (ufw) on Ubuntu
is an example. To allow only a specific IP use:
sudo ufw allow from 192.168.1.100 to any port 22
Setting Up and Configuring Chroot
Environments for SSH Users
A chroot environment limits a user to a specific
directory, restricting their movements. In sshd_
config use:
ISSUE 279 FEBRUARY 2024 93
LINUX VOICE TUTORIAL – SSH KEYS
Match User restricted_user
ChrootDirectory /home/restricted_user
AllowTCPForwarding no
PasswordAuthentication yes
Implementing Account Expiration for
Temporary SSH Access
Temporary accounts are a double-edged sword.
While they provide short-term access, they often get
forgotten and become a long-term security risk. By
setting expiration dates, these accounts auto-deac-
tivate, ensuring no lingering vulnerabilities. Use:
sudo usermod -e YYYY-MM-DD temporary_user
Monitoring and Auditing SSH Access Logs
Logs offer a retrospective view of all SSH activi-
ties. Regularly monitoring them can unearth sus-
picious patterns, repeated login attempts, or un-
authorized access, allowing timely interventions
and investigations.
Regularly inspecting /var/log/auth.log on
Debian/Ubuntu or /var/log/secure on CentOS/
Red Hat can give insights into access patterns
and potential breaches.
Each of these technical aspects, when correctly
configured, plays a pivotal role in safeguarding your
Linux systems against unauthorized SSH access.
Advanced SSH Features for Enhanced
Security
Port Forwarding and Tunneling
SSH isn’t just for shell access. One of its power-
ful features is the ability to forward ports, es-
sentially creating encrypted tunnels for other
protocols. This can be used to securely access
databases, web interfaces, and other services
without exposing them to the open Internet.
However, while this feature enhances security,
it’s crucial to use it judiciously to prevent unin-
tentional data leaks or unwanted access. To ac-
complish this, use:
ssh -L local_port:remote_host:remote_port U IT ecosystem. Q Q Q
user@ssh_server
Using SSH Jump Hosts
In high-security environments, it’s common to
use an SSH jump host (also known as a bastion
host). This setup allows SSH access only
through the jump host, acting as a single point of
entry and exit. It isolates the internal network
and provides a buffer against direct external at-
tacks. By consolidating access through a jump
host, auditing and monitoring become central-
ized and more manageable. To do this, use:
94 FEBRUARY 2024 ISSUE 279
ssh -J user@jumphost user@targethost
PKI for SSH
In large organizations or environments with
many users and hosts, managing individual
SSH keys can become cumbersome. Imple-
menting a public key infrastructure (PKI) simpli-
fies this. PKI involves a certificate authority
(CA) that issues and verifies digital certificates.
Instead of trusting individual keys, your sys-
tems trust the CA, and any key signed by that
CA is inherently trusted. This centralizes and
streamlines key management while maintaining
high security levels.
Host Certificates
Just as users can be authenticated with keys,
hosts can be authenticated using host certifi-
cates. This prevents man-in-the-middle attacks by
ensuring that you’re connecting to the genuine
server and not an imposter.
Conclusion
SSH isn’t merely a tool – it’s a foundation upon
which the secure infrastructure of modern busi-
nesses is built. Its versatility, ranging from secure
command-line access to intricate tunnels for data,
makes it a staple in the toolkit of IT professionals.
However, with such power comes responsibil-
ity. It’s paramount that IT professionals not only
understand the capabilities of SSH but also the
best practices associated with its use. Key man-
agement, configuration tuning, user access re-
strictions, and advanced features all play a pivotal
role in crafting a resilient security posture.
In today’s digital age, where threats are
evolving and becoming increasingly sophisti-
cated, a proactive approach to SSH security
isn’t just recommended, it’s essential. By dili-
gently applying the best practices and tech-
niques discussed, professionals can ensure
the sanctity of their systems, data, and opera-
tions, paving the way for a secure and efficient
The Author
Marcin Gastol is a Senior
DevOps Engineer and
Microsoft Certified Trainer
with extensive experience in
Azure technologies and
teaching various IT subjects.
Marcin hosts a blog
covering multiple IT areas at
https://marcingastol.com/.
QQQ
LINUX-MAGAZINE.COM
 SERVICE
Back Issues

LINUX
NEWSSTAND
Order online:
https://bit.ly/Linux-Magazine-catalog

Linux Magazine is your guide to the world of Linux. Monthly issues are packed with advanced technical
articles and tutorials you won't find anywhere else. Explore our full catalog of back issues for specific
topics or to complete your collection.
#278/January 2024
Scientific Computing
A crypto mining rig is built for math. Can an old rig find a second life solving science problems?
That all depends on the problem. Also this month, we explore a few popular data analysis
techniques and stir up some analysis of our own with the R programming language.
On the DVD: Kubuntu 23.10 and Fedora 39

#277/December 2023
Low-Code Tools
Experienced programmers are hard to find. Wouldn’t it be nice if subject matter experts and
occasional coders could create their own applications? The low-code revolution is all about
lowering the bar for programming knowledge. This month we show you some tools that let
you assemble an application using easy graphical building blocks.
On the DVD: MX Linux MX-23_x64 and Kali Linux 2023.3

#276/November 2023
ChatGPT on Linux
Everybody’s talking about ChatGPT, and ChatGPT is talking about everything. Sure you can
access the glib and versatile AI chatbot from a web interface, but think of the possibilities if
you tune in from the Linux command line.
On the DVD: Rocky Linux 9.2 and Debian 12.1

#275/October 2023
Think like an Intruder
The worst case scenario is when the attackers know more than you do about your network. If you
want to stay safe, learn the ways of the enemy. This month we give you a glimpse into the mind of
the attacker, with a close look at privilege escalation, reverse shells, and other intrusion techniques.
On the DVD: AlmaLinux 8.2 and blendOS

#274/September 2023
The Best of Small Distros
Nowadays, all the attention is on big, enterprise distributions supported by professional
developers at big, enterprise corporations, but small distros are still a thing. If you’re shopping
for a Linux to run on old hardware, if you just want a simpler system that is more responsive
and less cluttered, or if you’re looking for a special Linux tailored for a special purpose, you’re
sure to find inspiration in our look at small and specialty Linux systems.
On the DVD: 10 Small Distro ISOs and 4 Small Distro Virtual Appliances

#273/August 2023
Podcasting
On the Internet, you don’t have to wait for permission to speak to the world. Podcasting lets you
connect with your audience no matter where they are. Whether you're in it to build community,
raise awareness about your skills, or just have some fun, the tools of the Linux environment
make it easy to take your first steps.
On the DVD: Linux Mint 21.1 Cinnamon and openSUSE Leap 15.5

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 95

SERVICE
Events

FEATURED EVENTS
Users, developers, and vendors meet at Linux events around the world.
We at Linux Magazine are proud to sponsor the Featured Events shown here.
For other events near you, check our extensive events calendar online at
https://www.linux-magazine.com/events.
If you know of another Linux event you would like us to add to our calendar,
please send a message with all the details to info@linux-magazine.com.

State of Open Con 2024 FOSS Backstage SCaLE 21x

Date: February 6-7, 2024
Location: London, United Kingdom
Website: https://stateofopencon.com/
OpenUK's State of Open Con 2024 will
take place at The Brewery in London.
Don't miss the UK's Open Technology
Conference focused on Open Source
Software, Open Hardware, and Open
Data. Join us in London for or outstand-
ing content, amenities, and delegate in-
teractive experiences with world-class
speakers.
Date: March 4-5, 2024
Location: Berlin, Germany
Website: https://24.foss-backstage.de/
What makes an open source project
flourish? We want to encourage more
discourse about the non-coding
aspects of successful open source
projects. The sixth edition of FOSS
Backstage will take place in Berlin (and
online) on 4th and 5th March 2024.
Join us for two days of exciting talks
and discussions.
Date: March 14-17, 2024
Location: Pasadena, California
Website: https://www.socallinuxexpo.org/
scale/21x
SCaLE is the largest community-run open-
source and free software conference in
North America. It is held annually in the
greater Los Angeles area. Join us for the
21st Annual Southern California Linux
Expo March 14-17. In addition to
presentations, there are numerous co-
located events on a variety of topics.

Events
FOSDEM Feb 3-4 Brussels, Belgium https://fosdem.org/

State of Open Con 24 Feb 6-7 London, United Kingdom https://stateofopencon.com/

IEEE Serious Open Source 2024 Feb 20-21 Mountain View California https://events.bizzabo.com/549239

DeveloperWeek SF Bay Area Feb 21-23 San Francisco, California https://www.developerweek.com/

Academy Software Foundation Feb 22 Los Angeles, California https://events.linuxfoundation.org

Open Source Forum & Virtual

KickStart Europe 2024 Feb 26-27 Amsterdam, Netherlands https://www.kickstartconf.eu/

DeveloperWeek Live Online Feb 27-29 Virtual Event https://www.developerweek.com/

FOSS Backstage Mar 4-5 Berlin, Germany https://24.foss-backstage.de/

Energy HPC Conference Mar 5-7 Houston, Texas https://www.energyhpc.rice.edu/

SCaLE 21x Mar 14-17 Pasadena, California https://www.socallinuxexpo.org/scale/21x

CloudFest 2024 Mar 18-21 Europa-Park, Germany https://www.cloudfest.com/

AppDeveloperCon Mar 19 Paris, France https://events.linuxfoundation.org

BackstageCon Mar 19 Paris, France https://events.linuxfoundation.org

Images © Alex White, 123RF.com

Cloud Native AI Day Mar 19 Paris, France https://events.linuxfoundation.org

KubeCon + CloudNativeCon Europe Mar 19-22 Paris, France https://events.linuxfoundation.org/

Embedded Open Source Summit Apr 16-18 Seattle, Washington https://events.linuxfoundation.org

Open Source Summit North America Apr 16-18 Seattle, Washington https://events.linuxfoundation.org

Open Source Camp on Kubernetes April 18 Nürnberg, Germany https://opensourcecamp.de/

96 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

 SERVICE
Contact Info / Authors

Contact Info
WRITE FOR US
Editor in Chief Linux Magazine is looking for authors to write articles on Linux and the
Joe Casad, jcasad@linux-magazine.com tools of the Linux environment. We like articles on useful solutions that
Copy Editors
Amy Pettle, Aubrey Vaughn
solve practical problems. The topic could be a desktop tool, a command-
News Editors line utility, a network monitoring application, a homegrown script, or
Jack Wallen, Amber Ankerholz anything else with the potential to save a Linux user trouble and time.
Editor Emerita Nomadica Our goal is to tell our readers stories they haven’t already heard, so we’re
Rita L Sooby
especially interested in original fixes and hacks, new tools, and useful ap-
Managing Editor
Lori White plications that our readers might not know about. We also love articles on
Localization & Translation advanced uses for tools our readers do know about – stories that take a
Ian Travis traditional application and put it to work in a novel or creative way.
Layout
Dena Friesen, Lori White We are currently seeking articles on the following topics for upcoming
Cover Design cover themes:
Lori White
Cover Image • Open hardware
© Akaratee Nithipanmangkorn, 123RF.com
and lexey111, Fotolia.com
• Linux boot tricks
Advertising • Best browser extensions
Brian Osborn, bosborn@linuxnewmedia.com
phone +49 8093 7679420 Let us know if you have ideas for articles on these themes, but keep in
Marketing Communications mind that our interests extend through the full range of Linux technical
Gwen Clark, gclark@linuxnewmedia.com topics, including:
Linux New Media USA, LLC
4840 Bob Billings Parkway, Ste 104 Security
•
Lawrence, KS 66049 USA
Publisher • Advanced Linux tuning and configuration
Brian Osborn • Internet of Things
Customer Service / Subscription Networking
For USA and Canada:
•
Email: cs@linuxnewmedia.com • Scripting
Phone: 1-866-247-2802 Artificial intelligence
(Toll Free from the US and Canada)
•
• Open protocols and open standards
For all other countries:
Email: subs@linux-magazine.com If you have a worthy topic that isn’t on this list, try us out – we might be
www.linux-magazine.com
interested!
While every care has been taken in the content of the
magazine, the publishers cannot be held responsible Please don’t send us articles about products made by a company you
for the accuracy of the information contained within
it or any consequences arising from the use of it. The work for, unless it is an open source tool that is freely available to every-
use of the disc provided with the magazine or any one. Don’t send us webzine-style “Top 10 Tips” articles or other superfi-
material provided on it is at your own risk.
cial treatments that leave all the work to the reader. We like complete so-
Copyright and Trademarks © 2024 Linux New Media
USA, LLC. lutions, with examples and lots of details. Go deep, not wide.
No material may be reproduced in any form
whatsoever in whole or in part without the written
Describe your idea in 1-2 paragraphs and send it to: edit@linux-magazine.com.
permission of the publishers. It is assumed that all Please indicate in the subject line that your message is an article proposal.
correspondence sent, for example, letters, email,
faxes, photographs, articles, drawings, are supplied
for publication or license to third parties on a non-
exclusive worldwide basis by Linux New Media USA,
LLC, unless otherwise stated in writing.
Linux is a trademark of Linus Torvalds.
All brand or product names are trademarks of their
Authors
respective owners. Contact us if we haven’t credited
your copyright; we will always correct any oversight. Dave Allerton 70 Jon “maddog” Hall 79
Printed in Nuremberg, Germany by Kolibri Druck.
Bernhard Bablok 66 Daniel LaSalle 48
Distributed by Seymour Distribution Ltd, United
Kingdom Erik Bärwaldt 26, 82 Vincent Mealing 77
Represented in Europe and other territories by:
Sparkhaus Media GmbH, Bialasstr. 1a, 85625 Zack Brown 12 Graham Morrison 86
Glonn, Germany.
Linux Magazine (Print ISSN: 1471-5678, Online Bruce Byfield 6, 22, 32, 44 Thorsten Scherf 80
ISSN: 2833-3950, USPS No: 347-942) is published
monthly by Linux New Media USA, LLC, and dis- Joe Casad 3 Mike Schilli 58
tributed in the USA by Asendia USA, 701 Ashland
Ave, Folcroft PA. Application to Mail at Periodicals Mark Crutch 77 Markus Stubbig 16
Postage Prices is pending at Philadelphia, PA and
additional mailing offices. POSTMASTER: send ad- Chris Binnie 38 Jack Wallen 8
dress changes to Linux Magazine, 4840 Bob Billings
Parkway, Ste 104, Lawrence, KS 66049, USA. Marcin Gastol 92 Matthias Wübbeling 36, 54

LINUX-MAGAZINE.COM ISSUE 279 FEBRUARY 2024 97

NEXT MONTH
Issue 280
Available Starting
Issue 280 / March 2024
February 9

Plasma 6
A major release of KDE’s Plasma desktop
arrives with many new tools and some lasting
innovations. We’ll fill you in on the changes
coming to KDE’s innovative interface.

Preview Newsletter
The Linux Magazine Preview is a monthly email
newsletter that gives you a sneak peek at the next
issue, including links to articles posted online.
Sign up at: https://bit.ly/Linux-Update

Image © tamersale and jossdim, 123RF.com

98 FEBRUARY 2024 ISSUE 279 LINUX-MAGAZINE.COM

NEW