Share your Linux desktop with x11vnc

x11vnc is a pretty useful program that you can use to share your Linux desktop with someone far away. To start x11vnc while using X11 windows, issue the following command:

x11vnc -display :0

This command will work in most cases, assuming there is only one instance of X11 Windows server running. However, the display number could be different. To be sure, type the following command:

xdpyinfo | head

x11vnc will output a lot of information, including the port number it runs on:

The VNC desktop is:      bootcd:2
PORT=5902

Subtracting 5900 from the port number (5902), you'll get the display number (2). Use this number to connect to your desktop remotely. I use gvncviewer.

gvncviewer 192.168.200.83:2

Administrator To Monitor Someone's Desktop with X11VNC

Let's assume that you are a system administrator with root privilege and want to monitor a user's X11 Windows desktop. You can't just run “x11vnc -display :0” because you are not the user currently using display :0. In that case, you need access to the X11 Windows' xauth file which is located at one of the following locations:

• /var/lib/gdm
  
• /var/lib/kdm
  
• /var/lib/xdm/authdir/authfiles
  
• /home/USER/.Xauthority
  

Once you locate the xauth file associated with the user's X11 desktop, you can use x11vnc to monitor his desktop activity.

x11vnc -display :0 -auth /var/lib/gdm/\:0.Xauth

Then, on your desktop as administrator, connect to the user's desktop with a vnc client.

gvncviewer 192.168.200.83:2

x11vnc with SSL

x11vnc supports various connection schemes, including SSL. On Debian and Ubuntu, type the following command to create a SSL certificate for use with x11vnc.

cat /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/certs/ssl-cert-snakeoil.pem > /tmp/x11vnc.pem

Then, start x11vnc with -ssl option to run x11vnc in secure mode.

x11vnc -display :0 -auth /var/lib/gdm/\:0.Xauth -ssl /tmp/x11vnc.pem

ssvnc and gvncviewer can be used to connect to x11vnc via SSL connection. The following example command starts x11vnc in anonymous SSL mode that doesn't require X509 exchange.

x11vnc -display :0 -xauth /var/lib/xdm/authdir/authfiles/A\:0-R2x5Db -xkb -nopw -nc_cr -ssl /tmp/x11vnc.pem -vencrypt newdh:nox509:support

Linux: Transmitting a Bunch of Files using socat

socat is a nifty, versatile tool for establishing a secure data channel between two computers. To install socat on Debian, use apt-get:

apt-get install socat

I was trying to use socat and tar to duplicate the contents of an entire filesystem securely between two computers. In this case, I copied all files in partition /dev/sda5 on box A to partition /dev/sdb6 on box B (IP 192.168.200.83).

Using the SCTP protocol

This method does not involve encryption, so it is relatively simple to follow.

1. First, I opened a terminal at box B (192.168.200.83) and changed the current directory to /mnt/sdb6 where I will unpack the incoming stream of files.

   
   

   cd /mnt/sdb6

   
   

   Then, I typed the following command to have socat establish a SCTP connection listening on port 7749. tar would be expecting to receive incoming files.

   
   

   socat EXEC:"tar xzf -" SCTP4-LISTEN:7749

   
   

2. Then, I opened a terminal at box A. Here I would transmit a bunch of files to box B (192.168.200.83). I changed directory to /mnt/sda5 containing files to send.

   
   

   cd /mnt/sda5

   
   

   Then, I typed the following command to transmit all the files in the current directory.

   
   

   socat EXEC:"tar czf - ." SCTP4-CONNECT:192.168.200.83:7749

   
   

Using the SSL connection

This method involves encrypted connection and requires SSL certicates on both sides of the link. Read this post to learn how to create self-signed SSL certificates if you don't already have one.

1. Debian and Ubuntu automatically create a local SSL certificate at /etc/ssl/certs/ssl-cert-snakeoil.pem. Both parties of an SSL connection — box A and box B — should exchange each other's ssl-cert-snakeoil.pem in order to have SSL connections between them.
   
   
   
2. On box B, I typed the following command to run socat in SSL listening mode at port 7749.
   
   

   cd /mnt/sdb6
   socat EXEC:"tar xzf -" OPENSSL-LISTEN:7749,reuseaddr,cert=/etc/ssl/certs/ssl-cert-snakeoil.pem,key=/etc/ssl/private/ssl-cert-snakeoil.key,cafile=box-A.pem

   
   
   
3. On box A, I typed the following command to run socat in SSL mode while running tar to pack all the files and send them through the pipeline.
   
   

   cd /mnt/sda5
   socat EXEC:"tar czf - ." OPENSSL:192.168.200.83:7749,cert=/etc/ssl/certs/ssl-cert-snakeoil.pem,key=/etc/ssl/private/ssl-cert-snakeoil.key,cafile=box-B.pem

   
   
   

Thus I have duplicated the whole directory tree from Box A to Box B. Using socat and tar, I was able to mirror a filesystem over the network. As shown above, socat alone can be a good substitute in situations where ssh, scp and/or netcat are needed. socat has many other features I have yet to explore.

How to Extract Boot Images from Acronis Bootable CD

Acronis Backup and Restore is a great software to purchase for any business that wants to protect and preserve their digital assets from natural or accidental loss. After you purchase Acronis software and deploy it on your computers, you have a chance to create a bootable CD for emergency purpose. The Acronis boot CD will prove useful when you need to restore backups on a compromised or corrupted system.

However, you may want to incorporate Acronis software into your own custom boot CD. The custom CD can be a live Linux CD or live Windows CD. In that case, your ideal CD will have a menu of choices to run Acronis in addition to booting Linux or Windows. To create such a disc, you need to extract boot images from Acronis Boot CD. This post illustrates the steps needed to creat a custom CD containing Acronis software.

1. Bring your Acronis emergency CD and use the following command to create an ISO file. This assumes that you are using Linux. On Windows, you can use the readom program from my cdrkit build.

   
   
   

   readom dev=/dev/sr0 f=ABR11.5AWUR_en-US.iso speed=8 retries=16 -nocorr -noerror

   
   
   

2. Acronis uses a special bootloader called BootWiz. To extract the boot image, you need to find the location of area that begins with BOOTWIZ0 string inside the ISO file. This is a hit-or-miss process. hexedit can be used here.

   
   
   

   hexedit ABR11.5AWUR_en-US.iso

   
   
   

3. In hexedit, press Ctrl+S, then enter 424F4F5457495A30, which translates to BOOTWIZ0. Hit Enter.

   
   
   
   
   

4. Hexedit will find the given string (BOOTWIZ0). Note the address of the line
   (0x1A000). The address (0x1A000) is equivalent to 106496 in decimal, and 208 sectors. After you write down the address, quit Hexedit by pressing Ctrl+C.

   
   
   
   
   

5. Use dd to extract the FAT filesystem image.

   
   
   

   dd if=ABR11.5AWUR_en-US.iso of=abr11.bin skip=208

   
   
   

6. Use WinImage to convert the image file (abr11.bin) — actually a FAT filesystem image — to a hard disk image format with MBR.

   
   
   
   
   

   Normally, you can just put the hard disk image on the CD and boot it using isolinux & memdisk.

   
   
   

   LABEL abr11
   MENU LABEL Acronis Backup & Restore 11
   KERNEL memdisk
   INITRD abr11.bin

   
   
   

7. Alternatively, you can mount the image file (abr11.bin) and extract only the kernel and initramfs.

   
   
   

   mount -t msdos -o loop,ro abr11.bin /mnt
   cd /mnt
   cp dat*.dat /boot

   
   
   

   The following is an example boot entry for isolinux that starts 64-bit Acronis Backup & Restore.

   
   
   

   LABEL abr11x
   MENU LABEL Acronis Backup & Restore 11 (64-bit)
   KERNEL dat5.dat
   INITRD dat4.dat
   APPEND video=vesa:mtrr vga=0x317 product=bootagent media_for_windows quiet

   
   
   

   The kernel parameters to put as APPEND string can be taken from the efi/boot/bootx64.xml.

   
   
   

Disk Cloning / Imaging over Network with SSH, Netcat, DD and XZ

Today we have affordable, ample storage and faster bandwidth to facilitate partition imaging and disk cloning over network. Nowadays, it's common and feasible to take the image of a whole partition for various reasons. Compared to file-based backups using tar, disk imaging provides the following advantages.

• The boot sector is preserved so that it's easy to make it bootable after the restore.
  
• Information such as UUID and LABEL is presered, which helps identify the partition in booting and mounting.
  
• Information such as ACL and XATTR is preserved, which helps restrict file access and secure the system.
  
• Every bit in the unused sectors is preserved, which may assist in digital forensics to uncover deleted or hidden information.
  

There are commercial programs for disk imaging and backup (Norton Ghost, Acronis True Image). However, Linux users can use readily available tools to get things done. For disk cloning/imaging, we can use ssh, netcat, dd and xz. Note that dd will fail on physically damaged disks. For such disks, use ddrescue instead.

For security and compression, we are going to use ssh and xz in this tutorial. If you don't like xz, feel free to substitute xz with gzip, bzip2 or lzop. Also, netcat is used to stream the dd output over the network. On Debian and Ubuntu derivatives, you need the following packages.

• bzip2, gzip, lzop, lzma OR xz-utils
  
• dd
  
• netcat
  
• ssh
  

We are making these assumptions in the following scenarios.

• Sending computer S
  
  This computer has IP address 192.168.1.1 and needs to back up partition /dev/sda1.
  
• Sending Port
  
  We'll send using port 5525.
  
• Receiving computer T
  
  This computer has IP address 192.168.1.2 and needs to restore partition /dev/sda2.
  
• Receiving Port
  
  We'll receive at port 7749.
  

Disk Cloning using dd, xz, netcat and ssh

In this scenario, we will clone a disk partition, simultaneously sending an image of the source partition /dev/sda1 from computer S (192.168.1.1) and restoring it at /dev/sda2 on computer T (192.168.1.2). Make sure that the source partition is not mounted or is mounted read-only. Also, make sure that the target partition size is greater than or equal to the source partition size.

1. At the sending computer, compress the source partition /dev/sda1 with xz and set up netcat to send it at port 5525:
   
   

   dd if=/dev/sda1 bs=16M | xz | nc -l 5525

   
   
2. At the receiving computer, set up a SSH tunnel to the sending computer (192.168.1.1):
   
   

   ssh -f -N -L 7749:127.0.0.1:5525 username@192.168.1.1

   
   
3. At the receiving computer, type the following command to receive the partition image and restore it at /dev/sda2:
   
   

   nc 127.0.0.1 7749 | xz -d | dd of=/dev/sda2 bs=16M

   
   

Alternatively, we could take the following steps to achieve the same thing. However, we start at the receiving computer.

1. At the receiving computer with the target partition /dev/sda2, type the following command to receive the partition image:
   
   

   nc -l 7749 | xz -d | dd of=/dev/sda2 bs=16M

   
   
2. At the sending computer with the source partition /dev/sda1, set up a SSH tunnel to the receiving computer (192.168.1.2):
   
   

   ssh -f -N -L 5525:127.0.0.1:7749 username@192.168.1.2

   
   
3. At the sending computer, type the following command to compress the source partition /dev/sda1 and transmit it over the SSH tunnel:
   
   

   dd if=/dev/sda1 bs=16M | xz | nc 127.0.0.1 5525

   
   

   Note that the transfer may take many hours for a large partition.

   
   

Disk Imaging using dd, xz, netcat and ssh

In this scenario, we will just send an image of the source partition /dev/sda1 to the receiving computer T (192.168.1.2) without restoring it. Make sure that the source partition is not mounted or is mounted read-only. A question remains whether to compress the image at the sending or receiving computer. The answer depends on which computer is more powerful. For this example, we'll compress at the sending computer (for network bandwidth reason).

1. At the sending computer, compress the source partition /dev/sda1 with xz and stream it using netcat:
   
   

   dd if=/dev/sda1 bs=16M | xz | nc -l 5525

   
   
2. At the receiving computer, set up a SSH tunnel to the sending computer (192.168.1.1):
   
   

   ssh -f -N -L 7749:127.0.0.1:5525 username@192.168.1.1

   
   
3. At the receiving computer, type the following command to receive the file:
   
   

   nc 127.0.0.1 7749 > partimg.xz

   
   

Alternatively, we could take the following steps to achieve the same thing.

1. At the receiving computer, set up netcat to listen at port 7749 and save the incoming data to a file partimg.xz.
   
   

   nc -l 7749 | dd of=partimg.xz bs=16M

   
   
2. At the sending computer, establish a SSH tunnel to the receiving computer (192.168.1.2) first:
   
   

   ssh -f -N -L 5525:192.168.1.2:7749 username@192.168.1.2

   
   
3. At the sending computer, type the following command to compress the source partition /dev/sda1 and transmit it over the SSH tunnel:
   
   

   dd if=/dev/sda1 bs=16M | xz | nc 127.0.0.1 5525

   
   

   Note that the transfer may take many hours for a large partiiton.

   
   

Alternative Simple Commands for Disk Cloning / Imaging

I don't like these methods for some reason, but here I show the simpler methods where netcat is not needed. For disk cloning, type something like this:

dd if=/dev/sda1 bs=16M | xz | ssh username@192.168.1.2 "xz -d | dd of=/dev/sda2 bs=16M"

Just to send an image file, run a command as follows:

dd if=/dev/sda1 bs=16M | xz | ssh username@192.168.1.2 "dd of=partimg.xz bs=16M"

Also Read:

• Linux: Using dd To Back Up Hard Drive Partitions.
  
• Backing up Hard Disk Partitions in Linux
  

Checking Integrity of A Debian/Ubuntu System

Sometimes, a Linux filesystem becomes corrupted, system files are damaged, or some crucial files get lost. This often happens, regardless of which filesystem (ext2, ext3, ext4, jfs, reiserfs, reiser4, or xfs) is used. There are many possible reasons, such as:

• Unstable hardware, for example, memory or hard drive problem
  
• Overheat, power surge, quake or another environmental disaster
  
• Buggy software, such as a bug in the kernel or the filesystem driver
  
• Compromised security, for example, network intrusion or attack
  
• Worm or virus infection

Files in Linux systems can be categorized into the following three:

1. Verifiable System Files
   
   In Linux systems that are managed by packages (such as Debian and Ubuntu), these files are installed by packages and make up the bulk of the filesystem. These files reside in such directories as /bin, /lib, /sbin and /usr. They are usually static, which means they don't normally change except when the system is updated, or locally compiled binaries are installed.
   
2. Changeable System Files
   
   These files are auxiliary system files for system configuration, initialization or customization, and system data (such as logs and cache). They reside in /boot, /etc, /opt, /srv and /var.
   
3. User Data
   
   These files are created and used by superuser (a.k.a root) and normal users, or software-generated during casual user activities. Typically, they are in /home, /media, /mnt and /root.
   

This post focuses on verifiable system files (installed by packages). When the filesystem becomes corrupted (but not completely unreadable), it is possible to verify and restore the system integrity by using package checksums. Before you continue, make sure to fsck the filesystem.

e2fsck -r -v /dev/sda7

In this example, /dev/sda7 points to an ext2 partition we're going to check. Be aware that you cannot fsck a mounted filesystem. Therefore, boot with a Debian Live CD (or a Ubuntu CD) and run fsck. After you've performed fsck, there may be some files created in the /lost+found directory. We'll deal with them later. First, mount the filesystem.

mount -t ext2 /dev/sda7 /mnt

Go to /var/lib/dpkg/info. Then, concatenate all the md5sums files. Most, if not all, Debian and Ubuntu packages come with a md5sum file that we can use to check the integrity of the package and the files installed by the package.

cd /var/lib/dpkg/info
cat *.md5sums | sort > /dev/shm/all.md5

all.md5 has md5 checksums of all the files installed on the system. Now, check the files on the Debian/Ubuntu system against the concatenated md5sums file.

cd /
md5sum -c /dev/shm/all.md5 > /dev/shm/check.txt 2>&1

/dev/shm/check.txt now contains the results of the integrity check. It looks like this:

bin/bash: OK
bin/bunzip2: OK
bin/bzcat: FAILED

In this example, /bin/bzcat is damaged. To find all the missing or damaged files, use a command like this one:

grep -v ': OK$' /dev/shm/check.txt

Let's reinstall this file. First, find out which package this file belongs to.

dpkg -S /bin/bzcat

We'll see the following result.

bzip2: /bin/bzcat

Now we know that we need to reinstall bzip2. Let's download the package.

dpkg -p bzip2 | grep 'Filename: '

This command will let us know the name of the package to download. Use wget to download it.

wget ftp://ftp.us.debian.org/debian/pool/main/b/bzip2/bzip2_1.0.5-4_i386.deb

You can just reinstall the package.

dpkg -i bzip2_1.0.5-4_i386.deb

Or, you can just extract one file:

dpkg --fsys-tarfile bzip2_1.0.5-4_i386.deb | tar xf - ./bin/bzcat

Alternatively,

dpkg --fsys-tarfile bzip2_1.0.5-4_i386.deb | tar xOf - ./bin/bzcat > /mnt/bin/bzcat

To restore a file from the /lost+found directory, you can also use the MD5SUMS file. First, run md5sum on files in /lost+found.

cd /lost+found
md5sum *

You may get an output like this.

9aaa2176d20c1b1203e3abbac55a2513  #124531

To find out what #124531 file is originally, find its md5 checksum from the all.md5 file above.

grep 9aaa /dev/shm/all.md5

You'll get a result like this.

9aaa2176d20c1b1203e3abbac55a2513  bin/bzip2

Now you can just move it to its place.

mv \#124531 /mnt/bin/bzip2

After you restore all damaged files and restore files from /lost+found, you can find missing files in the system. Go to /var/lib/dpkg/info again and concatenate all the list files.

cd /var/lib/dpkg/info
cat *.list | sort | uniq > /dev/shm/all.txt

The .list files in the /var/lib/dpkg/info directore show the list of files installed by packages. Let's find what's missing from the system.

cd /
for f in $(cat /dev/shm/all.txt ); do test -e "$f" || echo "$f" >> /dev/shm/nonexist.txt ; done

The file /dev/shm/nonexist.txt will show which files are missing from the system. You can then replace the missing files as done previously.

Linux: Using dd To Back Up Hard Drive Partitions

I am going to use the omnipresent and omnipotent tool called dd to back up a hard drive partition. I am working with the drive /dev/sdb. First, I save a text file that has information on the partition table layout.

fdisk -l /dev/sdb > hdpt.txt
fdisk -l -u /dev/sdb >> hdpt.txt

Then, I choose the compression format to use for the backup archive.

• gzip
  
• bzip2
  
• lzma
  
• xz

My choice for the compression format is lzma which provides superior compression and faster decompression. The following command backs up a partition at /dev/sdb1 with dd and lzma.

dd if=/dev/sdb1 | lzma -9c > backup01.bin.lzma

To restore this backup later, use the following command:

lzcat backup01.bin.lzma | dd of=/dev/sdb1

Linux Commands To Partition and Format a Drive

Partitioning

In addition to the wonderful gparted, we can also use fdisk to partition a disk:

fdisk /dev/sdb

The device names for hard disks and USB drives are typically /dev/sd?, for example, /dev/sda, /dev/sdb, /dev/sdc, etc. For Linux kernels 2.6.18 or older, IDE hard drives may be called /dev/hda, /dev/hdb, etc.

Formatting

To format a FAT16 partition:

mkdosfs -F 16 -n LABEL -r 512 -v /dev/sdb1

To format EXT2 partition:

mke2fs -L SID -v /dev/sdb2

To format a JFS partition:

jfs_mkfs -c -L Debian_Sid /dev/sdb2

Installing MBR

MBR is a boot code necessary for booting from the hard drive or USB flash.

install-mbr /dev/sdb -v --drive 0x80 --enable +12

Installing bootloaders

For SYSLINUX:

syslinux /dev/sdb1

Checking Filesystem Integrity

For FAT16/FAT32:

dosfsck -r -v -V /dev/sdb1

Tweaking Windows Vista for Slow PC

Is Windows Vista only for fast and powerful computers? Not really. Technically, Vista can run on old computers with a CPU as slow as 800MHz. But Vista runs sluggish on old computers. For those old and slow computers, there are some ways to improve the speed of Vista, as explained below.

Stop unnecessary programs from running or starting.

Don't use the Windows Sidebar. This program is unnecessary and graphics-intensive program that slows your computer down. You can easily disable it from starting.

Disable UAC

Disabling UAC may dramatically speed up Windows Vista.

Disable Windows Theme

If you don't need fancy Windows themes, you can change your theme to a plain one or disable the Themes service altogether.