Table of contents for No. 191 in Linux User & Developer

Welcome to the UK and North America’s favourite Linux and open source magazine. It’s been another fascinating month in the open source world. Of course, Ubuntu 18.04 LTS has landed, but we’ve also seen strong open source advocate Nextcloud snag a seven-figure deal to supply the German federal government with a private Bundescloud for 300,000 civil servants. Then Microsoft floored a lot of people by revealing an entirely Linux-based OS for a microcontroller it is touting for IoT devices. The Linux Foundation’s Jim Zemlin describes Microsoft’s Linux usage as the “new normal” – and we shouldn’t be surprised, plenty of companies now use Linux and FOSS when it makes money and practical sense. To that end we turn to our main feature this month, where we’ll show you how to…

Vagrant’s native support for Oracle VirtualBox is not your only option for using it. Thanks to community plug-in support and code contributions, it’s also possible to use other providers. This is particularly useful in enterprise settings where you might already be running something more scalable like OpenStack or VMware vSphere. As an example, you can use Docker as a provider for your Vagrant configurations on Linux hosts just as easily as you would VirtualBox. The only difference is the exact set of commands you would use to do that in your Vagrantfile: This tells Vagrant to use Docker as a provider, and then instructs that provider to build a container from the Dockerfile you’ve provided. To directly download a container image and run it, replace d.build_dir with: In both cases…

Resources Post exploitation repository http://bit.ly/lud_postexp Metasploit local exploit suggester http://bit.ly/lud_suggest LinEnum http://bit.ly/lud_linenum Linux exploit suggester http://bit.ly/lud_suggest2 Exploit database http://bit.ly/lud_exploit Vulners scanner http://bit.ly/lud_vulners Lynis https://cisofy.com So far our tutorials in this series have been dealing with different techniques to find and exploit well-known vulnerabilities in order to get a foothold into a system. Most of the time, however, that initial foothold won’t get you a root shell. That’s because some of these services may run using a non-privileged user account (for example, Apache’s ‘www-data’ user). As a pen-tester, your next step is obvious: to escalate privileges, or priv esc. To some, priv esc is kind of an art, and we agree. Whatever your thoughts about it, priv esc can be achieved by abusing misconfigured services,…

• Desktop Ubuntu 18.04 ditches the Unity desktop and brings GNOME on X.Org to LTS for the first time in a long time. • Server The Server release of Bionic Beaver sports a much-improved installer and a new, smaller ISO file for a minimal install option. • Cloud The latest Ubuntu release offers tighter integration with Canonical’s cloud offerings and a simplified deployment process. • Containers As well as a new release of LXD, Ubuntu continues to offer support for Kubernetes and Docker on public, private, hybrid or bare-metal clouds. • Core/IoT/Robotics Ubuntu is experiencing huge growth in the areas of IoT players and robotics, making use of Canonical’s investment in the snap ecosystem.…

1 Create a key to sign uploads Before starting to build the image, you need to create a key to sign future store uploads. Generate a key that will be linked to your Ubuntu Store account with snapcraft create-key. Confirm the key with snapcraft list-keys. 2 Register with Ubuntu Store Next, you have to register your key with the Ubuntu Store, linking it to your account. You will be asked to login with your store account credentials – use the command snapcraft register-key to start the process. 3 Create a model assertion To build an image, you need to create a model assertion. This is a JSON file which contains a description of your device with fields such as model, architecture, kernel and so on. Base this on an existing…

Keyboard warriors who love the command line can now even beat their media library into shape with beets. In addition to managing music libraries, beets can fix the filenames and metadata of your music collection, fetch cover art and lyrics, transcode audio to different formats, and do a lot more. While Beets is available in the repositories of popular distributions, you should install the latest version using Python’s pip package manager using pip install beets. You’ll need to spend some time creating a configuration file for the utility. Once created, beets will import your music files and sort them as per the instructions in the configuration file. During import, the utility also fixes and fills in any gaps in the metadata by referencing the online MusicBrainz database. Once the files…

Top 10 (Average hits per day, 30 days to 6 April 2018) This month •• In development (4) •• Stable releases (22) BSD operating systems have recently seen a renaissance, with FreeBSD-based TrueOS hovering in the top 10 and other options in the top 100 Highlights TrueOS TrueOS prides itself on being easy to install, with a graphical installation system and a good number of pre-configured desktop environments. OpenBSD Security-focused, OpenBSD 6.3 features ISO support in the virtual machine daemon, updates to LibreSSL and OpenSSH, and SMP for ARM64 systems. NetBSD This popular implementation of the Berkeley Software Distribution is a lightweight OS designed to work on a wide range of hardware platforms. Latest distros available: filesilo.co.uk…

Puppet’s main function is to manage configuration for Linux and Windows boxes across the network by slaving their settings to a common ‘master’ configuration called a ‘catalogue’. The key benefit of this is that you can set common configurations for your servers in one place rather than having to do it manually on each server. “This should (in theory) mean fewer hard-to-troubleshoot typos and confusing log messages” This should, in theory, mean fewer hard-to-troubleshoot typos and confusing log messages being caused by bad configuration values. However, Puppet takes this a step further by enabling you to define settings for smaller clusters of servers or even individual boxes from that same master server. As long as the slave is running the supplied agent software, and it has synced with the master…

1 Create your account Visit https://app.any.run/#register and create a new account, with any email address you like. Using the free plan only gives you access to a Windows 7 32-bit sandbox. 2 Upload your malicious binary to the sandbox Grab your malicious program and send it to the sandbox. You can use the New Task icon on the left (+) to upload a local file, or you can paste an URL holding the binary. Only files up to 16MB are allowed. 3 Let it run Wait for a while until the sandbox is ready. The system will start gathering some useful information about the program: network connections, registry changes, malicious behaviour, and so on. You are free to interact with the system at any time. 4 Have a look at…

KUBUNTU Kubuntu brings KDE Plasma to Ubuntu, providing an alternative high-end desktop environment If you’re switching to Ubuntu 18.04 from the last LTS release, you’re going to change your desktop environment anyway, so what about trying KDE? The Qt-based desktop is fast, beautiful and quite a different option! LUBUNTU Lubuntu is a more lightweight version of Ubuntu, running the LXDE desktop environment If you’re running Ubuntu on lower-spec hardware – perhaps even a Raspberry Pi – the light but fully featured Lubuntu may be worth a look. Unlike the main flavour, 32-bit images are still available. XUBUNTU Xubuntu provides another lightweight alternative, using the Xfce desktop environment Like Lubuntu, Xubuntu focuses on running well on modest hardware, but has all the applications pre-installed to get you up and running right…

1 Install Docker Find instructions on how to configure your package manager and install both the Docker daemon and client app at http://bit.ly/lud_install. If this doesn’t work you could also try installing the binaries from http://bit.ly/lud_binaries. 2 Set up Docker Compose This is a helpful tool for creating applications that span multiple containers, such as a website that’s split into a webserver, database and content hosting components. See http://bit.ly/lud_compose for installation details. 3 Create a container Pull down a new container, verify it’s installed and run it with: 4 Check container status You can view all the currently installed container types using docker images. To get more useful information such as which containers are running and what they’re up to, you should try: $ docker ps -a. 5 Access your…

The most straightforward way to get Ansible up and running is by installing it through through the pip package manager distributed with Python. However, you can also install it through your distro’s package manager. Unfortunately the latest version won’t be in the main channels by default, so there’s a little extra legwork to do. RHEL 7 users need to enable the Extras repository before Ansible can be installed through yum, while older versions will need you to enable EPEL. Meanwhile, Ubuntu users can install the latest package from the project’s PPA; just run the following command to add that:…

Rust, in a nutshell, is a safe C. Developed in the last 10-12 years under the sponsorship of Mozilla, it quickly took on a number of safety features that are directly useful within software engineering projects. At its heart, it’s a systems programming language just as C is, but it combines low-level access to the machine with elegant features, such as strong typing and ownership, that help Rust programmers avoid bugs and memory leaks much more effectively than they could in C – or in similar languages such as C++. Today, Rust is hugely popular, owing to its elegance and robustness. In fact, it was named the most-loved language in the Stack Overflow developer survey in 2016, 2017 and 2018. Getting started We’ll assume that you know a bit about…

Most file managers have a find function to help you search for files. But these lack powerful filtering mechanisms such as regular expressions that are usually only available on the command line. Searchmonkey JAVA is a graphical tool that bridges the gap between the basic functions of file managers and powerful CLI tools by bringing a feature-rich regular-expression builder to the desktop. You can use Searchmonkey to easily construct a complex search query with little effort. It can help you search for files by their size, type, creation, modification and last-accessed date. You can also search for files recursively, and the app enables you to control how many subfolders it should look into. The Option tab houses other advanced search options such as the option to skip binary files and…

“Netcetera is one of Europe’s leading Web Hosting service providers, with customers in over 75 countries worldwide” Featured host: www.netcetera.co.uk03330 439780 About us Formed in 1996, Netcetera is one of Europe’s leading web hosting service providers, with customers in over 75 countries worldwide. It is a leading IT infrastructure provider offering co-location, dedicated servers and managed infrastructure services to businesses worldwide. What we offer Managed Hosting A full range of solutions for a cost-effective, reliable, secure host Dedicated Servers Single server through to a full racks with FREE setup and a generous bandwidth allowance Cloud Hosting Linux, Windows, hybrid and private cloud solutions with support and scaleability features Datacentre co-location from quad-core up to smart servers, with quick setup and full customisation Supreme hosting www.cwcs.co.uk0800 1 777 000 CWCS…