Chapter 9. System tips

Table of Contents

9.1. The screen program
9.1.1. The use scenario for screen(1)
9.1.2. Key bindings for the screen command
9.2. Data recording and presentation
9.2.1. The log daemon
9.2.2. Log analyzer
9.2.3. Recording the shell activities cleanly
9.2.4. Customized display of text data
9.2.5. Customized display of time and date
9.2.6. Colorized shell echo
9.2.7. Colorized commands
9.2.8. Recording the editor activities for complex repeats
9.2.9. Recording the graphic image of an X application
9.2.10. Recording changes in configuration files
9.3. Data storage tips
9.3.1. Disk space usage
9.3.2. Disk partition configuration
9.3.3. Accessing partition using UUID
9.3.4. Filesystem configuration
9.3.5. Filesystem creation and integrity check
9.3.6. Optimization of filesystem by mount options
9.3.7. Optimization of filesystem via superblock
9.3.8. Optimization of hard disk
9.3.9. Optimization of solid state drive
9.3.10. Using SMART to predict hard disk failure
9.3.11. Expansion of usable storage space via LVM
9.3.12. Expansion of usable storage space by mounting another partition
9.3.13. Expansion of usable storage space by bind-mounting another directory
9.3.14. Expansion of usable storage space using symlink
9.3.15. Expansion of usable storage space using aufs
9.4. Data encryption tips
9.4.1. Removable disk encryption with dm-crypt/LUKS
9.4.2. Encrypted swap partition with dm-crypt
9.4.3. Automatically encrypting files with eCryptfs
9.4.4. Automatically mounting eCryptfs
9.5. Monitoring, controlling, and starting program activities
9.5.1. Timing a process
9.5.2. The scheduling priority
9.5.3. The ps command
9.5.4. The top command
9.5.5. Listing files opened by a process
9.5.6. Tracing program activities
9.5.7. Identification of processes using files or sockets
9.5.8. Repeating a command with a constant interval
9.5.9. Repeating a command looping over files
9.5.10. Starting a program from GUI
9.5.11. Customizing program to be started
9.5.12. Killing a process
9.5.13. Scheduling tasks once
9.5.14. Scheduling tasks regularly
9.5.15. Alt-SysRq key
9.6. System maintenance tips
9.6.1. Who is on the system?
9.6.2. Warning everyone
9.6.3. Hardware identification
9.6.4. Hardware configuration
9.6.5. System and hardware time
9.6.6. The terminal configuration
9.6.7. The sound infrastructure
9.6.8. Disabling the screen saver
9.6.9. Disabling beep sounds
9.6.10. Memory usage
9.6.11. System security and integrity check
9.7. The kernel
9.7.1. Linux kernel 2.6
9.7.2. Kernel parameters
9.7.3. Kernel headers
9.7.4. Compiling the kernel and related modules
9.7.5. Compiling the kernel source: Debian Kernel Team recommendation
9.7.6. Non-free hardware drivers
9.8. Virtualized system
9.8.1. Virtualization tools
9.8.2. Virtualization work flow
9.8.3. Mounting the virtual disk image file
9.8.4. Chroot system
9.8.5. Multiple desktop systems

Here, I describe basic tips to configure and manage systems, mostly from the console.

9.1. The screen program

screen(1) is a very useful tool for people to access remote sites via unreliable or intermittent connections since it support interrupted network connections.

Table 9.1. List of programs to support interrupted network connections

package popcon size description
screen 952 terminal multiplexer with VT100/ANSI terminal emulation

9.1.1. The use scenario for screen(1)

screen(1) not only allows one terminal window to work with multiple processes, but also allows remote shell process to survive interrupted connections. Here is a typical use scenario of screen(1).

  1. You login to a remote machine.

  2. You start screen on a single console.

  3. You execute multiple programs in screen windows created with ^A c ("Control-A" followed by "c").

  4. You switch among the multiple screen windows by ^A n ("Control-A" followed by "n").

  5. Suddenly you need to leave your terminal, but you don't want to lose your active work by keeping the connection.

  6. You may detach the screen session by any methods.

    • Brutally unplug your network connection

    • Type ^A d ("Control-A" followed by "d") and manually logging out from the remote connection

    • Type ^A DD ("Control-A" followed by "DD") to have screen detach and log you out

  7. You log in again to the same remote machine (even from a different terminal).

  8. You start screen as "screen -r".

  9. screen magically reattaches all previous screen windows with all actively running programs.

[Tip] Tip

You can save connection fees with screen for metered network connections such as dial-up and packet ones, because you can leave a process active while disconnected, and then re-attach it later when you connect again.

9.1.2. Key bindings for the screen command

In a screen session, all keyboard inputs are sent to your current window except for the command keystroke. All screen command keystrokes are entered by typing ^A ("Control-A") plus a single key [plus any parameters]. Here are important ones to remember.

Table 9.2. List of key bindings for screen

key binding meaning
^A ? show a help screen (display key bindings)
^A c create a new window and switch to it
^A n go to next window
^A p go to previous window
^A 0 go to window number 0
^A 1 go to window number 1
^A w show a list of windows
^A a send a Ctrl-A to current window as keyboard input
^A h write a hardcopy of current window to file
^A H begin/end logging current window to file
^A ^X lock the terminal (password protected)
^A d detach screen session from the terminal
^A DD detach screen session and log out

See screen(1) for details.

9.2. Data recording and presentation

9.2.1. The log daemon

Many programs record their activities under the "/var/log/" directory.

  • The kernel log daemon: klogd(8)

  • The system log daemon: rsyslogd(8)

See Section 3.5.9, “The system message” and Section 3.5.10, “The kernel message”.

9.2.2. Log analyzer

Here are notable log analyzers ("~Gsecurity::log-analyzer" in aptitude(8)).

Table 9.3. List of system log analyzers

package popcon size description
logwatch 2018 log analyzer with nice output written in Perl
fail2ban 414 ban IPs that cause multiple authentication errors
analog 3187 web server log analyzer
awstats 3101 powerful and featureful web server log analyzer
sarg 921 squid analysis report generator
pflogsumm 133 Postfix log entry summarizer
syslog-summary 84 summarize the contents of a syslog log file
lire 5040 full-featured log analyzer and report generator
fwlogwatch 440 firewall log analyzer
squidview 193 monitor and analyze squid access.log files
visitors 293 fast web server log analyzer
swatch 112 log file viewer with regexp matching, highlighting, and hooks
crm114 1065 Controllable Regex Mutilator and Spam Filter (CRM114)
icmpinfo 84 interpret ICMP messages

[Note] Note

CRM114 provides language infrastructure to write fuzzy filters with the TRE regex library. Its popular use is spam mail filter but it can be used as log analyzer.

9.2.3. Recording the shell activities cleanly

The simple use of script(1) (see Section 1.4.9, “Recording the shell activities”) to record shell activity produces a file with control characters. This can be avoided by using col(1) as the following.

$ script
Script started, file is typescript

Do whatever … and press Ctrl-D to exit script.

$ col -bx <typescript >cleanedfile
$ vim cleanedfile

If you don't have script (for example, during the boot process in the initramfs), you can use following instead.

$ sh -i 2>&1 | tee typescript
[Tip] Tip

Some x-terminal-emulator such as gnome-terminal can record. You may wish to extend line buffer for scrollback.

[Tip] Tip

You may use screen(1) with "^A H" (see Section 9.1.2, “Key bindings for the screen command”) to perform recording of console.

[Tip] Tip

You may use emacs(1) with "M-x shell", "M-x eshell", or "M-x term" to perform recording of console. You may later use "C-x C-w" to write the buffer to a file.

9.2.4. Customized display of text data

Although pager tools such as more(1) and less(1) (see Section 1.4.5, “The pager”) and custom tools for highlighting and formatting (see Section 11.1.8, “Highlighting and formatting plain text data”) can display text data nicely, general purpose editors (see Section 1.4.6, “The text editor”) are most versatile and customizable.

[Tip] Tip

For vim(1) and its pager mode alias view(1), ":set hls" enables highlighted search.

9.2.5. Customized display of time and date

The default display format of time and date by the "ls -l" command depends on the locale (see Section 1.2.6, “Timestamps” for value). The "$LANG" variable is referred first and it can be overridden by the "$LC_TIME" variable.

The actual default display format for each locale depends on the version of the standard C library (the libc6 package) used. I.e., different releases of Debian had different defaults.

If you really wish to customize this display format of time and date beyond the locale, you should set the time style value by the "--time-style" argument or by the "$TIME_STYLE" value (see ls(1), date(1), "info coreutils 'ls invocation'").

Table 9.4. Display examples of time and date for the "ls -l" command for lenny

time style value locale display of time and date
iso any 01-19 00:15
long-iso any 2009-01-19 00:15
full-iso any 2009-01-19 00:15:16.000000000 +0900
locale C Jan 19 00:15
locale en_US.UTF-8 2009-01-19 00:15
locale es_ES.UTF-8 ene 19 00:15
+%d.%m.%y %H:%M any 19.01.09 00:15
+%d.%b.%y %H:%M C or en_US.UTF-8 19.Jan.09 00:15
+%d.%b.%y %H:%M es_ES.UTF-8 19.ene.09 00:15

[Tip] Tip

You can eliminate typing long option on commandline using command alias, e.g. "alias ls='ls --time-style=+%d.%m.%y\ %H:%M'" (see Section 1.5.9, “Command alias”).

[Tip] Tip

ISO 8601 is followed for these iso-formats.

9.2.6. Colorized shell echo

Shell echo to most modern terminals can be colorized using ANSI escape code (see "/usr/share/doc/xterm/ctlseqs.txt.gz").

For example, try the following

$ RED=$(printf "\x1b[31m")
$ NORMAL=$(printf "\x1b[0m")
$ REVERSE=$(printf "\x1b[7m")

9.2.7. Colorized commands

Colorized commands are handy for inspecting their output in the interactive environment. I include the following in my "~/.bashrc".

if [ "$TERM" != "dumb" ]; then
    eval "`dircolors -b`"
    alias ls='ls --color=always'
    alias ll='ls --color=always -l'
    alias la='ls --color=always -A'
    alias less='less -R'
    alias ls='ls --color=always'
    alias grep='grep --color=always'
    alias egrep='egrep --color=always'
    alias fgrep='fgrep --color=always'
    alias zgrep='zgrep --color=always'
    alias ll='ls -l'
    alias la='ls -A'

The use of alias limits color effects to the interactive command usage. It has advantage over exporting environment variable "export GREP_OPTIONS='--color=auto'" since color can be seen under pager programs such as less(1). If you wish to suppress color when piping to other programs, use "--color=auto" instead in the above example for "~/.bashrc".

[Tip] Tip

You can turn off these colorizing aliases in the interactive environment by invoking shell with "TERM=dumb bash".

9.2.8. Recording the editor activities for complex repeats

You can record the editor activities for complex repeats.

For Vim, as follows.

  • "qa": start recording typed characters into named register "a".

  • … editor activities

  • "q": end recording typed characters.

  • "@a": execute the contents of register "a".

For Emacs, as follows.

  • "C-x (": start defining a keyboard macro.

  • … editor activities

  • "C-x )": end defining a keyboard macro.

  • "C-x e": execute a keyboard macro.

9.2.9. Recording the graphic image of an X application

There are few ways to record the graphic image of an X application, including an xterm display.

9.2.10. Recording changes in configuration files

There are specialized tools to record changes in configuration files with help of DVCS system.

Table 9.6. List of packages to record configuration history in VCS

package popcon size description
etckeeper 242 store configuration files and their metadata with Git (default), Mercurial, or Bazaar (new)
changetrack 148 store configuration files with RCS (old)

I recommend to use the etckeeper package with git(1) which put entire "/etc" under VCS control. Its installation guide and tutorial are found in "/usr/share/doc/etckeeper/README.gz".

Essentially, running "sudo etckeeper init" initializes the git repository for "/etc" just like the process explained in Section 10.9.5, “Git for recording configuration history” but with special hook scripts for more thorough setups.

As you change your configuration, you can use git(1) normally to record them. It automatically records changes nicely every time you run package management commands, too.

[Tip] Tip

You can browse the change history of "/etc" by executing "sudo GIT_DIR=/etc/.git gitk" with clear view for new installed packages, removed packages, and version changes of packages.

9.3. Data storage tips

Booting your system with Linux live CDs or debian-installer CDs in rescue mode make it easy for you to reconfigure data storage on your boot device. See also Section 10.3, “The binary data”.

9.3.1. Disk space usage

The disk space usage can be evaluated by programs provided by the mount, coreutils, and xdu packages:

  • mount(8) reports all mounted filesystems (= disks).

  • df(1) reports the disk space usage for the file system.

  • du(1) reports the disk space usage for the directory tree.

[Tip] Tip

You can feed the output of du(8) to xdu(1x) to produce its graphical and interactive presentation with "du -k . |xdu", "sudo du -k -x / |xdu", etc.

9.3.2. Disk partition configuration

For disk partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.

Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).

[Note] Note

Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector.

Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.

Table 9.7. List of disk partition management packages

package popcon size GPT description
util-linux 1593 Not supported miscellaneous system utilities including fdisk(8) and cfdisk(8)
parted 262 Supported GNU Parted disk partition resizing program
gparted 5074 Supported GNOME partition editor based on libparted
gnu-fdisk 215 Supported GNU replacements of console fdisk(8), cfdisk(8), etc.
gdisk 636 Supported partition editor for the GPT disk
gptsync 72 Supported synchronize classic MBR partition table with the GPT one
kpartx 104 Supported program to create device mappings for partitions

[Caution] Caution

Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), …) and resize2fs(8).

[Note] Note

In order to switch between GPT and MBR, you need to erase first few blocks of disk contents directly (see Section 10.3.6, “Clearing file contents”) and use "parted /dev/sdx mklabel gpt" or "parted /dev/sdx mklabel msdos" to set it. Please note "msdos" is use here for MBR.

9.3.3. Accessing partition using UUID

Although reconfiguration of your partition or activation order of removable storage media may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.

[Tip] Tip

You can probe UUID of a block special device with blkid(8).

[Tip] Tip

Device nodes of devices such as removable storage media can be made static by using udev rules, if needed. See Section 3.5.11, “The udev system”.

9.3.4. Filesystem configuration

For ext3 filesystem, the e2fsprogs package provides the following.

  • mkfs.ext3(8) to create new ext3 filesystem

  • fsck.ext3(8) to check and to repair existing ext3 filesystem

  • tune2fs(8) to configure superblock of ext3 filesystem

The mkfs(8) and fsck(8) commands are provided by the e2fsprogs package as front-ends to various filesystem dependent programs (mkfs.fstype and fsck.fstype). For ext3 filesystem, they are mkfs.ext3(8) and fsck.ext3(8) (they are hardlinked to mke2fs(8) and e2fsck(8)).

Similar commands are available for each filesystem supported by Linux.

Table 9.8. List of filesystem management packages

package popcon size description
e2fsprogs 2233 utilities for the ext2/ext3/ext4 filesystems
reiserfsprogs 1200 utilities for the Reiserfs filesystem
dosfstools 162 utilities for the FAT filesystem. (Microsoft: MS-DOS, Windows)
xfsprogs 3135 utilities for the XFS filesystem. (SGI: IRIX)
ntfsprogs 41 utilities for the NTFS filesystem. (Microsoft: Windows NT, …)
jfsutils 1024 utilities for the JFS filesystem. (IBM: AIX, OS/2)
reiser4progs 1296 utilities for the Reiser4 filesystem
hfsprogs 317 utilities for HFS and HFS Plus filesystem. (Apple: Mac OS)
btrfs-tools 2061 utilities for the Btrfs filesystem
zerofree 47 program to zero free blocks from ext2/3 filesystems

[Tip] Tip

Ext4 filesystem is the default filesystem for the Linux system and strongly recommended to use it unless you have some specific reasons not to.

[Tip] Tip

Btrfs filesystem is available in Linux kernel 3.2 (Debian wheezy). It is expected to be the next default filesystem after the ext4 filesystem.

[Warning] Warning

You should not use the Btrfs filesystem for your critical data yet before it aquires the live kernel space fsck(8) feature and the boot loader support.

[Tip] Tip

Some tools allow access to filesystem without Linux kernel support (see Section 10.3.2, “Manipulating files without mounting disk”).

9.3.5. Filesystem creation and integrity check

The mkfs(8) command creates the filesystem on a Linux system. The fsck(8) command provides the filesystem integrity check and repair on a Linux system.

[Caution] Caution

It is generally not safe to run fsck on mounted filesystems.

[Tip] Tip

Check files in "/var/log/fsck/" for the result of the fsck(8) command run from the boot script.

[Tip] Tip

Use "shutdown -F -r now" to force to run the fsck(8) command safely on all filesystems including root filesystem on reboot. See the shutdown(8) manpage for more.

9.3.6. Optimization of filesystem by mount options

Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). Notable ones are the following.

  • "defaults" option implies default options: "rw,suid,dev,exec,auto,nouser,async". (general)

  • "noatime" or "relatime" option is very effective for speeding up the read access. (general)

  • "user" option allows an ordinary user to mount the filesystem. This option implies "noexec,nosuid,nodev" option combination. (general, used for CD and floppy)

  • "noexec,nodev,nosuid" option combination is used to enhance security. (general)

  • "noauto" option limits mounting by explicit operation only. (general)

  • "data=journal" option for ext3fs can enhance data integrity against power failure with some loss of write speed.

[Tip] Tip

You need to provide kernel boot parameter (see Section 3.3, “Stage 2: the boot loader”), e.g. "rootflags=data=journal" to deploy a non-default journaling mode for the root filesystem. For lenny, the default jounaling mode is "rootflags=data=ordered". For squeeze, it is "rootflags=data=writeback".

9.3.7. Optimization of filesystem via superblock

Characteristics of a filesystem can be optimized via its superblock using the tune2fs(8) command.

  • Execution of "sudo tune2fs -l /dev/hda1" displays the contents of the filesystem superblock on "/dev/hda1".

  • Execution of "sudo tune2fs -c 50 /dev/hda1" changes frequency of filesystem checks (fsck execution during boot-up) to every 50 boots on "/dev/hda1".

  • Execution of "sudo tune2fs -j /dev/hda1" adds journaling capability to the filesystem, i.e. filesystem conversion from ext2 to ext3 on "/dev/hda1". (Do this on the unmounted filesystem.)

  • Execution of "sudo tune2fs -O extents,uninit_bg,dir_index /dev/hda1 && fsck -pf /dev/hda1" converts it from ext3 to ext4 on "/dev/hda1". (Do this on the unmounted filesystem.)

[Warning] Warning

Filesystem conversion for the boot device to the ext4 filesystem should be avoided until GRUB boot loader supports the ext4 filesystem well and installed Linux Kernel version is newer than 2.6.30.

[Tip] Tip

Despite its name, tune2fs(8) works not only on the ext2 filesystem but also on the ext3 and ext4 filesystems.

9.3.8. Optimization of hard disk

[Warning] Warning

Please check your hardware and read manpage of hdparam(8) before playing with hard disk configuration because this may be quite dangerous for the data integrity.

You can test disk access speed of a hard disk, e.g. "/dev/hda", by "hdparm -tT /dev/hda". For some hard disk connected with (E)IDE, you can speed it up with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda" by enabling the "(E)IDE 32-bit I/O support", enabling the "using_dma flag", setting "interrupt-unmask flag", and setting the "multiple 16 sector I/O" (dangerous!).

You can test write cache feature of a hard disk, e.g. "/dev/sda", by "hdparm -W /dev/sda". You can disable its write cache feature with "hdparm -W 0 /dev/sda".

You may be able to read badly pressed CDROMs on modern high speed CD-ROM drive by slowing it down with "setcd -x 2".

9.3.9. Optimization of solid state drive

Performance and disk wear of the solid state drive (SSD) can be optimized as follows.

  • Use the latest Linux kernel. (>= 3.2)

  • Reduce disk writes for read disk accesses.

    • Set "noatime" or "relatime" mount option in /etc/fstab.

  • Enable the TRIM command.

    • Set "discard" mount option in /etc/fstab for the ext4 filesystem, swap partition, Btrfs, etc. See fstab(5).

    • Set "discard" option in /etc/lvm/lvm.conf for LVM. See lvm.conf(5).

    • Set "discard" option in /etc/crypttab for dm-crypt. See crypttab(5).

  • Enable the SSD optimized disk space allocation scheme.

    • Set "ssd" mount option in /etc/fstab for the Btrfs.

  • Make system flush data to the disk every 10 minutes for laptop PCs.

    • Set "commit=600" mount option in /etc/fstab. See fstab(5).

    • Set pm-utils to use laptop-mode even under AC operation. See Debian BTS #659260.

[Warning] Warning

Changing flushing interval from normal 5 seconds to 10 minutes makes your data venerable to the power failure.

9.3.10. Using SMART to predict hard disk failure

You can monitor and log your hard disk which is compliant to SMART with the smartd(8) daemon.

  1. Enable SMART feature in BIOS.

  2. Install the smartmontools package.

  3. Identify your hard disk drives by listing them with df(1).

    • Let's assume a hard disk drive to be monitored as "/dev/hda".

  4. Check the output of "smartctl -a /dev/hda" to see if SMART feature is actually enabled.

    • If not, enable it by "smartctl -s on -a /dev/hda".

  5. Enable smartd(8) daemon to run by the following.

    • uncomment "start_smartd=yes" in the "/etc/default/smartmontools" file.

    • restart the smartd(8) daemon by "sudo /etc/init.d/smartmontools restart".

[Tip] Tip

The smartd(8) daemon can be customized with the /etc/smartd.conf file including how to be notified of warnings.

9.3.11. Expansion of usable storage space via LVM

For partitions created on Logical Volume Manager (LVM) (Linux feature) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.

[Caution] Caution

Deployment of the current LVM system may degrade guarantee against filesystem corruption offered by journaled filesystems such as ext3fs unless their system performance is sacrificed by disabling write cache of hard disk.

9.3.12. Expansion of usable storage space by mounting another partition

If you have an empty partition (e.g., "/dev/sdx"), you can format it with mkfs.ext3(1) and mount(8) it to a directory where you need more space. (You need to copy original data contents.)

$ sudo mv work-dir old-dir
$ sudo mkfs.ext3 /dev/sdx
$ sudo mount -t ext3 /dev/sdx work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir
[Tip] Tip

You may alternatively mount an empty disk image file (see Section 10.2.5, “Making the empty disk image file”) as a loop device (see Section 10.2.3, “Mounting the disk image file”). The actual disk usage grows with the actual data stored.

9.3.13. Expansion of usable storage space by bind-mounting another directory

If you have an empty directory (e.g., "/path/to/emp-dir") on another partition with usable space, you can mount(8) it with "--bind" option to a directory (e.g., "work-dir") where you need more space.

$ sudo mount --bind /path/to/emp-dir work-dir

9.3.14. Expansion of usable storage space using symlink

[Tip] Tip

This is a deprecated method. Use Section 9.3.13, “Expansion of usable storage space by bind-mounting another directory” instead, if possible.

If you have an empty directory (e.g., "/path/to/emp-dir") in another partition with usable space, you can create a symlink to the directory with ln(8).

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo ln -sf /path/to/emp-dir work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir
[Warning] Warning

Do not use "symlink to a directory" for directories managed by the system such as "/opt". Such a symlink may be overwritten when the system is upgraded.

[Caution] Caution

Some software may not function well with "symlink to a directory".

9.3.15. Expansion of usable storage space using aufs

If you have usable space in another partition (e.g., "/path/to/"), you can create a directory in it and stack that on to a directory where you need space with aufs.

$ sudo mv work-dir old-dir
$ sudo mkdir work-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo mount -t aufs -o br:/path/to/emp-dir:old-dir none work-dir
[Caution] Caution

Use of aufs for long term data storage is not good idea since it is under development and its design change may introduce issues.

[Tip] Tip

In order to use aufs, its utility package aufs-tools and kernel module package for aufs such as aufs-modules-2.6-amd64 need to be installed.

[Tip] Tip

aufs is used to provide writable root filesystem by many modern live CD projects.

9.4. Data encryption tips

With physical access to your PC, anyone can easily gain root privilege and access all the files on your PC (see Section 4.7.4, “Securing the root password”). This means that login password system can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although GNU privacy guard (see Section 10.4, “Data security infrastructure”) can encrypt files, it takes some user efforts.

dm-crypt and eCryptfs facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.

Table 9.9. List of data encryption utilities

package popcon size description
cryptsetup 648 utilities for encrypted block device (dm-crypt / LUKS)
cryptmount 341 utilities for encrypted block device (dm-crypt / LUKS) with focus on mount/unmount by normal users
ecryptfs-utils 368 utilities for encrypted stacked filesystem (eCryptfs)

Dm-crypt is a cryptographic filesystem using device-mapper. Device-mapper maps one block device to another.

eCryptfs is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.

[Caution] Caution

Data encryption costs CPU time etc. Please weigh its benefits and costs.

[Note] Note

Entire Debian system can be installed on a encrypted disk by the debian-installer (lenny or newer) using dm-crypt/LUKS and initramfs.

[Tip] Tip

See Section 10.4, “Data security infrastructure” for user space encryption utility: GNU Privacy Guard.

9.4.1. Removable disk encryption with dm-crypt/LUKS

You can encrypt contents of removable mass devices, e.g. USB memory stick on "/dev/sdx", using dm-crypt/LUKS. You simply formatting it as the following.

# badblocks -c 1024 -s -w -t random -v /dev/sdx
# fdisk /dev/sdx
... "n" "p" "1" "return" "return" "w"
# cryptsetup luksFormat /dev/sdx1
# cryptsetup luksOpen /dev/sdx1 sdx1
# ls -l /dev/mapper/
total 0
crw-rw---- 1 root root  10, 60 2008-10-04 18:44 control
brw-rw---- 1 root disk 254,  0 2008-10-04 23:55 sdx1
# mkfs.vfat /dev/mapper/sdx1
# cryptsetup luksClose sdx1

Then, it can be mounted just like normal one on to "/media/<disk_label>", except for asking password (see Section 10.1.10, “Removable storage device”) under modern desktop environment, such as GNOME using gnome-mount(1). The difference is that every data written to it is encrypted. You may alternatively format media in different file format, e.g., ext3 with "mkfs.ext3 /dev/sdx1".

[Note] Note

If you are really paranoid for the security of data, you may need to overwrite multiple times in the above example. This operation is very time consuming though.

9.4.2. Encrypted swap partition with dm-crypt

Let's assume that your original "/etc/fstab" contains the following.

/dev/sda7 swap sw 0 0

You can enable encrypted swap partition using dm-crypt by as the following.

# aptitude install cryptsetup
# swapoff -a
# echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab
# perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab
# /etc/init.d/cryptdisks restart
# swapon -a

9.4.3. Automatically encrypting files with eCryptfs

You can encrypt files written under "~/Private/" automatically using eCryptfs and the ecryptfs-utils package.

  • Run ecryptfs-setup-private(1) and set up "~/Private/" by following prompts.

  • Activate "~/Private/" by running ecryptfs-mount-private(1).

  • Move sensitive data files to "~/Private/" and make symlinks as needed.

    • Candidates: "~/.fetchmailrc", "~/.ssh/identity", "~/.ssh/id_rsa", "~/.ssh/id_dsa" and other files with "go-rwx"

  • Move sensitive data directories to a subdirectory in "~/Private/" and make symlinks as needed.

    • Candidates: "~/.gnupg" and other directories with "go-rwx"

  • Create symlink from "~/Desktop/Private/" to "~/Private/" for easier desktop operations.

  • Deactivate "~/Private/" by running ecryptfs-umount-private(1).

  • Activate "~/Private/" by issuing "ecryptfs-mount-private" as you need encrypted data.

[Tip] Tip

Since eCryptfs selectively encrypt only the sensitive files, its system cost is much less than using dm-crypt on the entire root or "/home" device. It does not require any special on-disk storage allocation effort but cannot keep all filesystem metadata confidential.

9.4.4. Automatically mounting eCryptfs

If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via PAM (Pluggable Authentication Modules).

Insert the following line just before "" in "/etc/pam.d/common-auth".

auth required unwrap

Insert the following line just at the last line in "/etc/pam.d/common-session".

session optional unwrap

Insert the following line at first active line in "/etc/pam.d/common-password".

password required

This is quite convenient.

[Warning] Warning

Configuration errors of PAM may lock you out of your own system. See Chapter 4, Authentication.

[Caution] Caution

If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see Section 4.3, “Good password”). Unless you are careful to set up a strong password, your data is at risk when someone runs password cracking software after stealing your laptop (see Section 4.7.4, “Securing the root password”).

9.5. Monitoring, controlling, and starting program activities

Program activities can be monitored and controlled using specialized tools.

Table 9.10. List of tools for monitoring and controlling program activities

package popcon size description
coreutils 14088 nice(1): run a program with modified scheduling priority
bsdutils 187 renice(1): modify the scheduling priority of a running process
procps 593 "/proc" filesystem utilities: ps(1), top(1), kill(1), watch(1), …
psmisc 602 "/proc" filesystem utilities: killall(1), fuser(1), peekfd(1), pstree(1)
time 152 time(1): run a program to report system resource usages with respect to time
sysstat 962 sar(1), iostat(1), mpstat(1), …: system performance tools for Linux
isag 126 Interactive System Activity Grapher for sysstat
lsof 420 lsof(8): list open files by a running process using "-p" option
strace 404 strace(1): trace system calls and signals
ltrace 188 ltrace(1): trace library calls
xtrace 336 xtrace(1): trace communication between X11 client and server
powertop 380 powertop(1): information about system power use on Intel-based laptops
cron 195 run processes according to a schedule in background from cron(8) daemon
anacron 159 cron-like command scheduler for systems that don't run 24 hours a day
at 140 at(1) or batch(1): run a job at a specified time or below certain load level

[Tip] Tip

The procps packages provide very basics of monitoring, controlling, and starting program activities. You should learn all of them.

9.5.1. Timing a process

Display time used by the process invoked by the command.

# time some_command >/dev/null
real    0m0.035s       # time on wall clock (elapsed real time)
user    0m0.000s       # time in user mode
sys     0m0.020s       # time in kernel mode

9.5.2. The scheduling priority

A nice value is used to control the scheduling priority for the process.

Table 9.11. List of nice values for the scheduling priority

nice value scheduling priority
19 lowest priority process (nice)
0 very high priority process for user
-20 very high priority process for root (not-nice)

# nice  -19 top                                      # very nice
# nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # very fast

Sometimes an extreme nice value does more harm than good to the system. Use this command carefully.

9.5.3. The ps command

The ps(1) command on the Debian support both BSD and SystemV features and helps to identify the process activity statically.

Table 9.12. List of ps command styles

style typical command feature
BSD ps aux display %CPU %MEM
System V ps -efH display PPID

For the zombie (defunct) children process, you can kill them by the parent process ID identified in the "PPID" field.

The pstree(1) command display a tree of processes.

9.5.4. The top command

top(1) on the Debian has rich features and helps to identify what process is acting funny dynamically.

Table 9.13. List of commands for top

command key description of response
h or ? show help
f set/reset display field
o reorder display field
F set sort key field
k kill a process
r renice a process
q quit the top command

9.5.5. Listing files opened by a process

You can list all files opened by a process with a process ID (PID), e.g. 1, by the following.

$ sudo lsof -p 1

PID=1 is usually init program.

9.5.6. Tracing program activities

You can trace program activity with strace(1), ltrace(1), or xtrace(1) for system calls and signals, library calls, or communication between X11 client and server.

You can trace system calls of the ls command as the following.

$ sudo strace ls

9.5.7. Identification of processes using files or sockets

You can also identify processes using files by fuser(1), e.g. for "/var/log/mail.log" by the following.

$ sudo fuser -v /var/log/mail.log
                     USER        PID ACCESS COMMAND
/var/log/mail.log:   root       2946 F.... rsyslogd

You see that file "/var/log/mail.log" is open for writing by the rsyslogd(8) command.

You can also identify processes using sockets by fuser(1), e.g. for "smtp/tcp" by the following.

$ sudo fuser -v smtp/tcp
                     USER        PID ACCESS COMMAND
smtp/tcp:            Debian-exim   3379 F.... exim4

Now you know your system runs exim4(8) to handle TCP connections to SMTP port (25).

9.5.8. Repeating a command with a constant interval

watch(1) executes a program repeatedly with a constant interval while showing its output in fullscreen.

$ watch w

This displays who is logged on to the system updated every 2 seconds.

9.5.9. Repeating a command looping over files

There are several ways to repeat a command looping over files matching some condition, e.g. matching glob pattern "*.ext".

for x in *.ext; do if [ -f "$x"]; then command "$x" ; fi; done
  • find(1) and xargs(1) combination:

find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 command
  • find(1) with "-exec" option with a command:

find . -type f -maxdepth 1 -name '*.ext' -exec command '{}' \;
  • find(1) with "-exec" option with a short shell script:

find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "command '{}' && echo 'successful'" \;

The above examples are written to ensure proper handling of funny file names such as ones containing spaces. See Section 10.1.5, “Idioms for the selection of files” for more advance uses of find(1).

9.5.10. Starting a program from GUI

You can set up to start a process from graphical user interface (GUI).

Under GNOME desktop environment, a program can be started with proper argument by double-clicking the launcher icon, by drag-and-drop of a file icon to the launcher icon, or by "Open with …" menu via right clicking a file icon. KDE can do the equivalent, too.

Here is an example under GNOME to create a launcher icon for mc(1) started in gnome-terminal(1).

Create an executable program "mc-term" by the following.

# cat >/usr/local/bin/mc-term <<EOF
gnome-terminal -e "mc \$1"
# chmod 755 /usr/local/bin/mc-term

Create a desktop launcher as the following.

  1. Right click desktop space to select "Create Launcher …".

  2. Set "Type" to "Application".

  3. Set "Name" to "mc".

  4. Set "Command" to "mc-term %f".

  5. Click "OK".

Create an open-with association as as the following.

  1. Right click folder to select "Open with Other Application …".

  2. Click open "Use a custom command" dialog and enter "mc-term %f".

  3. Click "Open".

[Tip] Tip

Launcher is a file at "~/Desktop" with ".desktop" as its extension.

9.5.11. Customizing program to be started

Some programs start another program automatically. Here are check points for customizing this process.

  • Application configuration menu:

    • GNOME desktop: "System" → "Preferences" → "Preferred Application"

    • KDE desktop: "K" → "Control Center" → "KDE Components" → "Component Chooser"

    • Iceweasle browser: "Edit" → "Preferences" → "Applications"

    • mc(1): "/etc/mc/mc.ext"

  • Environment variables such as "$BROWSER", "$EDITOR", "$VISUAL", and "$PAGER" (see eviron(7))

  • The update-alternatives(8) system for programs such as "editor", "view", "x-www-browser", "gnome-www-browser", and "www-browser" (see Section 1.4.7, “Setting a default text editor”)

  • the "~/.mailcap" and "/etc/mailcap" file contents which associate MIME type with program (see mailcap(5))

  • The "~/.mime.types" and "/etc/mime.types" file contents which associate file name extension with MIME type (see run-mailcap(1))

[Tip] Tip

update-mime(8) updates the "/etc/mailcap" file using "/etc/mailcap.order" file (see mailcap.order(5)).

[Tip] Tip

The debianutils package provides sensible-browser(1), sensible-editor(1), and sensible-pager(1) which make sensible decisions on which editor, pager, and web browser to call, respectively. I recommend you to read these shell scripts.

[Tip] Tip

In order to run a console application such as mutt under X as your preferred application, you should create an X application as following and set "/usr/local/bin/mutt-term" as your preferred application to be started as described.

# cat /usr/local/bin/mutt-term <<EOF
gnome-terminal -e "mutt \$@"
chmod 755 /usr/local/bin/mutt-term

9.5.12. Killing a process

Use kill(1) to kill (or send a signal to) a process by the process ID.

Use killall(1) or pkill(1) to do the same by the process command name and other attributes.

Table 9.14. List of frequently used signals for kill command

signal value signal name function
1 HUP restart daemon
15 TERM normal kill
9 KILL kill hard

9.5.13. Scheduling tasks once

Run the at(1) command to schedule a one-time job by the following.

$ echo 'command -args'| at 3:40 monday

9.5.14. Scheduling tasks regularly

Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).

You can schedule to run processes as a normal user, e.g. foo by creating a crontab(5) file as "/var/spool/cron/crontabs/foo" with "crontab -e" command.

Here is an example of a crontab(5) file.

# use /bin/sh to run commands, no matter what /etc/passwd says
# mail any output to paul, no matter whose crontab this is
# Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed)
# run at 00:05, every day
5  0  *  * *   $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
# run at 14:15 on the first of every month -- output mailed to paul
15 14 1  * *   $HOME/bin/monthly
# run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc:
0 22 *   * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%%
23 */2 1 2 *   echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1"
5  4 *   * sun echo "run at 04:05 every Sunday"
# run at 03:40 on the first Monday of each month
40 3 1-7 * *   [ "$(date +%a)" == "Mon" ] && command -args
[Tip] Tip

For the system not running continuously, install the anacron package to schedule periodic commands at the specified intervals as closely as machine-uptime permits. See anacron(8) and anacrontab(5).

[Tip] Tip

For scheduled system maintenance scripts, you can run them periodically from root account by placing such scripts in "/etc/cron.hourly/", "/etc/cron.daily/", "/etc/cron.weekly/", or "/etc/cron.monthly/". Execution timings of these scripts can be customized by "/etc/crontab" and "/etc/anacrontab".

9.5.15. Alt-SysRq key

Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system.

Table 9.15. List of SAK command keys

key following Alt-SysRq description of action
r restore the keyboard from raw mode after X crashes
0 change the console loglevel to 0 to reduce error messages
k kill all processes on the current virtual console
e send a SIGTERM to all processes, except for init(8)
i send a SIGKILL to all processes, except for init(8)
s sync all mounted filesystems
u remount all mounted filesystems read-only (umount)
b reboot the system without syncing or unmounting

The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations.

See "/usr/share/doc/linux-doc-2.6.*/Documentation/sysrq.txt.gz".

[Caution] Caution

The Alt-SysRq feature may be considered a security risk by allowing users access to root-privileged functions. Placing "echo 0 >/proc/sys/kernel/sysrq" in "/etc/rc.local" or "kernel.sysrq = 0" in "/etc/sysctl.conf" disables the Alt-SysRq feature.

[Tip] Tip

From SSH terminal etc., you can use the Alt-SysRq feature by writing to the "/proc/sysrq-trigger". For example, "echo s > /proc/sysrq-trigger; echo u > /proc/sysrq-trigger" from the root shell prompt syncs and umounts all mounted filesystems.

9.6. System maintenance tips

9.6.1. Who is on the system?

You can check who is on the system by the following.

  • who(1) shows who is logged on.

  • w(1) shows who is logged on and what they are doing.

  • last(1) shows listing of last logged in user.

  • lastb(1) shows listing of last bad logged in users.

[Tip] Tip

"/var/run/utmp", "/var/log/wtmp", and "/var/run/utmp" hold such user information. See login(1) and utmp(5).

9.6.2. Warning everyone

You can send message to everyone who is logged on to the system with wall(1) by the following.

$ echo "We are shutting down in 1 hour" | wall

9.6.3. Hardware identification

For the PCI-like devices (AGP, PCI-Express, CardBus, ExpressCard, etc.), lspci(8) (probably with "-nn" option) is a good start for the hardware identification

Alternatively, you can identify the hardware by reading contents of "/proc/bus/pci/devices" or browsing directory tree under "/sys/bus/pci" (see Section 1.2.12, “procfs and sysfs”).

Table 9.16. List of hardware identification tools

package popcon size description
pciutils 921 Linux PCI Utilities: lspci(8)
usbutils 630 Linux USB utilities: lsusb(8)
pcmciautils 115 PCMCIA utilities for Linux 2.6: pccardctl(8)
scsitools 316 collection of tools for SCSI hardware management: lsscsi(8)
pnputils 108 Plug and Play BIOS utilities: lspnp(8)
procinfo 164 system information obtained from "/proc": lsdev(8)
lshw 712 information about hardware configuration: lshw(1)
discover 66 hardware identification system: discover(8)

9.6.4. Hardware configuration

Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.

Table 9.17. List of hardware configuration tools

package popcon size description
hal 1495 Hardware Abstraction Layer: lshal(1)
console-tools 956 Linux console font and keytable utilities
x11-xserver-utils 485 X server utilities: xset(1), xmodmap(1)
acpid 187 daemon to manage events delivered by the Advanced Configuration and Power Interface (ACPI)
acpi 70 utility to display information on ACPI devices
apmd 252 daemon to manage events delivered by the Advanced Power Management (APM)
noflushd 248 daemon to allow idle hard disks to spin down
sleepd 148 daemon to put a laptop to sleep during inactivity
hdparm 284 hard disk access optimization (see Section 9.3.8, “Optimization of hard disk”)
smartmontools 1149 control and monitor storage systems using S.M.A.R.T.
setserial 147 collection of tools for serial port management
memtest86+ 2342 collection of tools for memory hardware management
scsitools 316 collection of tools for SCSI hardware management
tpconfig 164 utility to configure touchpad devices
setcd 28 compact disc drive access optimization
big-cursor 68 larger mouse cursors for X

Here, ACPI is a newer framework for the power management system than APM.

[Tip] Tip

CPU frequency scaling on modern system is governed by kernel modules such as acpi_cpufreq.

9.6.5. System and hardware time

The following sets system and hardware time to MM/DD hh:mm, CCYY.

# date MMDDhhmmCCYY
# hwclock --utc --systohc
# hwclock --show

Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UT(GMT).

If the hardware (BIOS) time is set to UT, change the setting to "UTC=yes" in the "/etc/default/rcS".

If you wish to update system time via network, consider to use the NTP service with the packages such as ntp, ntpdate, and chrony.

See the following.

[Tip] Tip

ntptrace(8) in the ntp package can trace a chain of NTP servers back to the primary source.

9.6.6. The terminal configuration

There are several components to configure character console and ncurses(3) system features.

  • The "/etc/terminfo/*/*" file (terminfo(5))

  • The "$TERM" environment variable (term(7))

  • setterm(1), stty(1), tic(1), and toe(1)

If the terminfo entry for xterm doesn't work with a non-Debian xterm, change your terminal type, "$TERM", from "xterm" to one of the feature-limited versions such as "xterm-r6" when you log in to a Debian system remotely. See "/usr/share/doc/libncurses5/FAQ" for more. "dumb" is the lowest common denominator for "$TERM".

9.6.7. The sound infrastructure

Device drivers for sound cards for current Linux 2.6 are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.

Run "dpkg-reconfigure linux-sound-base" to select the sound system to use ALSA via blacklisting of kernel modules. Unless you have very new sound hardware, udev infrastructure should configure your sound system.

[Tip] Tip

Use "cat /dev/urandom > /dev/audio" or speaker-test(1) to test speaker. (^C to stop)

[Tip] Tip

If you can not get sound, your speaker may be connected to a muted output. Modern sound system has many outputs. alsamixer(1) in the alsa-utils package is useful to configure volume and mute settings.

Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.

There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.

9.6.8. Disabling the screen saver

For disabling the screen saver, use following commands.

Table 9.19. List of commands for disabling the screen saver

environment command
The Linux console setterm -powersave off
The X Window (turning off screensaver) xset s off
The X Window (disabling dpms) xset -dpms
The X Window (GUI configuration of screen saver) xscreensaver-command -prefs

9.6.9. Disabling beep sounds

One can always unplug the PC speaker to disable beep sounds. Removing pcspkr kernel module does this for you.

The following prevents the readline(3) program used by bash(1) to beep when encountering "\a" (ASCII=7).

$ echo "set bell-style none">> ~/.inputrc

9.6.10. Memory usage

The kernel boot message in the "/var/log/dmesg" contains the total exact size of available memory.

free(1) and top(1) display information on memory resources on the running system.

# grep '\] Memory' /var/log/dmesg
[    0.004000] Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init)
$ free -k
             total       used       free     shared    buffers     cached
Mem:        997184     976928      20256          0     129592     171932
-/+ buffers/cache:     675404     321780
Swap:      4545576          4    4545572
[Tip] Tip

Do not worry about the large size of "used" and the small size of "free" in the "Mem:" line, but read the one under them (675404 and 321780 in the example below) and relax.

For my MacBook with 1GB=1048576k DRAM (video system steals some of this), I see the following.

Table 9.20. List of memory sizes reported

report size
Total size in dmesg 1016784k = 1GB - 31792k
Free in dmesg 990528k
Total under shell 997184k
Free under shell 20256k (but effectively 321780k)

9.6.11. System security and integrity check

Poor system maintenance may expose your system to external exploitation.

For system security and integrity check, you should start with the following.

Table 9.21. List of tools for system security and integrity check

package popcon size description
logcheck 284 daemon to mail anomalies in the system logfiles to the administrator
debsums 224 utility to verify installed package files against MD5 checksums
chkrootkit 920 rootkit detector
clamav 584 anti-virus utility for Unix - command-line interface
tiger 2374 report system security vulnerabilities
tripwire 9029 file and directory integrity checker
john 472 active password cracking tool
aide 1320 Advanced Intrusion Detection Environment - static binary
bastille 1960 security hardening tool
integrit 440 file integrity verification program
crack 160 password guessing program

Here is a simple script to check for typical world writable incorrect file permissions.

# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)
[Caution] Caution

Since the debsums package uses MD5 checksums stored locally, it can not be fully trusted as the system security audit tool against malicious attacks.

9.7. The kernel

Debian distributes modularized Linux kernel as packages for supported architectures.

9.7.1. Linux kernel 2.6

There are few notable features on Linux kernel 2.6 compared to 2.4.

  • Devices are created by the udev system (see Section 3.5.11, “The udev system”).

  • Read/write accesses to IDE CD/DVD devices do not use the ide-scsi module.

  • Network packet filtering functions use iptable kernel modules.

9.7.2. Kernel parameters

Many Linux features are configurable via kernel parameters as follows.

See "kernel-parameters.txt(.gz)" and other related documents in the Linux kernel documentation ("/usr/share/doc/linux-doc-2.6.*/Documentation/filesystems/*") provided by the linux-doc-2.6.* package.

9.7.3. Kernel headers

Most normal programs don't need kernel headers and in fact may break if you use them directly for compiling. They should be compiled against the headers in "/usr/include/linux" and "/usr/include/asm" provided by the libc6-dev package (created from the glibc source package) on the Debian system.

[Note] Note

For compiling some kernel-specific programs such as the kernel modules from the external source and the automounter daemon (amd), you must include path to the corresponding kernel headers, e.g. "-I/usr/src/linux-particular-version/include/", to your command line. module-assistant(8) (or its short form m-a) helps users to build and install module package(s) easily for one or more custom kernels.

9.7.4. Compiling the kernel and related modules

Debian has its own method of compiling the kernel and related modules.

Table 9.22. List of key packages to be installed for the kernel recompilation on the Debian system

package popcon size description
build-essential 48 essential packages for building Debian packages: make, gcc, …
bzip2 86 compress and decompress utilities for bz2 files
libncurses5-dev 1007 developer's libraries and docs for ncurses
git 13073 git: distributed revision control system used by the Linux kernel
fakeroot 316 provide fakeroot environment for building package as non-root
initramfs-tools 321 tool to build an initramfs (Debian specific)
dkms 338 dynamic kernel module support (DKMS) (generic)
devscripts 1506 helper scripts for a Debian Package maintainer (Debian specific)

If you use initrd in Section 3.3, “Stage 2: the boot loader”, make sure to read the related information in initramfs-tools(8), update-initramfs(8), mkinitramfs(8) and initramfs.conf(5).

[Warning] Warning

Do not put symlinks to the directories in the source tree (e.g. "/usr/src/linux*") from "/usr/include/linux" and "/usr/include/asm" when compiling the Linux kernel source. (Some outdated documents suggest this.)

[Note] Note

When compiling the latest Linux kernel on the Debian stable system, the use of backported latest tools from the Debian unstable may be needed.

[Note] Note

The dynamic kernel module support (DKMS) is a new distribution independent framework designed to allow individual kernel modules to be upgraded without changing the whole kernel. This will be endorsed for the maintenance of out-of-tree modules for squeeze. This also makes it very easy to rebuild modules as you upgrade kernels.

9.7.5. Compiling the kernel source: Debian Kernel Team recommendation

For building custom kernel binary packages from the upstream kernel source, you should use the "deb-pkg" target provided by it.

$ sudo apt-get build-dep linux-2.6
$ cd /usr/src
$ wget<version>.tar.bz2
$ tar -xjvf linux-<version>.tar.bz2
$ cd linux-<version>
$ cp /boot/config-<version> .config
$ make menuconfig
$ make deb-pkg
[Tip] Tip

The linux-source-<version> package provides the Linux kernel source with Debian patches as "/usr/src/linux-<version>.tar.bz2".

For building specific binary packages from the Debian kernel source package, you should use the "binary-arch_<architecture><featureset><flavour>" targets in "debian/rules.gen".

$ sudo apt-get build-dep linux-2.6
$ apt-get source linux-2.6
$ cd linux-2.6-*
$ fakeroot make -f debian/rules.gen binary-arch_i386_none_686

See further information:

9.7.6. Non-free hardware drivers

Although most of hardware drivers are available as free software and as a part of the Debian system, you may need to load some non-free external drivers to support some hardwares, such as Winmodem, on your system.

[Tip] Tip

Check available firmware packages with "aptitude search ^firmware" while enabling the non-free repository.

[Tip] Tip

The NDISwrapper can use Windows XP network drivers natively on Linux. Check "aptitude search ^ndis".

Check pertinent resources.

9.8. Virtualized system

Use of virtualized system enables us to run multiple instances of system simultaneously on a single hardware.

9.8.1. Virtualization tools

There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.

Table 9.23. List of virtualization tools

package popcon size description
schroot 2293 specialized tool for executing Debian binary packages in chroot
sbuild 465 tool for building Debian binary packages from Debian sources
pbuilder 992 personal package builder for Debian packages
debootstrap 225 bootstrap a basic Debian system (written in sh)
cdebootstrap 71 bootstrap a Debian system (written in C)
rootstrap 97 tool for building complete Linux filesystem images
virt-manager 5372 Virtual Machine Manager: desktop application for managing virtual machines
libvirt-bin 4595 programs for the libvirt library
user-mode-linux 24015 User-mode Linux (kernel)
bochs 3018 Bochs: IA-32 PC emulator
qemu 358 QEMU: fast generic processor emulator
qemu-system 76945 QEMU: full system emulation binaries
qemu-user 44931 QEMU: user mode emulation binaries
qemu-utils 1374 QEMU: utilities
qemu-kvm 4722 KVM: full virtualization on x86 hardware with the hardware-assisted virtualization
virtualbox-ose 118 VirtualBox: x86 virtualization solution on i386 and amd64
xen-tools 1228 tools to manage debian XEN virtual server
wine 41 Wine: Windows API Implementation (standard suite)
dosbox 2526 DOSBox: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS
dosemu 5944 DOSEMU: The Linux DOS Emulator
vzctl 660 OpenVZ server virtualization solution - control tools
vzquota 204 OpenVZ server virtualization solution - quota tools
lxc 692 Linux containers user space tools

See Wikipedia article Comparison of platform virtual machines for detail comparison of different platform virtualization solutions.

9.8.2. Virtualization work flow

[Note] Note

Some functionalities described here are only available in squeeze.

[Note] Note

Default Debian kernels support KVM since lenny.

Typical work flow for virtualization involves several steps.

9.8.3. Mounting the virtual disk image file

For the raw disk image file, see Section 10.2, “The disk image”.

For other virtual disk image files, you can use qemu-nbd(8) to export them using network block device protocol and mount them using the nbd kernel module.

qemu-nbd(8) supports disk formats supported by QEMU: QEMU supports following disk formats: raw, qcow2, qcow, vmdk, vdi, bochs, cow (user-mode Linux copy-on-write), parallels, dmg, cloop, vpc, vvfat (virtual VFAT), and host_device.

The network block device can support partitions in the same way as the loop device (see Section 10.2.3, “Mounting the disk image file”). You can mount the first partition of "disk.img" as follows.

# modprobe nbd max_part=16
# qemu-nbd -v -c /dev/nbd0 disk.img
# mkdir /mnt/part1
# mount /dev/nbd0p1 /mnt/part1
[Tip] Tip

You may export only the first partition of "disk.img" using "-P 1" option to qemu-nbd(8).

9.8.4. Chroot system

chroot(8) offers most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting.

[Caution] Caution

Examples below assumes both parent system and chroot system share the same CPU architecture.

You can learn how to setup and use chroot(8) by running pbuilder(8) program under script(1) as follows.

$ sudo mkdir /sid-root
$ sudo pbuilder --create --no-targz --debug --buildplace /sid-root

You see how debootstrap(8) or cdebootstrap(1) populate system data for sid environment under "/sid-root".

[Tip] Tip

These debootstrap(8) or cdebootstrap(1) are used to install Debian by the Debian Installer. These can also be used to install Debian to a system without using a Debian install disk, but instead from another GNU/Linux distribution.

$ sudo pbuilder --login --no-targz  --debug --buildplace /sid-root

You see how a system shell running under sid environment is created as the following.

  1. Copy local configuration ("/etc/hosts", "/etc/hostname", "/etc/resolv.conf")

  2. Mount "/proc" filesystem

  3. Mount "/dev/pts" filesystem

  4. Create "/usr/sbin/policy-rc.d" which always exits with 101

  5. Run "chroot /sid-root bin/bash -c 'exec -a -bash bin/bash'"

[Note] Note

Some programs under chroot may require access to more files from the parent system to function than pbuilder provides. For example, "/sys", "/etc/passwd", "/etc/group", "/var/run/utmp", "/var/log/wtmp", etc. may need to be bind-mounted or copied.

[Note] Note

The "/usr/sbin/policy-rc.d" file prevents daemon programs to be started automatically on Debian system. See "/usr/share/doc/sysv-rc/README.policy-rc.d.gz".

[Tip] Tip

The original purpose of the specialized chroot package, pbuilder is to construct a chroot system and builds a package inside the chroot. It is an ideal system to use to check that a package's build-dependencies are correct, and to be sure that unnecessary and wrong build dependencies do not exist in the resulting package.

[Tip] Tip

Similar schroot package may give you an idea to run i386 chroot system under amd64 parent system.

9.8.5. Multiple desktop systems

I recommend you to use QEMU or VirtualBox on a Debian stable system to run multiple desktop systems safely using virtualization. These enable you to run desktop applications of Debian unstable and testing without usual risks associated with them.

Since pure QEMU is very slow, it is recommended to accelerate it with KVM when the host system support it.

The virtual disk image "virtdisk.qcow2" containing Debian system for QEMU can be created using debian-installer: Small CDs as follows.

$ wget
$ qemu-img create -f qcow2 virtdisk.qcow2 5G
$ qemu -hda virtdisk.qcow2 -cdrom debian-503-amd64-netinst.iso -boot d -m 256

See more tips at Debian wiki: QEMU.

VirtualBox comes with Qt GUI tools and quite intuitive. Its GUI and command line tools are explained in VirtualBox User Manual and VirtualBox User Manual (PDF).

[Tip] Tip

Running other GNU/Linux distributions such as Ubuntu and Fedra under virtualization is a great way to learn configuration tips. Other proprietary OSs may be run nicely under this GNU/Linux virtualization, too.