June 2008 Archives

openSUSE 11.0 x86_64 Review

| 2 Comments
Opensuse_7.gifI have finished setting up openSUSE 11.0 on my HP dv2000z AMD Turion64 X2.  Up to version 10.3 I was running the 32-bit version of SUSE and decided now was a good time to do a 'New' install and give x86_64 a spin.

Installation

I downloaded from the openSUSE BitTorrent the DVD iso and burned to a disc with K3B and ran an MD5 checksum which was ok.

The YaST install interface, written in Qt4, has received a major facelift, and is visually very easy on the eyes.  Since this was a new install I accepted the suggested partitioning option (2Gb Linux swap partition with one primary partition for everything else).  I've been following the KDE4 developments over the past months and opted to go with installing KDE 3.5.9 and will hope to reevaluate KDE 4.1 later this year.

In the Install list I added the kernel sources and development tools which includes the
gcc compiler.  For applications that don't come in rpm format your only other option is source code tar.gz tar.bz2 format, which means you need to download and compile the sources at the command-line with ./configure, make and make install.

(If you are going to do technical support, having the kernel sources and gcc compiler on your client's system is a must.  Otherwise, any software the average user needs can be found in the on-line openSUSE repository and other repositories across the internet (e.g., Packman) and YaST makes getting them a breeze.)

The install went well until I reached OpenOffice_org when it errored unpacking the rpm.  So, I went back and deselected the application in the install list and started up the install again.  The install then ran to completion without any further issues.

Reading the Release Notes during the install I noted that Ctrl-Alt-Backspace has been changed to Ctrl-Alt-Backspace-Backspace (pressing Backspace twice withing 2 seconds).

When adding myself as the 'first' user, openSUSE defaulted the root administrator to the same password.

It took about 2 hours to download the torrent, 15 minutes to burn and check the iso, and about 30 minutes to complete the initial installation.  All seemed fine...

Customizations

Wireless:

When I finally rebooted after the install, I discovered I had no wireless connection in KNetworkManager.  This didn't come entirely as a surprise as I've dealt with this issue many times before and using ndiswrapper with my Windows broadcom driver has been the solution. 

This time around, I didn't have on hand a 64-bit Windows driver.  Inspecting the kernel boot messages with dmesg, I noted that the error message not only confirmed the default bcm43xx driver failed to load, but it also politely included a suggestion of how to fix the driver issue by visiting LinuxWireless.org and getting an updated driver.  All went well getting and installing the update and I was wireless in about 15 minutes. I might have spent considerable time Googling for a solution had it not been for that suggestion in the error message.

Admittedly, proprietary kernel drivers has been and still is the most contentious issue with getting Linux installed. In some Distros, like my openSUSE wireless issue, it's not a user-friendly process to fix and needs to be improved upon.  Providing kernel module/driver sources is a BIG issue and hopefully all vendors will recognize its importance and lend cooperation in making drivers available as open source.

Now that I had a connection, the next thing to do was to run from YaST administrator settings 'Online Update'.  This 'handshakes' with the openSUSE repositories and syncronizes my installation sources to theirs.

Security:

The next step was to change my root password with passwd from a root shell prompt.

New users to Linux can take comfort that openSUSE provides great security in its default form.  Additionally, openSUSE runs with a form security, called AppArmor.  AppArmor puts a 'sandbox' around any process or application you profile.  My target for sandboxing was the internet browser Firefox.  The profile already exists for Firefox in openSUSE so it was just a matter of manually adding the profile and restarting the AppArmor service.  A 5-minute step.

Read article Is It Safe, on how to configure Firefox with AppArmor.

Video:

openSUSE Xorg 7.x provides the basics and support for most video cards.  It's ok, but where Nvidia is concerned, I recommend getting the Nvidia driver instead of using Xorg.  You'll benefit from faster video and improved font support.  The 'one-click' install of the Nvidia driver 'errored out' for me so I went with 'Plan B' which is to manually download and install the driver, a minor inconvenience for a user such as myself, but this might again make a new user turn and run for the nearest exit.  Again part of the open source driver issue I mentioned above which I can only hope will be resolved soon to everyone's benefit.

KDE Personal Settings:

One of the best things about KDE is the many ways you can configure its appearance.
I personally like the traditional KDE KMenu--it's as simple as right-clicking on the KMenu button and selecting 'KDE Menu Style'.

For Icons, I have chosen to set up Tango which you'll need to install from YaST Software Management.  Then click KMenu->Personal Settings->Appearance & Themes->Icons and select the Tango Icon Theme.  There are many others from which to choose at KDE-Look.org.

For Widget Styles, I have chosen QtCurve--click KMenu->Personal Settings->Appearance & Themes->Styles and select QtCurve.

Compiz:

If your PC has a graphics adapter which support 3D compositing, you'll be happy to try out Compiz.  Click KMenu->Utilities Desktop->Desktop Effects to bring up 'Simple Compiz Config Settings Manager.  Click on 'Enable desktop effects' to start Compiz.  There are many effects which I won't go into detail on but you read more about it here.  I have found that even if you have Compiz enabled, logging out of or restarting openSUSE disables Compiz.  The current workaround is to go to a terminal command-line prompt, cd to directory /home/$USER/.kde/Autostart and create a shell script with kate as follows:

kate ./compiz.sh &

#---------------cut and paste this into kate (don't include this line)
#!/bin/bash
sleep 5
compiz-manager --replace
#---------------cut and past end

File Save (compiz.sh)
chmod 755 compiz.sh


Any script found in Autostart automatically runs after you log into KDE.
This script simply causes compiz to start after a delay of 5 seconds.

Microsoft True Type Fonts:

If you are from the Microsoft camp, you'll most likely yelp when you see the stock font selection in Linux--marginally usable but an abuse to the eyes for extended use.  Fortunately the TrueType fonts are in the openSUSE repository and you can follow along in this how-to to install them.  This is a 'must-have' customization.

Internet Browser:

Firefox is my browser of choice.  It just so happens, openSUSE comes with Firefox and Konqueror.

Much to my surprise, when I first opened Firefox, it was version 3.05b (beta?), so I clicked on the taskbar openSUSE updater to get updates and down came 64-bit version 3.0-0.1 along with a few KDE updates.

Minimally, for added browser security, I recommend that you install two Firefox plugins:

1) NoScript
2) AdBlock Plus

openSUSE installs a 'global' copy of Firefox in /usr/bin.
I've opted in the past to override that copy with a local user version in /home/$USER.

In x86_64, I've made no changes because FF 64-bit comes preconfigured with NPAPI Pluginwrapper 64-bit version Shockwave Flash and Helix (Realplayer) plugins.  Currently, there is no 64-bit Java plugin Firefox available, but the Konqueror browser has one if I need to run a Java applet over the internet.  But, for most day-to-day browser use, I've not had the need for the Java browser plugin.

openSUSE Updater:

If you do your install and have a ethernet cable connection, use it.  Don't expect your wireless to work during or after the install--there is a good chance it won't--which is why I ran the OnLine Update after fixing my wireless.  During your install, openSUSE Updater will automatically check and get and install updates for you.  Thereafter, the default configuration settings check for updates once every 24 hours.  You can right-click on the Updater to see or change your settings. 

On older versions of openSUSE, there were issues with getting updates.  Even with 10.3 you needed to be patient as update checking might take a significant amount of time to complete.  It got so I resorted in 10.3 to turning off the updater and only starting it once a week, typically on Friday evening, to get updates.

Now in openSUSE 11.0, waiting for updates is a thing of the past.  openSUSE Updater is FAST and it is clear that much effort went into correcting the problems of the past.

YaST:

YaST has been given a thorough update with many feature enhancements--so much so that I'll provide a separate blog review of its new features.  YaST was always good yet now it is even better and easier than ever to use.

Email:

I've been a long-time user of Google Mail.  When Google added IMAP support, I switch from the browser-based interface to using KDE Kmail, which supports 'cached-IMAP'--how-to found here.

In additon, I like Kmail because it provides integrated GnuPG, SpamAssassin and ClamAV support.  In the Tools Menu you'll find Wizards to help you configure both SpamAssassin and ClamAV.

Instant Messaging:

openSUSE comes with KDE multi-protocol Kopete. I added my AIM and Gmail's Google Talk accounts.

Skype:

In x86_64, it turns out the easiest way to install Skype 2.0 for Linux is simply to download and extract their static version.  Add a symbolic link in your /home/$USER/bin to the executable and you can manually launch skype from the command line by typing: skype&

I added a desktop application icon with a reference to the link.

Virtual Machines:

My HP laptop has AMD-V virtualization support.  Going on several years, I have used VMware.  It has been good for test bedding and having VM of my licensed copy of Windows XP Professional available for on-demand use.

VMware 1.0.6 for Linux is written in Qt and has only USB 1 support and requires some technical expertise that some power users might have trouble with.  VMware has also experienced sporadic video resolution issues.

So when SUN recently acquired Innotek's VirtualBox, which includes Intel-VT and AMD-V support I decided to install it with my Windows XP.  Compared with VMware, it is for the most part easy to install and power users will have no problem setting it up with a VM.  It supports a wide range of guest operating systems, dual-processor support, USB 2.0 and has no video issues.  So far, it is beating the pants off VMware.  VirtualBox also includes a command-line (VBoxManage) interface and a 'Saved' memory image mode.  With this I set up on my Desktop and Taskbar an Icon to start Windows XP 'on-demand'.  It takes about 5 seconds to boot into Windows!

Conclusion

I've covered the basics for getting openSUSE 11.0 x86_64 installed.  So far, I have had only a few minor 'nuisance' issues described above and feel that the openSUSE Development Team have done a great job of putting together another winner.  YaST is even easier to use combined with 'one-click' installations that puts it on the same level of ease of use with Ubuntu's Synaptic GUI.  At the same time openSUSE is a power-user's Linux. 

Congratulations to the openSUSE Development Team.

openSUSE 11.0 Now Available for Downloading

| 0 Comments
+===============================================================+ OpenSUSE_logo.gif
Congratulations are in order and go to the openSUSE Development Team for their fine efforts.  openSUSE 11.0 is now available for download today.  I am patiently waiting for my bittorrent to finish downloading the 64-bit version.  It should finish up soon and I'll be rolling up my sleeves and getting down to installing it forthwith!

A full review of my experiences with openSUSE 11.0 will follow.

Again, Congratulations openSUSE Development Team!

+===============================================================+

Is Now The Time to Switch to Linux?

| 2 Comments
Microsoft officially set the end date for availability of Windows XP Professional to June 30, 2008.

For many reasons, IT decision makers (and retail consumers) might not want to move to Windows Vista.

One argument is that Windows XP Pro is more than 'good enough' and that the cost imposed by upgrading to Vista verses the net benefits doesn't warrant such a move.

The rising cost of doing business is being accelerated by the soaring price of crude oil.  As budget deficits grow, it becomes an imperative that Businesses be 'creative' in directing fiscal conservative efforts to reduce operating costs.  As a cost center, the IT Department is no less exempt from any other, so alternative replacement solutions to Microsoft must be given serious consideration. 

The alternatives include Open Source and Commercial Linux Distributions.

Linux, taken together with other emerging technology solutions such as Virtualization combined with hardware processor advancements that can effectively consolidate many servers to a just a few Virtual Machine (VM) server Farms provides a very attractive cost reduction benefit.  Sun, RedHat, Novell SuSE, Citrix, VMware all provide competitive Linux-based VM solutions compatible with interoperability from today's Microsoft world to Linux in a seemless fashion.  Coupled with use of Thin Clients, Linux aids in providing cost-effective, secure, centralized application and data management.

Now, more than ever, Linux presents itself as a viable alternative to Microsoft.

Are you considering making the switch?



 


690560_30014270.jpg
Same situation.  Different day.  You've seen it happen ad. infinitum.  You support a rank and file of Microsoft-based PCs running Windows XP.  You spend X hours a week handling call tickets for infected PCs.  You can't successfully disinfect unless you simply reghost them.  This creates issues for end-users who loose customizations.  You support them and manually put back those needed 'tweaks' after ghosting.  And you spend additional time downloading security updates to bring the ghosted PCs to the most current patch level.  It's an endless treadmill of support for the deficits of a legacy single-user operating system that doesn't adequately address the real multi-user networked world we now live in.

All of this support, in terms of man-hour time, accrues ultimately to the bottom-line.  Wouldn't it be nice if you could effectively strike a line through those costs and eliminate them for good?

Nearly every day, I read about Zero-Day exploits.  The latest exploit, brought to you by Nate McFeters at ZDNet Zero-Day, entitled Another bug your tools won't find and your WAF won't prevent, is yet again another example of how profoundly bad Microsoft ActiveX technology is.

The article goes into detail on how ActiveX repurposing exploits are being used, in this case against a Juniper VPN SSL Windows client.  It refers to the exploit as being 'sexy'.  I find this to be a bit troubling.  There's nothing to my mind sexy (or cool) about it.  Not in the least.  What type of public service this provides is in question.  If it were me at ZDNet, I'd be providing information on how IT professionals and consumers can avoid ActiveX all together.

Make a change.  Linux has everything you need minus the Windows Viruses.  openSUSE is safe, secure and not prone to the kinds of exploits which hamper Microsoft Windows products.

Thanks and Be Safe.

KDE 4: Problematic

| 6 Comments
I've been in the openSUSE Linux camp for several years now.  My gui of preference is KDE (currently 3.5.9).  openSUSE 10.3 has been pretty stable and I've not had major issues with it for a while.

Everyone remembers the YaST changes that threw a wrench into getting on-line updates.  Well, that is in the past and everything is going swimmingly.  YaST on-line updates has at times some 'speed' issues but openSUSE 11.0 has many MANY changes that will improve usability.

I will be reviewing GM openSUSE 11.0 64-bit edition.  It's time to make the switch from 32-bit to 64-bit.  Many things have changed and especially where virtualization is concerned, you need 64-bit to take full advantage of the built-in 'bare-metal' Intel VT- or AMD-V-enabled Intel and AMD 64-bit processors.

Along the way during the past several months I have been following closely at Planet SUSE the changes that are slated to be included in openSUSE 11.0.  One of the 'big' ones is inclusion of KDE 4.

To be honest, I tried using KDE 4 on openSUSE 10.3 a few times and found in each case it had issues, so I returned to the sanctuary of KDE 3.5.9.  But I thought, OK, give the KDE Folks time to work things out and everything will be fine by the time June 2008 comes around.

Based on feedback from others, I am not getting the sense that KDE 4 will be ready for prime time for quite some time.  So, this time around I am going to 'pass' on it.

I'll be doing a 'clean install' of openSUSE 11.0 64-bit but staying with KDE 3.5.9.

I realize that KDE 4 has been a huge undertaking in terms of intellectual effort, but, if the KDE Team expect it to be successful, it should 'replicate' 100% of the functionality found in 3.5.9.

Otherwise, you'll have alot of Folk digging their heels in and either staying with 3.5.x or switching GUIs wholesale in avoidance of KDE 4.

Your thoughts?


806151_19258825.jpg
By now you've probably heard or read about Vista's User Account Control (UAC).  This feature alone has taken the brunt of much criticism and has created much consternation among Vista end-users.

In fact, users of Vista have an option to disable UAC entirely.  Microsoft will maintain that UAC is functioning as it should--to get in the way of any attempt at elevating user privilege legitimate or otherwise even at the risk of degrading usability and the overall user experience.  It's all about security and how Microsoft's Vista implements enhanced security in an effort to put in the past some of the Windows single-user legacy issues that Windows XP inherited and really never was designed to adequately address.

Microsoft is so confident they believe other O/Ses should follow suit and recently took the position that UAC is designed to annoy you.  Ed Bott of ZDNet, punctuates with Dear Microsoft: Please get UAC right this time, and brings probably the most veracity to understanding any and all issues around Vista.

From my perspective, if I am doing something that annoys me, I'll probably stop doing it or find a way of avoiding it entirely.  Making the case that 'annoyance' was intentionally designed in troubles me and I find it to be less than sincere.

openSUSE GNU/Linux and other Distros make use of sudo.  Sudo does only what it's supposed to do and does it well--it's flexible, you can't by-pass or disable it, and, most of all, it doesn't annoy.

Your thoughts?


 



Is It Safe? - Part 3

| 0 Comments
This is a continuation of Is It Safe - Part 2. Today we continue in the YaST control center with a look at the 'Security and Users' page.


security_users_page.png

Let's look at the Firewall page.

security_users_page_fw_startup.pngFor the most part, it probably won't be necessary to make any changes to the default configuration, but if and when you do, you'll appreciate how openSUSE provides a nice GUI for addressing some of the most common situations. I have not found the need to make any changes other than to open just a few ports.  When it comes to security, the fewer ports left open, the better, as it reduces the PC's attack surface area. 

Your Firewall, iptables, should already know about your computer's interfaces.  If you have your PC connected via an ethernet port, the device assigned is usually, /dev/eth0. Similarly, if you are connected to a wireless router, the device might show /dev/wlan0 on the Interfaces page.

Each of those interfaces which is used to bridge across your Firewall to the internet WAN should show as assigned to the External Zone.  The Firewall actively monitors packets which come across (both inbound and outbound) the External Zone and will drop inbound packets (filter) which are unsolicited.

Here's a couple of things you can do that will make support of or access to your PC or a company's PCs a bit easier.

I am going to 'backpedal' here and go back to the YaST control center by pressing abort, saying 'Yes' to the 'Really Abort' message.

First, we want to make sure that Secure Shell service is running on your system.

system_services.png On the 'System' page, click on 'System Services (Runlevel)' icon.

system_services_runlevel.pngThis shows which services are installed and running.  The presentation of information has two modes: Simple Mode (default) and Expert Mode (for experts).  In the window services are listed alphabetically.  Scroll down to the letter 's' and you should see an entry for 'sshd'.  The column heading 'Enabled' needs to be a 'Yes'.  If it is not, click on the sshd service to give it focus, and then click the 'Enable' button below.  A window with an OK button should appear with: "/etc/init.d/sshd start returned 0 (success):" and the column for Enabled should now show as 'Yes'.  Click the 'Finish' button in the lower right corner and 'Yes' to commit this change to the runlevels.  Otherwise, if sshd is already running, just press 'Abort'.

Next, we are going to turn on VNC Remote Administration.  Click on Network Services', Remote Administration icon.

network_services.png
network_services_remote_admin.png
If you would like to allow Remote Administration of your PC, select 'Allow Remote Administration'.  Also, click 'Open Port in Firewall'.  Be aware that if your PC is connected directly to a WAN cable modem, then your PC's ports are directly accessible from the internet, at large, by anyone.  So, you should be sure to use strong user ids and strong user passwords. Also be aware that everything that is transmitted over VNC is sent as 'clear text', even your passwords. 

If your PC is connected directly to a cable modem or dial-up modem, I'd suggest you only turn on VNC when needed and turn it off when done.  Furthermore, I strongly recommend that you encrypt (tunnel) VNC over Secure Shell.  I'll show you how in a bit.  Click on 'Finish'.

Let's go back to the 'Security and Users' page and click on 'Firewall', then 'Allowed Services'.

security_users_fw_allowed_services.png
In my scenario, in the 'External Zone', I have allowed two services, 1) Remote Administration (ports 5801 and 5901) and 2) SSH (default port 22).

If you've been following along and you wish to have remote administration and ssh capability, these services must be allowed.  You can select them from the 'drop-down' list of 'Services to Allow' and click on Add if they aren't showing.

Click the 'Next' button in the lower right corner of the window and a summary of your Firewall's settings will display.  Press 'Finish'.  That should suffice for allowing accessing your PC via either ssh or VNC from any PC on the same subnet or if your PC is connected directly to the internet WAN.

If your PC sits safely behind a wireless router, you need to take additional steps to open up the corresponding ports on the router to have forwarding reach your LAN ip.

My web server is running openSUSE, uses a static ip of 192.168.1.101 and sits behind a linksys WRT54GL running DD-WRT v23 firmware.  Here's where I made the port forward settings.

linksys_port_foward.pngYou'll note that I have port fowarding for port 22, and the two other VNC 'provisional' port forwards for ports 5801 and 5901 are not enabled, intentionally.

So how can I reach my server behind the router's Firewall if I don't have the VNC ports open?
Very simple, I tunnel the VNC port over ssh.

From a terminal window bash shell prompt, tunneling VNC over ssh is accomplished with the following:
 

$ssh -L 5901:localhost:5901 -f -N yourUserName@host_name_or_ip
$vncviewer localhost:1 &

You could also run vncviewer from KDE's Remote Desktop Connection, by typing in from the command line krdc & in place of vncviewer, or you can run it via KMenu->System->Remote Access->krdc (Remote Desktop Connection).

krdc.png
krdc_localhost.pngFor the Remote desktop to connect to, type in localhost:1 and click Connect.

krdc_vnc_prefs.pngSelect the connection type that matches your situation and vncviewer will optimize the screen to that preference.

krdc_vnc_suse_login_screen.png
Here we see the openSUSE login screen via a secure shell tunnel.

Another option you have which is definitely handy when you are working from a remote pc that doesn't have VNC installed is to access the system from your Java-enabled web browser by typing in the following url: http://your_ip:5801.  In that case, I would have tunneled vnc over ssh with -L 5801:localhost:5801 replacing port 5901.

These are things you can do to facilitate remote administration over a secure channel.

What's more, openSUSE's YaST control center not only runs on GNOME and KDE, it also can be started from a character-based terminal screen interface with sudo /sbin/yast.

yast_char.pngThis is especially helpful in situations where you are doing remote administration over ssh on a 'headless' server (no X Windows Graphics Display Manager running of any kind).

At a minimum, one other security precaution should be taken with your sshd settings.  To access your ssh server settings, select KMenu->Run Command.  Type:

kdesu kate /etc/ssh/sshd_config


Then click 'Run'.  When prompted, type in the root administrator's password.

This should launch kate (KDE Advanced Text Editor) and open your ssh server configuration file into the text editor.

Type Ctrl-F and search for a line that begins with: 'PermitRootLogin'
If it shows as Yes, change it to a No. Then click File->Save and Quit.

To restart your sshd server and have this change take effect go to KMenu->Run Command and type:

kdesu /sbin/service sshd restart

Click Run and when prompted type in the root password to perform the restart.

Ideally, your systems should be configured for passwordless ssh login.  It's a little tricky at first to set up, but once you've done it a few times, it's not bad.  But I think I'll stop here so as to not create information overload and leave that for another time. 

If you have questions or comments, please let me know!

Thanks and as always, Be Safe.

--dietrich