This chapter describes only the basics of system configuration through a text-based interface. A prerequisite of this chapter is reading Debian 系統安裝提示, 第 3 章.
For the security conscious, it is highly recommended to read the Securing Debian
Manual
, which can also be found as the harden-doc
package.
See The init
program, 第 2.4.1 節 for the basics of the Debian init script.
Debian uses the System V init script system. Although all init scripts in
/etc/init.d/*
are marked as conffiles and sysadmins are free to
modify them, customizing init scripts by editing files in
/etc/default/*
is the preferred approach.
For example, /etc/init.d/rcS
can be used to customize boot-time
defaults for motd
, sulogin
, etc.
System log mode can be configured using /etc/syslog.conf
. Check
the colorize
package for a program to colorize system logfiles.
See also syslogd(8)
and syslog.conf(5)
.
There are a few hardware optimization configurations that Debian leaves to the sysadmin to take care of.
hdparm
hdparm(8)
first.
setcd
setcd(1)
.
setserial
scsitools
memtest86
hwtools
irqtune
: changes the IRQ priority of devices to allow devices that
require high priority and fast service (e.g. serial ports, modems) to have it.
3x speedup of serial/modem throughput is possible.
scanport
: scans I/O space from 0x100 to 0x3ff looking for
installed ISA devices.
inb
: a quick little hack that reads an I/O port and dumps the
value in hex and binary.
schedutils
taskset
, irqset
, lsrt
, and
rt
are included.
nice
and renice
(not included), they
allow full control of process scheduling parameters.
Mounting a filesystem with the noatime option is also very
effective in speeding up read access to the file. See fstab(5)
and mount(8)
.
Some hardware can be tuned directly by the Linux kernel itself through the proc filesystem. See Tuning the kernel through the proc filesystem, 第 7.3 節.
There are many hardware-specific configuration utilities in Debian. Many of them address needs specific to the laptop PC. Here are some interesting packages available in Debian:
tpconfig
- A program to configure touchpad devices
apmd
- Utilities for Advanced Power Management (APM)
acpi
- displays information on ACPI devices
acpid
- Utilities for using ACPI
lphdisk
- prepares hibernation partition for Phoenix NoteBIOS
sleepd
- puts a laptop to sleep during inactivity
noflushd
- allow idle hard disks to spin down
big-cursor
- larger mouse cursors for X
acme
- Enables the "multimedia buttons" found on laptops
tpctl
- IBM ThinkPad hardware configuration tools
mwavem
- Mwave/ACP modem support
toshset
- Access much of the Toshiba laptop hardware interface
toshutils
- Toshiba laptop utilities
sjog
- A program to use the "Jog Dial" on Sony Vaio
Laptops
spicctrl
- Sony Vaio controller program to set LCD backlight
brightness
Here, ACPI is a newer framework for the power management system than APM.
Some of these packages require special kernel modules. They are already included in the latest kernel source in many cases. In case of trouble, you may need to apply the latest patch to the kernel yourself.
PAM (Pluggable Authentication Modules) provides login control.
/etc/pam.d/* # PAM control files /etc/pam.d/login # PAM control file for login /etc/security/* # PAM module parameters /etc/securetty # this controls root login by console (login) /etc/login.defs # this controls login behaviors (login)
Change the contents of /etc/pam.d/login
as follows, if you want
insecure but passwordless console terminals at your own risk.
#auth required pam_unix.so nullok auth required pam_permit.so
Similar tricks can be applied for xdm
, gdm
, ..., for
passwordless console X.
On the other hand, install cracklib2
and set
/etc/pam.d/passwd
as follows, if you want to enforce a good
password policy.
password required pam_cracklib.so retry=3 minlen=6 difok=3
A one-time login password for account activation may also help. For this, use
the passwd
command with the -e option. See
passwd(1)
.
The maximum number of processes can be set with ulimit -u 1000 in
a Bash shell or with settings in /etc/security/limits.conf
from
PAM. Other parameters such as core can be set similarly. The
initial value of PATH
can be set by /etc/login.defs
before the shell startup script.
The documentation for PAM is packaged in the libpam-doc
package.
The Linux-PAM System Administrator's Guide covers configuring PAM,
what modules are available, etc. The documentation also includes The
Linux-PAM Application Developers' Guide and The Linux-PAM Module
Writers' Guide.
su
does not support the wheel group"
This is the famous phrase at the bottom of the old info su page by
Richard M. Stallman. Not to worry: the current su
in Debian uses
PAM, so that one can restrict the ability to use su
to any group
using pam_wheel.so
in /etc/pam.d/su
. The following
will set the adm group in a Debian system as an equivalent of the
BSD wheel group and allow su
without a password for
its members.
# anti-RMS configuration in /etc/pam.d/su auth required pam_wheel.so group=adm # Wheel members to be able to su without a password auth sufficient pam_wheel.so trust group=adm
A few interesting groups:
su
if
pam_wheel.so
is used without the group= argument.
/usr/src
. It can be used locally to give a user the ability to
manage system source code.
/usr/local
and to create
directories in /home
.
For a complete list, see the "FAQ" section in the Securing Debian
Manual
, which can also be found as the harden-doc
package in Woody. Also the new base-passwd
(>3.4.6) contains
an authoritative list:
/usr/share/doc/base-passwd/users-and-groups.html
.
sudo
– a safer work environment
My usage of sudo
is mostly a protection from my own stupidity.
Personally, I consider using sudo
a better alternative to always
using the system as root.
Install sudo
and activate it by setting options in
. Also check out the
sudo group feature in /etc/sudoers
/usr/share/doc/sudo/OPTIONS
.
The sample configuration provides "staff" group members access to any
commands run as root under sudo
and also gives "src"
members access to selected commands run as root under sudo
.
The advantage of sudo
is that it only requires an ordinary user's
password to log in, and activity is monitored. This is a nice way to give some
authority to a junior administrator. For example:
$ sudo chown -R myself:mygrp .
Of course if you know the root password (as most home users do), any command can be run under root from a user account:
$ su -c "shutdown -h now" Password:
(I know I should tighten the admin account's sudo
privileges. But
since this is my home server, I have not bothered yet.)
For a different program that allows ordinary users to run commands with root
privileges, see the super
package.
The Internet super-server, inetd
, is started at boot time
by /etc/rc2.d/S20inetd
(for RUNLEVEL=2), which is a symlink to
/etc/init.d/inetd
. Essentially, inetd
allows one
running daemon to invoke several others, reducing load on the system.
Whenever a request for service arrives, its protocol and service are identified
by looking them up in the databases in /etc/protocols
and
/etc/services
. inetd
then looks up a normal Internet
service in the /etc/inetd.conf
database, or a Sun-RPC based
service in /etc/rpc.conf
.
For system security, make sure to disable unused services in
/etc/inetd.conf
. Sun-RPC services need to be active for NFS and
other RPC-based programs.
Sometimes, inetd
does not start the intended server directly but
starts the tcpd
TCP/IP daemon wrapper program with the intended
server name as its argument in /etc/inetd.conf
. In this case,
tcpd
runs the appropriate server program after logging the request
and doing some additional checks using /etc/hosts.deny
and
/etc/hosts.allow
.
If you have problems with remote access in a recent Debian system, comment out
"ALL: PARANOID" in /etc/hosts.deny
if it exists.
For details, see inetd(8)
, inetd.conf(5)
,
protocols(5)
, services(5)
, tcpd(8)
,
hosts_access(5)
, and hosts_options(5)
.
For more information on Sun-RPC, see rpcinfo(8)
,
portmap(8)
, and
/usr/share/doc/portmap/portmapper.txt.gz
.
References:
OpenLDAP
openldap-guide
package
LDAP Linux
HOWTO
LDAP
Implementation HOWTO
OpenLDAP,
extensive use reports
Open LDAP
with Courier IMAP and Postfix
CD-writers with ATAPI/IDE interfaces have recently become a very popular
option. It is a nice medium for system backup and archiving for the home user
needing < 640MB capacity. For the most authoritative information, see the
LDP CD-Writing-HOWTO
.
First, any disruption of data sent to the CD-writer will cause irrecoverable damage to the CD. Get a CD-writer with as large a buffer as possible. If money is no object, do not bother with ATAPI/IDE, just get a SCSI version. If you have a choice of IDE interface to be connected, use the one on the PCI-bus (i.e., on the motherboard) rather than one on the ISA-bus (an SB16 card, etc.).
When a CD-writer is connected to IDE, it has to be driven by the IDE-SCSI driver instead of an ordinary IDE CD driver for Linux 2.2 and 2.4 kernels. Also, the SCSI generic driver needs to be activated. There are two possible approaches to doing this, assuming a kernel distributed with modern distributions (as of March 2001).
lilo
Add the following line to /etc/lilo.conf
if you are using a stock
Debian kernel. If multiple options are used, list them separated by spaces:
append="hdx=ide-scsi ignore=hdx"
Here the location of the CD-writer, which is accessed through the ide-scsi driver, is indicated by hdx, where x represents one of the following:
hda for a master on the first IDE port hdb for a slave on the first IDE port hdc for a master on the second IDE port hdd for a slave on the second IDE port hde ... hdh for a drive on an external IDE port or ATA66/100 IDE port
Type the following commands as root to activate after finishing all the configuration:
# lilo # shutdown -h now
Debian uses make-kpkg
to create a kernel. Use the new
--append_to_version with make-kpkg
to build multiple
kernel images. See The Linux kernel under
Debian, 第 7 章.
Use the following setup through make menuconfig:
Kernel support for the CD-writer can be activated during booting by the following:
# echo ide-scsi >>/etc/modules # echo sg >>/etc/modules # cd /dev; ln -sf scd0 cdrom
Manual activation can be done by:
# modprobe ide-scsi # modprobe sg
After reboot, you can check installation by:
$ dmesg|less # apt-get install cdrecord # cdrecord -scanbus
[Per Warren Dodge] Sometimes there may be conflicts between
ide-scsi and ide-cd if there are both CD-ROM and
CD-R/RW on the system. Try adding the following line to your
/etc/modutils/aliases
, running update-modules
, and
rebooting.
pre-install ide-scsi modprobe ide-cd
This causes the IDE driver to load before ide-scsi. The IDE driver ide-cd takes control of the ATAPI CD-ROM—anything that it hasn't been told to ignore. That leaves just the ignored devices for ide-scsi to control.
To create a CD-image of files under target-directory/
as
cd-image.raw
(bootable, Joliet TRANS.TBL-enabled format; if not
bootable, take out -b and -c options), insert a boot
floppy in the first floppy drive and
# dd if=/dev/fd0 target-directory/boot.img # mkisofs -r -V volume_id -b boot.img -c bootcatalog -J -T \ -o cd-image.raw target_directory/
One funny hack is to make a bootable DOS CD-ROM. If an ordinary DOS boot
floppy disk image is in the above boot.img
, the CD-ROM
will boot as if a DOS floppy were in the first floppy drive (A:). Doing this
with freeDOS may be more interesting.
This CD-image file can be inspected by mounting it on the loop device.
# mount -t iso9660 -o ro,loop cd-image.raw /cdrom # cd /cdrom # mc # umount /cdrom
First test with (assuming double speed)
# nice --10 cdrecord -dummy speed=2 dev=0,0 disk.img
Then if OK, write to CD-R with
# nice --10 cdrecord -v -eject speed=2 dev=0,0 disk.img
Or write to a CD-RW disk with
# nice --10 cdrecord -v -eject blank=fast speed=2 dev=0,0 disk.img
Some CD-RW drives work better with
# nice --10 cdrecord -v blank=all speed=2 dev=0,0 disk.img
followed by
# nice --10 cdrecord -v -eject speed=2 dev=0,0 disk.img
Two steps are needed to prevent SCSI timeouts during blanking from interfering
with the burning step. The argument value to nice
may require
some adjustments.
Some CD-Rs and commercial CDs have junk sectors at the end that make copying by
dd
impossible (the Windows 98 CD is one of them). The
cdrecord
package comes with the readcd
command. Use
this to copy any CD contents to an image file. If it is a data disk, mount it
and run df
to see its actual size. Divide the number shown in
blocks (1 block = 1024 bytes) by 2 to get the number of actual CD sectors (1
sector = 2048 bytes). Run readcd
with options and use this disk
image to burn the CD-R/RW.
# readcd dev=target,lun,scsibusno # select function 11
Here, set all three parameters to 0 for most cases. Usually the number of
sectors given by readcd
is excessive! Use the above number from
an actual mount for better results.
It should be noted that the use of dd
has a few problems if used
on CD-ROM. The first run of the dd
command may cause an error
message and may yield a shorter disk image with a lost tail-end. The second
run of dd
command may yield a larger disk image with garbage data
attached at the end on some systems if the data size is not specified. Only
the second run of the dd
command with the correct data size
specified, and without ejecting the CD after an error message, seems to avoid
these problems. If for example the image size displayed by df
is
46301184 blocks, use the following command twice to get the right
image (this is my empirical information):
# dd if=/dev/cdrom of=cd.img bs=2048 count=$((46301184/2))
To obtain the latest information on Debian CDs, visit the Debian CD site
.
If you have a fast Internet connection, think about installing over the network using:
floppy
images
.
minimal bootable CD
image
.
If you do not have a fast Internet connection, think about purchasing CDs from
a CD vendor
.
Please do not waste bandwidth by downloading standard CD images unless you are a CD image tester (even with the new jigdo method).
One noteworthy CD image is KNOPPIX - Live Linux
Filesystem On CD
. This CD will boot a functioning Debian system
without installing itself to the hard disk.
To copy key configuration files and data files to CD-R, use the example backup
script "backup"
. Also see 拷貝及建立子目錄, 第 8.3 節 and 差異備份與資料同步, 第 8.4 節.
Not tested by me:
# apt-get install cdrecord cdparanoia # cdparanoia -s -B # cdrecord dev=0,0,0 speed=2 -v -dao -eject defpregap=1 -audio *.wav
or,
# apt-get install cdrdao #disk at once # cdrdao read-cd --device /dev/cdrom --paranoia-mode 3 my_cd # read cd # cdrdao write --device /dev/cdrom --speed 8 my_cd # write a new CD
cdrdao
does a real copy (no gaps, etc...).
The X environment is provided by Xfree86
. There are two major
versions of X server available on the Debian system: Xfree86 Version 3.3 (XF3)
and XFree86 Version 4.x series (XF4) both based on X11R6 specifications by
X.Org
.
For the basics of X, refer to X(7)
, the LDP XWindow-User-HOWTO
,
and the Remote X Apps
mini-HOWTO
. For a Debian-specific user guide, read
/usr/share/doc/xfree86-common/FAQ.gz
provided in the
xfree86-common
package. This contains an interesting and
authoritative review of the key binding issues by Branden Robinson.
This reverses the ordinary use of "server" and "client" in other contexts.
There are several ways of getting the "X server" (display side) to accept remote connections from an "X client" (application side):
xhost
method
xhost
, 第 9.4.7 節
and xhost(1x)
.
xauth
method
xhost
).
ssh -X
.
xauth(1x)
.
xdm
, wdm
, gdm
, kdm
, ...
methods
xauth
).
xdm(1x)
and Xsecurity(7)
for the basics of X
display access control.
wdm(1x)
, gdm(8)
, and kdm.options(5)
for more information, if these are installed.
init
和
runlevels, 第 6.5.4 節 for how to disable xdm
to gain a Linux
console upon boot without purging the xdm
package.
ssh -X
method
ssh
, 第 9.4.8 節.
All remote connection methods, except ssh
, require TCP/IP
connection enabled on the X server. See TCP/IP connection to
X, 第 9.4.6 節.
There are a few (meta)packages provided to ease installation of the X system in Woody.
x-window-system-core
xserver-xfree86
), a set of fonts, and a group of basic X
clients and utilities.
x-window-system
x-window-system-core
, twm
, and xdm
,
i.e., no need to install x-window-system-core
if you install
this.)
xserver-common-v3
xserver-*
xserver-common-v3
.)
For most cases, x-window-system
is the package to install. (If
you want console login, be sure to disable xdm
as described in 「我不想直接啟動到 X!」, 第 8.1.4 節.)
To enable hardware detection during the X configuration stage, install the following packages prior to installing the X system.:
discover
– hardware identification system.
mdetect
– mouse device autodetection tool.
read-edid
– hardware information-gathering tool for VESA PnP
monitors.
See XFree86(1x)
for X server information.
Invoke X server from a local console:
$ startx -- :<display> vtXX e.g.: $ startx -- :1 vt8 -bpp 16 ... start on vt8 connected to localhost:1 with 16 bpp mode
Arguments given after -- are for the X server.
Note, when using a ~/.xserverrc
script to customize the X server
startup process, be sure to exec the real X server. Failing to do
this can make the X server slow to start and exit. For example:
#!/bin/sh exec /usr/bin/X11/X -dpi 100 -nolisten tcp
To (re-)configure an XF4 server,
# dpkg-reconfigure --priority=low xserver-common # dpkg-reconfigure --priority=low xserver-xfree86
will generate /etc/X11/XF86Config-4
file and configure X using the
script dexconf
.
To (re-)configure an XF3 server,
# dpkg-reconfigure --priority=low xserver-common-v3 # dpkg-reconfigure --priority=low xserver-mach64
will generate /etc/X11/XF86Config
file and configure X using the
script xf86config-v3
.
To add user customizations, do not edit the configuration file between the text (this is XF4):
### BEGIN DEBCONF SECTION [snip] ### END DEBCONF SECTION
Instead, add the customizations before the text. For example, to use a custom video device, add something resembling the following text to the top of the file:
Section "Device" Identifier "Custom Device" Driver "ati" Option "NoAccel" EndSection Section "Screen" Identifier "Custom Screen" Device "Custom Device" Monitor "Generic Monitor" DefaultDepth 24 Subsection "Display" Depth 8 Modes "1280x960" "1152x864" "1024x768" "800x600" "640x480" EndSubsection Subsection "Display" Depth 16 Modes "1280x960" "1152x864" "1024x768" "800x600" "640x480" EndSubsection Subsection "Display" Depth 24 Modes "1280x960" "1152x864" "1024x768" "800x600" "640x480" EndSubsection EndSection Section "ServerLayout" Identifier "Custom" Screen "Custom Screen" InputDevice "Generic Keyboard" "CoreKeyboard" InputDevice "Configured Mouse" "CorePointer" EndSection
Most X client programs can be started with a command like this:
client $ xterm -geometry 80x24+30+200 -fn 6x10 -display hostname:0 &
Here, the optional command-line arguments mean:
/tmp/.X11-unix/XD
(so it's only reachable from
host).
The default displayname for the X client program (application side) can be set by the DISPLAY environment variable. For example, prior to running an X client program, executing one of the following commands achieves this:
$ export DISPLAY=:0 # The default, local machine using the first X screen $ export DISPLAY=hostname.fulldomain.name:0.2 $ export DISPLAY=localhost:0
Its startup can be customized by ~/.xinitrc
. For example:
xrdb -load $HOME/.Xresources xsetroot -solid gray & xclock -g 50x50-0+0 -bw 0 & xload -g 50x50-50+0 -bw 0 & xterm -g 80x24+0+0 & xterm -g 80x24+0-0 & twm
As described in Custom X session, 第 9.4.5.1 節, this
overrides everything normal execution of Xsession
does when
started from startx
. Use ~/.xsession
instead and use
this approach only as the last resort.
An X session (X server + X client) can be started by:
startx
: wrapper script command for initx
to start an
X server and client from a Linux character console. If ~/.xinitrc
does not exist, /etc/X11/Xsession
is executed through
/etc/X11/xinit/xinitrc
.
xdm
, gdm
, kdm
, or wdm
: X
display manager daemons to start the X server and client, and to control login
via a GUI screen. /etc/X11/Xsession
is directly executed.
The console can be made available as in 「我不想直接啟動到 X!」, 第 8.1.4 節.
The default startup script /etc/X11/Xsession
is effectively a
combination of
/etc/X11/Xsession.d/50xfree86-common_determine-startup
and
/etc/X11/Xsession.d/99xfree86-common_start
.
Execution of /etc/X11/Xsession
is somewhat affected by
/etc/X11/Xsession.options
and is essentially an execution of a
program which was first found in the following order with the exec
command:
~/.xsession
or ~/.Xsession
, if it is defined.
/usr/bin/x-session-manager
, if it is defined.
/usr/bin/x-window-manager
, if it is defined.
/usr/bin/x-terminal-emulator
, if it is defined.
The exact meaning of these commands is determined by the Debian alternative system described in Alternative 指令, 第 6.5.3 節. For example:
# update-alternatives --config x-session-manager ... or # update-alternatives --config x-window-manager
In order to make any X window manager a default while keeping GNOME and KDE
session managers installed, replace
/etc/X11/Xsession.d/50xfree86-common_determine-startup
with the
one attached in the second bug report at http://bugs.debian.org/168347
(I hope this will be included soon) and edit
/etc/X11/Xsession.options
as follows to disallow the X session
manager:
# /etc/X11/Xsession.options # # configuration options for /etc/X11/Xsession # See Xsession.options(5) for an explanation of the available options. # Default enabled allow-failsafe allow-user-resources allow-user-xsession use-ssh-agent # Default disabled (enable them by uncommenting) do-not-use-x-session-manager #do-not-use-x-window-manager
Without the abovementioned modification to the system,
gnome-session
and kdebase
are the packages containing
these X session managers. Removing them allows X window manager to be a
default. (Yack, any better idea?)
On a system where /etc/X11/Xsession.options
contains a line
allow-user-xsession without preceding characters, any user who
defines ~/.xsession
or ~/.Xsession
will be able to
customize the action of /etc/X11/Xsession
.
The last command in the ~/.xsession
file should use form of
exec some-window/session-manager to start your favorite
X window/session manager.
A good example of an ~/.xsession
script is given at
/usr/share/doc/xfree86-common/examples/xsession.gz
.
I use this to set the window manager, screen access, and language support for each user account. See Start a particular X session/window manager, 第 9.4.5.2 節, Gain root in X, 第 9.4.11 節, and Example for a bilingual system (Japanese EUC and ISO-8859-1), 第 9.7.8 節.
User-specific additional X resources can be stored in
~/.Xresources
, while system-wide X resources are stored in
/etc/X11/Xresources/*
. See xrdb(1x)
.
User-customized keymaps and pointer button mappings in X can be specified in
~/.xmodmaprc
. See xmodmap(1x)
.
Following the principle described at Custom X session, 第 9.4.5.1 節, a user-specific X session/window manager can be activated by
installing the package indicated and setting the contents at the end of
~/.xsession
file as follows. (I like
blackbox
/fluxbox
for its simple style and fast
speed.):
gnome-session
kdebase
(or kdebase3
for KDE3)
blackbox
fluxbox
xfce
icewm
fvwm
wmaker
enlightenment
In order to setup full KDE or GNOME environment, the following metapackages are useful:
kde
package
gnome
package
Installing these packages with tools which handle recommends, such
as dselect
and aptitudes
, provides you with richer
choices of software than just installing these with apt-get
.
If you want console login, be sure to disable X display managers, such as
kdm
, gdm
, and wdm
, which may be pulled
in by the dependencies, as described in 「我不想直接啟動到 X!」, 第 8.1.4 節.
If you want to have GNOME as the system default over KDE, make sure to
configure x-session-manager
as in Alternative 指令, 第 6.5.3 節.
Because a remote TCP/IP socket connection without encryption is prone to an
eavesdropping attack, the default setting for X in recent Debian versions
disables the TCP/IP socket. Consider using ssh
for a remote X
connection (see Remote X connection: ssh
, 第 9.4.8 節).
The method described here is not encouraged unless one is in a very secure environment behind a good firewall system with only trusted users present. Use the following command to verify your current X server setting for the TCP/IP socket:
# find /etc/X11 -type f -print0 | xargs -0 grep nolisten /etc/X11/xinit/xserverrc:exec /usr/bin/X11/X -dpi 100 -nolisten tcp
Remove -nolisten to restore TCP/IP listening on the X server.
xhost
xhost
allows access based on hostnames. This is very insecure.
The following will disable host checking and allow connections from anywhere if
a TCP/IP socket connection is allowed (see TCP/IP connection
to X, 第 9.4.6 節):
$ xhost +
You can re-enable host checking with:
$ xhost -
xhost
does not distinguish between different users on the remote
host. Also, hostnames (addresses actually) can be spoofed.
This method must be avoided even with more restrictive host criteria if you're
on an untrusted network (for instance with dialup PPP access to the Internet).
See xhost(1x)
.
ssh
The use of ssh
enables a secure connection from a local X server
to a remote application server.
/etc/ssh/sshd_config
of the remote host, if
you want to avoid corresponding command-line options.
xterm
in the local host.
ssh
to establish a connection with the remote site.
localname @ localhost $ ssh -q -X -l loginname remotehost.domain Password: .....
loginname @ remotehost $ gimp &
This method allows the display of the remote X client output as if it were locally connected through a local UNIX domain socket.
xterm
Learn everything about xterm
at http://dickey.his.com/xterm/xterm.faq.html
.
Many older X programs, such as xterm
, use the X resource database
to configure their appearance. The file ~/.Xresources
is used to
store user resource specifications. This file is automatically merged into the
default X resources upon login.
Here are some helpful settings to add to your ~/.Xresources
file:
! Set the font to a more readable 9x15 XTerm*font: 9x15 ! Display a scrollbar XTerm*scrollBar: true ! Set the size of the buffer to 1000 lines XTerm*saveLines: 1000
To make these settings take effect immediately, merge them into the database using the command:
xrdb -merge ~/.Xresources
If a GUI program needs to be run with root privilege, use the following procedures to display program output on a user's X server. Never attempt to start an X server directly from the root account in order to avoid possible security risks.
Start the X server as a normal user and open an xterm
console.
Then:
$ XAUTHORITY=$HOME/.Xauthority $ export XAUTHORITY $ su root Password:***** # printtool &
When using this trick to su
to a non-root user, make sure
~/.Xauthority
is group readable by this non-root user.
To automate this command sequence, create a file ~/.xsession
from
the user's account, containing the following lines:
# This makes X work when I su to the root account. if [ -z "$XAUTHORITY" ]; then XAUTHORITY=$HOME/.Xauthority export XAUTHORITY fi unset XSTARTUP # If a particular window/session manager is desired, uncomment # the following and edit it to fit your needs. #XSTARTUP=/usr/bin/blackbox # This starts x-window/session-manager program if [ -z "$XSTARTUP" ]; then if [ -x /usr/bin/x-session-manager ]; then XSTARTUP=x-session-manager elif [ -x /usr/bin/x-window-manager ]; then XSTARTUP=x-window-manager elif [ -x /usr/bin/x-terminal-emulator ]; then XSTARTUP=x-terminal-emulator fi fi # execute autoselected X window/session manager exec $XSTARTUP
Then run su
(not su -) in an xterm
window of the user. Now GUI programs started from this xterm
can
display output on this user's X window while running with root privilege. This
trick works as long as the default /etc/X11/Xsession
is executed.
If a user set up his customization using ~/.xinit
or
~/.xsession
, the abovementioned environment variable
XAUTHORITY needs to be set similarly in those scripts.
Alternatively, sudo
can be used to automate the command sequence:
$ sudo xterm ... or $ sudo -H -s
Here /root/.bashrc
should contain:
if [ $SUDO_USER ]; then sudo -H -u $SUDO_USER xauth extract - $DISPLAY | xauth merge - fi
This works fine even with the home directory of the user on an NFS mount,
because root does not read the .Xauthority
file.
There are also several specialized packages for this purpose:
kdesu
, gksu
, gksudo
,
gnome-sudo
, and xsu
. Some other methods can be used
to achieve similar results: creating a symlink from
/root/.Xauthority
to the user's corresponding one; use of the
script sux
; or putting
"xauth merge ~USER_RUNNING_X/.Xauthority" in
the root initialization script.
See more on the debian-devel
mailing list
.
The standard xfs
in XFree86-4 works fine with TrueType fonts. You
have to install a third-party font server such as xfs-xtt
, if you
are using XFree86-3.
You just need to make sure that whatever apps you want to use the TrueType fonts are linked against libXft or libfreetype (you probably don't even have to worry about this if you're using precompiled .debs).
Remember to install required font files and generate the
fonts.{scale,dir}
files so that the fonts can be indexed and used.
Since Free fonts are sometimes limited, installing or sharing some commercial TrueType fonts is an option for a Debian users. In order to make this process easy for the user, some convenience packages have been created:
ttf-commercial
msttcorefonts (>1.1.0)
(The package in Woody does not work as
of 8/2002 due to a change in Microsoft's website.)
You'll have a really good selection of TT fonts at the expense of contaminating your Free system with non-Free fonts.
There are a few web browser packages with graphical display capabilities as of the Woody release:
mozilla
The Mozilla browser (new)
galeon
Mozilla-based browser with a Gnome UI (new)
konqueror
KDE browser
dillo
GTK browser
amaya-gtk
W3C reference browser
amaya-lesstif
W3C reference browser
netscape-...
(many, old)
communicator-...
(many, old)
The version of mozilla
must match the version that
galeon
requires. Although they differ in UI, these two programs
share the Gecko HTML rendering engine.
Plug-ins for browsers such as mozilla
and galeon
can
be enabled by installing "*.so" manually in the plug-in
directory and restarting the browsers.
Plug-in resources:
http://java.sun.com
.
http://www.macromedia.com/software/flashplayer/
.
freewrl
: VRML browser and Netscape plug-in
SSH (Secure SHell) is the secure way to connect over the Internet. A free
version of SSH called OpenSSH is available as the ssh
package in
Debian.
First install the OpenSSH server and client.
# apt-get update && apt-get install ssh
The non-US entry in the /etc/apt/source.list
is required.
/etc/ssh/sshd_not_to_be_run
must not be present if one wishes to
run the OpenSSH server.
SSH has two authentication protocols:
.rhosts
or /etc/hosts.equiv
authentication combined with public key client host authentication (disabled)
Be careful about these differences if you are migrating to Woody or using a non-Debian system.
See /usr/share/doc/ssh/README.Debian.gz
, ssh(1)
,
sshd(8)
, ssh-agent(1)
, and ssh-keygen(1)
for details.
Following are the key configuration files:
/etc/ssh/ssh_config
: SSH client defaults. See
ssh(1)
. Notable entries are:
/etc/ssh/sshd_config
: SSH server defaults. See
sshd(8)
. Notable entries are:
sshd
should listen on. Multiple options are permitted.
$HOME/.ssh/authorized_keys
: the lists of the default public keys
that clients use to connect to this account on this host. See
ssh-keygen(1)
.
$HOME/.ssh/identity
: See ssh-add(1)
and
ssh-agent(1)
.
The following will start an ssh
connection from a client.
$ ssh username@hostname.domain.ext $ ssh -1 username@hostname.domain.ext # Force SSH version 1 $ ssh -1 -o RSAAuthentication=no -l username foo.host # force password on SSH1 $ ssh -o PreferredAuthentications=password -l username foo.host # force password on SSH2
For the user, ssh
functions as a smarter and more secure
telnet
(will not bomb with ^]).
To establish a pipe to connect to port 25 of remote-server from port
4025 of localhost, and to port 110 of remote-server from port 4110
of localhost through ssh
, execute on the local machine:
# ssh -q -L 4025:remote-server:25 4110:remote-server:110 \ username@remote-server
This is a secure way to make connections to SMTP/POP3 servers over the
Internet. Set the AllowTcpForwarding entry to yes in
/etc/ssh/sshd_config
of the remote host.
One can avoid having to remember a password for each remote system by using RSAAuthentication (SSH1 protocol) or PubkeyAuthentication (SSH2 protocol).
On the remote system, set the respective entries, "RSAAuthentication
yes" or "PubkeyAuthentication yes", in
/etc/ssh/sshd_config
.
Then generate authentication keys locally and install the public key on the remote system:
$ ssh-keygen # RSAAuthentication: RSA1 key for SSH1 $ cat .ssh/identity | ssh user1@remote \ "cat - >>.ssh/authorized_keys" ... $ ssh-keygen -t rsa # PubkeyAuthentication: RSA key for SSH2 $ cat .ssh/id_rsa.pub | ssh user1@remote \ "cat - >>.ssh/authorized_keys" ... $ ssh-keygen -t dsa # PubkeyAuthentication: DSA key for SSH2 $ cat .ssh/id_dsa.pub | ssh user1@remote \ "cat - >>.ssh/authorized_keys"
One can change the passphrase later with "ssh-keygen -p". Make sure to verify settings by testing the connection. In case of any problem, use "ssh -v".
You can add options to the entries in authorized_keys
to limit
hosts and to run specific commands. See sshd(8)
for details.
Note that SSH2 has HostbasedAuthentication. For this to work, you
must adjust the settings of HostbasedAuthentication to
yes in both /etc/ssh/sshd_config
on the server
machine and /etc/ssh/ssh_config
or $HOME/.ssh/config
on the client machine.
There are a few free SSH clients available for non-Unix-like platforms.
puTTY
(GPL)
cygwin
(GPL)
macSSH
(GPL) [Note that Mac
OS X includes OpenSSH; use ssh in the Terminal application]
See also SourceForge.net, site
documentation
, "6. CVS Instructions".
It is safer to protect your SSH authentication key with a passphrase. If it was not set, use ssh-keygen -p to set it.
Place your public key (e.g. ~/.ssh/id_rsa.pub
) into
~/.ssh/authorized_keys
on a remote host using a password-based
connection to the remote host as described in Connect with
fewer passwords, 第 9.5.3 節.
$ ssh-agent bash # or run zsh/tcsh/pdksh program instead. $ ssh-add ~/.ssh/id_rsa Enter passphrase for /home/osamu/.ssh/id_rsa: Identity added: /home/osamu/.ssh/id_rsa (/home/osamu/.ssh/id_rsa) $ scp foo user@remote.host:foo ... no passphrase needed from here on :-) $^D ... terminating ssh-agent session
For the X server, normal Debian startup scripts execute ssh-agent
as parent process. So you only need to execute ssh-add
once.
For more, read ssh-agent(1)
and ssh-add(1)
.
If you have problems, check the permissions of configuration files and run
ssh
with the "-v" option.
Use the "-P" option if you are root and have trouble with a firewall; this avoids the use of server ports 1–1023.
If ssh
connections to a remote site suddenly stop working, it may
be the result of tinkering by the sysadmin, most likely a change in
host_key
during system maintenance. After making sure this is the
case and nobody is trying to fake the remote host by some clever hack, one can
regain a connection by removing the host_key
entry from
$HOME/.ssh/known_hosts
on the local machine.
Mail configuration divides into three categories:
exim
, postfix
,
sendmail
, qmail
, ssmtp
,
nullmailer
, ...
procmail
, fetchmail
,
mailx
, ...
mutt
, emacs
+gnus
,
...
For a full-featured MTA, use exim
. References:
exim-doc
and exim-doc-html
packages
http://www.exim.org/
The only reasonable alternative MTA is postfix
if you care about
security. sendmail
and qmail
are available as Debian
packages but are not recommended.
If you do not need the relay capability of an MTA as in the case of a satellite system such as a laptop PC, you may consider using one of these lightweight packages:
ssmtp
: needs an SMTP connection and is alias-capable, or
nullmailer
: can spool but is not alias-capable.
At this moment, I find exim
to be more suitable even for my
personal workstation machine, which is a laptop PC.
You may need to remove exim
for the installation of these
conflicting packages:
# dpkg -P --force-depends exim # apt-get install nullmailer # or ssmtp
In order to use exim
as your MTA, configure the following:
/etc/exim/exim.conf "eximconfig" to create and edit /etc/inetd.conf comment out smtp to run exim as daemon /etc/email-addresses Add spoofed source address lists check filters using exim -brw, -bf, -bF, -bV, ... etc.
In /etc/exim/exim.conf
(Woody or later), in the DIRECTORS part, at
the end (after the localuser: director) add a catch-all director that matches
all addresses that the previous directors couldn't resolve (per Miquel van
Smoorenburg):
catchall: driver = smartuser new_address = webmaster@mydomain.com
If one wants to have more a detailed recipe for each virtual domain, etc., add
the following at the end of /etc/exim/exim.conf
(per me, not well
tested):
*@yourdomain.com ${lookup{$1}lsearch*{/etc/email-addresses} \ {$value}fail} T
Then have an "*" entry in /etc/email-addresses
.
Selective address rewrite for outgoing mail to produce proper "From:"
headers can be done using exim
by configuring near the end of
/etc/exim/exim.conf
:
*@host1.something.dyndns.org \ "${if eq {${lookup{$1}lsearch{/etc/passwd}{1}{0}}} {1} \ {$0}{$1@somethig.dyndns.org}}" frFs
This rewrites all addresses matching *@host1.something.dyndns.org.
/etc/password
to see if the local part ($1) is
a local user or not.
Some SMTP services such as yahoo.com require SMTP auth. Configure
/etc/exim/exim.conf
as follows:
remote_smtp: driver = smtp authenticate_hosts = smtp.mail.yahoo.com ... smarthost: driver = domainlist transport = remote_smtp route_list = "* smtp.mail.yahoo.com bydns_a" ... plain: driver = plaintext public_name = PLAIN client_send = "^cmatheson3^this_is_my_password"
Do not forget double quotes in the last line.
fetchmail
is run in daemon mode to fetch mail from a POP3 account
with an ISP into the local mail system. Configure:
/etc/init.d/fetchmail /etc/rc?.d/???fetchmail run update-rc.d fetchmail default priority 30 /etc/fetchmailrc configuration file (chown 600, owned by fetchmail)
Information on how to start fetchmail
as a daemon from the
init.d
script for Potato is confusing (Woody fixed this). See the
sample /etc/init.d/fetchmail
and /etc/fetchmailrc
files in the example scripts
.
If your email headers are contaminated by ^M due to your ISP's mailer, add
"stripcr" to your options in $HOME/.fetchmailrc
:
options fetchall no keep stripcr
procmail
is a local mail delivery and filter program. One needs
to create $HOME/.procmailrc
for each account that uses it.
Example: _procmailrc
Use mutt
as the mail user agent (MUA) in combination with
vim
. Customize with ~/.muttrc
; for example:
# use visual mode and "gq" to reformat quotes set editor="vim -c 'set tw=72 et ft=mail'" # # header weeding taken from the manual (Sven's Draconian header weeding) # ignore * unignore from: date subject to cc unignore user-agent x-mailer hdr_order from subject to cc date user-agent x-mailer auto_view application/msword ....
Add the following to /etc/mailcap
or $HOME/.mailcap
to display HTML mail and MS Word attachments inline:
text/html; lynx -force_html %s; needsterminal; application/msword; /usr/bin/antiword '%s'; copiousoutput; description="Microsoft Word Text"; nametemplate=%s.doc
Debian is internationalized, offering support for a growing number of languages and local usage conventions. The next subsection lists some of the forms of diversity that Debian currently supports, and the following subsections discuss localization, the process of customizing your working environment to allow current input and output of your chosen language(s) and conventions for dates, numeric and monetary formats, and other aspects of a system that differ according to your region.
There are several aspects to customizing for localization and national language support.
Debian is distributed with keymaps for nearly two dozen keyboards. In Woody, reconfigure the keyboard by:
The vast majority of Debian software packages support data handling of non-US-ASCII characters through the LC_CTYPE environment variable offered by the locale technology in glibc.
X can display any coding, including UTF-8, and supports all fonts. The list includes not only all the 8-bit fonts but also 16-bit fonts such as Chinese, Japanese, or Korean. Multibyte character input method is supported by the XIM mechanism. See Example for a bilingual system (Japanese EUC and ISO-8859-1), 第 9.7.8 節.
Japanese EUC code display is also available in a (S)VGA graphics console
through the kon2
package. There is an alternative new Japanese
display, jfbterm
, which uses a frame-buffer console, too. In
these console environments, the Japanese input method must be supplied by the
application. Use egg
package for Emacs and use japanized
jvim
package for a Vim environment.
Translations exist for many of the text messages and documents that are displayed in the Debian system, such as error messages, standard program output, menus, and manual pages. Currently, support for manual pages in German, Spanish, Finnish, French, Hungarian, Italian, Japanese, Korean, Polish, Portuguese, Chinese, and Russian is provided through the manpages-LANG packages (where LANG is a comma-separated list of two-letter ISO country codes. Use apt-cache search manpages-|less to get a list of available Unix manual pages.)
To access an NLS manual page, the user must set the environment variable
LC_MESSAGES to the appropriate string. For example, in the case of the
Italian-language manual pages, LC_MESSAGES needs to be set to it.
The man
program will then search for Italian manual pages under
/usr/share/man/it/
.
Debian supports locale technology. Locale is a mechanism that allows programs to provide suitable output and functionality according to local conventions such as character set, format for date and time, currency symbol, and so on. It uses environment variables to determine the appropriate behavior. For example, assuming you have both the American English and German locales installed on your system, the error messages of many programs can be multilingual:
$ LANG="en_US" cat foo cat: foo: No such file or directory $ LANG="de_DE" cat foo cat: foo: Datei oder Verzeichnis nicht gefunden
Glibc offers support for this functionality to programs as a library. See
locale(7)
.
Debian does not come with all available locales precompiled.
Check /usr/lib/locale
to see which locales (besides the default
"C") are compiled for your system. If the one you need is not
present, you have two options:
/etc/locale.gen
to add the desired locale, then run
locale-gen
as root to compile it. See locale-gen(8)
and the manpages listed in its "SEE ALSO" section.
locales
package. Or if it is not already installed, installing
locales
will invoke the debconf interface to let you choose needed
locales and compile the database.
The following environment variables are evaluated in this order to provide particular locale values to programs:
LC_* variables are:
Note that some applications (e.g., Netscape 4) ignore LC_* settings.
The locale
program can display active locale settings and
available locales; see locale(1)
. (NOTE: locale -a
lists all the locales that your system knows about; this does not mean
that all of them are compiled! See Activate
locale support capability, 第 9.7.3 節.)
The locale support for the international date standard of
yyyy-mm-dd (ISO 8601 date format) is provided by the locale called
en_DK, "English in Denmark", which is a bit of joke :-)
This seems to work only in a console screen for ls
.
Add the following lines to ~/.bash_profile
:
LC_CTYPE=en_US.ISO-8859-1 export LC_CTYPE
Add the following lines to ~/.bash_profile
:
LANG=fr_FR@euro export LANG LC_CTYPE=fr_FR@euro export LC_CTYPE
Configure the keyboard for French "AZERTY" as described in Keyboard, 第 9.7.1.1 節; add French manual pages by
installing manpages-fr
. The Right-Alt key in the US is called
Alt-Gr in Europe. Pressing this together with other keys creates numerous
accented and special characters. For example, Alt-Gr+E creates a Euro sign.
Most western European languages can be configured similarly.
See Debian Euro
HOWTO
for adding support for the new Euro currency and Utiliser et
configurer Debian pour le français
for more details in French.
Let us set up a bilingual system: ja_JP.eucJP (Japanese EUC, traditional Unix Japanese environment) in X with English messages and ISO type dates, and en_US.ISO-8859-1 (almost ASCII with accented character support) in the Linux console.
canna
—Local server ("free-beer" license), or
freewnn-jserver
—Network-extensible server (Public Domain)
kinput2-canna
—for X, or
kinput2-canna-wnn
—for X, and
egg
—directly works with Emacsen even in console (optional)
kterm
—X (classic),
mlterm
—X (very neat, variable font size), and
startx
, xdm
, ...)
~/.xsession
that sets the user-specific X environment:
#!/bin/sh # This makes X work when I su to root. if [ -z "$XAUTHORITY" ]; then XAUTHORITY=$HOME/.Xauthority export XAUTHORITY fi # Japanese locale as default, C locale as backup # export LANG=ja_JP.eucJP # make sure to overwrite en_US.ISO-8859-1 used in console #export LC_CTYPE=ja_JP.eucJP # I want menu messages to be English in ASCII :-) export LC_MESSAGES=C # activate input method kinput2 & XMODIFIERS=@im=kinput2 export XMODIFIERS # How about blackbox window manager (lightweight) exec /usr/bin/blackbox
~/.bashrc
:
# Change language environment depending on the console program # X-shells only execute .bashrc (they are not login shells) # General environment for X is set by .xsession if [ $TERM = kterm ] || [ $TERM = mlterm ]; then unset LC_ALL export LANG=C #export LANG=ja_JP.eucJP # For ISO yyyy-mm-dd date display, more natural for Japanese :-) export LC_TIME=en_DK.ISO-8859-1 export LC_MESSAGES=C export LANGUAGE=ja_JP.eucJP:en_US.ISO-8859-1:C export LC_CTYPE=ja_JP.eucJP else unset LC_ALL export LANG=C export LC_TIME=en_DK.ISO-8859-1 export LANGUAGE=en_US.ISO-8859-1:C export LC_CTYPE=en_US.ISO-8859-1 fi
~/.muttrc
:
# UTF-8 support is not popular in popular Japanese EMACS environment # 7-bit encoding of iso-2022-jp is easier for everyone # default encoding order = us-ascii --> iso-8859-1 --> utf-8 #set send_charset="us-ascii:iso-8859-1:utf-8" #set allow_8bit=yes set send_charset="us-ascii:iso-8859-1:iso-2022-jp" set allow_8bit=no
kinput2
for X applications
~/.Xresources
(it looks like Debian takes care of this
automatically somehow).
mlterm
) also allow you to set up
*inputMethod: and other information dynamically at runtime (press
Ctrl-MouseButton-3 in mlterm
).
xdm
, gdm
, kdm
, wdm
, ...)
See also the SuSE pages for
CJK
.
Everyone will need this in the future. See The Unicode
HOWTO
.
UTF-8 support on a FB console is provided by bterm
used in the
debian-installer
.
When you are first setting the system up for a national language
environment, please consider using tasksel
or
aptitude
to find out what packages are selected by choosing the
corresponding language environment task. The package choice made is useful
even for a multilingual setup. If you encounter any package dependency
conflicts during the install to your carefully configured system, avoid
installing any software that conflicts with the existing system. You may have
to use update-alternative
to regain the original state for some
commands since a newly installed one may have higher priority than existing
ones.
Newer major programs are using glibc 2.2 and are mostly internationalized. So
a specially localized version such as jvim
for Vim may not be
needed as its functionality is offered by vim
version 6.0 in X.
In reality, it is still somewhat rough-edged. Since jvim
has a
version compiled with direct Japanese input method (canna
) support
even in the console and addresses many other Japanese-specific issues maturely,
you may still want it :-)
Programs may need to be configured beyond locale configuration to
enable a comfortable working environment. The language-env
package and its command set-language-env
greatly eases this
process.
Also see the internationalization document, Introduction to
i18n
. It is aimed at developers but is also useful for system
administrators.
Debian 參考手冊
1.06-16, 週六 一月 3 21:37:21 UTC 2004osamu@debian.org
wctang@csie.nctu.edu.tw