[ 上一頁 ] [ 目錄 ] [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ A ] [ 下一頁 ]

Debian 參考手冊
第 9 章 - Tuning a Debian system


This chapter describes only the basics of system configuration through a text-based interface. A prerequisite of this chapter is reading Debian 系統安裝提示, 第 3 章.

For the security conscious, it is highly recommended to read the Securing Debian Manual, which can also be found as the harden-doc package.


9.1 System initialization hints

See The init program, 第 2.4.1 節 for the basics of the Debian init script.


9.1.1 Customizing init scripts

Debian uses the System V init script system. Although all init scripts in /etc/init.d/* are marked as conffiles and sysadmins are free to modify them, customizing init scripts by editing files in /etc/default/* is the preferred approach.

For example, /etc/init.d/rcS can be used to customize boot-time defaults for motd, sulogin, etc.


9.1.2 Customizing system logging

System log mode can be configured using /etc/syslog.conf. Check the colorize package for a program to colorize system logfiles. See also syslogd(8) and syslog.conf(5).


9.1.3 Hardware access optimization

There are a few hardware optimization configurations that Debian leaves to the sysadmin to take care of.

Mounting a filesystem with the noatime option is also very effective in speeding up read access to the file. See fstab(5) and mount(8).

Some hardware can be tuned directly by the Linux kernel itself through the proc filesystem. See Tuning the kernel through the proc filesystem, 第 7.3 節.

There are many hardware-specific configuration utilities in Debian. Many of them address needs specific to the laptop PC. Here are some interesting packages available in Debian:

Here, ACPI is a newer framework for the power management system than APM.

Some of these packages require special kernel modules. They are already included in the latest kernel source in many cases. In case of trouble, you may need to apply the latest patch to the kernel yourself.


9.2 Access control


9.2.1 Access control through PAM and login

PAM (Pluggable Authentication Modules) provides login control.

     /etc/pam.d/*             # PAM control files
     /etc/pam.d/login         # PAM control file for login
     /etc/security/*          # PAM module parameters
     /etc/securetty           # this controls root login by console (login)
     /etc/login.defs          # this controls login behaviors (login)

Change the contents of /etc/pam.d/login as follows, if you want insecure but passwordless console terminals at your own risk.

     #auth       required   pam_unix.so nullok
     auth       required   pam_permit.so

Similar tricks can be applied for xdm, gdm, ..., for passwordless console X.

On the other hand, install cracklib2 and set /etc/pam.d/passwd as follows, if you want to enforce a good password policy.

     password required       pam_cracklib.so retry=3 minlen=6 difok=3

A one-time login password for account activation may also help. For this, use the passwd command with the -e option. See passwd(1).

The maximum number of processes can be set with ulimit -u 1000 in a Bash shell or with settings in /etc/security/limits.conf from PAM. Other parameters such as core can be set similarly. The initial value of PATH can be set by /etc/login.defs before the shell startup script.

The documentation for PAM is packaged in the libpam-doc package. The Linux-PAM System Administrator's Guide covers configuring PAM, what modules are available, etc. The documentation also includes The Linux-PAM Application Developers' Guide and The Linux-PAM Module Writers' Guide.


9.2.2 "Why GNU su does not support the wheel group"

This is the famous phrase at the bottom of the old info su page by Richard M. Stallman. Not to worry: the current su in Debian uses PAM, so that one can restrict the ability to use su to any group using pam_wheel.so in /etc/pam.d/su. The following will set the adm group in a Debian system as an equivalent of the BSD wheel group and allow su without a password for its members.

     # anti-RMS configuration in /etc/pam.d/su
     auth       required   pam_wheel.so group=adm
     
     # Wheel members to be able to su without a password
     auth       sufficient pam_wheel.so trust group=adm

9.2.3 Meaning of various groups

A few interesting groups:

For a complete list, see the "FAQ" section in the Securing Debian Manual, which can also be found as the harden-doc package in Woody. Also the new base-passwd (>3.4.6) contains an authoritative list: /usr/share/doc/base-passwd/users-and-groups.html.


9.2.4 sudo – a safer work environment

My usage of sudo is mostly a protection from my own stupidity. Personally, I consider using sudo a better alternative to always using the system as root.

Install sudo and activate it by setting options in /etc/sudoers. Also check out the sudo group feature in /usr/share/doc/sudo/OPTIONS.

The sample configuration provides "staff" group members access to any commands run as root under sudo and also gives "src" members access to selected commands run as root under sudo.

The advantage of sudo is that it only requires an ordinary user's password to log in, and activity is monitored. This is a nice way to give some authority to a junior administrator. For example:

     $ sudo chown -R myself:mygrp .

Of course if you know the root password (as most home users do), any command can be run under root from a user account:

     $ su -c "shutdown -h now"
     Password:

(I know I should tighten the admin account's sudo privileges. But since this is my home server, I have not bothered yet.)

For a different program that allows ordinary users to run commands with root privileges, see the super package.


9.2.5 Access control to daemon programs

The Internet super-server, inetd, is started at boot time by /etc/rc2.d/S20inetd (for RUNLEVEL=2), which is a symlink to /etc/init.d/inetd. Essentially, inetd allows one running daemon to invoke several others, reducing load on the system.

Whenever a request for service arrives, its protocol and service are identified by looking them up in the databases in /etc/protocols and /etc/services. inetd then looks up a normal Internet service in the /etc/inetd.conf database, or a Sun-RPC based service in /etc/rpc.conf.

For system security, make sure to disable unused services in /etc/inetd.conf. Sun-RPC services need to be active for NFS and other RPC-based programs.

Sometimes, inetd does not start the intended server directly but starts the tcpd TCP/IP daemon wrapper program with the intended server name as its argument in /etc/inetd.conf. In this case, tcpd runs the appropriate server program after logging the request and doing some additional checks using /etc/hosts.deny and /etc/hosts.allow.

If you have problems with remote access in a recent Debian system, comment out "ALL: PARANOID" in /etc/hosts.deny if it exists.

For details, see inetd(8), inetd.conf(5), protocols(5), services(5), tcpd(8), hosts_access(5), and hosts_options(5).

For more information on Sun-RPC, see rpcinfo(8), portmap(8), and /usr/share/doc/portmap/portmapper.txt.gz.


9.2.6 Lightweight Directory Access Protocol

References:


9.3 CD-writer

CD-writers with ATAPI/IDE interfaces have recently become a very popular option. It is a nice medium for system backup and archiving for the home user needing < 640MB capacity. For the most authoritative information, see the LDP CD-Writing-HOWTO.


9.3.1 Introduction

First, any disruption of data sent to the CD-writer will cause irrecoverable damage to the CD. Get a CD-writer with as large a buffer as possible. If money is no object, do not bother with ATAPI/IDE, just get a SCSI version. If you have a choice of IDE interface to be connected, use the one on the PCI-bus (i.e., on the motherboard) rather than one on the ISA-bus (an SB16 card, etc.).

When a CD-writer is connected to IDE, it has to be driven by the IDE-SCSI driver instead of an ordinary IDE CD driver for Linux 2.2 and 2.4 kernels. Also, the SCSI generic driver needs to be activated. There are two possible approaches to doing this, assuming a kernel distributed with modern distributions (as of March 2001).


9.3.2 Approach 1: modules + lilo

Add the following line to /etc/lilo.conf if you are using a stock Debian kernel. If multiple options are used, list them separated by spaces:

     append="hdx=ide-scsi ignore=hdx"

Here the location of the CD-writer, which is accessed through the ide-scsi driver, is indicated by hdx, where x represents one of the following:

     hda          for a master on the first IDE port
     hdb          for a slave on the first IDE port
     hdc          for a master on the second IDE port
     hdd          for a slave on the second IDE port
     hde ... hdh  for a drive on an external IDE port or ATA66/100 IDE port

Type the following commands as root to activate after finishing all the configuration:

     # lilo
     # shutdown -h now

9.3.3 Approach 2: recompile the kernel

Debian uses make-kpkg to create a kernel. Use the new --append_to_version with make-kpkg to build multiple kernel images. See The Linux kernel under Debian, 第 7 章.

Use the following setup through make menuconfig:


9.3.4 Post-configuration steps

Kernel support for the CD-writer can be activated during booting by the following:

     # echo ide-scsi >>/etc/modules
     # echo sg       >>/etc/modules
     # cd /dev; ln -sf scd0 cdrom

Manual activation can be done by:

     # modprobe ide-scsi
     # modprobe sg

After reboot, you can check installation by:

     $ dmesg|less
     # apt-get install cdrecord
     # cdrecord -scanbus

[Per Warren Dodge] Sometimes there may be conflicts between ide-scsi and ide-cd if there are both CD-ROM and CD-R/RW on the system. Try adding the following line to your /etc/modutils/aliases, running update-modules, and rebooting.

     pre-install      ide-scsi      modprobe ide-cd

This causes the IDE driver to load before ide-scsi. The IDE driver ide-cd takes control of the ATAPI CD-ROM—anything that it hasn't been told to ignore. That leaves just the ignored devices for ide-scsi to control.


9.3.5 CD-image file (bootable)

To create a CD-image of files under target-directory/ as cd-image.raw (bootable, Joliet TRANS.TBL-enabled format; if not bootable, take out -b and -c options), insert a boot floppy in the first floppy drive and

     # dd if=/dev/fd0 target-directory/boot.img 
     # mkisofs -r -V volume_id -b boot.img -c bootcatalog -J -T \
             -o cd-image.raw target_directory/

One funny hack is to make a bootable DOS CD-ROM. If an ordinary DOS boot floppy disk image is in the above boot.img, the CD-ROM will boot as if a DOS floppy were in the first floppy drive (A:). Doing this with freeDOS may be more interesting.

This CD-image file can be inspected by mounting it on the loop device.

     # mount -t iso9660 -o ro,loop cd-image.raw /cdrom
     # cd /cdrom
     # mc
     # umount /cdrom

9.3.6 Write to the CD-writer (R, RW):

First test with (assuming double speed)

     # nice --10 cdrecord -dummy speed=2 dev=0,0 disk.img

Then if OK, write to CD-R with

     # nice --10 cdrecord -v -eject speed=2 dev=0,0 disk.img

Or write to a CD-RW disk with

     # nice --10 cdrecord -v -eject blank=fast speed=2 dev=0,0 disk.img

Some CD-RW drives work better with

     # nice --10 cdrecord -v blank=all speed=2 dev=0,0 disk.img

followed by

     # nice --10 cdrecord -v -eject speed=2 dev=0,0 disk.img

Two steps are needed to prevent SCSI timeouts during blanking from interfering with the burning step. The argument value to nice may require some adjustments.


9.3.7 Make an image file of a CD

Some CD-Rs and commercial CDs have junk sectors at the end that make copying by dd impossible (the Windows 98 CD is one of them). The cdrecord package comes with the readcd command. Use this to copy any CD contents to an image file. If it is a data disk, mount it and run df to see its actual size. Divide the number shown in blocks (1 block = 1024 bytes) by 2 to get the number of actual CD sectors (1 sector = 2048 bytes). Run readcd with options and use this disk image to burn the CD-R/RW.

     # readcd dev=target,lun,scsibusno # select function 11

Here, set all three parameters to 0 for most cases. Usually the number of sectors given by readcd is excessive! Use the above number from an actual mount for better results.

It should be noted that the use of dd has a few problems if used on CD-ROM. The first run of the dd command may cause an error message and may yield a shorter disk image with a lost tail-end. The second run of dd command may yield a larger disk image with garbage data attached at the end on some systems if the data size is not specified. Only the second run of the dd command with the correct data size specified, and without ejecting the CD after an error message, seems to avoid these problems. If for example the image size displayed by df is 46301184 blocks, use the following command twice to get the right image (this is my empirical information):

     # dd if=/dev/cdrom of=cd.img bs=2048 count=$((46301184/2))

9.3.8 Debian CD images

To obtain the latest information on Debian CDs, visit the Debian CD site.

If you have a fast Internet connection, think about installing over the network using:

If you do not have a fast Internet connection, think about purchasing CDs from a CD vendor.

Please do not waste bandwidth by downloading standard CD images unless you are a CD image tester (even with the new jigdo method).

One noteworthy CD image is KNOPPIX - Live Linux Filesystem On CD. This CD will boot a functioning Debian system without installing itself to the hard disk.


9.3.9 Back up the system to CD-R

To copy key configuration files and data files to CD-R, use the example backup script "backup". Also see 拷貝及建立子目錄, 第 8.3 節 and 差異備份與資料同步, 第 8.4 節.


9.3.10 Copy a music CD to CD-R

Not tested by me:

     # apt-get install cdrecord cdparanoia
     # cdparanoia -s -B
     # cdrecord dev=0,0,0 speed=2 -v -dao -eject defpregap=1 -audio *.wav

or,

     # apt-get install cdrdao #disk at once
     # cdrdao read-cd --device /dev/cdrom --paranoia-mode 3 my_cd # read cd
     # cdrdao write --device /dev/cdrom --speed 8 my_cd    # write a new CD

cdrdao does a real copy (no gaps, etc...).


9.4 The X program

The X environment is provided by Xfree86. There are two major versions of X server available on the Debian system: Xfree86 Version 3.3 (XF3) and XFree86 Version 4.x series (XF4) both based on X11R6 specifications by X.Org.

For the basics of X, refer to X(7), the LDP XWindow-User-HOWTO, and the Remote X Apps mini-HOWTO. For a Debian-specific user guide, read /usr/share/doc/xfree86-common/FAQ.gz provided in the xfree86-common package. This contains an interesting and authoritative review of the key binding issues by Branden Robinson.

X server, 第 9.4.3 節
a program on a local host that displays an X window and/or desktop on a user's monitor (CRT, LCD) and accepts keyboard and mouse input.
X client, 第 9.4.4 節
a program on a (local or remote) host that runs X-compatible application software.

This reverses the ordinary use of "server" and "client" in other contexts.

There are several ways of getting the "X server" (display side) to accept remote connections from an "X client" (application side):

All remote connection methods, except ssh, require TCP/IP connection enabled on the X server. See TCP/IP connection to X, 第 9.4.6 節.


9.4.1 X system packages

There are a few (meta)packages provided to ease installation of the X system in Woody.

x-window-system-core
This metapackage provides the essential components for a stand-alone workstation running the X Window System. It provides the X libraries, an X server (xserver-xfree86), a set of fonts, and a group of basic X clients and utilities.
x-window-system
This metapackage provides substantially all the components of the X Window System as developed by the XFree86 Project, as well as a set of historically popular accessory programs. (Notably, it depends on x-window-system-core, twm, and xdm, i.e., no need to install x-window-system-core if you install this.)
xserver-common-v3
Files and utilities common to XFree86 3.x X servers (XF3)
xserver-*
Supplemental XF3 server packages to support hardware not supported by the new XF4 server for whatever reason. Some old ATI mach64 cards are not supported in XF4, other cards hang badly in the Woody version of XF4, etc. (For available packages, use apt-cache search xserver-|less. All of these XF3 servers depend on xserver-common-v3.)

For most cases, x-window-system is the package to install. (If you want console login, be sure to disable xdm as described in 「我不想直接啟動到 X!」, 第 8.1.4 節.)


9.4.2 Hardware detection packages for the X server

To enable hardware detection during the X configuration stage, install the following packages prior to installing the X system.:


9.4.3 X server

See XFree86(1x) for X server information.

Invoke X server from a local console:

     $ startx -- :<display> vtXX
     e.g.:
     $ startx -- :1 vt8 -bpp 16
     ... start on vt8 connected to localhost:1 with 16 bpp mode

Arguments given after -- are for the X server.

Note, when using a ~/.xserverrc script to customize the X server startup process, be sure to exec the real X server. Failing to do this can make the X server slow to start and exit. For example:

     #!/bin/sh
     exec /usr/bin/X11/X -dpi 100 -nolisten tcp

9.4.3.1 Configure an XF4 server

To (re-)configure an XF4 server,

     # dpkg-reconfigure --priority=low xserver-common
     # dpkg-reconfigure --priority=low xserver-xfree86

will generate /etc/X11/XF86Config-4 file and configure X using the script dexconf.


9.4.3.2 Configure an XF3 server

To (re-)configure an XF3 server,

     # dpkg-reconfigure --priority=low xserver-common-v3
     # dpkg-reconfigure --priority=low xserver-mach64

will generate /etc/X11/XF86Config file and configure X using the script xf86config-v3.


9.4.3.3 Manually configure an X server

To add user customizations, do not edit the configuration file between the text (this is XF4):

     ### BEGIN DEBCONF SECTION
     [snip]
     ### END DEBCONF SECTION

Instead, add the customizations before the text. For example, to use a custom video device, add something resembling the following text to the top of the file:

     Section "Device"
       Identifier        "Custom Device"
       Driver            "ati"
       Option            "NoAccel"
     EndSection
     
     Section "Screen"
       Identifier  "Custom Screen"
       Device      "Custom Device"
       Monitor     "Generic Monitor"
       DefaultDepth 24
       Subsection "Display"
         Depth       8
         Modes       "1280x960" "1152x864" "1024x768" "800x600" "640x480"
       EndSubsection
       Subsection "Display"
         Depth       16
         Modes       "1280x960" "1152x864" "1024x768" "800x600" "640x480"
       EndSubsection
       Subsection "Display"
         Depth       24
         Modes       "1280x960" "1152x864" "1024x768" "800x600" "640x480"
       EndSubsection
     EndSection
     
     Section "ServerLayout"
         Identifier        "Custom"
         Screen            "Custom Screen"
         InputDevice       "Generic Keyboard" "CoreKeyboard"
         InputDevice       "Configured Mouse" "CorePointer"
     EndSection

9.4.4 X client

Most X client programs can be started with a command like this:

     client $ xterm -geometry 80x24+30+200 -fn 6x10 -display hostname:0 &

Here, the optional command-line arguments mean:

The default displayname for the X client program (application side) can be set by the DISPLAY environment variable. For example, prior to running an X client program, executing one of the following commands achieves this:

     $ export DISPLAY=:0 
             # The default, local machine using the first X screen
     $ export DISPLAY=hostname.fulldomain.name:0.2
     $ export DISPLAY=localhost:0

Its startup can be customized by ~/.xinitrc. For example:

     xrdb -load $HOME/.Xresources
     xsetroot -solid gray &
     xclock -g 50x50-0+0 -bw 0 &
     xload -g 50x50-50+0 -bw 0 &
     xterm -g 80x24+0+0 &
     xterm -g 80x24+0-0 &
     twm

As described in Custom X session, 第 9.4.5.1 節, this overrides everything normal execution of Xsession does when started from startx. Use ~/.xsession instead and use this approach only as the last resort.


9.4.5 X session

An X session (X server + X client) can be started by:

The console can be made available as in 「我不想直接啟動到 X!」, 第 8.1.4 節.


9.4.5.1 Custom X session

The default startup script /etc/X11/Xsession is effectively a combination of /etc/X11/Xsession.d/50xfree86-common_determine-startup and /etc/X11/Xsession.d/99xfree86-common_start.

Execution of /etc/X11/Xsession is somewhat affected by /etc/X11/Xsession.options and is essentially an execution of a program which was first found in the following order with the exec command:

  1. ~/.xsession or ~/.Xsession, if it is defined.
  2. /usr/bin/x-session-manager, if it is defined.
  3. /usr/bin/x-window-manager, if it is defined.
  4. /usr/bin/x-terminal-emulator, if it is defined.

The exact meaning of these commands is determined by the Debian alternative system described in Alternative 指令, 第 6.5.3 節. For example:

     # update-alternatives --config x-session-manager
     ... or
     # update-alternatives --config x-window-manager

In order to make any X window manager a default while keeping GNOME and KDE session managers installed, replace /etc/X11/Xsession.d/50xfree86-common_determine-startup with the one attached in the second bug report at http://bugs.debian.org/168347 (I hope this will be included soon) and edit /etc/X11/Xsession.options as follows to disallow the X session manager:

     # /etc/X11/Xsession.options
     #
     # configuration options for /etc/X11/Xsession
     # See Xsession.options(5) for an explanation of the available options.
     # Default enabled
     allow-failsafe
     allow-user-resources
     allow-user-xsession
     use-ssh-agent
     # Default disabled (enable them by uncommenting)
     do-not-use-x-session-manager
     #do-not-use-x-window-manager

Without the abovementioned modification to the system, gnome-session and kdebase are the packages containing these X session managers. Removing them allows X window manager to be a default. (Yack, any better idea?)

On a system where /etc/X11/Xsession.options contains a line allow-user-xsession without preceding characters, any user who defines ~/.xsession or ~/.Xsession will be able to customize the action of /etc/X11/Xsession.

The last command in the ~/.xsession file should use form of exec some-window/session-manager to start your favorite X window/session manager.

A good example of an ~/.xsession script is given at /usr/share/doc/xfree86-common/examples/xsession.gz.

I use this to set the window manager, screen access, and language support for each user account. See Start a particular X session/window manager, 第 9.4.5.2 節, Gain root in X, 第 9.4.11 節, and Example for a bilingual system (Japanese EUC and ISO-8859-1), 第 9.7.8 節.

User-specific additional X resources can be stored in ~/.Xresources, while system-wide X resources are stored in /etc/X11/Xresources/*. See xrdb(1x).

User-customized keymaps and pointer button mappings in X can be specified in ~/.xmodmaprc. See xmodmap(1x).


9.4.5.2 Start a particular X session/window manager

Following the principle described at Custom X session, 第 9.4.5.1 節, a user-specific X session/window manager can be activated by installing the package indicated and setting the contents at the end of ~/.xsession file as follows. (I like blackbox/fluxbox for its simple style and fast speed.):

See Window Managers for X.


9.4.5.3 Set up a KDE/GNOME environment

In order to setup full KDE or GNOME environment, the following metapackages are useful:

Installing these packages with tools which handle recommends, such as dselect and aptitudes, provides you with richer choices of software than just installing these with apt-get.

If you want console login, be sure to disable X display managers, such as kdm, gdm, and wdm, which may be pulled in by the dependencies, as described in 「我不想直接啟動到 X!」, 第 8.1.4 節.

If you want to have GNOME as the system default over KDE, make sure to configure x-session-manager as in Alternative 指令, 第 6.5.3 節.


9.4.6 TCP/IP connection to X

Because a remote TCP/IP socket connection without encryption is prone to an eavesdropping attack, the default setting for X in recent Debian versions disables the TCP/IP socket. Consider using ssh for a remote X connection (see Remote X connection: ssh, 第 9.4.8 節).

The method described here is not encouraged unless one is in a very secure environment behind a good firewall system with only trusted users present. Use the following command to verify your current X server setting for the TCP/IP socket:

     # find /etc/X11 -type f -print0 | xargs -0 grep nolisten
     /etc/X11/xinit/xserverrc:exec /usr/bin/X11/X -dpi 100 -nolisten tcp

Remove -nolisten to restore TCP/IP listening on the X server.


9.4.7 Remote X connection: xhost

xhost allows access based on hostnames. This is very insecure. The following will disable host checking and allow connections from anywhere if a TCP/IP socket connection is allowed (see TCP/IP connection to X, 第 9.4.6 節):

     $ xhost +

You can re-enable host checking with:

     $ xhost -

xhost does not distinguish between different users on the remote host. Also, hostnames (addresses actually) can be spoofed.

This method must be avoided even with more restrictive host criteria if you're on an untrusted network (for instance with dialup PPP access to the Internet). See xhost(1x).


9.4.8 Remote X connection: ssh

The use of ssh enables a secure connection from a local X server to a remote application server.

This method allows the display of the remote X client output as if it were locally connected through a local UNIX domain socket.


9.4.9 xterm

Learn everything about xterm at http://dickey.his.com/xterm/xterm.faq.html.


9.4.10 X resource database

Many older X programs, such as xterm, use the X resource database to configure their appearance. The file ~/.Xresources is used to store user resource specifications. This file is automatically merged into the default X resources upon login.

Here are some helpful settings to add to your ~/.Xresources file:

     ! Set the font to a more readable 9x15
     XTerm*font: 9x15
     
     ! Display a scrollbar
     XTerm*scrollBar: true
     
     ! Set the size of the buffer to 1000 lines
     XTerm*saveLines: 1000

To make these settings take effect immediately, merge them into the database using the command:

     xrdb -merge ~/.Xresources

9.4.11 Gain root in X

If a GUI program needs to be run with root privilege, use the following procedures to display program output on a user's X server. Never attempt to start an X server directly from the root account in order to avoid possible security risks.

Start the X server as a normal user and open an xterm console. Then:

     $ XAUTHORITY=$HOME/.Xauthority
     $ export XAUTHORITY
     $ su root
     Password:*****
     # printtool &

When using this trick to su to a non-root user, make sure ~/.Xauthority is group readable by this non-root user.

To automate this command sequence, create a file ~/.xsession from the user's account, containing the following lines:

     # This makes X work when I su to the root account.
     if [ -z "$XAUTHORITY" ]; then
             XAUTHORITY=$HOME/.Xauthority
             export XAUTHORITY
     fi
     unset XSTARTUP
     # If a particular window/session manager is desired, uncomment
     # the following and edit it to fit your needs.
     #XSTARTUP=/usr/bin/blackbox
     # This starts x-window/session-manager program
     if [ -z "$XSTARTUP" ]; then
       if [ -x /usr/bin/x-session-manager ]; then
         XSTARTUP=x-session-manager
       elif [ -x /usr/bin/x-window-manager ]; then
         XSTARTUP=x-window-manager
       elif [ -x /usr/bin/x-terminal-emulator ]; then
         XSTARTUP=x-terminal-emulator
       fi
     fi
     # execute autoselected X window/session manager
     exec $XSTARTUP

Then run su (not su -) in an xterm window of the user. Now GUI programs started from this xterm can display output on this user's X window while running with root privilege. This trick works as long as the default /etc/X11/Xsession is executed. If a user set up his customization using ~/.xinit or ~/.xsession, the abovementioned environment variable XAUTHORITY needs to be set similarly in those scripts.

Alternatively, sudo can be used to automate the command sequence:

     $ sudo xterm
     ... or
     $ sudo -H -s

Here /root/.bashrc should contain:

     if [ $SUDO_USER ]; then
         sudo -H -u $SUDO_USER xauth extract - $DISPLAY | xauth merge -
     fi

This works fine even with the home directory of the user on an NFS mount, because root does not read the .Xauthority file.

There are also several specialized packages for this purpose: kdesu, gksu, gksudo, gnome-sudo, and xsu. Some other methods can be used to achieve similar results: creating a symlink from /root/.Xauthority to the user's corresponding one; use of the script sux; or putting "xauth merge ~USER_RUNNING_X/.Xauthority" in the root initialization script.

See more on the debian-devel mailing list.


9.4.12 TrueType fonts in X

The standard xfs in XFree86-4 works fine with TrueType fonts. You have to install a third-party font server such as xfs-xtt, if you are using XFree86-3.

You just need to make sure that whatever apps you want to use the TrueType fonts are linked against libXft or libfreetype (you probably don't even have to worry about this if you're using precompiled .debs).

Remember to install required font files and generate the fonts.{scale,dir} files so that the fonts can be indexed and used.

Since Free fonts are sometimes limited, installing or sharing some commercial TrueType fonts is an option for a Debian users. In order to make this process easy for the user, some convenience packages have been created:

You'll have a really good selection of TT fonts at the expense of contaminating your Free system with non-Free fonts.


9.4.13 Web Browser (graphical)

There are a few web browser packages with graphical display capabilities as of the Woody release:

The version of mozilla must match the version that galeon requires. Although they differ in UI, these two programs share the Gecko HTML rendering engine.

Plug-ins for browsers such as mozilla and galeon can be enabled by installing "*.so" manually in the plug-in directory and restarting the browsers.

Plug-in resources:


9.5 SSH

SSH (Secure SHell) is the secure way to connect over the Internet. A free version of SSH called OpenSSH is available as the ssh package in Debian.


9.5.1 Basics

First install the OpenSSH server and client.

     # apt-get update && apt-get install ssh

The non-US entry in the /etc/apt/source.list is required. /etc/ssh/sshd_not_to_be_run must not be present if one wishes to run the OpenSSH server.

SSH has two authentication protocols:

Be careful about these differences if you are migrating to Woody or using a non-Debian system.

See /usr/share/doc/ssh/README.Debian.gz, ssh(1), sshd(8), ssh-agent(1), and ssh-keygen(1) for details.

Following are the key configuration files:

The following will start an ssh connection from a client.

     $ ssh username@hostname.domain.ext
     $ ssh -1 username@hostname.domain.ext # Force SSH version 1
     $ ssh -1 -o RSAAuthentication=no -l username foo.host
         # force password on SSH1
     $ ssh -o PreferredAuthentications=password -l username foo.host
         # force password on SSH2

For the user, ssh functions as a smarter and more secure telnet (will not bomb with ^]).


9.5.2 Port forwarding – for SMTP/POP3 tunneling

To establish a pipe to connect to port 25 of remote-server from port 4025 of localhost, and to port 110 of remote-server from port 4110 of localhost through ssh, execute on the local machine:

     # ssh -q -L 4025:remote-server:25 4110:remote-server:110 \
                username@remote-server

This is a secure way to make connections to SMTP/POP3 servers over the Internet. Set the AllowTcpForwarding entry to yes in /etc/ssh/sshd_config of the remote host.


9.5.3 Connect with fewer passwords

One can avoid having to remember a password for each remote system by using RSAAuthentication (SSH1 protocol) or PubkeyAuthentication (SSH2 protocol).

On the remote system, set the respective entries, "RSAAuthentication yes" or "PubkeyAuthentication yes", in /etc/ssh/sshd_config.

Then generate authentication keys locally and install the public key on the remote system:

     $ ssh-keygen          # RSAAuthentication: RSA1 key for SSH1
     $ cat .ssh/identity   | ssh user1@remote \
             "cat - >>.ssh/authorized_keys"
     ...
     $ ssh-keygen -t rsa   # PubkeyAuthentication: RSA key for SSH2
     $ cat .ssh/id_rsa.pub | ssh user1@remote \
             "cat - >>.ssh/authorized_keys"
     ...
     $ ssh-keygen -t dsa   # PubkeyAuthentication: DSA key for SSH2
     $ cat .ssh/id_dsa.pub | ssh user1@remote \
             "cat - >>.ssh/authorized_keys"

One can change the passphrase later with "ssh-keygen -p". Make sure to verify settings by testing the connection. In case of any problem, use "ssh -v".

You can add options to the entries in authorized_keys to limit hosts and to run specific commands. See sshd(8) for details.

Note that SSH2 has HostbasedAuthentication. For this to work, you must adjust the settings of HostbasedAuthentication to yes in both /etc/ssh/sshd_config on the server machine and /etc/ssh/ssh_config or $HOME/.ssh/config on the client machine.


9.5.4 Foreign SSH clients

There are a few free SSH clients available for non-Unix-like platforms.

Windows
puTTY (GPL)
Windows (cygwin)
SSH in cygwin (GPL)
Macintosh Classic
macSSH (GPL) [Note that Mac OS X includes OpenSSH; use ssh in the Terminal application]

See also SourceForge.net, site documentation, "6. CVS Instructions".


9.5.5 SSH agent

It is safer to protect your SSH authentication key with a passphrase. If it was not set, use ssh-keygen -p to set it.

Place your public key (e.g. ~/.ssh/id_rsa.pub) into ~/.ssh/authorized_keys on a remote host using a password-based connection to the remote host as described in Connect with fewer passwords, 第 9.5.3 節.

     $ ssh-agent bash # or run zsh/tcsh/pdksh program instead.
     $ ssh-add ~/.ssh/id_rsa
     Enter passphrase for /home/osamu/.ssh/id_rsa:
     Identity added: /home/osamu/.ssh/id_rsa (/home/osamu/.ssh/id_rsa)
     $ scp foo user@remote.host:foo
      ... no passphrase needed from here on :-)
     $^D
      ... terminating ssh-agent session

For the X server, normal Debian startup scripts execute ssh-agent as parent process. So you only need to execute ssh-add once.

For more, read ssh-agent(1)and ssh-add(1).


9.5.6 Troubleshooting

If you have problems, check the permissions of configuration files and run ssh with the "-v" option.

Use the "-P" option if you are root and have trouble with a firewall; this avoids the use of server ports 1–1023.

If ssh connections to a remote site suddenly stop working, it may be the result of tinkering by the sysadmin, most likely a change in host_key during system maintenance. After making sure this is the case and nobody is trying to fake the remote host by some clever hack, one can regain a connection by removing the host_key entry from $HOME/.ssh/known_hosts on the local machine.


9.6 Mail programs

Mail configuration divides into three categories:


9.6.1 Mail transport agent (MTA)

For a full-featured MTA, use exim. References:

The only reasonable alternative MTA is postfix if you care about security. sendmail and qmail are available as Debian packages but are not recommended.

If you do not need the relay capability of an MTA as in the case of a satellite system such as a laptop PC, you may consider using one of these lightweight packages:

At this moment, I find exim to be more suitable even for my personal workstation machine, which is a laptop PC.

You may need to remove exim for the installation of these conflicting packages:

     # dpkg -P --force-depends exim
     # apt-get install nullmailer         # or ssmtp

9.6.1.1 Basic configuration of Exim

In order to use exim as your MTA, configure the following:

     /etc/exim/exim.conf     "eximconfig" to create and edit
     /etc/inetd.conf         comment out smtp to run exim as daemon
     /etc/email-addresses    Add spoofed source address lists
     check filters using exim -brw, -bf, -bF, -bV, ... etc.

9.6.1.2 A catchall for nonexistent email addresses (Exim)

In /etc/exim/exim.conf (Woody or later), in the DIRECTORS part, at the end (after the localuser: director) add a catch-all director that matches all addresses that the previous directors couldn't resolve (per Miquel van Smoorenburg):

     catchall:
       driver = smartuser
         new_address = webmaster@mydomain.com

If one wants to have more a detailed recipe for each virtual domain, etc., add the following at the end of /etc/exim/exim.conf (per me, not well tested):

     *@yourdomain.com ${lookup{$1}lsearch*{/etc/email-addresses} \
             {$value}fail} T

Then have an "*" entry in /etc/email-addresses.


9.6.1.3 Selective address rewrite for outgoing mail (Exim)

Selective address rewrite for outgoing mail to produce proper "From:" headers can be done using exim by configuring near the end of /etc/exim/exim.conf:

     *@host1.something.dyndns.org \
       "${if eq {${lookup{$1}lsearch{/etc/passwd}{1}{0}}} {1}  \
        {$0}{$1@somethig.dyndns.org}}"  frFs

This rewrites all addresses matching *@host1.something.dyndns.org.

  1. It searches through /etc/password to see if the local part ($1) is a local user or not.
  1. If it is a local user, it rewrites the address to the same thing it was in the first place ($0).
  1. If it is not a local user, it rewrites the domain part.

9.6.1.4 SMTP auth with Exim

Some SMTP services such as yahoo.com require SMTP auth. Configure /etc/exim/exim.conf as follows:

     remote_smtp:
       driver = smtp
       authenticate_hosts = smtp.mail.yahoo.com
     ...
     
     smarthost:
       driver = domainlist
       transport = remote_smtp
       route_list = "* smtp.mail.yahoo.com bydns_a"
     ...
     
     plain:
       driver = plaintext
       public_name = PLAIN
       client_send = "^cmatheson3^this_is_my_password"

Do not forget double quotes in the last line.


9.6.2 Mail utility (Fetchmail)

fetchmail is run in daemon mode to fetch mail from a POP3 account with an ISP into the local mail system. Configure:

     /etc/init.d/fetchmail   
     /etc/rc?.d/???fetchmail run update-rc.d fetchmail default priority 30
     /etc/fetchmailrc        configuration file (chown 600, owned by fetchmail)

Information on how to start fetchmail as a daemon from the init.d script for Potato is confusing (Woody fixed this). See the sample /etc/init.d/fetchmail and /etc/fetchmailrc files in the example scripts.

If your email headers are contaminated by ^M due to your ISP's mailer, add "stripcr" to your options in $HOME/.fetchmailrc:

     options fetchall no keep stripcr

9.6.3 Mail utility (Procmail)

procmail is a local mail delivery and filter program. One needs to create $HOME/.procmailrc for each account that uses it. Example: _procmailrc


9.6.4 Mail user agent (Mutt)

Use mutt as the mail user agent (MUA) in combination with vim. Customize with ~/.muttrc; for example:

     # use visual mode and "gq" to reformat quotes
     set editor="vim -c 'set tw=72 et ft=mail'"
     #
     # header weeding taken from the manual (Sven's Draconian header weeding)
     #
     ignore *
     unignore from: date subject to cc
     unignore user-agent x-mailer
     hdr_order from subject to cc date user-agent x-mailer
     auto_view application/msword
     ....

Add the following to /etc/mailcap or $HOME/.mailcap to display HTML mail and MS Word attachments inline:

     text/html; lynx -force_html %s; needsterminal;
     application/msword; /usr/bin/antiword '%s'; copiousoutput;
     description="Microsoft Word Text"; nametemplate=%s.doc

9.7 Localization and national language support

Debian is internationalized, offering support for a growing number of languages and local usage conventions. The next subsection lists some of the forms of diversity that Debian currently supports, and the following subsections discuss localization, the process of customizing your working environment to allow current input and output of your chosen language(s) and conventions for dates, numeric and monetary formats, and other aspects of a system that differ according to your region.


9.7.1 Customizing basics

There are several aspects to customizing for localization and national language support.


9.7.1.1 Keyboard

Debian is distributed with keymaps for nearly two dozen keyboards. In Woody, reconfigure the keyboard by:


9.7.1.2 Data

The vast majority of Debian software packages support data handling of non-US-ASCII characters through the LC_CTYPE environment variable offered by the locale technology in glibc.


9.7.1.3 Display

X can display any coding, including UTF-8, and supports all fonts. The list includes not only all the 8-bit fonts but also 16-bit fonts such as Chinese, Japanese, or Korean. Multibyte character input method is supported by the XIM mechanism. See Example for a bilingual system (Japanese EUC and ISO-8859-1), 第 9.7.8 節.

Japanese EUC code display is also available in a (S)VGA graphics console through the kon2 package. There is an alternative new Japanese display, jfbterm, which uses a frame-buffer console, too. In these console environments, the Japanese input method must be supplied by the application. Use egg package for Emacs and use japanized jvim package for a Vim environment.


9.7.1.4 Translation

Translations exist for many of the text messages and documents that are displayed in the Debian system, such as error messages, standard program output, menus, and manual pages. Currently, support for manual pages in German, Spanish, Finnish, French, Hungarian, Italian, Japanese, Korean, Polish, Portuguese, Chinese, and Russian is provided through the manpages-LANG packages (where LANG is a comma-separated list of two-letter ISO country codes. Use apt-cache search manpages-|less to get a list of available Unix manual pages.)

To access an NLS manual page, the user must set the environment variable LC_MESSAGES to the appropriate string. For example, in the case of the Italian-language manual pages, LC_MESSAGES needs to be set to it. The man program will then search for Italian manual pages under /usr/share/man/it/.


9.7.2 Locales

Debian supports locale technology. Locale is a mechanism that allows programs to provide suitable output and functionality according to local conventions such as character set, format for date and time, currency symbol, and so on. It uses environment variables to determine the appropriate behavior. For example, assuming you have both the American English and German locales installed on your system, the error messages of many programs can be multilingual:

     $ LANG="en_US" cat foo
     cat: foo: No such file or directory
     $ LANG="de_DE" cat foo
     cat: foo: Datei oder Verzeichnis nicht gefunden

Glibc offers support for this functionality to programs as a library. See locale(7).


9.7.3 Activate locale support capability

Debian does not come with all available locales precompiled. Check /usr/lib/locale to see which locales (besides the default "C") are compiled for your system. If the one you need is not present, you have two options:


9.7.4 Activate a particular locale

The following environment variables are evaluated in this order to provide particular locale values to programs:

  1. LANGUAGE: This environment variable consists of a colon-separated list of locale names in order of priority. Used only if the POSIX locale is set to a value other than "C" [in Woody; the Potato version always has priority over the POSIX locale]. (GNU extension)
  1. LC_ALL: If this is non-null, the value is used for all locale categories. (POSIX.1) Usually "" (null).
  1. LC_*: If this is non-null, the value is used for the corresponding category (POSIX.1). Usually "C".

    LC_* variables are:

  1. LANG: If this is non-null and LC_ALL is undefined, the value is used for all LC_* locale categories with undefined values. (POSIX.1) Usually "C".

Note that some applications (e.g., Netscape 4) ignore LC_* settings.

The locale program can display active locale settings and available locales; see locale(1). (NOTE: locale -a lists all the locales that your system knows about; this does not mean that all of them are compiled! See Activate locale support capability, 第 9.7.3 節.)


9.7.5 ISO 8601 date format locale

The locale support for the international date standard of yyyy-mm-dd (ISO 8601 date format) is provided by the locale called en_DK, "English in Denmark", which is a bit of joke :-) This seems to work only in a console screen for ls.


9.7.6 Example for the US (ISO-8859-1)

Add the following lines to ~/.bash_profile:

     LC_CTYPE=en_US.ISO-8859-1
     export LC_CTYPE

9.7.7 Example for France with Euro sign (ISO-8859-15)

Add the following lines to ~/.bash_profile:

     LANG=fr_FR@euro
     export LANG
     LC_CTYPE=fr_FR@euro
     export LC_CTYPE

Configure the keyboard for French "AZERTY" as described in Keyboard, 第 9.7.1.1 節; add French manual pages by installing manpages-fr. The Right-Alt key in the US is called Alt-Gr in Europe. Pressing this together with other keys creates numerous accented and special characters. For example, Alt-Gr+E creates a Euro sign.

Most western European languages can be configured similarly.

See Debian Euro HOWTO for adding support for the new Euro currency and Utiliser et configurer Debian pour le français for more details in French.


9.7.8 Example for a bilingual system (Japanese EUC and ISO-8859-1)

Let us set up a bilingual system: ja_JP.eucJP (Japanese EUC, traditional Unix Japanese environment) in X with English messages and ISO type dates, and en_US.ISO-8859-1 (almost ASCII with accented character support) in the Linux console.

See also the SuSE pages for CJK.


9.7.9 Example for UTF-8 in X

Everyone will need this in the future. See The Unicode HOWTO.


9.7.10 Example for UTF-8 in a framebuffer console

UTF-8 support on a FB console is provided by bterm used in the debian-installer.


9.7.11 Beyond locale

When you are first setting the system up for a national language environment, please consider using tasksel or aptitude to find out what packages are selected by choosing the corresponding language environment task. The package choice made is useful even for a multilingual setup. If you encounter any package dependency conflicts during the install to your carefully configured system, avoid installing any software that conflicts with the existing system. You may have to use update-alternative to regain the original state for some commands since a newly installed one may have higher priority than existing ones.

Newer major programs are using glibc 2.2 and are mostly internationalized. So a specially localized version such as jvim for Vim may not be needed as its functionality is offered by vim version 6.0 in X. In reality, it is still somewhat rough-edged. Since jvim has a version compiled with direct Japanese input method (canna) support even in the console and addresses many other Japanese-specific issues maturely, you may still want it :-)

Programs may need to be configured beyond locale configuration to enable a comfortable working environment. The language-env package and its command set-language-env greatly eases this process.

Also see the internationalization document, Introduction to i18n. It is aimed at developers but is also useful for system administrators.


[ 上一頁 ] [ 目錄 ] [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ A ] [ 下一頁 ]

Debian 參考手冊

1.06-16, 週六 一月 3 21:37:21 UTC 2004

青木 修 (Osamu Aoki) osamu@debian.org
翻譯者:唐偉清 (Tang Wei-Ching) wctang@csie.nctu.edu.tw
作者, 第 A.1 節