sabato 20 ottobre 2012

How To Manage Packages Using apt-get, apt-cache, apt-file and dpkg Commands ( With 13 Practical Examples )


Debian based systems (including Ubuntu) uses apt-* commands for managing packages from the command line.

In this article, using Apache 2 installation as an example, let us review how to use apt-* commands to view, install, remove, or upgrade packages.

1. apt-cache search: Search Repository Using Package Name

If you are installing Apache 2, you may guess that the package name is apache2.  To verify whether it is a valid package name, you may want to search the repository for that particular package name as shown below.
The following example shows how to search the repository for a specific package name.

$ apt-cache search ^apache2$
apache2 - Apache HTTP Server metapackage

2. apt-cache search: Search Repository Using Package Description

If you don’t know the exact name of the package, you can still search using the package description as shown below.

$ apt-cache search "Apache HTTP Server"
apache2 - Apache HTTP Server metapackage
apache2-doc - Apache HTTP Server documentation
apache2-mpm-event - Apache HTTP Server - event driven model
apache2-mpm-prefork - Apache HTTP Server - traditional non-threaded model
apache2-mpm-worker - Apache HTTP Server - high speed threaded model
apache2.2-common - Apache HTTP Server common files

3. apt-file search: Search Repository Using a Filename from the Package

Sometimes you may know the configuration file name (or) the executable name from the package that you would like to install.
The following example shows that apache2.conf file is part of the apache2.2-common package. Search the repository with a configuration file name using apt-file command as shown below.

$ apt-file search apache2.conf
apache2.2-common: /etc/apache2/apache2.conf
apache2.2-common: /usr/share/doc/apache2.2-common/examples/apache2/apache2.conf.gz

4. apt-cache show: Basic Information About a Package

Following example displays basic information about apache2 package.
$ apt-cache show apache2
Package: apache2
Priority: optional
Maintainer: Ubuntu Core Developers
Original-Maintainer: Debian Apache Maintainers
Version: 2.2.11-2ubuntu2.3
Depends: apache2-mpm-worker (>= 2.2.11-2ubuntu2.3)
 | apache2-mpm-prefork (>= 2.2.11-2ubuntu2.3)
 | apache2-mpm-event (>= 2.2.11-2ubuntu2.3)
Filename: pool/main/a/apache2/apache2_2.2.11-2ubuntu2.3_all.deb
Size: 46350
Description: Apache HTTP Server metapackage
 The Apache Software Foundation's goal is to build a secure, efficient and
 extensible HTTP server as standards-compliant open source software.
Homepage: http://httpd.apache.org/

5. apt-cache showpkg: Detailed Information About a Package

“apt-cache show” displays basic information about a package. Use “apt-cache showpkg” to display detailed information about a package as shown below.
$ apt-cache showpkg apache2
Package: apache2
Versions:
2.2.11-2ubuntu2.3 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_jaunty-updates_main_binary-i386_Packages) (/var/lib/apt/lists/security.ubuntu.com_ubuntu_dists_jaunty-security_main_binary-i386_Packages)
 Description Language:
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_jaunty-updates_main_binary-i386_Packages
                  MD5: d24f049cd70ccfc178dd8974e4b1ed01
Reverse Depends:
  squirrelmail,apache2
  squid3-cgi,apache2
  phpmyadmin,apache2
  mahara-apache2,apache2
  ipplan,apache2
Dependencies:
  2.2.11-2ubuntu2.3 - apache2-mpm-worker (18 2.2.11-2ubuntu2.3) apache2-mpm-prefork (18 2.2.11-2ubuntu2.3) apache2-mpm-event (2 2.2.11-2ubuntu2.3)
  2.2.11-2ubuntu2 - apache2-mpm-worker (18 2.2.11-2ubuntu2) apache2-mpm-prefork (18 2.2.11-2ubuntu2) apache2-mpm-event (2 2.2.11-2ubuntu2)
Provides:   2.2.11-2ubuntu2.3 -
  2.2.11-2ubuntu2 -
Reverse Provides:   apache2-mpm-itk 2.2.6-02-1build4.3
  apache2-mpm-worker 2.2.11-2ubuntu2.3
  apache2-mpm-prefork 2.2.11-2ubuntu2.3
  apache2-mpm-prefork 2.2.11-2ubuntu2
  apache2-mpm-event 2.2.11-2ubuntu2

6. apt-file list: List all the Files Located Inside a Package

Use “apt-file list” to display all the files located inside the apache2 package as shown below.
$ apt-file list apache2 | more
apache2: /usr/share/bug/apache2/control
apache2: /usr/share/bug/apache2/script
apache2: /usr/share/doc/apache2/NEWS.Debian.gz
apache2: /usr/share/doc/apache2/README.Debian.gz
apache2: /usr/share/doc/apache2/changelog.Debian.gz
...

7. apt-cache depends: List all Dependent Packages

Before installation, if you like to view all the dependent packages, use “apt-cache depends” as shown below.
$ apt-cache depends apache2
apache2
 |Depends: apache2-mpm-worker
 |Depends: apache2-mpm-prefork
  Depends: apache2-mpm-event

8. dpkg -l: Is the Package Already Installed?

Before installing a package, you may want to make sure it is not already installed as shown below using dpkg -l command.
$ dpkg -l | grep -i apache

9. apt-get install: Install a Package

Finally, install the package using “apt-get install” as shown below.
$ sudo apt-get install apache2
[sudo] password for ramesh: 

The following NEW packages will be installed:
  apache2 apache2-mpm-worker apache2-utils apache2.2-common libapr1
  libaprutil1 libpq5

0 upgraded, 7 newly installed, 0 to remove and 26 not upgraded.

10. dpkg -l : Verify Whether the Package got Successfully Installed

After installing the package, use “dpkg -l” to make sure it got installed successfully.
$ dpkg -l | grep apache ii  apache2             2.2.11-2ubuntu2.3  Apache HTTP Server metapackage
ii  apache2-mpm-worker  2.2.11-2ubuntu2.3  Apache HTTP Server - high speed threaded mod
ii  apache2-utils       2.2.11-2ubuntu2.3  utility programs for webservers
ii  apache2.2-common    2.2.11-2ubuntu2.3  Apache HTTP Server common files

11. apt-get remove: Delete a Package

Use “apt-get purge” or “apt-get remove” to delete a package as shown below.
$ sudo apt-get purge apache2 
(or)

$ sudo apt-get remove apache2

The following packages were automatically installed and are no longer required:
  apache2-utils linux-headers-2.6.28-11 libapr1 apache2.2-common
  linux-headers-2.6.28-11-generic apache2-mpm-worker libpq5 libaprutil1

Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:
  apache2
0 upgraded, 0 newly installed, 1 to remove and 26 not upgraded.
Removing apache2 ...
  • apt-get remove will not delete the configuration files of the package
  • apt-get purge will delete the configuration files of the package

12. apt-get -u install: Upgrade a Specific Package

The following example shows how to upgrade one specific package.

$ sudo apt-get -u install apache2 
 
 Reading package lists... Done
Building dependency tree
Reading state information... Done
apache2 is already the newest version.
The following packages were automatically installed and are no longer required:
  linux-headers-2.6.28-11 linux-headers-2.6.28-11-generic
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 26 not upgraded.

13. apt-get -u upgrade: Upgrade all Packages

To upgrade all the packages to it’s latest version, use “apt-get -u upgrade” as shown below.
$ sudo apt-get -u upgrade
The following packages will be upgraded:
  libglib2.0-0 libglib2.0-data libicu38 libsmbclient libwbclient0
  openoffice.org-base-core openoffice.org-calc openoffice.org-common
  openoffice.org-core openoffice.org-draw openoffice.org-emailmerge
  openoffice.org-gnome openoffice.org-gtk openoffice.org-impress
  openoffice.org-math openoffice.org-style-human openoffice.org-writer
  python-uno samba-common smbclient ttf-opensymbol tzdata
26 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Linux modprobe Command Examples to View, Install, Remove Modules

modprobe utility is used to add loadable modules to the Linux kernel. You can also view and remove modules using modprobe command.

Linux maintains /lib/modules/$(uname-r) directory for modules and its configuration files (except /etc/modprobe.conf and /etc/modprobe.d).

In Linux kernel 2.6, the .ko modules are used instead of .o files since that has additional information that the kernel uses to load the modules. The example in this article are done with using modprobe on Ubuntu.

1. List Available Kernel Modules

modprobe -l will display all available modules as shown below.

$ modprobe -l | less
kernel/arch/x86/kernel/cpu/mcheck/mce-inject.ko
kernel/arch/x86/kernel/cpu/cpufreq/e_powersaver.ko
kernel/arch/x86/kernel/cpu/cpufreq/p4-clockmod.ko
kernel/arch/x86/kernel/msr.ko
kernel/arch/x86/kernel/cpuid.ko
kernel/arch/x86/kernel/apm.ko
kernel/arch/x86/kernel/scx200.ko
kernel/arch/x86/kernel/microcode.ko
kernel/arch/x86/crypto/aes-i586.ko
kernel/arch/x86/crypto/twofish-i586.ko

2. List Currently Loaded Modules

While the above modprobe command shows all available modules, lsmod command will display all modules that are currently loaded in the Linux kernel.

$ lsmod | less
soundcore          7264   1 snd
ppdev                6688   0
snd_page_alloc   9156    1 snd_pcm
psmouse            56180  0
lp                     8964    0

3. Install New modules into Linux Kernel

In order to insert a new module into the kernel, execute the modprobe command with the module name.
Following example loads vmhgfs module to Linux kernel on Ubuntu.
$ sudo modprobe vmhgfs
Once a module is loaded, verify it using lsmod command as shown below.

$ lsmod | grep vmhgfs
vmhgfs                 50772  0
 
The module files are with .ko extension. If you like to know the full file location of a specific Linux kernel module, use modprobe command and do a grep of the module name as shown below.

$ modprobe | grep vmhgfs
misc/vmhgfs.ko

$ cd /lib/modules/2.6.31-14-generic/misc

$ ls vmhgfs*
vmhgfs.ko
 
Note: You can also use insmod for installing new modules into the Linux kernel.

4. Load New Modules with the Different Name to Avoid Conflicts

Consider, in some cases you are supposed to load a new module but with the same module name another module got already loaded for different purposes.
If for some strange reasons, the module name you are trying to load into the kernel is getting used (with the same name) by a different module, then you can load the new module using a different name.

To load a module with a different name, use the modprobe option -o as shown below.

$ sudo modprobe vmhgfs -o vm_hgfs

$ lsmod  | grep vm_hgfs
vm_hgfs                   50772  0

5. Remove the Currently Loaded Module

If you’ve loaded a module to Linux kernel for some testing purpose, you might want to unload (remove) it from the kernel.
Use modprobe -r option to unload a module from the kernel as shown below.
modprobe -r vmhgfs

Linux ethtool Examples to Manipulate Ethernet Card (NIC Card)

Ethtool utility is used to view and change the ethernet device parameters.

1. List Ethernet Device Properties

When you execute ethtool command with a device name, it displays the following information about the ethernet device.

# ethtool eth0
Settings for eth0:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: d
        Wake-on: d
        Link detected: yes
 
This above ethtool output displays ethernet card properties such as speed, wake on, duplex and the link detection status. Following are the three types of duplexes available.
  • Full duplex : Enables sending and receiving of packets at the same time. This mode is used when the ethernet device is connected to a switch.
  • Half duplex : Enables either sending or receiving of packets at a single point of time. This mode is used when the ethernet device is connected to a hub.
  • Auto-negotiation : If enabled, the ethernet device itself decides whether to use either full duplex or half duplex based on the network the ethernet device attached to.

2. Change NIC Parameter Using ethtool Option -s autoneg

The above ethtool eth0 output displays that the “Auto-negotiation” parameter is in enabled state. You can disable this using autoneg option in the ethtool as shown below.
# ifdown eth0
    eth0      device: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
    eth0      configuration: eth-bus-pci-0000:0b:00.0

# ethtool  -s eth0 autoneg off

# ethtool eth0
Settings for eth0:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  Not reported
        Advertised auto-negotiation: No
        Speed: Unknown! (65535)
        Duplex: Unknown! (255)
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: off
        Supports Wake-on: g
        Wake-on: g
        Link detected: no
# ifup eth0
After the above change, you could see that the “link detection” value changed to down and auto-negotiation is in off state.

3. Change the Speed of Ethernet Device

Using ethtool you can change the speed of the ethernet device to work with the certain network devices, and the newly assign speed value should be within the limited capacity.
# ethtool -s eth0 speed 100 autoneg off

# ethtool eth0
Settings for eth0:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  Not reported
        Advertised auto-negotiation: No
        Speed: Unknown! (65535)
        Duplex: Unknown! (255)
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: off
        Supports Wake-on: g
        Wake-on: g
        Link detected: no
Once you change the speed when the adapter is online, it automatically goes offline, and you need to bring it back online using ifup command.
# ifup eth0
    eth0      device: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
    eth0      configuration: eth-bus-pci-0000:0b:00.0
Checking for network time protocol daemon (NTPD):                     running

# ethtool eth0
Settings for eth0:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  Not reported
        Advertised auto-negotiation: No
        Speed: 100Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: off
        Supports Wake-on: g
        Wake-on: g
        Link detected: yes
 
As shown in the above output, the speed changed from 1000Mb/s to 100Mb/s and auto-negotiation parameter is unset.
To change the Maximum Transmission Unit (MTU), refer to our ifconfig examples article.

4. Display Ethernet Driver Settings

ethtool -i option displays driver version, firmware version and bus details as shown below.
# ethtool -i eth0
driver: bnx2
version: 2.0.1-suse
firmware-version: 1.9.3
bus-info: 0000:04:00.0

5. Display Auto-negotiation, RX and TX of eth0

View the autonegotiation details about the specific ethernet device as shown below.
# ethtool -a eth0
Pause parameters for eth0:
Autonegotiate:  on
RX:             on
TX:             on

6. Display Network Statistics of Specific Ethernet Device

Use ethtool -S option to display the bytes transfered, received, errors, etc, as shown below.
# ethtool -S eth0
NIC statistics:
     rx_bytes: 74356477841
     rx_error_bytes: 0
     tx_bytes: 110725861146
     tx_error_bytes: 0
     rx_ucast_packets: 104169941
     rx_mcast_packets: 138831
     rx_bcast_packets: 59543904
     tx_ucast_packets: 118118510
     tx_mcast_packets: 10137453
     tx_bcast_packets: 2221841
     tx_mac_errors: 0
     tx_carrier_errors: 0
     rx_crc_errors: 0
     rx_align_errors: 0
     tx_single_collisions: 0
     tx_multi_collisions: 0
     tx_deferred: 0
     tx_excess_collisions: 0
     tx_late_collisions: 0
     tx_total_collisions: 0
     rx_fragments: 0
     rx_jabbers: 0
     rx_undersize_packets: 0
     rx_oversize_packets: 0
     rx_64_byte_packets: 61154057
     rx_65_to_127_byte_packets: 55038726
     rx_128_to_255_byte_packets: 426962
     rx_256_to_511_byte_packets: 3573763
     rx_512_to_1023_byte_packets: 893173
     rx_1024_to_1522_byte_packets: 42765995
     rx_1523_to_9022_byte_packets: 0
     tx_64_byte_packets: 3633165
     tx_65_to_127_byte_packets: 51169838
     tx_128_to_255_byte_packets: 3812067
     tx_256_to_511_byte_packets: 113766
     tx_512_to_1023_byte_packets: 104081
     tx_1024_to_1522_byte_packets: 71644887
     tx_1523_to_9022_byte_packets: 0
     rx_xon_frames: 0
     rx_xoff_frames: 0
     tx_xon_frames: 0
     tx_xoff_frames: 0
     rx_mac_ctrl_frames: 0
     rx_filtered_packets: 14596600
     rx_discards: 0
     rx_fw_discards: 0

7. Troubleshoot the Ethernet Connection Issues

When there is a problem with the network connection, you might want to check (or change) the ethernet device parameters explained in the above examples, when you see following issues in the output of ethtool command.
  • Speed and Duplex value is shown as Unknown
  • Link detection value is shown as No
Upon successful connection, the three parameters mentioned above gets appropriate values. i.e Speed is assigned with known value, Duplex become either Full/Half, and the Link detection becomes Yes.

After the above changes, if the Link Detection still says “No”, check whether there are any issues in the cables that runs from the switch and the system, you might want to dig into that aspect further.

To capture and analyze packets from a specific network interface, use tcpdump utility.

8. Identify Specific Device From Multiple Devices (Blink LED Port of NIC Card)

Let us assume that you have a machine with four ethernet adapters, and you want to identify the physical port of a particular ethernet card. (For example, eth0).
Use ethtool option -p, which will make the corresponding LED of physical port to blink.

# ethtool -p eth0

9. Make Changes Permanent After Reboot

If you’ve changed any ethernet device parameters using the ethtool, it will all disappear after the next reboot, unless you do the following.
On ubuntu, you have to modify /etc/network/interfaces file and add all your changes as shown below.

# vim /etc/network/interfaces
post-up ethtool -s eth2 speed 1000 duplex full autoneg off
 
The above line should be the last line of the file. This will change speed, duplex and autoneg of eth2 device permanently.

On SUSE, modify the /etc/sysconfig/network/ifcfg-eth-id file and include a new script using POST_UP_SCRIPT variable as shown below. Include the below line as the last line in the corresponding eth1 adpater config file.

# vim /etc/sysconfig/network/ifcfg-eth-id
POST_UP_SCRIPT='eth1'
 
Then, create a new file scripts/eth1 as shown below under /etc/sysconfig/network directory. Make sure that the script has execute permission and ensure that the ethtool utility is present under /sbin directory.

# cd /etc/sysconfig/network/

# vim scripts/eth1
#!/bin/bash
/sbin/ethtool -s duplex full speed 100 autoneg off

Linux Beginners Guide to NFS Mount Using Exportfs

Using NFS (Network File System), you can mount a disk partition of a remote machine as if it is a local disk. This article explains how to export a file system to a remote machine and mount it both temporarily and permanently.

1. Export File System to Remote Server using exportfs

To export a directory to a remote machine, do the following.
exportfs REMOTEIP:PATH
  • REMOTEIP – IP of the remote server to which you want to export.
  • : – delimiter
  • PATH – Path of directory that you want to export.

2. Mount Remote Server File System as a Local Storage

To mount the remote file system on the local server, do the following.
mount REMOTEIP:PATH PATH
Explanation
  • REMOTEIP – IP of the remote server which exported the file system
  • : – delimeter
  • PATH – Path of directory which you want to export.

3. Unmount Remote File System

Umount the remote file system mounted on the local server using the normal umount PATH. For more option refer to umount command examples.

4. Unexport the File System

You can check the exported file system as shown below.
# exportfs
/publicdata webserver.pq.net
To unexport the file system, use the -u option as shown below.
# exportfs -u REMOTEIP:PATH
After unexporting, check to make sure it is not available for NFS mount as shown below.
# exportfs

5. Make NFS Export Permanent Across System Reboot

Export can be made permanent by adding that entry into /etc/exports file.
# cat /etc/exports
/publicdata  webserver.pq.net

6. Make the Mount Permanent Across Reboot

mount can be made permanent by adding that entry into /etc/fstab file.
# cat /etc/fstab
webserver.pq.net:/publicdata    /mydata   ext3    defaults   0 0

6 Common Errors in Setting Java Heap Size


Two JVM options are often used to tune JVM heap size: -Xmx for maximum heap size, and -Xms for initial heap size. Here are some common mistakes I have seen when using them:

* Missing m, M, g or G at the end (they are case insensitive). For example,


java -Xmx128 BigApp
java.lang.OutOfMemoryError: Java heap space


The correct command should be: java -Xmx128m BigApp. To be precise, -Xmx128 is a valid setting for very small apps, like HelloWorld. But in real life, I guess you really mean

-Xmx128m

* Extra space in JVM options, or incorrectly use =. For example,


java -Xmx 128m BigApp

Invalid maximum heap size: -Xmx

Could not create the Java virtual machine.

java -Xmx=512m HelloWorld

Invalid maximum heap size: -Xmx=512m


Could not create the Java virtual machine.

The correct command should be java -Xmx128m BigApp, with no whitespace nor =. -X options are different than -Dkey=value system properties, where = is used.

* Only setting -Xms JVM option and its value is greater than the default maximum heap size, which is 64m. The default minimum heap size seems to be 0. For example,

java -Xms128m BigApp

Error occurred during initialization of VM

Incompatible initial and maximum heap sizes specified

The correct command should be java -Xms128m -Xmx128m BigApp. It’s a good idea to set the minimum and maximum heap size to the same value. In any case, don’t let the minimum heap size exceed the maximum heap size.

* Heap size is larger than your computer’s physical memory. For example,

java -Xmx2g BigApp

Error occurred during initialization of VM
Could not reserve enough space for object heap
Could not create the Java virtual machine.
The fix is to make it lower than the physical memory: java -Xmx1g BigApp

* Incorrectly use mb as the unit, where m or M should be used instead.


java -Xms256mb -Xmx256mb BigApp

Invalid initial heap size: -Xms256mb

Could not create the Java virtual machine.

* The heap size is larger than JVM thinks you would ever need. For example,

java -Xmx256g BigApp

Invalid maximum heap size: -Xmx256g

The specified size exceeds the maximum representable size.
Could not create the Java virtual machine.
The fix is to lower it to a reasonable value: java -Xmx256m BigApp

* The value is not expressed in whole number. For example,

java -Xmx0.9g BigApp

Invalid maximum heap size: -Xmx0.9g

Could not create the Java virtual machine.

The correct command should be java -Xmx928m BigApp

NOTE:

How to set java heap size in Tomcat?


Stop Tomcat server, set environment variable CATALINA_OPTS, and then restart Tomcat. Look at the file tomcat-install/bin/catalina.sh or catalina.bat for how this variable is used. For example,

set CATALINA_OPTS=”-Xms512m -Xmx512m”  (Windows)
export CATALINA_OPTS=”-Xms512m -Xmx512m”  (ksh/bash)
setenv CATALINA_OPTS “-Xms512m -Xmx512m”  (tcsh/csh)


In catalina.bat or catallina.sh, you may have noticed CATALINA_OPTS, JAVA_OPTS, or both can be used to specify Tomcat JVM options. What is the difference between CATALINA_OPTS and JAVA_OPTS? The name CATALINA_OPTS is specific for Tomcat servlet container, whereas JAVA_OPTS may be used by other java applications (e.g., JBoss). Since environment variables are shared by all applications, we don’t want Tomcat to inadvertently pick up the JVM options intended for other apps. I prefer to use CATALINA_OPTS.

How to set java heap size in JBoss?

Stop JBoss server, edit $JBOSS_HOME/bin/run.conf, and then restart JBoss server. You can change the line with JAVA_OPTS to something like:

JAVA_OPTS=”-server -Xms128m -Xmx128m”

How to set java heap size in Eclipse?

You have 2 options:
  1. Edit eclipse-home/eclipse.ini to be something like the following and restart Eclipse.

    -vmargs
    -Xms64m
    -Xmx256m
  2. Or, you can just run eclipse command with additional options at the very end. Anything after -vmargs will be treated as JVM options and passed directly to the JVM. JVM options specified in the command line this way will always override those in eclipse.ini. For example,

    eclipse -vmargs -Xms64m -Xmx256m

How to set java heap size in NetBeans?

Exit NetBeans, edit the file netbeans-install/etc/netbeans.conf. For example,

netbeans_default_options=”-J-Xms512m -J-Xmx512m -J-XX:PermSize=32m -J-XX:MaxPermSize=128m -J-Xverify:none

How to set java heap size in Apache Ant?

Set environment variable ANT_OPTS. Look at the file $ANT_HOME/bin/ant or %ANT_HOME%\bin\ant.bat, for how this variable is used by Ant runtime.

set ANT_OPTS=”-Xms512m -Xmx512m”  (Windows)
export ANT_OPTS=”-Xms512m -Xmx512m”  (ksh/bash)
setenv ANT_OPTS “-Xms512m -Xmx512m”  (tcsh/csh)

How to set java heap size in jEdit?

jEdit is a java application, and basically you need to set minimum/maximum heap size JVM options when you run java command. jEdit by default runs with a default maximum heap size 64m. When you work on large files, you are likely to get these errors:

java.lang.OutOfMemoryError: Java heap space
at java.lang.String.concat(String.java:2001)
at org.gjt.sp.jedit.buffer.UndoManager.contentInserted(UndoManager.java:160)
at org.gjt.sp.jedit.Buffer.insert(Buffer.java:1139)
at org.gjt.sp.jedit.textarea.JEditTextArea.setSelectedText(JEditTextArea.java:2052)
at org.gjt.sp.jedit.textarea.JEditTextArea.setSelectedText(JEditTextArea.java:2028)
at org.gjt.sp.jedit.Registers.paste(Registers.java:263)


How to fix it? If you click a desktop icon, or Start menu item to start jEdit: right-click the icon or menu item, view its property, and you can see its target is something like:

C:\jdk6\bin\javaw.exe -jar “C:\jedit\jedit.jar”

You can change that line to:

C:\jdk6\bin\javaw.exe -Xmx128m -Xms128m -jar “C:\jedit\jedit.jar”

If you run a script to start jEdit: just add these JVM options to the java line inside the script file:

java -Xmx128m -Xms128m -jar jedit.jar

If you start jEdit by running java command: just add these JVM options to your java command:

java -Xmx128m -Xms128m -jar jedit.jar

Note that when you run java with -jar option, anything after -jar jar-file will be treated as application arguments. So you should always put JVM options before -jar. Otherwise, you will get error:

C:\jedit>java -jar jedit.jar -Xmx128m

Unknown option: -Xmx128m

Usage: jedit [] []

venerdì 14 settembre 2012

Enable htaccess Apache in Ubuntu


Enable htacces for directories

we know that htaccess permission must on apache web server like making SEF urls, directory permissions..etc.here we discuss about how to check .htaccess enabled.
Before we begin this tutorial, please make sure you make a backup copy of the originalhttpd.conf apache configuration file located in apache installation folder in case we make a mistake, this way we can always go back to the original configuration file
Now open
httpd.conf
file with note pad and find the below text
<directory />
    Options FollowSymLinks
    AllowOverride none
    Order deny,allow
    Deny from all
    Satisfy all
</directory>
Then replace AllowOverride none to AllowOverride All. Modified version looks as below
<directory />
    Options FollowSymLinks
    AllowOverride all
    Order deny,allow
    Deny from all
    Satisfy all
</directory>
Above change tells the apache to use .htaccess as per directory bases.
Now we can use .htaccess files .

Remember

Remember while uploading .htaccess file to remote server make sure the file transfer in ASCII mode, generally with windows operating system FTP programs use binary mode.
Generally FTP programs doesn’t display the .htaccess files by default ,we must force the FTP program to show hidden files like .htaccess files.
When you save .htaccess file with note pad it saves as .htaccess.txt .Make sure .htaccess is a file extension not a file name with empty name.

venerdì 10 agosto 2012

How to secure an Ubuntu 12.04 LTS server - The Basics



This guide is based on various community forum posts and webpages. Special thanks to all. All comments and improvements are very welcome as this is purely a personal experimental project at this point and must be considered a work in progress. 
This guide is intended as a relatively easy step by step guide to:
Harden the security on an Ubuntu 12.04 LTS server by installing and configuring the following:
  1. Install and configure Firewall - ufw
  2. Secure shared memory - fstab 
  3. SSH - Disable root login and change port 
  4. Protect su by limiting access only to admin group 
  5. Harden network with sysctl settings 
  6. Disable Open DNS Recursion - Bind9 DNS 
  7. Prevent IP Spoofing
  8. Harden PHP for security 
  9. Install and configure Apache application firewall - ModSecurity
  10. Protect from DDOS (Denial of Service) attacks with ModEvasive
  11. Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban
  12. Intrusion Detection - PSAD
  13. Check for RootKits - RKHunter and CHKRootKit
  14. Scan open Ports - Nmap
  15. Analyse system LOG files - LogWatch
  16. SELinux - Apparmor
  17. Audit your system security - Tiger
If you are looking for a GUI script to install and configure all the steps explained here automatically,
visit How to secure an Ubuntu 12.04 LTS server - Part 2 The GUI Installer script
Requirements:
  • Ubuntu 12.04 LTS server with a standard LAMP stack installed.

1. Firewall - UFW

  • A good place to start is to install a Firewall. 
  • UFW - Uncomplicated Firewall is a basic firewall that works very well and easy to configure with its Firewall configuration tool - gufw, or use  Shorewall, fwbuilder, or Firestarter.
  • Use Firestarter GUI to configure your firewall or refer to the Ubuntu Server Guide,  UFW manual pages or the Ubuntu UFW community documentation.
  • Install UFW and enable, open a terminal window and enter :
sudo apt-get install ufw
sudo ufw enable
  • Check the status of the firewall.
sudo ufw ufw status verbose
  • Allow SSH and Http services.
sudo ufw allow ssh
sudo ufw allow http

2. Secure shared memory.

  • /dev/shm can be used in an attack against a running service, such as httpd. Modify /etc/fstab to make it more secure.
  • Open a Terminal Window and enter the following :
sudo vi /etc/fstab
  • Add the following line and save. You will need to reboot for this setting to take effect :
tmpfs     /dev/shm     tmpfs     defaults,noexec,nosuid     0     0

3. SSH Hardening - disable root login and change port.

  • The easiest way to secure SSH is to disable root login and change the SSH port to something different than the standard port 22. 
  • Before disabling the root login create a new SSH user and make sure the user belongs to the admin group (see step 4. below regarding the admin group).
  • If you change the SSH port also open the new port you have chosen on the firewall and close port 22.
  • Open a Terminal Window and enter :
sudo vi /etc/ssh/sshd_config
  • Change the following and save.
Port 
Protocol 2
PermitRootLogin no
  • Restart SSH server, open a Terminal Window and enter :
sudo /etc/init.d/ssh restart

4. Protect su by limiting access only to admin group.

  • To limit the use of su by admin users only we need to create an admin group, then add users and limit the use of su to the admin group.
  • Add a admin group to the system and add your own admin username to the group by replacing below with your admin username.
  • Open a terminal window and enter:
sudo groupadd admin
sudo usermod -a -G admin 
sudo dpkg-statoverride --update --add root admin 4750 /bin/su

5. Harden network with sysctl settings.

  • The /etc/sysctl.conf file contain all the sysctl settings.
  • Prevent source routing of incoming packets and log malformed IP's enter the following in a terminal window:
sudo vi /etc/sysctl.conf
  • Edit the /etc/sysctl.conf file and un-comment or add the following lines :
# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1
  • To reload sysctl with the latest changes, enter:
sudo sysctl -p

6. Disable Open DNS Recursion - BIND DNS Server.

  • Open a Terminal and enter the following :
sudo vi /etc/bind/named.conf.options
  • Add the following to the Options section :
recursion no;
  • Restart BIND DNS server. Open a Terminal and enter the following :
sudo /etc/init.d/bind9 restart

7. Prevent IP Spoofing.

  • Open a Terminal and enter the following :
sudo vi /etc/host.conf
  • Add or edit the following lines :
order bind,hosts
nospoof on

8. Harden PHP for security.

  • Edit the php.ini file :
sudo vi /etc/php5/apache2/php.ini
  • Add or edit the following lines :
disable_functions = exec,system,shell_exec,passthru
register_globals = Off
expose_php = Off
magic_quotes_gpc = On

9. Web Application Firewall - ModSecurity.

10. Protect from DDOS (Denial of Service) attacks - ModEvasive

11. Scan logs and ban suspicious hosts - DenyHosts and Fail2Ban.

  • DenyHosts is a python program that automatically blocks SSH attacks by adding entries to /etc/hosts.deny. DenyHosts will also inform Linux administrators about offending hosts, attacked users and suspicious logins.
  • Open a Terminal and enter the following :
sudo apt-get install denyhosts
  • After installation edit the configuration file /etc/denyhosts.conf  and change the email, and other settings as required.
  • To edit the admin email settings open a terminal window and enter:
sudo vi /etc/denyhosts.conf
  • Change the following values as required on your server :
ADMIN_EMAIL = root@localhost
SMTP_HOST = localhost
SMTP_PORT = 25
#SMTP_USERNAME=foo
#SMTP_PASSWORD=bar
SMTP_FROM = DenyHosts nobody@localhost
#SYSLOG_REPORT=YES 
  • Fail2ban is more advanced than DenyHosts as it extends the log monitoring to other services including SSH, Apache, Courier, FTP, and more.
  • Fail2ban scans log files and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.
  • Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action could also be configured.
  • Out of the box Fail2Ban comes with filters for various services (apache, courier, ftp, ssh, etc).
  • Open a Terminal and enter the following :
sudo apt-get install fail2ban
  • After installation edit the configuration file /etc/fail2ban/jail.local  and create the filter rules as required.
  • To edit the settings open a terminal window and enter:
sudo vi /etc/fail2ban/jail.conf
  • Activate all the services you would like fail2ban to monitor by changing enabled = false to enabled = true
  • For example if you would like to enable the SSH monitoring and banning jail, find the line below and change enabled from false to true. Thats it.
[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
  • If you would like to receive emails from Fail2Ban if hosts are banned change the following line to your email address.
destemail = root@localhost
  • and change the following line from :
action = %(action_)s
  • to:
action = %(action_mwl)s
  • You can also create rule filters for the various services that you would like fail2ban to monitor that is not supplied by default.
sudo vi /etc/fail2ban/jail.local
  • Good instructions on how to configure fail2ban and create the various filters can be found on HowtoForge - click here for an example
  • When done with the configuration of Fail2Ban restart the service with :
sudo /etc/init.d/fail2ban restart
  • You can also check the status with.
sudo fail2ban-client status

12. Intrusion Detection - PSAD.

  • Cipherdyne PSAD is a collection of three lightweight system daemons that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic.
  • Currently version 2.1 causes errors during install on Ubuntu 12.04, but apparently does work. Version 2.2 resolves these issues but is not yet available on the Ubuntu software repositories. It is recommended to manually compile and install version 2.2 from the source files available on theCiperdyne website
  • To install the latest version from the source files follow these instruction : How to install PSAD Intrusion Detection on Ubuntu 12.04 LTS server
  • OR install the older version from the Ubuntu software repositories, open a Terminal and enter the following :
sudo apt-get install psad

13. Check for rootkits - RKHunter and CHKRootKit.

  • Both RKHunter and CHKRootkit basically do the same thing - check your system for rootkits. No harm in using both.
  • Open a Terminal and enter the following :
sudo apt-get install rkhunter chkrootkit
  • To run chkrootkit open a terminal window and enter :
sudo chkrootkit
  • To update and run RKHunter. Open a Terminal and enter the following :
sudo rkhunter --update
sudo rkhunter --propupd
sudo rkhunter --check

14. Scan open ports - Nmap.

  • Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.
  • Open a Terminal and enter the following :
sudo apt-get install nmap
  • Scan your system for open ports with :
nmap -v -sT localhost
  • SYN scanning with the following :
sudo nmap -v -sS localhost

15. Analyse system LOG files - LogWatch.

  • Logwatch is a customizable log analysis system. Logwatch parses through your system's logs and creates a report analyzing areas that you specify. Logwatch is easy to use and will work right out of the package on most systems.
  • Open a Terminal and enter the following :
sudo apt-get install logwatch libdate-manip-perl
  • To view logwatch output use less :
sudo logwatch | less
  • To email a logwatch report for the past 7 days to an email address, enter the following and replace mail@domain.com with the required email. :
sudo logwatch --mailto mail@domain.com --output mail --format html --range 'between -7 days and today' 

16. SELinux - Apparmor.

  • National Security Agency (NSA) has taken Linux to the next level with the introduction of Security-Enhanced Linux (SELinux). SELinux takes the existing GNU/Linux operating system and extends it with kernel and user-space modifications to make it bullet-proof.
  • More information can be found here. Ubuntu Server Guide - Apparmor
  • It is installed by default since Ubuntu 7.04. 
  • Open a Terminal and enter the following :
sudo apt-get install apparmor apparmor-profiles
  • Check to see if things are running :
sudo apparmor_status

17. Audit your system security - Tiger.

  • Tiger is a security tool that can be use both as a security audit and intrusion detection system.
  • Open a Terminal and enter the following :
sudo apt-get install tiger
  • To run tiger enter :
sudo tiger
  • All Tiger output can be found in the /var/log/tiger
  • To view the tiger security reports, open a Terminal and enter the following :
sudo less /var/log/tiger/security.report.*