Indholdsfortegnelse for October 2023 i Linux Magazine

Dear Reader, Last month I used this space to talk about IBM/Red Hat’s plan to restrict access to Red Hat Enterprise Linux (RHEL) source code. This eerie announcement, which seemed quite contrary to the ideals of free software, sent shock waves through the community. Some said it violated the spirit of the GPL, and others argued it was necessary to stop the clones from stealing Red Hat’s business. Everyone agreed that Red Hat had developed a novel argument that could potentially allow them to skirt around the code-sharing protections of the GPL, and the general feeling was that the matter would only be settled after a protracted courtroom battle. Regardless of where this episode ends legally, it is now clear that Red Hat’s clones and other competitors are not planning…

If you’re a fan of Zorin (or of user-friendly open source operating systems), you should be excited about the new 16.3 release. This latest upgrade includes the highly anticipated Zorin OS Upgrader, which allows users to easily upgrade between releases and editions of Zorin OS without having to re-install the OS. With the new upgrader, you can even go from, say, Zorin OS 16 Core to Zoron OS 16 Pro or Zorin OS 15 to Zorin OS 16. This feature has been in development for over a year and is now considered stable. Other improvements include new features for Zorin Connect, which allows you to run commands on your computer directly from the Android power menu, improved playback controls when Spotify is playing content on your computer, a monochrome icon…

Now that third parties no longer have unfettered access to the RHEL source code, distributions such as Rocky Linux, AlmaLinux, and Oracle Linux have had to rethink how they build their operating systems. For the longest time, the main appeal of these operating systems was that they were 1:1 compatible with Red Hat Enterprise Linux. With that no longer a simple and cost-effective option, those distributions have had to make drastic changes. The company behind AlmaLinux says they will no longer focus on being 1:1 compatible with RHEL but, instead, will maintain ABI compatibility. What this means is that AlmaLinux will be Application Binary Interface compatible with RHEL. In other words, AlmaLinux will be able to link pre-built libraries with compiled binaries. On this matter, Benny Vasquez, Chair of the…

The European Commission (EC) has adopted an adequacy decision for the EU-US Data Privacy Framework. “The decision concludes that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from the EU to US companies under the new framework,” the announcement states (https://ec.europa.eu/commission/presscorner/detail/en/ip_23_3721). This decision means that “personal data can flow safely from the EU to US companies participating in the Framework, without having to put in place additional data protection safeguards.” Additionally, US companies can now self-certify their compliance (https://www.commerce.gov/news/press-releases/2023/07/data-privacy-framework-program-launches-new-website-enabling-us) with the EU-US Data Privacy Framework to facilitate cross-border transfers of personal data in compliance with EU law.…

According to the WordPress website, a staggering 42 percent of the World Wide Web runs on WordPress software. It is not difficult to see why the huge number of WordPress websites around the world is a major draw for attackers. Discovering a WordPress bug allows the attacker to repeat the process hundreds of times. In some cases, they can even automate the process for a rinse-and-repeat attack which could be a real danger for millions of website owners. This article looks at some of the techniques an attacker can use to gain shell access to a server that is running WordPress. Once they've attained shell access, the attacker can use standard privilege escalation techniques to take full control of the machine. Pen testers have many ways to describe the structure…

A good backup tool is like a dishwasher: It’s not something most of us get excited about, but the degree to which it improves our daily lives is hard to overstate. And like with a dishwasher, no one really wants to spend time attending to a backup tool. Ideally, you’d want to set it up once and let it do its job with the push of a button or have it perform backups automatically, with no user interaction whatsoever. Picking the right backup tool is not as trivial as choosing a dishwasher, though. Sure, you can whip up a simple shell script that backs up data to a different storage device using good old rsync. But in this day and age, it’s simply not enough. If you’re serious about keeping…

Available Starting October 6 Preview Newsletter The Linux Magazine Preview is a monthly email newsletter that gives you a sneak peek at the next issue, including links to articles posted online. Sign up at: https://bit.ly/Linux-Update…

The first release candidate of Mageia 9 is now available. This first look at the latest release follows the last beta release from May 2023 and has resolved several “stubborn” issues as well as included a number of security fixes and updates. In terms of updated packages, you’ll find kernel 6.4.3, glib 2.36, gcc 12.3.0, rpm 4.18.0, Chromium 114.0.5735.198, Firefox ESR 102.13, LibreOffice 7.5.4.2, and Mesa 23.1.3. As far as desktops are concerned, Mageia 9 makes available the following: KDE Plasma 5.27.5, Gnome 44.2, Xfce 4.18.4, and LXQt 1.3.0. You’ll find installation media for both 32- and 64-bit architecture. The latest release installation media has been reduced in size and is, in fact, the smallest since Mageia 4. It’s also important to note that the Mageia RPM database no longer…

Linux Magazine www.linux-magazine.com ADMIN HPC http://www.admin-magazine.com/HPC/ Getting Data Into and Out of the Cluster • Jeff Layton A basic question when getting into HPC is how to get data into and out of the cluster from local Linux and Windows machines. ADMIN Online http://www.admin-magazine.com/ Secure Microservices with Centralized Zero Trust • Abe Sharp SPIFFE and SPIRE put strong workload identities at the center of a zero-trust architecture. They improve reliability and security by taking the responsibility for identity creation and management away from individual services and workloads. Pentest Your Web Server with Nikto • Matthias Wübbeling Check your web servers for known vulnerabilities. Passkeys Eliminate the Need for Password-Based Authentication • Mark Zimmermann Passwords are becoming a thing of the past. We look into the basic weaknesses of passwords, explain…

The Institute of Electrical and Electronics Engineers (IEEE) has released 802.11bb (https://standards.ieee.org/ieee/802.11bb/10823/) as a standard for light-based wireless communications. “LiFi is a wireless technology that uses light rather than radio frequencies to transmit data. By harnessing the light spectrum, LiFi can unleash faster, more reliable wireless communications with unparalleled security compared to conventional technologies such as WiFi and 5G,” according to this statement from global proponents of the technology: https://www.purelifi.com/global-ifi-firms-welcome-the-release-of-ieee-802-11bb-global-light-communications-standard/. LiFi complements WiFi and 5G technologies and integrates easily with existing infrastructures, says Dominic Schulz, lead of LiFi development at Fraunhofer HHI. Additionally, it offers “high-speed mobile connectivity in areas with limited RF, like fixed wireless access, classrooms, medical, and industrial scenarios.” Get the latest news in your inbox every week Subscribe FREE to Linux Update bit.ly/Linux-Update…

The Fedora Project [1] was started in 2003 as the community face of the newly established Red Hat Enterprise Linux (RHEL). Although sometimes dismissed as no more than a beta release for RHEL, Fedora quickly became a popular community choice as well, with numerous spins and builds. Twenty years later, it is also one of the main sources for numerous major commercial distributions, including RHEL, CentOS Stream, Rocky Linux, and AlmaLinux, as well as a dozen derivatives in its own right. Matthew Miller has been Fedora Project Leader since 2014. As he prepared for Flock, the Fedora Project’s annual conference, in Cork, Ireland, in August 2023, Miller kindly agreed to talk about the current state of Fedora. Linux Magazine (LM): Tell us about your involvement in free software. Matthew Miller…

This article is about the joy of tinkering, and the project I look at is suitable for all kinds of situations when your hands are full or just dirty. The hardware requirements turn out to be quite low: a Raspberry Pi, a screen, and a gesture sensor. My choice of sensor was the APDS9960 (Figure 1), for which you can get breakouts and an I2C connector for a low price at the usual dealers ($3.20-$7.50). However, you should note whether the sensor has soldered jumpers. The left jumper (PS) controls the power supply of the infrared lamp with the pin for positive supply voltage (VCC) and definitely needs to be closed. The right jumper (labelled 12C PU on the sensor in Figure 1) enables the pullups on the clock line…

From Contract Law to Copyright Last month I touched briefly on an issue with trademarks, and this month I would like to continue the theme of intellectual property by talking about copyright. As I normally do, I will go back in time to when computer software could not be copyrighted. In 1969, when I started programming, you would protect your programs (if you wanted to) by using contract law or “trade secrets” (or both). Much of this was because computers were astronomically expensive by today’s standards. Even the smallest of computers might cost more than $50,000 (and that was when $50,000 was a lot of money). Software, if you purchased it, was also expensive, and I remember purchasing a compiler from a company and paying $100,000 for a single copy…

Nitrux 2.9.1 Available and Uses a Newer Linux Kernel The developers of the systemd-free Linux distribution, Nitrux, have released a new version of the operating system (version 2.9.1) which includes kernel 6.4. This Debian-based distribution is immutable and uses the KDE Plasma desktop environment as a base to form its own unique desktop, called NX Desktop. Although this is just a point release, it shifts to the Liquorix Linux kernel, version 6.4.8, the latest KDE software (including KDE Frameworks 5.108 and KDE Gear 23.04.3), and is built against Qt 5.15.5. You’ll also find a few new bits, such as the Kernel Boot tool that simplifies the process of booting different kernels. Another addition is the Hardware Probe Tool, which makes hardware detection easier and more reliable. As well, fuse-overlayfs has…

Linux Mint 21.2, “Victoria,” is now available for general usage. This latest release includes a number of improvements, including a brand new take on the Greeter, which now has support for multiple keyboard layouts so you can easily switch. As well, the touchpad was given some significant love such that tap-to-click is now automatically detected and enabled in the login screen. Users can also now configure the virtual keyboard. The Pix image viewer has also been re-based on gThumb 3.12.2 with a new UI that features header bars and buttons in place of toolbars and menubars. Along with the UI change, there have been 168 total new features for this one app alone. The look and feel of Linux Mint was also given some interesting tweaks. This includes two-tone icons…

Canonical and Intel have joined forces to deliver real-time Ubuntu for industrial systems, according to a recent announcement (https://ubuntu.com/blog/real-time-industrial-systems). “The solution enables enterprises to harness the power of optimized Linux on Intel silicon for a wide range of use cases, from telco workloads to life-saving medical equipment, and automation systems for the factory floor,” the announcement says. The solution is now generally available on Intel Core processors and supports Intel Time Coordinated Computing (TCC) and IEEE 802.1 Time Sensitive Networking (TSN) (https://1.ieee802.org/tsn/). TSN primarily focuses on the network space, explains Edoardo Barbieri (https://ubuntu.com/blog/real-time-industrial-systems), ensuring that time-sensitive applications and workloads receive the necessary processing and network priorities. “With the addition of TCC and TSN, enterprises can achieve enhanced performance, time synchronization, and temporal isolation at the silicon layer,” he says.…

Heap Hardening Against Hostile Spraying Ruiqi Gong wanted to address the generic security threat of “heap spraying” in the Linux kernel. Heap spraying is when an attacker knows the memory address of a critical part of the system and makes a large number of malloc() calls trying to allocate memory at that specific address. In the event of certain types of kernel bugs, one of those malloc() calls might succeed, giving the attacker the ability to overwrite the critical part of the system with their own malicious code. Heap spraying is not a security vulnerability in itself, because user software could legitimately want to issue many malloc() calls. Rather, heap spraying is a way to exploit other bugs that may exist in the kernel. Because heap spraying itself is not…

When trying to break into a web server, ethical hackers often alter some of the variables that are present in a website’s URLs. This type of attack can fall into a number of different categories. Some attacks concern the manipulation of files that a server has access to. The definition of directory traversal, as it suggests, is allowing an attacker to traverse a filesystem and then read files (that they shouldn’t have access to). On the other hand, Local File Inclusion (LFI) and Remote File Inclusion (RFI) attacks can also execute the files that they have access to. As you would guess, LFI is concerned with files that are already present on the target system (which is usually a server), whereas RFI is where an attacker uploads a malicious file…

Imagine you’ve just arrived at your vacation resort, and the WiFi isn’t working. Is the router’s DHCP server failing to assign an IP address to your laptop? Is it DNS? Or is it just that the throughput is so poor that everything seems to be stalling? You can diagnose all of these issues by running various command-line tools, but it is tedious and annoying to have to repeat the procedure every time. How about a tool that repeatedly runs these steps at regular intervals, visualizes the results, and hopefully zeroes in on the root cause? I will use the tview [1] library from GitHub as the terminal user interface (UI) for my wifi diagnostic tool. After all, some well-known projects, such as Kubernetes, also use it for their command-line tools.…

SUBSCRIBE shop.linuxnewmedia.com Expand your Linux skills: • In-depth articles on trending topics, including Bitcoin, ransomware, cloud computing, and more!• How-tos and tutorials on useful tools that will save you time and protect your data• Troubleshooting and optimization tips• Insightful news on crucial developments in the world of open source• Cool projects for Raspberry Pi, Arduino, and other maker-board systems Go farther and do more with Linux, subscribe today and never miss another issue! Follow us @linux_pro @linuxpromagazine Linux Magazine @linuxmagazine Need more Linux7 Subscribe free to Linux Update Our free Linux Update newsletter delivers insightful articles and tech tips to your inbox every week. bit.ly/Linux-Update…

Suppose you want to record the contents of a computer screen or window. Linux is blessed with a number of useful tools that capture the view on your screen at a given moment. You can use screenshots to preserve critical information, document the contents of web forms, or illustrate application procedures. Most of the popular screenshot tools, however, are desktop applications. What if you don’t want to slow down and maneuver through a GUI just to capture the contents of your screen? Many users don’t realize you can also create screenshots from the command line. Command-line screenshots are a quick and useful option when you are working in a terminal window, and conjuring up a screenshot through a one-line command means you can add screenshots to your Bash scripts. In…

This month, Graham finally migrated his old CentOS 6 server to a shiny new Ubuntu LTS release. It had been running for over a decade and handled all his email and messaging. Video stabilizer Gyroflow There was a time when many of us laughed at the silly people and their selfie sticks – absurd periscopes sticking out of a crowd holding frontfacing phones in the air or skipole-attached cameras hovering ahead of some great action jump or remarkable descent. But times have changed, and what one generation considered narcissism has now become completely normalized. We are now recording more videos than we ever thought possible, from mountain biking and snowboarding, to chasing people around the garden. For any of this footage to be watchable, it needs motion stabilization. Back in…

#274/September 2023 The Best of Small Distros Nowadays, all the attention is on big, enterprise distributions supported by professional developers at big, enterprise corporations, but small distros are still a thing. If you’re shopping for a Linux to run on old hardware, if you just want a simpler system that is more responsive and less cluttered, or if you’re looking for a special Linux tailored for a special purpose, you’re sure to find inspiration in our look at small and specialty Linux systems. On the DVD: 10 Small Distro ISOs and 4 Small Distro Virtual Appliances #273/August 2023 Podcasting On the Internet, you don’t have to wait for permission to speak to the world. Podcasting lets you connect with your audience no matter where they are. Whether you're in it to…

Users, developers, and vendors meet at Linux events around the world. We at Linux Magazine are proud to sponsor the Featured Events shown here. For other events near you, check our extensive events calendar online at https://www.linux-magazine.com/events. If you know of another Linux event you would like us to add to our calendar, please send a message with all the details to info@linux-magazine.com. DrupalCon Lille 2023 Date: October 17-20, 2023 Location: Lille, France Website: https://events.drupal.org/lille2023 DrupalCon comes back to France in 2023 between 17-20 October! Do not miss the opportunity to get access to hundreds of sessions by thought leaders and the Drupal community. Join BoF’s to talk about solving real problems. Get inspired by keynote speakers and much more. Learn more and register today! LinuxFest Northwest Date: October 20-22, 2023…

Linux Magazine is looking for authors to write articles on Linux and the tools of the Linux environment. We like articles on useful solutions that solve practical problems. The topic could be a desktop tool, a command-line utility, a network monitoring application, a homegrown script, or anything else with the potential to save a Linux user trouble and time. Our goal is to tell our readers stories they haven’t already heard, so we’re especially interested in original fixes and hacks, new tools, and useful applications that our readers might not know about. We also love articles on advanced uses for tools our readers do know about – stories that take a traditional application and put it to work in a novel or creative way. Topics close to our hearts include:…