Libre Things

When you have enabled automatic login under Gnome/Ubuntu, the window asking your password to unlock the keyring at startup is very annoying ! Network-manager needs it to be able to use the Wifi keys.

If your keyring password is the same as your login password, the keyring is unlocked automatically when you type in your password to log in. This is not possible with autologin.

A solution is to put an empty keyring password. This is bad for security of all your passwords.

The best solution would be to store the wifi keys in the default keyring, and to store all the other passwords in another keyring. Maybe I didn't check correctly, but from what I seen most applications only use the default keyring.

Average solution: put a "foo" password to the default keyring, unlocked at Gnome startup by a script. This is better than an empty password.

Here is my solution:

We change the default keyring password:

1. Go in Applications > Accessories > Passwords and encryption keys (don't loose 2 hours like me looking for it in System > Preferences, where it should be)
2. Right click on the default keyring > Change password

We then create the python script with the following code:

vi ~/.lordiam.py

#!/usr/bin/python
import gnomekeyring
#gnomekeyring.lock_sync(None);
gnomekeyring.unlock_sync(None, 'mypassword');

We prevent other user from reading the file:

chmod 700 ~/.lordiam.py

We test it. Expect 0 as return code (the warning is normal):

~/.lordiam.py
echo $?

Now, we add the script at startup in System > Preferences > Startup Applications:

Command: /home/USER/.lordiam.py

Finally, we reboot the PC to test the whole thing.

Notes:

• The fact that the script is called before network-manager start is a chance. I didn't found how to put a priority on it in the Gnome startup programs.
• What is the 'login' keyring for ? From what I understand, it is for storing passwords which will be forgotten at session end.
• For the script, we choose a common name, less remarkable than unlock_keyring.py. We also put the script as hidden file. It is better than nothing.

References:

• apt-get source libpam-gnome-keyring
• apt-get source python-gnomekeyring

Userspace Software Suspend is an alternative to the default hibernation method in the Linux kernel. It adds several interesting features like compression, encryption... Compression allows for hibernation with a smaller Swap partition. It also decreases the wake up time of your system!

Here is how to install USwSusp on Ubuntu Karmic. Should also work with a recent Debian.

Install the uswsusp package:

aptitude install uswsusp

You can now hibernate with the s2disk command as root.

To hibernate from Ubuntu menu or by key shortcut, then change the following line in the /etc/pm/config.d/00sleep_module file:

SLEEP_MODULE=uswsusp

And test your hibernation!!

Links:

• https://lists.ubuntu.com/archives/karmic-changes/2009-April/000258.html
• http://suspend.sourceforge.net/

I looked for a way of changing mail format sent by the crontab. I hoped for a syntax like MAILTO=

Answer: Impossible.

With Debian default cron program, it's hard coded in cron :

In do_command.c source file:

fprintf(mail, "From: root (Cron Daemon)\n");
fprintf(mail, "To: %s\n", mailto);
fprintf(mail, "Subject: Cron <%s@%s> %s\n",
  usernm, first_word(hostname, "."),
  e->cmd);

Here is howto make sftp shares with chroot.

In /etc/ssh/sshd_config:

# we use openssh internal sftp
# because /usr/lib/openssh/sftp-server won't be available in chroot
Subsystem sftp internal-sftp

Match group sftp
        ChrootDirectory %h
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand internal-sftp

UPDATE 17/06/2010: Beware with the syntax! Comments must start at the line beginning, and no spaces at the end of the ForceCommand internal-sftp line.

Now just create users belonging to sftp group, and that's it. Test it with:

sftp user@myserver.com

Problem: we cannot use the rsync command to send files, because rsync is not available in the chroot.

First, we allow other commands, commenting the line:

#ForceCommand internal-sftp

Then, we build the following tree in the chroot directory:

bin/
bin/bash
bin/rsync
lib/
lib/libncurses.so.5
lib/ld-linux.so.2
lib/libacl.so.1
lib/libpopt.so.0
lib/libattr.so.1
lib/i686
lib/i686/cmov
lib/i686/cmov/libdl.so.2
lib/i686/cmov/libc.so.6

We must put both bash and rsync commands, and all their librairies (you can display them with the ldd command).

Note: the user must have /bin/bash as default shell.

Note2: the chroot dir must belong to root, even if it's the user's folder. To allow the user to write in it, you have to create a subfolder with appropriate permissions. According to OpenSSH programers, it's a big constraint, but very important for a chroot's security.

References :

• man sshd_config
• http://www.debian-administration.org/articles/590
• http://www.howtoforge.org/chrooted-ssh-sftp-tutorial-debian-lenny
• http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/