Learn the Functions of Shebang in Linux

bash shebang linux

The #! characters form a magic number. We embed these magic number in any scripts under UNIX / Linux operating systems to tell the kernel what interpreter to execute, to read our script. Like Linux shell, Python, Perl and R interpreters. You might have noticed all Linux shell and Perl / python script starts with the below line:

#!/bin/bash

OR

#!/usr/bin/env python

OR

#!/usr/bin/env perl

OR

#!/usr/bin/env Rscript

Now we will write a program file for Python language. we can execute this program by calling the interpreter directly without adding shebang line like below.

python_script

import sys

def greeting(name):
sys.stdout.write(“Hello” + name + “n”)

name = “Omar”
greeting(name)

For executing the code, we will mention python before name of the file.

python python_script.py
Output
Hello Omar

Also we will write a program file for R language. we can execute this program by calling the interpreter directly without adding shebang line like below.

r_script

print(“hello world”)

For executing the code, we will mention Rscript before name of the file.

Rscript r_script.R
Output
“hello world”

How to make executable file

to make executable file we should add shebang line #!/usr/bin/python to the top of script and changing the mode of the file to be executable.

python_script

#!/usr/bin/python
import sys

def greeting(name):
sys.stdout.write(“Hello” + name + “n”)

name = “Omar”
greeting(name)

To make the file is executable, type the command below.

chmod +x python_script.py

Now we can just run the file and it will be interpreted by python.

./python_script.py
Output
Hello Omar

Large computer cluster

The path /usr/bin/python will probably work for most default systems but might not work on things like a large computer cluster. So we will use the program env to get the right interperter.

#!/usr/bin/env python
import sys

def greeting(name):
sys.stdout.write(“Hello” + name + “n”)

name = “Omar”
greeting(name)

We can do the same for any program like Rscript as well.

#!/usr/bin/env Rscript
print(“hello world”)

Read Also:

Source

Check Out Ways to Stop and Restart Apache on Linux Systems

stop and restart apache linux

As we all know, Apache is a free and open source cross-platform web server that is used to serve both static and dynamic web pages. on the web. In this article, we’ll focus on how you can start and restart Apache web server on Linux systems using the apache2 command.

On Ubuntu/Debian Linux

Let’s see how we can start, stop and restart apache2 web server in Ubuntu and Debian versions

Apache2 Restart/Start/Stop/

For Ubuntu and Debian Systemd users – Ubuntu 18.04,16.04 and Debian 9.x later use below commands.

Start Apache2 by running

# systemctl start apache2

Stop Apache2 by running

# systemctl stop apache2

Restart Apache2 by running

# systemctl restart apache2

To check Apache2 status on the terminal run

# systemctl status apache2

Sample Output

● apache2.service – LSB: Apache2 web server
Loaded: loaded (/etc/init.d/apache2; bad; vendor preset: enabled)
Drop-In: /lib/systemd/system/apache2.service.d
└─apache2-systemd.conf
Active: active (running) since Tue 2018-09-11 12:49:03 UTC; 26s ago
Docs: man:systemd-sysv-generator(8)
CGroup: /system.slice/apache2.service
├─28788 /usr/sbin/apache2 -k start
├─28791 /usr/sbin/apache2 -k start
└─28792 /usr/sbin/apache2 -k start

To verify whether the web server is indeed running, open your browser and enter your server’s IP address

http://server-ip-address/

You should be able to view Apache’s default page as shown below

restart Apache web server on Linux Systems

For older versions of Ubuntu -14.10 and older and Debian older

Start Apache2 service by running

# sudo service apache2 start
or
# /etc/init.d/apache2 start
or
# sudo /etc/init.d/apache2 start

Stop Apache2 service by running

# sudo service apache2 stop
or
# /etc/init.d/ apache2 stop

Restart Apache2 service by running

# sudo service apache2 restart
or
# /etc/init.d/ apache2 restart
or
# sudo /etc/init.d/ apache2 restart

Sample Output

[ ok ] Restarting apache2 (via systemctl): apache2.service.

Check Apache2 status run

# sudo service apache2 status
or
# /etc/init.d/ apache2 status
or
# sudo /etc/init.d/ apache2 status

Sample Output

● apache2.service – LSB: Apache2 web server
Loaded: loaded (/etc/init.d/apache2; bad; vendor preset: enabled)
Drop-In: /lib/systemd/system/apache2.service.d
└─apache2-systemd.conf
Active: active (running) since Tue 2018-09-11 12:49:03 UTC; 26s ago
Docs: man:systemd-sysv-generator(8)
CGroup: /system.slice/apache2.service
├─28788 /usr/sbin/apache2 -k start
├─28791 /usr/sbin/apache2 -k start
└─28792 /usr/sbin/apache2 -k start

On RHEL/CentOS

Apache2 Restart/Start/Stop

For newer versions of RHEL / CentOS (Versions 7.x and later)

Start Apache2 by running

# systemctl start httpd
or
# systemctl start httpd.service

Stop Apache2 by running

# systemctl stop httpd
or
# systemctl stop httpd.service

Restart Apache2 by running

# systemctl restart httpd
or
# systemctl restart httpd.service

To verify/check the status of Apache2

# systemctl status httpd

Sample Output

● httpd.service – The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor prese t: disabled)
Active: active (running) since Tue 2018-09-11 17:33:28 UTC; 6min ago
Docs: man:httpd(8)
man:apachectl(8)
Main PID: 1450 (httpd)
Status: “Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/s ec”
CGroup: /system.slice/httpd.service
├─1450 /usr/sbin/httpd -DFOREGROUND
├─1451 /usr/sbin/httpd -DFOREGROUND
├─1452 /usr/sbin/httpd -DFOREGROUND
├─1453 /usr/sbin/httpd -DFOREGROUND
├─1454 /usr/sbin/httpd -DFOREGROUND
└─1455 /usr/sbin/httpd -DFOREGROUND

Sep 11 17:33:28 ip-172-31-16-67.us-east-2.compute.internal systemd[1]: Starti…
Sep 11 17:33:28 ip-172-31-16-67.us-east-2.compute.internal systemd[1]: Starte…
Hint: Some lines were ellipsized, use -l to show in full.

For older versions (CentOS/RHEL (Red Hat) Linux version 4.x/5.x/6.x )

Start Apache2 by running

# service httpd start

Stop Apache2 by running

# service httpd stop

Restart Apache2 by running

# service httpd restart

To check the status of Apache web server

# service httpd status

sample output

● httpd.service – The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2018-09-11 19:46:30 UTC; 1 weeks 1 days ago
Docs: man:httpd(8)
man:apachectl(8)
Process: 9118 ExecStop=/bin/kill -WINCH $ (code=exited, status=0/SUCCESS)
Process: 22055 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS)
Main PID: 9122 (httpd)
Status: “Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec”
CGroup: /system.slice/httpd.service
├─ 9122 /usr/sbin/httpd -DFOREGROUND
├─22058 /usr/sbin/httpd -DFOREGROUND
├─22059 /usr/sbin/httpd -DFOREGROUND
├─22060 /usr/sbin/httpd -DFOREGROUND
├─22061 /usr/sbin/httpd -DFOREGROUND
├─22062 /usr/sbin/httpd -DFOREGROUND
├─22149 /usr/sbin/httpd -DFOREGROUND
└─27556 /usr/sbin/httpd -DFOREGROUND

Just like in Debian systems, you can verify that the web server is running by opening your browser and typing your server’s IP address

http://server-ip-address/

restart Apache web server on Linux Systems

On Fedora

Apache2 Restart/Start/Stop

For Fedora Systems (22 and later)

Start Apache2 by running

# systemctl start httpd
or
# apachectl start

Stop Apache2 by running

# systemctl stop httpd
or
# apachectl -k stop

To restart Apache2 run

apachectl -k restart

To check Apache2 status

systemctl status httpd

To confirm that the server is up and running on a web browser, type the server’s IP

http://server-ip-address/

restart Apache web server on Linux Systems

In this article, we focussed on How you can start, stop and restart Apache2 web server on Linux Systems such as Ubuntu/Debian and Redhat systems. We hope that this tutorial has been helpful.

Read Also:

Source

[Stable Update] 2018-08-18 – Kernels, Xorg-Server, Mesa, Deepin, MATE, Perl, Python

Hi community,

Welcome to another stable update. So what do we have with this one?

  • renewed most of our kernels, incl. the L1TF fixes
  • we updated our Xorg-Server to 1.20.1
  • mesa got updated to 18.1.6
  • xf86-video-ati we used the latest git-snapshot to fix some graphical glitches
  • Nvidia 304xx driver is dropped now.
  • Virtualbox got updated to 5.2.18
  • we backported a fix for kscreenlocker reducing the 100% CPU usage
  • we reverted commit 6f130e8 in systemd, which improves network speed
  • we pushed our rebuilds for python 3.7 and perl 5.28.
  • LibreOffice is now at 6.0.6
  • we added the latest MATE packages
  • added some new Deepin packages
  • Stefano updated our Adapta Themes
  • we updated some of our Grub themes
  • we fixed an issue with gpodder
  • updated firefox and thunderbird
  • updated dbus
  • we updated firefox-dev and firefox-kde and jdk8 to their latest versions
  • flameshot got a fix for zh_TW locale loading
  • small fixes to pamac-cli
  • the usual python/haskell rebuilds/updates

We hope with all these changes Manjaro to be more efficent for you all.

Our effort and all the needed information about the new security risk can be found here.

So please report back and give us feedback for given changes made to our repositories. Users of our 32-bit Distro should read this.

kind regards

Philip Müller
Manjaro Project Lead

Current supported Kernels

  • linux316 3.16.57
  • linux318 3.18.119 [EOL]
  • linux41 4.1.52 [EOL]
  • linux44 4.4.149
  • linux49 4.9.121
  • linux414 4.14.64
  • linux415 4.15.18 [EOL]
  • linux416 4.16.18 [EOL]
  • linux417 4.17.16
  • linux418 4.18.2
  • linux419 4.19-rc0
  • linux414-rt 4.14.52_rt34
  • linux416-rt 4.16.18_rt11

Package Updates (Sat Aug 18 06:46:56 CEST 2018)

  • community x86_64: 2965 new and 2912 removed package(s)
  • core x86_64: 65 new and 64 removed package(s)
  • extra x86_64: 1033 new and 1021 removed package(s)
  • multilib x86_64: 22 new and 25 removed package(s)

Links

Posted in: news · update

Source

PyTorch 1.0 Preview Release: Facebook’s newest Open Source AI

Last updated October 4, 2018 By Avimanyu Bandyopadhyay Leave a Comment

Facebook already uses its own Open Source AI, PyTorch quite extensively in its own artificial intelligence projects. Recently, they have gone a league ahead by releasing a pre-release preview version 1.0.

For those who are not familiar, PyTorch is a Python-based library for Scientific Computing.

PyTorch harnesses the superior computational power of Graphical Processing Units (GPUs) for carrying out complex Tensor computations and implementing deep neural networks. So, it is used widely across the world by numerous researchers and developers.

This new ready-to-use Preview Release was announced at the PyTorch Developer Conference at The Midway, San Francisco, CA on Tuesday, October 2, 2018.

Highlights of PyTorch 1.0 Release Candidate

PyTorhc is Python based open source AI framework from Facebook

Some of the main new features in the release candidate are:

1. JIT

JIT is a set of compiler tools to bring research close to production. It includes a Python-based language called Torch Script and also ways to make existing code compatible with itself.

2. New torch.distributed library: “C10D”

“C10D” enables asynchronous operation on different backends with performance improvements on slower networks and more.

3. C++ frontend (experimental)

Though it has been specifically mentioned as an unstable API (expected in a pre-release), this is a pure C++ interface to the PyTorch backend that follows the API and architecture of the established Python frontend to enable research in high performance, low latency and C++ applications installed directly on hardware.

To know more, you can take a look at the complete update notes on GitHub.

The first stable version PyTorch 1.0 will be released in summer.

Installing PyTorch on Linux

To install PyTorch v1.0rc0, the developers recommend using conda while there also other ways to do that as shown on their local installation page where they have documented everything necessary in detail.

Prerequisites

  • Linux
  • Pip
  • Python
  • CUDA (For Nvidia GPU owners)

As we recently showed you how to install and use Pip, let’s get to know how we can install PyTorch with it.

Note that PyTorch has GPU and CPU-only variants. You should install the one that suits your hardware.

Installing old and stable version of PyTorch

If you want the stable release (version 0.4) for your GPU, use:

pip install torch torchvision

Use these two commands in succession for a CPU-only stable release:

pip install http://download.pytorch.org/whl/cpu/torch-0.4.1-cp27-cp27mu-linux_x86_64.whl
pip install torchvision

Installing PyTorch 1.0 Release Candidate

You install PyTorch 1.0 RC GPU version with this command:

pip install torch_nightly -f https://download.pytorch.org/whl/nightly/cu92/torch_nightly.html

If you do not have a GPU and would prefer a CPU-only version, use:

pip install torch_nightly -f https://download.pytorch.org/whl/nightly/cpu/torch_nightly.html

Verifying your PyTorch installation

Startup the python console on a terminal with the following simple command:

python

Now enter the following sample code line by line to verify your installation:

from __future__ import print_function
import torch
x = torch.rand(5, 3)
print(x)

You should get an output like:

tensor([[0.3380, 0.3845, 0.3217],
[0.8337, 0.9050, 0.2650],
[0.2979, 0.7141, 0.9069],
[0.1449, 0.1132, 0.1375],
[0.4675, 0.3947, 0.1426]])

To check whether you can use PyTorch’s GPU capabilities, use the following sample code:

import torch
torch.cuda.is_available()

The resulting output should be:

True

Support for AMD GPUs for PyTorch is still under development, so complete test coverage is not yet provided as reported here, suggesting this resource in case you have an AMD GPU.

Lets now look into some research projects that extensively use PyTorch:

Ongoing Research Projects based on PyTorch

  • Detectron: Facebook AI Research’s software system to intelligently detect and classify objects. It is based on Caffe2. Earlier this year, Caffe2 and PyTorch joined forces to create a Research + Production enabled PyTorch 1.0 we talk about.
  • Unsupervised Sentiment Discovery: Such methods are extensively used with social media algorithms.
  • vid2vid: Photorealistic video-to-video translation
  • DeepRecommender (We covered how such systems work on our past Netflix AI article)

Nvidia, leading GPU manufacturer covered more on this with their own update on this recent development where you can also read about ongoing collaborative research endeavours.

How should we react to such PyTorch capabilities?

To think Facebook applies such amazingly innovative projects and more in its social media algorithms, should we appreciate all this or get alarmed? This is almost Skynet! This newly improved production-ready pre-release of PyTorch will certainly push things further ahead! Feel free to share your thoughts with us in the comments below!


About Avimanyu Bandyopadhyay

Avimanyu is a Doctoral Researcher on GPU-based Bioinformatics and a big-time Linux fan. He strongly believes in the significance of Linux and FOSS in Scientific Research. Deep Learning with GPUs is his new excitement! He is a very passionate video gamer (his other side) and loves playing games on Linux, Windows and PS4 while wishing that all Windows/Xbox One/PS4 exclusive games get support on Linux some day! Both his research and PC gaming are powered by his own home-built computer. He is also a former Ubisoft Star Player (2016) and mostly goes by the tag “avimanyu786” on web indexes.

Source

LinuxBoot for Servers: Enter Open Source, Goodbye Proprietary UEFI

Last updated October 6, 2018 By Avimanyu Bandyopadhyay 19 Comments

LinuxBoot is an Open Source alternative to Proprietary UEFI firmware. It was released last year and is now being increasingly preferred by leading hardware manufacturers as default firmware. Last year, LinuxBoot was warmly welcomed into the Open Source family by The Linux Foundation.

This project was an initiative by Ron Minnich, author of LinuxBIOS and lead of coreboot at Google, in January 2017.

Google, Facebook, Horizon Computing Solutions, and Two Sigma collaborated together to develop the LinuxBoot project (formerly called NERF) for server machines based on Linux.

Its openness allows Server users to easily customize their own boot scripts, fix issues, build their own runtimes and reflash their firmware with their own keys. They do not need to wait for vendor updates.

Following is a video of Ubuntu Xenial booting for the first time with NERF BIOS:

Let’s talk about some other advantages by comparing it to UEFI in terms of Server hardware.

Advantages of LinuxBoot over UEFI

LinuxBoot vs UEFI

Here are some of the major advantages of LinuxBoot over UEFI:

Significantly
faster startup

It can boot up Server boards in less than twenty seconds, versus multiple minutes on UEFI.

Significantly
more flexible

LinuxBoot
can make use of any devices, filesystems and protocols that Linux
supports.

Potentially
more secure

Linux device drivers and filesystems have significantly more scrutiny than through UEFI.

We can argue that UEFI is partly open with EDK II and LinuxBoot is partly closed. But it has been addressed that even such EDK II code does not have the proper level of inspection and correctness as the Linux Kernel goes through, while there is a huge amount of other Closed Source components within UEFI development.

On the other hand, LinuxBoot has a significantly smaller amount of binaries with only a few hundred KB, compared to the 32 MB of UEFI binaries.

To be precise, LinuxBoot fits a whole lot better into the Trusted Computing Base, unlike UEFI.

LinuxBoot has a kexec based bootloader which does not support startup on Windows/non-Linux kernels, but that is insignificant since most clouds are Linux-based Servers.

LinuxBoot adoption

In 2011, the Open Compute Project was started by Facebook who open-sourced designs of some of their Servers, built to make its data centers more efficient. LinuxBoot has been tested on a few Open Compute Hardware listed as under:

  • Winterfell
  • Leopard
  • Tioga Pass

More OCP hardware are described here in brief. The OCP Foundation runs a dedicated project on firmware through Open System Firmware.

Some other devices that support LinuxBoot are:

Last month end, Equus Compute Solutions announced the release of its WHITEBOX OPEN™ M2660 and M2760 Servers, as a part of their custom, cost-optimized Open-Hardware Servers and storage platforms. Both of them support LinuxBoot to customize the Server BIOS for flexibility, improved security, and create a blazingly fast booting experience.

What do you think of LinuxBoot?

LinuxBoot is quite well documented on GitHub. Do you like the features that set it apart from UEFI? Would you prefer using LinuxBoot rather than UEFI for starting up Servers, owing to the former’s open-ended development and future? Let us know in the comments below.


About Avimanyu Bandyopadhyay

Avimanyu is a Doctoral Researcher on GPU-based Bioinformatics and a big-time Linux fan. He strongly believes in the significance of Linux and FOSS in Scientific Research. Deep Learning with GPUs is his new excitement! He is a very passionate video gamer (his other side) and loves playing games on Linux, Windows and PS4 while wishing that all Windows/Xbox One/PS4 exclusive games get support on Linux some day! Both his research and PC gaming are powered by his own home-built computer. He is also a former Ubisoft Star Player (2016) and mostly goes by the tag “avimanyu786” on web indexes.

Source

Download Kodachi Linux 4.2

Kodachi Linux is an open source and free distribution of Linux based on the award winning Debian GNU/Linux operating system and built around the modern GNOME desktop environment. It is an anonymous, secure and anti forensic OS.

Distributed as a 64-bit Live DVD

This custom Debian-based operating system can be downloaded from its official homepage or via Softpedia (see download link above) as a single Live DVD ISO image that has been engineered to support only 64-bit (x86_64) hardware platforms.

In order to use it, users must burn the ISO image onto a blank DVD disc using any CD/DVD burning software, or write it on a USB flash drive of 4G or higher capacity in order to boot it from the BIOS of a computer.

Boot options

The boot menu is quite complex and will allow the user to run the live environment with default boot options, with the nosmp and noapic options, with the smp and noapic options, with splash screen, or in failsafe mode.

In addition, you can drop to a shell prompt, perform a system memory diagnostic test, as well as to boot an existing operating system that is installed on the first disk drive.

Slick desktop environment powered by GNOME 3

Kodachi Linux’s desktop environment is pretty slick, powered by GNOME 3, as it uses no panels, but only a dock (application launcher) located on the bottom edge of the screen, as well as a bunch of system monitoring widgets.

From the dock you can start, stop or restart the VPN (Virtual Private Network) service incorporated into the distribution, as well as to connect to a Tor network that is more appropriate to your current location.

Bottom line

Using GNOME (with GNOME Shell) as its default desktop environment, Kodachi Linux provides a secure, anonymous and anti-forensic operating system that features a VPN connection, a Tor connection, and a DNScrypt service.

Linux Kodachi Linux distribution Operating system Kodachi VPN Security Linux

Source

Download lighttpd Linux 1.4.51

lighttpd is an open source, totally free, secure, fast, compliant, and very flexible Web (HTTP) server software implemented in C and specifically engineered and optimized for high-performance GNU/Linux environments.

It’s a command-line program that comes with an advanced set of features, including FastCGI (load balanced), CGI (Common Gateway Interface), Auth, Output-Compression, URL-Rewriting, SSL (Secure Sockets Layer), etc.

It’s optimized for a large number of parallel connections

lighttpd is the perfect solution for Linux servers, where high performance AJAX applications are a must, because of its event-driven architecture, which has been optimized to support a large number of parallel connections (keep-alive).

Compared to other popular Web servers, such as Apache or Nginx, lighttpd has a small memory footprint, which means that it can be deployed on computers with old and semi-old hardware components, as well as an effective management of the CPU load.

Getting started with lighttpd

To install and use lighttpd on your GNU/Linux system, you have two options. First, open your favorite package manager and search for lighttpd in the main software repositories of your distribution, and install the package.

If lighttpd is not available in your Linux system’s repos, then you will have to download the latest version from Softpedia, where it’s distributed as a source tarball (tar archive), save the file on your computer, unpack its contents, open a terminal emulator and navigate to the location of the extracted archive file with the ‘cd’ command.

Then, you will be able to compile the software by executing the ‘make’ command in the terminal emulator, followed by the ‘make install’ command as root or with sudo to install it system wide and make it available to all users.

Command-line options

The program comes with a few command-line options, which can be viewed at a glance by running the ‘lighttpd –help’ command in a terminal. These include the ability to specify a configuration file and the location of the modules, test the config file, as well as to force the daemon to run in foreground.

Web server Internet server HTTP server Web Server HTTP High-performance

Source

Red Hat Enterprise Linux Identify Management Integration with Active Directory – Red Hat Enterprise Linux Blog

Identity Management in Red Hat Enterprise Linux (IdM) supports two different integration options with Active Directory: synchronization and trust.

I recently got a question about comparison of the two. I was surprised to find that I haven’t yet covered this topic in my blog. So let us close this gap!

The customer was interested in comparison of the two. Here is the question he asked:

To integrate IdM with AD 2016 I want to use winsync rather than trusts.

  • We would like to be able to manage the SUDO, SELinux, SSH key and other options that are not in AD.
  • I understand the advantages and disadvantages of each of the configurations and it seems to me that the synchronization is the best option to get the maximum of functionalities of IdM
  • But I would like to know the reason why Red Hat does not suggest the synchronisation.

Red Hat documentation states:

“In some integration scenarios, the user synchronization may be the only available option, but in general, use of the synchronization approach is discouraged in favor of the cross-realm trust-based integration.”

Is there any special reason why Red Hat recommends trusts (although more complected) vs. winsync?

Thank you for asking!

We in fact do not recommend synchronization for several reasons that I will lay down below but we also acknowledge some cases when synchronization might be the only option. So let us dive into the details…

When you have sync you really have two accounts: one in AD and one in IdM. These would be two different users. In this case you need to keep the passwords in sync too. Keeping password in sync requires putting a password intercepting plugin – passsync on every AD domain controller because it is never known which domain controller will be used for the password change operation. After you deploy the plugin to the domain controllers you need to reset the password for every account so that the plugin can intercept the password and store it in the IdM account. So in fact there is a lot of complexity that is related to synchronization. Let us add that this solution would work only for a single domain. If you have more than one domain in a forest or even several forests you can’t use sync. The synchronization also is done against one AD domain controller so if the connecting is down the synchronization is not going to work and there is no failover.

Another issue to keep in mind is that with synchronization you have two different places where the user authentication happens. For compliance purpose all your audit tools need to be pointed to yet another environment and they would have to collect and merge logs from IdM and AD. It is usually doable but yet another complexity to keep in mind. Another aspect is the account related policies, when you have two different accounts you need to make sure that policies are the same and not diverge.

Synchronization only works for user accounts not groups. Groups structure needs to be created on the IdM side.

Benefits of Trust

With trust there are no duplicate accounts. Users always authenticate against AD. All the audit trails are there in the single place. Since there is only one account for a user all the settings that apply to the account (password length, strength, expiration, etc.) are always consistent with the company wide policy and you do not need to check and enforce them in more than one place. This makes it easier to pass audits.

Trusts are established on the environment to environment level so there is really no single point of failure.

Trust allows users in all AD domains to access IdM managed environment, and since IdM can establish trusts with multiple AD forests if needed you really can cover all forests in your infrastructure.

With the trust setup POSIX attributes can be either managed in AD via schema extensions, if they are already there, dynamically created from AD SIDs on the fly by IdM and SSSD or set on the IdM side as explicit overrides. This capability also allows setting different POSIX attributes for different sets of clients. This is usually needed in the complicated environments where UID and GID namespace has duplicates due to NIS history or merges.

AD groups are transparently exposed by IdM to the clients without the need to recreate them. IdM groups can be created on top or in addition to AD groups.

The information above can be summarized in the following table:

So the promise of the trust setup is to provide a more flexible, reliable and feature rich solution. But this is the promise. This is why I put an asterisk in the table. The reality is more complex. In practice there are challenges with the trust setup too. It turns out the trust setup assumes a well configured and well behaved AD environment. In multiple deployments Red Hat consultants uncovered misconfiguration of AD, DNS, firewalls and other elements of the infrastructure that made deployments more painful than we would like them to be. Despite of the challenges some of which are covered in the article Discovery and Affinity published last year and some of which will be covered in my talk at Red Hat Summit in May most of the current deployments see a way to resolve the deficiencies of the existing infrastructure and get to a stable and reliable environment.

So synchronization might be attractive in the case of the small environment but even in such environment setting up a trust would not be a big complication.

The only case where I would call synchronization out is two factor authentication (2FA) using one time password (OTP) tokens. Customers usually want to have some subset of users to be able to use OTP tokens to login into Linux systems. Since AD does not support 2FA natively some other system needs to assign a token to AD user. It can be a 3rd party solution if customer has it or it can be IdM. In this case to provide centralized OTP based authentication for the Linux systems managed by IdM the accounts that would use OTP would need to be created in IdM. This can be done in different ways: by syncing them from AD using winsync, by syncing them from AD using ipa migrate-ds command, by a script that will load user data from some other source using IdM CLI or LDAP operation, just manually. Once the user is created a password and token can be assigned to him in IdM or the account can be configured to proxy authentication to an existing 2FA solution via RADIUS. IdM allows to enforce 2FA for selected set of systems and services. How to do it, please, read the Red Hat documentation about authentication indicators. This is the best approach. It allows for a general population of users to access systems with their AD password while a selected set of special users will be required to use 2FA on a specific subset of hosts. The only limitation is that this approach will work on Red Hat Enterprise Linux 7 systems. Older systems have limitations with OTP support.

If all the users need to have OTP tokens to log into the Linux systems then trust does not make sense and syncing accounts might be a more attractive option.

Thank you for reading! Comments and suggestions are welcome!

Source

Linux Now Dominates Azure – Slashdot

Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

Linux

Linux Now Dominates Azure (zdnet.com)

Posted
by

msmash

on Thursday September 27, 2018 @04:10PM

from the gaining-traction dept.

An anonymous reader shares a report:

Three years ago, Mark Russinovich, CTO of Azure, Microsoft’s cloud program, said, “One in four [Azure] instances are Linux.” Then, in 2017, it was 40 percent Azure virtual machines (VM) were Linux. Today, Scott Guthrie, Microsoft’s executive vice president of the cloud and enterprise group, said in an interview, “Slightly over half of Azure VMs are Linux. That’s right. Microsoft’s prize cloud, Linux, not Windows Server, is now the most popular operating system. Windows Server isn’t going to be making a come back. Every month, Linux goes up,” Guthrie said. And it’s not just Azure users who are turning to Linux.

“Native Azure services are often running on Linux,” Guthrie added. “Microsoft is building more of these services. For example, Azure’s Software Defined Network (SDN) is based on Linux.” It’s not just on Azure that Microsoft is embracing Linux. “Look at our simultaneous release of SQL Server on Linux. All of our projects now run on Linux,” Guthrie said.

 

Take everything in stride. Trample anyone who gets in your way.

Working…

Source

Charly’s Column – grepcidr » Linux Magazine

Often it is the very simple tools that, when used appropriately, lead to the greatest success. This time, sys admin columnist Charly employs an IP address filter to count the devices in his home and trip up spammers to boot.

Although Linux has many grep variants, you can always find a new one. I only discovered grepcidr [1] a few months ago. As the name suggests, the tool filters input by IP addresses and networks. It works equally well with IPv4 and IPv6. To show grepcidr’s capabilities, I will use it to compile a list of all IPv4 addresses on my home network. I got this from the Syslog on the firewall, which is also the DHCP server:

cd /var/log
grepcidr 10.0.0.0/24 syslog|grep DHCPACK|tail -n 1500|cut -f9 -d” “|sort|uniq > 1stlist

The 1stlist file now contains 46 IP addresses:

[…]

Use Express-Checkout link below to read the full article (PDF).

Source

WP2Social Auto Publish Powered By : XYZScripts.com