How To Set Up A Headless X Server On Redhat Linux

Hey there,

Today we're going to throw out another Linux tip somewhat related to networking. Or, more correctly, we're going to throw another quick tip out there ;) Today we're going to look at setting up a headless X Server. It's not quite as difficult, or as scary, as it sounds. Running a headless X Server is kind of like Night Of The Living Dead (the original; although the remake was kind of fun) except without all the zombies and with exported displays instead of excoriated remains (best I could do in the almost-rhyming department on that one ;)

If you stick to the following steps (Tested on RedHat Enterprise Linux Update 4) and adjust slightly if your distro is either completely different, your system architecture varies or your RedHat release is just a version or so off, you should be up and running in no time.

1. Make sure that you install all of the following rpm's on the machine on which you want to run the headless X Server (ignore errors that state you already have any of the packages installed. If you run into dependency conflicts, run rpm with the --nodeps option. If you need to update any of the files, run rpm with the --update option. You may need to install these one by one, but you might get lucky and just be able to run rpm -ivh in a loop and have them all install the first time. You can also get around dependency issues by installing all of the rpm's on one line - i.e. rpm -ivh rpm1.rpm rpm2.rpm ... rpmN.rpm):

XFree-libs-data-4.3.0-78.EL.i386.rpm
XFree-xfs-4.3.0-78.EL.i386.rpm
XFree-libs-4.3.0-78.EL.i386.rpm
XFree86-xauth-4.3.0-35.EL.i386.rpm
XFree86-base-fonts-4.3.0-35.EL.i386.rpm
XFree86-4.3.0-78.EL.i386.rpm
cpp-3.2.3-47.i386.rpm
xinitrc-3.32-1.noarch.rpm
switchdesk-3.98.17.i386.rpm
desktop-file-utils-0.3-10.i386.rpm
XFree86-Xvfb-4.3.0-78.EL.i386.rpm
XFree86-ISO8859-14-100dpi-fonts-4.3.0-97.i386.rpm

2. Start up X's virtual frame buffer server like so:

Xvfb :0 –pn –nolisten tcp –audit 4 –screen 0 800x600x16 & <-- The 800x600 is the screen resolution and the x16 (16 bit)is the color depth. You can change these settings to suit your taste or satisfy any limitations your graphics driver might impose).

NOTE: If you have problems with the X Server going offline when you logoff, try running it with nohup and/or check out our previous post on what to do when nohup hangs up anyway!

And, how about that? I think this is, blessedly, the shortest post I've ever written :) Just pretend there are a couple more paragraphs of "ipsum lorem dolor sit amet" if you find yourself suffering from information underload ;)

Cheers,

, Mike

---

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

---

Mac OS X Shell Scripting Tips For Young And Old

Hey there,

Today's post, as the title suggests, is veering slightly off the beaten path of this blog's general content. But, in keeping with this blog's tradition (and mission) of exploring all things Linux and Unix, it's not too far of a stretch. Hopefully the "Mac" in the title didn't put anyone off (Like, say "Vista," might ;). We're actually going to be looking at their underlying Linux subsystem, which is where we come full circle and it all makes sense. Mac has been fronting their BSD'ish CLI for quite a while now and, if you can use RedHat, Suse, FreeBSD or any of the other myriad varieties of Linux on the market today, OS X's insides should be easy enough for you to figure out. I'm happy, also, that Mac has a Linuxy ( Is that a word? judges? ;) command line interface. The marrying of the fancy windows interface with the bare bones power of Linux should make it easier for the next generation of computer-savvy users to not only enjoy the pretty pictures ( and the funny sounds they make when you click on them with a pointing device), but also (by necessity) possess a rudimentary knowledge of the more powerful underpinnings of all that Window dressing.

Either that or they'll be highly proficient in Fake-DOS v49.x and, if something goes horribly horribly wrong, all the jobs in the tech sector will be for BAT file programmers. I secretly wanted to be one when I started out in this business. If someone threw me enough dough, I'd still do it. Can you imagine getting paid to barely be able to do anything? ;) No offense to Windows fans out there. I, admittedly, use it to run PuTTY, Cygwin, ActiveState Perl and many other useful programs and find it to be an excellent repository for all my log files and script backups... Getting off track; sorry ;)

So, why the Mac? Yesterday, my son ( 5 years old and still kicking - literally ;) started kindergarten. I went to the orientation, because I didn't want to miss out on a milestone in my son's life just so I could catch the early train home, and - to my amazement - they actually had 3 Mac's in the classroom. Computer training (to what degree, I'm unsure) is now part of the curriculum in "kindergarten." This may come as no surprise to a lot of you, but I (being the almost-old fogy that I am) was blown away. I remember kindergarten (well, ...some of it, anyway ;) and I have hazy recollections of dealing with wooden blocks (sometimes with letters and numbers painted on the sides), stuffed animals, monkey bars, crayons, paper and absolutely nothing more "technical" than the interpretation of another person's tone of voice ;) I actually was introduced to computing in the 7th or 8th grade when our school went all out and picked up 3 or 4 TRS-80's from Radio Shack. My first program was a simple if/else clause following a question and "input prompt." My only other masterpiece was an ascii art drawing of a really long diagonal line ;)

Anyway, seeing my kid go off to school - for the first time on his own - in the big yellow bus this morning still haunts me. Not in a bad way. More of an onset of realizations that things are much different now than they were when I was young, that my kids are going to grow up and eventually move out on their own and fiercely demand their independence (even though, for now, they're still sticking like glue ;), that I'll eventually really miss the way things are now and that I waste far too much time "not" paying attention to the most important things in my life. So this little OS X crib-sheet is my way of giving my son something extra (taking time away from my work to give to my son, instead of the other way around which, although considered normal, seems increasingly counter to the development of a healthy relationship with anyone; let alone your own flesh and blood) even when I can't be there with him in person.

Here's to you, Ian. Hopefully, you'll find these tips helpful, easy to follow (hint: don't ask the "teacher" for help with these ;) and you won't use them to bring those Mac's down to whatever their equivalent of a blue-screen is ;) Either way, you'll make me proud :) I love you unconditionally and, if you just want to stop reading at this point, make sure you check out number 10 on the list below before you check out completely :)

NOTE: These links (except the last) all point back to MacOSXHints.com. Although I would love to (I actually do own a G4, with OS X Leopard, that's sitting in storage ;), I can't take credit for them. From what I've found tinkering around with other people's boxes, I could probably write a thing or two, based on recollection, and have it work out correctly, but - for now - I'll leave it to the folks who really know what they're doing with OS X.

Enjoy,

My Lifted List Of Probably Fun Things To Try On An Existing OS X Macintosh (especially a public one ;)

1. Grab all the emails from an address book

2. Show all events in the Calendar's search results

3. Install the FISH shell

4. Move your cursor without moving the Zoomed-In screen

5. Create a Dock bookmark to show all Safari bookmarks

6. Become root using sudo with no password

7. Professor Fizzwizzle and the Molten Mystery - A Fun Puzzle Game

8. Easily add iTunes lyrics to songs via AppleScript

9. Create a visual catalogue of setups and dialogues

10. Send Carly (of iCarly.com) a personal Txt Message <-- He loves that show, although he may hate me by the time he gets around to reading this ;)

, Mike

---

Please note that this blog accepts comments via email only. See our Mission And Policy Statement for further details.

---

Linux and Unix Software Security Basics - Part 3

Howdy,

Continuing along, following our first 3 posts on basic Linux and Unix installation security, even more security measures and user, group and account-based security, we're ready to move on to the next section. Today, we'll be focusing more specifically on locking down and/or removing existing software on your newly-installed system.

Again, I hope this series of posts is able to help out, if just a little bit, and I welcome any suggestions for improvement or expansion to include other OS's :)

See you tomorrow for the wrap-up!

Cheers,

OS Installation Guidelines, Part 3: Existing Software Modifications

1. chmod o-w /var/adm/utmp, /var/adm/wtmp, /var/adm/wtmpx, /var/adm/utmpx - any and/or all on Solaris. On RedHat, these files should be in /var/log. If only one of the four files exists, you're okay.

2. touch /var/adm/loginlog.

3. Add “/usr/lib/acct/accton /var/adm/pacct” to /etc/init.d/syslog, if possible considering the caveats in our previous posts. Again, this is only necessary on Solaris. The psacct RPM for RedHat should take care of this for you.

4. chmod 0 /usr/bin/at or /usr/sbin/at.

5. chmod 0 /usr/bin/finger or /usr/sbin/finger.

6. rm /etc/acct/holidays (If this generates errors, just create a file with one line, indicating what year it is).

7. chmod o-rwx /etc/security. On RedHat, or Solaris with PAM enabled, limit access to /etc/pam.d, as well, if possible.

IMPORTANT NOTE: For points 8 through 15, the file locations are general and your particular release of either Solaris of RedHat may place the binaries elsewhere, but you can generally find them in one of the directories we go through in these steps. It should also be noted that, removing the pkg's or RPM's associated with these files should have, theoretically, removed them already, but I don't believe in things working the way they should (a hazard of my profession ;) Obviously, if you're using lp or CUPS, you won't want to delete any of the print commands. For all of these steps, my recommendation is to always ask if you're unsure. If I started a new job and removed all the NIS commands on a box and then found out that's what they used for their directory service... ouch!

8. In /usr/bin, rm if necessary and possible (ask first, if unsure):

cu
disable
enable
tip
uucp
uuencode
uudecode
uuglist
uulog
uuname
uupick
uustat
uuto
uux
cancel
lp
lpget
lpset
lpstat
rsh <--- The remote shell as opposed to restricted sh!
rdate
rdist
rcp
remsh
rlogin
rup
ruptime
rusers
rwho
yppasswd
nispasswd

9. In /etc, rm if possible (ask first, if unsure):

–r lp
–r uucp

10. In /usr/lib, rm if possible (ask first, if unsure):

accept
–r lp
print
reject
lpadmin
lpfilter
lpforms
lpsched
lpshut
lpmove
lpsystem
lpusers
–r uucp
–r nfs
–r netsvc
rsh

11. In /usr/sbin, rm if possible (ask first, if unsure):

lpmove
lpadmin
lpfilter
lpforms
lpshut
lpsystem
lpusers
accept
reject
sadmind

12. For /usr/sbin/in.*, remove all except the following files, if possible (ask first, if unsure):

in.ftpd
in.telnetd
in.rarpd

13. In /usr/sbin/static (on Solaris only), rm if possible (ask first, if unsure):

rcp

14. In /usr/ucb (also only on Solaris), rm if possible (ask first, if unsure):

lpc
lpq
lpr
lprm
lptest
rcp
rdate
rdist
rlogin
rsh
ruptime
rusage
rwho

15. In /var, rm if possible (ask first, if unsure):

–r lp
–r uucp
–r spool/lp
–r spool/uucp
-r spool/print

16. Comment out all of /etc/rpc except the rpcbind line. NOTE: If using Solstice Disk Suite (Volume Manager) software, do not comment out the following lines (on Solaris 9 leave all lines uncommented near the bottom of the file, beginning with the line for metad and ending with the last line of the file). As always, be sure not to comment out any services you really need:

rpc.metad
metad
rpc.metamhd
metamhd

17. chmod –R 0 , if possible, /usr/openwin/bin/* on Solaris and /usr/X11R6 on RedHat.

18. chmod –R 0 , if possible, /usr/dt/bin/* on Solaris. Additional locations of X-Windows binary files might be in many different locations on RedHat. Check out the man pages for your system and Gnome, KDE, etc, to be sure that you're disabling all access to the GUI.

19. All device files have should have good permissions at first. Do not change them unless it's really necessary or you're looking to do enhanced network security of the order we went over in an older post on securing all network programs at once using extended ACL's. That goes a bit beyond the scope of this series ;)

to be continued...

, Mike