Chrome Headless mode

Chrome has a headless mode which is generally for testing (and scripting). You can invoke it as follows:

/usr/bin/google-chrome --headless --disable-gpu --print-to-pdf http://localhost:8080/

Inkscape and glue: Creating CSS sprites

I use a combination of Inkscape (to create raw SVG files and then export them to PNG images) and glue (to stich them all up and create the CSS file) to help me create CSS sprite icons for various websites. I also used iconmonstr as a starting point for some icons.

This is the BASH script I use to convert raw SVG files into PNG files and then into the sprite and CSS combination:

#!/bin/bash
mkdir -p ./img/48x48/ ./img/32x32/ ./img/16x16/
for i in ./svg/*.svg; do
    inkscape -z -w 48 -h 48 -e ./img/48x48/`basename $i .svg`.png $i
    inkscape -z -w 32 -h 32 -e ./img/32x32/`basename $i .svg`.png $i
    inkscape -z -w 16 -h 16 -e ./img/16x16/`basename $i .svg`.png $i
done
glue ./img/ --img=./img/ --css=./css/ --html --project

Coursera Notes: Stanford 'Start-up Engineering' (Lectures 1-4)

These are just some of my notes from Coursera's 'Start-up Engineering' course, taught by Balaji Srinivasan from Stanford.

Lecture 1:

• A start-up is typically a company designed to grow rapidly and scale to global markets. The idea is to take ownership of the market before competitors move in.
• The modern Start-up company is generally focused around the internet and other emerging technologies, but history is filled with start-up stories. The automobile, aviation, oil, and pharmaceutical industries all began with similar start-up journeys. Some of the biggest businesses we know had very humble beginnings.
• The modern start-up industry began in 1989-1992. This was due to a combination of factors such as the widespread adoption of the internet, the fall of the USSR and the repeal of the NSF AUP in the USA.
• The USSR (and other communist regimes) heavily regulated the use of technology, and you could be jailed for any unauthorized use. The fall of the USSR allowed the adoption of technology by the mainstream population, vastly increasing the amount of people interacting on-line. It also forced India to introduce policies that deregulated technology use and made China focus on market reforms. These factors helped to create the global free market.
• The National Science Federation (NSF) in the USA had banned e-commerce because of fears of malware, spam and pornography. Eventually the US congress repealed the Accepted Use Policy (AUP), and this allowed people to start trading goods and services on-line.
• The features of a modern start-up company include:

1. Operational Scalability: This refers to the ability to conduct transactions from anywhere in the world without requiring a physical presence. This means you can rapidly expand into global markets without increasing operational overhead.
2. Market size: The internet means a company now has access to a customer from anywhere in the world. This exponentially increases your market size (as long as border and geographical restrictions are solved).
3. Generality: Software is a flexible and malleable tool with almost limitless potential. Software skills are also portable.
4. Low capital barriers: Hardware costs are relative cheap, so sophisticated equipment can be bought with little capital overhead. Developers can also create their own software tools to suit the job at hand.
5. Low regulation barriers: It is currently very hard to regulate the internet, but this should not be taken for granted. The firewall in China and the USA's NSA spying program are examples of attempts by governments to control, regulate and restrict the internet.
6. Open source: The internet is built on open source technologies such as DNS, HTTP, HTML, IP, DHCP and other protocols and specifications. The free exchange of ideas and common technologies means the rapid emergence of new and useful tools for the entrepreneur.
7. The long trail: The global scale of the potential market means that a start-up can target extremely specific customers and market niches like never before.
8. Failure tolerance: Penalty for failure is lower than other industries (such as automobiles and aviation).
9. Able to build a hybrid business: Can supply an API to interact with third-parties or the physical world. Automation through device drivers and actuators.

• The current trend for start-ups is towards mobility and decentralization (or at least reducing the penalty for location and nationality).
• Start-up engineering is focused on shipping a workable product. Iterative development is key; ship an initial product with reduced functionality to bring in some early funding to fuel further improvements in the next version.
• Primary task of a start-up engineer is the integration of diverse technologies. They need to keep up with the latest developments, evaluate the usefulness of technology and quickly snap together the pieces.
• Engineers need versatility, especially with Design, Marketing and Sales.
• Mobile HTML5 and JS/JSON is the future of web applications. They allow for responsive mobile design (with a desktop UI as an aftereffect), which allows the use of the application on as many devices as possible.

Lecture 3 & 4:

• Virtual Machines allows us to take a single physical computer and make it seem like multiple independent computers. Virtualisation significantly reduces the infrastructure overhead.
• Linux has server-side license loophole. This allows a developer to modify open source code without distributing those changes to the public. This means you can modify code to create a service without releasing those code changes, as long as you are not distributing the changes for profit.
• The Cloud Computer is a computer whose precise physical location is immaterial to the application. There are three approaches:

1. IAAS: (Infrastructure As A Service) Direct access to hardware
2. PAAS: (Platform As A Service) API access to the hardware.
3. SAAS: (Software As A Service) API and GUI to the application, but no control over the hardware.

• $PATH is the order of directories that Linux will use to search for a command. The first matching command found is assumed to be the desired command.
• 'which' is a useful command to determine which command Linux will find first. This can help when you have multiple versions of a command installed
• bash is a command-line shell implementation
• A shell script begins with a sha-bang (#!) followed by the path to the command that the shell will use to interpret/execute the script.
• ssh allows you to securely connect to a remote machine and run commands
• scp allows you to connect and copy files to a remote machine
• You can configure SSH so that you don't have to write out the connection details every time. Add the following to the file ~/.ssh/config and invoke with ssh <name>
• Host <name>
• HostName <hostname>
• User <username>
• Identityfile <the path to the file>
• STDIN is the input stream, STDOUT is the output stream, and STDERROR is the error stream
• Some useful linux commands:
• cd - change directory
• alias - set a command alias to save typing
• rm - remove a file
• mv - move a file
• mkdir - create a directory
• pwd - print the current working directory
• env - list all environment variables
• ls - list files in current directory
• ln - create symbolic links
• rsync - synchronise a local file with a remote file
• wget - download a file (unlike rsync this is only for publicly available files)
• curl - Only for single URLs, and can support more protocols than wget
• ping - test network availability
• less - used to view large files by paging it. CTRL+N down, CTRL+P up, Q quit
• cat - File viewer, but does not have pagination features of less
• head - view first few lines of a file
• tail - view last few lines of a file
• cut - Pull out columns from a file
• paste - paste data into columns
• nl - print our the line number
• sort - sort lines in a file
• uniq - determine unique elements in a file
• wc - line, word and character count
• split - split large files
• man - single page manual files for commands
• info - for some applications this will provide more detail than what man provides
• uname - lists system information
• hostname - name of machine
• whoami - name of current user
• ps - list current running processes
• kill - kill a process
• top - list processes based on criteria
• sudo - act as root user for one or more commands
• su - become root user
• tar - archival utility
• gzip - compression utility
• find - non-indexed file search
• locate - indexed file search. Requires updatedb command to be operational
• df - determine disk space
• du - determine file's disk usage
• grep is a text and file parser that uses regular expressions. Very powerful.
• sed is a string substitution command. Used to do a find and replace.
• awk is a useful scripting language for tab-delimited text.
• A list of useful bash shortcuts:
• CTRL+K : Kill everything from cursor up
• CTRL+C : Abort command
• CTRL+L : Clear the screen
• CTRL+D : Exit the command prompt
• Backticks ` allows you to use results from commands as part of a new command
• Ampersand & allows you to run a command in the background
• xargs allows you to build command line arguments, and can spawn parallel processes.
• tee allows you output to both a file and the display
• time is useful for bench-marking commands
• screen is a manager for remote tabs. This allows you to save a context that allows you to resume your work if you lose connection temporarily.

Setting up a CentOS 6.2 web server: Software and package integrity and installation

This is a follow on post from my guide to installing CentOS 6.2. We will go through some of the steps required to secure your server and get it ready for production use.

These steps will outline how to check what is installed on your system and whether your system has been compromised.

1.  Log in as root and grab a current software list (check out my previous blog post on this topic).
   
#Using RPM
rpm -qa
#Using yum
yum list installed
    
2. Check to ensure that yum is forced to check the gpg signature when installing packages. This is default behaviour in CentOS 6.2, but for the sake of completeness I have included this step. Check /etc/yum.conf and all the files in /etc/yum.repos.d/ for the following line:
   
gpgcheck=1
    
3. AIDE is an intrusion dectection environment that checks the integrity of installed packages and files. It can report on the changes to your system. Install it using yum:
   
yum install aide
    
4. It should be your priority to read and understand /etc/aide.conf and tailor it to your system. While the defaults should be adequate for most installations, you should nevertheless know what AIDE does.
    
5. Generate the initial AIDE database (by default it will be stored as /var/lib/aide/aide.db.new.gz):
   
   /usr/sbin/aide --init
    
6. Back up the database (in this example we are copying it to root's home directory):
   
   cp /var/lib/aide/aide.db.new.gz ~/
    
7. Install the AIDE database:
   
   mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
    
8. Run a manual check:
   
   /usr/sbin/aide --check
    
9. Stop the yum update daemon (we are going to write our own). If you followed the above guide the service won't even be installed, but again I am including it here for completeness.
   
   chkconfig yum-updatesd off
    
10. Edit /etc/crontab by adding the following line (this will do a daily check of the system with AIDE):
    
    50 4 * * * root /usr/sbin/aide --check
     
11. Add a file called update.cron in /etc/cron.weekly/ and add in the following (NOTE!: cron.weekly is run by the anacron service. Keep this in mind when you are disabling services later on in this guide).
    
    #!/bin/sh
#
# Update yum, then the rest of the system
/usr/bin/yum -R 120 -e 0 -d 0 -y update yum
/usr/bin/yum -R 10 -e -0 -d 0 -y update
#
# Save a list of software currently installed on the system
/bin/rpm -qa > /root/`/bin/hostname -s`_software_`/bin/date +%Y%m%d`.txt
#
# OPTIONAL: Fix all the prelinks (otherwise you may get alot of prelink messages)
/usr/sbin/prelink --all
#
# Update the AIDE database
/usr/sbin/aide --update
#
# Make a back-up of the new database
/bin/cp /var/lib/aide/aide.db.gz /root/aide.db.`/bin/date +%Y%m%d`.gz
     
12. Make /etc/cron.weekly/update.cron executable:
    
    chmod 755 /etc/cron.weekly/update.cron
     

References

• Howto Forge's guide: 'The Perfect Server - CentOS 6.2 x86_64 with Apache2'
• Howto Forge's guide: 'Installing Apache2 with PHP5 and MySQL support on CentOS 6.2'
• Red Hat Linux 5 Hardening Tips - National Security Agency
• Guide to the secure configuration of Red Hat Linux 5 - National Security Agency
• CentOS wiki on hardening the OS

VSFTPD and CentOS

This basic configuration allows only users with an account and a home directory to log in and use the resource. Although it must be said that if you have SSH up and running then you should use SFTP (which is pretty much FTP over SSH), as it provides a little bit more security.

1. Install vsftpd:
   
   sudo yum install vsftpd


2. Configure our firewall to allow incoming connections:
   
   sudo /sbin/iptables -I RH-Firewall-1-INPUT 4 -p tcp --dport 21 -m state --state NEW -j ACCEPT
sudo /sbin/iptables -I RH-Firewall-1-INPUT 5 -p tcp --dport 20 -m state --state NEW -j ACCEPT


3. Check to see if SELinux is up and running (an output of 0 means that it is):
   
   /usr/sbin/selinuxenabled; echo $?


4. If SELinux is up and running you need to disable it for the ftp protocol, or apply a policy to allow FTP to make changes to your local directory:
   
   sudo /usr/sbin/setsebool -P ftpd_disable_trans 1


5. Open up the vsftpd configuration file for editing:
   
   sudo vim /etc/vsftpd/vsftpd.conf


6. Make the following changes:
   
   anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES


7. Start VSFTPD:
   
   sudo /sbin/service vsftpd start


8. Turn on FTP on reboot:
   
   sudo /sbin/chkconfig --levels 235 vsftpd on

References:

• Fedora Forum post about how to set up SELinux policies for FTP
• nixCraft guide to setting up FTP on RedHat/CentOS
• IPTables guides are available from here and here
• Red Hat documentation manuals (good reference for ANYTHING)