Linux Mint Multiseat with keyboards & mice(Xephyr)

I must state this important fact first:

Xephyr on Ubuntu/Linux Mint does not come compiled with evdev support.

This is important because Linux uses evdev to configure most input devices like keyboards and mice. You will see lots of documentation on configuring inputs with evdev, but none of those methods will work unless you compile Xephyr from scratch and enable evdev yourself.

I downloaded and installed the following executable to make my life easier. I repeat, this method will not work unless you have a modified version of Xephyr with evdev support!

Correct drivers - make sure they are installed!

I used an older Nvidia card so the following commands got me up and running:

sudo apt-get -y xserver-xorg-video-nouveau
#
# Upgrade our system
sudo apt-get -y install ubuntu-drivers-common
sudo apt-get -y install nvidia-current nvidia-settings

If you are unsure what graphics card you have then run the following (the second line is my output; yours will probably be different):

$ lspci | grep VGA
01:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce 210] (rev a2)

Input devices

Determine which devices are which by running the following command (unplug devices to help to narrow down your options). The paths you see are going to help in writing up our configuration file.

$ ls -l /dev/input/by-path/
total 0
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:1:1.0-event-kbd -> ../event3
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:2:1.0-event-mouse -> ../event4
lrwxrwxrwx 1 root root 9 May 27 18:39 pci-0000:00:1d.0-usb-0:2:1.0-mouse -> ../mouse0
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-0-event-kbd -> ../event2
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-1-event-mouse -> ../event5
lrwxrwxrwx 1 root root 9 May 27 18:39 platform-i8042-serio-1-mouse -> ../mouse1

Custom Xephyr script

The custom script (save it to /usr/sbin/Xephyr.sh) will act like the glue in our multi-seat environment. It will attach input devices to our monitors and some other stuff.

#!/bin/bash
# 20060905 - josean - added get_event() function to obtain eventNN from a physical address
# Original version:
# http://en.wikibooks.org/wiki/Multiterminal_with_Xephyr
# http://www.c3sl.ufpr.br/multiterminal/howtos/Xephyr.sh
trap "" usr1
XEPHYR=/usr/local/sbin/Xephyr
get_event()
{
    evento=`grep -A5 $1 /proc/bus/input/devices | grep 'H: Handlers=' | grep --only-matching -e 'event[0-9]*'`
}
args=()
while [ ! -z "$1" ]; do
    if [[ "$1" == "-xauthority" ]]; then
        shift
        if [ ! -z "$1" ]; then
            export XAUTHORITY="$1"
        fi
    elif [[ "$1" == "-display" ]]; then
        shift
        if [ ! -z "$1" ]; then
            export DISPLAY="$1"
        fi
    elif [[ "$1" == "-kbdphys" ]]; then
        shift
        if [ ! -z "$1" ]; then
            get_event $1
            args=("${args[@]}" "-keybd")
            args=("${args[@]}" "evdev,,device=/dev/input/$evento,xkbrules=evdev,xkbmodel=evdev,xkblayout=us")
        fi
    elif [[ "$1" == "-mousephys" ]]; then
        shift
        if [ ! -z "$1" ]; then
            get_event $1
            args=("${args[@]}" "-mouse")
            args=("${args[@]}" "evdev,5,device=/dev/input/$evento")
        fi
    else
        if ! expr match $1 'vt[0-9][0-9]*' >/dev/null; then
            args=("${args[@]}" "$1")
        fi
    fi
    shift
done
echo $XEPHYR "${args[@]}"
exec $XEPHYR "${args[@]}"

Xorg.conf settings

Edit /etc/X11/xorg.conf with something similar to the following. Please change the values to your whatever matches your system!!

############## SETTINGS#############
Section "ServerFlags"   Option  "DontZap"  "true"   Option  "DontVTSwitch" "true"   Option   "DontZoom" "true"   Option   "AllowMouseOpenFail"   "true"   Option   "AllowEmptyInput"   "true"   Option   "AutoAddDevices"   "false"   Option   "AutoEnableDevices"   "false"   Option  "Xinerama" "false"   Option   "NoPM" "true"   Option   "DPM" "false"   Option   "BlankTime" "0"   Option   "StandbyTime" "0"   Option   "SuspendTime" "0"   Option   "OffTime" "0"EndSection
############## INPUTS#############
Section "InputDevice"   Identifier   "Keyboard1"   Driver      "evdev"   Option      "Device" "/dev/input/event2"   Option      "Floating" "true"   Option      "XkbRules" "evdev"   Option       "XkbModel" "evdev"   Option      "XkbLayout" "us"EndSection
Section "InputDevice"   Identifier   "Mouse1"   Driver      "evdev"   Option      "Device" "/dev/input/event5"   Option      "Floating" "true"   Option      "GrabDevice" "on"   Option      "Protocol" "auto"   Option      "Emulate3Buttons" "no"   Option      "ZAxisMapping" "4 5"EndSection
Section "InputDevice"   Identifier   "Keyboard0"   Driver      "evdev"   Option      "Device" "/dev/input/event3"   Option      "Floating" "true"   Option      "XkbRules" "evdev"   Option      "XkbModel" "evdev"   Option      "XkbLayout" "us"EndSection
Section "InputDevice"   Identifier   "Mouse0"   Driver      "evdev"   Option      "Device" "/dev/input/event4"   Option      "Floating" "true"   Option      "GrabDevice" "on"   Option      "Protocol" "auto"   Option      "Emulate3Buttons" "no"   Option      "ZAxisMapping" "4 5"EndSection
########### SEAT 1##########
Section "Device"   Identifier   "Device1"   Driver      "nvidia"   Vendorname   "NVIDIA Corporation"   BoardName   "GeForce 210"   Option      "DPMS" "false"   Option      "UseDisplayDevice" "CRT"   Option      "ProbeAllGpus" "false"   Option      "NoLogo" "true"   Option      "RenderAccel" "true"   Screen      1EndSection
Section "Monitor"   Identifier   "Monitor1"   VendorName   "Toshiba"   ModelName   "Toshiba Matsushita Display Technology Co., Ltd LCD-MONITOR"   Option      "DPMS" "false"EndSection
Section "Screen"   Identifier   "Screen1"   Device      "Device1"   Monitor      "Monitor1"   DefaultDepth   24   Subsection "Display"      Depth   24      Modes   "nvidia-auto-select"   EndSubsection   Option      "DPMS" "false"   Option      "UseDisplayDevice" "CRT"   Option      "ProbeAllGpus" "false"EndSection
############# SEAT 0############
Section "Device"   Identifier   "Device0"   Driver      "nvidia"   VendorName   "NVIDIA Corporation"   BoardName   "GeForce 210"   Option      "DPMS" "false"   Option      "UseDisplayDevice" "DFP"   Option      "ProbeAllGpus" "false"   Option      "NoLogo" "true"   Option      "RenderAccel" "true"   Screen      0EndSection
Section "Monitor"   Identifier   "Monitor0"   VendorName   "Toshiba"   ModelName   "Toshiba Matsushita Display Technology Co., Ltd LCD-MONITOR"   Option      "DPMS" "false"EndSection
Section "Screen"   Identifier   "Screen0"   Device      "Device0"   Monitor      "Monitor0"   DefaultDepth   24   SubSection "Display"      Depth 24      Modes "nvidia-auto-select"   EndSubsection   Option      "DPMS" "false"   Option      "UseDisplayDevice" "DFP"   Option      "ProbeAllGpus" "false"EndSection
############## SERVERS#############
Section "ServerLayout"   Identifier   "multix"   Screen   0 "Screen0" 0 0   Screen   1 "Screen1" 0 0EndSection

MDM configuration

The MDM is what executes everything (if it has been configured properly). Edit /etc/mdm/mdm.conf and change the Server Section to the following:

## Also note, that if you redefine a [server-foo] section, then MDM will# use the definition in this file, not the MDM System Defaults configuration# file.  It is currently not possible to disable a [server-foo] section# defined in the MDM System Defaults configuration file.#
[server-Xephyr0]name=Xephyr0command=/usr/bin/X -ac -br -layout multix -audit 4 -dpmshandled=falseflexible=false
[server-Xephyr1]name=Xephyr1command=/usr/sbin/Xephyr.sh -display :0.0 -xauthority /var/lib/mdm/:0.Xauth -fullscreen -kbdphys usb-0000:00:1d.0-1/input0 -mousephys usb-0000:00:1d.0-2/input0 -verbosity 100 -audit 4 -screen 0 -dpms -retrohandled=trueflexible=false
[server-Xephyr2]name=Xephyr2command=/usr/sbin/Xephyr.sh -display :0.1 -xauthority /var/lib/mdm/:0.Xauth -fullscreen -kbdphys isa0060/serio0/input0 -mousephys isa0060/serio1/input0 -verbosity 100 -audit 4 -screen 1 -dpms -retrohandled=trueflexible=false

Resources

• http://forums.linuxmint.com/viewtopic.php?f=49&t=135076
• http://research.edm.uhasselt.be/~jori/page/index.php?n=Misc.DualSeatX
• http://research.edm.uhasselt.be/~jori/page/index.php?n=Misc.XevdevServer
• http://cambuca.ldhs.cetuc.puc-rio.br/multiuser/
• http://en.wikibooks.org/wiki/Multiseat_Configuration/Xephyr#XKB_configuration

PostgreSQL 9.1 and Ubuntu 12.04

This is just a quick guide on how to get started using PostgreSQL on Ubuntu.

Installing

1. Install the PostgreSQL server using apt:
   

   sudo apt-get install postgresql

2. Install the contrib add-on package. This provides additional tools and features, such as improved logging and administration functions.
   

   sudo apt-get install postgresql-contrib

3. Install the GUI admin interface pgadmin3:

   sudo apt-get install pgadmin3

4.  Edit the file /etc/postgresql/9.1/main/postgresql.conf to allow TCP/IP connections to the server. Just uncomment the following line in the file:
   

   listen_addresses = 'localhost'

5. Start the database
   

   sudo service postgresql start

6.  To automatically start the server run the following command:
   

   sudo update-rc.d postgresql defaults

7. Put a password on the default postgresql user by opening up a connection to the database:
   

   sudo -u postgres psql template1

   And then running the following SQL command:

   ALTER USER postgres WITH PASSWORD 'password';

8. Set up the same password for the system postgres user:
   

   # Delete the existing postgres user password
   sudo passwd -d postgres
   
   # Set the user password
   sudo su postgres -c passwd

    

Interfacing with PostgreSQL

• You can create a database directly from the command line (this assumes that your linux user has a corresponding account to use PostgreSQL):
  

  createdb newdb

• To create a new database with a user that has full rights on that database:

  # Create the user
  sudo -u postgres createuser -D -A -P newuser# Create the database
  sudo -u postgres createdb -O newuser newdb

• The corresponding command to delete a database is:
  

  dropdb olddb

• Accessing the database through the commandline:
  

  psql newdb
  #OR you could use
  sudo -u postgres psql newdb#OR you could use
  psql -h localhost -U postgres -W newdb

  
  NOTE: If the command prompt shows "=#", then you are using an admin account which bypasses normal access controls. This is potentially dangerous. Your average account should be displaying "=>" as part of the prompt.
• In-built psql commands are prefaced with a '\':
  
  • \h displays the help for SQL commands
  • \? displays the help for psql-specific commands
  • \q exits the terminal interface for psql
• Some useful in-built SQL statements:
• SELECT version(); will display the current PostgreSQL version
• SELECT current_date; will display the current date of the system
• SELECT now(); will display the date and time
• SELECT now()::date; will only display the date portion
• SELECT now()::time; will only display the time portion
• count(), sum(), avg(), max(), and min() are special aggregate functions you can perform on fields in your SQL statement.

References:

• How to set up PostgreSQL in Ubuntu by ubuntugeek.com
• The PGAdmin3 main web-page
• The PostgreSQL 9.1 documentation
• Automatically starting services in Debian

Ubuntu 12.04, LAMP and CodeIgniter 2

This guide aims to install and use CodeIgniter on an Ubuntu machine. We will assume you have the default Ubuntu installation.

1. Install Apache 2:

   sudo apt-get install apache2

2. Install MySQL:
   

   sudo apt-get install mysql-server mysql-client

3. Install PHP5 and the necessary libraries:
   

   sudo apt-get install php5-cli php5-mysql libapache2-mod-php5

4. Download the CodeIgniter framework:
   

   wget http://codeigniter.com/download.php -O ~/CodeIgniter.zip

5. Extract the framework to the default Apache2 web directory:
   

   sudo unzip ~/CodeIgniter.zip /var/www/

6. You should now be able to navigate to your extracted folder from your web-browser. Hint: you will need to open firefox to http://localhost/<name-of-folder> which you can get by executing the following command:
   

   ls /var/www

References

• 'Installing the LAMP stack for Apache2' from www.howtoforge.com
•  Another LAMP stack for Ubuntu tutorial from smashingweb.info
• Settin up LAMP and CodeIgniter from caravaggisto.wordpress.com

Securing Ubuntu 12.04

I have been extended my knowledge of Linux System Administration (in particular, securing Linux systems), and as such the first thing I did when I installed Ubuntu 12.04 LTS was to lock it down.

Installing Ubuntu is outside the scope of this blog post, so if you don't have Ubuntu yet I suggest you follow the official documentation.

Networking

We will first deal with locking down our machines network access. By restricting how our machine communicates with others we narrow down the attack vectors available.

1. The first thing we should do is turn on a firewall. Ubuntu comes with ufw pre-installed so we will just use that (I have covered this in a previous blog post).
   

   sudo ufw enable

   Check its status with:
   

   sudo ufw allow ssh

2. Enable any services you will need. For instance a web server will need the HTTP port of 80 open.
   

   sudo ufw allow ssh
   
   # You can specify a port directly
   sudo ufw allow 80
   # You can also specify whether it is TCP or UDP
   sudo ufw allow 80/tcp
   # Finally, you can specify whether it is incoming or outgoing
   sudo ufw allow in 80
   sudo reject out 1337

3. Sysctl allows you to configure the Linux kernel during runtime. We will edit the file /etc/sysctl to harden our network interface; open the file in your favorite editor and make the following changes:

   #IP spoofing/forging protection by turning on the reverse path filter
   net.ipv4.conf.all.rp_filter=1
   net.ipv4.conf.default.rp_filter=1
   
   # Protect against ICMP attacks
   net.ipv4.icmp_echo_ignore_broadcasts=1
   net.ipv4.icmp_ignore_bogus_error_responses=1
   
   # Turn off IPv4 features that are easy to abuse
   net.ipv4.conf.all.accept_source_route=0
   net.ipv6.conf.all.accept_source_route=0
   net.ipv4.conf.default.accept_source_route=0
   net.ipv6.conf.default.accept_source_route=0
   net.ipv4.conf.all.send_redirects=0
   net.ipv4.conf.default.send_redirects=0
   net.ipv4.conf.all.accept_redirects=0
   net.ipv6.conf.all.accept_redirects=0
   net.ipv4.conf.all.secure_redirects=0
   
   # Block SYN attacks
   net.ipv4.tcp_syncookies=1
   net.ipv4.tcp_max_syn_backlog=2048
   net.ipv4.tcp_synack_retries=2
   net.ipv4.tcp_syn_retries=2
   
   # Log Martians
   net.ipv4.conf.all.log_martians=1
   
   # Ignore directed ICMP pings
   net.ipv4.icmp_echo_ignore_all=1
   
   # Don't perform IP forwarding
   net.ipv4.ip_forward=0
   
   #####
   # IPv6
   #####
   
   # Number of router solicitations to send until assume no routers present
   net.ipv6.conf.default.router_solicitations=0
   
   # Do not accept router preferences
   net.ipv6.conf.default.accept_ra_rtr_pref=0
   
   # Do not accept prefix info from router
   net.ipv6.conf.default.accept_ra_pinfo=0
   
   # Do not accept Hop limit settings from router
   net.ipv6.conf.default.accept_ra_defrtr=0

   
   
4. Reload sysctl with your changes:
   

   sudo sysctl -p

5. Secure your TCP Wrapper by editing the /etc/hosts.deny file, ensuring the following line is the only one uncommented:
   

   ALL: ALL

6. Allow your TCP Wrapper services (like SSH) by editing the /etc/hosts.allow file. The basic syntax is:
   

   <service>: <host/network>

7. Prevent IP Spoofing via DNS by editing the file /etc/host.conf and adding the following lines:
   

   order bind,hosts
   nospoof on

8. If you have not already done so, update your system so that there are no security vulnerabilities:
   

   sudo apt-get update
   sudo apt-get upgrade

9. Install nmap, a tool for network discovery and security auditing:
   

   sudo apt-get install nmap

10. Perform a local nmap TCP scan of your machine and ensure that all ports that are open are supposed to be open.
    

    sudo nmap -v -sT localhost

    Perform a SYN scan, which is another way a hacker can probe your system:
    

    sudo nmap -v -sS localhost

    Perform a UDP scan to determine which UDP services are operational:
    

    sudo nmap -v -sU localhost

11. Perform the same NMap tests but on another host. If you followed the above instructions you may want to add -PN to the command so that nmap ignores the fact that your machine does not respond to pings. Note that this scan may take some time...

 

Filesystem

We will now protect our file-system.  

Note: you will get the best security by putting your system directories into their own partition. This will allow you to specify the mount options for each directory. This guide will only cover the default install.

1. Protect your shared memory by editing /etc/fstab as follows:
   

   tmpfs  /dev/shm  tmpfs  defaults,noexec,nosuid  0  0

2. Bind /var/tmp to /tmp so that we limited what applications can do with that system directory. Edit /etc/fstab as follows:
   

   /tmp  /var/tmp  none  rw,noexec,nosuid,nodev,bind  0  0

 

Startup Applications

We will now modify the start-up applications and services that turn on during boot.

1. Display the hidden start-up applications:
   

   sudo sed -i 's/NoDisplay=true/NoDisplay=false/g' /etc/xdg/autostart/*.desktop

2. Press the windows key on your keyboard, type in 'Startup Applications' and launch the program of the same name
3. Disable the following services (Note: These may change depending on your personal situation):
• Backup monitor
• Bluetooth manager
• Chat
• Desktop Sharing
• Gwibber
• Orca Screen Reader
• Personal File Sharing
• Ubuntu One

 

Disable Guest Login

Just edit /etc/lightdm/lightdm.conf and add the following line:

allow-guest=false

 

References:

• 'How to secure Ubuntu 12.04 LTS server' by thefanclub.co.za
• 'Securing a Linux VPS' from wolfpaw.co.uk
• NSA guide to securing RHEL 5
• NSA hardening tips for RHEL 5
• NSA guides to securing other operating systems
• 'Tuning the Linux kernel', a paper by Long Yi and James Connan
• 'Linux Kernel /etc/sysctl.conf Security Hardening' from www.cyberciti.biz
• 'Security auditing with NMAP' by www.techrepublic.com 
• Nmap reference for scanning techniques
• 'Securing an Ubuntu Server' by www.andrewault.net
• Ubuntu 12.04 LTS security by rationally paranoid
• Modify Ubuntu blog

Access an LVM module (Ubuntu 12.04)

A computer died on me and I needed to recover some of the data. I thought it would simply be a case of popping the disk into an external hard-drive case and ripping the data out. Unfortunately, I encountered a little snag involving LVM.

My Ubuntu 12.04 machine could not recognise the LVM partition natively. Basically this meant I had to configure the machine so that I could manipulate the disk; a quick Google search revealed this post from linux-sxs.org.

To make your life easier, here are the steps:

1. Install lvm2, which is the libraries and utilities required to manipulate LVM volumes.
   

   sudo apt-get install lvm2

2. Use the following command to scan for available LVM volume groups and find the one you are looking for (in this example we are going to assume our volume group is VolumeGroup01)
   

   sudo vgscan

3. Activate your volume
   

   sudo vgchange -ay VolumeGroup01

4. Search for the volume that contains the partition you are looking for (we are going to assume that the volume is called LogicalVolume01)
   

   sudo lvs

5. Create a mount point for your volume
   

   sudo mkdir /mnt/destination

6. Mount the volume
   

   sudo mount /dev/VolGroup00/LogVol00 /mnt/fcroot -o ro,user

 

References:

• 'Accessing a Fedora Logical Volume from Ubuntu' from linux-sxs.org
• Relevant question that was posted in linuxquestions.org
• LVM reference from tlpd.org
• Beginners guide to LVM from howtoforge.com

Troubleshooting USB mobile internet in Ubuntu

Most mobile broadband USB sticks come with two partitions; one with the installer and the other with the actual connection device. When you plug in the USB, the operating system will first mount the installer partition (which usually contains the installers for Windows and Mac). The installer will insert code that will automatically switch the USB to skip the installer and mount the connection device directly. Unfortunately most manufacturers don't support Linux, so new USB devices won't work straight away.

This guide will provide some tips to get your troublesome USB broadband stick working. This guide will focus on Ubuntu (11.04 in particular), however most of this guide should be applicable to other distro's as well (as long as it has usb_modeswitch installed). The particular device I will be configuring is the Huawei Technologies K3771 USB device given by Vodafone Australia.

First we will go through some troubleshooting tips for those new to the game, and by step 3 we will begin applying our fix.

1. Plug-in your device, open up a terminal (or command prompt) and type in the following command:
   
   

   nm-tool

   
   This will open up a list of internet devices; eth stands for ethernet and is usually your wired/wireless connections. We are looking for entries with wwan, GSM, 3G or Mobile Broadband in this list. If your device is detected here but does not work then it is a software issue that is outside the scope of this guide.
    
2. Now we need to see if your device is even detected by the system. Unplug your device, wait a second and in the terminal type in:
   
   

   lsusb > ~/usb1.txt

   
   When the command finishes plug the device back in, wait ALOT of seconds (wait until LEDs start flashing) and type in:
   
   

   lsusb > ~/usb2.txt

   
   Now to see if anything changed. Type in the command:
   
   

   diff ~/usb1.txt ~/usb2.txt

   
   You should now see something like:
   
   

   6a7> Bus 002 Device 008: ID 12d1:14c4 Huawei Technologies Co., Ltd

   
   If nothing pops up on the terminal, then either you jumped the gun too early with the second lsusb OR your device simply isn't playing nice. This is outside the scope of this guide and I suggest you hit up the guys at libusb or kernel developers to track this problem down. But before you do just cross your fingers and try:
   
   

   sudo /usr/sbin/update-usbids

   
   This will update the id list of USB devices your system will support; hopefully it will be in there!!
    
3. So now the hard part starts. The line we got from lsusb gives us some useful information about the device. The ID of a device can be split into two parts; the first part (12d1) is the vendor code, and the second part (14c4) is the product code. Unfortunately, in this case the product code points to the installer partition of the device. We need to manually tell the system to switch over to the mobile broadband part (this is what the installer does automatically for Windows and Mac). To do this we run the following command:
   
   

   sudo gedit /lib/udev/rules.d/40-usb_modeswitch.rules

   
   This will bring up a text editor with a list of all the USB devices that the system will automatically switch. We now need to add our device to this list. Either add to the end of the file or do a search to find similar devices and add:
   
   

   # This is just a comment. Replace this text with information of your device
   ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14c4", RUN+="usb_modeswitch '%b/%k'"

   
   Replace the vendor and product id's with whatever lsusb produced. It should look like:
   
   

   # Vodafone (Huawei) K3771
   ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14c4", RUN+="usb_modeswitch '%b/%k'"

   
   Ok, so now we are telling the system to switch our device.... switch to what? Remember, no matter how fancy they get computers are always very, very stupid machines. The mobile broadband device has it's own product id that we must link to the installer id. This is where it gets tricky; you need to figure out what this id is and at this stage I have no other advice other than to Google and pray. Luckily for me I know that my device id is 12d1:14ca. Now we need to create a custom usb_modeswitch rule.....
    
4. Navigate to the directory /usr/share/usb_modeswitch/ by running the following command in a terminal:
   
   

   cd /usr/share/usb_modeswitch/

   
   If you perform an ls you will see that this directory contains a file called configPack.tar.gz. This file contains all the switching rules; we need to edit it to add our device. First back up the file through:
   
   

   sudo cp configPack.tar.gz configPack-ORIGINAL.tar.gz

   
   Now we will extract the scripts through running:
   
   

   sudo mkdir configPack/; sudo tar xzf configPack.tar.gz -C configPack/

   
   Run the command to open a text file for our new rule (replace the 12d1:14c4 part with the id of your device):
   
   

   sudo gedit configPack/12d1\:14c4

   
   This will open a completely blank document. Add the following text (remember to customise for your particular device!):
   
   

   ##########################################
   # Vodafone (Huawei) K3771 (again, this is just a comment)
   #
   # Our settings discovered by lsusb (the '0x' part just
   # tells the system how to interpret the number
   DefaultVendor= 0x12d1
   DefaultProduct=0x14c4
   #
   # Our target product that we will switch to
   TargetVendor= 0x12d1
   TargetProduct= 0x14ca
   #
   # Some misc values that I don't really understand and am
   # not game enough to change...
   CheckSuccess=20
   MessageContent="55534243123456780000000000000011062000000100000000000000000000"

   
   Now we need to repack the rules and clean up our mess:
   
   

   cd configPack/; sudo tar -czf ../configPack.tar.gz *; cd ../; sudo rm -rf configPack/

   
   You can check the contents of the file by running the following command:
   
   

   sudo file-roller configPack.tar.gz

    
5. Now restart your machine and, fingers crossed, the system will now correctly detect your device!

References

Some useful links for those who want to trace something more specific:

• usb_modeswitch usage details; straight from the source!
• The actual github commit for usb_modeswitch that will fix my specific Huawei K3771 problem
• Alot of this guide is based on the work done by AlexFish; goes into more depth than mine!
• The post that gave me the original tip-off; pdc pointed me in the right direction!

UFW: Uncomplicated Fire Wall

Back when I used Red Hat Linux and Fedora I had to use the iptables tool to create a secure box over the Internet. It's been a few years since, and now I gladly find that the CLI has a new simplified firewall tool: ufw. This tool takes away the onerous task of creating the long chain rules required for iptables and compresses them into easy to decipher statements.

Here is a little script I used for my machine to lock away the whole internet except for the companies web-application:


#!/bin/bash
#
# Accept all outgoing packets from this machine by default
sudo ufw default allow outgoing
#
# Deny all incoming packets to this machine by default
sudo ufw default deny incoming
#
# Only accept outgoing connections to port 80 (www) to the following IP addresses
sudo ufw allow out to 1.2.3.4 port 80
sudo ufw allow out to 10.0.0.1 port 80
#
# Other reject all other connections to port 80
sudo ufw reject out 80
#
# Turns on the firewall and adds it to the boot-up script
sudo ufw enable