Wireless connection from the command line

If ever you find yourself stuck with a *Nix box that won't boot into any kind of comfy graphical interface, and you need to connect to a wireless internet connection so that you can look stuff up and maybe solve your problem, here's a helpful tip:

There is a wireless networking utility very much like ifconfig called iwconfig. When you have a chance (and preferably before you really need it) check out the man page for it. Here are some quick and dirty instructions, in case you are desperate right now.

To find out what wireless networks are available to you, type
iwconfig wlan0 scan (see comments)
iwlist wlan0 scan

To attach to an open, non-encrypted network, type
iwconfig wlan0 essid netname
where netname is the essid of the network you want to connect to.

If you only have encrypted networks available, you might be in a bit more trouble. I haven't actually managed to get that working at all yet, though theoretically, it should work something like this:
iwconfig wlan0 key s:password
iwconfig wlan0 essid netname
where password is your password and netname is the essid of the network you want. The s: means that the password is in string format. If you know the hex version of your password, then instead of saying s:password you'd just type in the hex of the password like this:
iwconfig wlan0 key 0123-4567-89

Good luck getting your GUI fixed!

Finding a host I couldn't see

Last week I finally broke down and asked IT if they would mind if I switched over to a Linux desktop for my daily development work. Functioning in Windows was driving me absolutely bonkers. He wasn't so sure about it at first. He suggested that I run Windows and then have Linux running in virtualization. That just seemed like a waste of resources to me, though. So, I suggested that I set the computer up for dual boot, and if things went badly I could always go back to Windows.

The IT guy's concern was that, while I might be able to do my programming in Linux, I might not have access to all the company shares, the exchange server for mail, and all that other Windows-based stuff sitting on the company network. And he was right to be concerned. In the past, all those things have been a major pain in the backside to fix.

The good news is that Samba, the tool that lets you hook up Linux or Unix machines to a Windows network, has come a very long way, and the whole thing turned out to be pathetically easy. Not only that, but Evolution for mail kicks the proverbial butt, and I was able to get mail, tasks, contacts, and calendar from exchange working perfectly with the Exchange server with just a few button clicks and no sweat at all.

But, then I need to look something up on the company wiki, and that's when I hit trouble. Firefox turned my http://companywiki/ url into http://www.companywiki.com. Woops! I tried a couple of times before it sunk in to my thick skull that the problem was that my computer wasn't recognizing the internal domain names. Clearly I need another Domain Name Server in my list, but the problem is that I don't want to go back to that IT guy just now. He may just tell me it's all Linux's fault, and that I have to switch back. I don't want that. So, I have a work around.

I checked in Windows what the ip address for companywiki is supposed to be, and then, back in Linux, I edited my hosts file to point the name companywiki to that address. Poof! I have normal access to the wiki using the domain name now. Easy peasy.

There are other uses for the hosts file, too. For instance, if I have server settings in a Web application that I'm working on, I can tell my hosts file that those server names are really my computer. My computer will look where the hosts file tells it to look before asking the Domain Name Server for information, so I can test the application without having to change those server name variables in the code.

Linux is not the only system with a hosts file that can let you find servers by a certain name, either. You can find a list of where to find the hosts file on different operating systems at Wikipedia.

Locking Down Root

Having an active root user is generally not a good thing. If the machine is used by lots of people and several individuals do superuser tasks under the root user, you have no way to track who did what in the event that someone decides to get evil. And of course, hackers like to get root access, because it lets the do anything that they want. You don't want that, so let's lock root up.

First, make sure that you have super user abilities when root is locked. If you don't already have sudo access, use root now to add yourself into the /etc/sudoers file. (I'll write an article about that soon. In the meantime, use man sudo to learn more.)

Now, lock root. Get out of root, if you are in it already, and as a user with sudoers privileges type
sudo passwd -l root
Check your work with
sudo passwd -S root
You should see something like
$ root L 09/11/2007 0 99999 7 -1

The option -S gives you the status of a user. It gives you the user name, then the status (L = locked, NP = no password, P = password), the date of the last change, and then the minimum age, maximum age, warning period and inactivity period for the password.*


Root is now locked. You can't log into root directly any more, and will have to run superuser tasks through sudo. There is still a cheater way around it, though. You can
sudo su
and then you will be root again. (I'll explain how to fix that in the sudo article.)



* Minimum age for a password says that you can only change the password ever so many days. Maximum age says that you have to change your password every so many days. Warning period is how long before maximum age is reached that the system should start warning you that you have to change your password. Inactivity period is how long after a password is expired that the login should be completely locked out. If you don't change your password before maximum age is reached, then the system will generally let you log in and immediately change your password before moving on. Once you've hit the days in inactivity period, though, you don't get a chance. It just won't let you in at all at that point. All of these ages are expressed as a number of days.

Creating A New *Nix User

The easiest way to create a new user on the command line is:
sudo useradd george
sudo passwd george

But that's not always enough. Let's say, for instance that you want people to change their password the first time that they log in and then again every three weeks. Let's set georgette up like that:
sudo useradd georgette -c "Georgette Userina"
sudo passwd georgette
(give her a throw-away password)
sudo passwd -e -x 21 georgette


Here's what we just did:
sudo = "superuser do" (do this as if you are root)
add user georgette with the comment (-c) "Georgette Userina" (-c is usually used for the user's full name)
give georgette a password she can use the first time she logs in
expire georgette's password immediately (so she has to change it when she next logs in) and then expire (-x) her password every 21 days.

Need a short term user? Maybe you have a contractor working with your company for a short time or a friend that's hanging out at your house for the next two weeks and needs access to your Ubuntu desktop while he's there. Here's how to do it:
sudo useradd sammi -c "Sammi Shortimer" -e 2008-03-10


Here we use the -e option with useradd to expire the account after March 10, 2008.

If you do most of your new user adds with the same special options, you can set those things as default in the file /etc/login.defs

Give a user a new group

So, you have someone who just got a new position within your organization and now s/he needs additional permissions on the server. It makes more sense to give people permissions based on their position rather than on their user. That way, you can give and take exactly the right group of permissions for the position based on a well thought out policy rather than a spur of the moment, "I think they need x to get things done today," sort of thing.

A perfect example of this is sudoers privileges. You can give specific root-type abilities to users or groups of users in the /etc/sudoers file. Another example of this is when you make a certain folder owned by a specific group and have people write to it as *themselves.thatGroup.

You want to use usermod to add a new group to a user, but the problem is that when you use -G to add additional groups, it takes the list that you give it and erases whatever was on the list before. The solution is to add -a for append like this:

usermod -G groupname -a username

Now your user won't lose any of the old groups s/he had, but s/he will get the new one that they need.

*NB: There are a couple of notations for username and groupname for ownership on *Nix. One is username.groupname. The other is username:groupname They are often interchangeable on a single OS or distro, but sometimes you can only use one or the other for commands like chown.

Cups Printing from the Command Line

Sometimes you just need to print something without going into an application. Here's how...

First, find out what printers are available
lpstat -a

That will tell you what printers are available to you. Then you can print to one of them
lpr -P [printer_name] [file_name]

Need to find out what jobs are running right now?
lpstat -o
(that's the letter oh, not the number zero)

Need to cancel a job?
lprm [job_id]

For more information and all sorts of other CUPS goodness, check http://www.cups.org

Fixing Some Little Network Annoyances

To set your IP address for your Ethernet connection and the gateway address for the world outside your local network, run these as root or sudo them...

ifconfig eth0 [ip address]
route add default gw [gateway ip address]


Secure Copy

scp is like cp for copying files only it can securely copy files from one server to another using the ssh protocol. This is a good thing. The bad thing is that I always forget how to write the line, because I'm a ditz that way.

Here's an example of how to copy a file from a local computer to a location on a remote server:
scp index.php user@web2.websites.com:/mysite.com/httpdocs/index.php

Here's an example of how to copy a whole directory from a local computer to a remote server:
scp -r httpdocs/. user@web2.websites.com:/mysite.com/httpdocs/.

Notice the slash dot thing at the end of the directory name. That's so that everything under that directory gets moved. If you don't use the slash dot after the directory name you will end up with the directory inside the other directory (like /mysite.com/httpdocs/httpodocs/...) which is clearly not what I want.

The -r stands for recursive.

Of course, you can find more details about other options that go with scp by typing
man scp
at a linux-ish or unix-ish command prompt.