The Tech Active Series. The Hacker's Manual 2015: Take Your Linux Skills to The Next Level

146 Pages·2016·32.28 MB·English

TAKE YOUR LINUX SKILLS
TO THE NEXT LEVEL
146
PAGES OF THE
BEST LINUX
TUTORIALS
FULLY
REVISED &
UPDATED
FOR 2014
80+ HACKS TO MAKE YOU A LINUX POWER USER
From security tricks to sysadmin secrets and
hardware hacks – learn how to do it all!
NETWORKING HACKING PRIVACY
100% SAFE, 100% LEGAL
Get the UK’s best-selling
Linux magazine
OUT
NOW!
DELIVERED DIRECT TO YOUR DOOR
Order online at www.myfavouritemagazines.co.uk
or find us in your nearest supermarket, newsagent or bookstore!
Welcome
Welcome!
EDITORIAL
Editor Neil Mohr
Bookazine editor Chris Thornett
Managing art editor Paul Blachford
MANAGERIAL & MARKETING
Editor in chief, Computing Brands Graham Barlow
Group art director Steve Gotobed
Group editor in chief Paul Newman
Head of content & marketing
for Technology Nick Merritt
Content & marketing director Nial Ferguson
DISTRIBUTION & CIRCULATION
Production co-ordinator Roberta Lealand
Trade marketing manager Stuart Brown
Distributed by Seymour Distribution Ltd,
2 East Poultry Avenue, London EC1A 9PT
Tel [phone]
Overseas distribution by Future Publishing Ltd
Tel [phone]
LICENSING
Head of international licensing Regina Erak
[e-mail] Tel [phone]
Copyright No part of this publication may be reproduced without
written permission from our publisher. We assume all letters sent –
by email, fax or post – are for publication unless otherwise stated, H
acker! Lock up the children and hide the silver!
and reserve the right to edit contributions. All contributions to Linux
Format are submitted and accepted on the basis of non-exclusive
worldwide licence to publish or license others to do so unless Hacking has a bad name in the mainstream press.
otherwise agreed in advance in writing. Linux Format recognises all
copyrights in this issue. Where possible, we have acknowledged the Given that the papers tend to use the term in relation
copyright holder. Contact us if we haven’t credited your copyright
and we will always correct any oversight. We cannot be held to criminal activities, you’d be forgiven for thinking
responsible for mistakes or misprints.
that all hacking was pure dagnasty evil and, of late, preoccupied
All DVD demos and reader submissions are supplied to us on the
assumption they can be incorporated into a future covermounted with uncovering ill-advised nude photos of celebrities.
DVD, unless stated to the contrary.
Hacking has much nobler roots, however. It’s generally held as
Disclaimer All tips in this magazine are used at your own risk. We
accept no liability for any loss of data or damage to your computer,
peripherals or software through the use of any tips or advice. originating at MIT, in the 1960s, as a term for the crème de la
Printed in the UK by William Gibbons crème of programmers. They were the master alchemists of

© Future Publishing Ltd 2014 languages such as Fortran, and known for pushing them beyond
Future Publishing Ltd, 30 Monmouth Street, their limitations – what they achieved often felt like magic.
Bath BA1 2BW Tel [phone]
Email [e-mail] Hacking is really about making the most of your systems,
turning the conventional into the unconventional, and subverting
LINUX is a trademark of Linus Torvalds,
GNU/Linux is abbreviated to Linux tools to tasks no one thought possible. And like the original
throughout for brevity. All other
trademarks are the property of their hackers it’s about a hunger for knowledge, which is why we’ve laid
respective owners.
out the best tutorials and the most useful features from the last
Future Publishing Ltd is part of Future plc.
Future is an award-winning international media group
year of Linux Format as a feast for the hungry hacker to devour.
and leading digital business. We reach more than 49
million international consumers a month and create You’ll learn things like how to stay anonymous online; how to
world-class content and advertising solutions for
passionate consumers online, on tablet & smartphone secure your phone or run a Linux distro on it; how to take control
and in print. Future plc is a public company quoted on the
London Stock Exchange (symbol: FUTR). of our data and set up a personal cloud and even learn a few web
www.futureplc.com
cracks that the ‘Dark side’ may try to fling in your direction.
Chairman Peter Allen
Chief executive Zillah Byng-Maddick We think this year’s Hacker Manual is the best one yet. Tuck in
Chief finance director Richard Hayley
Tel [phone] www.futureplc.com and enjoy the hack!
3
Contents
Privacy
Protect your privacy 8
..............................................................................................
Set up a secure VPS 16
...........................................................................................
Open source alternatives to Google services 20
.....................
Secure Android 30
.......................................................................................................
Encrypt your hard disk 34
...................................................................................
Hardware
Hack the Raspberry Pi 38
....................................................................................
Make an Arduino-powered controller for Kerbal 46
.............
Install Linux on your new Chromebook 52
.....................................
Build a multi-Pi cluster 56
....................................................................................
Free your Android phone 60
.............................................................................
4
Contents
Web
Hack the web 66
.............................................................................................................
PHP: Custom website scraping 74
............................................................
OwnCloud 7: Own your data 78
....................................................................
Django: Build a custom CMS 82
..................................................................
Python: Make a Twitter client 86
.................................................................
Networking
Samba: Dancing with Windows 92
...........................................................
Networking: The basics 98
.................................................................................
Wireshark: Analyse traffic 102
.......................................................................
Networking: Build a router 106
......................................................................
Deluge: Set up a torrent server 110
..........................................................
Docker: Build containers 114
............................................................................
Zabbix: Monitor your network 118
.............................................................
Hacks
Speed up Linux 124
....................................................................................................
Linux kernel: Build your own 132
.................................................................
Python: Code a Gimp plugin 136
................................................................
Terminal: Time-savers 144
................................................................................
5
Privacy
6
Privacy
Privacy
G
ot nothing to hide? Then you’ve got nothing
to worry about. Were we really that naïve?
If you hadn’t already woken up to the mass
surveillance being undertaken by government
agencies on anyone and everyone, Edward
Snowden’s revelations were a painful wake-up call.
Keeping your activities under wraps has become a
concern for us all. Even if you’re not doing anything
you shouldn’t, you’ll want to stop prying eyes
feeding you ads, seeing your private files, and more.
Here’s how to do all that and more.
Protect your privacy 8
..............................................................................................
Set up a secure VPS 16
...........................................................................................
Open source alternatives to Google services 20
.....................
Secure Android 30
.......................................................................................................
Encrypt your hard disk 34
...................................................................................
7
Privacy
G YO
N U
I R
T
C P
E R
I
T
V
O
A
R C
P Y
(cid:44)
(cid:44)
s
S l
i
S a
T
L

t
T a
C
o
r o
t
p
y
O
r
T C
R
G
TrueCrypt G P
Are you fed up of being tracked online? We show you how
to take control of your online privacy.
You are being watched by three- Our individual liberty is under attack by rewritten to make it easier to get access to
letter organisations and billion- technology. You can’t turn a blind eye towards your personal data.
dollar corporations. They can read the monitoring just because you have ‘nothing We laud any such efforts if they help keep
every email you send, every to hide’ either, because former NSA contractor, us safe, but we are disgusted when our
comment you post and every photo you Edward Snowden’s whistleblowing has private data makes its way to corporations
share. They know what articles you read, revealed clandestine operations and pervasive who fill their coffers by selling it.
what videos you watch, and where you like databases that log all our online activities, In this feature we’ll look at some of the
to shop. These people know best tools available to protect
you don’t like being monitored your privacy online. We’ll show
“These people know you don’t
but the truth is they don’t care. you the kind of information
Your online activities are like being monitored but the you are leaking inadvertently
tracked in the name of national and how that information is
security and under the garb of truth is they don’t care.” being misused. You’ll also
targeted advertising. learn how to control your
This Orwellian loss of visibility and become a private
privacy has its roots in the unbridled exchange irrespective of whether you are a bona fide citizen on the web. There’s nothing sneaky or
of electronic information. There’s no criminal or a law-abiding subject. illegal in what we’ll show you. This feature is
omnipresent ‘Big Brother’ as such. Instead Privacy isn’t just about hiding things either: all about being aware of the dangers of losing
what we have are hundreds of ‘Little Brothers’ it’s about controlling what details of our lives your privacy and protecting yourself from
that follow us around as we use and traverse we keep to ourselves and what we share with illegal surveillance, identity thieves and
the internet. the world, and laws around the world are being governments (oppressive ones or not).
8
Privacy
Protecting your information and your privacy go Make sure
you check
hand in hand and it all starts with limiting the
Firefox’s
information you give out to web companies. They
Privacy
don’t always have your best interest at heart and some are Preferences
infamous for selling or trading personal information. to block third-
The most basic way of being identified is through your IP party cookies.
address. From your IP address, a website can determine your
rough geographical location, such as your city or area. This is
fairly common technique exploited by web advertisements,
which try to grab your attention by mentioning your location.
IP addresses are dynamic, which makes them unsuitable
for tracking a user over time. But by combining your IP
address with other tracking information, such as HTTP
referrers and cookies and you can be easily monitored.
The job of the HTTP referrer header is to load the website
you clicked on and inform it where you came from. It’s also
sent when loading content on a web page. So if a web page
includes an advertisement, your browser tells the advertiser It tracks information, such as a user’s posting history, IP
what page you’re viewing. Some unscrupulous marketers address, and web browser version, across websites that use
embed invisible images in emails that take advantage of the Disqus, even if the user is logged out. They also put the
HTTP referrer to track you when you open emails. comments on public profile pages for each user.
While some online services offer an option to opt-out,
Tough cookie
many are opt-in only. You can opt out of the major tracking
Almost every website uses cookies to store information about networks by visiting the Network Advertising Initiative’s Opt-
the visitors and how they use the website. These are stored Out page (www.networkadvertising.org/choices).
on a user’s computer but the user has little control over what This online service will check your system for tracking cookies
information is stored within the cookie. from participating ad networks and enables you to opt-out
Cookies have plenty of legitimate uses, such as for storing from them.
settings and preferences on a website, eg online email Additionally, all browsers offer options to zap cookies. Did you
services use cookies to remember your login details. You can also use the browser’s Private Browsing mode to know?
However, these cookies also allow the website to track you ensure that the cookies are flushed when you close the
as you move around on their website. This might sound pretty window. This also prevents websites from learning where The NSA has been
collecting a lot of
harmless, but major websites such as Google aren’t just you’ve previously been. The mode is especially handy when
metadata about
confined to a single domain. Google, as you may be aware, using a public computer. internet traffic.
controls the largest advertising network on the internet. But there is one nasty little cookie that’s more invasive Things like who’s
As you move from website to website, in addition to than a standard cookie. The Local Shared object (LSO) or talking to who, when
displaying advertisements, the advertising system will also Flash cookie, as its commonly known, is particularly and for how long.
Metadata is a lot
track the websites you visit. The advertising system then uses dangerous because it isn’t stored with the other cookies and
easier to store and
this data to display advertisements that are similar to the is designed to evade the commonly used privacy controls. analyse, and can be
sites that you’ve visited. To restrict how Flash stores LSOs, visit Flash’s online extremely personal
Google is not alone in doing this, according to a survey by settings manager (http://bit.ly/1m33E9X) and deselect to the individual.
www.digitaltrends.com, there at least 125 different the Allow Third-Party Flash Content To Store Data On Your
companies or company products being used to track your Computer option. Note: If you go down this route of
online activity through the top 100 sites. Many of these are restricting the use of cookies then it will impact your web
simple advertising networks, but others are particularly browsing experience, but the trade-off in regards to privacy is
nefarious. Take for example the Disqus comment widget. well worth it.
Switch to SSL

One of the first steps you should take by a certifying authority’ such as VeriSign cheap to procure, but do not provide
when navigating the Internet badlands is and Thwate. All SSL encrypted websites authentication or validation of the
to encrypt your network traffic by will have a padlock icon in the browser business behind the website. Clicking on
switching to the Secure Sockets Layer window and you can click on the icon to the padlock icon will not display any
(SSL) protocol. SSL uses certificates to get more details about the certificate. information other than encryption
create a secure, encrypted link between However, there is one subtle danger to information. Other secure certificates will
the visitor’s web browser and the web be aware of. There are several types of supply data about the organisation
server that hosts the page. SSL certificates and some phishing sites behind the website.
The encrypted connection ensures have purchased legitimate certificates in Every insecure network protocol has
that any data that’s transferred from the order to trick people into believing they an equivalent secure one. For web
browser to the web server, such as your are trustworthy. browsing, there’s HTTPS, for transferring
credit card details, remains private during Keep an eye out for the Domain files there’s SFTP and SCP, and for
transmission. The certificate is provided Validated certificates. These are pretty remote logins there’s SSH.
9
Privacy
Cover your tracks
Here’s how you can browse the web without leaving any trace.
Even if you take precautions to minimise your
Did you
footprint on the internet and only access encrypted
know?
websites, you are still exposed. You are still
According to Edward broadcasting your IP address to anyone who’s watching
Snowden, monitoring including the websites you visit.
network activities is Additionally, since not all websites use SSL you’ll end up
more efficient than
transmitting login credentials and other details over
attacking systems,
so the NSA has unencrypted channels. These can be intercepted easily by
programs that packet analysis tools such as Wireshark, (see p102) especially
intercept consumer over non-secure networks like public Wi-Fi hotspot. There are
hardware, such as
a number of solutions to help cover your tracks and disguise
laptops and routers,
your digital footprint, bypass censorship and keep you
and turns them into
surveillance devices invisible when online. This is especially advantageous as
which can be turned some websites and services block access to visitors from
on remotely. specific countries. JonDo’s interface includes the Anonym-O-Meter which
gauges the level of anonymity offered by the active service.
The most common is the Virtual Private Network or VPN.
It’s primary purpose is to extend a private network over a
public network to allow remote workers to connect and use law enforcement with the right paperwork. There is a
services on the workplace network. The same features also wonderful writeup by TorrentFreak.com on which VPN
make it an ideal tool to create a secure connection to the services take anonymity seriously (http://bit.ly/1dvMqay).
Internet and guarantee that all of the data you send and When you’re looking for a VPN look for a service that
receive is encrypted and secured from prying eyes. supports OpenVPN and uses SSL/TLS for key exchange.
There are dozens of VPN services, and there’s a big list on Privacy conscious users will also want to pick a service
operated from outside their home country. A service that has
“Many VPN services keep logs servers in multiple locations is always a better choice.
and say that they will co-operate Embrace the onion
Another way to bypass censorship and maintain anonymity is
with law enforcement.”
to use a proxy server tool. The most well-known of these is
the Tor network. Tor, an acronym for The Onion Router, is a
the internet censorship wiki http://en.cship.org/wiki/VPN. software that creates a network to allow people to browse the
When choosing a VPN, make sure it doesn’t only run at the web anonymously.
application level. There are VPNs that only run inside a web It creates a network of relay nodes across the Internet.
browser, for instance. Their drawback is that they only protect When you visit a website using Tor, the data to and from your
what’s in the browser. If you were to run another browser computer is bounced around these nodes before ending up
alongside Firefox, or a separate email program, the data from at the website, which masks your origins from the website.
these other programs would not be protected. You can use Tor to visit websites that block visitors based
Some VPNs may also restrict certain services, such as on their geographic location. The easiest way to use Tor is via
peer-to-peer file-sharing services like BitTorrent. Also many the Tor Browser Bundle to connect to the Tor network. (See
VPN services keep logs and say that they will co-operate with Setup the Tor Browser Bundle, p11.)
One downside to Tor is that websites load slower as the
Privacy plugins network data goes through so many relay nodes in the
middle. Further, some ISPs, particularly in China, actively
search and block Tor relays, making it difficult for some users
BetterPrivacy plugin prompts you to Disconnect plugin Prevents tracking to connect. Also note that Tor only encrypts traffic from your
delete all local shared objects (LSOs) by over 2,000 common trackers.
computer to the exit node, which prevents your ISP from
every time you close the browser. Priveazy Lockdown plugin When
monitoring you. But since the traffic at the exit node is
HTTPS Everywhere plugin Forces you visit a website supported by the
unencrypted, anyone that’s running the exit node can see
the web browser to use HTTPS with all plugin, it will suggest some of the tasks
your internet traffic. There are unconfirmed reports that
sites that support it. you should complete to ensure your
The Web of Trust plugin Identifies privacy is protected. When you click on many exit nodes are run by government agencies.
dangerous websites from search results. a task, Priveazy will automatically load One way to negate the vulnerability at Tor’s exit node is to
DoNotTrackMe plugin Stops third the relevant settings page, along with only use secure protocols (HTTPS, SSH etc) when using the
parties, ad agencies, and search engines detailed instructions on how to change Tor network. You can also use the Java Anonymous Proxy
from tracking the webpages you visit. that specific setting. called JonDo, which uses interconnected proxy servers to
conceal your IP address. JonDo is similar to Tor, however the
10