I’ve been reading through the launchpad bugs for Xen and thought that I could use them to illustrate some tips and tricks for using Xen in Ubuntu or Debian. I ran into some problems with Xen today on a system after having been upgraded from Ubuntu 7.10 to Ubuntu 8.04 and from Xen 3.1 to Xen 3.2. This should help as a checklist when diagnosing various Xen problems.

I recently tried the reniced package only to find that it isn’t a daemon at all as is indicated by its name ending in “d”. It’s too bad because if it was it could be useful. It could always be called frequently from cron in order to have a system that continuously adjusts the niceness of running processes. The config file is pretty nice as it’s just a list of a nice level pair with a regular expression to match against the list of processes. This can be useful to change the niceness of processes launched without any other mechanism for controlling the nice level. I found that running firefox and kvm with a niceness of 10 can keep either from making the rest of the system too unresponsive.

Over time, especially with Ubuntu and it’s 6 month release cycle, a system can contain a number of packages that are no longer needed but still present on the system in some way. I have a number of techniques I use to locate these packages and remove them and I thought I would share them.

I often find myself asking the same questions about package dependencies. It can sometimes be confusing to remember which command answers which question due to the similarity of the commands. These are the common questions:

Here are some of the applications with available packages for Debian and Ubuntu:

• AIDE
• FCheck
• Integrit
• Samhain
• Stealth
• Tripwire

I’m leaning toward trying Stealth because I like the design. Lots of folks seem to like FCheck for its simplicity.

I was interested in trying to determine how many packages were installed from universe on the servers I manage. Luckily I came across a helpful discussion titled list installed Universe packages which suggested this command:

• comm -12 <(apt-cache dumpavail | grep-dctrl -nsPackage -FSection universe/ |sort) <(dpkg --get-selections | awk '$2 == "install" { print $1 }' |sort)

To get the command to work I had to install the package dctrl-tools (for the grep-dctrl command):

• sudo apt-get install dctrl-tools

After that it worked pretty well and can easily be adapted to search for other sections. It turns out that my servers use many packages from universe but none from restricted or multiverse, which is nice.

There are a number of things to look forward to in MySQL 5.1 such as the support for data partitioning, new replication methods, and logging to the database. One feature that shows promise is a plugin API to extend the database. This is only as good as the plugins developed and their ease of integration. That’s why I was pleased to see that the Debian MySQL 5.1 package will contain the plugins for PBXT and SphinxSE which are both excellent storage engine projects.

I was noticing that kfreebsd-amd64 and kfreebsd-i386 are now architectures in the Debian unstable repositories. I’ve always been interested in running a GNU operating system with an alternative kernel. Of course, so far nothing has been stable enough to warrant leaving Linux. And besides, Linux does have the best mascot of all the kernels. The Linux kernel is also largely responsible for the rapid growth of the free software movement. Still, the idea is appealing and here’s where things stand with other kernels.

I was working on a server running MySQL and found that the debian-sys-maint account not longer existed which caused errors when upgrading the mysql packages. It was relatively simple to fix by getting the password from the /etc/mysql/debian.cnf file and running the following command:

• GRANT ALL PRIVILEGES ON *.* TO 'debian-sys-maint'@'localhost' IDENTIFIED BY 'password';

In this case the word password is replaced by the value in the /etc/mysql/debian.cnf file.

New kernel releases have been released by both the Ubuntu and Debian teams. Both address CVE-2008-0600 which could allow an attacker to escalate their privileges. The Debian vserver kernels have also been updated to address CVE-2008-0163 which allows users in one vserver to access information in another. For Ubuntu this comes just a week after the last Linux kernel security update.

• DSA-1494-1 linux-2.6 — missing access checks
• USN-577-1: Linux kernel vulnerability
• USN-574-1: Linux kernel vulnerabilities
• Patching CVE-2008-0600, Local Root Exploit

And I had just finished burning some copies of 4.0r1 (onto rewritable discs so they'll be reused). Still I'm happy to have a new version with updated and more secure software included. It also means that people should update their Debian Etch systems as I have been doing the last couple of days. It's also worth reading the Deabin 4.0r2 Release Announcement for an overview of the changes and the Debian 4.0 (Etch) changelog for specific details.

I’m happy to see that my favorite password manager has finally been packaged for Debian and Ubuntu. I’ve never found a graphical password manager that I liked as much as Password Gorilla. Plus, of all the password saving programs, it has the best name.

• http://packages.debian.org/password-gorilla
• http://packages.ubuntu.com/password-gorilla

Time to update those kernels. Here are the details:

• Debian: DSA-1436-1 linux-2.6 — several vulnerabilities
• Ubuntu: USN-558-1: Linux kernel vulnerabilities