Category Archives: Linux General

Notes which apply to all flavours of Linux systems

Manually Adjusting Fan Speed on Lenovo L420

Platform: Debian Jessie (Testing), Linux 3.16

I have found that under considerable load such as video processing, the Lenovo L420 Thinkpad laptop gets very hot and instantly powers off.

As far as I can make out, the automatic fan speed doesn’t work as well as it should. Therefore when running under high load, it might be wise to force the fan to its highest setting. I should try and make a better fix sometime.

To manually adjust the fan speed, the thinkpad_acpi kernel module must be loaded with an extra option. Create the file /etc/modprobe.d/thinkpad_acpi.conf containing just one line:
options thinkpad_acpi fan_control=1
reboot.

The fan speed can be set to maximum with the command run as root:
echo “level 7” > /proc/acpi/ibm/fan
and then reset to auto:
echo “level auto” > /proc/acpi/ibm/fan

Read the current status by using:
cat /proc/acpi/ibm/fan
Note, the reported fan speed appears to be incorrect.

Quick and dirty introduction to GnuPG (GPG) on Linux

It’s a few simple steps to create GPG encryption keys and use these for signing and encrypting files and emails.

GPG Key Creation

  1. Create a new pair of public/private cryptographic keys:
    user@yourhost:~$ gpg --gen-key
    …
    follow the prompts use the defaults if unsure, Enter your name and email address.
  2. List keys
    tom@tomsalmon:~$ gpg --list-keys

    pub 1024D/C96ACE6A 2010-03-30 [expires: 2015-03-29]
    uid      Tom Salmon <tom@tomsalmon.com>
    sub 4096g/2BEF6E4A 2010-03-30 [expires: 2015-03-29]

  3. Upload the Public Key to one of the Key servers
    gpg --keyserver hkp://keys.gnupg.net --send-keys C96ACE6A
    The key ID is retrieved using the above list keys function.
  4. Export the Public Key in ASCII
    tom@tomsalmon:~$ gpg --export -a C96ACE6A
    Sample output
  5. Import a Public Key in ASCII format
    gpg --import < key.asc gpg --edit-key C96ACE6A … run the commands: 'trust', 'sign', 'save', 'quit'

GPG with Email

  • Mutt comes with built-in GPG support and integrates perfectly with the system's GPG setup

File Encryption

  • Encrypting
    gpg -r your@emailaddress.org -e intheclear.txt
    Creates a new file intheclear.txt.gpg which is encrypted with your public key. Only your private key can decrypt this file.
  • Decrypting
    gpg [-d] secret.txt.gpg
    (requires that you enter your passphrase) creates the unencrypted file 'secret.txt', if the '-d' flag is used the unencrypted data is displayed on the command line

You may encrypt files for other people if you have imported their Public Key. Only their Private Key will be able to decrypt the file.

Key Signing

  1. Search the Keyserver:
    gpg --keyserver hkp://keys.gnupg.net --search-keys tom@tomsalmon.com
    … select the most recent key that matches, find the Key ID
    To make life easier, add the following line to your .bashrc file:
    alias gpgsearch='gpg --keyserver hkp://keys.gnupg.net --search-keys'
    restart your shell, and run 'gpgsearch user@example.com'
  2. Verify the Key fingerprint with its owner (manually, in person)
    gpg --fingerprint KEY_ID
  3. Set the trust level and sign the key
    gpg --edit-key KEY_ID
    … run the commands: 'trust', 'sign', 'save', 'quit'
  4. Upload the signed key to the keyserver
    gpg --keyserver hkp://keys.gnupg.net --send-keys KEY_ID

Checking signatures on new keys

  1. Search the keyserver and download the matching key
  2. Check to see if the key has been signed by any trusted keys
    gpg --check-sigs KEY_ID
  3. Based on this result, you can determine if the key belongs to the user

Implementing IPv6 Privacy Extensions (RFC4941)

IPv6 auto configuration on Linux will normally assign the same address every time when connecting to a specific network. This address would normally be formed from the network prefix and local interface MAC address.

When using IPv4 your identity is slightly masqued by NAT. Although your single public IP address may be tracked, it is hard to track individual devices that exist on the local network. This is not the case with IPv6 where there is no NAT. Every device has a visible unique public IP address that rarely changes.

RFC4941 (obsoletes 3041) defines privacy extensions to IPv6 which will randomly assign an additional Global IPv6 address to the interface. This additional random address will have the same network prefix and be used for outgoing internet connections.

To enable the privacy extensions under Linux (using Debian Wheezy):
echo 2 > /proc/sys/net/ipv6/conf/${ifname}/use_tempaddr
replace ${ifname} with the name of your interface, eg wlan0

Possible values for this setting:
(0=off, 1=assign, 2=prefer)

Now at least you will be anonymized amongst the other nodes of your local network.

Backport of Aircrack-ng for Debian Wheezy

I have created a backport of aircrack-ng based on the version in Jessie/Testing. This may be installed with the command:
dpkg -i aircrack-ng_1.1-6~bpo70+1_amd64.deb
(remove the package with command: dpkg -r aircrack-ng)
download here

This package is now available in Debian wheezy-backports.

Back in March 2012 I built the latest svn version from source, available here.
I have included the necessary scripts and binary files in the ‘bin/’ directory. Copy these to somewhere like: /usr/local/sbin/

ipt_ROUTE Netfilter module ported to Linux 2.6.31

The ipt_ROUTE module became depreciated in an earlier version of Linux 2.6 – however I needed it so ported it to Linux Kernel version 2.6.31.

Disclaimer: wherever possible iproute2 should be used to achieve the desired effect.

The sources include the Kernel module and extensions to iptables.

This module and iptables extension create a new target which may be used on the mangle table.
Target usage: -j ROUTE <option>
options:
--oif ifname - Route packet through `ifname' network interface
--iif ifname - Change packet's incoming interface to `ifname'
--gw ip - Route packet via this gateway `ip'
--continue - Route packet and continue traversing the rules. (Not valid with --iif or --tee)
--tee - Duplicate packet and route the duplicate, continue traversing the original packet. (Not valid with --iif or --continue)

I have tested the ported module on the PREROUTING and INPUT chains of the mangle table.

I use this module to route packets that have a destination IP address which matches a local IP address, out of an ethernet interface (using ‘--oif‘ option). These packets would normally be directed to the local system.