Entries by Junya Keller

1a) Kompilierumgebung erstellen

#!/bin/sh

# file: /data/OE-install

# http://www.angstrom-distribution.org/building-angstrom

# http://developer.berlios.de/projects/bitbake/

# http://oe.linuxtogo.org/snapshots/

mkdir -p /data/OE/build

cd /data/OE

wget http://download.berlios.de/bitbake/bitbake-1.8.10.tar.gz

wget http://wiki.openembedded.net/snapshots/OE.mtn.bz2

tar zxf /data/OE/bitbake-1.8.10.tar.gz 

bunzip2 /data/OE/OE.mtn.bz2 

mtn --db=/data/OE/OE.mtn pull monotone.openembedded.org org.openembedded.{stable,dev}

mtn --db=/data/OE/OE.mtn checkout --branch=org.openembedded.stable

1b) Kompilierumgebung aktualisieren

#!/bin/sh

# file: /data/OE-update

# update oe metadata

cd /data/OE/org.openembedded.stable

mtn pull monotone.openembedded.org org.openembedded.{stable,dev}

mtn update

2) Environment vorbereiten

#!/bin/sh

# file: /data/OE-setupenv

 BBPATH=/data/OE/:/data/OE/build/:/data/OE/org.openembedded.stable/

 PKGDIR=/data/OE/build/ 

 DL_DIR=/data/OE/downloads

 echo Setting up dev env for ??ngstr??m

 if [ -z ${ORG_PATH} ]

 then

  ORG_PATH=${PATH}

   export ORG_PATH

   fi

  if [ -z ${ORG_LD_LIBRARY_PATH} ]

  then

   ORG_LD_LIBRARY_PATH=${LD_LIBRARY_PATH}

    export ORG_LD_LIBRARY_PATH

        fi

        PATH=/data/OE/bitbake-1.8.10/bin:${ORG_PATH}

        cd $PKGDIR

        LD_LIBRARY_PATH=

        export PATH LD_LIBRARY_PATH BBPATH

        export LANG=C

        echo "Altered environment for OE Development"

3) Konfiguration

# file: /data/OE/org.openembedded.stable/conf/local.conf

#

# OpenEmbedded local configuration file (sample)

#

# Please visit the Wiki at http://openembedded.org/ for more info.

#

#

# Be SURE to read this file in its entirety and the GettingStarted page on the

# wiki before proceeding.

#

# Once you have done that, remove the line at the end of this

# file and build away.

# 

# WARNING: lines starting with a space (' ') will result in parse failures.

# Remove '# ' from commented lines to activate them.

#

# NOTE: Do NOT use $HOME in your paths, BitBake does NOT expand ~ for you.  If you

# must have paths relative to your homedir use ${HOME} (note the {}'s there

# you MUST have them for the variable expansion to be done by BitBake).  Your

# paths should all be absolute paths (They should all start with a / after

# expansion.  Stuff like starting with ${HOME} or ${TOPDIR} is ok).



# Use this to specify where BitBake should place the downloaded sources into

DL_DIR = "/data/OE/sources"



# Delete the line below. Then specify which .bb files to consider for

# your build. Typically this will be something like BBFILES = "/path/to/openembedded/packages/*/.bb"

BBFILES := "/data/OE/org.openembedded.stable/packages/*/.bb"



# Use the BBMASK below to instruct BitBake to NOT consider some .bb files

# This is a regulary expression, so be sure to get your parenthesis balanced.

BBMASK = ""



# Uncomment this if you want to use a prebuilt toolchain. You will need to

# provide packages for toolchain and additional libraries yourself. You also

# have to set PATH in your environment to make sure BitBake finds additional binaries.

# Note: You will definitely need to say:

#     ASSUME_PROVIDED += "virtual/arm-linux-gcc-2.95"

# to build any of two Linux 2.4 Embedix kernels,

# i.e. openzaurus-sa-2.4.18 and openzaurus-pxa-2.4.18 - and don't forget

# to rename the binaries as instructed in the Wiki.

# ASSUME_PROVIDED += "virtual/${TARGET_PREFIX}gcc virtual/libc"



# Select between multiple alternative providers, if more than one is eligible.

PREFERRED_PROVIDERS = "virtual/qte:qte virtual/libqpe:libqpe-opie"

PREFERRED_PROVIDERS += " virtual/libsdl:libsdl-x11"

PREFERRED_PROVIDERS += " virtual/${TARGET_PREFIX}gcc-initial:gcc-cross-initial"

PREFERRED_PROVIDERS += " virtual/${TARGET_PREFIX}gcc:gcc-cross"

PREFERRED_PROVIDERS += " virtual/${TARGET_PREFIX}g++:gcc-cross"



# Uncomment this to specify where BitBake should create its temporary files.

# Note that a full build of everything in OpenEmbedded will take GigaBytes of hard

# disk space, so make sure to free enough space. The default TMPDIR is

# <build directory>/tmp

# Don't use symlinks in in the path to avoid problems

# TMPDIR = /usr/local/projects/oetmp



# Uncomment this to specify a machine to build for. See the conf directory

# for machines currently known to OpenEmbedded. This will automatically take care

# of TARGET_ARCH

MACHINE = "akita"



# Use this to specify the target architecture. Note that this is only

# needed when building for a machine not known to OpenEmbedded. Better use

# the MACHINE attribute (see above)

# TARGET_ARCH = "arm"



# Use this to specify the target operating system.  The default is "linux",

# for a normal linux system with glibc. Set this to "linux-uclibc" if you want

# to build a uclibc based system.

# Normally the DISTRO of your choosing will take care of this 

# TARGET_OS = "linux"

# TARGET_OS = "linux-uclibc"



# Uncomment this to select a distribution policy. See the conf directory

# for distributions currently known to OpenEmbedded.

# Although it no longer contain version number in the (file-)name

# openzaurus-unstable is a so called "versioned"  distro, i.e. they 

# explicitely select specific versions of various packages.

# Stay away from unversioned distros unless you really know what you are doing

#DISTRO = "angstrom-2007.1"

DISTRO = "angstrom-2007.12-r18"



# So far, angstrom.conf sets ENABLE_BINARY_LOCALE_GENERATION

# to generate binary locale packages at build time using qemu-native and

# thereby guarantee i18n support on all devices. If your build breaks on 

# qemu-native consider disabling ENABLE_BINARY_LOCALE_GENERATION (note that

# this breaks i18n on devices with less than 128MB RAM) or installing

# a working third-party qemu (e.g. provided by your distribution) and

# adding qemu-native to ASSUME_PROVIDED. Caveat emptor, since third-party

# qemus lack patches needed to work with various OE targets.

# ENABLE_BINARY_LOCALE_GENERATION = "0"

# ASSUME_PROVIDED += "qemu-native"



# If ENABLE_BINARY_LOCALE_GENERATION is set to "1", you can limit locales

# generated to the list provided by GLIBC_GENERATE_LOCALES. This is huge

# time-savior for developmental builds. Format: list of locale.encoding pairs

# with spaces as separators.

# GLIBC_GENERATE_LOCALES = "en_GB.UTF-8 de_DE.UTF-8"



# Uncomment this to select a particular major kernel version if the MACHINE setting

# supports more than one major kernel version. Currently this is suported by the

# following MACHINE types: poodle, tosa and simpad.

# MACHINE_KERNEL_VERSION = "2.6"



# Uncomment one of these to build packages during the build process.

# This is done automatically if you set DISTRO (see above)

# INHERIT = "package_ipk"

# INHERIT = "package_tar"



# Add the required image file system types below. Valid are 

# jffs2, tar(.gz|bz2), cpio(.gz), cramfs, ext2(.gz), ext3(.gz)

# squashfs, squashfs-lzma

IMAGE_FSTYPES = "jffs2 tar.gz"



# Uncomment this to disable the parse cache (not recommended).

# CACHE = ""



# Uncomment this if you want BitBake to emit debugging output

# BBDEBUG = "yes"



# Uncomment these two if you want BitBake to build images useful for debugging. 

# Note that INHIBIT_PACKAGE_STRIP needs a package format to be defined.

# Also note that OE now produces -dbg packages which contain debugging symbols.

# DEBUG_BUILD = "1"

# INHIBIT_PACKAGE_STRIP = "1"



# Uncomment these to build a package such that you can use gprof to profile it.

# NOTE: This will only work with 'linux' targets, not

# 'linux-uclibc', as uClibc doesn't provide the necessary

# object files.  Also, don't build glibc itself with these

# flags, or it'll fail to build.

#

# PROFILE_OPTIMIZATION = "-pg"

# SELECTED_OPTIMIZATION = "${PROFILE_OPTIMIZATION}"

# LDFLAGS =+ "-pg"



# Uncomment this to enable parallel make.

# This allows make to spawn mutliple processes to take advantage of multiple 

# processors. Useful on SMP machines. This may break some packages - we're

# in the process of marking these so let us know if you find any.

# PARALLEL_MAKE = "-j 4"



# Uncomment this if you want BitBake to emit the log if a build fails.

BBINCLUDELOGS = "yes"



# Specifies a location to search for pre-generated tarballs when fetching

# a cvs:// URI. Outcomment this, if you always want to pull directly from CVS.

#CVS_TARBALL_STASH = ""



# EDIT THIS FILE and then remove the line below before using!

#REMOVE_THIS_LINE:="${@bb.fatal('Read the comments in your conf/local.conf')}"

4) axnet-Treiber patchen
cd /data/OE/org.openembedded.stable/packages/linux/linux-rp-2.6.24/

wget http://blog.h2o.ch/files/axnet_cs.patch
vi /data/OE/org.openembedded.stable/packages/linux/linux-rp_2.6.24.bb (zeile hinzufügen)
"file://axnet_cs.patch;patch=1;status=hack "
5) Kompilieren
#!/bin/sh

# file: /data/OE-build

source /OE-setupenv

cd /data/OE/org.openembedded.stable

mtn pull ; mtn update

# bitbake x11-image 

cd /data/OE/org.openembedded.stable/tmp/deploy/glibc/images/akita/

#cd /data/OE/org.openembedded.stable/tmp/deploy/glibc/ipk/akita/kernel-module-axnet-cs_2.6.24-r9_akita.ipk

Dateien sicher löschen

Beim überschreiben von Daten können (z.B. durch ungenaue Schreibkopf-Positionierung) alte Daten in den Randbereichen zwischen den Tracks zurückbleiben. Dadurch, dass nicht überall alte Daten zurückbleiben und weil in diesen Randbereichen die Fehlerrate hoch ist, wird man dort keine oder nur geringe Datenmengen retten können. Solche Datenrettungsversuche sind sehr aufwändig und koennen auch nicht durch Spezialfirmen in nützlicher Zeit durchgeführt werden. Das einmalige Überschreiben mit echten Zufallsdaten sollte also in den meisten Fällen ausreichen. Wer mehr Sicherheit wünscht, kann das Überschreiben beliebig oft wiederholen. Die Gutmann-Methode [1], welche 35 Mal mit bestimmten Mustern überschreibt, halte ich für übertrieben und durch den hohen Zeitaufwand nicht praktikabel. Eine Datei ein Mal komplett mit Zufallsdaten zu überschreiben geht z.B. mit: srm -vll <Datei>

Bei Filesystemen mit Journaling reicht es eventuell nicht, eine Datei zu überschreiben. In diesem Fall ist es besser, die Datei normal zu löschen und anschliessend den freien Speicher auf der Festplatte komplett zu überschreiben. Den freien Speicher ein Mal zufällig überschreiben geht z.B. mit: sfill -vll <Pfad>

Unter Debian/Ubuntu sind srm und sfill im Paket secure-delete zu finden.

Wie komplex Festplatten heutzutage aufgebaut sind, wie die Daten aufbereitet und auf die Disks geschrieben werden und welche Möglichkeiten zur Datenrettung bestehen, kann man unter [2] nachlesen.


Daten auf Festplatten sicher entsorgen / löschen

Wer sicher gehen will, dass die Daten auf einer Festplatte unwiderruflich vernichtet werden, sollte die Festplatte physikalisch beschädigen: Die Festplatte öffnen, alle Plattenoberflächen zerkratzen und die Platten verbiegen oder noch sicherer: Die Platten mit geeignetem Gerät zerkleinern. Wem dies zu aufwändig ist, kann von oben Löscher in die ungeöffnete Festplatte bohren, wo sich die Platten befinden.

Das entfernen der Steuerplatine reicht nicht, da die Datenrettung durch den Austausch der Steuerplatine aus der selben Serie zum Erfolg führen kann. Jede Festplatte weist unterschiedliche Parameter auf, aber sie werden beim Burn-In ermittelt und mit der Firmware auf die Platte geschrieben.

Wer die Festplatte weiterverwenden und nur löschen will, sollte die Festplatte mit einem geeigneten Programm überschreiben, z.B. mit DBAN [3].


Quellen:
[1] http://www.nber.org/sys-admin/overwritten-data-guttman.html
[2] http://www.actionfront.com/whitepaper/Drive-Independent%20Data%20Recovery%20Ver14Alrs.pdf
[3] http://www.dban.org/

• In /etc/network/interfaces :

iface eth0 inet6 static
  pre-up modprobe ipv6
  up echo 0 > /proc/sys/net/ipv6/conf/eth0/autoconf
  (...)

Eine knappe Anleitung, wie man auf alix2-Boards von PC Engines natives IPv6 (also nicht getunnelt) über PPPoE zum laufen bringt:

• Squashfs-Image unter Ubuntu erstellen

$ sudo apt-get install svn libncurses5-dev zlib1g-dev bison flex autoconf
$ mkdir kamikaze
$ cd kamikaze/
$ svn co https://svn.openwrt.org/openwrt/trunk/
$ make menuconfig

Target System: x86 / Target Profile: PCEngines Alix / Kernel partition size: 12 / Filsystem part size: <z.B. 224MB bei einer 256MB-Karte>
Base package: qos-scripts, wireless-tools / Network: hostapd-mini, hostapd-utils, ip, iw, wpa-supplicant, wpa-cli
IPv6: ip6tables / Wireless driver: kmod-madwifi

$ ./scripts/feeds update -a
$ make package/symlinks
$ make menuconfig

Administration - webif: webif, webif-lang-de, webif-theme-xwrt

$ make

• Image auf CF schreiben. Achtung: Device darf nicht gemountet sein!

$ sudo dd if=bin/openwrt-x86-squashfs.image of=/dev/<Device der CF-Karte> bs=16k

• Karte in alix2c0 einstecken, Serielles Kabel anschliessen, minicom mit 38400 Baud starten und alix2c0 booten
• Passwort setzen mit passwd
• PPPoE fuer IPv6 konfigurieren

# vi /etc/ppp/options
+ipv6
#debug
logfile /var/log/ppp.log

• IPv6 Autoconf abstellen

# vi /etc/init.d/network

boot() {
        echo "0" >/proc/sys/net/ipv6/conf/all/autoconf
        echo "0" >/proc/sys/net/ipv6/conf/default/autoconf
        echo "0" >/proc/sys/net/ipv6/conf/all/accept_ra

• Netzwerk konfigurieren

# vi /etc/config/network

config interface wan
	option ifname	eth1
	option proto	pppoe
	option username	'<user>'
	option password	'<pass>'
	option ppp_redial	'persist'

config  interface lan
	option ip6addr	<IPv6-Adresse/Netzmaske>

• IPv6-Forwarding aktivieren

# echo 1 >/proc/sys/net/ipv6/conf/all/forwarding
# vi /etc/sysctrl.conf

net.ipv6.conf.all.forwarding=1

• Netzwerk neu starten

# /etc/init.d/network restart
# /etc/init.d/firewall restart

• radvd installieren und konfigurieren (IPv6-Adresse des Gateways im LAN announcen)

# opkg update
# opkg install radvd

# vi /etc/config/radvd

config interface
	#option ignore          1

config prefix
	option prefix	'<IPv6-Netz>'
	#option ignore          1

• radvd aktivieren

# /etc/init.d/radvd enable

• IPv6-Firewall-Script erstellen

# vi /etc/init.d/firewall6

#!/bin/sh /etc/rc.common
# Copyright (C) 2006 OpenWrt.org

## Please make changes in /etc/firewall6.user
START=45

start() {
  echo "Starting firewall (IPv6)..."
  [ -f /etc/firewall6.user ] && . /etc/firewall6.user

  ip6tables -P INPUT DROP
  ip6tables -P FORWARD DROP

  # --> Firewall
  ip6tables -A INPUT -i ! ${UPLINK} -j ACCEPT
  ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  ip6tables -A INPUT -p icmpv6 -j ACCEPT
  ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
  ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
  ip6tables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
  ip6tables -A INPUT -p udp -j REJECT --reject-with icmp6-port-unreachable

  # --> LAN
  ip6tables -A FORWARD -i ! ${UPLINK} -j ACCEPT
  ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  ip6tables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  ip6tables -A INPUT -p icmpv6 -j ACCEPT
  for x in ${TCPSERVICES}; do
    ip6tables -A FORWARD -p tcp --dport ${x} -j ACCEPT
  done
  for x in ${UDPSERVICES};do
    ip6tables -A FORWARD -p udp --dport ${x} -j ACCEPT
  done
  ip6tables -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
  ip6tables -A FORWARD -p udp -j REJECT --reject-with icmp6-port-unreachable
        
  #explicitly disable ECN
  if [ -e /proc/sys/net/ipv6/tcp_ecn ]; then
    echo 0 > /proc/sys/net/ipv6/tcp_ecn
  fi   
} 

stop() {
  echo "Stopping firewalll (IPv6)..."
  ip6tables -F INPUT 
  ip6tables -P INPUT ACCEPT
  ip6tables -F FORWARD 
  ip6tables -P FORWARD ACCEPT
}

• IPv6-Firewall konfigurieren

# vi /etc/firewall6.user

#wan interface
UPLINK="ppp0"

#allowed services from wan to lan
TCPSERVICES="22 80"
UDPSERVICES=""

• Firewall aktivieren

# /etc/init.d/firewall6 enable

Wie man unter Debian/Ubuntu die Zeit mit NTP-Server synchronisiert:

# apt-get install ntp ntpdate
# /etc/init.d/ntp stop
# ntpdate ntp.metas.ch
# /etc/init.d/ntp start

Wie man unter Ubuntu seine SATA-Harddisks ueberwachen kann und E-Mails erhaelt, wenn eine HD ersetzt werden sollte:

• Pakete installieren

$ sudo apt-get install smartmontools mailx

• Smartmontools aktivieren ("#" entfernen)

$ sudo vi /etc/default/smartmontools

start_smartd=yes

• Devicescan deaktivieren ("#" hinzufuegen) und jedes SATA-Device einzeln eintragen (zusaetzlich "-M test" fuer E-Mail-Test)

$ sudo vi /etc/smartd.conf

#DEVICESCAN -m root -M exec /usr/share/smartmontools/smartd-runner
/dev/sda -a -d sat -m me@example.com -M diminishing -M test
/dev/sdb -a -d sat -m me@example.com -M diminishing
/dev/sdc -a -d sat -m me@example.com -M diminishing
/dev/sdd -a -d sat -m me@example.com -M diminishing

• Exim fuer E-Mail-Versand an externe Hosts aktivieren

$ sudo dpkg-reconfigure exim4-config

• "Internet Site" auswaehlen

• Smartmontools starten

$ sudo /etc/init.d/smartmontools start

Falls der Dienst nicht starten sollte, /var/log/daemon.log konsultieren. Bei Debian Etch muss man fuer SATA "-d ata" statt "-d sat" verwenden.

• Testen, ob Mailversand erfolgreich

$ sudo tail /var/log/exim4/mainlog

• Falls SoftRAID genutzt wird, sollten Fehlermeldungen von mdadm an die selbe Adresse versendet werden

$ sudo vi /etc/mdadm/mdadm.conf

#MAILADDR root
MAILADDR me@example.com

$ sudo /etc/init.d/mdadm restart