Practical use of Linux capabilities

Centos (Linux) is the generous open source re-issue of Red Hat Server. It's been running in parallel since 2004, offering Red Hat Server enthusiasts access to source / binaries free and open for private and commercial use. Many clients that have support contracts for Red Hat can't afford to maintain support on all systems, so fill in with Centos. Many only run Centos as well.

Neither are as 'fanciful' as hot new Linux distro's, but these are used by many commercial, academic, and government institutions, and have been instrumental in building the internet, and have been the standard for many years.

Fedora is the desktop / workstation open source free version, and Fedora Server is available as recognition that many implement Fedora first on their desktop then want to migrate their implementation to the datacenter, and don't want to support both Fedora and Centos.

Oracle Linux was added as another downstream Redhat build back in 2007, and is similar but favors Oracle applications / services integration.

There are a few other downstream implementations of RHEL:

Red Hat Enterprise Linux derivatives
https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux_derivatives

"Appliance-oriented derivatives based on RHEL:

• Google Search Appliance - derived from CentOS
• Cisco Unified Communications Manager[9]
• VMware ESX's Service Console software
• Amazon.com Amazon Linux AMI RHEL7 userland with a linux-xen-kernel"

By that list of integrators of RHEL / Centos you can tell how important this branch of Linux has become over the years.

Once you know one Linux distro, you can learn the particulars of the others easily and your skills are not only valuable to your employer, those skills are valuable to a vast number of employers.

Of course you can add this to Debian / Ubuntu / etc experience, and moving both directions is also easy - IMHO - once you know the core concepts everything else are apps and services.

This is a nice review of some applicable core concepts to basic service management. Although used in new combinations expressing service management.

Gerlof Langeveld - Practical use of Linux capabilities (Full Talk) , at the ORNL CentOS Dojo
TheCentOSProject
Published on May 13, 2019
Talk Overview : In conventional UNIX systems, processes running under a 'normal' user identity had no specific privileges whatsoever while processes running under the root identity had all special privileges, like the ability to reboot the system, to kill any process, to open raw sockets, etcetera. The capability mechanism implemented by the Linux kernel enables a process to get only a limited set of these privileges, just enough to do the special tasks that this process is supposed to do. Nowadays capabilities are used by systemd to provide specific privileges to services and by Docker to provide specific privileges to the process that is running in a container. Furthermore, capabilities are used as an alternative for setuid executables that enable normal users to run a specific program (like ping) under the root identity. In this presentation I will explain how the capability mechanism works and how systemd, containers and executable files are related to this feature.


You may not understand - or catch the importance of - much of the material the first time through, but somewhere between the 2nd and the 100th time you are exposed to these concepts, you'll have gained insight into most of it, and long before then you'll be productive using the concepts.

TheCentOSProject has lots of other good training and project video's. And, there are a lot of other training videos showing how to install the OS, application stacks, manage security, systems administrator, and network administration from RHEL based systems.

Even this Ubuntu-centric site lists CentOS as the #2 out of 10 best Server OS's, with their #1 being Ubuntu Server, and #3 Debian (Stable) (progenitor upline source for Ubuntu), no surprises there. Red Hat Linux they have listed as #6, with Fedora #5.

Best Linux Server Distro: Top 10 Compared and Our Recommendation
https://www.ubuntupit.com/best-linux-server-distro-top-10-compared-recommendation/

Here's other rankings of server OS's:

Top 10 Linux Server Distributions of 2018
https://www.serverwatch.com/columns/slideshows/top-10-linux-server-distributions.html


Best Linux server distro of 2018
Use the very best distro for your home or business server
By Nate Drake September 10, 2018 Operating systems

These guys recommend Debian #1, and Ubuntu Server #2 for *home* server. Well, that's a challenge, you'll bust your brain trying to get somewhere starting with Debian as a newbie, but WTH, why not - it is possible if you've got attention to detail, love following lots of written instructions and have infinite patience when things go wrong. CentOS is #5.

Debian vs Ubuntu: Compared as a Desktop and as a Server
https://thishosting.rocks/debian-vs-ubuntu/

"After our CentOS vs Ubuntu comparison and the requests we get, it’s finally time to compare Debian and Ubuntu. These 2 distros are used both as a desktop OS and as a server, so we’ll compare both use-cases.

Ubuntu is based on a snapshot of Debian (Testing), so naturally, they are similar in many ways. However, they still have differences. Our comparison will focus more on the differences, but we’ll include the similarities too, so you can better compare them and decide which distro is better for you. This is a controversial comparison, so we expect as much input from you as possible. Leave a comment below, please."

I'm not recommending or not recommending their services, I just liked their comparison, and am only commenting below as it pertains to downloading their distro vs the original source distro, along with some I hope helpful "cloud" OS use comments.

Although they've got site hosted versions of Debian and Ubuntu on their site, I'd recommend going to the source upline - unless you intend on using their hosting services - then usually you would be encouraged by them to use their localized distro.

I'd normally recommend against doing that as you want to be in control of your build and port it over to their cloud, but it depends on the client, the host, and the phase of the moon - the idea is to know what's in it and have control over it and not have something in there you don't know about, no matter how innocuous, as it will bite you some day - that which you don't know randomizes success and true success isn't random.

Using localized cloud provider builds are ok to learn their services and to learn what you need to to know roll in their required packages to support their services - public and private, as well as eventually local cloud self hosted on your iron.

Have fun.

If you've never really done anything with Linux CLI before, you've only installed the OS in a VM / Windows / etc and then clicked around the GUI, you've only emulated Windows on Linux...

The real power and usage, what more Linux users do all day every day, is to have multiple shell windows up (bash usually these days), connected to various servers - or local shell windows only - and do work there. Editing programs, scripts, configuration files, output from programs (logs), monitoring processes, and transferring files locally and remotely.

You will then also interact with a lot of applications via CLI to implement projects, but the basics are always used as part of this work.

Of course there are programmatic CLI's, integrated with source management and test / validation along with build and qa tools, and many implemented as GUI's, but still the underpinnings of all of it still rely on the basic building blocks you need to learn and operate at the CLI level - you need to be aware of the resources and tools in order to know what is possible / not easy possible.

I don't have any current CLI / bash basic books or videos to immediately recommend, but I'll see if I can find some on youtube so you can have a start - you'll likely get bored easily just watching, so be sure and have a bash / shell window or two open in a test directory to try things out as you see them.

Here's one series to start, kinda rough, but it's not too bad. It's more time consuming than simply man'ing commands and reading the man pages, but given the hundreds / thousands of cli accessible commands installed (depending on the distro and options selected) it's good to see someone choosing what to learn and in what order - even if it's not completely optimal.

This one starts out with a pre-CLI discussion to give some perspective for Windows users - contrasting with Linux, if the accent distracts, move on after he starts on the shell commands to the next series below:

Linux Tutorial For Beginners - 1 | Linux Administration Tutorial | Linux Commands | Edureka
edureka!


This series might be easier to listen to, and has smaller parts to take in. Try a few different parts and see if it works for you:

Bash Basics Part 1 of 8 | Access and Navigation
Joe Collins
Published on Apr 11, 2016
In this video we talk about accessing bash in a terminal and show basic file system navigation.


He's also got a 10 useful commands video... not sure how / where it fits in his 8 part series:

Linux Tip | 10 Useful Linux Commands
Joe Collins
Published on Feb 6, 2016
10 very useful commands you can use on your Linux system.


One of the problems with Linux / UNIX is that it is so broad and rich - even though a small subset of commands will do most of the work - there are many commands that you'd just love, if you only knew they existed - first, they do exist, most everything you can think of is a command, library function, service, application, etc - you just need to find it and learn it.

Apache Web Server and HTTPS on Linux
Steven Gordon
Published on Apr 11, 2018
Install and setup Apache web server on Ubuntu Linux, as well as generating certificates and setting up HTTPS. This assumes an internal network of Linux machine has been setup: https://www.youtube.com/watch?v=qso9W....
The commands used, although with different filenames, are at https://sandilands.info/sgordon/https...


https://www.youtube.com/results?search_query=apache+configuration+in+linux&sp=CAM%3D

https://www.youtube.com/results?search_query=apache+configuration+files&sp=CAM%3D

https://www.youtube.com/results?search_query=linux+apache+https+configuration&sp=CAI%3D

https://www.youtube.com/results?search_query=oracle+enterprise+linux&sp=CAMSAhAB

https://www.youtube.com/results?search_query=openstack+on+linux&sp=CAI%3D

 

This is still too reminiscent of the old CLI/GUI wars. While I agree with the rest CLI is where the power is GUI avails the OS to the mass's. That was my stance then and now.

 

I wouldn't suggest a typical Windows GUI user drop into the CLI of Windows to do their daily tasks, as the Windows CLI is hardly a robust tool to use without the GUI.

On the other hand Linux / UNIX has a huge volume of commands and services available that isn't reachable via a GUI alone.

Managing routers, switches, load balancers, storage devices, a wide range of devices that indeed have GUI's for management and monitoring, but save some of the power and control for command line use only, and often hide configuration files accessible only through a command shell.

Managing many of those complex configurable devices requires CLI familiarity and ease of use only gained through constant CLI use, and constant Linux use can help grow those skills.

That's what Linux brings - a GUI to step over to the Linux CLI world - and access to the full power underneath through the CLI as well. That's why people often leave Linux after a brief GUI only visit, as it's not quite enough to induce people to move from Windows most of the time.

The full transition to Linux needs to include CLI, otherwise you are missing out on a large % of what makes Linux special. The GUI isn't the focus of use, it is only the Window Manager for the CLI windows and other applications / VM windows. Linux isn't for everyone, but if you love getting technical there's a vast world of tools and technology available through the CLI, and GUI.

I've used GUIs from the way back in the Altos / Sun / LISP Machine days, and there wasn't then and there still isn't now a 100% GUI for everything, you've got to dig in and learn the CLI to get access to the good stuff.

There never really was a real GUI vs CLI war for those that used both to get work done. They were two sides of resource access that needed both to work together to gain access to all the available resources. Neither are enough alone.

Users do not live by CLI alone, or GUI alone. Both CLI and GUI working in harmony are a beautiful thing.

 

Back in the day, at the time of the advent of Windows and Ensemble, Hobbyists using CLI's argued that GUI's were taking away from the computer purists and there was resistance. Linux with GUI's reminds me of back in the days of using Ensemble and DOS.

I agree as well that Linux is much more robust than DOS was. I would not be upset though to see Linux develop to the point that a user would never need touch the CLI. This would take away the fears of simple casual users to migrate from Windows to Linux. As it is Linux is still just suited for those of us that are so inclined.

 

Yes, I remember the CLI vs GUI discussions with everyone effectively a newbie learning the limitations of each interface - with many starting on one side without experiencing the other.

It was less effort to defend where they stood than to take the time to make the effort to experience the other interface. Both CLI and GUI were so primitive and limited it was easy to prove neither was superior for all tasks.

Today a feature complete Linux GUI would be an amazing interface, especially the AI assistant that would try to figure out what you wanted to do and then pop up a constructed on the fly fully populated GUI customized to implement your desired needs.

GUI's are supposed to provide a simple way to visually navigate to the desired resource, visualize that resource, and then control that resource. To implement all of the Linux resources - commands, applications, services, etc through a GUI would make the Linux GUI even more cumbersome.

One of the most frustrating things for people trying to get work done with a complex GUI is finding every option they need to change, missing that one switch / option - where was it? - only to find that the GUI didn't implement it and you need to get into the CLI to change that option.

That's why GUI's often generate the underlying code for you to edit additional options not included in the GUI. CLI tools are updated first, causing GUI tools to lag in functionality.

I haven't really thought about it for a while, but maybe it's a good time to put together a project to create an AI in between the user and the GUI / CLI to make both work together easier?

Or, maybe the user could gradually learn the CLI commands and syntax - gradually improving their typing skills through use, and eventually become the Expert Intelligence between the Chair and the Keyboard themselves.

 

I use windows for data and domain services, linux for literally everything else. I find tat powershell, in its modern form, and windows in general to be just as capable as linux. But requires more work and "layers" to do so and now with WSL and the upcoming Windows terminal that gap is nearly closed altogether. Linux is can be booted, installed and configured in no time at all and hits the ground running faster IMHO. For me linux is a Server OS and a development machine for those whom do not want or need an apple. As far as using linux for a desktop environment, well if all you need is "office" type work, email and internet it can certainly work just fine with a default install. Honestly the only thing that pushes me to windows on my main rig as the host/main OS is gaming, but that is looking like it will change very soon and Ill likely be back on linux as a main OS and windows at home for gaming and testing.

Im no purist for any OS and see the value in all 3 main desktop variants. Only reason I have disdain for Apple is Im just not a fan of their hardware feel, much like that of a certain brand of car interior, and their general closed off sense of business. But they are a decent and solid OS. As of now if I had to choose one OS to use I would almost be forced to go linux purely on my work and side projects.

 

I like certain things about Linux, but over time learned to respect Windows, and all in all prefer it nowadays. Guess Windows caught up and got much better, or maybe my Linux knowledge increased to the point where I see obvious shortcomings in this OS. E.g. lack of app-based filtering in firewall is a major problem. USB3.0 to SATA bridges problems in Linux are disappointing too. And permissions system... let me be blunt, Linux permission system just sucks. It may be adequate for basic tasks, but all the dancing around with chroot requires ridiculous amount of time&effort to pull off, and then maintain. Bottom line, Linux is fantastic OS and very straightforward for common tasks that many people perform, but once you need to achieve something specific and rarely required by most - it often usually becomes a disaster, forcing you to rethink OS choices.

 

App-based firewall filtering: what specifically are you trying to do?

USB3-SATA bridges: what issues?

Permission system: there are a lot of capabilities beyond the traditional user/group/other RWX bits available via extended attributes and SELinux. Again, what specifically are you trying to do?

Containers really couldn't be done properly without fine grained networking and permissions, and Linux is where most containers and container orchestration is hosted. So the question is, what are you really trying to do? Perhaps there's some other way of accomplishing the same thing.

 

User Firefox exclusively over VPN tunnel, use Chrome exclusively bypassing VPN tunnel.

UASP problems, requiring to blacklist UASP on many if not most USB-SATA bridges. To be perfectly honest I didn't use USB3.0 to SATA bridges under Linux yet, and ordered some despite recommendations against it - but judging by what I read on the forums, it is indeed a problem. On the other hand, I have been running a Windows NAS with UASP USB bridges for quite some time, and the only problem I faced so far was colliding drive signatures that can be easily resolved.

Put a particular ssh-controlled video player (omxplayer) in a chroot jail without putting a whole OS image inside it via debootstrap. Can't put it inside a docker or other container, sadly.

 

I wonder if using a new network namespace for the VPN connection and some shell scripts would do that for you? http://sgros.blogspot.com/2017/04/how-to-run-firefox-in-separate-network.html

 

And that's a great point because it's true. An enduser just wants the operating system to get out of the way so they can get on with what they were looking to do. Years ago and IIRC, I had heard a conversation with Bill Gates and prior to the beginnings of MS-DOS, how they had to use a CLI program just to move and copy files. Now because of a GUI, all you need to do is click on the file and right click whether you want to move or copy it.

The advancement of the GUI has allowed non computer geeks to use a computer who might have otherwise not done so. It is partly responsible for the acceptance of the computer essentially becoming an appliance.

Mark Shuttleworth changed the look and feel of interacting with Ubuntu for similar reasons much to the dismay of Linux users, to get more people to interact and use Linux. Linux Mint has also made great strides with it's GUI as well as openSUSE where these distros don't want you to have to deal with a CLI.

The use of a GUI is what made the Mac so popular back in the 80's before Microsoft countered with Windows.

 

And unfortunately also made some people rent a VM / Server without really understanding what they're doing. So these machines end up as hops for attacks, mining platforms, hosting malicious content and such things.

Sounds a lot like "I'm better then the masses", sorry if it does, my point is that by the try to make everything idiot-proof, also a lot of idiots will come along and use it.
And just because there's a GUI available, it doesn't mean it's a good idea to install Samba on a root server to share files with 'ur mateys.

 

Point taken but here's what I think is the reason behind Canonical's decision to put training wheels on Linux which has resulted in other Distro's doing the same. I would say the vast majority of those who use a computer (Windows, MacOS, Linux) are those who use it for Shopping online, Banking, Web Browsing, Email, and letter writing or notes. And if that really is the case then Linux gambled well.

As has been said on other occasions, that in order for Linux to become a mainstream OS it needs acceptance as a games platform. I personally prefer OpenGL over DirectX any day. It was superior in performance and looks but MS took the fight to it and won. SteamOS has helped but not enough so there's going to be years of slogging before developers find Linux and Windows as equally attractive videogames platforms. Playing videogames on a PC is what made Windows and the PC commonplace.

So in a nutshell while it could ruffle feathers with the Linux hardcore/faithful it was a decision Canonical and Mark Shuttleworth thought was worth it to get people to try Linux. In the end it's all about " compromise".

 

Absolutely - I respect what Ubuntu / Mint etc. try to do. Though, if you strip it down to "average Joe" who's using a putor for shopping, browsing, email, video streaming the OS doesn't matter at all and these people can also use a Chromebook and that absolutely will match their daily needs.
The last years my "problem" is a bit that by trying to get on the desktop, e.g. "Year of the linux desktop" distro's are slowly loosing what Linux is really making a *nix like OS.
Windows and OSX are like an egg-laying-cow with an one-tool-fits-all approach. *unix is more like taking several small tools, put them together and get awesome results. It's the "do one thing but do it right" vs. the "try to do everything, but nothing right" approach. Take "bc" and "dc" as example.
With dc:

Code:

dc
1234
2 * p
2468

Now since that syntax is kinda strange to multiple numbers, someone wrote "bc" which does nothing else then being an interface to dc

Code:

bc
1234 * 2
2468

That's the strength of *nix systems, not having a shiny fancy GUI. Now I'm aware we're no longer in the 1980's and have 2019 meanwhile.
So the most successful *nix system today on the market, apart embedded systems, is Android.

 

That's correct it really doesn't matter what OS the average Joe is using but alas today's OS's are essentially services and are free. In fact Microsoft Windows has copied the Linux distribution schedule. I'm sure Ubuntu is getting some nice kickbacks from Amazon and Linux Mint is getting kickbacks from Yahoo. But what if the "Average Joe" doesn't like MacOS, doesn't want to pay Apple's premium prices? What if the Average Joe doesn't like Windows? That person would be a good fit for Linux.

It's really all about getting the products out to the masses and that's why MacOS, Windows and Linux exist.