Baron Samedit: Heap-based buffer overflow in Sudo (CVE-2021-3156)
https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt

https://redd.it/l5lazz
@r_linux

I automate sending birthday and festival wishes to my friends by running a bash noscript in cronjob.

​

One day one of my female friend got angry with me and stopped talking to me because I forgot her birthday and she never forget my birthday. So I was feeling very bad.

and this is not the first time. This happen every year. Not just with one friend with all my friends. Since I don't use any social media it's really hard for me to remember my friends birthdays.

I have no facebook to notify me about my friends birthday. Also no whatsapp so I can see status of my friends putting party pictures or others birthday wishes.

I never wish people on festivals too and we have so many festivals here in India.

But then I got this idea -

I also have a Video explanation or you can read text.

Script - https://pastebin.com/HZrUYynw

# Step 1 -

First my college group is on telegram so almost all my friends use telegram. So by using Telethon library I create a simple tgsend python noscript to send messages on telegram from my account by using terminal.

You need to get your telegram API ID and API HASH from telegram website but it's really easy. Not like Google API.

tgsend username "Sending Happy Birthday using Username"
tgsend +00123456789 "Sending Happy Birthday using Phone number"

# Step 2 -

After this I created a csv file which contain my friends - name, contact number, birthday. My list is huge because I included almost everyone I know - old friends, new friends, all classmates, people I see daily.

File is something like this -

$ cat contacts.csv
Jimmy, +1234567890, 02-May
Emma watson, +1231231234, 09-Jan
Hannah Montana, +1233123123, 21-Sep
...

# Step 3 -

We can use simple grep magic to know who is having birthday today.

grep $(date '+%d-%B') contacts.csv

Here by using date command we can print today's date in exact format we have in contact.csv

Now to get more information we can use Simple cut command.

For example -

name=$(grep $(date '+%d-%B') contacts.csv | cut -d, -f1) # for name
phone=$(grep $(date '+%d-%B') contacts.csv | cut -d, -f2) # for contact number

We can also use awk '{print $1}' to just get first name.

# Step 4 -

Now we Generate message. I am generating a very simple happy birthday message.

msg="Haaappppy Birthday ${name} .. Many Many happy returns of the day."

But you guys can go creative and make list of variety of messages and use shuf to get a random message string. Also It's good if you add name in your messages.

In last

tgsend $phone "$msg"

# Step 5 -

Create a cronjob at random time in mid night .. don't set this to exact 00:00 (24 hours format) otherwise this will look fishy. Also run this on your VPS server or somewhere online. like PythonAnywhere. You can also create a log file for yourself. If you want.

# Conclusion -

This idea was very simple but it changed my life. Now I wish all my friends on their birthday automatically and when they reply Thank you. At that time I realize ohh.. She is having birthday today and this way I don't have to worry about forgetting birthdays.

Also I use this to wish people on festivals .. Now I am just doing it with telegram but you guys can find some whatsapp libraries written in javanoscript. I know there are some. Also There is a way of sending messages from phone numbers too.

I will highly recommend doing this .. You can save so much time of sending these stupid messages to people you don't really care about.

I know this is Autism at its peak. But I am happy like this.

https://redd.it/l5mxg7
@r_linux

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo

Serious looking vulnerability in sudo

Run command “sudoedit -s /”

If the system is vulnerable, it will respond with an
error that starts with “sudoedit:”

If the system is patched, it will respond with an error that starts with “usage:”

Arch have released a patch in the last few hours (1.9.5.p2)
Running on my system after updating produces

sudoedit -s /
usage: sudoedit [-AknS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-T timeout] [-u user] file ...

Which looks like it's patched.

https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit

/edit: just checked on a Ubuntu 18.04 server and it seems to have been patched so I assume later versions are patched also

/edit2: /u/WarriorXK has confirmed patched on Debian 10 - and it appears not to be patched on Debian 8.

https://redd.it/l5n12d
@r_linux

RHEL no-cost* vs openSUSE Leap

Red Hat allows its clients to use RHEL for free on up to 16 machines. On the other hand, openSUSE Leap boasts binary compatibility with SUSE Linux Enterprise and comes without any restriction on usage.

[https://sysadmin-journal.com/rhel-no-cost-vs-opensuse-leap/](https://sysadmin-journal.com/rhel-no-cost-vs-opensuse-leap/)

https://redd.it/l5nbzv
@r_linux

cryfs - Keep your data safe in the cloud
https://www.cryfs.org/

https://redd.it/l5ecq6
@r_linux

LFCA Exam Study Guide (Linux Foundation Certified IT Associate) Study Guide

Linux Foundation has announced a new beginner certification LFCA. You can do this certification before doing certifications like LFCS and LFCE. Here is the study guide for LFCA, in case you decide to appear for it.

https://ravikirans.com/lfca-linux-exam-study-guide/

All other Linux-based certifications can be found here

https://ravikirans.com/category/linux-certification/

https://redd.it/l5efbb
@r_linux

Lenovo ThinkPad X1 Carbon Gen 8 with Ubuntu Pre-Installed -- a Disaster So Far

I recently bought a new ThinkPad X1 Carbon Gen 8 computer with Ubuntu Linux factory pre-installed. It crashed right out of the box during its so-called Out Of Box Experience (OOBE) system configuration process. It became so corrupted the first session that I could not even power it off normally. And, at the end of the very first time I turned it on, I had to resort to the last ditch Emergency Reset button on the bottom of the unit to get it to power down completely. (Yes. I did leave it for a full hour on the black screen of death with a list of error messages just to be sure it wasn't actually doing something in the background in the final stages of power down.) At least one cause of the initial OOBE crash was most likely a local internet service interruption during the OOBE -- and more fundamentally, the associated OOBE programming bugs that would allow that kind of rare, but fully foreseeable, scenario to crash and corrupt the entire operating system. (I am now tending so suspect it was more than likely that there were some other pre-existing faults with the system image used to create my computer. I have been programming since....1985 or 1986, so that's not a completely baseless speculation.)

The only thing worse than the computer itself has been the exceptionally poor treatment I have received from Lenovo Support. (I even filled out 2 Lenovo-requested customer satisfaction surveys, one sent out to my email by their V.P. and General Manager of eCommerce, Ajit Sivadasan, and I never heard back from anyone in management wondering why a customer would be so upset about being treated soo poorly in their attempt to get service for a brand new error-plagued laptop. Everyone in support that I talk to keep trying to tell me their department doesn't support Linux!) About 40 hours of my personal time in (over 12 days), I've been lied to, ignored, passed around in circles by (automated-chat-bot-, online-chat-, hardware-, software-, and warranty-) support, hung up on, muted indefinitely, and "facilitated" with unhelpful, incomplete, and irrelevant advice and instructions (each multiple times).

I have found some help from non-Support Lenovo Engineers on the Lenovo forums, but that means I'm spending a whole lot of my time fixing their problem. And the ThinkPad is only better, but far from fixed (down to 17 reported "Important"-level errors + 5 more in the final blackscreen every time I power off, plus 1/3 or the original desktopApplications now missing or gone hiding), and I'm still not getting clear, comprehensive, and fully correct answers -- even from the software engineers. (Sorry guys, I do appreciate the help, and dealing with individual unhappy customers may not really be part of your proper jobs, but I need to be completely honest here -- things are still a long way from OK at my end).

So, (40 hours) x (going consulting rate for technical office admin help -- call it $50/hour) = $2000 -- more than the price of the computer. (Maybe that's why they had them on sale???)

I personally really, really hate Microsoft Windows and Office. (I used to do MS Office Application Development for stock analysts and their portfolio manager customers at a large, old bank in Chicago for about 5 years in the early 2000's, so I've seen MS products from the inside in real corporate office environments back then and for decades since.) MS Windows/MS Office has never come even remotely close to meeting my personal needs, and so I really wanted to try out Linux in a comparatively pain-and-worry-free environment so that I could more easily automate certain office functions in the way I find convenient.

(Even longer ago, I had to design, create, test, use, and document a couple of 25,000 line scientific data analysis programs at a DOE science lab, so the level of complexity and care required to create a large, error-free program isn't really an issue for me. Learning a new high-level language is a nuisance, but I've actually got the time

to do that again now.) Just 12 days ago, I was actually quite excited to have a new Lenovo Linux computer to start experimenting around with, and I was sincerely thankful for Lenovo offering one with Linux pre-installed so that I didn't have to worry about something I missed in that end of it.

Perhaps my undoing was that I chose the Ubuntu OS (vs. the Fedora OS) from Lenovo? Both should be fine, but maybe Lenovo just can't handle Ubuntu yet? Ironically, I chose Ubuntu because it was reported to be even more stable than Fedora. Even I -- a "non-Linux person" -- was able to install Ubuntu on my own on in a separate partition on an old, 2nd-hand, Toshiba Satellite Windows 7 machine when I was "demoing" Linux desktops to see if I wanted to make the leap. It was old tech, so I didn't have to deal with the possibility of new missing drivers and the like, but it wasn't all that bad.

Or perhaps I just drew the unlucky straw and got a rare ThinkPad lemon. But given the extraordinarily poor performance of Lenovo support so far, I'd say try elsewhere if you can. You might get lucky and never need them. Or you might just get them on a day when they actually remember how to help. But my experience suggests you shouldn't count on it. (Really a shame. I was quite excited and positive about Lenovo just 12 days ago. I even got my partner to by a Lenovo Yoga with MS Windows (she has to have MS for her work) a few days after I ordered mine. (No, she isn't terribly happy with hers either. Her PC works, but they did a little visual marketing bait and switch on her with the stylus -- not that she actually needed one, but she got excited thinking she was getting one with her model of Yoga. She bought it for other reasons.)

I'd be interested to hear other's experiences with pre-installed Linux (any brand of PC) and separately Lenovo support of Linux (Ubuntu vs. Fedora). (Yes, I see some older threads with more positive results, but frankly a lot of them read a bit like marketing vs. real experience, and I'm curious if things have shifted at Lenovo recently for some reason. Seems like they've been really trying to force the bottom line to show immediate profits.)

Sincerely,

R. C. Blasdell, Ph.D.

https://redd.it/l5ti5c
@r_linux

dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)

I have a server running on a Raspberry Pi 4 B+

Went to do my weekly update/upgrade and came back with the following errors when using both apt and apt-get.

usr@server:~ $ sudo apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
firmware-atheros firmware-brcm80211 firmware-libertas firmware-misc-nonfree
firmware-realtek raspi-config
6 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 15.5 MB of archives.
After this operation, 11.3 kB of additional disk space will be used.
Do you want to continue? Y/n Y
Get:1 http://archive.raspberrypi.org/debian buster/main armhf firmware-atheros a ll 1:20190114-1+rpt11 3,887 kB
Get:2 http://archive.raspberrypi.org/debian buster/main armhf firmware-brcm80211 all 1:20190114-1+rpt11 4,600 kB
Get:3 http://archive.raspberrypi.org/debian buster/main armhf firmware-libertas all 1:20190114-1+rpt11 3,424 kB
Get:4 http://archive.raspberrypi.org/debian buster/main armhf firmware-misc-nonf ree all 1:20190114-1+rpt11 3,071 kB
Get:5 http://archive.raspberrypi.org/debian buster/main armhf firmware-realtek a ll 1:20190114-1+rpt11 496 kB
Get:6 http://archive.raspberrypi.org/debian buster/main armhf raspi-config all 2 0210119 27.9 kB
Fetched 15.5 MB in 4s (4,406 kB/s)
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
Traceback (most recent call last):
File "/usr/share/apt-listchanges/DebianFiles.py", line 124, in readdeb
output = subprocess.checkoutput(command)
File "/usr/lib/python3.7/subprocess.py", line 395, in checkoutput
kwargs).stdout
File "/usr/lib/python3.7/subprocess.py", line 487, in run
output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command ''dpkg-deb', '-f', '/var/cache/apt/archi ves/firmware-atheros_1%3a20190114-1+rpt11_all.deb', 'Package', 'Source', 'Versio n', 'Architecture', 'Status'' returned non-zero exit status 2.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/bin/apt-listchanges", line 281, in <module>
main(config)
File "/usr/bin/apt-listchanges", line 96, in main
pkg = DebianFiles.Package(deb)
File "/usr/share/apt-listchanges/DebianFiles.py", line 215, in init
parser.readdeb(self.path)
File "/usr/share/apt-listchanges/DebianFiles.py", line 128, in readdeb
{'what': file, 'errmsg': str(ex)}) from ex
NameError: name 'file' is not defined

During handling of the above exception, another exception

occurred:

Traceback (most recent call last):
File "/usr/bin/apt-listchanges", line 291, in <module>
traceback.printexc()
File "/usr/lib/python3.7/traceback.py", line 163, in printexc
printexception(*sys.excinfo(), limit=limit, file=file, chain=chain)
File "/usr/lib/python3.7/traceback.py", line 104, in printexception
type(value), value, tb, limit=limit).format(chain=chain):
File "/usr/lib/python3.7/traceback.py", line 508, in init
capturelocals=capturelocals)
File "/usr/lib/python3.7/traceback.py", line 363, in extract
f.line
File "/usr/lib/python3.7/traceback.py", line 285, in line
self.line = linecache.getline(self.filename, self.lineno).strip()
File "/usr/lib/python3.7/linecache.py", line 16, in getline
lines = getlines(filename, moduleglobals)
File "/usr/lib/python3.7/linecache.py", line 47, in getlines
return updatecache(filename, moduleglobals)
File "/usr/lib/python3.7/linecache.py", line 137, in updatecache
lines = fp.readlines()
File "/usr/lib/python3.7/codecs.py", line 322, in decode
(result, consumed) = self.bufferdecode(data, self.errors, final)
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xf2 in position 4143: inval id continuation byte
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/0-firmware-atheros1 %3a20190114-1+rpt11all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/1-firmware-brcm80211 1%3a20190114-1+rpt11all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/2-firmware-libertas 1%3a20190114-1+rpt11all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/3-firmware-misc-nonf ree1%3a20190114-1+rpt11all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/4-firmware-realtek1 %3a20190114-1+rpt11all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
dpkg-deb: error: tar subprocess was killed by signal (Segmentation fault)
dpkg: error processing archive /tmp/apt-dpkg-install-5ajyR9/5-raspi-config20210 119all.deb (--unpack):
dpkg-deb --control subprocess returned error exit status 2
Errors were encountered while processing:

/tmp/apt-dpkg-install-5ajyR9/0-firmware-atheros1%3a20190114-1+rpt11all.deb
/tmp/apt-dpkg-install-5ajyR9/1-firmware-brcm802111%3a20190114-1+rpt11all.deb
/tmp/apt-dpkg-install-5ajyR9/2-firmware-libertas1%3a20190114-1+rpt11all.deb
/tmp/apt-dpkg-install-5ajyR9/3-firmware-misc-nonfree1%3a20190114-1+rpt11all.d eb
/tmp/apt-dpkg-install-5ajyR9/4-firmware-realtek1%3a20190114-1+rpt11all.deb
/tmp/apt-dpkg-install-5ajyR9/5-raspi-config20210119all.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

Attempted a Google search and that yielded old posts from years ago that I don't think would work today. Any insight on how to rectify this issue would be greatly helpful. Thanks in advance.

https://redd.it/l5uh3e
@r_linux

I tried to write down everything I did in order to get better performance including compiling your own kernel
https://github.com/sn99/Optimizing-linux

https://redd.it/l5dqj1
@r_linux

Why is there no Linux advertisement?

I'm pretty sure that the biggest reason why the Linux marketshare is so low,is cause no one advertises that.

I mean before I started using Linux,I thought that it's for hackers,and the funny thing is that I only looked it up,cause I wanted to search for "the os that hackers use" and then I found out that the de's look better than windows and hackers only use it,cause it's better,but it's not only for hackers,but for everyone.

And that problem probably comes from that there is no advertisement that shows how good Linux is.

I mean I never saw any advertisement of Linux in my whole life,I even saw that crappy brave add more lol.

And it would definitely make the marketshare bigger,I mean look at chromeOS,it came out some years ago but it got bigger than Linux marketshare,cause of the adds,if there were no chromebook adds it would be smaller.

So why is that so?

I mean there is the benefit that Linux gets bigger and stomps windows and then we have won.

I mean why do bussinesses that sell Linux related products not make adds for it? (Or why are there so little adds that I don't even see them?)

https://redd.it/l5fhc2
@r_linux

My friend wants to use Linux (he wants to leave windows)

What is the most Beginners friendly distribution? He needs to use ms teams for work, and likes to play games regularly, I have mint right now(i dont have experience with other distributions because im also relatively new) what are your recommendations for beginners?

https://redd.it/l5xbm0
@r_linux

Anticipating your memory needs

Proactive and adaptive free memory management in the Linux kernel.

Explanation about how the Linux kernel handles physical memory

*https://blogs.oracle.com/linux/anticipating-your-memory-needs*

https://redd.it/l5ystc
@r_linux

Linux File Permissions or chmod
https://medium.com/@ProfessionProgrammer/linux-file-permissions-or-chmod-5de27b48e30e?source=friends_link&sk=6c1e2f1e0a47e02c6b9ed35b0dc698f1

https://redd.it/l5dzbz
@r_linux

Remote US job: Embedded Linux Engineer - Customer Success

(hope this post doesn't violate the community rules)

Hello everyone, we're looking for an Embedded Linux Engineer with a customer-facing experience. Someone who could assist our clients during onboarding and solve their problems during their use of our software.

More about the company - we're Northern.tech, a company behind two products - CFEngine and Mender. We're looking for someone to join the Mender team.

We need someone based in the US to assist our US customers but the position is remote.

More info can be found here. Please drop us an email to contact@northern.tech if you feel like it's a right position for you.

https://redd.it/l61y1t
@r_linux

Advice on teaching a new Linux user

I have a colleague who wants to learn about Linux and I’ve been showing her stuff. She has to have Windows at work because of engineering software. So, I set her up with WSL and she apparently ran with it because she installed Ubuntu on her personal laptop. She really likes Linux so far and is playing with terminal commands.

What are some good next learning steps after that? I get the sense, “Do vimtutor” would be discouraging.

https://redd.it/l63eve
@r_linux

Anyone know of a small library to preview/quick-view 3D model files, supporting .stl?

I'm trying to find a way to quickly preview all the STL files on my machine. Similar to gnome sushi (pressing spacebar to preview an image)...

Closest I found is g3dviewer, but it doesn't seem to support STL, oddly. Not sure why, it's a pretty common format for 3d these days, especially for people doing CAD/3d-printing, but maybe that's why... the project seems old... considering breaking open the code to add stl support, but thought I'd ask first.

https://redd.it/l64htt
@r_linux

having hell of a time install a particular version of wireshark

Hey everyone,


I work for a company that required a specific version of wireshark to be installed on the system, we inherited a system that has the most up to date version.


I can remove that version using apt-get uninstall wirehshark


however, how do I manually install wireshark version 2.6.10


I have the tar, and from what I can read online you run ./configure


however there is no configure in the wirehsark directory after it upacks.


what gives?

https://redd.it/l69m2j
@r_linux

Changing ip to domain

Hey everyone. I have finished a lemp setup on ubuntu. It's a WordPress website. Now the challenge I'm facing is that the website is accessible from ip but I want to give my users a domain name. How can I attain this?
Also I have this window server on aws which has a domain running a website let's call it xyz.com. Is that possible to make xyz.com/blog to redirect to my lemp.

https://redd.it/l6awuw
@r_linux