Do not use Edit(GUI) button.

?TableOfContents(4)

Copyright 2007, 2008 Osamu Aoki GPL, (Please agree to GPL, GPL2, and any version of GPL which is compatible with DSFG if you update any part of wiki page)

Generated HTML is at "[http://people.debian.org/~osamu/pub/getwiki/html/ch10.en.html Debian Reference: Chapter 10. System tips]".

I welcome your contributions to update this wiki page. You must follow these rules:

System tips

Here, I will describe basic tips to configure and manage systems, mostly from the console.

The screen program

The screen program is a very useful tool for people to access remote sites via unreliable or intermittent connections since it support interrupted network connections.

List of programs to support interrupted network connections.

1

2

3

package

popcon

size

description

screen

-

-

terminal multiplexer with VT100/ANSI terminal emulation

xmove

-

-

allows you to move programs between X Window System displays

The use scenario for the screen command

The screen(1) program not only allows one terminal window to work with multiple processes, but also allows remote shell process to survive interrupted connections. Here is a typical use scenario of the screen(1) program.

  1. You login to a remote machine.
  2. You start the screen command on a single console.

  3. You execute multiple programs in screen windows created with ^A c ("Control-A" followed by "c").

  4. You switch among the multiple screen windows by ^A n ("Control-A" followed by "n").

  5. Suddenly you need to leave your terminal, but you don't want to lose your active work by keeping the connection.
  6. You detach the screen session by any methods such as:

    • brutally unplugging your network connection,
    • typing ^A d ("Control-A" followed by "d") and manually logging out from the remote connection, or

    • typing ^A DD ("Control-A" followed by "DD") to have screen detach and log you out.

  7. You log in again to the same remote machine (even from a different terminal).
  8. You enter the "screen -r" command.

  9. The screen program will magically reattach all previous screen windows with all actively running programs.

{i} You can save connection fees for metered network connections such as dial-up and packet ones, because you can leave a process active while disconnected, and then re-attach it later when you connect again.

Key bindings for the screen command

In screen session, all keyboard inputs are sent to your current window except for the command keystroke, by default ^A ("Control-A"). All screen commands are entered by typing ^A plus a single key [plus any parameters]. Here are important ones to remember:

List of key bindings for screen.

key binding

meaning

^A ?

show a help screen (display key bindings)

^A c

create a new window and switch to it

^A n

go to next window

^A p

go to previous window

^A 0

go to window number 0

^A 1

go to window number 1

^A w

show a list of windows

^A a

send a Ctrl-A to current window as keyboard input

^A h

write a hardcopy of current window to file

^A H

begin/end logging current window to file

^A ^X

lock the terminal (password protected)

^A d

detach screen session from the terminal

^A DD

detach screen session and log out

See screen(1) for details.

A screen-like program for X window system

The xmove package enables support for mobile X clients; that is, X clients can move between displays. See xmove(1).

Data recording and presentation

The log daemon

Many programs record their activities under the /var/log/ directory.

See @{@thesystemmessage@}@ and @{@thekernelmessage@}@.

Log analyzer

Here are notable log analyzers ("~Gsecurity::log-analyzer" in aptitude).

List of system log analyzers.

1

2

3

package

popcon

size

description

logwatch

-

-

log analyser with nice output written in Perl

fail2ban

-

-

bans IPs that cause multiple authentication errors

analog

-

-

web server log analyzer

awstats

-

-

powerful and featureful web server log analyzer

sarg

-

-

squid analysis report generator

pflogsumm

-

-

Postfix log entry summarizer

syslog-summary

-

-

summarize the contents of a syslog log file

lire

-

-

full-featured log analyzer and report generator

fwlogwatch

-

-

Firewall log analyzer

squidview

-

-

monitors and analyses squid access.log files

visitors

-

-

fast web server log analyzer

swatch

-

-

Log file viewer with regexp matching, highlighting, & hooks

crm114

-

-

The Controllable Regex Mutilator and Spam Filter (CRM114)

icmpinfo

-

-

Interpret ICMP messages

(!) [http://crm114.sourceforge.net/ CRM114] provides language infrastructure to write fuzzy filters with the [http://www.laurikari.net/tre/ TRE regex library]. Its popular use is spam mail filter but it can be used as log analyzer.

Recording the shell activities cleanly

The simple use of the script(1) command (see: @{@recordingtheshellactivities@}@) to record shell activity produces a file with control characters. This can be avoided by using the col(1) command:

$ script
Script started, file is typescript

$ col -bx <typescript >cleanedfile
$ vim cleanedfile

If you don't have the script command (for example, during the boot process in the initramfs), you can use following instead:

$ sh -i 2>&1 | tee typescript

{i} Some x-terminal-emulator such as gnome-terminal can record. You may wish to extend line buffer for scrollback.

{i} You may use screen command with "^A H" (see @{@keybindingsforthescreencommand@}@) to perform recording of console.

{i} You may use emacs with "M-x shell", "M-x eshell", or "M-x term" to perform recording of console. You may later use "C-x C-w" to write the buffer to a file.

Customized display of text data

Although pager tools such as more(1) and less(1) (see @{@thepager@}@) and custom tools for highlighting and formatting @{@highlightingandfingplaintextdata@}@ can display text data nicely, general purpose editors (see @{@thetexteditor@}@) are most versatile and customizable.

{i} For vim(1) and its pager mode alias view(1), ":set hls" will enable highlighted search.

Colorized shell echo

Shell echo to most modern terminals can be colorized using [http://en.wikipedia.org/wiki/ANSI_escape_code ANSI escape code] (see /usr/share/doc/xterm/ctlseqs.txt.gz). E.g.:

$ RED=$(printf "\x1b[31m")
$ NORMAL=$(printf "\x1b[0m")
$ REVERSE=$(printf "\x1b[7m")
$ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"

Colorized commands

Colorized commands are handy for inspecting their output in the interactive environment. I include following in my ~/.bashrc.

if [ "$TERM" != "dumb" ]; then
    eval "`dircolors -b`"
    alias ls='ls --color=always'
    alias ll='ls --color=always -l'
    alias la='ls --color=always -A'
    alias less='less -R'
    alias ls='ls --color=always'
    alias grep='grep --color=always'
    alias egrep='egrep --color=always'
    alias fgrep='fgrep --color=always'
    alias zgrep='zgrep --color=always'
else
    alias ll='ls -l'
    alias la='ls -A'
fi

The use of alias limits color effects to the interactive command usage. It has advantage over exporting environment variable "export GREP_OPTIONS='--color=auto'" since color can be seen under pager programs such as "less".

{i} You can turn off these colorizing aliases in the interactive environment by invoking shell with "TERM=dumb bash".

Recording the graphic image of an X application

There are few ways to record the graphic image of an X application, including an xterm display.

List of graphic image manipulation tools.

1

2

3

package

popcon

size

command

xbase-clients

25829

-

xwd(1)

gimp

8489

-

GUI menu

imagemagick

5479

-

import(1)

scrot

134

-

scrot(1)

Recording changes in configuration files

There are specialized tools to record changes in configuration files with help of DVCS system (see @{@gitforrecordingcigurationhistory@}@).

List of packages to record configuration history in VCS.

1

2

3

package

popcon

size

description

changetrack

-

-

store configuration files with [http://en.wikipedia.org/wiki/Revision_Control_System RCS]. (old)

etckeeper

-

-

store configuration files and its metadata with [http://en.wikipedia.org/wiki/Git_(software) Git], [http://en.wikipedia.org/wiki/Mercurial_(software) Mercurial], or [http://en.wikipedia.org/wiki/Bazaar_(software) Bazaar]. (new)

Data storage tips

Booting your system with Linux [http://en.wikipedia.org/wiki/Live_CD live CDs] or [http://www.debian.org/releases/stable/debian-installer/ debian-installer CDs] in rescue mode make it easy for you to reconfigure data storage on your boot device. See also @{@thebinarydata@}@.

Partition configuration

For partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.

Most PCs use the classic [http://en.wikipedia.org/wiki/Master_boot_record Master Boot Record (MBR)] scheme to hold [http://en.wikipedia.org/wiki/Disk_partitioning disk partitioning] data in the first sector, i.e., [http://en.wikipedia.org/wiki/Logical_block_addressing LBA] sector 0 (512 bytes).

(!) Some new PCs with [http://en.wikipedia.org/wiki/Extensible_Firmware_Interface Extensible Firmware Interface (EFI)], including Intel-based Macs, use [http://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table (GPT)] scheme to hold [http://en.wikipedia.org/wiki/Disk_partitioning disk partitioning] data not in the first sector.

Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.

List of disk partition tool packages

1

2

3

package

pocon

size

description

[http://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table]

util-linux

-

-

Miscellaneous system utilities including fdisk(8) and cfdisk(8)

Not supported

parted

-

-

The GNU Parted disk partition resizing program

Supported

gparted

-

-

GNOME partition editor based on libparted

Supported

qtparted

-

-

KDE partition editor based on libparted

Supported

gptsync

-

-

Synchronize classic MBR partition table with the GPT one

Supported

<!> Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), ...) and resize2fs(8).

(!) In order to switch between GPT and MBR, you need to erase first few blocks of disk contents directly (see @{@clearfilecontents@}@) and use "parted /dev/sdx mklabel gpt" or "parted /dev/sdx mklabel msdos" to set it. Please note "msdos" is use here for MBR.

Accessing partition using UUID

Although reconfiguration of your partition may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.

{i} You can probe [http://en.wikipedia.org/wiki/Universally_Unique_Identifier UUID] of a block special device with the vol_id(8) command.

Expand usable storage space via LVM

For partitions created on [http://en.wikipedia.org/wiki/Logical_Volume_Manager_(Linux) Logical Volume Manager (Linux)] at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.

<!> Deployment of the current LVM system may degrade guarantee against filesystem corruption offered by journaled file systems such as ext3fs unless their system performance is sacrificed.

Expand usable storage space by mounting another partition

If you have an empty partition (e.g., /dev/sdx), you can format it with mkfs.ext3(1) and mount(8) it to a directory where you need more space. (You need to copy original data contents.)

$ sudo mv work-dir old-dir
$ sudo mkfs.ext3 /dev/sdx
$ sudo mount -t ext3 /dev/sdx work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir

If you have an empty directory (e.g., /path/to/emp-dir) in another partition with usable space, you can create a symlink to the directory with ln(8).

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo ln -sf /path/to/emp-dir work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir

<!> Some software may not function well with "symlink to a directory".

Expand usable storage space using aufs

If you have usable space in another partition (e.g., /path/to/), you can create a directory in it and stack that on to a directory where you need space with [http://en.wikipedia.org/wiki/Aufs aufs].

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo mount -t aufs -o br:/path/to/emp-dir:old-dir none work-dir

<!> Use of [http://en.wikipedia.org/wiki/Aufs aufs] for long term data storage is not good idea since it is under development and its design change may introduce issues.

{i} In order to use [http://en.wikipedia.org/wiki/Aufs aufs], its utility package aufs-tools and kernel module package for [http://en.wikipedia.org/wiki/Aufs aufs] such as aufs-modules-2.6-amd64 need to be installed.

(!) [http://en.wikipedia.org/wiki/Aufs aufs] is used to provide writable root filesystem by many modern [http://en.wikipedia.org/wiki/Live_CD live CD] projects.

Optimization of filesystem

Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). For example:

{i} You need to provide kernel boot parameter "rootflags=data=journal" to deploy "data=journal" option for the root file system formatted with ext3fs.

Optimization of harddisk

You can test disk access speed of harddisk, e.g. /dev/hda, by "hdparm -tT /dev/hda".

You may be able to speed up a harddisk connected with (E)IDE with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda". Please check your hardware and read manpage of hdparam(8) before playing with harddisk configuration because this may be quite dangerous for the data integrity.

You may be able to read badly pressed cdroms on modern high head CD-ROM drive by slowing it down with "setcd -x 2.

Filesystem check frequency

You can control how frequently the boot-up filesystem checks are done (fsck checks). In this example, a partition is changed to a check every 50 boots. tune2fs -c 50 /dev/hda1

Data encryption tips

Since gaining root privilege is relatively easy with physical access (see @{@securingtherootpassword@}@), it can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although [http://en.wikipedia.org/wiki/GNU_Privacy_Guard GNU privacy guard] (see @{@datasecurityinfrastructure@}@) can encrypt files, it takes some user efforts.

[http://en.wikipedia.org/wiki/Dm-crypt dm-crypt] and [http://ecryptfs.sourceforge.net/ eCryptfs] facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.

List of data encryption utilities.

1

2

3

package

popcon

size

function

cryptsetup

-

-

Utilities for encrypted block device ([http://en.wikipedia.org/wiki/Dm-crypt dm-crypt] / [http://en.wikipedia.org/wiki/Linux_Unified_Key_Setup LUKS])

cryptmount

-

-

Utilities forencrypted block device ([http://en.wikipedia.org/wiki/Dm-crypt dm-crypt] / [http://en.wikipedia.org/wiki/Linux_Unified_Key_Setup LUKS]) with focus on mount/unmount by normal users

ecryptfs-utils

-

-

Utilities for encrypted stacked filesystem ([http://ecryptfs.sourceforge.net/ eCryptfs])

[http://en.wikipedia.org/wiki/Dm-crypt Dm-crypt] is a cryptographic filesystem using [http://en.wikipedia.org/wiki/Device_mapper device-mapper]. [http://en.wikipedia.org/wiki/Device_mapper Device-mapper] maps one block device to another.

[http://ecryptfs.sourceforge.net/ eCryptfs] is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.

(!) Entire Debian system can be installed on a encrypted disk by the [http://www.debian.org/devel/debian-installer/ debian installer] (lenny or newer) using [http://en.wikipedia.org/wiki/Dm-crypt dm-crypt]/[http://en.wikipedia.org/wiki/Linux_Unified_Key_Setup LUKS] and initramfs.

<!> Data encryption costs CPU time etc. Please weigh its benefits and costs.

{i} See @{@datasecurityinfrastructure@}@ for user space encryption utility: [http://en.wikipedia.org/wiki/GNU_Privacy_Guard GNU Privacy Guard].

Removable disk encryption with dm-crypt/LUKS

You can encrypt contents of removable mass storage devices, e.g. USB memory stick on /dev/sdx, using [http://en.wikipedia.org/wiki/Dm-crypt dm-crypt]/[http://en.wikipedia.org/wiki/Linux_Unified_Key_Setup LUKS]. You simply formatting it as:

# badblocks -c 10240 -s -w -t random -v /dev/sdx
# shred -v -n 1 /dev/sdx
# fdisk /dev/sdx
... "n" "p" "1" "return" "return" "w"
# cryptsetup luksFormat /dev/sdx1
...
# cryptsetup luksOpen /dev/sdx1 sdx1
...
# ls -l /dev/mapper/
total 0
crw-rw---- 1 root root  10, 60 2008-10-04 18:44 control
brw-rw---- 1 root disk 254,  0 2008-10-04 23:55 sdx1
# mkfs.vfat /dev/mapper/sdx1
...
# cryptsetup luksClose sdx1

Then, it can be mounted just like normal one on to /media/<disk_label>, except for asking password (see @{@removablemassstoragedevice@}@) under modern desktop environment, such as Gnome using gnome-mount(1). The difference is that every data written to it is encrypted. You may alternatively format media in different file format, e.g., ext3 with "mkfs.ext3 /dev/sdx1".

(!) If you are really paranoid for the security of data, you may need to overwrite multiple times in the above example. This operation is very time consuming though.

Encrypted swap partition with dm-crypt

If your original /etc/fstab contains:

/dev/sda7 swap sw 0 0

then you can enable encrypted swap partition using [http://en.wikipedia.org/wiki/Dm-crypt dm-crypt] as

# swapoff -a
# echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab
# perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab
# swapon -a

Automatically encrypting files with eCryptfs

You can encrypt files written under "~/Private/" automatically using [http://ecryptfs.sourceforge.net/ eCryptfs] and the ecryptfs-utils package.

{i} Files and directories with "go-r" permission such as "~/.cvspass", "~/.fetchmailrc", "~/.ssh/identity", "~/.ssh/id_rsa", "~/.ssh/id_dsa", "~/.gnupg/", "~/.gnome2/", ... can be considered sensitive data.

{i} Since [http://ecryptfs.sourceforge.net/ eCryptfs] selectively encrypt only the sensitive files, its system cost is much less than using [http://en.wikipedia.org/wiki/Dm-crypt dm-crypt] on the entire root or home device. It does not require any special on-disk storage allocation effort but cannot keep all filesystem metadata confidential.

Automatically mounting eCryptfs

If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via Pluggable Authentication Module by having active lines in /etc/pam.d/common-auth as:

auth required pam_unix.so nullok_secure
auth required pam_ecryptfs.so unwrap

and active lines in /etc/pam.d/common-session as:

session required pam_unix.so
session optional pam_ecryptfs.so unwrap

This is quite convienient.

<!> If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see @{@goodpassword@}@). Unless you are careful to set up a [http://en.wikipedia.org/wiki/Password_strength strong password], your data will be at risk when someone runs [http://en.wikipedia.org/wiki/Password_cracking password cracking] software after stealing your laptop (see @{@securingtherootpassword@}@). The squeeze version of the ecryptfs-utils package comes with option to have independent password for wrapping and to set up user's entire home directory for encryption. This is an actively developed package.

Monitoring, controlling, and starting program activities

Program activities can be monitored and controlled using specialized tools.

List of tools for monitoring and controlling program activities

1

2

3

package

popcon

size

description

time

-

-

The time(1) command runs a program to report system resource usages with respect to time.

coreutils

-

-

The nice(1) command runs a program with modified scheduling priority.

bsdutils

-

-

The renice(1) command modifies the scheduling priority of a running process.

powertop

-

-

On Intel-based laptops powertop(1) gives information about system power use.

procps

-

-

The /proc file system utilities: ps(1), top(1), kill(1), watch(1), ...

psmisc

-

-

The /proc file system utilities: killall(1), fuser(1), pstree(1)

cron

-

-

This package run processes according to a schedule (in background).

at

-

-

The at(1) or batch(1) commands run a job at a specified time or below certain load level.

lsof

-

-

The lsof(8) command lists open files by a running process using "-p" option.

strace

-

-

The strace(1) command traces system calls and signals.

ltrace

-

-

The ltrace(1) command traces library calls.

xtrace

-

-

The xtrace(1) command traces communication between X11 client and server.

Time a process

Display time used by the process invoked by the command.

# time some_command >/dev/null
real    0m0.035s       # time on wall clock (elapsed real time)
user    0m0.000s       # time in user mode
sys     0m0.020s       # time in kernel mode

The scheduling priority

A nice value is used to control the scheduling priority for the process.

List of nice values for the scheduling priority.

nice value

scheduling priority

19

lowest priority process (nice)

0

very high priority process for user.

-20

very high priority process for root. (not-nice)

# nice  -19 top                                      # very nice
# nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # very fast

Sometimes an extreme nice value does more harm than good to the system. Use this command carefully.

The ps command

The ps(1) command on the Debian support both BSD and SystemV features and helps to identify the process activity statically.

List of ps command styles.

style

typical command

feature

BSD

ps aux

display %CPU %MEM

System V

ps -efH

display PPID

For the zombie (defunct) children process, you can kill them by the parent process ID identified in the (PPID) field.

The pstree(1) command display a tree of processes.

The top command

The top(1) command on the Debian has rich features and helps to identify what process is acting funny dynamically.

List of commands for top.

command key

response

h or ?

To show help.

f

To set/reset display field.

o

To reorder display field.

F

To set sort key field.

k

To kill a process.

r

To renice a process.

q

To quit the top command.

List files opened by a process

You can list all files opened by a process with a process ID (PID), e.g. 1 as:

$ sudo lsof -p 1

PID=1 is usually init program.

Trace program activities

You can trace program activity with strace(1), ltrace(1), or xtrace(1) commands for system calls and signals, library calls, or communication between X11 client and server. For example:

$ sudo strace ls
...

Identify processes using files or sockets

You can also identify processes using files or sockets by fuser(1). For example:

$ sudo fuser -v /var/log/mail.log
                     USER        PID ACCESS COMMAND
/var/log/mail.log:   root       2946 F.... syslogd

You see that file /var/log/mail.log is open for writing by the syslogd(8) command.

$ sudo fuser -v smtp/tcp
                     USER        PID ACCESS COMMAND
smtp/tcp:            Debian-exim   3379 F.... exim4

Now you know your system runs exim4(8) to handle [http://en.wikipedia.org/wiki/Transmission_Control_Protocol TCP] connections to [http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol SMTP] port (25).

Repeating a command with a constant interval

The watch(1) command executes a program repeatedly with a constant interval while showing its output in fullscreen.

$ watch w

This will display who is logged on to the system updated every 2 seconds.

Repeating a command looping over files

There are several ways to repeat a command looping over files matching some condition, e.g. matching glob pattern "*.ext".

The above examples are written to ensure proper handling of funny file names such as ones containing spaces. See @{@idiomsfortheselectionoffiles@}@ for more advance uses of find(1).

Starting a program from GUI

You can set up to start a process from [http://en.wikipedia.org/wiki/Graphical_user_interface graphical user interface (GUI)].

Under Gnome desktop environment, a program program can be started with proper argument by drag-and-drop of an icon to the launcher icon or by "Open with ..." menu with right clicking. KDE can do the equivalent, too. Here is an example for Gnome to set up mc program started in gnome-terminal:

# cat >/usr/local/mc-term <<EOF
#!/bin/sh
gnome-terminal -e "mc $1"
EOF
# chmod 755 /usr/local/mc-term

{i} Launcher is a file at "~/Desktop" with "desktop" as its extension.

Customizing program to be started

Some programs start another program automatically. Here are check points for customizing this process:

{i} The update-mime(8) command updates the "/etc/mailcap" file using "/etc/mailcap.order" file (see mailcap.order(5)).

{i} The debianutils package provides sensible-browser(1), sensible-editor(1), and sensible-pager(1) commands which make sensible decisions on which editor, pager, and web browser to call, respectively. I recommend you to read these shell commands.

Kill a process

Use the kill(1) command to kill (or send a signal to) a process by the process ID.

Use killall(1) or pkill(1) commands to do the same by the process command name and other attributes.

List of frequently used signals for kill command.

signal value

signal name

function

1

HUP

restart daemon

15

TERM

normal kill

9

KILL

kill hard

Schedule tasks once

Run the at(1) command to schedule a one-time job:

$ echo 'command -args'| at 3:40 monday

Schedule tasks regularly

Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).

Run the command "crontab -e" to create or edit a crontab file to set up regularly scheduled events.

Example of a crontab file:

# use /bin/sh to run commands, no matter what /etc/passwd says
SHELL=/bin/sh
# mail any output to paul, no matter whose crontab this is
MAILTO=paul
# Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed)
# run at 00:05, every day
5  0  *  * *   $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
# run at 14:15 on the first of every month -- output mailed to paul
15 14 1  * *   $HOME/bin/monthly
# run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc:
0 22 *   * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%%
23 */2 1 2 *   echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1"
5  4 *   * sun echo "run at 04:05 every sunday"
# run at 03:40 on the first Monday of each month
40 3 1-7 * *   [ "$(date +%a)" == "Mon" ] && command -args

{i} For the system not running continuously, install the anacron package to schedule periodic command at the specified intervals as closely as machine-uptime permits.

Alt-SysRq

Insurance against system malfunction is provided by the kernel compile option "Magic ?SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-?SysRq followed by one of the following keys does the magic of rescuing control of the system:

List of SAK command keys.

key following Alt-?SysRq

function

r

Unraw restores the keyboard after things like X crashes.

0

Changing the console loglevel to 0 reduces error messages.

k

SAK (system attention key) kills all processes on the current virtual console.

e

Send a SIGTERM to all processes, except for init.

i

Send a SIGKILL to all processes, except for init.

s

Sync all mounted filesystems.

u

Remount all mounted filesystems read-only (umount).

b

Reboot the system without syncing or unmounting.

The combination of "Alt-?SysRq s", "Alt-?SysRq u", and "Alt-?SysRq r" is good for getting out of really bad situations.

See /usr/share/doc/linux-doc-2.6.*/Documentation/sysrq.txt.gz .

<!> The Alt-?SysRq feature may be considered a security risk by allowing users access to root-privileged functions. Placing "echo 0 >/proc/sys/kernel/sysrq" in /etc/rc.local or "kernel.sysrq = 0" in /etc/sysctl.conf will disable the Alt-?SysRq feature.

{i} From SSH terminal etc., you can use the Alt-?SysRq feature by writing to the /proc/sysrq-trigger. For example, "echo s > /proc/sysrq-trigger; echo u > /proc/sysrq-trigger" from the root shell prompt will sync and umount all mounted filesystems.

System maintenance tips

Who is logged on

You can check who is logged on to the system with w(1) or who(1) commands.

Warn everyone

You can send message to everyone who is logged on to the system with the wall(1) command:

$ echo "We are shutting down in 1 hour" | wall

System security and integrity check

Poor system maintenance may expose your system to external exploitation.

For system security and itegrity check, you should start with:

List of tools for system security and integrity check

1

2

3

package

popcon

size

description

logcheck

-

-

This mails anomalies in the system logfiles to the administrator

debsums

-

-

This verifies installed package files against MD5 checksums.

chkrootkit

-

-

[http://en.wikipedia.org/wiki/Rootkit Rootkit] detector.

clamav

-

-

Anti-virus utility for Unix - command-line interface.

tiger

-

-

Report system security vulnerabilities

tripwire

-

-

File and directory integrity checker

john

-

-

Active password cracking tool

aide

-

-

Advanced Intrusion Detection Environment - static binary

bastille

-

-

Security hardening tool

integrit

-

-

A file integrity verification program

crack

-

-

Password guessing program

Here is a simple script to check for typical world writable incorrect file permissions.

# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)

Filesystem creation and integrity check

The mkfs(8) command creates the filesystem on a Linux system. The fsck(8) command provides the filesystem integrity check and repair on a Linux system.

{i} Check files in /var/log/fsck/ for the result of the fsck(8) command run from the boot script.

Although mkfs(8) and fsck(8) commands themselves comes in the e2fsprogs package, mkfs and fsck are simply front-ends for various programs (mkfs.fstype and fsck.fstype) available. For [http://en.wikipedia.org/wiki/Ext3 ext3] filesystem, it will be fsck.ext3(8) (this is hardlinked to e2fsck).

List of tools for filesystem creation and integrity check

1

2

3

package

popcon

size

description

e2fsprogs

-

-

Utilities for the [http://en.wikipedia.org/wiki/Ext2 ext2]/[http://en.wikipedia.org/wiki/Ext3 ext3]/[http://en.wikipedia.org/wiki/Ext4 ext4] filesystem.

reiserfsprogs

-

-

Utilities for the [http://en.wikipedia.org/wiki/Reiserfs Reiserfs] filesystem.

dosfstools

-

-

Utilities for the [http://en.wikipedia.org/wiki/File_Allocation_Table MS-DOS FAT] filesystem.

xfsprogs

-

-

Utilities for the [http://en.wikipedia.org/wiki/XFS XFS] filesystem.

jfsutils

-

-

Utilities for the [http://en.wikipedia.org/wiki/JFS_(file_system) JFS] filesystem.

reiser4progs

-

-

Utilities for the [http://en.wikipedia.org/wiki/Reiser4 Reiser4] filesystem.

hfsprogs

-

-

Utilities for [http://en.wikipedia.org/wiki/Hierarchical_File_System HFS] and [http://en.wikipedia.org/wiki/HFS_Plus HFS+] filesystem.

btrfs-tools

-

-

Utilities for the [http://en.wikipedia.org/wiki/Btrfs btrfs] filesystem.

<!> It is generally not safe to run fsck on mounted filesystems.

{i} Use "shutdown -F -r now" to force to run the fsck(8) command safely on all filesystems including root file system on reboot. See the shutdown(8) manpage for more.

The hardware identification

For the [http://en.wikipedia.org/wiki/Peripheral_Component_Interconnect PCI]-like devices ([http://en.wikipedia.org/wiki/Accelerated_Graphics_Port AGP], [http://en.wikipedia.org/wiki/PCI_Express PCI-Express], [http://en.wikipedia.org/wiki/PC_Card#CardBus CardBus], [http://en.wikipedia.org/wiki/ExpressCard ?ExpressCard], etc.), lspci(8) command (probably with "-nn" option) is a good start for the hardware identification

Alternatively, you can identify the hardware by reading contents of /proc/bus/pci/devices or browsing directory tree under /sys/bus/pci (see @{@procfsandsysfs@}@).

List of hardware identification tools.

1

2

3

package

popcon

size

description

pciutils

-

-

Linux PCI Utilities, lspci(8)

usbutils

-

-

Linux USB utilities, lsusb(8)

pcmciautils

-

-

PCMCIA utilities for Linux 2.6, pccardctl(8)

scsitools

-

-

Collection of tools for SCSI hardware management, lsscsi(8)

pnputils

-

-

Plug and Play BIOS utilities, lspnp(8)

procinfo

-

-

Displays system information from /proc, lsdev(8)

lshw

-

-

Information about hardware configuration, lshw(1)

discover

-

-

Hardware identification system, discover(8)

The hardware configuration

Although most of the hardware configuration on modern GUI desktop systems such as Gnome and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.

List of hardware configuration tools.

1

2

3

package

popcon

size

description

hal

-

-

Hardware Abstraction Layer, lshal(1)

console-tools

-

Linux console font and keytable utilities.

x11-xserver-utils

-

X server utilities. xset(1) and xmodmap(1) commands.

acpid

24513

-

Daemon to manage events delivered by the Advanced Configuration and Power Interface (ACPI)

acpi

2563

-

Utilities for ACPI devices

apmd

1222

-

Daemon to manage events delivered by the Advanced Power Management (APM)

powersaved

1038

-

Daemon to manage battery, temperature, ac, cpufreq (?SpeedStep, Powernow!) control and monitor with ACPI and APM supports.

noflushd

95

-

Allow idle hard disks to spin down

sleepd

75

-

Puts a laptop to sleep during inactivity

hdparm

5192

-

Hard disk access optimization. Very effective but dangerous. You must read hdparm(8) first.

smartmontools

3526

-

Control and monitor storage systems using S.M.A.R.T.

setserial

2619

-

Collection of tools for serial port management.

memtest86+

406

-

Collection of tools for memory hardware management.

scsitools

185

-

Collection of tools for SCSI hardware management.

tpconfig

276

-

A program to configure touchpad devices

setcd

82

-

Compact disc drive access optimization.

big-cursor

*121

-

Larger mouse cursors for X

lspowertweak

-

-

Simple front end to powertweak, lspowertweak(8)

Here, ACPI is a newer framework for the power management system than APM.

System and hardware time

The following will set system and hardware time to MM/DD hh:mm, CCYY.

# date MMDDhhmmCCYY
# hwclock --utc --systohc
# hwclock --show

Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UTC.

If the hardware (BIOS) time is set to GMT, change the setting to UTC=yes in the /etc/default/rcS.

If you wish to update system time via network, consider to use the NTP service with the packages such as ntp, ntpdate, and chrony. See:

{i} The ntptrace(8) command in the ntp package can trace a chain of NTP servers back to the primary source.

The terminal configuration

There are several components to configure character console and ncurses(3) system features:

If the terminfo entry for xterm doesn't work with a non-Debian xterm, change your terminal type from xterm to one of the feature-limited versions such as xterm-r6 when you log in to a Debian system remotely. See /usr/share/doc/libncurses5/FAQ for more. dumb is the lowest common denominator for terminfo.

The sound infrastructure

Device drivers for sound cards for current Linux 2.6 are provided by [http://en.wikipedia.org/wiki/Advanced_Linux_Sound_Architecture Advanced Linux Sound Architecture (ALSA)]. ALSA provides emulation mode for previous [http://en.wikipedia.org/wiki/Open_Sound_System Open Sound System (OSS)] for compatibility.

Run "dpkg-reconfigure linux-sound-base" to select the sound system to use ALSA via blacklisting of kernel modules. Unless you have very new sound hardware, udev infrastructure should configure your sound system.

{i} Use "cat /dev/urandom > /dev/audio" or the speaker-test(1) command to test speaker. (^C to stop)

{i} If you can not get sound, your speaker may be connected to a muted output. Modern sound system has many outputs. The alsamixer(1) command in the alsa-utils package is useful to configure volume and mute settings.

Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.

List of sound packages

1

2

3

package

pocon

size

description

linux-sound-base

-

-

Base package for ALSA and OSS sound systems

alsa-base

-

-

ALSA driver configuration files

alsa-utils

-

-

Utilities for configuring and using ALSA

oss-compat

-

-

OSS compatibility under ALSA preventing "/dev/dsp not found" errors

esound-common

-

-

[http://en.wikipedia.org/wiki/Enlightened_Sound_Daemon Enlightened Sound Daemon (ESD)] common (Enlightenment and GNOME)

esound

-

-

[http://en.wikipedia.org/wiki/Enlightened_Sound_Daemon Enlightened Sound Daemon (ESD)] server (Enlightenment and GNOME)

esound-clients

-

-

[http://en.wikipedia.org/wiki/Enlightened_Sound_Daemon Enlightened Sound Daemon (ESD)] client (Enlightenment and GNOME)

libesd-alsa0

-

-

[http://en.wikipedia.org/wiki/Enlightened_Sound_Daemon Enlightened Sound Daemon (ESD)] library Enlightenment and GNOME)

libesd0

-

-

[http://en.wikipedia.org/wiki/Enlightened_Sound_Daemon Enlightened Sound Daemon (ESD)] library (Enlightenment and GNOME) - OSS

arts

-

-

[http://en.wikipedia.org/wiki/ARts aRts] server (KDE)

libarts1c2a

-

-

[http://en.wikipedia.org/wiki/ARts aRts] library (KDE)

libartsc0

-

-

[http://en.wikipedia.org/wiki/ARts aRts] library (KDE)

jackd

-

-

[http://en.wikipedia.org/wiki/JACK_Audio_Connection_Kit JACK Audio Connection Kit. (JACK)] server (low latency)

libjack0

-

-

[http://en.wikipedia.org/wiki/JACK_Audio_Connection_Kit JACK Audio Connection Kit. (JACK)] library (low latency)

libjack0.100.0-0

-

-

[http://en.wikipedia.org/wiki/JACK_Audio_Connection_Kit JACK Audio Connection Kit. (JACK)] library (low latency)

nas

-

-

[http://en.wikipedia.org/wiki/Network_Audio_System Network Audio System (NAS)] server

libaudio2

-

-

[http://en.wikipedia.org/wiki/Network_Audio_System Network Audio System (NAS)] library

pulseaudio

-

-

[http://en.wikipedia.org/wiki/PulseAudio PulseAudio] server, replacement for ESD

libpulse0

-

-

[http://en.wikipedia.org/wiki/PulseAudio PulseAudio] client library, replacement for ESD

libpulsecore5

-

-

[http://en.wikipedia.org/wiki/PulseAudio PulseAudio] server library, replacement for ESD

libgstreamer0.10-0

-

-

[http://en.wikipedia.org/wiki/GStreamer GStreamer]: Gnome sound engine

libxine1

-

-

[http://en.wikipedia.org/wiki/Xine xine]: KDE older sound engine

libphonon4

-

-

[http://en.wikipedia.org/wiki/Phonon_(KDE) Phonon]: KDE new sound engine

There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.

Disable the screen saver

For disabling the screen saver, use following commands.

List of commands for disabling the screen saver.

environment

command

The Linux console

setterm -powersave off

The X Window by turning off screensaver

xset s off

The X Window by disabling dpms

xset -dpms

The X Window by GUI configuration of screen saver

xscreensaver-command -prefs

Disable the sound (beep)

One can always unplug the PC speaker. ;-) Removing pcspkr kernel module does this for you.

The following will prevent the readline program used by the bash to beep when encountering "\a" (ASCII=7):

$ echo "set bell-style none">> ~/.inputrc

Memory usage

The kernel boot message in the /var/log/dmesg contains the total exact size of available memory.

The free(1) and top(1) commands display information on memory resources on the running system.

$ grep '^Memory' /var/log/dmesg
Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init)
$ free -k
             total       used       free     shared    buffers     cached
Mem:        997184     976928      20256          0     129592     171932
-/+ buffers/cache:     675404     321780
Swap:      4545576          4    4545572

For my MacBook with 1GB=1048576k DRAM (video system steals some of this):

List of memory sizes reported.

report

size

Total size in dmesg

1016784k = 1GB - 31792k

Free in dmesg

990528k

Total under shell

997184k

Free under shell

20256k

Do not worry about the large size of "used" and the small size of "free" in the "Mem:" line, but read the one under them (675404 and 321780 in the example below) and relax.

The kernel

Debian distributes modularized Linux kernel as packages for supported architectures.

Linux kernel 2.6

There are few notable features on Linux kernel 2.6 compared to 2.4.

Kernel headers

Most normal programs don't need kernel headers and in fact may break if you use them directly for compiling. They should be compiled against the headers in /usr/include/linux and /usr/include/asm provided by the libc6-dev package (created from the glibc source package) on the Debian system.

(!) For compiling some kernel-specific programs such as the kernel modules from the external source and the automounter daemon (amd), you must include path to the corresponding kernel headers, e.g. -I/usr/src/linux-particular-version/include/ , to your command line. The module-assistant package helps users to build and install module package(s) easily for one or more custom kernels with the m-a(8) command.

Kernel and module compile

Debian has its own method of compiling the kernel and related modules.

List of key packages to be installed for the kernel recompilation on the Debian system

1

2

3

package

popcon

size

description

build-essential

-

-

essential packages for building Debian packages: make, gcc, ...

bzip2

-

-

compress and decompress utilities for bz2 files

libncurses5-dev

-

-

developer's libraries and docs for ncurses

git-core

-

-

git: distributed revision control system used by the Linux kernel

fakeroot

-

-

provide fakeroot environment for building package as non-root

initramfs-tools

-

-

tool to build an initramfs (Debian specific)

kernel-package

-

-

tool to build Linux kernel packages (Debian specific)

module-assistant

-

-

tool to help build module packages (Debian specific)

devscripts

-

-

helper scripts for a Debian Package maintainer (Debian specific)

linux-tree-2.6.*

-

-

Linux kernel source tree for building Debian kernel images (Debian specific)

If you use initrd in @{@stagecthebootloader@}@, make sure to read the related information in initramfs-tools(8), update-initramfs(8), mkinitramfs(8) and initramfs.conf(5).

/!\ Do not put symlinks to the directories in the source tree (e.g. /usr/src/linux*) from /usr/include/linux and /usr/include/asm when compiling the Linux kernel source. (Some outdated documents suggest this.)

(!) When compiling the latest Linux kernel on the Debian stable system, the use of backported latest tools from the Debian unstable may be needed.

Kernel source compile: Debian standard method

The Debian standard method for compiling kernel source to create a custom kernel package uses make-kpkg(1) command. The official documentation is in (the bottom of) /usr/share/doc/kernel-package/README.gz. See kernel-pkg.conf(5) and kernel-img.conf(5) for customization.

Here is an example for amd64 system:

# aptitude install linux-tree-<version>
$ cd /usr/src
$ tar -xjvf linux-source-<version>.tar.bz2
$ cd linux-source-<version>
$ cp /boot/config-<oldversion> .config
$ make menuconfig
 ...
$ make-kpkg clean
$ fakeroot make-kpkg --append_to_version -amd64 --initrd --revision=rev.01 kernel_image modules_image
$ cd ..
# dpkg -i linux-image*.deb

<!> When you intend to create a non-modularized kernel compiled only for one machine, invoke make-kpkg command without "--initrd" option since initrd is not used. Invocation of "make oldconfig" and "make dep" are not required since "make-kpkg kernel_image" invokes them.

Module source compile: Debian standard method

The Debian standard method for creating and installing a custom module package for a custom kernel package uses module-assistant(8) command and module-source packages. For example, following will build the unionfs kernel module package and installs it.

$ sudo aptitude install module-assistant
...
$ sudo aptitude install unionfs-source unionfs-tools unionfs-utils
$ sudo m-a update
$ sudo m-a prepare
$ sudo m-a auto-install unionfs
...
$ sudo apt-get autoremove

Kernel source compile: classic method

You can still build [http://www.kernel.org/ Linux kernel from the pristine sources] with the classic method. You must take care the details of the system configuration manually.

$ cd /usr/src
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-<version>.tar.bz2
$ tar -xjvf linux-<version>.tar.bz2
$ cd linux-<version>
$ cp /boot/config-<version> .config
$ make menuconfig
 ...
$ make dep; make bzImage
$ make modules
# cp ./arch/x86_64/boot/bzImage /boot/vmlinuz-<version>
# make modules_install
# depmod -a
# update-initramfs -c -k <version>

Non-free hardware drivers

Although most of hardware drivers are available as free software and as a part of the Debian system, you may need to load some non-free external drivers to support some hardwares, such as Winmodem, on your system.

Check pertinent resources:

The chroot

The chroot(8) program is most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting. I will explain simple [http://en.wikipedia.org/wiki/Chroot chroot] systems in the following as examples.

For serious chroot setup with the detail configuration, please consider to use the specialized schroot package.

Run a different Debian distribution with chroot

A chroot Debian environment can easily be created by the debootstrap or cdebootstrap command.

For example, the following will create a sid chroot on /sid-root while having fast Internet access:

main # debootstrap sid /sid-root http://ftp.debian.org/debian/

main # echo "proc-sid    /sid-root/proc     proc   none 0 0" >> /etc/fstab
main # echo "devpts-sid  /sid-root/dev/pts  devpts defaults 0 0" >> /etc/fstab
main # mount -a
main # cp -f /etc/passwd /sid-root/etc/passwd
main # cp -f /etc/shadow /sid-root/etc/shadow
main # cp -f /etc/group  /sid-root/etc/group
main # cp -f /etc/hosts  /sid-root/etc/hosts
main # chroot /sid-root /bin/bash
chroot # cd /dev; /sbin/MAKEDEV generic ; cd -
chroot # vi /etc/apt/sources.list

chroot # aptitude update
...
chroot # aptitude install locales
...

Do you want to continue? [Y/n/?] y
chroot # aptitude install mc vim
...
Do you want to continue? [Y/n/?] y
...
chroot # exit
main #

At this point you should have a fully working Debian sid system, where you can play around without fear of affecting your main Debian installation.

<!> If you use bind mount for directories such as home directory in the chroot, you must be careful for its side effects. I heard people lost their home directory after executing "rm -rf /sid-root" without unbinding their home directory in the chroot. A bind mount is not normally visible with "df", you need to execute "df -a" to see it.

This debootstrap trick can also be used to [http://www.debian.org/releases/stable/installmanual install Debian] to a system without using a Debian install disk, but instead from another GNU/Linux distribution.

Setting up login for chroot

Typing "chroot /sid-root /bin/bash" is easy, but it retains all sorts of environment variables that you may not want, and has other issues. A much better approach is to run another login process on a separate virtual terminal where you can log in to the chroot directly.

Since on default Debian systems tty1 to tty6 run Linux consoles and tty7 runs the X Window System, let's set up tty8 for a chrooted console as an example. After creating a chroot system, type from the root shell of the main system:

main # echo "8:23:respawn:/usr/sbin/chroot /sid-root /sbin/getty 38400 tty8"  >> /etc/inittab
main # init q

Setting up X for chroot

You want to run the latest X and GNOME safely in your chroot? That's entirely possible! The following example will make GDM run on virtual terminal vt9.

First install a chroot system. From the root of the main system, copy key configuration files to the chroot system.

main # cp /etc/X11/xorg.conf /sid-root/etc/X11/xorg.conf
main # chroot /sid-root
chroot # cd /dev; /sbin/MAKEDEV generic ; cd -
chroot # aptitude install gdm gnome x-window-system
chroot # vim /etc/gdm/gdm.conf

chroot # /etc/init.d/gdm start

Now you can easily switch back and forth between full X environments in your chroot and your main system just by switching between Linux virtual terminals; e.g. by using Ctrl-Alt-F7 and Ctrl-Alt-F9. Have fun!

Run other distributions with chroot

A chroot environment for another Linux distribution can easily be created. You install a system into separate partitions using the installer of the other distribution. If its root partition is in /dev/hda9:

main # cd / ; mkdir /other-dist
main # mount -t ext3 /dev/hda9 /other-dist
main # chroot /other-dist /bin/bash

Build packages under chroot

There is a more specialized chroot package, pbuilder, which constructs a chroot system and builds a package inside the chroot. It is an ideal system to use to check that a package's build-dependencies are correct, and to be sure that unnecessary and wrong build dependencies will not exist in the resulting package.

Other virtualization tools

There are several system [http://en.wikipedia.org/wiki/Virtualization virtualization] and [http://en.wikipedia.org/wiki/Emulator emulation] related packages in Debian beyond simple [http://en.wikipedia.org/wiki/Chroot chroot].

List of virtualization tools

1

2

3

package

pocon

size

description

schroot

-

-

Specialized tool for executing Debian binary packages in chroot

sbuild

-

-

Tool for building Debian binary packages from Debian sources

pbuilder

-

-

Personal package builder for Debian packages

debootstrap

-

-

Bootstrap a basic Debian system (written in sh)

cdebootstrap

-

-

Bootstrap a Debian system (written in C)

rootstrap

-

-

A tool for building complete Linux filesystem images

user-mode-linux

-

-

[http://en.wikipedia.org/wiki/User-mode_Linux User-mode Linux] (kernel)

xen-tools

-

-

Tools to manage debian [http://en.wikipedia.org/wiki/Xen XEN] virtual server

bochs

-

-

[http://en.wikipedia.org/wiki/Bochs Bochs]: IA-32 PC emulator

qemu

-

-

[http://en.wikipedia.org/wiki/Qemu Qemu]: fast generic processor emulator

virtualbox-ose

-

-

[http://en.wikipedia.org/wiki/VirtualBox VirtualBox]: x86 virtualization solution on i386 and amd64

wine

-

-

[http://en.wikipedia.org/wiki/Wine_(software) Wine]: Windows API Implementation (standard suite)

dosbox

-

-

[http://en.wikipedia.org/wiki/DOSBox DOSBox]: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS

util-vserver

-

-

[http://en.wikipedia.org/wiki/Linux-VServer Linux-VServer] virtual private servers - user-space tools

vzctl

-

-

[http://en.wikipedia.org/wiki/OpenVZ OpenVZ] server virtualization solution - control tools

vzquota

-

-

[http://en.wikipedia.org/wiki/OpenVZ OpenVZ] server virtualization solution - quota tools

See Wikipedia article [http://en.wikipedia.org/wiki/Comparison_of_virtual_machines] for detail comparison of different virtualization solutions.