Working with Linux!

A Brief Introduction to PGP-security

2010-10-16T21:55:00.000-07:00

PGP offers a reliable but easy way to securely exchange emails and documents. All it requires is a PGP software and an email client that supports this method. Modern email clients, such as, Thunderbird (setup instructions for Windows), support it very well.

The PGP offers a complete security, and it consists of two parts:

1. Digitally signing an email
A matching digital signature of an email confirms that the origin of the email is genuinely what the email claims to have originated from. In other words, if a malicious, third party (e.g. Chinese government) is trying to deceive you by sending fake emails on the name of your friend, the PGP-signature can detect it. Besides, it also guarantees that the contents of the email (along with the attachment) are not altered by the third party, in the process of the email exchange between you and your friend.

2. Encrypting an email
It hides the email-content by encrypting it. Therefore, in the worst case, even if an email is intercepted by any third party, in-between, it will be unreadable to them.

OK, how does it work?
The PGP software that you install, generates an unique pair of keys: a public-key and a private-key. You keep the private-key with you and distribute the public-key among your friends, by means of, say, email, websites, Facebook etc. Similarly, your friends keep their private-keys with themselves and give you their public-keys. In the end, everyone has their private-keys saved safely with themselves and the public-keys distributed among others.

When you send an email (or any other secret document) to your friend, you first use his public-key to encrypt it, and then your private-key to sign the encrypted email (or document). When this email reaches to your friend, he can verify the origin and completeness of this email message by using your public key that you already have publicly distributed. If the signature is verified, he can be sure that the email that he is reading is indeed from you and the content is not altered by a third party, in-between. Then, he can use his private-key to decrypt the encrypted email and read the content.

It is always possible to only encrypt or only sign the emails (or documents). However, for a complete security, both the encryption and signing are recommended.

Further remarks
1. To ensure that your friends’ public-keys that you possess, is truly from your friends, please verify that these keys are self-signed (using the private-key of the pair). If a public-key is tempered by a malicious third party, its signature would be altered and you can detect it. NEVER ever trust a public-key that is not self-signed. It also implies that you also must self-sign your public-key (by using your private-key) before you distribute it among your friends.

2. A private-public key pair is very unique and its structure is based on prime-number theories in mathematics. It uses large prime numbers to generate the pair, and current mathematical advances and computer resources are far from breaking the algorithm. Therefore, you are quite safe (well, until now :-)) that any key of the key-pair can be duplicated.

3. There is an universal place to get your friends’ public keys and distribute that of your own. These are called key-servers. Here is a popular key-server at MIT, and here is a global-one that claims to be a global directory for pgp-keys.

4. The original PGP is not free (either as in FREEdom or in FREE-beer). MIT holds its license and it costs money to obtain it. However, thanks to the GPL folks that its open-source implementation, called GNUPG or GPG (in short), also exists. It is available even for Windows. So, if you are interested, please follow the GNUPG website for more. It also describes the concept as well as its usage in a great detail. You may also like to check this PGP for Beginners website to understand the concept.

5. Finally, I have put a test PGP public-key here. You can send me a private, encrypted email using this. However, please verify its self-signature first. Also, note that if you use your private-key to sign your email, I can't verify it, because I don't have your public-key. But I would surely be able to read the encrypted email. Please give it a try.

That’s all for an introduction. I hope this document provided you enough information to begin with. To know its nuts and bolts, please embrace your best friend, Google. In the end, please always keep in mind that to truly secure the privacy of your communication, there is no other way but to take measures by yourselves. Therefore, I actively appreciate the usage of signed and encrypted emails.

If you have any further questions or comments, please leave them below, send me a private message here.

Nepomuk + Strigi --> Resolving the mystery

2009-05-04T23:08:00.000-07:00

Well, last week, I installed Fedora-11-preview on my computer. It was the KDE-Live-CD. The 4.2 interface looked quite impressive.

As I started configuring the Nepomuk search with Strigi indexing in System Settings, all I could found was "Strigi service not running". It took a lot of time to get it work. I googled things but there was not much of help available. So, after I could get the strigi working properly, I decided to write it down, so that others can find it helpful . Here it goes...

NOTE: the # prompt means superuser mode and the $ means normal user mode.

At first, you need to install the strigi. It is not shipped with Fedora-11's KDE Live CD.
"# yum -y install strigi" should do the job.

Now, check if the Nepomuk server is active or not. "$ ps -A|grep nepomuk" should output two processes: (1). nepomukserver and (2). nepomukservices.

These processes are started by default when you log into the KDE. If these are not already running, start it manually:
(1). "$ nepomukserver &"
(2). "$ nepomukservicestub nepomukstrigiservice"

You also need to start the strigi daemon manually by "$ strigidaemon &". As a back check, confirm it by "$ ps -A|grep strigi".

After finishing all these startups, go to System Settings--->Advanced---->Desktop Search, and check the box there saying use nepomuk with strigi for search...and hit the apply button in the bottom. You will see an error message there stating as if strigi service is not running....or something similar.

This is where it sucks and I'll tell you why...

Oversimplifyingly speaking, the default file-manager, Dolphin, uses Nepomuk to manage the matadata to tag and comment on files. The Strigi is used to index the tags, comments, filenames and content of the files. To use strigi's indexed data for searching, the Nepomuk needs some library/backend. It has two available options: Sesame or Redland. However, there are some associated problems with both.

The Sesame is fast but needs all those Java development packages, which is perhaps 200MB+ in size. Given limited space available in the Live-CD release, it can't be included.

The second option, Redland, is ridiculously slow with the strigi's indexed data, but small in size. That's why, the packagers decided to include it with the Live-CD release as the backend for tagging/commenting the files in Dolphin under the Nepomuk layer. However, it is not allowed to fraternize with strigi's data. That's why, you'll see "Strigi service not running"-type of error, even if the strigi services are running actually.

Well, now comes the fixing....and this is where things get crucial a bit...

Install the Sesame package. You can download the source rpm packages and specs from here and build it for your own distribution.

I have build it for the Fedora-11 and you can download it from here. Of course, the easiest way to install it is to issue the yum: "# yum localinstall soprano-backend-sesame2-2.2.3-2.fc11.i386.rpm". It'll take care of all the dependencies as usual.

You can either leave the Redland package installed on the system or remove it, doesn't matter much. The Nepomuk starts using sesame once it finds it.

After all these, you need to reboot your box.

But before doing that, I just got a very interesting stuff for you. Check out Naomi Letizia, the girl who put Silvio Berlusconi's wife out of humour to refresh yourself (-__<).

Well, after the reboot, check the Desktop Search section in the System Setting. It should now show the strigi running and indexing the files. Give it some time. Initially, it will consume some of your CPU % but once done, it behaves very gently and mostly sits idle unnoticed.

To search your files, you can either fire the krunner (Alt+F2) and start typing your keywords. Or, in the Dolphin location bar, type "nepomuksearch:keywords". After hitting the Enter key, it will show the items it has found for you.

I hope this helps. If you have any further questions or comments, plz leave it here.

And yeah, I too find this word, Nepomuk, very odd. This is German(?)!

Configure Realplayer on linux and play various media-players simultaniously and smoooooothly ;)

2007-01-23T17:34:00.000-08:00

Well folks, here is an important tip related to multimedia stuff in Fedora Core 6 (FC6) what I have learned based on my experience with the OS. I hope you will find it useful.

Things related to installation of mplayer, kaffeine, realplayer etc. are available everywhere on internet but there is more to be done as far as realplayer is concerned. Realplayer seems to be co-operating least with other media-players and here is an workaround....lets begin anyway !!

* Login as root first using $ su ;)

* Install RealPlayer from www.real.com. I would recommend to download .bin file for the GOLD version. Once the download is complete:

1. # cd
2. # chmod 755 ./RealPlayer10GOLD.bin
3. # ./RealPlayer10GOLD.bin

This will lead you to installation. Follow the instructions and install it in "/usr/local/RealPlayer" folder and give "/usr/local" as option for creating links. Now, switch to the /usr/local/bin folder using "# cd /usr/local/bin" and check if there is a symbolic link created there as "realplay" pointing to "/usr/local/RealPlayer/realplay" by using the command "# ls -l". If you find no link, create one as follows:

4. # ln -s /usr/local/RealPlayer/realplay

With these steps, you are done with the installation.

* Install the package alsa-oss using yum [# yum -y install alsa-oss]. This establishes a kind of negotiation between oss and alsa. This is a must by the way. (Here, I am assuming that u have set the yum correctly and you are having repos for livna, freshrpms, fedora update, extras etc. already included).

* Now, it's time to edit the realplay script. Do # vim /usr/local/bin/realplay and add the lines:

LD_PRELOAD="$LDPRELOAD:/usr/lib/libaoss.so.0.0.0"
export LD_PRELOAD

Add the above lines just after the section:
if [ -n "$LD_PRELOAD" ]; then
echo "Warning: LD_PRELOAD=\"$LD_PRELOAD\""
fi

Save and exit. Switch back to normal user (no superuser anymore).

Of course, if the library libaoss.so.0.0.0 is located to somewhere else, use that path instead. Sometimes, depending on the version of the alsa-oss package, the libaoss.so.0.0.0 library may not be available. In those cases, try to replace it by libaoss.so.0 or libaoss.so. Use # updatedb; locate libaoss.so to find out which one is available to you.

* Now run realplay as a normal user and follow the instruction what comes with first time run of the realplayer. Once you are done with these instructions, quit the realplayer and edit the file ~/.realplayer. Add the line SoundDriver=2 to it below the [helix] section as it is mentioned at FC6 Tips & Tricks.

* One more thing, go to KDE Control Center -----> Sound System ------> General -------> Auto-suspend if idle after 1 seconds.

Now, it's time to check if things work properly or not. Open realplayer and other media players (e.g. mplayer, kaffeine etc.). After the aforementioned procedure, I didnt have any problem with sound on FC6 anymore.

Also, I would like to mention (my personal choice) that don't install mplayerplug-in. It sucks. Rather, there are many marvelous extensions available with Firefox to deal with online media. I would recommend mediaplayer connectivity. It does excellent job. It redirects online streams to your local media player and so you can use mplayer, kaffeine, realplayer etc. to watch/listen all those streaming stuffs.

Good Luck ;) This is working well on my FC6 box and I hope this would work well on other distros as well. If need any further information in this regard, please leave your comments below.