screen(1) not only allows one terminal window to work with multiple processes, but also allows remote shell process to survive interrupted connections. Here is a typical use scenario of screen(1).

	Tip
	You can save connection fees with screen for metered network connections such as dial-up and packet ones, because you can leave a process active while disconnected, and then re-attach it later when you connect again.

In a screen session, all keyboard inputs are sent to your current window except for the command keystroke. All screen command keystrokes are entered by typing ^A ("Control-A") plus a single key [plus any parameters]. Here are important ones to remember.

See screen(1) for details.

Many programs record their activities under the "/var/log/" directory.

See Section 3.5.9, “The system message” and Section 3.5.10, “The kernel message”.

Here are notable log analyzers ("~Gsecurity::log-analyzer" in aptitude(8)).

	Note
	CRM114 provides language infrastructure to write fuzzy filters with the TRE regex library. Its popular use is spam mail filter but it can be used as log analyzer.

The simple use of script(1) (see Section 1.4.9, “Recording the shell activities”) to record shell activity produces a file with control characters. This can be avoided by using col(1) as the following.

$ script
Script started, file is typescript

Do whatever … and press Ctrl-D to exit script.

$ col -bx <typescript >cleanedfile
$ vim cleanedfile

If you don't have script (for example, during the boot process in the initramfs), you can use following instead.

$ sh -i 2>&1 | tee typescript

	Tip
	Some x-terminal-emulator such as gnome-terminal can record. You may wish to extend line buffer for scrollback.

	Tip
	You may use screen(1) with "^A H" (see Section 9.1.2, “Key bindings for the screen command”) to perform recording of console.

	Tip
	You may use emacs(1) with "M-x shell", "M-x eshell", or "M-x term" to perform recording of console. You may later use "C-x C-w" to write the buffer to a file.

Although pager tools such as more(1) and less(1) (see Section 1.4.5, “The pager”) and custom tools for highlighting and formatting (see Section 11.1.7, “Highlighting and formatting plain text data”) can display text data nicely, general purpose editors (see Section 1.4.6, “The text editor”) are most versatile and customizable.

	Tip
	For vim(1) and its pager mode alias view(1), ":set hls" enables highlighted search.

The default display format of time and date by the "ls -l" command depends on the locale (see Section 1.2.6, “Timestamps” for value). The "$LANG" variable is referred first and it can be overridden by the "$LC_TIME" variable.

The actual default display format for each locale depends on the version of the standard C library (the libc6 package) used. I.e., different releases of Debian had different defaults.

If you really wish to customize this display format of time and date beyond the locale, you should set the time style value by the "--time-style" argument or by the "$TIME_STYLE" value (see ls(1), date(1), "info coreutils 'ls invocation'").

	Tip
	You can eliminate typing long option on commandline using command alias, e.g. "alias ls='ls --time-style=+%d.%m.%y\ %H:%M'" (see Section 1.5.9, “Command alias”).

	Tip
	ISO 8601 is followed for these iso-formats.

Shell echo to most modern terminals can be colorized using ANSI escape code (see "/usr/share/doc/xterm/ctlseqs.txt.gz").

For example, try the following

$ RED=$(printf "\x1b[31m")
$ NORMAL=$(printf "\x1b[0m")
$ REVERSE=$(printf "\x1b[7m")
$ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"

Colorized commands are handy for inspecting their output in the interactive environment. I include the following in my "~/.bashrc".

if [ "$TERM" != "dumb" ]; then
    eval "`dircolors -b`"
    alias ls='ls --color=always'
    alias ll='ls --color=always -l'
    alias la='ls --color=always -A'
    alias less='less -R'
    alias ls='ls --color=always'
    alias grep='grep --color=always'
    alias egrep='egrep --color=always'
    alias fgrep='fgrep --color=always'
    alias zgrep='zgrep --color=always'
else
    alias ll='ls -l'
    alias la='ls -A'
fi

The use of alias limits color effects to the interactive command usage. It has advantage over exporting environment variable "export GREP_OPTIONS='--color=auto'" since color can be seen under pager programs such as less(1). If you wish to suppress color when piping to other programs, use "--color=auto" instead in the above example for "~/.bashrc".

	Tip
	You can turn off these colorizing aliases in the interactive environment by invoking shell with "TERM=dumb bash".

There are few ways to record the graphic image of an X application, including an xterm display.

There are specialized tools to record changes in configuration files with help of DVCS system.

I recommend to use the etckeeper package with git(1) which put entire "/etc" under VCS control. Its installation guide and tutorial are found in "/usr/share/doc/etckeeper/README.gz".

Essentially, running "sudo etckeeper init" initializes the git repository for "/etc" just like the process explained in Section 10.8.4, “Git for recording configuration history”) but with special hook scripts for more thorough setups.

As you change your configuration, you can use git(1) normally to record them. It automatically records changes nicely every time you run package management commands, too.

	Tip
	You can browse the change history of "/etc" by executing "sudo GIT_DIR=/etc/.git gitk" with clear view for new installed packages, removed packages, and version changes of packages.

For disk partition configuration, although fdisk(8) has been considered standard, parted(8) deserves some attention. "Disk partitioning data", "partition table", "partition map", and "disk label" are all synonyms.

Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).

	Note
	Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector.

Although fdisk(8) has been standard for the disk partitioning tool, parted(8) is replacing it.

	Caution
	Although parted(8) claims to create and to resize filesystem too, it is safer to do such things using best maintained specialized tools such as mkfs(8) (mkfs.msdos(8), mkfs.ext2(8), mkfs.ext3(8), …) and resize2fs(8).

	Note
	In order to switch between GPT and MBR, you need to erase first few blocks of disk contents directly (see Section 10.2.13, “Clearing file contents”) and use "parted /dev/sdx mklabel gpt" or "parted /dev/sdx mklabel msdos" to set it. Please note "msdos" is use here for MBR.

Although reconfiguration of your partition or activation order of removable storage media may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.

	Tip
	You can probe UUID of a block special device with vol_id(8).

	Tip
	Device nodes of devices such as removable storage media can be made static by using udev rules, if needed. See Section 3.5.11, “The udev system”.

For ext3 filesystem, the e2fsprogs package provides the following.

The mkfs(8) and fsck(8) commands are provided by the e2fsprogs package as front-ends to various filesystem dependent programs (mkfs.fstype and fsck.fstype). For ext3 filesystem, they are mkfs.ext3(8) and fsck.ext3(8) (they are hardlinked to mke2fs(8) and e2fsck(8)).

Similar commands are available for each filesystem supported by Linux.

	Tip
	Ext3 filesystem is the default filesystem for the Linux system and strongly recommended to use it unless you have some specific reasons not to. After Linux kernel 2.6.30 (Debian squeeze), ext4 filesystem is available and expected to be the default filesystem for the Linux system. btrfs filesystem is expected to be the next default filesystem after ext4 filesystem for the Linux system.

	Warning
	You might face some limitations with ext4 since it is new. For example, you must have Linux kernel 2.6.30 or later if you wish to resize an ext4 partition.

	Tip
	Some tools allow access to filesystem without Linux kernel support (see Section 10.2.6, “Manipulating files without mounting disk”).

The mkfs(8) command creates the filesystem on a Linux system. The fsck(8) command provides the filesystem integrity check and repair on a Linux system.

	Caution
	It is generally not safe to run fsck on mounted filesystems.

	Tip
	Check files in "/var/log/fsck/" for the result of the fsck(8) command run from the boot script.

	Tip
	Use "shutdown -F -r now" to force to run the fsck(8) command safely on all filesystems including root filesystem on reboot. See the shutdown(8) manpage for more.

Performance and characteristics of a filesystem can be optimized by mount options used on it (see fstab(5) and mount(8)). Notable ones are the following.

	Tip
	You need to provide kernel boot parameter (see Section 3.3, “Stage 2: the boot loader”), e.g. "rootflags=data=journal" to deploy a non-default journaling mode for the root filesystem. For lenny, the default jounaling mode is "rootflags=data=ordered". For squeeze, it is "rootflags=data=writeback".

Characteristics of a filesystem can be optimized via its superblock using the tune2fs(8) command.

	Warning
	Filesystem conversion for the boot device to the ext4 filesystem should be avoided until GRUB boot loader supports the ext4 filesystem well and installed Linux Kernel version is newer than 2.6.30.

	Tip
	Despite its name, tune2fs(8) works not only on the ext2 filesystem but also on the ext3 and ext4 filesystems.

	Warning
	Please check your hardware and read manpage of hdparam(8) before playing with hard disk configuration because this may be quite dangerous for the data integrity.

You can test disk access speed of a hard disk, e.g. "/dev/hda", by "hdparm -tT /dev/hda". For some hard disk connected with (E)IDE, you can speed it up with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda" by enabling the "(E)IDE 32-bit I/O support", enabling the "using_dma flag", setting "interrupt-unmask flag", and setting the "multiple 16 sector I/O" (dangerous!).

You can test write cache feature of a hard disk, e.g. "/dev/sda", by "hdparm -W /dev/sda". You can disable its write cache feature with "hdparm -W 0 /dev/sda".

You may be able to read badly pressed CDROMs on modern high speed CD-ROM drive by slowing it down with "setcd -x 2.

You can monitor and log your hard disk which is compliant to SMART with the smartd(8) daemon.

	Tip
	The smartd(8) daemon can be customized with the /etc/smartd.conf file including how to be notified of warnings.

For partitions created on Logical Volume Manager (LVM) (Linux feature) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.

	Caution
	Deployment of the current LVM system may degrade guarantee against filesystem corruption offered by journaled filesystems such as ext3fs unless their system performance is sacrificed by disabling write cache of hard disk.

If you have an empty partition (e.g., "/dev/sdx"), you can format it with mkfs.ext3(1) and mount(8) it to a directory where you need more space. (You need to copy original data contents.)

$ sudo mv work-dir old-dir
$ sudo mkfs.ext3 /dev/sdx
$ sudo mount -t ext3 /dev/sdx work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir

	Tip
	You may alternatively mount an empty disk image file (see Section 10.2.4, “Making an empty disk image file”) as a loop device (see Section 10.2.3, “Mounting the disk image file”). The actual disk usage grows with the actual data stored.

If you have an empty directory (e.g., "/path/to/emp-dir") in another partition with usable space, you can create a symlink to the directory with ln(8).

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo ln -sf /path/to/emp-dir work-dir
$ sudo cp -a old-dir/* work-dir
$ sudo rm -rf old-dir

	Caution
	Some software may not function well with "symlink to a directory".

If you have usable space in another partition (e.g., "/path/to/"), you can create a directory in it and stack that on to a directory where you need space with aufs.

$ sudo mv work-dir old-dir
$ sudo mkdir -p /path/to/emp-dir
$ sudo mount -t aufs -o br:/path/to/emp-dir:old-dir none work-dir

	Caution
	Use of aufs for long term data storage is not good idea since it is under development and its design change may introduce issues.

	Tip
	In order to use aufs, its utility package aufs-tools and kernel module package for aufs such as aufs-modules-2.6-amd64 need to be installed.

	Tip
	aufs is used to provide writable root filesystem by many modern live CD projects.

You can encrypt contents of removable mass devices, e.g. USB memory stick on "/dev/sdx", using dm-crypt/LUKS. You simply formatting it as the following.

# badblocks -c 10240 -s -w -t random -v /dev/sdx
# shred -v -n 1 /dev/sdx
# fdisk /dev/sdx
... "n" "p" "1" "return" "return" "w"
# cryptsetup luksFormat /dev/sdx1
...
# cryptsetup luksOpen /dev/sdx1 sdx1
...
# ls -l /dev/mapper/
total 0
crw-rw---- 1 root root  10, 60 2008-10-04 18:44 control
brw-rw---- 1 root disk 254,  0 2008-10-04 23:55 sdx1
# mkfs.vfat /dev/mapper/sdx1
...
# cryptsetup luksClose sdx1

Then, it can be mounted just like normal one on to "/media/<disk_label>", except for asking password (see Section 10.1.10, “Removable storage device”) under modern desktop environment, such as GNOME using gnome-mount(1). The difference is that every data written to it is encrypted. You may alternatively format media in different file format, e.g., ext3 with "mkfs.ext3 /dev/sdx1".

	Note
	If you are really paranoid for the security of data, you may need to overwrite multiple times in the above example. This operation is very time consuming though.

Let's assume that your original "/etc/fstab" contains the following.

/dev/sda7 swap sw 0 0

You can enable encrypted swap partition using dm-crypt by as the following.

# aptitude install cryptsetup
# swapoff -a
# echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab
# perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab
# /etc/init.d/cryptdisks restart
 ...
# swapon -a

You can encrypt files written under "~/Private/" automatically using eCryptfs and the ecryptfs-utils package.

	Tip
	Since eCryptfs selectively encrypt only the sensitive files, its system cost is much less than using dm-crypt on the entire root or "/home" device. It does not require any special on-disk storage allocation effort but cannot keep all filesystem metadata confidential.

If you use your login password for wrapping encryption keys, you can automate mounting eCryptfs via PAM (Pluggable Authentication Modules).

Insert the following line just before "pam_permit.so" in "/etc/pam.d/common-auth".

auth required pam_ecryptfs.so unwrap

Insert the following line just at the last line in "/etc/pam.d/common-session".

session optional pam_ecryptfs.so unwrap

Insert the following line at first active line in "/etc/pam.d/common-password".

password required pam_ecryptfs.so

This is quite convenient.

	Warning
	Configuration errors of PAM may lock you out of your own system. See Chapter 4, Authentication.

	Caution
	If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see Section 4.3, “Good password”). Unless you are careful to set up a strong password, your data is at risk when someone runs password cracking software after stealing your laptop (see Section 4.7.4, “Securing the root password”).

Display time used by the process invoked by the command.

# time some_command >/dev/null
real    0m0.035s       # time on wall clock (elapsed real time)
user    0m0.000s       # time in user mode
sys     0m0.020s       # time in kernel mode

A nice value is used to control the scheduling priority for the process.

# nice  -19 top                                      # very nice
# nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # very fast

Sometimes an extreme nice value does more harm than good to the system. Use this command carefully.

The ps(1) command on the Debian support both BSD and SystemV features and helps to identify the process activity statically.

For the zombie (defunct) children process, you can kill them by the parent process ID identified in the "PPID" field.

The pstree(1) command display a tree of processes.

top(1) on the Debian has rich features and helps to identify what process is acting funny dynamically.

You can list all files opened by a process with a process ID (PID), e.g. 1, by the following.

$ sudo lsof -p 1

PID=1 is usually init program.

You can trace program activity with strace(1), ltrace(1), or xtrace(1) for system calls and signals, library calls, or communication between X11 client and server.

You can trace system calls of the ls command as the following.

$ sudo strace ls

You can also identify processes using files by fuser(1), e.g. for "/var/log/mail.log" by the following.

$ sudo fuser -v /var/log/mail.log
                     USER        PID ACCESS COMMAND
/var/log/mail.log:   root       2946 F.... syslogd

You see that file "/var/log/mail.log" is open for writing by the syslogd(8) command.

You can also identify processes using sockets by fuser(1), e.g. for "smtp/tcp" by the following.

$ sudo fuser -v smtp/tcp
                     USER        PID ACCESS COMMAND
smtp/tcp:            Debian-exim   3379 F.... exim4

Now you know your system runs exim4(8) to handle TCP connections to SMTP port (25).

watch(1) executes a program repeatedly with a constant interval while showing its output in fullscreen.

$ watch w

This displays who is logged on to the system updated every 2 seconds.

There are several ways to repeat a command looping over files matching some condition, e.g. matching glob pattern "*.ext".

for x in *.ext; do if [ -f "$x"]; then command "$x" ; fi; done

find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 command

find . -type f -maxdepth 1 -name '*.ext' -exec command '{}' \;

find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "command '{}' && echo 'successful'" \;

The above examples are written to ensure proper handling of funny file names such as ones containing spaces. See Section 10.1.5, “Idioms for the selection of files” for more advance uses of find(1).

You can set up to start a process from graphical user interface (GUI).

Under GNOME desktop environment, a program can be started with proper argument by double-clicking the launcher icon, by drag-and-drop of a file icon to the launcher icon, or by "Open with …" menu via right clicking a file icon. KDE can do the equivalent, too.

Here is an example under GNOME to create a launcher icon for mc(1) started in gnome-terminal(1).

Create an executable program "mc-term" by the following.

# cat >/usr/local/bin/mc-term <<EOF
#!/bin/sh
gnome-terminal -e "mc \$1"
EOF
# chmod 755 /usr/local/bin/mc-term

Create a desktop launcher as the following.

Create an open-with association as as the following.

	Tip
	Launcher is a file at "~/Desktop" with ".desktop" as its extension.

Some programs start another program automatically. Here are check points for customizing this process.

	Tip
	update-mime(8) updates the "/etc/mailcap" file using "/etc/mailcap.order" file (see mailcap.order(5)).

	Tip
	The debianutils package provides sensible-browser(1), sensible-editor(1), and sensible-pager(1) which make sensible decisions on which editor, pager, and web browser to call, respectively. I recommend you to read these shell scripts.

	Tip
	In order to run a console application such as mutt under X as your preferred application, you should create an X application as following and set "/usr/local/bin/mutt-term" as your preferred application to be started as described.

# cat /usr/local/bin/mutt-term <<EOF
#!/bin/sh
gnome-terminal -e "mutt \$@"
EOF
chmod 755 /usr/local/bin/mutt-term

Use kill(1) to kill (or send a signal to) a process by the process ID.

Use killall(1) or pkill(1) to do the same by the process command name and other attributes.

Run the at(1) command to schedule a one-time job by the following.

$ echo 'command -args'| at 3:40 monday

Use cron(8) to schedule tasks regularly. See crontab(1) and crontab(5).

If you are a member of crontab group, you can schedule to run processes as a normal user, e.g. foo by creating a crontab(5) file as "/var/spool/cron/crontabs/foo" with "crontab -e" command.

Here is an example of a crontab(5) file.

# use /bin/sh to run commands, no matter what /etc/passwd says
SHELL=/bin/sh
# mail any output to paul, no matter whose crontab this is
MAILTO=paul
# Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed)
# run at 00:05, every day
5  0  *  * *   $HOME/bin/daily.job >> $HOME/tmp/out 2>&1
# run at 14:15 on the first of every month -- output mailed to paul
15 14 1  * *   $HOME/bin/monthly
# run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc:
0 22 *   * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%%
23 */2 1 2 *   echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1"
5  4 *   * sun echo "run at 04:05 every Sunday"
# run at 03:40 on the first Monday of each month
40 3 1-7 * *   [ "$(date +%a)" == "Mon" ] && command -args

	Tip
	For the system not running continuously, install the anacron package to schedule periodic commands at the specified intervals as closely as machine-uptime permits. See anacron(8) and anacrontab(5).

	Tip
	For scheduled system maintenance scripts, you can run them periodically from root account by placing such scripts in "/etc/cron.hourly/", "/etc/cron.daily/", "/etc/cron.weekly/", or "/etc/cron.monthly/". Execution timings of these scripts can be customized by "/etc/crontab" and "/etc/anacrontab".

Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system.

The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations.

See "/usr/share/doc/linux-doc-2.6.*/Documentation/sysrq.txt.gz".

	Caution
	The Alt-SysRq feature may be considered a security risk by allowing users access to root-privileged functions. Placing "echo 0 >/proc/sys/kernel/sysrq" in "/etc/rc.local" or "kernel.sysrq = 0" in "/etc/sysctl.conf" disables the Alt-SysRq feature.

	Tip
	From SSH terminal etc., you can use the Alt-SysRq feature by writing to the "/proc/sysrq-trigger". For example, "echo s > /proc/sysrq-trigger; echo u > /proc/sysrq-trigger" from the root shell prompt syncs and umounts all mounted filesystems.

You can check who is on the system by the following.

	Tip
	"/var/run/utmp", "/var/log/wtmp", and "/var/run/utmp" hold such user information. See login(1) and utmp(5).

You can send message to everyone who is logged on to the system with wall(1) by the following.

$ echo "We are shutting down in 1 hour" | wall

For the PCI-like devices (AGP, PCI-Express, CardBus, ExpressCard, etc.), lspci(8) (probably with "-nn" option) is a good start for the hardware identification

Alternatively, you can identify the hardware by reading contents of "/proc/bus/pci/devices" or browsing directory tree under "/sys/bus/pci" (see Section 1.2.12, “procfs and sysfs”).

Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.

Here, ACPI is a newer framework for the power management system than APM.

The following sets system and hardware time to MM/DD hh:mm, CCYY.

# date MMDDhhmmCCYY
# hwclock --utc --systohc
# hwclock --show

Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UT(GMT).

If the hardware (BIOS) time is set to UT, change the setting to "UTC=yes" in the "/etc/default/rcS".

If you wish to update system time via network, consider to use the NTP service with the packages such as ntp, ntpdate, and chrony.

See the following.

	Tip
	ntptrace(8) in the ntp package can trace a chain of NTP servers back to the primary source.

There are several components to configure character console and ncurses(3) system features.

If the terminfo entry for xterm doesn't work with a non-Debian xterm, change your terminal type, "$TERM", from "xterm" to one of the feature-limited versions such as "xterm-r6" when you log in to a Debian system remotely. See "/usr/share/doc/libncurses5/FAQ" for more. "dumb" is the lowest common denominator for "$TERM".

Device drivers for sound cards for current Linux 2.6 are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.

Run "dpkg-reconfigure linux-sound-base" to select the sound system to use ALSA via blacklisting of kernel modules. Unless you have very new sound hardware, udev infrastructure should configure your sound system.

	Tip
	Use "cat /dev/urandom > /dev/audio" or speaker-test(1) to test speaker. (^C to stop)

	Tip
	If you can not get sound, your speaker may be connected to a muted output. Modern sound system has many outputs. alsamixer(1) in the alsa-utils package is useful to configure volume and mute settings.

Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.

There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.

For disabling the screen saver, use following commands.

One can always unplug the PC speaker to disable beep sounds. Removing pcspkr kernel module does this for you.

The following prevents the readline(3) program used by bash(1) to beep when encountering "\a" (ASCII=7).

$ echo "set bell-style none">> ~/.inputrc

The kernel boot message in the "/var/log/dmesg" contains the total exact size of available memory.

free(1) and top(1) display information on memory resources on the running system.

$ grep '\] Memory' /var/log/dmesg
[    0.004000] Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init)
$ free -k
             total       used       free     shared    buffers     cached
Mem:        997184     976928      20256          0     129592     171932
-/+ buffers/cache:     675404     321780
Swap:      4545576          4    4545572

	Tip
	Do not worry about the large size of "used" and the small size of "free" in the "Mem:" line, but read the one under them (675404 and 321780 in the example below) and relax.

For my MacBook with 1GB=1048576k DRAM (video system steals some of this), I see the following.

Poor system maintenance may expose your system to external exploitation.

For system security and integrity check, you should start with the following.

Here is a simple script to check for typical world writable incorrect file permissions.

# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)

	Caution
	Since the debsums package uses MD5 checksums stored locally, it can not be fully trusted as the system security audit tool against malicious attacks.

There are few notable features on Linux kernel 2.6 compared to 2.4.

Most normal programs don't need kernel headers and in fact may break if you use them directly for compiling. They should be compiled against the headers in "/usr/include/linux" and "/usr/include/asm" provided by the libc6-dev package (created from the glibc source package) on the Debian system.

	Note
	For compiling some kernel-specific programs such as the kernel modules from the external source and the automounter daemon (amd), you must include path to the corresponding kernel headers, e.g. "-I/usr/src/linux-particular-version/include/", to your command line. module-assistant(8) (or its short form m-a) helps users to build and install module package(s) easily for one or more custom kernels.

Debian has its own method of compiling the kernel and related modules.

If you use initrd in Section 3.3, “Stage 2: the boot loader”, make sure to read the related information in initramfs-tools(8), update-initramfs(8), mkinitramfs(8) and initramfs.conf(5).

	Warning
	Do not put symlinks to the directories in the source tree (e.g. "/usr/src/linux*") from "/usr/include/linux" and "/usr/include/asm" when compiling the Linux kernel source. (Some outdated documents suggest this.)

	Note
	When compiling the latest Linux kernel on the Debian stable system, the use of backported latest tools from the Debian unstable may be needed.

The Debian standard method for compiling kernel source to create a custom kernel package uses make-kpkg(1). The official documentation is in (the bottom of) "/usr/share/doc/kernel-package/README.gz". See kernel-pkg.conf(5) and kernel-img.conf(5) for customization.

Here is an example for amd64 system.

# aptitude install linux-tree-<version>
$ cd /usr/src
$ tar -xjvf linux-source-<version>.tar.bz2
$ cd linux-source-<version>
$ cp /boot/config-<oldversion> .config
$ make menuconfig
 ...
$ make-kpkg clean
$ fakeroot make-kpkg --append_to_version -amd64 --initrd --revision=rev.01 kernel_image modules_image
$ cd ..
# dpkg -i linux-image*.deb

Reboot to new kernel with "shutdown -r now".

	Caution
	When you intend to create a non-modularized kernel compiled only for one machine, invoke make-kpkg without "--initrd" option since initrd is not used. Invocation of "make oldconfig" and "make dep" are not required since "make-kpkg kernel_image" invokes them.

The Debian standard method for creating and installing a custom module package for a custom kernel package uses module-assistant(8) and module-source packages. For example, the following builds the unionfs kernel module package and installs it.

$ sudo aptitude install module-assistant
...
$ sudo aptitude install unionfs-source unionfs-tools unionfs-utils
$ sudo m-a update
$ sudo m-a prepare
$ sudo m-a auto-install unionfs
...
$ sudo apt-get autoremove

You can still build Linux kernel from the pristine sources with the classic method. You must take care the details of the system configuration manually.

$ cd /usr/src
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-<version>.tar.bz2
$ tar -xjvf linux-<version>.tar.bz2
$ cd linux-<version>
$ cp /boot/config-<version> .config
$ make menuconfig
 ...
$ make dep; make bzImage
$ make modules
# cp ./arch/x86_64/boot/bzImage /boot/vmlinuz-<version>
# make modules_install
# depmod -a
# update-initramfs -c -k <version>

Set up bootloader by the following.

Reboot to new kernel with "shutdown -r now".

Although most of hardware drivers are available as free software and as a part of the Debian system, you may need to load some non-free external drivers to support some hardwares, such as Winmodem, on your system.

Check pertinent resources.

Virturization involves 2 steps.

There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.

See Wikipedia article Comparison of virtual machines for detail comparison of different virtualization solutions.

chroot(8) offers most basic way to run different instances of the GNU/Linux environment on a single system simultaneously without rebooting.

	Caution
	Examples below assumes both parent system and chroot system share the same CPU architecture.

You can learn how to setup and use chroot(8) by running pbuilder(8) program under script(1) as follows.

$ sudo mkdir /sid-root
$ sudo pbuilder --create --no-targz --debug --buildplace /sid-root

You see how debootstrap(8) or cdebootstrap(1) populate system data for sid environment under "/sid-root".

	Tip
	These debootstrap(8) or cdebootstrap(1) are used to install Debian by the Debian Installer. These can also be used to install Debian to a system without using a Debian install disk, but instead from another GNU/Linux distribution.

$ sudo pbuilder --login --no-targz  --debug --buildplace /sid-root

You see how a system shell running under sid environment is created as the following.

	Note
	Some programs under chroot may require access to more files from the parent system to function than pbuilder provides. For example, "/sys", "/etc/passwd", "/etc/group", "/var/run/utmp", "/var/log/wtmp", etc. may need to be bind-mounted or copied.

	Note
	The "/usr/sbin/policy-rc.d" file prevents daemon programs to be started automatically on Debian system. See "/usr/share/doc/sysv-rc/README.policy-rc.d.gz".

	Tip
	The original purpose of the specialized chroot package, pbuilder is to construct a chroot system and builds a package inside the chroot. It is an ideal system to use to check that a package's build-dependencies are correct, and to be sure that unnecessary and wrong build dependencies do not exist in the resulting package.

	Tip
	Similar schroot package may give you an idea to run i386 chroot system under amd64 parent system.

	Tip
	By installing a system into a separate partition using the installer of other distributions and using this system for chroot(8), you can run other distributions under chroot(8).

You can run another login process on a separate virtual terminal where you can log in to the chroot system directly. Since on default Debian systems tty1 to tty6 run Linux consoles and tty7 runs the X Window System, let's set up tty8 for a chrooted console as an example. After creating a sid chroot system under "/sid-root" by following steps you learned from pbuilder(8), type from the root shell of the main system.

main # echo "8:23:respawn:/usr/sbin/chroot /sid-root /sbin/getty 38400 tty8"  >> /etc/inittab
main # init q

Reload init(8).