Linux Bootup Process

1. Hardware poweron
   > hardware test, load BIOS
   > Find boot device (harddisk, cdrom, usb...)

2. Load harddisk & Boot loader (GRUB)
   > Execute boot loader in MBR
   > Boot menu select OS
   > The MBR then needs to know which partitions on the disk have boot loader code specific to their operating systems in their boot sectors and then attempts to boot one of them.

3. Load kernel
   > Load kernel into memory
   > Detect hardware and load the driver
   > pass control on to the kernel

4. Kernel init task
   > Establish memory management
   > detects the type of CPU
   > any additional functionality
  
5. Run the /sbin/init program
   > system check
   > verify the integrity of the file systems
   > start vital programs for operating system to function properly.
   > Inspects the /etc/inittab file to determine operation mode or runlevel
   > launch process depend on runlevel

6. System initialization
   > run /etc/rc.d/rc.sysinit

7. Init run level service

8. Init run file in /etc/rc.d/rc.local

9. Init prepare login environment and wait user login

Linux的各種Distribution分析

ref.: http://www.lawtw.com/article.php?template=article_content&parent_path=,1,777,&article_category_id=817&job_id=4602&article_id=4565



Redhat==Linux忠實擁護著==半封閉式的Open Source

台 灣目前沒有自行研發的Linux Distribution，根據調查，使用率最高的是RedHat Linux，引用國內Linufab的調查資料所知，使用Linux的人52%都使用Redhat，因此Redhat相對性的應用性產品最多，其中 RedHat所研發出來的RPM套件機制更是廣泛被各大Linux Distribution所使用，但是事實上RedHat並非是最好的Distribution，因為其在軟體的安裝上需要各軟體套件高度的相依性 (package dependence)：，常造成一般使用著極大的困擾〈可以參考以下網址http://pc510.ev.ncku.edu.tw/~vbird /linux_redhat7.2/37command_5rpmtarball.html〉，且由於RedHat內含了非標準的系統核心修補程式，這會 讓使用者自行設定系統的時候遇到困難，支援RedHat的軟體不管是商業或非商業軟體最多，這當然是其他Distribution所比不上的優勢。還有一 點就是台灣的非營利性組織CLE專門針對RedHat做繁體中文化的工作。更重要的是當你遇到問題能夠替你解決問題的人也越多。


     Mandrake===新手的Linux==全開放式的Open Source

     Linux Mandrake 發行套件是由 MandrakeSoft 公司所發行的。該公司是在一九九八年由一群 Linux 狂熱者所共同組成，並且努力朝向讓 Linux 易於使用的目標前進。為了達到這個目標，Mandrake 提供了一個極佳的圖形介面安裝程式。
     Mandrake是這一年來最紅的Linux Distribution，其標榜的就是可以跟視窗比美的簡易安裝過程，安裝的過程是所有的Distribution中最容易安裝且最容易做系統多重分割 的喔，而且畫面也最精緻，也許跟這Distribution是法國人發明的原因，所以多了一點法國人的浪費，除此之外他的中文化也做得最 好，Mandrake 著重卓面用戶，在安裝及使用上比較簡單，及採用比較多圖形介面，所以對於新手來說是一個不錯的選擇，如果你是想使用Mandrake作為替代 Windows的系統，推薦你使用Mandrake，但是由於Mandrake是根據RedHat作修改，因此RedHat的缺點Mandrake不只 有，Mandrake更是把它發揚光大，比如rpm的問題，沒有辦法很好的處理隨插即用ISA卡。不過由於它是屬於全開放式的Open Source Liinux ，所以它的軟體研發跟更新速度是非常的快。


     Debian==進階的LInux==穩定性的Open Source

     Debian 於一九九三年八月十六日誕生，主要是希望能提供一個穩定且無問題的 Linux Distribution。Debian 並無企業的支持，完全是由很多的研發人員自行研發，Debian出名在於其穩定性，主要是由於其利用了外掛認證模組讓眾多的研發人員可以處理軟體認證的問 題，也相對的保障了Debian的穩定性。
     問題在於Debian完全是純文字安裝介面，初學著不適合使用這Distribution，甚至連分割都只有類似fdisk的工具，無法自動分割，因此 Debian實在不適合初學著使用，而且由於其講求穩定性，因此該Distribution的核心跟軟體總是比較舊。提到Debian就要提到其最著名的 更新軟體==APT，這軟體是由Debian所研發，其最突出的功能就是能夠非常完整的解決RPM相依性和更新軟體的問題，這軟體能夠良好的解決各 Linux Distribution軟體的安裝和更新問題。


     Suse==歐洲的LInux==良好的系統架構跟資料庫

     提到歐洲的Linux Distribution，RedHat根本不夠看，Susse才是大哥大，SuSe是由德國S.u.S.E. Gmbh於五年前開始發展S.u.S.E. Linux 4.2 是其第一個Distribution，SuSe的優點在於其跟很多的資料庫大廠甲骨文以及 IBM 這類資料庫廠商達成合作夥伴關係，讓他們的資料庫產品能夠在 SuSE Linux 發行套件上面順暢地運作，因此其穩定性跟強調資料庫的特性讓其在歐洲極受歡迎，Debian」的軟體資料庫應該說是是眾家Linux中最完整的，從來源、 作者、ftp、www、patch、管理者都有詳細的記錄，安裝系統也考慮的比RPM來得週到，許多的Distribution都會借用Debian系統 設計的觀念，「Debian」提供「Intel」、「Alpha」、「Motorola 68K」、「Sun SPARC」等眾多版本；此外也正在對「ARM」、「MIPS」、「Sun UltraSPARC」、「GNU Hurd」、「Beowulf」做支援，不僅系統穩定支援也多，對於XWindows的支援也有它的一套。 「Debian」使用族群主要在Linux的進階族群，商業氣息目前不高，銷量並不像其它Distribution那麼好，但其潛在商業價值非常地高。


     OpenLinux==Caldera完全封閉極度商業化 Open Sources

     唯一有在台灣設立分公司的 Linux開發公司，這個月宣佈Caldera OpenLinux 將更改為 SCO Linux powered by UnitedLinux ，Caldera Open Unix 將更改為 SCO UnixWare ，Caldera 夥伴計劃更改為 TeamSCO ，Caldera 全球服務更改為 SCO 全球服務，同時提供Linux 跟 Unix服務。
     OpenLinux在台灣推廣最為積極，不僅設立公司而且跟翔威資訊還有聯成電腦合作開發認證課程合作，因此有不少的公司採用該系統，不過由於該公司採 用封閉式的方式開發Open Linux所以軟體跟核心的更新速度極漫，不是很受開放性社群的歡迎，但是由於其封閉式的特性使得該公司對於核心的掌握跟軟體的穩定性提供了極佳的保障， 這也是為何它是除了RedHat外賣得最好的Distribution。

Cache 50 Windows logins for better availability (快取的網域登入資訊)

ref.: http://support.microsoft.com/kb/172931

快取 Windows 記憶體前一個使用者的登入資訊在本機，以便如果在更新登入嘗試時無法使用登入伺服器，它們可以登入。

快取登入資訊由下列機碼控制:
Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"cachedlogonscount"="0 - 50"           

Virtualization - VMLite XP Mode

ref.: http://www.vmlite.com/index.php/products/vmlite-xp-mode

• Provides similar functions as Virtual PC and Windows XP Mode from Microsoft
• No requirement for hardware-assisted virtualization, namely, it runs without VT-x or AMD-v
• Provides seamless integration with host desktop to run applications from Windows XP virtual machine
• Host files can be accessed from within the XP Mode virtual machine easily
• Control-C/V can be used to copy files and other contexts between host and vm, between different vms.
• Support 3rd party virtual machine images: VMDK, VHD, VDI, HDD
• Runs on any PC with Windows XP and above as host operating systems
• Highly performed, XP Mode boots in 20 seconds
• Supports XP, Vista, Windows 7, 2003 server, 2008 server as guest, for example, you can run Windows 7 on XP to have similar integration features
• Supports Virtual Application Mode - if you start a vm application from host Start menu, this program is launched within a special context, called "Virtual Application Mode", where My Documents, My Desktop, and other special shell folders will be redirected to the host. For example, if you launch XP Mode Word from host Start menu, you will see green borders, and when you save a new document to My Documents, it will be actually saved to your host My Documents folder.

Ubuntu pppoe dialup problem with Network Manager

Step1: ensure eth is ready
Step2: >sudo service network-manager stop
Step3: >sudo pppoeconf
Step4(optional): add nameserver to /etc/resolv.conf

Mozilla Firefox & Thunderbird remove master password

Method 1: Go to Documents and Settings\username\Application Data\Mozilla\Firefox\Profiles\xxxxxxx.default and rename key3.db to key3.db.bak

Method 2: run the url chrome://pippki/content/resetpassword.xul and press the reset buttom.
For thunderbird, you can evaluate the url in Tools>Error console.

IDS vs. IPS Explained

Layered security is the key to protecting any size network, and for most companies, that means deploying both intrusion detection systems (IDS) and intrusion prevention systems (IPS). When it comes to IPS and IDS, it?s not a question of which technology to add to your security infrastructure ? both are required for maximum protection against malicious traffic. In fact, vendors are increasingly combining the two technologies into a single box.

IDS
At its most basic, an IDS device is passive, watching packets of data traverse the network from a monitoring port, comparing the traffic to configured rules, and setting off an alarm if it detects anything suspicious. An IDS can detect several types of malicious traffic that would slip by a typical firewall, including network attacks against services, data-driven attacks on applications, host-based attacks like unauthorized logins, and malware like viruses, Trojan horses, and worms. Most IDS products use several methods to detect threats, usually signature-based detection, anomaly-based detection, and stateful protocol analysis.

IPS
At its most basic, an IPS has all the features of a good IDS, but can also stop malicious traffic from invading the enterprise. Unlike an IDS, an IPS sits inline with traffic flows on a network, actively shutting down attempted attacks as they?re sent over the wire. It can stop the attack by terminating the network connection or user session originating the attack, by blocking access to the target from the user account, IP address, or other attribute associated with that attacker, or by blocking all access to the targeted host, service, or application.

In addition, an IPS can respond to a detected threat in two other ways. It can reconfigure other security controls, such as a firewall or router, to block an attack. Some IPS devices can even apply patches if the host has particular vulnerabilities. In addition, some IPS can remove the malicious contents of an attack to mitigate the packets, perhaps deleting an infected attachment from an email before forwarding the email to the user.