目次
Here, I will describe basic tips to configure and manage systems, mostly from the console.
screen
(1) is a very useful tool for people to access
remote sites via unreliable or intermittent connections since it support
interrupted network connections.
表9.1 List of programs to support interrupted network connections.
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
screen |
V:11, I:31 | 1036 | terminal multiplexer with VT100/ANSI terminal emulation |
screen
(1) not only allows one terminal window to work
with multiple processes, but also allows remote
shell process to survive interrupted connections. Here is a
typical use scenario of screen
(1).
screen
on a single console.
screen
windows created
with ^A c
("Control-A" followed by "c").
screen
windows by
^A n
("Control-A" followed by "n").
You detach the screen
session by any methods such as:
^A d
("Control-A" followed by "d") and manually
logging out from the remote connection, or
^A DD
("Control-A" followed by "DD") to have
screen
detach and log you out.
screen
as "screen -r
".
screen
will magically reattach all previous screen
windows with all actively running programs.
![]() |
ティップ |
---|---|
You can save connection fees for metered network connections such as dial-up and packet ones, because you can leave a process active while disconnected, and then re-attach it later when you connect again. |
In a screen
session, all keyboard inputs are sent to your
current window except for the command keystroke, by default
^A
("Control-A"). All screen
commands
are entered by typing ^A
plus a single key [plus any
parameters]. Here are important ones to remember:
表9.2 screenキーバインディングのリスト。
キーバインディング | 意味 |
---|---|
^A ?
|
show a help screen (display key bindings) |
^A c
|
create a new window and switch to it |
^A n
|
go to next window |
^A p
|
go to previous window |
^A 0
|
go to window number 0 |
^A 1
|
go to window number 1 |
^A w
|
show a list of windows |
^A a
|
send a Ctrl-A to current window as keyboard input |
^A h
|
write a hardcopy of current window to file |
^A H
|
begin/end logging current window to file |
^A ^X
|
lock the terminal (password protected) |
^A d
|
detach screen session from the terminal |
^A DD
|
detach screen session and log out |
See screen
(1) for details.
Many programs record their activities under the
"/var/log/
" directory.
klogd
(8)
syslogd
(8)
See 「システムメッセージ」 and 「カーネルメッセージ」.
Here are notable log analyzers
("~Gsecurity::log-analyzer
" in
aptitude
(8)).
表9.3 List of system log analyzers.
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
logwatch |
V:2, I:3 | 2312 | log analyser with nice output written in Perl |
fail2ban |
V:3, I:3 | 616 | 複数回の認証エラーを発生させるIPを使用禁止とする |
analog |
V:1.4, I:17 | 4612 | web server log analyzer |
awstats |
V:1.7, I:3 | 5100 | powerful and featureful web server log analyzer |
sarg
|
V:1.6, I:1.8 | 1448 | squid analysis report generator |
pflogsumm |
V:0.3, I:0.7 | 164 | Postfix log entry summarizer |
syslog-summary |
V:0.2, I:1.0 | 80 | summarize the contents of a syslog log file |
lire
|
V:0.17, I:0.2 | 5056 | full-featured log analyzer and report generator |
fwlogwatch |
V:0.13, I:0.2 | 432 | Firewall log analyzer |
squidview |
V:0.11, I:0.6 | 260 | monitors and analyses squid access.log files |
visitors |
V:0.10, I:0.3 | 224 | fast web server log analyzer |
swatch |
V:0.08, I:0.2 | 112 | Log file viewer with regexp matching, highlighting, & hooks |
crm114 |
V:0.07, I:0.2 | 1164 | The Controllable Regex Mutilator and Spam Filter (CRM114) |
icmpinfo |
V:0.06, I:0.3 | 84 | Interpret ICMP messages |
![]() |
注意 |
---|---|
CRM114 provides language infrastructure to write fuzzy filters with the TRE regex library. Its popular use is spam mail filter but it can be used as log analyzer. |
The simple use of script
(1) (see 「シェル活動の記録」) to record shell activity
produces a file with control characters. This can be avoided by using
col
(1):
$ script Script started, file is typescript
Ctrl-D
to exit script
$ col -bx <typescript >cleanedfile $ vim cleanedfile
If you don't have script
(for example, during the boot
process in the initramfs), you can use following instead:
$ sh -i 2>&1 | tee typescript
![]() |
ティップ |
---|---|
Some |
![]() |
ティップ |
---|---|
You may use |
![]() |
ティップ |
---|---|
You may use |
Although pager tools such as more
(1) and
less
(1) (see 「ページャ」) and custom
tools for highlighting and formatting 「Highlighting and formatting plain text data」 can display text
data nicely, general purpose editors (see 「テキストエディタ」) are most versatile and customizable.
![]() |
ティップ |
---|---|
For |
The default display format of time and date by the "ls
-l
" command depends on the locale (see value 「タイムスタンプ」).
The "$LANG
" variable is referred first and it can be
overridden by the "$LC_TIME
" variable.
The actual default display format for each locale depends on the version of
the standard C library (the libc6
package) used. I.e.,
different releases of Debian had different defaults.
If you really wish to customize this display format of time and date beyond
the locale, you should set the time style value by the
"--time-style
" argument or by the
"$TIME_STYLE
" value (see ls
(1),
date
(1), "info coreutils 'ls
invocation'
").
表9.4 Display examples of time and date for the "ls -l
" command
for lenny
.
time style value | locale | display of time and date |
---|---|---|
iso
|
any |
01-19 00:15
|
long-iso
|
any |
2009-01-19 00:15
|
full-iso
|
any |
2009-01-19 00:15:16.000000000 +0900
|
locale
|
C
|
Jan 19 00:15
|
locale
|
en_US.UTF-8
|
2009-01-19 00:15
|
locale
|
es_ES.UTF-8
|
ene 19 00:15
|
+%d.%m.%y %H:%M
|
any |
19.01.09 00:15
|
+%d.%b.%y %H:%M
|
C またはen_US.UTF-8
|
19.Jan.09 00:15
|
+%d.%b.%y %H:%M
|
es_ES.UTF-8
|
19.ene.09 00:15
|
![]() |
ティップ |
---|---|
You can eliminate typing long option on commandline using command alias,
e.g. " |
![]() |
ティップ |
---|---|
ISO 8601 is followed for these iso-formats. |
Shell echo to most modern terminals can be colorized using ANSI escape code (see
"/usr/share/doc/xterm/ctlseqs.txt.gz
"). E.g.:
$ RED=$(printf "\x1b[31m") $ NORMAL=$(printf "\x1b[0m") $ REVERSE=$(printf "\x1b[7m") $ echo "${RED}RED-TEXT${NORMAL} ${REVERSE}REVERSE-TEXT${NORMAL}"
Colorized commands are handy for inspecting their output in the interactive
environment. I include following in my "~/.bashrc
".
if [ "$TERM" != "dumb" ]; then eval "`dircolors -b`" alias ls='ls --color=always' alias ll='ls --color=always -l' alias la='ls --color=always -A' alias less='less -R' alias ls='ls --color=always' alias grep='grep --color=always' alias egrep='egrep --color=always' alias fgrep='fgrep --color=always' alias zgrep='zgrep --color=always' else alias ll='ls -l' alias la='ls -A' fi
The use of alias limits color effects to the interactive command usage. It
has advantage over exporting environment variable "export
GREP_OPTIONS='--color=auto'
" since color can be seen under pager
programs such as less
(1). If you wish to surpress color
when piping to other programs, use "--color=auto
" instead
in the above example for "~/.bashrc
".
![]() |
ティップ |
---|---|
You can turn off these colorizing aliases in the interactive environment by
invoking shell with " |
There are few ways to record the graphic image of an X application,
including an xterm
display.
表9.5 グラフィックイメージの操作ツールのリスト。
パッケージ | popcon | サイズ | コマンド |
---|---|---|---|
xbase-clients |
V:13, I:56 | 184 |
xwd (1)
|
gimp
|
V:14, I:50 | 13468 | GUI menu |
imagemagick |
V:15, I:32 | 304 |
import (1)
|
scrot
|
V:0.2, I:1.2 | 80 |
scrot (1)
|
DVCSシステムを使って設定ファイルの変更を記録する専用ツールがあります。
表9.6 List of packages to record configuration history in VCS.
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
etckeeper |
V:0.4, I:0.7 | 372 | store configuration files and its metadata with Git (default), Mercurial, or Bazaar. (new) |
changetrack |
V:0.06, I:0.08 | 152 | store configuration files with RCS. (old) |
I recommend to use the etckeeper
package with
git
(1) which put entire "/etc
" under
VCS control. Its installation guide and tutorial are found in
"/usr/share/doc/etckeeper/README.gz
".
Essentially, running "sudo etckeeper init
" initializes
the git repository for "/etc
" just like the process
explained in 「Git for recording configuration history」) but
with special hook scripts for more thorough setups.
As you change your configuration, you can use git
(1)
normally to record them. It will automatically record changes nicely every
time you run package management commands, too.
![]() |
ティップ |
---|---|
You can browse the change history of " |
Booting your system with Linux live CDs or debian-installer CDs in rescue mode make it easy for you to reconfigure data storage on your boot device. See also 「バイナリデータ」.
For partition configuration, although fdisk
(8) has been
considered standard, parted
(8) deserves some attention.
"Disk partitioning data", "partition table", "partition map", and "disk
label" are all synonyms.
Most PCs use the classic Master Boot Record (MBR) scheme to hold disk partitioning data in the first sector, i.e., LBA sector 0 (512 bytes).
![]() |
注意 |
---|---|
Some new PCs with Extensible Firmware Interface (EFI), including Intel-based Macs, use GUID Partition Table (GPT) scheme to hold disk partitioning data not in the first sector. |
Although fdisk
(8) has been standard for the disk
partitioning tool, parted
(8) is replacing it.
表9.7 ディスクパーティション管理パッケージのリスト
パッケージ | Popcon | サイズ | 説明 | GUIDパーティションテーブル |
---|---|---|---|---|
util-linux |
V:90, I:99 | 1848 |
Miscellaneous system utilities including fdisk (8) and
cfdisk (8)
|
非サポート |
parted |
V:1.0, I:8 | 164 | The GNU Parted disk partition resizing program | サポート |
gparted |
V:4, I:42 | 3168 |
GNOME partition editor based on libparted
|
サポート |
qtparted |
V:0.17, I:1.2 | 764 |
KDE partition editor based on libparted
|
サポート |
gptsync |
V:0.01, I:0.15 | 72 | Synchronize classic MBR partition table with the GPT one | サポート |
![]() |
注意 |
---|---|
Although |
![]() |
注意 |
---|---|
In order to switch between GPT and MBR, you need to erase first few blocks
of disk contents directly (see 「Clear file contents」) and
use " |
Although reconfiguration of your partition may yield different names for partitions, you can access them consistently. This is also helpful if you have multiple disks and your BIOS doesn't give them consistent device names.
mount
(8) with "-U
" options can mount a
block device using UUID, instead of using its
file name such as "/dev/sda3
".
/etc/fstab
" (see fstab
(5)) can use
UUID.
![]() |
ティップ |
---|---|
You can probe UUID of a block special device
with |
For ext3 filesystem, the
e2fsprogs
package provides:
The mkfs
(8) and fsck
(8) commans are
provided by the e2fsprogs
package as front-ends to
various filesystem dependent programs (mkfs.fstype
and
fsck.fstype
). For ext3
filesystem, they are mkfs.ext3
(8) and
fsck.ext3
(8) (they are hardlinked to
mke2fs
(8) and e2fsck
(8)).
Similar commands are available for each filesystem supported by Linux.
表9.8 List of filesystem management packages
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
e2fsprogs |
V:66, I:99 | 1884 | Utilities for the ext2/ext3/ext4 filesystems. |
reiserfsprogs |
V:3, I:10 | 1200 | Utilities for the Reiserfs filesystem. |
dosfstools |
V:3, I:23 | 224 | Utilities for the FAT filesystem. (Microsoft: MS-DOS, Windows) |
xfsprogs |
V:2, I:10 | 3044 | Utilities for the XFS filesystem. (SGI: IRIX) |
ntfsprogs |
V:1.5, I:6 | 632 | Utilities for the NTFS filesystem. (Microsoft: Windows NT, …) |
jfsutils |
V:0.6, I:3 | 1116 | Utilities for the JFS filesystem. (IBM: AIX, OS/2) |
reiser4progs |
V:0.08, I:0.7 | 1292 | Utilities for the Reiser4 filesystem. |
hfsprogs |
V:0.04, I:0.5 | 324 | HFSとHFS Plusファイルシステムのためのユーティリティ。(Apple: Mac OS) |
btrfs-tools |
V:0.01, I:0.13 | 968 | Utilities for the btrfs filesystem. |
![]() |
ティップ |
---|---|
Ext3 filesystem is the default filesystem for
the Linux system and strongly recommended to use it unless you have some
specific reasons not to. After Linux kernel 2.6.28 (Debian
|
![]() |
警告 |
---|---|
You might face some limtations with ext4 since it is new. For example, you must have Linux kernel 2.6.30 or later if you wish to resizean ext4 partition. |
![]() |
ティップ |
---|---|
Some tools allow access to filesystem without Linux kernel support (see 「Manipulating files without mounting disk」). |
The mkfs
(8) command creates the filesystem on a Linux
system. The fsck
(8) command provides the filesystem
integrity check and repair on a Linux system.
![]() |
注意 |
---|---|
It is generally not safe to run |
![]() |
ティップ |
---|---|
Check files in " |
![]() |
ティップ |
---|---|
Use " |
Performance and characteristics of a filesystem can be optimized by mount
options used on it (see fstab
(5) and
mount
(8)). For example:
defaults
" option implies default options:
"rw,suid,dev,exec,auto,nouser,async
". (general)
noatime
" or "relatime
" option is very
effective for speeding up the read access. (general)
user
" option allows an ordinary user to mount the file
system. This option implies "noexec,nosuid,nodev
" option
combination. (general, used for CD and floppy)
noexec,nodev,nosuid
" option combination is used to
enhance security. (general)
noauto
" option limits mounting by explicit operation
only. (general)
data=journal
" option for ext3fs can enhance data
integrity against power failure with some loss of write speed.
![]() |
ティップ |
---|---|
You need to provide kernel boot parameter
" |
Characteristics of a filesystem can be optimized via its superblock using
the tune2fs
(8) command. For example on
"/dev/hda1
":
sudo tune2fs -l /dev/hda1
" will display the
contents of its filesystem superblock.
sudo tune2fs -c 50 /dev/hda1
" will change
frequency of filesystem checks (fsck
execution during
boot-up) to every 50 boots.
sudo tune2fs -j /dev/hda1
" will add
journaling capability to the filesystem, i.e. filesystem conversion from
ext2 to ext3. (Do
this on the unmounted filesystem.)
sudo tune2fs -O extents,uninit_bg,dir_index /dev/hda1
&& fsck -pf /dev/hda1
" will convert it from ext3 to ext4. (Do this on
the unmounted filesystem.)
![]() |
警告 |
---|---|
Filesystem conversion for the boot device to the ext4 filesystem should be avoided until GRUB boot loader supports the ext4 filesystem well and installed Linux Kernel version is newer than 2.6.28. |
![]() |
警告 |
---|---|
Please check your hardware and read manpage of |
You can test disk access speed of a harddisk,
e.g. "/dev/hda
", by "hdparm -tT
/dev/hda
". For some harddisk connected with (E)IDE, you can speed
it up with "hdparm -q -c3 -d1 -u1 -m16 /dev/hda
" by
enabling the "(E)IDE 32-bit I/O support", enabling the "using_dma flag",
setting "interrupt-unmask flag", and setting the "multiple 16 sector I/O"
(dangerous!).
You can test write cache feature of a harddisk,
e.g. "/dev/sda
", by "hdparm -W
/dev/sda
". You can disable its write cache feature with
"hdparm -W 0 /dev/sda
".
You may be able to read badly pressed CDROMs on modern high head CD-ROM
drive by slowing it down with "setcd -x 2
.
You can monitor and log your harddisk which is compliant to SMART with the smartd
(8) daemon.
smartmontools
package.
Identify your harddisk drives by listing them with df
(1).
/dev/hda
".
Check the output of "smartctl -a /dev/hda
" to see if
SMART feature is actually enabled.
smartctl -s on -a /dev/hda
".
Enable smartd
(8) daemon to run by:
start_smartd=yes
" in the
"/etc/default/smartmontools
" file.
smartd
(8) daemon by "sudo
/etc/init.d/smartmontools restart
".
![]() |
ティップ |
---|---|
The |
For partitions created on Logical Volume Manager (Linux) at install time, they can be resized easily by concatenating extents onto them or truncating extents from them over multiple storage devices without major system reconfiguration.
![]() |
注意 |
---|---|
Deployment of the current LVM system may degrade guarantee against filesystem corruption offered by journaled file systems such as ext3fs unless their system performance is sacrificed by disabling write cache of harddisk. |
If you have an empty partition (e.g., "/dev/sdx
"), you
can format it with mkfs.ext3
(1) and
mount
(8) it to a directory where you need more
space. (You need to copy original data contents.)
$ sudo mv work-dir old-dir $ sudo mkfs.ext3 /dev/sdx $ sudo mount -t ext3 /dev/sdx work-dir $ sudo cp -a old-dir/* work-dir $ sudo rm -rf old-dir
If you have an empty directory (e.g., "/path/to/emp-dir
")
in another partition with usable space, you can create a symlink to the
directory with ln
(8).
$ sudo mv work-dir old-dir $ sudo mkdir -p /path/to/emp-dir $ sudo ln -sf /path/to/emp-dir work-dir $ sudo cp -a old-dir/* work-dir $ sudo rm -rf old-dir
![]() |
注意 |
---|---|
Some software may not function well with "symlink to a directory". |
If you have usable space in another partition (e.g.,
"/path/to/
"), you can create a directory in it and stack
that on to a directory where you need space with aufs.
$ sudo mv work-dir old-dir $ sudo mkdir -p /path/to/emp-dir $ sudo mount -t aufs -o br:/path/to/emp-dir:old-dir none work-dir
![]() |
注意 |
---|---|
Use of aufs for long term data storage is not good idea since it is under development and its design change may introduce issues. |
With physical access to your PC, anyone can easily gain root privilege and access all the files on your PC (see 「rootパスワードのセキュリティ確保」). This means that login password system can not secure your private and sensitive data against possible theft of your PC. You must deploy data encryption technology to do it. Although GNU privacy guard (see 「Data security infrastructure」) can encrypt files, it takes some user efforts.
dm-crypt and eCryptfs facilitates automatic data encryption natively via Linux kernel modules with minimal user efforts.
表9.9 List of data encryption utilities.
パッケージ | popcon | サイズ | 機能 |
---|---|---|---|
cryptsetup |
V:3, I:4 | 904 | Utilities for encrypted block device (dm-crypt / LUKS) |
cryptmount |
V:0.09, I:0.5 | 304 | Utilities forencrypted block device (dm-crypt / LUKS) with focus on mount/unmount by normal users |
ecryptfs-utils |
V:0.09, I:0.2 | 444 | Utilities for encrypted stacked filesystem (eCryptfs) |
Dm-crypt is a cryptographic filesystem using device-mapper. Device-mapper maps one block device to another.
eCryptfs is another cryptographic filesystem using stacked filesystem. Stacked filesystem stacks itself on top of an existing directory of a mounted filesystem.
![]() |
注意 |
---|---|
Data encryption costs CPU time etc. Please weigh its benefits and costs. |
![]() |
注意 |
---|---|
Entire Debian system can be installed on a encrypted disk by the debian installer (lenny or newer) using dm-crypt/LUKS and initramfs. |
![]() |
ティップ |
---|---|
See 「Data security infrastructure」 for user space encryption utility: GNU Privacy Guard. |
You can encrypt contents of removable mass storage devices, e.g. USB memory
stick on "/dev/sdx
", using dm-crypt/LUKS. You
simply formatting it as:
# badblocks -c 10240 -s -w -t random -v /dev/sdx # shred -v -n 1 /dev/sdx # fdisk /dev/sdx ... "n" "p" "1" "return" "return" "w" # cryptsetup luksFormat /dev/sdx1 ... # cryptsetup luksOpen /dev/sdx1 sdx1 ... # ls -l /dev/mapper/ total 0 crw-rw---- 1 root root 10, 60 2008-10-04 18:44 control brw-rw---- 1 root disk 254, 0 2008-10-04 23:55 sdx1 # mkfs.vfat /dev/mapper/sdx1 ... # cryptsetup luksClose sdx1
Then, it can be mounted just like normal one on to
"/media/<disk_label>
", except for asking password
(see 「Removable mass storage device」) under modern desktop
environment, such as GNOME using gnome-mount
(1). The
difference is that every data written to it is encrypted. You may
alternatively format media in different file format, e.g., ext3 with
"mkfs.ext3 /dev/sdx1
".
![]() |
注意 |
---|---|
If you are really paranoid for the security of data, you may need to overwrite multiple times in the above example. This operation is very time consuming though. |
If your original "/etc/fstab
" contains:
/dev/sda7 swap sw 0 0
then you can enable encrypted swap partition using dm-crypt by as
# aptitude install cryptsetup # swapoff -a # echo "cswap /dev/sda7 /dev/urandom swap" >> /etc/crypttab # perl -i -p -e "s/\/dev\/sda7/\/dev\/mapper\/cswap/" /etc/fstab # /etc/init.d/cryptdisks restart ... # swapon -a
You can encrypt files written under "~/Private/
"
automatically using eCryptfs and the
ecryptfs-utils
package.
ecryptfs-setup-private
(1) and set up
"~/Private/
" by following prompts.
~/Private/
" by running
ecryptfs-mount-private
(1).
move sensitive data files to "~/Private/
" and make
symlinks as needed.
~/.fetchmailrc
",
"~/.ssh/identity
", "~/.ssh/id_rsa
",
"~/.ssh/id_dsa
" and other files with
"go-rwx
".
move sensitive data directories to a subdirectory in
"~/Private/
" and make symlinks as needed.
~/.gnupg
" and other directories with
"go-rwx
".
~/Desktop/Private/
" to
"~/Private/
" for easier desktop operations.
~/Private/
" by running
ecryptfs-umount-private
(1).
~/Private/
" by issuing
"ecryptfs-mount-private
" as you need encrypted data.
If you use your login password for wrapping encryption keys, you can
automate mounting eCryptfs via Pluggable Authentication Module by having a
following line just before "pam_permit.so
" in
"/etc/pam.d/common-auth
" as:
auth required pam_ecryptfs.so unwrap
and the last line in "/etc/pam.d/common-session
" as:
session optional pam_ecryptfs.so unwrap
and the first active line in "/etc/pam.d/common-password
"
as:
password required pam_ecryptfs.so
This is quite convienient.
![]() |
警告 |
---|---|
Configuration errors of PAM may lock you out of your own system. See 4章認証. |
![]() |
注意 |
---|---|
If you use your login password for wrapping encryption keys, your encrypted data are as secure as your user login password (see 「良好なパスワード」). Unless you are careful to set up a strong password, your data will be at risk when someone runs password cracking software after stealing your laptop (see 「rootパスワードのセキュリティ確保」). |
Program activities can be monitored and controlled using specialized tools.
表9.10 List of tools for monitoring and controlling program activities
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
time
|
V:7, I:85 | 152 |
time (1) runs a program to report system resource usages
with respect to time.
|
coreutils |
V:91, I:99 | 12868 |
nice (1) runs a program with modified scheduling priority.
|
bsdutils |
V:71, I:99 | 180 |
renice (1) modifies the scheduling priority of a running
process.
|
powertop |
V:0.6, I:11 | 424 |
powertop (1) gives information about system power use on
Intel-based laptops.
|
procps |
V:87, I:99 | 752 |
The "/proc " file system utilities:
ps (1), top (1),
kill (1), watch (1), …
|
psmisc |
V:52, I:87 | 536 |
The "/proc " file system utilities:
killall (1), fuser (1),
pstree (1)
|
cron
|
V:91, I:99 | 324 |
The cron (8) daemon runs processes according to a schedule
(in background).
|
at
|
V:54, I:83 | 220 |
at (1) or batch (1) commands run a job
at a specified time or below certain load level.
|
lsof
|
V:16, I:91 | 444 |
lsof (8) lists open files by a running process using
"-p " option.
|
strace |
V:7, I:63 | 420 |
strace (1) traces system calls and signals.
|
ltrace |
V:0.3, I:2 | 228 |
ltrace (1) traces library calls.
|
xtrace |
V:0.02, I:0.15 | 204 |
xtrace (1) traces communication between X11 client and
server.
|
コマンドが開始したプロセスによって使われた表示時間。
# time some_command >/dev/null real 0m0.035s # time on wall clock (elapsed real time) user 0m0.000s # time in user mode sys 0m0.020s # time in kernel mode
A nice value is used to control the scheduling priority for the process.
表9.11 List of nice values for the scheduling priority.
nice value | スケジューリングのプライオリティー |
---|---|
19 | lowest priority process (nice) |
0 | very high priority process for user. |
-20 | very high priority process for root. (not-nice) |
# nice -19 top # very nice # nice --20 wodim -v -eject speed=2 dev=0,0 disk.img # very fast
Sometimes an extreme nice value does more harm than good to the system. Use this command carefully.
The ps
(1) command on the Debian support both BSD and
SystemV features and helps to identify the process activity statically.
表9.12 List of ps command styles.
style | typical command | feature |
---|---|---|
BSD |
ps aux
|
%CPU %MEMを表示 |
System V |
ps -efH
|
PPIDを表示 |
For the zombie (defunct) children process, you can kill them by the parent
process ID identified in the (PPID
) field.
The pstree
(1) command display a tree of processes.
top
(1) on the Debian has rich features and helps to
identify what process is acting funny dynamically.
表9.13 topのコマンドのリスト。
command key | レスポンス |
---|---|
h or ?
|
To show help. |
f
|
To set/reset display field. |
o
|
To reorder display field. |
F
|
To set sort key field. |
k
|
To kill a process. |
r
|
To renice a process. |
q
|
To quit the top command.
|
You can list all files opened by a process with a process ID (PID), e.g. 1 as:
$ sudo lsof -p 1
PID=1 is usually init
program.
You can trace program activity with strace
(1),
ltrace
(1), or xtrace
(1) for system
calls and signals, library calls, or communication between X11 client and
server. For example:
$ sudo strace ls ...
You can also identify processes using files or sockets by
fuser
(1). For example:
$ sudo fuser -v /var/log/mail.log USER PID ACCESS COMMAND /var/log/mail.log: root 2946 F.... syslogd
You see that file "/var/log/mail.log
" is open for writing
by the syslogd
(8) command.
$ sudo fuser -v smtp/tcp USER PID ACCESS COMMAND smtp/tcp: Debian-exim 3379 F.... exim4
Now you know your system runs exim4
(8) to handle TCP connections to SMTP port
(25).
watch
(1) executes a program repeatedly with a constant
interval while showing its output in fullscreen.
$ watch w
This will display who is logged on to the system updated every 2 seconds.
There are several ways to repeat a command looping over files matching some
condition, e.g. matching glob pattern "*.ext
".
for x in *.ext; do if [ -f "$x"]; then command "$x" ; fi; done
find
(1) and xargs
(1) combination:
find . -type f -maxdepth 1 -name '*.ext' -print0 | xargs -0 -n 1 command
find
(1) with "-exec
" option with a
command:
find . -type f -maxdepth 1 -name '*.ext' -exec command '{}' \;
find
(1) with "-exec
" option with a
short shell script:
find . -type f -maxdepth 1 -name '*.ext' -exec sh -c "command '{}' && echo 'successful'" \;
The above examples are written to ensure proper handling of funny file names
such as ones containing spaces. See 「Idioms for the selection of files」 for more advance uses of
find
(1).
You can set up to start a process from graphical user interface (GUI).
Under GNOME desktop environment, a program program can be started with
proper argument by drag-and-drop of an
icon to the launcher icon or by "Open with
…" menu with right clicking. KDE can do the equivalent, too. Here
is an example for GNOME to set up mc
(1) started in
gnome-terminal
(1):
mc-term
" as:
# cat >/usr/local/bin/mc-term <<EOF #!/bin/sh gnome-terminal -e "mc \$1" EOF # chmod 755 /usr/local/bin/mc-term
create a desktop launcher
Create Launcher
…
"
Application
"
mc
"
mc-term %f
"
create an open-with association
Open with Other Application
…
"
mc-term
%f
"
![]() |
ティップ |
---|---|
Launcher is a file at " |
Some programs start another program automatically. Here are check points for customizing this process:
アプリケーション設定メニュー:
mc
(1): "/etc/mc/mc.ext
"
$BROWSER
",
"$EDITOR
", "$VISUAL
", and
"$PAGER
" (see eviron
(7)).
update-alternatives
(8) system for programs such as
"editor
", "view
",
"x-www-browser
", "gnome-www-browser
",
and "www-browser
" (see 「デフォルトのテキストエディタの設定」).
~/.mailcap
" and "/etc/mailcap
"
file contents which associate MIME type with
program (see mailcap
(5)).
~/.mime.types
" and
"/etc/mime.types
" file contents which associate file name
extension with MIME type (see
run-mailcap
(1)).
![]() |
ティップ |
---|---|
|
![]() |
ティップ |
---|---|
The |
![]() |
ティップ |
---|---|
In order to run a console application such as |
# cat /usr/local/bin/mutt-term <<EOF #!/bin/sh gnome-terminal -e "mutt \$@" EOF chmod 755 /usr/local/bin/mutt-term
Use kill
(1) to kill (or send a signal to) a process by
the process ID.
Use killall
(1) or pkill
(1) to do the
same by the process command name and other attributes.
表9.14 List of frequently used signals for kill command.
signal value | シグナル名 | 機能 |
---|---|---|
1 | HUP | restart daemon |
15 | TERM | normal kill |
9 | KILL | kill hard |
Run the at
(1) command to schedule a one-time job:
$ echo 'command -args'| at 3:40 monday
Use cron
(8) to schedule tasks regularly. See
crontab
(1) and crontab
(5).
Run the command "crontab -e
" to create or edit a crontab
file to set up regularly scheduled events.
Example of a crontab file:
# use /bin/sh to run commands, no matter what /etc/passwd says SHELL=/bin/sh # mail any output to paul, no matter whose crontab this is MAILTO=paul # Min Hour DayOfMonth Month DayOfWeek command (Day... are OR'ed) # run at 00:05, every day 5 0 * * * $HOME/bin/daily.job >> $HOME/tmp/out 2>&1 # run at 14:15 on the first of every month -- output mailed to paul 15 14 1 * * $HOME/bin/monthly # run at 22:00 on weekdays(1-5), annoy Joe. % for newline, last % for cc: 0 22 * * 1-5 mail -s "It's 10pm" joe%Joe,%%Where are your kids?%.%% 23 */2 1 2 * echo "run 23 minutes after 0am, 2am, 4am ..., on Feb 1" 5 4 * * sun echo "run at 04:05 every sunday" # run at 03:40 on the first Monday of each month 40 3 1-7 * * [ "$(date +%a)" == "Mon" ] && command -args
![]() |
ティップ |
---|---|
For the system not running continuously, install the
|
Insurance against system malfunction is provided by the kernel compile option "Magic SysRq key" (SAK key) which is now the default for the Debian kernel. Pressing Alt-SysRq followed by one of the following keys does the magic of rescuing control of the system:
表9.15 List of SAK command keys.
key following Alt-SysRq | 機能 |
---|---|
r
|
Unraw restores the keyboard after things like X crashes. |
0
|
Changing the console loglevel to 0 reduces error messages. |
k
|
SAK (system attention key) kills all processes on the current virtual console. |
e
|
Send a SIGTERM to all processes, except
for init (8).
|
i
|
Send a SIGKILL to all processes, except
for init (8).
|
s
|
Sync all mounted filesystems. |
u
|
Remount all mounted filesystems read-only (umount). |
b
|
Reboot the system without syncing or unmounting. |
The combination of "Alt-SysRq s", "Alt-SysRq u", and "Alt-SysRq r" is good for getting out of really bad situations.
See
"/usr/share/doc/linux-doc-2.6.*/Documentation/sysrq.txt.gz
".
![]() |
注意 |
---|---|
The Alt-SysRq feature may be considered a security risk by allowing users
access to root-privileged functions. Placing " |
![]() |
ティップ |
---|---|
From SSH terminal etc., you can use the Alt-SysRq feature by writing to the
" |
You can send message to everyone who is logged on to the system with
wall
(1):
$ echo "We are shutting down in 1 hour" | wall
For the PCI-like devices (AGP, PCI-Express,
CardBus, ExpressCard, etc.), lspci
(8)
(probably with "-nn
" option) is a good start for the
hardware identification
Alternatively, you can identify the hardware by reading contents of
"/proc/bus/pci/devices
" or browsing directory tree under
"/sys/bus/pci
" (see 「procfsとsysfs」).
表9.16 List of hardware identification tools.
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
pciutils |
V:16, I:92 | 780 |
Linux PCI Utilities, lspci (8)
|
usbutils |
V:38, I:97 | 548 |
Linux USB utilities, lsusb (8)
|
pcmciautils |
V:0.9, I:14 | 172 |
PCMCIA utilities for Linux 2.6, pccardctl (8)
|
scsitools |
V:0.2, I:1.3 | 484 |
Collection of tools for SCSI hardware management,
lsscsi (8)
|
pnputils |
V:0.02, I:0.2 | 108 |
Plug and Play BIOS utilities, lspnp (8)
|
procinfo |
V:0.5, I:4 | 164 |
Displays system information from "/proc ",
lsdev (8)
|
lshw
|
V:1.1, I:6 | 804 |
Information about hardware configuration, lshw (1)
|
discover |
V:4, I:14 | 928 |
Hardware identification system, discover (8)
|
Although most of the hardware configuration on modern GUI desktop systems such as GNOME and KDE can be managed through accompanying GUI configuration tools, it is a good idea to know some basics methods to configure them.
表9.17 List of hardware configuration tools.
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
hal
|
V:45, I:58 | 1844 |
Hardware Abstraction Layer, lshal (1)
|
console-tools |
V:59, I:95 | 948 | Linux console font and keytable utilities. |
x11-xserver-utils |
V:32, I:46 | 648 |
X server utilities. xset (1) and
xmodmap (1).
|
acpid
|
V:55, I:90 | 200 | Daemon to manage events delivered by the Advanced Configuration and Power Interface (ACPI) |
acpi
|
V:3, I:33 | 92 | Utilities for ACPI devices |
apmd
|
V:1.2, I:12 | 144 | Daemon to manage events delivered by the Advanced Power Management (APM) |
powersaved |
V:0.7, I:0.9 | 1800 | Daemon to manage battery, temperature, ac, cpufreq (SpeedStep, Powernow!) control and monitor with ACPI and APM supports. |
noflushd |
V:0.07, I:0.14 | 244 | Allow idle hard disks to spin down |
sleepd |
V:0.07, I:0.11 | 92 | Puts a laptop to sleep during inactivity |
hdparm |
V:13, I:34 | 284 |
Hard disk access optimization. Very effective but dangerous. You must read
hdparm (8) first.
|
smartmontools |
V:6, I:18 | 828 | Control and monitor storage systems using S.M.A.R.T. |
setserial |
V:2, I:4 | 176 | Collection of tools for serial port management. |
memtest86+ |
V:0.5, I:4 | 384 | Collection of tools for memory hardware management. |
scsitools |
V:0.2, I:1.3 | 484 | Collection of tools for SCSI hardware management. |
tpconfig |
V:0.4, I:0.5 | 208 | A program to configure touchpad devices |
setcd
|
V:0.08, I:0.4 | 28 | Compact disc drive access optimization. |
big-cursor |
I:0.19 | 68 | Larger mouse cursors for X |
Here, ACPI is a newer framework for the power management system than APM.
The following will set system and hardware time to MM/DD hh:mm, CCYY.
# date MMDDhhmmCCYY # hwclock --utc --systohc # hwclock --show
Times are normally displayed in the local time on the Debian system but the hardware and system time usually use UTC.
If the hardware (BIOS) time is set to GMT, change the setting to
"UTC=yes
" in the "/etc/default/rcS
".
If you wish to update system time via network, consider to use the NTP
service with the packages such as ntp
,
ntpdate
, and chrony
. See:
ntp-doc
package
![]() |
ティップ |
---|---|
|
There are several components to configure character console and
ncurses
(3) system features:
/etc/terminfo/*/*
" file
(terminfo
(5))
$TERM
" environment variable
(term
(7))
setterm
(1), stty
(1),
tic
(1), and toe
(1)
If the terminfo
entry for xterm
doesn't work with a non-Debian xterm
, change your
terminal type, "$TERM
", from "xterm
"
to one of the feature-limited versions such as "xterm-r6
"
when you log in to a Debian system remotely. See
"/usr/share/doc/libncurses5/FAQ
" for more.
"dumb
" is the lowest common denominator for
"$TERM
".
Device drivers for sound cards for current Linux 2.6 are provided by Advanced Linux Sound Architecture (ALSA). ALSA provides emulation mode for previous Open Sound System (OSS) for compatibility.
Run "dpkg-reconfigure linux-sound-base
" to select the
sound system to use ALSA via blacklisting of kernel modules. Unless you have
very new sound hardware, udev infrastructure should configure your sound
system.
![]() |
ティップ |
---|---|
Use " |
![]() |
ティップ |
---|---|
If you can not get sound, your speaker may be connected to a muted output.
Modern sound system has many outputs. |
Application softwares may be configured not only to access sound devices directly but also to access them via some standardized sound server system.
表9.18 サウンドパッケージのリスト。
There is usually a common sound engine for each popular desktop environment. Each sound engine used by the application can choose to connect to different sound servers.
For disabling the screen saver, use following commands.
表9.19 List of commands for disabling the screen saver.
environment | コマンド |
---|---|
The Linux console |
setterm -powersave off
|
The X Window by turning off screensaver |
xset s off
|
The X Window by disabling dpms |
xset -dpms
|
The X Window by GUI configuration of screen saver |
xscreensaver-command -prefs
|
One can always unplug the PC speaker. ;-) Removing
pcspkr
kernel module does this for you.
The following will prevent the readline
(3) program used
by bash
(1) to beep when encountering
"\a
" (ASCII=7):
$ echo "set bell-style none">> ~/.inputrc
The kernel boot message in the "/var/log/dmesg
" contains
the total exact size of available memory.
free
(1) and top
(1) display information
on memory resources on the running system.
$ grep '\] Memory' /var/log/dmesg [ 0.004000] Memory: 990528k/1016784k available (1975k kernel code, 25868k reserved, 931k data, 296k init) $ free -k total used free shared buffers cached Mem: 997184 976928 20256 0 129592 171932 -/+ buffers/cache: 675404 321780 Swap: 4545576 4 4545572
For my MacBook with 1GB=1048576k DRAM (video system steals some of this):
表9.20 List of memory sizes reported.
報告 | サイズ |
---|---|
Total size in dmesg | 1016784k = 1GB - 31792k |
Free in dmesg | 990528k |
Total under shell | 997184k |
Free under shell | 20256k |
Do not worry about the large size of "used
" and the small
size of "free
" in the "Mem:
" line, but
read the one under them (675404 and 321780 in the example below) and relax.
Poor system maintenance may expose your system to external exploitation.
For system security and integrity check, you should start with:
debsums
package: See debsums
(1)
and 「トップレベルの"Release"ファイルと信憑性」.
chkrootkit
package: See
chkrootkit
(1).
clamav
package family: See
clamscan
(1) and freahclam
(1).
表9.21 システムセキュリティや整合性確認のためのツールリスト
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
logcheck |
V:3, I:4 | 264 | This mails anomalies in the system logfiles to the administrator |
debsums |
V:2, I:3 | 264 | こうしてインストールされたパッケージファイルはMD5チェックサムを使って検証されます。 |
chkrootkit |
V:2, I:6 | 864 | ルートキット検出器。 |
clamav |
V:2, I:11 | 504 | Unix用アンチウィルスユーティリティー -- コマンドラインインターフェース |
tiger
|
V:0.8, I:1.0 | 3088 | Report system security vulnerabilities |
tripwire |
V:0.6, I:0.8 | 5020 | ファイルやディレクトリの整合性チェッカー |
john
|
V:0.5, I:2 | 476 | Active password cracking tool |
aide
|
V:0.3, I:0.5 | 1112 | Advanced Intrusion Detection Environment - static binary |
bastille |
V:0.19, I:0.5 | 1960 | セキュリティ強化ツール |
integrit |
V:0.10, I:0.2 | 440 | A file integrity verification program |
crack
|
V:0.05, I:0.2 | 204 | Password guessing program |
Here is a simple script to check for typical world writable incorrect file permissions.
# find / -perm 777 -a \! -type s -a \! -type l -a \! \( -type d -a -perm 1777 \)
![]() |
注意 |
---|---|
Since the |
Debian distributes modularized Linux kernel as packages for supported architectures.
There are few notable features on Linux kernel 2.6 compared to 2.4.
ide-scsi
module.
iptable
kernel
modules.
Most normal programs don't need kernel
headers and in fact may break if you use them directly for compiling. They
should be compiled against the headers in
"/usr/include/linux
" and
"/usr/include/asm
" provided by the
libc6-dev
package (created from the
glibc
source package) on the Debian system.
![]() |
注意 |
---|---|
For compiling some kernel-specific programs such as the kernel modules from
the external source and the automounter daemon ( |
Debian has its own method of compiling the kernel and related modules.
表9.22 Debianシステム上でカーネルの再コンパイルためにインストールする重要パッケージのリスト
パッケージ | popcon | サイズ | 説明 |
---|---|---|---|
build-essential |
I:45 | 48 |
essential packages for building Debian packages: make ,
gcc , …
|
bzip2
|
V:57, I:80 | 132 | compress and decompress utilities for bz2 files |
libncurses5-dev |
V:4, I:27 | 6724 | developer's libraries and docs for ncurses |
git-core |
V:6, I:10 | 14344 | git: distributed revision control system used by the Linux kernel |
fakeroot |
V:4, I:27 | 444 | provide fakeroot environment for building package as non-root |
initramfs-tools |
V:35, I:97 | 420 | tool to build an initramfs (Debian specific) |
kernel-package |
V:2, I:18 | 2340 | tool to build Linux kernel packages (Debian specific) |
module-assistant |
V:4, I:22 | 540 | tool to help build module packages (Debian specific) |
devscripts |
V:2, I:13 | 1656 | helper scripts for a Debian Package maintainer (Debian specific) |
linux-tree-2.6.*
|
N/A | N/A | Linuxカーネルのソースツリーのメタパッケージ(Debian固有) |
If you use initrd
in 「2段目: ブートローダ」, make sure to read the related
information in initramfs-tools
(8),
update-initramfs
(8), mkinitramfs
(8)
and initramfs.conf
(5).
![]() |
警告 |
---|---|
Do not put symlinks to the directories in the source tree
(e.g. " |
![]() |
注意 |
---|---|
When compiling the latest Linux kernel on the Debian
|
The Debian standard method for compiling kernel source to create a custom
kernel package uses make-kpkg
(1). The official
documentation is in (the bottom of)
"/usr/share/doc/kernel-package/README.gz
". See
kernel-pkg.conf
(5) and
kernel-img.conf
(5) for customization.
Here is an example for amd64 system:
# aptitude install linux-tree-<version> $ cd /usr/src $ tar -xjvf linux-source-<version>.tar.bz2 $ cd linux-source-<version> $ cp /boot/config-<oldversion> .config $ make menuconfig ... $ make-kpkg clean $ fakeroot make-kpkg --append_to_version -amd64 --initrd --revision=rev.01 kernel_image modules_image $ cd .. # dpkg -i linux-image*.deb
shutdown -r now
" .
![]() |
注意 |
---|---|
When you intend to create a non-modularized kernel compiled only for one
machine, invoke |
The Debian standard method for creating and installing a custom module
package for a custom kernel package uses
module-assistant
(8) and module-source packages. For
example, following will build the unionfs
kernel module
package and installs it.
$ sudo aptitude install module-assistant ... $ sudo aptitude install unionfs-source unionfs-tools unionfs-utils $ sudo m-a update $ sudo m-a prepare $ sudo m-a auto-install unionfs ... $ sudo apt-get autoremove
You can still build Linux kernel from the pristine sources with the classic method. You must take care the details of the system configuration manually.
$ cd /usr/src $ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-<version>.tar.bz2 $ tar -xjvf linux-<version>.tar.bz2 $ cd linux-<version> $ cp /boot/config-<version> .config $ make menuconfig ... $ make dep; make bzImage $ make modules # cp ./arch/x86_64/boot/bzImage /boot/vmlinuz-<version> # make modules_install # depmod -a # update-initramfs -c -k <version>
set up bootloader
/etc/lilo.conf
" and run
"/sbin/lilo
", if you use lilo
.
/boot/grub/menu.lst
", if you use
grub
.
shutdown -r now
".
Although most of hardware drivers are available as free software and as a part of the Debian system, you may need to load some non-free external drivers to support some hardwares, such as Winmodem, on your system.
Check pertinent resources:
Use of virtualized system enables us to run multiple instances of system simultaneously on a single hardware.
仮想化には2つの段階があります:
debootstrap
and cdebootstrap
helps
this process.
There are several system virtualization and emulation related packages in Debian beyond simple chroot. Some packages also help you to setup such system.
表9.23 List of virtualization tools
パッケージ | Popcon | サイズ | 説明 |
---|---|---|---|
schroot |
V:1.0, I:1.6 | 1988 | Specialized tool for executing Debian binary packages in chroot |
sbuild |
V:0.07, I:0.3 | 408 | Tool for building Debian binary packages from Debian sources |
pbuilder |
V:0.4, I:2 | 1112 | Debianパッケージの個人的なパッケージビルダー |
debootstrap |
V:1.7, I:12 | 260 | Bootstrap a basic Debian system (written in sh) |
cdebootstrap |
V:0.5, I:2 | 112 | Bootstrap a Debian system (written in C) |
rootstrap |
V:0.03, I:0.2 | 156 | A tool for building complete Linux filesystem images |
user-mode-linux |
V:0.10, I:0.5 | 17828 | User-mode Linux (kernel) |
xen-tools |
V:0.3, I:2 | 996 | Tools to manage debian XEN virtual server |
bochs
|
V:0.09, I:0.5 | 3360 | Bochs: IA-32 PC emulator |
qemu
|
V:1.2, I:6 | 43984 | Qemu: fast generic processor emulator |
virtualbox-ose |
V:2, I:3 | 22944 | VirtualBox: x86 virtualization solution on i386 and amd64 |
wine
|
V:1.6, I:16 | 64 | Wine: Windows API Implementation (standard suite) |
dosbox |
V:0.6, I:3 | 2240 | DOSBox: x86 emulator with Tandy/Herc/CGA/EGA/VGA/SVGA graphics, sound and DOS |
util-vserver |
V:0.8, I:1.1 | 2388 | Linux-VServer virtual private servers - user-space tools |
vzctl
|
V:0.5, I:1.0 | 1148 | OpenVZ server virtualization solution - control tools |
vzquota |
V:0.5, I:1.0 | 272 | OpenVZ server virtualization solution - quota tools |
See Wikipedia article Comparison of virtual machines for detail comparison of different virtualization solutions.
chroot
(8) offers most basic way to run different
instances of the GNU/Linux environment on a single system simultaneously
without rebooting.
![]() |
注意 |
---|---|
Examples below assumes both parent system and chroot system share the same CPU architecture. |
You can learn how to setup and use chroot
(8) by running
pbuilder
(8) program under script
(1) as
follows.
$ sudo mkdir /sid-root $ sudo pbuilder --create --no-targz --debug --buildplace /sid-root
debootstrap
(8)かdebootstrap
(1)が、"sid-root
"の下にsid
環境のためのシステムデータをどのようにして埋め込んでいくかが分かります。
![]() |
ティップ |
---|---|
These |
$ sudo pbuilder --login --no-targz --debug --buildplace /sid-root
You will see how a system shell running under sid
environment is created:
"/etc/hosts
"と"/etc/hostname
"と"/etc/resolv.conf
")
/proc
"ファイルシステムのマウント
/dev/pts
"ファイルシステムのマウント
/usr/sbin/policy-rc.d
"が作成される(これは常に101でプログラム終了する)
chroot /sid-root bin/bash -c 'exec -a -bash
bin/bash'
"
![]() |
注意 |
---|---|
プログラムによっては機能するためにchrootの下で |
![]() |
注意 |
---|---|
" |
![]() |
ティップ |
---|---|
The original purpose of the specialized chroot package,
|
![]() |
ティップ |
---|---|
Similar |
![]() |
ティップ |
---|---|
By installing a system into a separate partition using the installer of
other distributions and using this system for |
You can run another login process on a separate virtual terminal where you
can log in to the chroot system directly. Since on default Debian systems
tty1
to tty6
run Linux consoles and
tty7
runs the X Window System, let's set up
tty8
for a chrooted console as an example. After
creating a sid
chroot system under
"/sid-root
" by following steps you learned from
pbuilder
(8), type from the root shell of the main system:
main # echo "8:23:respawn:/usr/sbin/chroot /sid-root /sbin/getty 38400 tty8" >> /etc/inittab main # init q