I need rules to drop some malicious Apache connections

Update: The current answer is completely updated.

  According to this discussion I created a GitHub
  repository named WWW Security Assistant. There is a
  branch, called ask_ubuntu, dedicated to this answer.
  All references, previously available here, are removed due to the character limit - they are available on GitHub.

Here are over-viewed few ways, involved into a complete mechanism, how to increase Apache2 security within Ubuntu 16.04.

Table of content:

WWW Security Assistant Script (WSAS) ► Iptables
Iptables – Basic Configuration – Save and Restore
ModEvasive for Apache2
ModEvasive ► WSAS ► Iptables
ModSecurity 2.9 for Apache2
ModSecurity OWASP Core Rule Set 3.x
ModSecurity Rules Whitelisting
ModSecurity Rules ► WSAS ► Iptables
ModSecurity and Apache Log Files
ModSecurity Log Files ► Fail2Ban ► Iptables
ModSecurity GuardianLog ► HTTPD Guardian ► WSAS ► Iptables
ModSecurity GuardianLog ► HTTPD Custom Analyze ► WSAS ► Iptables

In addition let's say it always good to use HTTPS:

Read HTTPS and Common Apache Security Tips

WWW Security Assistant Script ► Iptables

Here is presented the script www-security-assistant.bash. It could help you with the handling of the malicious IP addresses. The script has two modes.

Automatic mode

When an external program, as Apache's mod_security, provides a malicious $IP address. In this case, the syntax that invokes the script, should be:

www-security-assistant.bash <ip-address> Guardian
www-security-assistant.bash <ip-address> ModSecurity
www-security-assistant.bash <ip-address> ModEvasive
www-security-assistant.bash <ip-address> a2Analyst

In this mode the script provides two action stages and for every action it will send an email to the administrator(s).

First stage: for the first few 'transgressions' the source $IP will be banned for a period of time equal to the value of $BAN_TIME. This mode uses the command at.
Second stage: when the number of the transgressions from certain $IP becomes equal to the value of $LIMIT, this $IP address will be banned permanently through Iptables and will be added to the $BAN_LIST.

Manual mode

This mode accept the following options:

www-security-assistant.bash <ip-address> --DROP "log notes"

Creates an entry into the file /var/www-security-assistant/iptables-DROP.list and generates a rule as:

iptables -A GUARDIAN -s $IP -j DROP

www-security-assistant.bash <ip-address> --DROP-CLEAR "log notes"

Creates an entry into the file /var/www-security-assistant/iptables-DROP-CLEAR.list, remove the certain Iptables rule, removes the $IP from the history and from the $BAN_LIST:

iptables -D GUARDIAN -s $IP -j DROP

www-security-assistant.bash <ip-address> --ACCEPT "log notes"

Creates only an entry into the file /var/www-security-assistant/iptables-ACCEPT.list.
www-security-assistant.bash <ip-address> --ACCEPT-CHAIN "log notes"

Creates an entry into the file /var/www-security-assistant/iptables-ACCEPT.list and generates a rule as:

iptables -A GUARDIAN -s $IP -j ACCEPT

Dependencies

The script uses iptables-save.sh and the iptables chain GUARDIAN, explained in the next section. It will create and maintain few files within the $WORK_DIR:

www-security-assistant.history - contains the data for the previous IP's transgressions.
www-security-assistant.mail - the content of the last email sent by the script.
iptables-ACCEPT.list; iptables-DROP.list and iptables-DROP-CLEAR.list.

The script needs a minimal configuration to send emails:

sudo apt install s-nail mutt mailutils postfix
sudo dpkg-reconfigure postfix  # For General type: Internet Site
echo 'Test passed.' | mail -s Test-Email email@example.com

If there is any configured HTTPS service its TLS certificate can be used within the Postfix service.

In addition the script uses at: sudo apt install at.

Installation

Create work directory, let's call it /var/www-security-assistant. Download www-security-assistant.bash and make it executable:

sudo mkdir /var/www-security-assistant
sudo wget https://raw.githubusercontent.com/pa4080/www-security-assistant/ask_ubuntu/www-security-assistant.bash -O /var/www-security-assistant/www-security-assistant.bash
sudo chmod +x /var/www-security-assistant/www-security-assistant.bash

Make www-security-assistant.bash available as custom command:

sudo ln -s /var/www-security-assistant/www-security-assistant.bash /usr/local/bin/

Grant permission to www-data to run www-security-assistant.bash without password via sudo. Use the following command to create and edit safely a new file with an additional 'sudoers' rule:

sudo visudo -f /etc/sudoers.d/www-security-assistant

Add the following line inside the file - save the file and exit:

www-data ALL=(ALL) NOPASSWD: /var/www-security-assistant/www-security-assistant.bash

Tweak www-security-assistant.bash. Change at least the value of the variable $EMAIL_TO.

Check-up

Represent yourself as $AGENT and check whether the Automatic MODE works properly:

www-security-assistant.bash 192.168.1.177 Guardian

Then check your e-mail, type iptables -L GUARDIAN -n, review the files www-security-assistant.history and www-security-assistant.mail. Run the above command 5 times and review the files iptables-DROP.list and iptables-CURRENT.conf.
Check whether the Manual MODE works properly - add your localhost to the White List:

www-security-assistant.bash 127.0.0.1 --ACCEPT "Server's localhost IP"

Then check the file iptables-ACCEPT.list.

  The rest part of this tutorial is how to integrate www-security-assistant with your system.

Iptables – Basic Configuration – Save and Restore

Basic configuration

Please read this manual before adding the following rules.

sudo iptables -F

sudo iptables -I INPUT 1 -i lo -j ACCEPT
sudo iptables -I INPUT 2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# This rule may lock you out of the system!
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT

Before you do the next actions open a new SSH connection and try to login into your system to check whether everything works fine!

Save and Restore

This could be achieved via custom scripts, that will save and restore the iptables coning during system's stop-start (or reboot) process. (If we using UFW to setup Iptables rules this step is not needed.)

printf '#!/bin/sh\n/sbin/iptables-save > /var/www-security-assistant/iptables-CURRENT.conf\nexit 0\n' | sudo tee /var/www-security-assistant/iptables-save.sh
printf '#!/bin/sh\n/sbin/iptables-restore < /var/www-security-assistant/iptables-CURRENT.conf\nexit 0\n' | sudo tee /var/www-security-assistant/iptables-restore.sh
sudo chmod +x /var/www-security-assistant/iptables-restore.sh /var/www-security-assistant/iptables-save.sh

sudo ln -s /var/www-security-assistant/iptables-save.sh /etc/network/if-post-down.d/iptables-save
sudo ln -s /var/www-security-assistant/iptables-restore.sh /etc/network/if-pre-up.d/iptables-restore

Create new chain

Create new chain, called GUARDIAN and insert it as number 3 into the INPUT chain:

sudo iptables -N GUARDIAN
sudo iptables -I INPUT 3 -j GUARDIAN

Check-up

Reboot the system and check the configuration. Please use sudo systemctl reboot (do not use the force option reboot -f). When the system is back online we can check if the newly created chain exists by:

sudo iptables -L GUARDIAN -n

ModEvasive for Apache2

  ModEvasive is an evasive maneuvers module for Apache to provide
  evasive action in the event of an HTTP DoS or DDoS attack or brute
  force attack. Read more...

Installation

Install and enable the module:

sudo apt install libapache2-mod-evasive
sudo a2enmod evasive

Create Log Directory and make it accessible for www-data:

sudo mkdir -p /var/log/apache2_mod_evasive
sudo chown www-data /var/log/apache2_mod_evasive

Adjust the basic configuration – uncomment and edit certain directives in the configuration file:

/etc/apache2/mods-enabled/evasive.conf

Restart Apache: sudo systemctl restart apache2.service.

Check-up

Open a web page from your server and refresh the browser window few times intensively (press F5) - you must get 403 Forbidden error message. Into the log directory, will be generated a new lock file. This file should be deleted for further transgressions detection from this IP address.

ModEvasive ► WSAS ► Iptables

Here we will configure mod_evasive to talk to iptables through the www-security-assistant.bash, created in the above section.

Edit /etc/apache2/mods-available/evasive.conf in this way:

<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        9
    DOSSiteCount        70
    DOSPageInterval     2
    DOSSiteInterval     2
    DOSBlockingPeriod   10

    #DOSEmailNotify     your@email.foo
    DOSLogDir           "/var/log/apache2_mod_evasive"
    DOSSystemCommand    "sudo /var/www-security-assistant/www-security-assistant.bash %s 'ModEvasive' 'AutoMode' >> /var/www-security-assistant/www-security-assistant.execlog 2>&1"
</IfModule>

Create log file and Restart Apache:

sudo touch /var/www-security-assistant/www-security-assistant.execlog && sudo chown www-data /var/www-security-assistant/www-security-assistant.execlog

To test this configuration we can simulate DDOS attack via the F5 method, mentioned above, or we can use a commands as ab, hping3, etc.

Attention: Be careful because the iptables rule, used in WSAS, will DROP all new connections from the source $IP, including your SSH connections. It is good to have a backup way to connect to the server during the tests. You can change this rule to work only with the HTTP/HTTPS ports.

ModSecurity 2.9 for Apache2

  ModSecurity is a web application firewall engine that provides very
  little protection on its own. In order to become useful, ModSecurity
  must be configured with rules. In order to enable users to take full
  advantage of ModSecurity out of the box, Trustwave's Spider Labs is
  providing a free certified rule set... Read more...

Installation

Install and enable the module:

sudo apt install libapache2-mod-security2
sudo a2enmod security2

Create configuration file:

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Read and edit /etc/modsecurity/modsecurity.conf carefully! Add or change at least the following directives:

# -- Rule engine initialization ----------------------------------------------
SecRuleEngine On

# -- Debug log configuration -------------------------------------------------
SecDebugLogLevel 2
SecDebugLog "/var/log/apache2_mod_security/modsec_debug.log"

# -- Audit log configuration -------------------------------------------------
SecAuditLog "/var/log/apache2_mod_security/modsec_audit.log"

# -- Guardian log configuration -------------------------------------------------
SecGuardianLog /var/log/apache2_mod_security/modsec_guardian.log

The file /etc/apache2/mods-enabled/security2.conf involves /etc/modsecurity/modsecurity.conf into Apache's configuration. At this stage security2.conf shall look as this:

<IfModule security2_module>
    SecDataDir /var/cache/modsecurity
    IncludeOptional /etc/modsecurity/*.conf
</IfModule>

Create Log Directory:

sudo mkdir -p /var/log/apache2_mod_security

Setup log rotation. First create config file:

sudo cp /etc/logrotate.d/apache2 /etc/logrotate.d/apache2-modsec

Then edit the new file in this way:

/var/log/apache2_mod_security/*.log { … }

Restart Apache.

Check-up

Create an additional configuration file in /etc/modsecurity, call it for example z-customrules.conf, and add the following rule as its content:

# Directory traversal attacks
SecRule REQUEST_URI "../" "t:urlDecodeUni, deny, log, id:109"

Restart the server: sudo systemctl restart apache2.service. Open your browser and type https://example.com/?abc=../. The result will be: 403 Forbidden. Check the log files in /var/log/apache2_mod_security for more details.
To make the things more fun place the script issues.php in an appropriate location within your DocumentRoot (here I'm assuming this place is /var/www/html):

sudo wget https://raw.githubusercontent.com/pa4080/www-security-assistant/ask_ubuntu/appendix/var/www/html/issues.php -O /var/www/html/issues.php

Then modify the above rule in the following way:

# Directory traversal attacks with redirection (or use URL instead of URI: redirect:'https://example.com/issues.php')
SecRule REQUEST_URI "../" "t:urlDecodeUni, deny, log, id:109, redirect:'/issues.php'"

Restart Apache, then open your browser and type https://example.com/?abc=../ ;-) The idea is borrowed from the SE's script BotLovin.cs.
Edit /etc/modsecurity/z-customrules.conf once again and comment (disable) the rule - this was just test example and it is covered by OWASP CRS, described in the next section.
Here is another example where we will redirect all wp-admin page requests, but except these from certain IP addresses (note the chain):

# Block wp-admin access
SecRule REQUEST_URI "^/wp-admin" "id:108, log, deny, status:403, t:lowercase, chain, redirect:'/issues.php'"
    SecRule REMOTE_ADDR "!@ipMatch 192.168.1.11,99.77.66.12"

Here we have two disruptive actions: (1) deny, status:403 and (2) redirect:'/issues.php'. Actually we do not need of the deny action because it will be override by the redirect action.

ModSecurity OWASP Core Rule Set 3.x

In Ubuntu 16.04 you can install CSR 2.x: apt install modsecurity-crs. Here we will install CSR 3.x, detailed instructions are provided within the Installation manual (git is required).

Installation

Clone CSR in the folder /usr/share/modsecurity-crs.3:

sudo git clone https://github.com/SpiderLabs/owasp-modsecurity-crs /usr/share/modsecurity-crs.3

Upgrade and auto renew the GeoIP database. (The GeoIP DB is no longer included with the CRS. Instead you are advised to download it regularly.) The script util/upgrade.py brings this functionality. You can use it as follows in cron - sudo crontab -e:

0 2 * * * /usr/share/modsecurity-crs.3/util/upgrade.py --geoip --crs --cron >> /var/log/apache2_mod_security/owasp-crs-upgrade.log 2>&1

Create configuration files:

sudo cp /usr/share/modsecurity-crs.3/crs-setup.conf{.example,}
sudo cp /usr/share/modsecurity-crs.3/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf{.example,}
sudo cp /usr/share/modsecurity-crs.3/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf{.example,}

Read and edit these files carefully! Uncomment at least SecGeoLookupDB directive:

SecGeoLookupDB util/geo-location/GeoIP.dat

Apply the Apache's configuration. Edit /etc/apache2/mods-available/security2.conf in this way:

<IfModule security2_module>
    SecDataDir /var/cache/modsecurity
    IncludeOptional /etc/modsecurity/*.conf
    IncludeOptional /usr/share/modsecurity-crs.3/crs-setup.conf
    IncludeOptional /usr/share/modsecurity-crs.3/rules/*.conf
</IfModule>

Save the file and then restart Apache.

ModSecurity Rules Whitelisting

Whitelisting of ModSecurity Rules could be done via the following ModSec directives, that can be used system wide or within virtual host's configuration, also globally, for specific directories or location matches:

SecRuleRemoveById
SecRuleRemoveByMsg
SecRuleRemoveByTag
SecRuleUpdateTargetById
SecRuleUpdateTargetByMsg
SecRuleUpdateTargetByTag
SecRuleUpdateActionById

Disable mod_security2 for PhpMyAdmin. Change /etc/phpmyadmin/apache.conf in this way:

<Directory /usr/share/phpmyadmin>
    <IfModule security2_module>
        SecRuleEngine Off
    </IfModule>
</Directory>

Disable specific rules for certain directory:

<Directory /var/www/html>
    <IfModule security2_module>
        SecRuleRemoveById 973301
    </IfModule>
</Directory>

Disable rules globally. For this purpose we must add our directives somewhere in Apache's configuration files: /etc/modsecurity/z-customrules.conf is a good place.

Disable rules within the entire Apache's configuration:

SecRuleRemoveById 973301 950907

Whitelist an IP address so it can pass through ModSecurity:

SecRule REMOTE_ADDR "@ipMatch 192.168.110.1" "phase:1,nolog,allow,ctl:ruleEngine=Off,ctl:auditEngine=Off"

Disable rules within Directory match:

<Directory /var/www/mediawiki/core>
    SecRuleRemoveById 973301 950907
</Directory>

Update rule's action by its ID within Location match:

<LocationMatch "/index.php.*">
    SecRuleUpdateActionById 973301 "pass"
    SecRuleUpdateActionById 950907 "pass"
</LocationMatch>

In the above examples we assume that 973301 and 950907 are rule IDs that obstruct the normal work of our web apps. We can find rules as these by an analyze of modsec_audit.log.

ModSecurity Rules ► WSAS ► Iptables

Here are given few more examples how to create custom SecRules, also how we can call WWW Security Assistant Script (WSAS) through them.

Initial Setup

We need of an additional startup scrip - modsecurity-assistant.sh. The reason is that, ModSecurity's exec action has too simple and limited syntax.

sudo wget https://raw.githubusercontent.com/pa4080/www-security-assistant/ask_ubuntu/modsecurity-assistant.sh -O /var/www-security-assistant/modsecurity-assistant.sh
sudo chmod +x /var/www-security-assistant/modsecurity-assistant.sh

If you look inside the script you will see few variables that are exportd by ModSecurity. These are: $REQUEST_URI, $ARGS, $SERVER_NAME, $REMOTE_ADDR, $REMOTE_HOST and $UNIQUE_ID. The other variables are explained inside the script.

Create custom rule and call our scripts through it

First let's create a rule that will execute modsecurity-assistant.sh (and call www-security-assistant.bash) when the request URI contains a word that is included in our blacklist. Open /etc/modsecurity/z-customrules.conf and add the following lines to the bottom:

# REQUEST_URI words blacklist
#
SecRule REQUEST_URI "@pmFromFile /var/www-security-assistant/modsecurity-uri-black.list" \
    "id:150, log, t:lowercase, chain, \
    drop, deny, status:403, redirect:'/issues.php'"
    SecRule REMOTE_ADDR "!@ipMatchFromFile /var/www-security-assistant/modsecurity-ip-white.list" \
        "setenv:REMOTE_HOST=%{REMOTE_HOST}, \
         setenv:ARGS=%{ARGS}, \
         exec:/var/www-security-assistant/modsecurity-assistant.sh"

REQUEST_URI - this variable contains the full URI from the current request. The rule culd be more wide: SecRule REQUEST_URI|ARGS|REQUEST_BODY ...
@pmFromFile will read the file modsecurity-uri-black.list that contains list of phrases, where each specific phrase or word is placed into a new line. You can collect interesting words and phrases from the log files. If there is a particular match between REQUEST_URI and our list of patterns the rule will be applied. The file could be empty, but you must create (touch) it.
The log action will create log entries in the log files for this rule with id:150.
drop, deny (with status) and redirect actions belong to the disruptive group of actions, they must be in the beginning of the rule chain (if there is a chain). The second action will override the first one and the third will override the second, so you must choice which you want to be performed and can delete the others.
chain action will call the next rule of of the chain, note that second rule, doesn't have id.
REMOTE_ADDR contains the IP address of the request.
@ipMatchFromFile will the file modsecurity-ip-white.list that contains white-list of IP addresses, separated at new lines. CIDR  entries are also acceptable. Because the disruptive action is always located in the leading rule of the chain it will be applied, but when certain IP is in this white list the exec action will not be applied. The file could be empty, but you must create (touch) it.
exec action will call our external script. This action isn't disruptive and will be executed when the current rule return true. When this action is applies the remote IP will be processed through our scripts.
setenv this action will export certain internal variables =%{...} as envvars, exported names can be different from the internals. Some variables must be exported manually, some other are exported automatically - probably it is a small bug (in some cases the manual export with the same names, for example setenv:REQUEST_URI=%{REQUEST_URI}, will cause a blank value of the exported variable).

Check-up

Let's assume you do not have Joomla on your server, edit the file modsecurity-uri-black.list and add a line with content /joomla. Then type in your browser https://exemple.com/joomla. You should be redirected and blocked through Iptables. Clear the records sudo www-security-assistant.bash <your-ip> --DROP-CLEAR 'some note', add your IP in modsecurity-ip-white.list and do the exercise again. Now you should be redirected, but not blocked.

Connect our scripts with OWASP Core Rule Set 3.x

To do that we will update the default action of the Anomaly Mode Rules (949110 and 959100). For this purpose edit the file  /usr/share/modsecurity-crs.3/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf and add the next lines to the bottom:

# -- Anomaly Mode - Update actions by ID -----
#

SecRuleUpdateActionById 949110 "t:none, drop, deny, status:403, redirect:'/issues.php', \
     setenv:REMOTE_HOST=%{REMOTE_HOST}, setenv:ARGS=%{ARGS}, \
     exec:/var/www-security-assistant/modsecurity-assistant.sh"

SecRuleUpdateActionById 959100 "t:none, drop, deny, status:403, redirect:'/issues.php', \
     setenv:REMOTE_HOST=%{REMOTE_HOST}, setenv:ARGS=%{ARGS}, \
     exec:/var/www-security-assistant/modsecurity-assistant.sh"

# -- Anomaly Mode - Whitelist some URI and IP addresses -----
#

SecRule REQUEST_URI "^/wp-admin/admin-ajax.php*|^/index\.php\?title=.*&action=(submit|raw&ctype=text/javascript|raw&ctype=text/css)$" \
    "id:'999010', t:none, phase:1, pass, \
     ctl:ruleRemoveById=949110, \
     ctl:ruleRemoveById=959100"

SecRule REMOTE_ADDR "@ipMatchFromFile /var/www-security-assistant/modsecurity-ip-white.list" \
    "id:'999020', t:none, phase:1, pass, \
     ctl:ruleRemoveById=949110, \
     ctl:ruleRemoveById=959100"

Check-up

Don't forget to restart (or reload) Apache to apply the configuration changes. Don't forget to clear the records periodically during the tests, otherwise you can be blocked permanently :-)

Simulate directory traversal attack:

https://example.com/?abc=../../../                         # This should be redirected and blocked
https://example.com/wp-admin/admin-ajax.php?abc=../../../  # This should pass because of the whitelist rule

Simulate SQL Injection attack:

https://example.com/?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1
https://example.com/index.php?username=1'%20or%20'1'%20=%20'1'))/*&password=foo

ModSecurity and Apache Log Files

  The Apache web server can be configured to give the server
  administrator important information about how it is functioning...
  The main avenue for providing feedback to the administrator is through
  the use of log files. Read more...

ModSecurity has powerful logging mechanism. By the directive SecGuardianLog it provides a log feed specially designed to work with external scripts.

  Currently the only tool known to work with guardian logging is
  httpd-guardian, which is part of the Apache httpd tools
  project. The httpd-guardian tool is designed to defend against
  denial of service attacks. It uses the blacklist tool to
  interact with an iptables-based... firewall, dynamically blacklisting
  the offending IP addresses. Read more...

ModSecurity Log Files ► Fail2Ban ► Iptables

It is possible to setup Fail2Ban for data parsing of Apache's log files. modsec_audit.log is probably the best choice, but see also the sections where we talk about of SecGuardianLog.

Take care that SecAuditLogRelevantStatus in /etc/modsecurity/modsecurity.conf is commented. Otherwise everyone that receives a 404 error page would be blocked by fail2ban.

SecAuditEngine RelevantOnly
#SecAuditLogRelevantStatus "^(?:5|4(?!04))"

Currently Fail2Ban is not implemented in any way in this project.

ModSecGuardianLog ► HTTPD-Guardian ► WSAS ► Iptables

  httpd-guardian - detect DoS attacks by monitoring requests
  Apache Security, Copyright (C) 2005 Ivan Ristic - is designed to
  monitor all web server requests through the piped logging mechanism.
  It keeps track of the number of requests sent from each IP address...
  httpd-guardian can either emit a warning or execute a script to block
  the IP address...

  This script can be used with Apache2 logging mechanism, or with
  ModSecurity (better).

Installation and Setup within the Current Circumstances

Download httpd-guardian and make it executable:

sudo wget https://raw.githubusercontent.com/pa4080/www-security-assistant/ask_ubuntu/httpd-guardian.pl -O /var/www-security-assistant/httpd-guardian.pl
sudo chmod +x /var/www-security-assistant/httpd-guardian.pl

Read lines 98-119 to see how the script is connected with our WSAS script.

Apply the following change within Apache's configuration (/etc/modsecurity/modsecurity.conf), then restart it:

#SecGuardianLog /var/log/apache2_mod_security/modsec_guardian.log
SecGuardianLog "|/var/www-security-assistant/httpd-guardian.pl"

Check-up

To test the script disable ModEvasive (sudo a2dismod evasive don't forget to enable it later) and restart Apache. Then tail the exec log:

tail -F /var/www-security-assistant/www-security-assistant.execlog

And from another instance perform DoS attack, for example use ab in this way:

for i in {1..20}; do (ab -n 200 -c 10 https://example.com/ &); done

ModSecGuardianLog ► Custom Analyze ► WSAS ► Iptables

Here is presented a simple script, called httpd-custom-analyze.bash, that isn't something special but could be a nice example. Its features are described within the script's body.

Installation and Setup

Download httpd-custom-analyze.bash and make it executable:

sudo wget https://raw.githubusercontent.com/pa4080/www-security-assistant/ask_ubuntu/httpd-custom-analyze.bash -O /var/www-security-assistant/httpd-custom-analyze.bash
sudo chmod +x /var/www-security-assistant/httpd-custom-analyze.bash

Apply the following change within Apache's configuration (/etc/modsecurity/modsecurity.conf) and restart it:

#SecGuardianLog /var/log/apache2_mod_security/modsec_guardian.log
#SecGuardianLog "|/var/www-security-assistant/httpd-guardian.pl"
SecGuardianLog "|/var/www-security-assistant/httpd-custom-analyze.bash"

The script will call WSAS when the threshold is reached - read line 86 and 35.
To get both httpd- scripts to work simultaneously edit modsecurity.conf and pipe SecGuardianLog to both.
To perform a test follow the tips from the above section.


Ubuntu server 16.04.4 hangs on reboot but not poweroff

You appear to experiencing a kernel bug or hardware failure, since you triggered a general protection fault.

This is likely hardware-specific.

I would recommend trying to upgrade to an 18.04 beta, since 18.04 is nearing release, and seeing if the newer kernel fixes it.

Otherwise, consider searching for a kernel bug report about that relates to your hardware. If none is found, considering opening a new kernel bug report about it.


Specify calendars in gnome notification area

It's not really intuitive, but it seems the calendars used for the notification area can be selected in Evolution calendar. After activating the corresponding calendars, a refresh in the notification area only occurs after browsing in the month back and forth (or vice versa). I don't know yet, if this is reboot proof, but I'd say it's improvable nonetheless. There should be a tool icon to configure the calendars. At least, the GNOME Tweak Tool should offer some way of selecting the calendars to display there.


Linux kernel image 3.2.0 on 32 bit x86 SMP but I have only 1 GB RAM

Kernel images are tested just like any other update so if they appear in the standard update list then, unless you have a very unusual system, they are safe to install. Kernel updates are only problematic if you have unusual hardware or are using an custom made kernel.

The standard kernel releases are usually built with SMP and PAE enabled.

SMP (Symmetric Multi-Processing) allows software to use multiple processors or multiple cores, which many CPU's now have. If you have an older single core CPU, the kernel will simply switch of the SMP capabilities without a problem.

PAE (Physical Address Extensions) allows a 32-bit process to map address to more than 4GB. If you don't have that much RAM then, again, the kernel simply doesn't use the feature.

Since kernel upgrades often include security or bug fixes, if they appear in the standard software update list, then you probably do want to install them.


How can I make this deploy/init run as a non root user?

In defiance of popular lore, su means "switch user" and not "superuser". So

su user -c command

(issued by root) should work. Example:

root@pern:~# su romano -c whoami
romano


netplan default gateway / route Internet traffic to WiFi

I answer to myself: dhcp may reset the default gateway, and the metrics we could specify in the netplan configuration are also overridden.

This works:

network:
  version: 2
  renderer: NetworkManager
  ethernets:
    enp5s0:
      dhcp4: false
      addresses: [192.168.1.143/24]
      routes:
        - to: 192.168.1.0/24
          via: 192.168.1.1
          metric: 10
  wifis:
    wlp4s0:
      dhcp4: true
      access-points:
        "My WiFi Network":
          password: "foobar"
      gateway4: 10.128.128.128


Run newaliases . If /etc/aliases doesn't exist then create it first, then run newaliases .
Also maybe update/add alias_maps = hash:/etc/aliases to /etc/postfix/main.cf to get rid of the other warning.
Then try again.

If you test with telnet, you don't need working DNS.

Edit 1

This is my working main.cf from my working postfix

cat /etc/postfix/main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = xxx.yyy.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = xxx.yyy.net, localhost.yyy.net, localhost
relayhost = smtp.yyy.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all

I use relayhost. That means that all mail I send trough ISP smtp server.
You can copy/paste this config and change myhostname, mydestination, relayhost ...

Try


Help with installing brother printer MFCJ270W

In 12.04, and in 11.10 and 11.04, simply clicking on the .deb file should open the package manager, where you just press the "install" button. but if you want to use the terminal, more power to you. I would the the cupswrapper.deb file. download it, and keep in mind where its saved. for this example, I saved it in my Downloads folder.

according to Brother, you have 1 dependencies, lets install them first in terminal:

sudo apt-get install ia32-libs

it might already be installed, but its good to check.
now to the .deb file. navigate to where you saved the file in your terminal. for me, thats my download folder:

cd /home/jmartin2279/Downloads

do and "ls" to verify you see the .deb
now type:

sudo dpkg -i cupswrapper.deb

and follow the onscreen instructions, if any.
thats it!

I dont know how long it will take to run the deb. I know HP drivers took about 10 minutes on my system, but it was a much larger file.


Unity top panel changed after resetting unity

you can adjust that by installing unity tweak tool as

sudo apt-get install unity-tweak-tool

then under unity , click on panel , there you can adjust transparacy level as your perference and even if tranparent panel doesnt occur then turn off background blur under search option that will do the trick


There can be many causes for overheating. The most common of which is Heatsink clogging.

Computer's heatsink can get clogged with dust and dirt. You may have to clean the heatsink of your computer.
This can be done by blowing into the heatsink vent with compressed air or simply with your mouth.
The other more comprehensive method is to completely dismantle your laptop and physically clean your heatsink.
The procedure for cleaning varies from computer to computer and you can get it done from a Hardware guy if you are not confident of doing it yourself.

You can also consider buying a Cooling Pad ($10-$30) which can keep your computer cool.

Heating is also affected by the level of usage. Playing demanding games and using graphics editing software for extended time can generate greater levels of heat.


installing ubuntu in a predefined partition

Boot up with live Ubuntu CD or bootable Ubuntu usb
Choose 'Something else' installation type
Delete the partition in which to install Ubuntu
Create Ext4 partition and separate swap space greater than equal to your physical RAM
Select the mount point for Ext4 partition to be '/'
Perform install.

Note: Creating a separate partition for home folder is a good idea. You can refer to this article for that.

Also, You can refer to this article for step-by-step installation of Ubuntu.


Try running Boot Repair on your system. If that fails, post back with the URL that the utility should give you.


I believe this is common for (older) systems running integrated graphics chipsets rather than discreet video cards, particularly when the chipset was predominantly used in laptops. My server (which has an ATI Rage XL integrated graphics chipset) displays the the monitor as "Laptop" in 12.04.


Kubuntu 14.10 create password protected archive

What program are you using?, I recommend using PeaZip:
http://sourceforge.net/projects/peazip/files/5.5.3/peazip_5.5.3.LINUX.GTK2-2_i386.deb/download

On how to encrypt in PeaZip (in Windows):

This will give you a basic idea, Screenshot not working....

Double click the Peazip shortcut on the desktop.
You will see the following dialog box:

Browse to the file that you want to ZIP.
Right click on the file you want to Zip and the following options appear:

Click on ADD and the following screen will appear:

Click on the ADVANCED tab to get the following page:

Check the desired Encryption Algorithm.
Click on the ARCHIVE TAB again to get back to this screen:

Click on the LOCK next to the PASSWORD IS NOT SET (right below Output).
You’ll see the following Password entry screen pop up:

Enter the password and enter it again to confirm password.  Leave everything else alone.
Click OK to get out of the PASSWORD entry dialog box.
Click OK and you’ll see a new ZIP file saved…usually in the same location where the file you want to ZIP is located.


No it's not possible to set a password to specifically protect wifi activation.
But you can deactivate the wlan interface with [sudo] ifdown wlan0.
To activate the interface again with [sudo] ifup wlan0 root privileges are required, so the user has to know the root password.


run gnome-terminal with executable command

For a new variable, you can export it, such as:

> export NEWVAR=something

However as in this case, the PATH variable is set by the shell's initialization scripts (/etc/profile, ~/.bashrc, etc).  Changes to PATH in the parent shell are blown away by those initialization scripts in the child shell.  Options you have:

Ensure whatever you are trying to run is in a well-known location (/usr/local/bin, etc)
Ensure you specify the full path when you run gnome-terminal
Reset the variable as part of the execution:

  gnome-terminal -x bash -c 'export PATH=$PATH:/.; whatever.sh'


Unable to upgrade dell vostro 3558 laptop to ubuntu 16.04LTS from 14.04LTS properly

If you have another computer, make a live USB with Ubuntu or another Linux, boot on it, go to the partition where your current Ubuntu is and backup your data .

You can try Boot-Repair from that Live USB and see if it fix your problem. If that doesn't fix it and you don't get a better answer, just install a fresh Ubuntu 16.04 as I guess that the factory reset will just get you back to a fresh Ubuntu 14.04.


Headphone jack disabled in windows, after using Ubuntu

I don't have a full and fool-proof solution that I can offer, but I do know that this happens with some hardware, where the headphone jack sense is "muted" by ALSA.

To turn it back on, you can use alsamixer:

My screenshot does not display the option for headphone jack sense because my card does not support it, but it is similar to the S/PDIF option. Select it with your keyboard ← and → and press M to mute or unmute it. These settings should stick with the system even when you reboot.

Depending on your sound card configuration, it may also be another option in ALSA's configuration that causes the problem, so if it doesn't work, be sure to look for any suspect features. You can also expand on your problem in your question (with a screenshot of your sound card options from alsamixer if this doesn't work, and I'll see if I can give an update to my answer.


How can I modify/delete folders in Shotwell's sidebar?

Those folders are real folders on your hard drive.

By default, your Shotwell folder is just ~/Pictures.

Open Nautilus (the file manager), and navigate to it. You will see the parent folder (e.g. 2012, then go to the empty folder, e.g. December) and then you can delete it.

Click for bigger image.


How to dual-boot Ubuntu on a separate drive?

First, read this please:
https://help.ubuntu.com/community/WindowsDualBoot "WindowsDualBoot"


How to enable Wireshark without running as root in Trusty 14.04

I found that after running:

sudo dpkg-reconfigure wireshark-common

a wireshark group been created in /etc/gshadow. So I just wrote:

sudo gpasswd -a $USER wireshark

and logout/login and now it works fine!


The Windows file system looks dirty to Ubuntu, so it gets mounted in readonly mode in Ubuntu. This is because Windows uses a hibernation file to save the system state.

You'll need to do this in Windows:

open the Power control panel
click on change what the power buttons do
click on change options that are unavailable
uncheck fast start
close the Power control panel
open an administrative command prompt window
type powercfg /h off (turns off hibernation)
type chkdsk /f c: (change c: to the correct drive letter, if required)
approve that chkdsk runs at next boot time
reboot Windows

Rather than directly editing/deleting/etc files on your Windows partition, I'd recommend creating a shared NTFS partition on your hard disk that's accessible from both Windows and Ubuntu.


SSL on one domain and not the server ip or any virtual hosts (nginx)

I didn't try it, but I think a redirection should work.

Try adding this after the server block where you configure the SSL connection on the IP :

server {
       listen 443;
       server_name *;
       return 301 http://$http_host$request_uri;
 }


Can I Install Old Packages on Newer Version of Ubuntu?

You won't be able to get the same settings on each package automatically, but you should be able to install the same packages themselves again from where you got them from.

You may have some problems as this is a newer, rawer version of Ubuntu. If you do, post them here and also press Ctrl + Alt + T and type in ubuntu-bug packagename (replacing packagename with the name of the package), this will bug report them with log files.


I'm a bit confused about the title, but to answer your question

  I'm going to be connecting from variable ip addresses via ssh. Given this requirement what should I set the first line in the screenshot to, to make sure I retain access?

sudo ufw allow 22 or even sudo ufw allow OpenSSH will open up port 22 to the world.

I didn't look at your links, but I hope they also suggest using keys instead of password login.


Create folder loop function doesn't work

Just simply use

mkdir name{1..2}

instead of your script/function.

The command above will create two folders

name1
name2

Alternatively - a corrected version of your script:

#!/bin/bash
function createDirs () {
  start="$1";
  end="$2";
  name="$3";
  for ((i=start; i<end; i++)); do
    mkdir "$name$i"
  done
}

createDirs "$@"


Can I allocate 'free space' on my harddrive to a partition?

You can boot up into a LiveCD and use GParted to expand the third partition. You should make sure to back up your files before this in case something goes wrong, but it should expand the partition properly, and you will have an extra 28GB of space.


Why don't you use Evernote itself? An alternative I've fiddled with is the combination. A review ofthis method can be found here. A comparison of Evernote vs RedNotebook can be found here. The Rednotebook project page is avaliable here.


Disable sudo password and ask yes or no like in Windows

It's important to note that Ubuntu will never be like Windows. Ubuntu is it's own OS and if you prefer windows features then you should install windows.

That being said, you can configure Ubuntu to never ask you for a sudo password.

Open terminal and type:

sudo visudo

In the bottom of the file, add the following line:

$USER ALL=(ALL) NOPASSWD: ALL

Where $USER is your username on your system. Save and close the sudoers file.

When you install programs from terminal, it will still confirm whether you want to install it or not but you won't have to input your password.


I have two hybrid laptops running 17.04, an old ThinkPad and a P50 (2016). These are Nvidia Optimus machines, both with the 'enterprise class' Quadro graphics and proper hardware multiplexing which cheaper laptops don't have. This renders Optimus problems in linux a bit moot, however, I have optimus working anyway.

I spent quite some time working through this problem, and I present The Answer. If you have my machines, anyway.

My laptops have a bios setting to disable the intel graphics and use only the nvidia card, which it describes as Discrete mode. This requires the hardware multiplexing which the mobile workstation ThinkPads have. In this mode, it is easy to get rid of tearing. This is solution (1). But this may not be an option.

If the Nvidia control panel is letting you choose nvidia or intel, you are in hybrid mode.

If you want to use hybrid graphics, or if you have no choice, it is easy to avoid tearing on external monitors since they are driven from the nvidia hardware. Is the tearing only on the laptop panel, or on external monitors? External monitor tearing is fixed by force pipeline composition, in my experience of the two machines. Full pipleline is not needed. This is solution (2a) but it doesn't stop tearing on the laptop panel. You can turn it on from the nvidia control panel or via the command line (good for a start-up script).
See screen shot below. There is a trick: you need to select an external monitor, not the internal panel, and then click Advanced...
A command line script is below.

But to stop tearing on the intel panel in nvidia prime mode, you need Prime sync. This is the most difficult thing to get working. I use gnome desktop on 17.04, but forget about using gdm3. Stay with lightdm as the display manager. gdm3 has a bug at the moment, it seems to force an wayland session and that's not working. With lightdm, you can enable prime sync for a tear free experience, using the very latest nvidia drivers (which are in a PPA I assume you have discovered). You need to create a new modprobe file named to load after the existing nvidia one, and then you rebuild your initramfs for this (purging and reinstalling nvidia drivers does this as a side-effect, but it takes a bit longer). I'll update this answer with full instructions if this is your situation. It works well now, with the latest drivers (about a week old). Until then, it worked but we got kernel panics. Now it seems stable. There is a forum at nvidia for linux drivers which has a very active thread.
So getting prime sync working is solution (2b)

I'm not sure there is much point of Prime sync on my laptop; I can also get what I want by using discrete mode if using multi-monitors (nearly all the time), and when I want long battery life, I swap to prime-select intel under hybrid mode. This means a trip to bios settings, but changing prime mode requires a reboot anyway. In other words, I never really need it, but it does work (now).

If you run hybrid graphics in intel mode, it is easy to fix tearing on the laptop panel, since the nvidia card disappears from the picture (literally). Prime sync is therefore irrelevant. No external monitors, in this case, of course.
On my laptop, I have to use a setting to enable tear-free intel; this is an xorg setting. I have a script prime-select_tim which restores that setting when running in intel mode, and removes it when running in nvidia mode. That's because x wouldn't start in prime select nvidia if this config was still active in /usr/share/X11/xorg.conf.d
You said you had trouble when trying to use the intel profile. I found X to be very fussy with the contents of /usr/share/X11 when running in hybrid Nvidia mode. It works if you add nothing (which is why I have a script which hides my 20-intel.conf file if I change to hybrid nvidia mode).

Also note that you should make sure you have the package xserver-xorg-video-intel installed. The package description implies that you won't need it ("discouraged if your hw is new enough (ca. 2007 and newer)." Despite that, it's essential.

This is solution (3). Note I don't know if leaving this file in xorg.conf.d when in hybrid-nvidia mode still causes problems, I haven't tested that for a while.

This is my 20-intel.conf to fix tearing on the laptop panel when in hybrid-intel mode. It does not fix tearing on the laptop panel when in hybrid-nvidia mode (in fact, even merely leaving this file there may stop X from starting). Only Prime sync can help you.

Section "Device"
     Identifier  "Intel Graphics"
        Driver      "intel"
        Option      "TearFree"    "true"
 EndSection

~

I worked all this out while using xfce, so I know it works there too. But gnome in 17.04 is so nice I changed. I did not test this in Unity.

== Hybrid Nvidia mode ==

So to elaborate on getting no tearing in hybrid nvidia mode:
In this mode the nvidia card renders everything. It can write directly to external screens, so any tearing on external screens is just an nvidia problem. ForceCompositionPipeline was the fix I needed.

You can activate this from the command line. Here's what I do.

#!/bin/bash
nvidia-settings --assign CurrentMetaMode="$(nvidia-settings -q CurrentMetaMode -t|tr '\n' ' '|sed -e 's/.*:: \(.*\)/\1\n/g' -e 's/}/, ForceCompositionPipeline = On}/g')" > /dev/null

I am not the author of that snippet, too magical for me.
You can also do this from the Nvidia control panel Advanced, but make sure you click on the representation of the external monitor. The PRIME panel, that is, the laptop panel, does not show this setting

If this does not fix the tearing, I can't help, but it means your problem is an nvidia driver problem, nothing to do with prime or prime sync. I'm using driver 384.59 from the PPA. See http://ubuntuhandbook.org/index.php/2017/02/how-to-install-nvidia-375-39-378-13-via-ppa-in-ubuntu/

To draw on the laptop panel, the nvidia card writes to memory used by the intel card, which then displays it on the screen. This is "Prime". For sure you have this working, otherwise there would be no image on your laptop panel.

But Prime Sync is next level. Getting the two cards synced to avoid tearing needs Prime Sync, something so new that only in the past few weeks have we seen a stable solution. The nvidia driver needs to operate in kernel mode setting, which it does not do by default.

sudo vi /etc/modprobe.d/zz-nvidia-modeset.conf

and use this content:

 options nvidia_384_drm modeset=1

which obviously assumes you have a 384 driver.

then
    sudo update-initramfs -u

otherwise the new text file won't have any effect. I don't care what anyone says about settings in grub2, using this text file is the only thing that worked for me and it's the accepted solution on the nvidia Prime Sync thread.

Don't use gdm3, use lightdm if you currently use gdm3. Hopefully the gdm3 bug will be fixed before Ubuntu 17.10 where it will probably be the default display manager :)
If you're not sure, so this:

dpkg-reconfigure lightdm

then reboot.

tim@raffles:~$ xrandr --properties | grep PRIME
    PRIME Synchronization: 1


Check to find either the switch is turned "off" or blocked in the BIOS if not run sudo rfkill unblock alland sudo rfkill list to see what is blocking the wireless

Some have a hotkey like Fn+F2 (or something else) that will turn it on or off.

Wireless is disabled by hardware switch


How to install the latest version of Groovy?

Sorry for the late response, just saw this post now. You can find an alternative repository for groovy that will allow you to install the latest groovy versions at Fresh Groovy
For the latest 1.8 version, here are the instructions from the site:

# first time users
sudo apt-add-repository ppa:groovy-dev/groovy

# all users
sudo apt-get update
sudo apt-get install groovy-1.8


Where is my xorg.conf file in my VBox virtual machine?

Ubuntu 10.04 doesn't have /etc/X11/xorg.conf by default but autodetects all settings. But if you create that file and insert the settings you want to change X.org will use it.


Where could I get the apparmor profile for latest skypeforlinux 5.3?

You answered your own question, ubuntu does not maintain a profile for skypeforlinux. You have to write your  own or find and adapt one from the internet.

https://packages.ubuntu.com/search?suite=yakkety&arch=any&mode=filename&searchon=contents&keywords=skypeforlinux

IMO, best to write your own profile, see https://www.howtogeek.com/118328/how-to-create-apparmor-profiles-to-lock-down-programs-on-ubuntu/

No one can tell you what to accept and what to block, that is for you to decide.

A google search yields several profiles on git hub and elsewhere. You need to review these profiles for accuracy, paths, and your needs but these may be a place to start.

https://www.google.com/search?q=apparmor+profile+skypeforlinux&oq=apparmor+profile+skypeforlinux&aqs=chrome..69i57j69i60l3.15031j0j9&sourceid=chrome&ie=UTF-8

First on the list : https://github.com/mk-fg/apparmor-profiles/blob/master/profiles/opt.skypeforlinux

#include <tunables/global>

/opt/skypeforlinux/skypeforlinux {

    #include <abstractions/base>
    #include <abstractions/consoles>
    #include <abstractions/nameservice>
    #include <abstractions/ssl_certs>
    #include <abstractions/fonts>
    #include <abstractions/X>
    #include <abstractions/freedesktop.org>
    #include <abstractions/user-download>
    #include <abstractions/user-tmp>
    #include <abstractions/pulse>
    #include <abstractions/node-webkit>
    #include <abstractions/site/base>
    #include <abstractions/site/de>

    /etc/os-release r,
    /sys/devices/virtual/tty/tty*/active r,
    deny /dev/video0 rw,

    /opt/skypeforlinux/** kmr,
    /opt/skypeforlinux/skypeforlinux ix,

    owner @{HOME}/.config/skypeforlinux/ rw,
    owner @{HOME}/.config/skypeforlinux/** krwm,
    owner @{HOME}/[dD]ownload{,s}/** k,

    deny /etc/passwd rm,
    deny /proc/sys/kernel/yama/ptrace_scope r, # no clue

    # Site-local thing
    /etc/core/app/sec/openssl.cnf r,

    network,

}

There are other options as well and you likely need to modify these profiles for you needs and paths for Ubuntu (I dont know for example is skypeforlinux is installed on /opt as in this profile or somewhere else.

Here is another: https://gogs.dsprenkels.com/dsprenkels/apparmor-profiles/src/bf7f56166f4084d07797195fc7739be19bd9ada1/usr.bin.skypeforlinux

# Last Modified: Tue Apr 11 23:47:05 2017
#include <tunables/global>

/usr/bin/skypeforlinux {
  #include <abstractions/audio>
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/dbus-session>
  #include <abstractions/fonts>
  #include <abstractions/freedesktop.org>
  #include <abstractions/gnome>
  #include <abstractions/nameservice>

  /usr/bin/skypeforlinux r,
  /bin/dash ix,
  /bin/mkdir rix,
  /bin/readlink rix,
  /usr/bin/dirname rix,
  /usr/bin/nohup rix,

  /dev/shm/* rw,
  /etc/udev/udev.conf r,
  owner @{HOME}/.Xauthority r,
  owner @{HOME}/.config/skypeforlinux/ rw,
  owner @{HOME}/.config/skypeforlinux/** rw,
  /sys/bus/pci/devices/ r,
  /sys/devices/** r,
  "/tmp/skypeforlinux Crashes/" w,
  /usr/share/glib-2.0/schemas/gschemas.compiled r,
  /usr/share/skypeforlinux/** r,
  /usr/share/skypeforlinux/skypeforlinux rix,
  /{run,dev}/shm/pulse-shm* rwk,

}


Before removing Compiz you might wanto to try and reset it
1.Press Alt + ctrl + F1
2.Login using your username and password
3.Reset compiz by executing gconftool-2 --recursive-unset /apps/compiz-1
4.Reset unity , by executing unity --reset
5.Optionally you can reset launcher icons by executing unity --reset-icons
6.Press Alt + ctrl + F7 to get back to login screen. However I recommend a restart by executing sudo reboot. Let us know if it worked.
Cerdits to Web-E
To remove compiz and compiz packages type this in a terminal:
sudo apt-get purge compiz compiz-plugins-main-default libcompizconfig0
Warning: Removing compiz also removes the packages unity & ubuntu-desktop.
Warning: Removing libcompizconfig0 also removes ubuntu-tweak.
Thus you will lose the ability to log into the unity or unity-2d desktops.
Source
More info here: How can I remove and re-install Unity?
And here: Ubuntu 12.04. Compiz Failure. Computer has nothing to use


How to login under root in ubuntu-dektop on Ubuntu server 14.04

To create a user with sudo permissions first type

sudo adduser username

Then enter your password. Then you'll be asked for some information, it's up to you whether you enter them or leave them empty. Once added, you have to add that user to the sudo group by typing

usermod -aG sudo username

Now username should be a new account with sudo privileges.


How do I install Ubuntu 18 without the GUI?

Generally this is done with:

The mini ISO (scroll down for ISO files), which fits even on CDs but which requires an Internet connection which will download hundreds of megabytes or several gigabytes of data while installing. Make sure, when the software selection screen comes up, to not choose any desktops.
The Ubuntu Server ISO, which needs a DVD or a 1 GB USB drive and doesn't require an Internet connection while installing.


Try this command:

compiz --replace

Or, reset:

dconf reset -f /org/compiz/

Then start it. It will work.


Ubuntu 14.04 LTS Support for Asus Z97 Deluxe Motherboard

I finally decided to purchase the Asus Z97 Deluxe motherboard along with an Intel Core i5-4590S processor.  I'm happy to report that the board works fine with Ubuntu 14.04 LTS.  I'm also using the following SATA devices without any problems:

1 x 256 GB Samsung EVO 840 PRO for the Ubuntu OS
4 x Western Digital Caviar Red 3TB NAS drives a ZFS pool
1 x 256 GB Samsung EVO 840 PRO for the ZFS cache and ZFS Intent Log
1 x LG WH16NS40 Super Multi Blue Internal SATA 16x Blu-ray Disc Rewriter

So far, so good :-)


How can I make an equivalent to this bash function in tcsh?

First, a warning to anyone who stumbles upon this post: the -f flag to pkill will cause it to match the pattern you give it with the full command line of each process rather than just the process's name. This matches more processes, so you may end up killing more than you intend. Be careful!

Since the pattern you are passing to pkill appears at the end of the command, you don't actually need explicit argument handling, so this can be done with the simple kind of tcsh alias:

alias killn pkill -9 -f

With that alias defined, if you want to send SIGKILL to processes whose full command lines contain a match to pattern, you use the alias like this:

killn pattern

That substitutes pkill -9 -f for killn, causing your desired command to be run:

pkill -9 -f pattern

Note to casual readers: this is a tcsh alias, which does not have the same syntax as a bash alias.


"@fkraiem Most likely not. I am installing a version of ubuntu and would like to make changes automatically versus doing the same process several times for different boards"

You could write a Bash script that, when run, makes the changes you want. Then you can put it on a USB stick and run it with every new install.

(this is all in a terminal, I use gnome-terminal)
For instance, you could have a template interfaces file that is what you want all of them to look like, and then you could write a script file like so: gedit scriptfile

#!/bin/bash
sudo cp ./interfaces /etc/network/interfaces
sudo gedit /etc/network/interfaces

Then you could run chmod +x scriptfile to make it executable.

Then you put the scriptfile and the interfaces template file onto a flash drive and when you install Ubuntu on a new "board" you can open the flash drive and run the scriptfile and it will replace the current /etc/network/interfaces file with the template one and then open it in Gedit for you to customise the IP address.


I can confirm the first answer works, but you may want to change a little something in the xscreensaver settings. Once you have electricsheep installed and followed the instructions on the web page link, go into your xscreensaver settings, click on electricsheep as you 'saver of choice, then click on Settings -> Advanced.

Enter the line below as the executed command:

electricsheep --root 1 2> /dev/null

Electricsheep is known to display some error messages from StErr. They're not critical errors unless you see obvious performance issues when electricsheep is running. The above code routes the error messages to /dev/null, so you never see them displayed.


Lightdm broke, have to manual login via bash

Tried everything, even copied the configuration from another computer.

Finally fixed it with writing this into console:

sudo -u my_username /usr/sbin/lightdm --test-mode

it opened the lightdm session in new window and I simply chose to reboot.


How to use an input language different from the keyboard layout country and from the system language?

Keyboard layouts are not dependent to countries (some countries don't have a keyboard layout, some have multiple, some keyboard-layouts are used in several countries, some keyboard layouts have no relation to any country, etc.).

So just change the keyboard layout to something else (I would suggest "US International with AltGr dead keys", or maybe to something else that you are used to).

Edit: it seems like by default US international behaves differently on Windows than in X; in Windows ' followed by c gives ç, while in X it gives ć.

Edit 2: okay, so I found a solution, but it doesn't work in Gtk/GNOME applications because of a stupid bug...

Create a file ~/.XCompose and put the following lines in it:

include "/usr/share/X11/locale/en_US.UTF-8/Compose"
<dead_acute> <C>        : "Ç" Ccedilla # LATIN CAPITAL LETTER C WITH CEDILLA
<dead_acute> <c>        : "ç" ccedilla # LATIN SMALL LETTER C WITH CEDILLA

Edit 3: Actually it does work in Gtk too when you select XIM as the import method for Gtk, and make sure it's selected in the Language Support dialog.


I can't find a wi-fi driver for my laptop Lenovo Ideapad L340 for Ubuntu 20

This is a common problem, look at the answer provided here Installing/Uninstalling WiFi Drivers on Ubuntu
Basically you need to download and build the driver for for the Realtek wireless network card from this repo: https://github.com/lwfinger/rtw88
Install the drivers
git clone https://github.com/lwfinger/rtw88.git
cd rtw88
make
sudo make install
sudo modprobe rtw_8822ce

And if still in trouble, try command, since there might be conflicting drivers.
echo "blacklist ideapad-laptop" | sudo tee -a /etc/modprobe.d/blacklist.conf
And reboot.


So, inspired by the comments, I searched for suitable gnome extensions and found two useful ones:

Shade Inactive Windows and Windows Blur Effects

I settled for the second one since it is more configurable.

However, I quickly realised that, while this is a great help when I'm quickly switching between windows, it is a nuisance at other times. Not wanting to open the extensions app to enable/disable the extension every time, I did some research and found this script which I modified as follows:

#! /usr/bin/env bash

#   Copyright (C) 2016
#       Alexandru Catalin Petrini <alexandru.c.petrini@gmail.com>
#  This script is intended to usefully manage gnome-shell extensions,
#  in compatible Gnome Shell versions.

# Install this script by running this command:
# $ sudo wget https://raw.githubusercontent.com/cyberalex4life/gnome-shell-extension-cl/master/gnome-shell-extension-cl -O /usr/local/bin/gnome-shell-extension-cl && sudo chmod +x /usr/local/bin/gnome-shell-extension-cl

# -------------------------------------------------------------------------------

function get_enabled_extensions() {
    enabled_extensions=( $(gsettings get org.gnome.shell enabled-extensions | \
                               sed -e 's|^@as ||g' | tr -d "[",",","]","\'") )
}

function print_enabled_extensions(){
    get_enabled_extensions
    for enabled_extension in "${enabled_extensions[@]}"
    do
        echo "$enabled_extension"
    done
}

# -------------------------------------------------------------------------------

function get_installed_extensions() {
    global_installed_extensions=( $(find "/usr/share/gnome-shell/extensions/" \
                                         -maxdepth 1 -type d -name "*@*" -exec \
                                         /usr/bin/basename {} \;) )
    local_installed_extensions=( $(find "$HOME/.local/share/gnome-shell/extensions/" \
                                        -maxdepth 1 -type d -name "*@*" -exec \
                                        /usr/bin/basename {} \;) )

    if [ ${#local_installed_extensions[@]} -gt ${#global_installed_extensions[@]} ]
    then
        installed_extensions=( ${local_installed_extensions[@]} )
        test_extensions=( ${global_installed_extensions[@]} )
    else
        installed_extensions=( ${global_installed_extensions[@]} )
        test_extensions=( ${local_installed_extensions[@]} )
    fi
    for test_extension in "${test_extensions[@]}"
    do
        test_extension_not_doubled=true
        for installed_extension in "${installed_extensions[@]}"
        do
            if [ "$test_extension" = "$installed_extension" ]
            then
                test_extension_not_doubled=false
                break
            fi
        done
        if  [ $test_extension_not_doubled = true ]
        then
            test_extension=( $test_extension )
            installed_extensions=( "${installed_extensions[@]}" "${test_extension[@]}" )
            #echo ${test_extension[@]}
        fi
    done
    echo "${installed_extensions[@]}"
}

function print_installed_extensions() {
    installed_extensions=( $(get_installed_extensions) )
    for installed_extension in "${installed_extensions[@]}"
    do
        [ "$(check_extension_is_enabled "$installed_extension")" = true ] && \
            status="enabled" || status="disabled";
        printf "%-65s - %-10s \n" "$installed_extension" "$status"
    done
}

# -------------------------------------------------------------------------------

function check_extension_is_enabled() {
    extension_to_check=$1
    enabled_extensions=( $(gsettings get org.gnome.shell enabled-extensions | \
                               sed -e 's|^@as ||g' | tr -d "[",",","]","\'") )
    for enabled_extension in "${enabled_extensions[@]}"
    do
        if [ "$enabled_extension" = "$extension_to_check" ]
        then
            echo true
            return
        fi
    done
    echo false
}

function check_extension_in_all_extensions() {
    extension_to_check=$1
    installed_extensions=( $(get_installed_extensions) )
    for installed_extension in "${installed_extensions[@]}"
    do
        if [ "$installed_extension" = "$extension_to_check" ]
        then
            echo true
            return
        fi
    done
    echo false
}

function version_greater() {
    minimal_version=3.18.0
    our_version=$(gnome-shell --version | awk '{print $3}')
    if [ "$(echo "$our_version $minimal_version" | tr " " "\n" | sort -V | head -n 1)" != "$our_version" ]
    then
        echo true
    else
        echo false
    fi
}

function disable_extension() {

    arguments=("$@")
    unset "arguments[0]"

    for extension_to_disable in "${arguments[@]}"
    do

        if  [ "$(check_extension_in_all_extensions "$extension_to_disable")" = false ]
        then
            echo "'$extension_to_disable' is not installed."
            continue
        fi
        if  [ "$(check_extension_is_enabled "$extension_to_disable")" = false ]
        then
            echo "'$extension_to_disable' is already disabled."
            continue
        fi
        if [ "$(version_greater)" = true ]
        then
            gnome-shell-extension-tool -d "$extension_to_disable"
            continue
        fi
        enabled_extensions=( $(gsettings get org.gnome.shell enabled-extensions | \
                                   tr -d "[",",","]","\'") )
        enabled_extensions_string=""
        for enabled_extension in "${enabled_extensions[@]}"
        do
            if [ "$enabled_extension" != "$extension_to_disable" ]
            then
                enabled_extensions_string="$enabled_extensions_string '$enabled_extension', "
            fi
        done
        enabled_extensions_string=${enabled_extensions_string:1:-2}
        enabled_extensions_string="[ $enabled_extensions_string ]"

        dbus-launch gsettings set org.gnome.shell enabled-extensions "$enabled_extensions_string"

    done
    return
}

function enable_extension() {

    arguments=("$@")
    unset "arguments[0]"

    for extension_to_enable in "${arguments[@]}"
    do

        if  [ "$(check_extension_in_all_extensions "$extension_to_enable")" = false ]
        then
            echo "'$extension_to_enable' is not installed."
            continue
        fi
        if  [ "$(check_extension_is_enabled "$extension_to_enable")" = true ]
        then
            echo "'$extension_to_enable' is already enabled."
            continue
        fi
        if [ "$(version_greater)" = true ]
        then
            gnome-shell-extension-tool -e "$extension_to_enable"
            continue
        fi
        enabled_extensions_string=$(gsettings get org.gnome.shell enabled-extensions | tr -d "]")
        [ "$enabled_extensions_string" != "@as [" ] && delimiter=,
        enabled_extensions_string="${enabled_extensions_string}${delimiter} '$extension_to_enable' ]"

        gsettings set org.gnome.shell enabled-extensions "$enabled_extensions_string"

    done
    return
}

# -------------------------------------------------------------------------------

function disable_all_extensions() {
    get_enabled_extensions
    for enabled_extension in "${enabled_extensions[@]}"
    do
        # Don't disable user-theme extensions to avoid breaking them
        if [ "$enabled_extension" != "user-theme" ] && \
               [ "$enabled_extension" != "user-themes" ] && \
               [ "$enabled_extension" != "user-theme@gnome-shell-extensions.gcampax.github.com" ]
        then
            disable_extension "this element will be ignored" "$enabled_extension"
        else
            continue
        fi
    done
}
# -------------------------------------------------------------------------------

function toggle_extension() {

    arguments=("$@")
    unset "arguments[0]"

    for extension_to_enable in "${arguments[@]}"
    do

        if  [ "$(check_extension_in_all_extensions "$extension_to_enable")" = false ]
        then
            echo "'$extension_to_enable' is not installed."
            continue
        fi
        if  [ "$(check_extension_is_enabled "$extension_to_enable")" = true ]
        then
            disable_extension "$@"
        else
            enable_extension "$@"
        fi
    done
    return
}
# -------------------------------------------------------------------------------

function print_help() {

    printf "
GNOME Shell Extension Control Tool:

usage: gnome-shell-extensions <option> [extension name]

Options
    -h,   --help                                Display help message.
    -e,   --enable-extension <extension name>   Enable extension.
    -d,   --disable-extension <extension name>  Disable extension.
    -da,  --disable-all-extensions              Disables all extensions.
    -le,  --list-enabled                        List enabled extensions.
    -l,   --list                                List all extensions + state info.
    -s,   --status <extension name>             Show status of extension.
    -t,   --toggle-extension                    Toggle extension.
\n"

}

# -------------------------------------------------------------------------------

case $1 in
    -h|--help)
        print_help
        ;;
    -e|--enable-extension)
        enable_extension "$@"
        ;;
    -d|--disable-extension)
        disable_extension "$@"
        ;;
    -t|--toggle-extension)
        toggle_extension "$@"
        ;;
    -da|--disable-all-extensions)
        disable_all_extensions
        ;;
    -le|--list-enabled)
        print_enabled_extensions
        ;;
    -l|--list)
        print_installed_extensions
        ;;
    -s|--status)
        if  [ "$(check_extension_is_enabled "$2")" = true ]
        then
            echo "enabled"
        else
            echo "disabled"
        fi
        ;;
    *)
        print_help
        ;;
esac

Then, I ran gnome-shell-extension-cl -l to get the list of extensions.

Finally, I added a Keyboard shortcut to run gnome-shell-extension-cl -t windows-blur-effects@com.gmail.lviggiani. I used Super + Alt + B, but any keyboard combination could do.


You can do this in juju as a round about way. Juju provides a juju run command which allows execution of commands against a remote Juju unit.

So, for example, if you have an application deployed called foo, with the unit foo/0 you could do the following:

juju run --unit foo/0 "open-port 8000"

Replacing 8000 with whichever port you need. There are a plethora of hook-tools you can invoke in addition to standard commands like whoami.

For that list you can run juju help-tool and for more information on each tool juju help-tool open-port.

I'd also make sure you file a bug against the charm if that port is supposed to be open but is not.


How do I install ia32 libs, the multi-arch packages?

Sounds like your APT doesn't have an i386 foreign architecture. I have no idea why this happens to people...

Try:

sudo dpkg --add-architecture i386
sudo apt-get update
sudo apt-get install ia32-libs


It may be a snap package you have installed. To verify run snap list in Terminal and look for any entry related to pycharm (for example pycharm-community).

To remove it simply run

snap remove pycharm-community


How to share files between two machines in a network with a router?

What do you mean by "sharing"?

If you just want to download a small number of files from one computer to another, you can run python2 -m SimpleHTTPServer 8001 in the directory of the files to be shared on one computer. Then on another computer, use your browser (or other tools like wget) to navigate to the url http://x.x.x.x:8001/ to view/download the files. x.x.x.x is to be replaced by the IP address of the former computer.

If you have a large number of files to copy, I suggest rsync though ssh. But it works well if you have ssh server up and running at least one computer.

If you want more complicated sharing, you may want to try NFS or sshfs.


Where can I find Dell 1510 Wireless-N drivers?

I believe the 1510 is a Broadcom card.  You can get these drivers either by opening

jockey-gtk

or by running

sudo apt-get install bcmwl-*  && sudo modprobe wl


Can't boot after changing "filesystem" partition to automount

As per your comment, I am assuming that / is on /dev/sda5 and swap is on /dev/sda6. That would mean your /etc/fstab should have the lines:

/dev/sda5 /         ext4    errors=remount-ro 0       1
/dev/sda6 none      swap    sw                0       0
UUID=8A9C /boot/efi vfat umask=0077 0 1

Make sure that / is mounted first !
At a later stage, if everything is working you can replace the /dev/sdaX lines by UUID=xxxxxx but that is not really necessary.


Replugging network cable doesn't reconnect

From this Dell LAN problem with TLP: Wired network not working after resuming from suspend (Ubuntu 16.04) #222

Edit TLP configuration using: sudo -H gedit /etc/default/tlp

Locate these lines:

# Disable wake on LAN: Y/N
WOL_DISABLE=Y

Change "Y" to "N"

Locate your USB_BLACKLIST lines (if any) and un-blacklist them by placing # at beginning:

#USB_BLACKLIST="10ec:8168"
#USB_BLACKLIST="103c:832b"

Save file and exit
Restart TLP with command: sudo tlp start

Second option: Disable PCIe power management

From: TLP Troubleshooting:

Disable Runtime Power Management completely

Comment both related config lines with a leading '#':

#RUNTIME_PM_ON_AC=on
#RUNTIME_PM_ON_BAT=auto

When the problem disappears, uncomment above lines and continue with the next section.

Otherwise the cause is not a PCIe device – proceed to USB.

Bug Watch

Here are some related bugs that will interest R8169 users:

Mar 21, 2018 - Fix Runtime PM for r8169:

  ===SRU Justification===
  [Impact]
  r8169 stays in D0 even when no ethernet cable is plugged in. This drains lots of power (~3W). The
  tested laptop uses 5.5W when r8169 is in D0,
  1.8W when r8169 is in D3. The power saved is substantial.

  [Fix]
  Improved rumtime PM logic to let the device gets suspended (D3)
  when the port is not in used and the link is down.

July 3, 2018 - r8169 no internet after suspending:

  ===SRU Justification===
  [Impact]
  r8169 failed to establish connection after the fix for LP: #1752772 landed.

  [Fix]
  Accepts BIOS WoL settings again, and disables MSI-X for certain
  chip revisions.

March 2, 2018 - r8169 ethernet card don't work after returning from suspension

This bug affects 127 people:

  ===SRU Justification===
  [Impact]
  Ethernet r8169 stops working after system resumed from suspend.

  [Test]
  User confirmed these patches fix the issue. r8169 continues to
  work after resume from suspend.

  [Regression Potential]
  Medium. The fix is limited to one device, all
  patches are in mainline. The WOL default change might cause regression
  for users that depend on BIOS settings. We can advice them to use
  userspace tool (systemd, ethtool, etc.) instead.

Summary

There have been quite a few bugs with r8169 in 2018. I'm using a kernel from 2017 (4.13.0-36) so I haven't experienced the same problems with TLP. It is more difficult to fix bugs I'm not experiencing. The kernel developers do have time to install new kernels, test for bugs and come up with solutions. I can do a little but, time constraints prevent installation of newer kernels.


Ubuntu 12.04 LTS would not complete booting

Given that the .iso checks out but you have problems with the disc on two machines, the problem is probably the disc media. Try burning another, and perhaps try using another brand of media as well. If your systems support it, you may want to look at booting using a USB thumb drive as an option.


Where should I save my web project files?

Yes You should use Your home folder

for example

mkdir home/YourUserName/Ruby


If you have another computer you could try a network install i had to do this on my current machine as i had misplaced my memory stick (i then found the memory stick ....irony)

Check this out see if it helps!

https://help.ubuntu.com/community/Installation#Server_and_network_installations


You have to make two scrips to achieve your goal.

one to switch both external displays on and turn off your laptop display.

and the other to revert the change made by script one.

So create script1.sh and make it executable with following contents.

#!/bin/bash
    xrandr --output LVDS-1 --off
    xrandr --output VGA-1 --mode 1920x1080 --auto
xrandr --output HDMI-1 --mode 1920x1080 --auto

and script2.sh with following contents and make this too executable.

#!/bin/bash
xrandr --output VGA-1 --off
xrandr --output HDMI-1 --off
xrandr --output LVDS-1 --mode 1366x768 --auto

You can run the scipt1.sh after connecting the external displays and you have to run the script2.sh before removing the external displays.

Note that the above method will mirror your screen to two separate screens at the same time. And if you need a separate screen rather than mirroring, you can use either  --left-of or --right-of option and provide device names accordingly.

And also you can check if your hardware supports three displays at the same time by turning on the laptop display along with the two monitors.


strongSwan 5.1.2 on Ubuntu Trusty (14.0.4) and AppArmor

I'm seeing the exact same issue, but it only occurs some of the time.  Sometimes the ipsec command completes successfully, and sometimes the same command gets the permission denied error.  Removing the apparmor profiles fixes it:

apparmor_parser -R /etc/apparmor.d/usr.lib.ipsec.charon
apparmor_parser -R /etc/apparmor.d/usr.lib.ipsec.stroke

Definitely something in a recent patch.


NFS Share Permissions between WDMyCloud / RaspberryPi with OwnCloud

The problem is that all the files in the NFS mount need to be owned by the webserver user. Otherwise you will run into problems. The easiest is if you mount it via smbclient as the webserver user and do a symlink of the data directory. By the way. It is recommended to use Nextcloud instead of ownCloud because it contains important security fixes. Nextcloud also has a feature to access smb shares directly. This is very easy.


Move the launcher to the right hand side?

No, thats not possible with Unity. Canonical did hardcode the position of the buttons on the Unity plugn, and there is still no way to change that.

If you really want to have the panel on your right hand side I'd recommend you to change to another desktop as the classic Gnome or also named Gnome Flashback :

sudo apt-get update
sudo apt-get install gnome-session-flashback

Once installed, log off and change the desktop by clicking on the Ubuntu icon next to your login name and choose "Gnome Flashback".

I recommend you to try it and customize it at your will, as you can always go back to Unity by simply selecting it again the same way I just explained.


Downgrade GCC from 5.2.1 to 4.9 Ubuntu 15.10

Like @steeldriver suggests, you need to use update-alternatives. Exactly step 3 on this question. Since at this point 4.9 is 4.9.3, which is not supported, you'll need 4.8.

sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.8 40 --slave /usr/bin/g++ g++ /usr/bin/g++-4.8

sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-5 50 --slave /usr/bin/g++ g++ /usr/bin/g++-5

Remember to choose gcc-4.8 before running the installer:

sudo update-alternatives --config gcc

and after, to switch back to having gcc-5 by default.

(Since you're doing it to install the CUDA SDK, I'll add that if you want to test the samples, you may want to read this.)


I have about 20 virtual machines so yes I believe it is a good idea. You do not have to run them all at once.

I use mine to diagnose wireless issues and test compiz and its settings.

I usually only run about three at a time.

It is suggest that hypervisor has to be disabled to get 64bit guests to run.

For recommendations about partitions please look here.


Can't change settings for Mobile Broadband Dongle - Button is greyed out

Did you try to create new network connection setting for the same dongle? Both settings co-exist and you can connect any one of them. If the new connection works and you can edit it then just delete the old non-editable one.


Saving subtitles found by the VLC extension "Subtitle Finder"?

It looks like it stays in memory to me.  A similar plugin that just downloads the subtitles file from opensubtitles is probably going to be your answer by using some of that code and modifying around line:

--vlc.msg.dbg("[Subtitles] File found in the archive: " .. srturl .. extension)

The one line edit below is BAD, but gets it not broken for unix-like OS-es only.  For the script to be cross platform it needs OS detection logic:

if(item ~= nil) then
  local name = item:uri()
  vlc.msg.info("NAME: "..name)
  name = vlc.strings.decode_uri(string.gsub(name, "file:///", ""))
  name = "/"..name
  vlc.msg.info(""..name.."."..language.."."..extension)
  vlc.msg.info("[Subtitle-download] saving subtitle to: "..name.."."..language.."."..extension)
  local fsout = assert(io.open(name.."."..language.."."..extension, "w"))
  fsout:write(dataBuffer)
  assert(fsout:close())
end

If someone running Windows VLC is interested in testing a patch that gets saving working on both Linux and Windows, check this pull request.

Evidently someone has tacked on some enhancements including the patch here.

This version here works in Linux (as well as in Windows) to save subtitles.


The problem was that the image was in qcow 3 format.


Install openjdk by:

sudo apt-get install openjdk-7-jdk

It installs several extra packages. After that netbeans find jdk automatically and normal installation completed smoothly...


Move Ubuntu partition to another drive and resize?

Not sure whether I understood the problem completely, but you could do the following: Create a new partition on /dev/sda (with gparted) that is big enough for your liking, mark it as bootable. Remove the boot flag from the /sdc partition that currently has it.  Mount the new partition, copy your Ubuntu installation to this partition. Reboot. Ubuntu should now be running from the new copy on the /dev/sda partition, so you can unmount the old partition on /dev/sdc. Do that, delete it (with gparted) and use the free space in whichever way you want.


How to check if checkbox-unity from ppa:unity-team/ppa succesfully send my report?

You can check your last successful upload date here:

http://results-tracker.ubuntu.com/~YOUR_LAUNCHPAD_USERNAME

With the date, you can then try to find the details of the testrun in this list:

http://results-tracker.ubuntu.com/ubuntu/precise/+testruns

A bit cumbersome, but it works (note, that it takes a while for results to show up).


error message "ubuntu-20.04-desktop no mountable file systems"

I had the same problem, and was able to solve it easily when I realized 1 thing:
You know when you download and you get the dialog box which has you choose to either open the file or save it?
I only got the "no mountable file systems" message when I chose to open the file.
Try downloading again, but this time choose "Save."
Hopefully this will work for you too!
Also, this YouTube video does a great job of walking you through it: https://www.youtube.com/watch?v=04ZNAKmm0dI


How to assign an specific letter to an specific partition under Wine

You can, by running winecfg:

Go the Drives tab:

Click Add...:

Select your drive letter, press Ok, then enter the path where the target drive is mounted in Ubuntu. For example, my common partition is mounted on /home/muru/Downloads:

Click Apply. Done.


Wifi suddenly stopped working in ubuntu 14.04 LTS

I suggest to upgrade kernel to 4.4. by running

sudo apt-get install linux-generic-lts-xenial

Reboot after the upgrade.


Wine - cups-bsd but it is not going to be installed and more

You need to enable x86 architecture for multiarch packages:

sudo dpkg --add-architecture i386
sudo apt-get update
sudo apt-get install wine1.7


saned.service is DEAD! When trying to connect my scanner at my computer on WIFI

I do not have Canon scanner.

On SANE page it is listed as Untested and supported by sane-pixma driver.

You can consult ArchLinux wiki for accessing it.

  Scanning over the network with Canon Pixma all-in-one printer/scanners

  Find out your printer/scanner's IP address, and add it on a new line to /etc/sane.d/pixma.conf in the format bjnp://10.0.0.20.

  Sane should now find your device. For more details refer to sane-pixma(5).

  Alternative: for some Canon Pixma all-in-one printer/scanners, which are not detected over network, can be used scangearmp package from AUR.

All you need is libsane package and man sane-pixma. Not sure about scangearamp.


You can use Grub Customizer.  The Grub Customizer PPA now is available for Ubuntu 13.10.  To install, just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command(s) below:

sudo add-apt-repository ppa:adabbas/1stppa
sudo apt-get update
sudo apt-get install grub-customizer


Can I remove Gnome if Ubuntu is my original installation?

Yes, you most certainly can, even though it is your original DE.
 To do it, run the following very long command:

sudo apt-get remove adium-theme-ubuntu aisleriot apg apport-gtk aptdaemon aptdaemon-data apturl at-spi2-core bamfdaemon banshee banshee-extension-soundmenu banshee-extension-ubuntuonemusicstore baobab binfmt-support bluez-gstreamer branding-ubuntu brasero brasero-cdrkit brasero-common checkbox checkbox-gtk cli-common compiz compiz-core compiz-gnome compiz-plugins-default compiz-plugins-main-default compizconfig-backend-gconf deja-dup desktop-file-utils dmz-cursor-theme doc-base duplicity empathy empathy-common eog espeak espeak-data evince evince-common evolution-data-server evolution-data-server-common example-content file-roller firefox firefox-globalmenu firefox-gnome-support gamin gbrainy gcalctool gcc gcc-4.6 gconf2 gconf2-common gedit gedit-common geoclue geoclue-ubuntu-geoip ginn gir1.2-appindicator3-0.1 gir1.2-atk-1.0 gir1.2-atspi-2.0 gir1.2-dbusmenu-glib-0.4 gir1.2-dbusmenu-gtk-0.4 gir1.2-dee-0.5 gir1.2-freedesktop gir1.2-gconf-2.0 gir1.2-gdkpixbuf-2.0 gir1.2-gmenu-3.0 gir1.2-gnomebluetooth-1.0 gir1.2-gtk-2.0 gir1.2-gtk-3.0 gir1.2-gtksource-3.0 gir1.2-indicate-0.6 gir1.2-launchpad-integration-3.0 gir1.2-notify-0.7 gir1.2-pango-1.0 gir1.2-peas-1.0 gir1.2-soup-2.4 gir1.2-totem-1.0 gir1.2-totem-plparser-1.0 gir1.2-unity-4.0 gir1.2-vte-2.90 gir1.2-webkit-3.0 gir1.2-wnck-3.0 gksu gnome-accessibility-themes gnome-bluetooth gnome-codec-install gnome-control-center gnome-control-center-data gnome-desktop-data gnome-desktop3-data gnome-disk-utility gnome-font-viewer gnome-games-common gnome-icon-theme gnome-icon-theme-symbolic gnome-keyring gnome-mahjongg gnome-media gnome-menus gnome-nettool gnome-online-accounts gnome-orca gnome-power-manager gnome-screensaver gnome-screenshot gnome-search-tool gnome-session gnome-session-bin gnome-session-canberra gnome-session-common gnome-settings-daemon gnome-sudoku gnome-system-log gnome-system-monitor gnome-terminal gnome-terminal-data gnome-user-guide gnome-user-share gnome-utils-common gnomine gstreamer0.10-gconf gstreamer0.10-nice gstreamer0.10-plugins-base-apps gstreamer0.10-tools gtk2-engines gtk2-engines-murrine gtk3-engines-unico gucharmap guile-1.8-libs gvfs gvfs-backends gvfs-bin gvfs-fuse gwibber gwibber-service gwibber-service-facebook gwibber-service-identica gwibber-service-twitter humanity-icon-theme hwdata ibus ibus-gtk3 ibus-pinyin ibus-pinyin-db-android ibus-pinyin-db-open-phrase ibus-table indicator-application indicator-appmenu indicator-datetime indicator-messages indicator-power indicator-session indicator-sound indicator-status-provider-mc5 intel-gpu-tools jockey-gtk language-selector-gnome launchpad-integration libappindicator0.1-cil libappindicator1 libappindicator3-1 libatk-adaptor libatkmm-1.6-1 libatspi2.0-0 libavahi-glib1 libavahi-gobject0 libavahi-ui-gtk3-0 libbamf0 libbamf3-0 libboost-serialization1.46.1 libbrasero-media3-1 libburn4 libc-dev-bin libc6-dev libcairo-perl libcairomm-1.0-1 libcamel-1.2-29 libcanberra-gtk-module libcanberra-gtk0 libcanberra-gtk3-0 libcanberra-gtk3-module libcap2-bin libcdio-cdda0 libcdio-paranoia0 libcdio10 libcompizconfig0 libcroco3 libdbus-glib1.0-cil libdbus1.0-cil libdconf-dbus-1-0 libdconf-qt0 libdconf0 libdecoration0 libdee-1.0-1 libdotconf1.0 libebackend-1.2-1 libebook1.2-12 libecal1.2-10 libedata-book-1.2-11 libedata-cal-1.2-13 libedataserver1.2-15 libedataserverui-3.0-1 libespeak1 libevent-2.0-5 libevince3-3 libexempi3 libfolks-telepathy25 libfolks25 libgail-3-0 libgail-3-common libgail-common libgail18 libgamin0 libgck-1-0 libgconf2-4 libgconf2.0-cil libgcr-3-1 libgd2-xpm libgdata-common libgdata1.7-cil libgdata13 libgdiplus libgdu-gtk0 libgdu0 libgee2 libgeoclue0 libgexiv2-0 libgkeyfile1.0-cil libgksu2-0 libglew1.5 libglewmx1.5 libglib-perl libglib2.0-bin libglib2.0-cil libglib2.0-data libglibmm-2.4-1c2a libgmime-2.4-2 libgmime2.4-cil libgnome-bluetooth8 libgnome-control-center1 libgnome-desktop-3-2 libgnome-media-profiles-3.0-0 libgnome-menu-3-0 libgnome-menu2 libgnome2-common libgnomekbd-common libgnomekbd7 libgnomevfs2-0 libgnomevfs2-common libgoa-1.0-0 libgomp1 libgpod-common libgpod4 libgrip0 libgssdp-1.0-2 libgstfarsight0.10-0 libgtk-3-0 libgtk-3-bin libgtk-3-common libgtk-sharp-beans-cil libgtk-vnc-2.0-0 libgtk2-perl libgtk2.0-cil libgtkmm-3.0-1 libgtksourceview-3.0-0 libgtksourceview-3.0-common libgtkspell0 libgtkspell3-0 libgtop2-7 libgtop2-common libgucharmap-2-90-7 libgudev1.0-cil libgupnp-1.0-3 libgupnp-igd-1.0-3 libgvnc-1.0-0 libgweather-3-0 libgweather-common libgwibber-gtk2 libgwibber2 libibus-1.0-0 libidl0 libido3-0.1-0 libindicate-gtk3 libindicator-messages-status-provider1 libindicator3-6 libindicator6 libisofs6 libjson-glib-1.0-0 libjte1 libkpathsea5 liblaunchpad-integration-3.0-1 liblaunchpad-integration-common liblaunchpad-integration1 liblaunchpad-integration1.0-cil liblightdm-gobject-1-0 liblircclient0 liblouis-data liblouis2 liblua5.1-0 libmetacity-private0 libminiupnpc5 libmission-control-plugins0 libmono-addins-gui0.2-cil libmono-addins0.2-cil libmono-cairo4.0-cil libmono-corlib4.0-cil libmono-csharp4.0-cil libmono-i18n-west4.0-cil libmono-i18n4.0-cil libmono-posix4.0-cil libmono-security4.0-cil libmono-sharpzip4.84-cil libmono-system-configuration4.0-cil libmono-system-core4.0-cil libmono-system-drawing4.0-cil libmono-system-security4.0-cil libmono-system-xml4.0-cil libmono-system4.0-cil libmono-zeroconf1.0-cil libnatpmp1 libnautilus-extension1 libnice10 libnm-gtk-common libnm-gtk0 libnotify-bin libnotify0.4-cil libnotify4 libnux-1.0-0 libnux-1.0-common liboauth0 libopencc1 liborbit2 liboverlay-scrollbar-0.2-0 liboverlay-scrollbar3-0.2-0 libp11-kit0 libpam-gnome-keyring libpango-perl libpangomm-1.4-1 libpeas-1.0-0 libpeas-common libpoppler-glib6 libportaudio2 libprotobuf7 libprotoc7 libpurple-bin libpurple0 libqtbamf1 libqtdee2 libqtgconf1 libquadmath0 libquvi0 librarian0 libreoffice-gnome libreoffice-gtk libreoffice-help-en-us libreoffice-style-human librest-0.7-0 librsvg2-2 librsvg2-common librsync1 libsdl1.2debian libsdl1.2debian-pulseaudio libsigc++-2.0-0c2a libstartup-notification0 libsyncdaemon-1.0-1 libt1-5 libtaglib2.0-cil libtelepathy-farsight0 libtelepathy-glib0 libtelepathy-logger2 libtotem-plparser17 libtotem0 libubuntuone-1.0-1 libubuntuone1.0-cil libunique-1.0-0 libunique-3.0-0 libunity-2d-private0 libunity-core-4.0-4 libunity-misc4 libunity6 libutouch-geis1 libuuid-perl libvte-2.90-9 libvte-common libvte9 libwebkitgtk-1.0-0 libwebkitgtk-1.0-common libwebkitgtk-3.0-0 libwebkitgtk-3.0-common libwmf0.2-7 libwmf0.2-7-gtk libwnck-3-0 libwnck-3-common libwnck-common libwnck22 libxklavier16 libxres1 libyaml-tiny-perl libyelp0 libzeitgeist-1.0-1 libzephyr4 light-themes lightdm linux-headers-3.0.0-12 linux-headers-3.0.0-12-generic linux-headers-generic linux-libc-dev make manpages-dev media-player-info metacity metacity-common mono-4.0-gac mono-gac mono-runtime mousetweaks nautilus nautilus-data nautilus-sendto nautilus-sendto-empathy nautilus-share network-manager-gnome network-manager-pptp-gnome notify-osd notify-osd-icons nux-tools onboard oneconf overlay-scrollbar pinyin-database pkg-config plymouth-theme-ubuntu-logo policykit-1-gnome protobuf-compiler pulseaudio-module-gconf python-appindicator python-aptdaemon python-aptdaemon-gtk python-aptdaemon.gtk3widgets python-aptdaemon.gtkwidgets python-brlapi python-configglue python-dateutil python-defer python-egenix-mxdatetime python-egenix-mxtools python-farsight python-gconf python-gnomekeyring python-gst0.10 python-gtk2 python-ibus python-indicate python-libproxy python-libxml2 python-louis python-notify python-openssl python-pam python-papyon python-piston-mini-client python-protobuf python-pyatspi2 python-pyinotify python-serial python-speechd python-support python-telepathy python-twisted-bin python-twisted-core python-twisted-names python-twisted-web python-ubuntuone-client python-ubuntuone-control-panel python-ubuntuone-storageprotocol python-virtkey python-vte python-webkit python-wnck qt-at-spi rarian-compat rdesktop seahorse sessioninstaller shotwell simple-scan sni-qt software-center software-properties-common software-properties-gtk speech-dispatcher ssh-askpass-gnome system-config-printer-gnome telepathy-butterfly telepathy-gabble telepathy-haze telepathy-idle telepathy-indicator telepathy-logger telepathy-mission-control-5 telepathy-salut thunderbird thunderbird-globalmenu thunderbird-gnome-support tomboy totem totem-common totem-mozilla totem-plugins transmission-common transmission-gtk ubufox ubuntu-artwork ubuntu-desktop ubuntu-docs ubuntu-mono ubuntu-sounds ubuntu-sso-client ubuntu-system-service ubuntu-wallpapers ubuntuone-client ubuntuone-client-gnome ubuntuone-control-panel ubuntuone-control-panel-gtk ubuntuone-couch ubuntuone-installer unity unity-2d unity-2d-launcher unity-2d-panel unity-2d-places unity-2d-spread unity-asset-pool unity-common unity-greeter unity-lens-applications unity-lens-files unity-lens-music unity-scope-musicstores unity-services update-manager update-notifier usb-creator-gtk vinagre vino whois xdg-user-dirs-gtk xdiagnose xul-ext-ubufox yelp yelp-xsl zeitgeist zeitgeist-core zeitgeist-datahub zeitgeist-extension-fts zenity zenity-common && sudo apt-get install kubuntu-desktop

Source: http://psychocats.net

Note: Removing just ubuntu-desktop will not uninstall all of Gnome packages.


Sometimes 12.04 will mount phone as USB storage when I plug it in, and sometimes it won't

The problem was that I was expecting a partitioned file system, and (perhaps) so was something in my environment. The device had a filesystem but no partition table, in other words.


DeadBeef is actively developed and in a way that brings it closer and closer to Foobar2000.

(what it lacks in Foobar2000-features (numbers of addons) it compensates in being light and up-to-the-point - the most straightforward and non-bloated music player/handler I have seen until now in Ubuntu).

With File browser plugin:

With Infobar plugin:

to install it:

sudo add-apt-repository ppa:alex-p/deadbeef
sudo apt-get update
sudo apt-get install deadbeef

Or download as .deb and install (i686 or amd64)

To install plugins, wich are .so files, they should be put into a certain folder.

~/.local/lib/deadbeef/

or: /usr/local/lib/deadbeef/

For the static portable version it is deadbeef-versionnumber/plugins

Considering problems of incompatibility and other issues in using  the plugins, see this related answer

To convert audio files, see this question+answer.

Considering memory use, Deadbeef is much lighter than other players that might be considered foobar-like.

The latest versions (now 0.6.2) bring it even closer to foobar by the 'Designer mode' feature (similar to the layout editing mode in foobar) by which built-in or plugin features (file browser, infobar etc) are integrated to the interface:

File conversion is now very close to Foobar2000's - see the link above on conversion.

Already mentioned in answers, a great alternative is Clementine.


18.04 LTS Ubuntu Software Center: Cannot resolve hostname

I had the same error. As suggested prior comments, I ran:

sudo apt update
sudo apt upgrade

And that seemed to fix it.


Is it possible to use Ubuntu as speaker while playing music from a bluetooth-linked smartphone?

You could do this:

 sudo apt-get install blueman

and then this:

 Bluetooth -v -l device

and it might work fine this way.


Caused by separate X/DE clipboards;  keep them synchronized with ClipIt

As ImaginaryRobots' answer explains there are two different clipboards: the X clipboard and the desktop environment/window manager clipboard (Gnome/Unity, KDE, etc.); depending on the selection method used (i.e. just highlighting, or an explicit Ctrl-C/right-click copy, etc.), the two clipboards may not be synchronized.

Thus, there are often issues when copying/pasting between GUI programs and the terminal.

The easiest solution if you have this problem is to use a tool that keeps both these separate clipboards in sync. I recommend ClipIt (sudo apt-get install clipit)

Start clipit (add to Startup Applications for convenience), and under Preferences, check both the Use Primary and Synchronize Clipboards options:


How To Get List Of Files From Audio CD Bash Terminal

I guess I would second using ripit.  However, it is just a wrapper around some other CD utilities, such as cdparanoia and cdda2wav.  It seems to me that it would just be easier to rip the entire CD into the file format you need (OGG, WAV, MP3...).

However, if you must use VLC, then I suspect all you really need is the track information, and cdda2wav can do that, but other than the number of tracks, I'm confused as to what you are looking for specifically.  Anyhow, if you want to do that to get the number of tracks, you could then pass in the parameter to VLC such as:

vlc cdda//sr0 --cdda-track 1

More about ripit, check out the README just off of http://www.suwald.com/ripit/use.php

If you go low-level with cdda2wav or its companions, you may have difficulty with the version that coms with Ubuntu, so you might want to read up on it and download the other version from http://cdrecord.org.

If none of this helps, then all I can say is that more input is needed.