Find the Procs
After upgrading an important package in Linux -or other Unix variant- that provides a library used by many other processes. Instead of restarting the server for the new lib to take effect, the procs can be restarted -or HUPed- individually.
Before we begin, lsof needs to be installed.
# RHEL / CentOS
~$ yum install lsof
# Debian / Ubuntu
~$ apt-get install lsof
In the following example, we list what processes are using the libcrypto library in Raspbian.
~$ lsof /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 551 root mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
ntpd 2321 ntp mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
sshd 6643 root mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
sshd 6649 meow mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
openvpn 30044 nobody mem REG 179,2 1418532 10074 /usr/lib/arm-linux-gnueabihf/libcrypto.so.1.0.0
Next, the affected processes can be restarted:
~$ service [SERVICENAME] restart
~$ systemctl restart [SERVICENAME]
~$ kill -HUP 31337
When security and integrity of a file is critical, such as with x509 certificates or other important documents, OpenSSL or other variant can be used to secure the file. With strong encryption and -hopefully- a strong password.
OpenSSL is generally available on all UNIX variants, downloadable as an executable for Windows and is also used with many other applications through the LibCrypto library.
If you need help picking a strong password, I’d recommend StrongPasswordGenerator.Com. Never share the password with the receiving party over the same medium as the file transmission. Send it Out-Of-Band over a SMS or Telephone Call or similar.
In the following example, we take a file and encrypt it using AES-256-CBC, protecting it using a password and adding a salt for extra randomness. The output is added to a newly created file.
~$ openssl enc -salt -aes-256-cbc -in TuxPics.tgz -out TuxPics.tgz.enc
enter aes-256-cbc encryption password: q55Tc9Hp68-Ry4d
Verifying - enter aes-256-cbc encryption password: q55Tc9Hp68-Ry4d
The content of TuxFiles.tgz.enc is perceived as a random binary string to EVE when in transit on the open network.
In the next example, we do the reverse action. Decrypting the file using the same password and appending the output to a new file.
~$ openssl enc -aes-256-cbc -d -in TuxFiles.tgz.enc > TuxFiles.tgz
enter aes-256-cbc decryption password: q55Tc9Hp68-Ry4d
In case the file type is not known from the decrytion result (stdout), the “file” command can be used when running Linux.
~$ file TuxPics
TuxPics: gzip compressed data
Using NetCat to upload files can sometimes be handy, however it would be awesome if you could track the upload ETA and not just stare patiently for a prompt. PV, or “Pipe Viewer”, is a handy little command that allows you to track the progress of any Unix pipe. Using it as an replacement for “cat” in the NetCat transfer, gives you a fancy progress-bar.
lazyclient@lazyclient-desktop:~$ nc -l 7000 > verybigfile.bin
superitguy@pro-server:~$ pv verybigfile.bin | nc 22.214.171.124 7000
70.2MB 0:00:11 [5.95MB/s] [============================================================>] 100%
Fetch the latest binary @ pv’s project homepage: http://www.ivarch.com/programs/pv.shtml