--- unixtoolbox.xhtml   8 Apr 2008 01:35:05 -0000   1.20
+++ unixtoolbox.xhtml   23 Jun 2008 21:07:23 -0000
@@ -6,11 +6,12 @@
       xmlns:svg="http://www.w3.org/2000/svg" xml:lang="en">
 <head>                            
   <title>Unix Toolbox</title>
+  <link rel="icon" href="data:image/x-icon;base64,AAABAAEAEBAAAAAAAABoBQAAFgAAACgAAAAQAAAAIAAAAAEACAAAAAAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA////AOBfLwBbX14AWxgYABg8RwC/g14AGBgYAL9OJAB8KhgAfHFeAOCDUgC/g0cAGCo7AOCDXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcJCw4ODg4ODgUHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcLCgcHBwcHBwcHBwcHBwcHBwgOBQcHBwcHBwcHBwcHBwcHBAwNBwcHBwcHBwcHBwcHBwcJCwMHBwcHBwcHBwcHBwcCBg0HBwcHBwcHBwcHBwkLAwcHBwcHBwcHBwcHBwcMDQcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" />
   <meta name="author" content="Colin Barschel c@cb.vu" />
-  <meta name="copyright" content="Copyright © 2007-2008 Colin Barschel. Some rights reserved under Creative Commons [Attribution - Share Alike]" />
+  <meta name="copyright" content="Copyright (c) 2007-2008 Colin Barschel. Some rights reserved under Creative Commons [Attribution - Share Alike]" />
   <meta name="description" content="A collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users, a compact and practical reference." />
   <meta name="abstract" content="Unix Toolbox a compact and practical reference for sysadmins and advanced users." />
-  <meta name="subject" content="Unix Toolbox revision 12" />
+  <meta name="subject" content="Unix Toolbox revision 13" />
   <meta name="keywords" content="Unix Toolbox, Unix tools, Unix, FreeBSD, Linux, commands list, sysadmin, practical guide, advanced reference, common Linux tasks, syntax reminder, howtos, ssh tunnels, rsync, ssl certificates" />
   <style type="text/css" >
 /* basic CSS common to all media */
@@ -84,10 +85,10 @@
 /* including some IE6 hacks */
     body {
         padding: 0;
-        margin: 1em 13em 0em 2em;
+        margin: 1em 13em 0em 1.5em;
     }   
     html>body {
-        margin: 1em 13em 0em 2em;
+        margin: 1em 13em 0em 1.5em;
     }
     body>div.menu {
         position: fixed;
@@ -98,15 +99,15 @@
     div.menu { 
         position: absolute;
         z-index: 2;
-        width: 10.2em; height: auto;
-        top: 0.4em; right: 1em; bottom: 0.8em; left: auto;
+        width: 10.7em; height: auto;
+        top: 0.4em; right: 0.5em; bottom: 0.8em; left: auto;
     }
     div.changestyle {
         font-size: 80%;
         font-weight: normal;
         position: absolute;
         z-index: 2;
-        width: 10.2em; height: auto;
+        width: 10.7em; height: auto;
         bottom: 0;
     }
     ol.toc, ol.toc li  {
@@ -115,6 +116,7 @@
         padding: 0.13em 0;
         text-indent: 0;
         text-align: left;
+        line-height: 1.1em;
     }
     p.last {
         padding-top: 5em;
@@ -137,15 +139,18 @@
     div {
         text-align: justify;
     }
-    
+    h2 {
+        margin-bottom: 0.7em;
+    }
     h3 {
-        margin-bottom: 1em;
+        margin-bottom: 0.5em;
     }
     pre {
         font-size: 90%;
         margin: 0.4em 0;
         padding: 0.2em 0 0.2em 0.4em;
         text-align: left;
+        line-height: 117%
     }
     a {
    text-decoration: none;
@@ -397,13 +402,15 @@
 This document is a collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users. This is a practical guide with concise explanations, however the reader is supposed to know what s/he is doing.<br /><br />
 </div>
 <div class="footerfirst">
-Unix Toolbox revision 12<br />
+Unix Toolbox revision 13<br />
 The latest version of this document can be found at <a href="http://cb.vu/unixtoolbox.xhtml">http://cb.vu/unixtoolbox.xhtml</a>. Replace .xhtml on the link with <a href="http://cb.vu/unixtoolbox.pdf">.pdf</a> for the PDF version and with <a href="http://cb.vu/unixtoolbox.book.pdf">.book.pdf</a> for the booklet version. On a duplex printer the booklet will create a small book ready to bind. <span class="web">This XHTML page can be converted into a nice PDF document with a CSS3 compliant application (see the <a class="xref" href="#bourneexample">script example</a>).</span> See also the <a href="http://cb.vu/unixtoolbox">about page</a>.<br />
 Error reports and comments are most welcome - <a href="mailto:c\at\cb.vu">c@cb.vu</a> Colin Barschel.
 <p class="copyright">&#169; <a href="mailto:c_at_cb.vu">Colin Barschel</a> 2007-2008. <a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/">Some rights reserved under Creative Commons</a>.
 </p>
 </div> 
-
+<!-- The table of content is displayed as a fixed vertical right menu
+  when viewed in a browser. When printed TOC is displayed on the front
+  page as a classical table of content with page numbers -->
 <div class="menu">
 <ol class="toc">
   <li><a href="#sysinfo">System</a></li>
@@ -431,7 +438,7 @@
   <li><a href="#onlinehelp">Online Help</a></li>
 </ol>
 <br />
-<div class="changestyle">
+<div class="changestyle"> <!-- small icons for black and white view. SVG is embedded -->
 <a href="#" onclick="setActiveStyleLink('default'); return false;">
 <svg:svg width="15" height="10" viewBox="0 0 310 210">
 <svg:rect x="5" y="5" width="300" height="200" style="stroke:black;stroke-width:7;fill:white" />
@@ -460,10 +467,10 @@
 # cat /etc/SuSE-release              <span class="cmt"># Get SuSE version</span>
 # cat /etc/debian_version            <span class="cmt"># Get Debian version</span>
 </pre>
-Use /etc/<code>DISTR</code>-release with <code>DISTR=</code> lsb (Ubuntu), redhat, gentoo, mandrake, sun (Solaris), and so on.
+Use /etc/<code>DISTR</code>-release with <code>DISTR=</code> lsb (Ubuntu), redhat, gentoo, mandrake, sun (Solaris), and so on. See also <code>/etc/issue</code>.
 <pre># uptime                             <span class="cmt"># Show how long the system has been running + load</span>
 # hostname                           <span class="cmt"># system's host name</span>
-# hostname -i                        <span class="cmt"># Display the IP address of the host.</span>
+# hostname -i                        <span class="cmt"># Display the IP address of the host. (Linux only)</span>
 # man hier                           <span class="cmt"># Description of the file system hierarchy</span>
 # last reboot                        <span class="cmt"># Show system reboot history</span>
 </pre>
@@ -495,6 +502,7 @@
 # pciconf -l -cv                     <span class="cmt"># Show PCI devices</span>
 # usbdevs -v                         <span class="cmt"># Show USB devices</span>
 # atacontrol list                    <span class="cmt"># Show ATA devices</span>
+# camcontrol devlist -v              <span class="cmt"># Show SCSI devices</span>
 </pre>
 <h2 id="loadstats">Load, statistics and messages</h2>
 The following commands are useful to find out what is going on on the system.
@@ -516,6 +524,8 @@
 # who                                <span class="cmt"># Show who is logged on the system</span>
 # groupadd admin                     <span class="cmt"># Add group "admin" and user colin (Linux/Solaris)</span>
 # useradd -c "Colin Barschel" -g admin -m colin
+# usermod -a -G &lt;group&gt; &lt;user&gt;       <span class="cmt"># Add existing user to group (Debian)</span>
+# groupmod -A &lt;user&gt; &lt;group&gt;         <span class="cmt"># Add existing user to group (SuSE)</span>
 # userdel colin                      <span class="cmt"># Delete user colin (Linux/Solaris)</span>
 # adduser joe                        <span class="cmt"># FreeBSD add user joe (interactive)</span>
 # rmuser joe                         <span class="cmt"># FreeBSD delete user joe (interactive)</span>
@@ -553,6 +563,7 @@
 <pre># sysctl -a                          <span class="cmt"># View all system limits</span>
 # sysctl fs.file-max                 <span class="cmt"># View max open files limit</span>
 # sysctl fs.file-max=102400          <span class="cmt"># Change max open files limit</span>
+# echo "1024 50000" > /proc/sys/net/ipv4/ip_local_port_range  <span class="cmt"># port range</span>
 # cat /etc/sysctl.conf
 fs.file-max=102400                   <span class="cmt"># Permanent entry in sysctl.conf</span>
 # cat /proc/sys/fs/file-nr           <span class="cmt"># How many file descriptors are in use</span>
@@ -573,6 +584,8 @@
 kern.ipc.somaxconn=8192              <span class="cmt"># TCP queue. Better for apache/sendmail</span>
 # sysctl kern.openfiles              <span class="cmt"># How many file descriptors are in use</span>
 # sysctl kern.ipc.numopensockets     <span class="cmt"># How many open sockets are in use</span>
+# sysctl -w net.inet.ip.portrange.last=50000 <span class="cmt"># Default is 1024-5000</span>
+# netstat -m                         <span class="cmt"># network memory buffers statistics</span>
 </pre>
 See The <a href="http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/configtuning-kernel-limits.html">FreeBSD handbook Chapter 11</a><span class="fn">http://www.freebsd.org/handbook/configtuning-kernel-limits.html</span> for details.
 
@@ -662,7 +675,6 @@
 # reboot
 </pre>
 
-
 <h2 id="kernelmodules">Kernel modules</h2>
 <h3>Linux</h3>
 <pre># lsmod                              <span class="cmt"># List all modules loaded in the kernel</span>
@@ -676,7 +688,7 @@
 <h3>Linux</h3>
 <pre># cd /usr/src/linux
 # make mrproper                      <span class="cmt"># Clean everything, including config files</span>
-# make oldconfig                     <span class="cmt"># Create a new config file from the current kernel</span>
+# make oldconfig                     <span class="cmt"># Reuse the old .config if existent</span>
 # make menuconfig                    <span class="cmt"># or xconfig (Qt) or gconfig (GTK)</span>
 # make                               <span class="cmt"># Create a compressed kernel image</span>
 # make modules                       <span class="cmt"># Compile the modules</span>
@@ -685,7 +697,16 @@
 # reboot
 </pre>
 <h3>FreeBSD</h3>
-To modify and rebuild the kernel, copy the generic configuration file to a new name and edit it as needed. It is however also possible to edit the file <code>GENERIC</code> directly.
+Optionally update the source tree (in <code>/usr/src</code>) with csup (as of FreeBSD 6.2 or later):
+<pre># csup &lt;supfile&gt;</pre>
+I use the following supfile:
+<pre>*default host=cvsup5.FreeBSD.org  # www.freebsd.org/handbook/cvsup.html#CVSUP-MIRRORS
+*default prefix=/usr 
+*default base=/var/db
+*default release=cvs delete tag=RELENG_7
+src-all
+</pre>
+To modify and rebuild the kernel, copy the generic configuration file to a new name and edit it as needed (you can also edit the file <code>GENERIC</code> directly). To restart the build after an interuption, add the option <code>NO_CLEAN=YES</code> to the make command to avoid cleaning the objects already build.
 <pre># cd /usr/src/sys/i386/conf/
 # cp GENERIC MYKERNEL
 # cd /usr/src
@@ -699,13 +720,12 @@
 # reboot
 # mergemaster -p                     <span class="cmt"># Compares only files known to be essential</span>
 # make installworld
-# mergemaster                        <span class="cmt"># Update all configuration and other files</span>
+# mergemaster -i -U                  <span class="cmt"># Update all configuration and other files</span>
 # reboot
 </pre>
-For small changes in the source, sometimes the short version is enough:
-<pre># make kernel world                  <span class="cmt"># Compile and install both kernel and OS</span>
-# mergemaster
-# reboot
+For small changes in the source you can use NO_CLEAN=yes to avoid rebuilding the whole tree. But use with care.
+<pre># make buildworld NO_CLEAN=yes       <span class="cmt"># Don't delete the old objects</span>
+# make buildkernel KERNCONF=MYKERNEL NO_CLEAN=yes
 </pre>
 </div>
 
@@ -1077,7 +1097,7 @@
 </div>
 
 <div id="network"><h1><a>Network</a></h1>
-<p class="xrefp"><a class="xrefp" href="#routing">Routing</a> | <a class="xrefp" href="#secondip">Additional IP</a> | <a class="xrefp" href="#changemac">Change MAC</a> | <a class="xrefp" href="#ports">Ports</a> | <a class="xrefp" href="#firewall">Firewall</a> | <a class="xrefp" href="#ipforward">IP Forward</a> | <a class="xrefp" href="#nat">NAT</a> | <a class="xrefp" href="#dns">DNS</a> | <a class="xrefp" href="#dhcp">DHCP</a> | <a class="xrefp" href="#traffic">Traffic</a> | <a class="xrefp" href="#trafficctrl">QoS</a> | <a class="xrefp" href="#nis">NIS</a></p>
+<p class="xrefp"><a class="xrefp" href="#routing">Routing</a> | <a class="xrefp" href="#secondip">Additional IP</a> | <a class="xrefp" href="#changemac">Change MAC</a> | <a class="xrefp" href="#ports">Ports</a> | <a class="xrefp" href="#firewall">Firewall</a> | <a class="xrefp" href="#ipforward">IP Forward</a> | <a class="xrefp" href="#nat">NAT</a> | <a class="xrefp" href="#dns">DNS</a> | <a class="xrefp" href="#dhcp">DHCP</a> | <a class="xrefp" href="#traffic">Traffic</a> | <a class="xrefp" href="#trafficctrl">QoS</a> | <a class="xrefp" href="#nis">NIS</a> | <a class="xrefp" href="#netcat">Netcat</a></p>
 <h2 id="netdebug">Debugging (See also <a class="xref" href="#traffic">Traffic analysis)</a></h2>
 <h3>Linux</h3>
 <pre># ethtool eth0              <span class="cmt"># Show the ethernet status (replaces mii-diag)</span>
@@ -1147,6 +1167,7 @@
 <h3>FreeBSD</h3>
 <pre># ifconfig fxp0 inet 192.168.50.254/24                     <span class="cmt"># First IP</span>
 # ifconfig fxp0 alias 192.168.51.254 netmask 255.255.255.0 <span class="cmt"># Second IP</span>
+# ifconfig fxp0 -alias 192.168.51.254                      <span class="cmt"># Remove second IP alias</span>
 </pre>Permanent entries in /etc/rc.conf                   
 <pre>ifconfig_fxp0="inet 192.168.50.254  netmask 255.255.255.0"
 ifconfig_fxp0_alias0="192.168.51.254 netmask 255.255.255.0"
@@ -1227,7 +1248,7 @@
 # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 20022 -j DNAT \
 --to 192.168.16.44:22           <span class="cmt"># Port forward 20022 to internal IP port ssh</span>
 # iptables -t nat -A PREROUTING -p tcp -d 78.31.70.238 --dport 993:995 -j DNAT \
---to 192.168.16.254:993:995     <span class="cmt"># Port forward of range 993-995</span>
+--to 192.168.16.254:993-995     <span class="cmt"># Port forward of range 993-995</span>
 # ip route flush cache
 # iptables -L -t nat            <span class="cmt"># Check NAT status</span>
 </pre>
@@ -1333,8 +1354,11 @@
 <a href="http://people.suug.ch/~tgr/bmon/">Bmon</a><span class="fn">http://people.suug.ch/~tgr/bmon/</span> is a small console bandwidth monitor and can display the flow on different interfaces. 
 <h3>Sniff with tcpdump</h3>
 <pre># tcpdump -nl -i bge0 not port ssh and src \(192.168.16.121 or 192.168.16.54\)
+# tcpdump -n -i eth1 net 192.168.16.121           <span class="cmt"># select to/from a single IP</span>
+# tcpdump -n -i eth1 net 192.168.16.0/24          <span class="cmt"># select traffic to/from a network</span>
 # tcpdump -l > dump &amp;&amp; tail -f dump               <span class="cmt"># Buffered output</span>
-# tcpdump -i rl0 -w traffic.rl0                   <span class="cmt"># Write traffic in binary file</span>
+# tcpdump -i rl0 -w traffic.rl0                   <span class="cmt"># Write traffic headers in binary file</span>
+# tcpdump -i rl0 -s 0 -w traffic.rl0              <span class="cmt"># Write traffic + payload in binary file</span>
 # tcpdump -r traffic.rl0                          <span class="cmt"># Read from file (also for ethereal</span>
 # tcpdump port 80                                 <span class="cmt"># The two classic commands</span>
 # tcpdump host google.com
@@ -1441,6 +1465,36 @@
 ypserver servername
 domain domain.net broadcast
 </pre>
+
+<h2 id="netcat">Netcat</h2>
+<a rel="nofollow" href="http://netcat.sourceforge.net/">Netcat</a><span class="fn">http://netcat.sourceforge.net</span> (nc) is better known as the "network Swiss Army Knife", it can manipulate, create or read/write TCP/IP connections. Here some useful examples, there are many more on the net, for example <a rel="nofollow" href="http://www.g-loaded.eu/2006/11/06/netcat-a-couple-of-useful-examples">g-loaded.eu[...]</a><span class="fn">http://www.g-loaded.eu/2006/11/06/netcat-a-couple-of-useful-examples</span> and <a rel="nofollow" href="http://www.terminally-incoherent.com/blog/2007/08/07/few-useful-netcat-tricks">here</a><span class="fn">http://www.terminally-incoherent.com/blog/2007/08/07/few-useful-netcat-tricks</span>.<br /> You might need to use the command <code>netcat</code> instead of <code>nc</code>. Also see the similar command <a rel="nofollow" href="http://www.dest-unreach.org/socat">socat</a>.
+
+<h3>File transfer</h3>
+Copy a large folder over a raw tcp connection. The transfer is very quick (no protocol overhead) and you don't need to mess up with NFS or SMB or FTP or so, simply make the file available on the server, and get it from the client. Here 192.168.1.1 is the server IP address.
+<pre><span class="cmt">server#</span> tar -cf - -C VIDEO_TS . | nc -l -p 4444         <span class="cmt"># Serve tar folder on port 4444</span>
+<span class="cmt">client#</span> nc 192.168.1.1 4444 | tar xpf - -C VIDEO_TS     <span class="cmt"># Pull the file on port 4444</span>
+<span class="cmt">server#</span> cat largefile | nc -l 5678                      <span class="cmt"># Server a single file</span>
+<span class="cmt">client#</span> nc 192.168.1.1 5678 > largefile                 <span class="cmt"># Pull the single file</span>
+<span class="cmt">server#</span> dd if=/dev/da0 | nc -l 4444                     <span class="cmt"># Server partition image</span>
+<span class="cmt">client#</span> nc 192.168.1.1 4444 | dd of=/dev/da0            <span class="cmt"># Pull partition to clone</span>
+<span class="cmt">client#</span> nc 192.168.1.1 4444 | dd of=da0.img             <span class="cmt"># Pull partition to file</span>
+</pre>
+<h3>Other hacks</h3>
+Specially here, you must know what you are doing.
+<h4>Remote shell</h4>
+Option -e only on the Windows version? Or use <a rel="nofollow" href="http://download.insecure.org/stf/nc110.tgz">nc 1.10</a>.
+<pre># nc -lp 4444 -e /bin/bash                        <span class="cmt"># Provide a remote shell (server backdoor)</span>
+# nc -lp 4444 -e cmd.exe                          <span class="cmt"># remote shell for Windows</span>
+</pre>
+<h4>Emergency web server</h4>
+Serve a single file on port 80 in a loop.
+<pre># while true; do nc -l -p 80 &lt; unixtoolbox.xhtml; done
+</pre>
+<h4>Chat</h4>
+Alice and Bob can chat over a simple TCP socket. The text is transferred with the enter key.
+<pre><span class="cmt">alice#</span> nc -lp 4444
+<span class="cmt">bob  #</span> nc 192.168.1.1 4444
+</pre>
 </div>
 
 <div id="ssh"><h1><a>SSH SCP</a></h1>
@@ -1522,7 +1576,7 @@
 The smb share can now be accessed with \\127.0.0.1\, but only if the local share is disabled, because <i>the local share is listening on port 139</i>.<br />
 It is possible to keep the local share enabled, for this we need to create a new virtual device with a new IP address for the tunnel, the smb share will be connected over this address. Furthermore <i>the local RDP is already listening on 3389</i>, so we choose 3388. For this example let's use a virtual IP of 10.1.1.1.<br />
 <ul>
-<li>With putty use Source port=10.1.1.1:139. It is possible to create multiple loop devices and tunnel. On Windows 2000, only putty worked for me.</li>
+<li>With putty use Source port=10.1.1.1:139. It is possible to create multiple loop devices and tunnel. On Windows 2000, only putty worked for me. On Windows Vista also forward the port 445 in addition to the port 139. Also on Vista the patch KB942624 prevents the port 445 to be forwarded, so I had to uninstall this path in Vista.</li>
 <li>With the ssh.com client, disable "Allow local connections only". Since ssh.com will bind to all addresses, only a single share can be connected.</li>
 </ul>
 Now create the loopback interface with IP 10.1.1.1:
@@ -1561,6 +1615,22 @@
 <pre># ssh -L 5900:localhost:15900 admin@gate</pre>
 Now the admin can connect directly to the client VNC with:
 <pre># vncconnect -display :0 localhost</pre>
+
+<h3 id="sshmultihop">Dig a multi-hop ssh tunnel</h3>
+Suppose you can not reach a server directly with ssh, but only via multiple intermediate hosts (for example because of routing issues). Sometimes it is still necessary to get a direct client - server connection, for example to copy files with scp, or forward other ports like smb or vnc. One way to do this is to chain tunnels together to forward a port to the server along the hops. This "carrier" port only reaches its final destination on the last connection to the server.<br />
+Suppose we want to forward the ssh port from a client to a server over two hops. Once the tunnel is build, it is possible to connect to the server directly from the client (and also add an other port forward).
+<h4>Create tunnel in one shell</h4>
+client -&gt; host1 -&gt; host2 -&gt; server and dig tunnel 5678
+<pre><span class="cmt">client&gt;</span># ssh -L5678:localhost:5678 host1        <span class="cmt"># 5678 is an arbitrary port for the tunnel</span>
+<span class="cmt">host_1&gt;</span># ssh -L5678:localhost:5678 host2        <span class="cmt"># chain 5678 from host1 to host2</span>
+<span class="cmt">host_2&gt;</span># ssh -L5678:localhost:22 server         <span class="cmt"># end the tunnel on port 22 on the server</span>
+</pre>
+<h4>Use tunnel with an other shell</h4>
+client -&gt; server using tunnel 5678
+<pre># ssh -p 5678 localhost                         <span class="cmt"># connect directly from client to  server</span>
+# scp -P 5678 myfile localhost:/tmp/            <span class="cmt"># or copy a file directly using the tunnel</span>
+# rsync -e 'ssh -p 5678' myfile localhost:/tmp/ <span class="cmt"># or rsync a file directly to the server</span>
+</pre>
 </div>
 
 <div id="vpn"><h1><a>VPN with SSH</a></h1>
@@ -1751,24 +1821,24 @@
 <h2>OpenSSL</h2>
 <h3>A single file</h3>
 Encrypt and decrypt:
-<pre># openssl des -salt -in file -out file.des
-# openssl des -d -salt -in file.des -out file
+<pre># openssl aes-128-cbc -salt -in file -out file.aes
+# openssl aes-128-cbc -d -salt -in file.aes -out file
 </pre>
 Note that the file can of course be a tar archive.
     
 <h3>tar and encrypt a whole directory</h3>
-<pre># tar -cf - directory | openssl des -salt -out directory.tar.des      <span class="cmt"># Encrypt</span>
-# openssl des -d -salt -in directory.tar.des | tar -x                 <span class="cmt"># Decrypt</span>
+<pre># tar -cf - directory | openssl aes-128-cbc -salt -out directory.tar.aes      <span class="cmt"># Encrypt</span>
+# openssl aes-128-cbc -d -salt -in directory.tar.aes | tar -x                 <span class="cmt"># Decrypt</span>
 </pre>
     
 <h3>tar zip and encrypt a whole directory</h3>
-<pre># tar -zcf - directory | openssl des -salt -out directory.tar.gz.des  <span class="cmt"># Encrypt</span>
-# openssl des -d -salt -in directory.tar.gz.des | tar -xz             <span class="cmt"># Decrypt</span>
+<pre># tar -zcf - directory | openssl aes-128-cbc -salt -out directory.tar.gz.aes  <span class="cmt"># Encrypt</span>
+# openssl aes-128-cbc -d -salt -in directory.tar.gz.aes | tar -xz             <span class="cmt"># Decrypt</span>
 </pre>
 
 <ul>
-<li>Use -k mysecretpassword after des to avoid the interactive password request. However note that this is highly insecure.</li>
-<li>Use <strong>des3</strong> instead of <strong>des</strong> to get even stronger encryption (Triple-DES Cipher). This uses also more CPU.</li>
+<li>Use -k mysecretpassword after aes-128-cbc to avoid the interactive password request. However note that this is highly insecure.</li>
+<li>Use <strong>aes-256-cbc</strong> instead of <strong>aes-128-cbc</strong> to get even stronger encryption. This uses also more CPU.</li>
 </ul>
 
 <h2>GPG</h2>
@@ -1782,7 +1852,7 @@
 The private and public keys are the heart of asymmetric cryptography. What is important to remember:
 <ul>
 <li>Your public key is used by <i>others</i> to encrypt files that only you as the receiver can decrypt (not even the one who encrypted the file can decrypt it). The public key is thus meant to be distributed.</li>
-<li>Your private key is encrypted with your passphrase and is used to decrypt files which where encrypted with <i>your</i> public key. The private key must be kept <b>secure</b>. Also if the key or passphrase is lost, so are all the files encrypted with your public key.</li>
+<li>Your private key is encrypted with your passphrase and is used to decrypt files which were encrypted with <i>your</i> public key. The private key must be kept <b>secure</b>. Also if the key or passphrase is lost, so are all the files encrypted with your public key.</li>
 <li>The key files are called keyrings as they can contain more than one key.</li>
 </ul>
 First generate a key pair. The defaults are fine, however you will have to enter at least your full name and email and optionally a comment. The comment is useful to create more than one key with the same name and email. Also you should use a "passphrase", not a simple password.
@@ -2343,7 +2413,8 @@
 <h3>Delete</h3>
 <pre># dd if=/dev/zero of=/dev/hdc                         <span class="cmt"># Delete full disk</span>
 # dd if=/dev/urandom of=/dev/hdc                      <span class="cmt"># Delete full disk better</span>
-# kill -USR1 PID                                      <span class="cmt"># View dd progress (Linux only!)</span>
+# kill -USR1 PID                                      <span class="cmt"># View dd progress (Linux)</span>
+# kill -INFO PID                                      <span class="cmt"># View dd progress (FreeBSD)</span>
 </pre>
 <h3>MBR tricks</h3>
 The MBR contains the boot loader and the partition table and is 512 bytes small. The first 446 are for the boot loader, the bytes 446 to 512 are for the partition table.
@@ -2439,6 +2510,11 @@
 # cp unixtoolbox.xhtml{,.bak}        <span class="cmt"># Short way to copy the file with a new extension</span>
 # mv /dir1 /dir2                     <span class="cmt"># Rename a directory</span>
 </pre>
+Check file hashes with openssl. This is a nice alternative to the commands <code>md5sum</code> or <code>sha1sum</code> (FreeBSD uses <code>md5</code> and <code>sha1</code>) which are not always installed.
+<pre># openssl md5 file.tar.gz            <span class="cmt"># Generate an md5 checksum from file</span>
+# openssl sha1 file.tar.gz           <span class="cmt"># Generate an sha1 checksum from file</span>
+# openssl rmd160 file.tar.gz         <span class="cmt"># Generate a RIPEMD-160 checksum from file</span>
+</pre>
 </div>
 
 <div id="software"><h1><a>Install Software</a></h1>
@@ -3075,7 +3151,7 @@
 <!-- <div class="pb" /> -->
 
 <div class="footerlast">
-This document: "Unix Toolbox revision 12" is licensed under a <a rel="nofollow" href="http://creativecommons.org/licenses/by-sa/3.0/">Creative Commons Licence [Attribution - Share Alike]</a>. &#169; <a href="mailto:c_at_cb.vu">Colin Barschel</a> 2007-2008. Some rights reserved.
+This document: "Unix Toolbox revision 13" is licensed under a <a rel="nofollow" href="http://creativecommons.org/licenses/by-sa/3.0/">Creative Commons Licence [Attribution - Share Alike]</a>. &#169; <a href="mailto:c_at_cb.vu">Colin Barschel</a> 2007-2008. Some rights reserved.
 </div>
 
 </body>

