Tuesday, August 17, 2010

How to setup a VPN connection to a SonicWall router using Openswan and Pre-shared Keys (PSK)


Our SonicWall router makes it easy enough to establish a VPN connection using Windows. There is a client that can be downloaded from the SonicWall web site. What about other operating systems? Our developers often use Ubuntu Linux from home and required a way to VPN into the office. Once established, a VPN connection allows access to development servers, remote desktops, and other network resources inside the firewall; so you can see why it would be essential for the remote office.
The problem, as most Linux users out there already know, is that setting up a VPN connection in Ubuntu Linux is not very easy. After much trial and error, here is how we got the VPN working on Ubuntu Linux using Openswan.

Configuring the SonicWall Router

Login to your SonicWall router admin and make the following adjustments to the VPN settings.
  1. Click on the VPN link and note the Unique Firewall Identifier for your SonicWall router. You will need it later for the value sonicwall.unique.identifier.
    SonicWall VPN Settings
  2. Under VPN Policies, create or edit the ‘GroupVPN’ policy.
  3. Click on the General tab and set the following:
    SonicWall VPN General Settings
    • IPSec Keying Mode: IKE using Preshared Secret
    • Shared Secret: shared.secret.key (enter your secret key here)
    • Click on the Proposals tab and set the following:
      SonicWall VPN Proposals Settings
      • IKE (Phase 1) Proposal
        DH Group: Group 5
        Encryption: 3DES
        Authentication: SHA1
      • Ipsec (Phase 2) Proposal
        Protocol: ESP
        Encryption: 3DES
        Authentication: SHA1
      • Enable Perfect Forward Secrecy (checked)
        DH Group: Group 5

    Installing Openswan

    If you are using Ubuntu, open a terminal window and type in:
    sudo apt-get install openswan
    The install will ask you a few questions about how you want to set it up. Select the suggested default for each step. This will install Openswan and create the ipsec.conf and ipsec.secrets configuration files.

    Configuring Openswan

    Add the following connection parameters to your /etc/ipsec.conf file:
    conn sonicwall
         type=tunnel
         left=192.168.2.31 #your IP
         leftid=@home
         leftxauthclient=yes
         right=xxx.xxx.xxx.xxx #IP address of your sonicwall router
         rightsubnet=192.168.1.0/24 #gateway IP for your LAN. This will work for most
         rightxauthserver=yes
         rightid=@sonicwall.unique.identifier
         keyingtries=0
         pfs=yes
         aggrmode=yes
         auto=add
         auth=esp
         esp=3DES-SHA1
         ike=3DES-SHA1
         authby=secret
         #xauth=yes
    Update: After upgrading to Ubuntu 9.10 a few things changed in the conf file. First, I had to comment out ‘xauth=yes’ as it was throwing an error. Second, I had to use my own static IP instead of %defaultroute. If you are using DHCP, %defaultroute may still work, but I have a static IP and had to change this.
    Add the following line to your /etc/ipsec.secrets file
    @home @sonicwall.unique.identifer : PSK "shared.secret.key"

    Starting and stopping the VPN connection

    Starting ipsec and opening the VPN connection
    sudo ipsec setup ––start
    sudo ipsec auto ––add sonicwall (note: if you change the configuration files, you'll need to run 'sudo ipsec auto ––replace sonicwall' to reload the file)
    sudo ipsec whack ––name sonicwall ––initiate

    Closing the VPN connection and stopping ipsec
    sudo ipsec whack ––name sonicwall ––terminate
    sudo ipsec setup ––stop

    References

    The following links were useful for getting the VPN connection up and running on Ubuntu Linux:
    Openswan wiki page for SonicWall routers:
    http://wiki.openswan.org/index.php/Openswan/SonicWall
    SonicWall PDF instructions for using Agressive Mode and IKE with Pre-shared Keys
    http://www.sonicwall.com/downloads/SonicOS_Enhanced_to_Openswan_Using_Aggressive_Mode_IKE_with_PreShared_key.pdf

    Learn UNIX in 10 minutes

    Directories:

    File and directory paths in UNIX use the forward slash "/"
    to separate directory names in a path.

    examples:

    / "root" directory
    /usr directory usr (sub-directory of / "root" directory)
    /usr/STRIM100 STRIM100 is a subdirectory of /usr

    Moving around the file system:

    pwd Show the "present working directory", or current directory.
    cd Change current directory to your HOME directory.
    cd /usr/STRIM100 Change current directory to /usr/STRIM100.
    cd INIT Change current directory to INIT which is a sub-directory of the current
    directory.
    cd .. Change current directory to the parent directory of the current directory.
    cd $STRMWORK Change current directory to the directory defined by the environment
    variable 'STRMWORK'.
    cd ~bob Change the current directory to the user bob's home directory (if you have permission).

    Listing directory contents:

    ls list a directory
    ls -l list a directory in long ( detailed ) format

    for example:
    $ ls -l
    drwxr-xr-x 4 cliff user 1024 Jun 18 09:40 WAITRON_EARNINGS
    -rw-r--r-- 1 cliff user 767392 Jun 6 14:28 scanlib.tar.gz
    ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
    | | | | | | | | | | |
    | | | | | owner group size date time name
    | | | | number of links to file or directory contents
    | | | permissions for world
    | | permissions for members of group
    | permissions for owner of file: r = read, w = write, x = execute -=no permission
    type of file: - = normal file, d=directory, l = symbolic link, and others...

    ls -a List the current directory including hidden files. Hidden files start
    with "."
    ls -ld * List all the file and directory names in the current directory using
    long format. Without the "d" option, ls would list the contents
    of any sub-directory of the current. With the "d" option, ls
    just lists them like regular files.

    Changing file permissions and attributes

    chmod 755 file Changes the permissions of file to be rwx for the owner, and rx for
    the group and the world. (7 = rwx = 111 binary. 5 = r-x = 101 binary)
    chgrp user file Makes file belong to the group user.
    chown cliff file Makes cliff the owner of file.
    chown -R cliff dir Makes cliff the owner of dir and everything in its directory tree.

    You must be the owner of the file/directory or be root before you can do any of these things.

    Moving, renaming, and copying files:

    cp file1 file2 copy a file
    mv file1 newname move or rename a file
    mv file1 ~/AAA/ move file1 into sub-directory AAA in your home directory.
    rm file1 [file2 ...] remove or delete a file
    rm -r dir1 [dir2...] recursivly remove a directory and its contents BE CAREFUL!
    mkdir dir1 [dir2...] create directories
    mkdir -p dirpath create the directory dirpath, including all implied directories in the path.
    rmdir dir1 [dir2...] remove an empty directory

    Viewing and editing files:

    cat filename Dump a file to the screen in ascii.
    more filename Progressively dump a file to the screen: ENTER = one line down
    SPACEBAR = page down q=quit
    less filename Like more, but you can use Page-Up too. Not on all systems.
    vi filename Edit a file using the vi editor. All UNIX systems will have vi in some form.
    emacs filename Edit a file using the emacs editor. Not all systems will have emacs.
    head filename Show the first few lines of a file.
    head -n filename Show the first n lines of a file.
    tail filename Show the last few lines of a file.
    tail -n filename Show the last n lines of a file.


    Shells

    The behavior of the command line interface will differ slightly depending
    on the shell program that is being used.

    Depending on the shell used, some extra behaviors can be quite nifty.

    You can find out what shell you are using by the command:

    echo $SHELL

    Of course you can create a file with a list of shell commands and execute it like
    a program to perform a task. This is called a shell script. This is in fact the
    primary purpose of most shells, not the interactive command line behavior.

    Environment variables

    You can teach your shell to remember things for later using environment variables.
    For example under the bash shell:

    export CASROOT=/usr/local/CAS3.0 Defines the variable CASROOT with the value
    /usr/local/CAS3.0.
    export LD_LIBRARY_PATH=$CASROOT/Linux/lib Defines the variable LD_LIBRARY_PATH with
    the value of CASROOT with /Linux/lib appended,
    or /usr/local/CAS3.0/Linux/lib

    By prefixing $ to the variable name, you can evaluate it in any command:

    cd $CASROOT Changes your present working directory to the value of CASROOT

    echo $CASROOT Prints out the value of CASROOT, or /usr/local/CAS3.0
    printenv CASROOT Does the same thing in bash and some other shells.


    Interactive History

    A feature of bash and tcsh (and sometimes others) you can use
    the up-arrow keys to access your previous commands, edit
    them, and re-execute them.

    Filename Completion

    A feature of bash and tcsh (and possibly others) you can use the
    TAB key to complete a partially typed filename. For example if you
    have a file called constantine-monks-and-willy-wonka.txt in your
    directory and want to edit it you can type 'vi const', hit the TAB key,
    and the shell will fill in the rest of the name for you (provided the
    completion is unique).

    Bash is the way cool shell.

    Bash will even complete the name of commands and environment variables.
    And if there are multiple completions, if you hit TAB twice bash will show
    you all the completions. Bash is the default user shell for most Linux systems.


    Redirection:

    grep string filename > newfile Redirects the output of the above grep
    command to a file 'newfile'.
    grep string filename >> existfile Appends the output of the grep command
    to the end of 'existfile'.

    The redirection directives, > and >> can be used on the output of most commands
    to direct their output to a file.

    Pipes:


    The pipe symbol "|" is used to direct the output of one command to the input
    of another.

    For example:

    ls -l | more This commands takes the output of the long format directory list command
    "ls -l" and pipes it through the more command (also known as a filter).
    In this case a very long list of files can be viewed a page at a time.

    du -sc * | sort -n | tail
    The command "du -sc" lists the sizes of all files and directories in the
    current working directory. That is piped through "sort -n" which orders the
    output from smallest to largest size. Finally, that output is piped through "tail"
    which displays only the last few (which just happen to be the largest) results.

    Command Substitution

    You can use the output of one command as an input to another command in another way
    called command substitution. Command substitution is invoked when by enclosing the
    substituted command in backwards single quotes. For example:

    cat `find . -name aaa.txt`

    which will cat ( dump to the screen ) all the files named aaa.txt that exist in the current
    directory or in any subdirectory tree.

    Searching for strings in files: The grep command

    grep string filename prints all the lines in a file that contain the string

    Searching for files : The find command


    find search_path -name filename

    find . -name aaa.txt Finds all the files named aaa.txt in the current directory or
    any subdirectory tree.
    find / -name vimrc Find all the files named 'vimrc' anywhere on the system.
    find /usr/local/games -name "*xpilot*"
    Find all files whose names contain the string 'xpilot' which
    exist within the '/usr/local/games' directory tree.

    Reading and writing tapes, backups, and archives: The tar command

    The tar command stands for "tape archive". It is the "standard" way to read
    and write archives (collections of files and whole directory trees).

    Often you will find archives of stuff with names like stuff.tar, or stuff.tar.gz. This
    is stuff in a tar archive, and stuff in a tar archive which has been compressed using the
    gzip compression program respectivly.

    Chances are that if someone gives you a tape written on a UNIX system, it will be in tar format,
    and you will use tar (and your tape drive) to read it.

    Likewise, if you want to write a tape to give to someone else, you should probably use
    tar as well.

    Tar examples:

    tar xv Extracts (x) files from the default tape drive while listing (v = verbose)
    the file names to the screen.
    tar tv Lists the files from the default tape device without extracting them.
    tar cv file1 file2
    Write files 'file1' and 'file2' to the default tape device.
    tar cvf archive.tar file1 [file2...]
    Create a tar archive as a file "archive.tar" containing file1,
    file2...etc.
    tar xvf archive.tar extract from the archive file
    tar cvfz archive.tar.gz dname
    Create a gzip compressed tar archive containing everything in the directory
    'dname'. This does not work with all versions of tar.
    tar xvfz archive.tar.gz
    Extract a gzip compressed tar archive. Does not work with all versions of tar.
    tar cvfI archive.tar.bz2 dname
    Create a bz2 compressed tar archive. Does not work with all versions of tar


    File compression: compress, gzip, and bzip2

    The standard UNIX compression commands are compress and uncompress. Compressed files have
    a suffix .Z added to their name. For example:

    compress part.igs Creates a compressed file part.igs.Z

    uncompress part.igs Uncompresseis part.igs from the compressed file part.igs.Z.
    Note the .Z is not required.

    Another common compression utility is gzip (and gunzip). These are the GNU compress and
    uncompress utilities. gzip usually gives better compression than standard compress,
    but may not be installed on all systems. The suffix for gzipped files is .gz

    gzip part.igs Creates a compressed file part.igs.gz
    gunzip part.igs Extracts the original file from part.igs.gz

    The bzip2 utility has (in general) even better compression than gzip, but at the cost of longer
    times to compress and uncompress the files. It is not as common a utility as gzip, but is
    becoming more generally available.

    bzip2 part.igs Create a compressed Iges file part.igs.bz2
    bunzip2 part.igs.bz2 Uncompress the compressed iges file.


    Looking for help: The man and apropos commands

    Most of the commands have a manual page which give sometimes useful, often more or less
    detailed, sometimes cryptic and unfathomable discriptions of their usage. Some say they
    are called man pages because they are only for real men.

    Example:

    man ls Shows the manual page for the ls command

    You can search through the man pages using apropos

    Example:

    apropos build Shows a list of all the man pages whose discriptions contain the word "build"

    Do a man apropos for detailed help on apropos.


    Basics of the vi editor

    Opening a file
    vi filename

    Creating text
    Edit modes: These keys enter editing modes and type in the text
    of your document.

    i Insert before current cursor position
    I Insert at beginning of current line
    a Insert (append) after current cursor position
    A Append to end of line
    r Replace 1 character
    R Replace mode
    Terminate insertion or overwrite mode

    Deletion of text

    x Delete single character
    dd Delete current line and put in buffer
    ndd Delete n lines (n is a number) and put them in buffer
    J Attaches the next line to the end of the current line (deletes carriage return).

    Oops

    u Undo last command

    cut and paste
    yy Yank current line into buffer
    nyy Yank n lines into buffer
    p Put the contents of the buffer after the current line
    P Put the contents of the buffer before the current line

    cursor positioning
    ^d Page down
    ^u Page up
    :n Position cursor at line n
    :$ Position cursor at end of file
    ^g Display current line number
    h,j,k,l Left,Down,Up, and Right respectivly. Your arrow keys should also work if
    if your keyboard mappings are anywhere near sane.

    string substitution

    :n1,n2:s/string1/string2/[g] Substitute string2 for string1 on lines
    n1 to n2. If g is included (meaning global),
    all instances of string1 on each line
    are substituted. If g is not included,
    only the first instance per matching line is
    substituted.

    ^ matches start of line
    . matches any single character
    $ matches end of line

    These and other "special characters" (like the forward slash) can be "escaped" with \
    i.e to match the string "/usr/STRIM100/SOFT" say "\/usr\/STRIM100\/SOFT"

    Examples:

    :1,$:s/dog/cat/g Substitute 'cat' for 'dog', every instance
    for the entire file - lines 1 to $ (end of file)

    :23,25:/frog/bird/ Substitute 'bird' for 'frog' on lines
    23 through 25. Only the first instance
    on each line is substituted.


    Saving and quitting and other "ex" commands

    These commands are all prefixed by pressing colon (:) and then entered in the lower
    left corner of the window. They are called "ex" commands because they are commands
    of the ex text editor - the precursor line editor to the screen editor
    vi. You cannot enter an "ex" command when you are in an edit mode (typing text onto the screen)
    Press to exit from an editing mode.

    :w Write the current file.
    :w new.file Write the file to the name 'new.file'.
    :w! existing.file Overwrite an existing file with the file currently being edited.
    :wq Write the file and quit.
    :q Quit.
    :q! Quit with no changes.

    :e filename Open the file 'filename' for editing.

    :set number Turns on line numbering
    :set nonumber Turns off line numbering

    CmdLine



    CommandDescription
    •apropos whatisShow commands pertinent to string. See also threadsafe
    •man -t man | ps2pdf - > man.pdfmake a pdf of a manual page
    which commandShow full path name of command
    time commandSee how long a command takes
    •time catStart stopwatch. Ctrl-d to stop. See also sw
    dir navigation
    •cd -Go to previous directory
    •cdGo to $HOME directory
    (cd dir && command)Go to dir, execute command and return to current dir
    •pushd .Put current dir on stack so you can popd back to it
    •alias l='ls -l --color=auto'quick dir listing
    •ls -lrtList files by date. See also newest and find_mm_yyyy
    •ls /usr/bin | pr -T9 -W$COLUMNSPrint in 9 columns to width of terminal
    find -name '*.[ch]' | xargs grep -E 'expr'Search 'expr' in this dir and below. See also findrepo
    find -type f -print0 | xargs -r0 grep -F 'example'Search all regular files for 'example' in this dir and below
    find -maxdepth 1 -type f | xargs grep -F 'example'Search all regular files for 'example' in this dir
    find -maxdepth 1 -type d | while read dir; do echo $dir; echo cmd2; doneProcess each item with multiple commands (in while loop)
    •find -type f ! -perm -444Find files not readable by all (useful for web site)
    •find -type d ! -perm -111Find dirs not accessible by all (useful for web site)
    •locate -r 'file[^/]*\.txt'Search cached index for names. This re is like glob *file*.txt
    •look referenceQuickly search (sorted) dictionary for prefix
    •grep --color reference /usr/share/dict/wordsHighlight occurances of regular expression in dictionary
    archives and compression
    gpg -c fileEncrypt file
    gpg file.gpgDecrypt file
    tar -c dir/ | bzip2 > dir.tar.bz2Make compressed archive of dir/
    bzip2 -dc dir.tar.bz2 | tar -xExtract archive (use gzip instead of bzip2 for tar.gz files)
    tar -c dir/ | gzip | gpg -c | ssh user@remote 'dd of=dir.tar.gz.gpg'Make encrypted archive of dir/ on remote machine
    find dir/ -name '*.txt' | tar -c --files-from=- | bzip2 > dir_txt.tar.bz2Make archive of subset of dir/ and below
    find dir/ -name '*.txt' | xargs cp -a --target-directory=dir_txt/ --parentsMake copy of subset of dir/ and below
    ( tar -c /dir/to/copy ) | ( cd /where/to/ && tar -x -p )Copy (with permissions) copy/ dir to /where/to/ dir
    ( cd /dir/to/copy && tar -c . ) | ( cd /where/to/ && tar -x -p )Copy (with permissions) contents of copy/ dir to /where/to/
    ( tar -c /dir/to/copy ) | ssh -C user@remote 'cd /where/to/ && tar -x -p'Copy (with permissions) copy/ dir to remote:/where/to/ dir
    dd bs=1M if=/dev/sda | gzip | ssh user@remote 'dd of=sda.gz'Backup harddisk to remote machine
    rsync (Network efficient file copier: Use the --dry-run option for testing)
    rsync -P rsync://rsync.server.com/path/to/file fileOnly get diffs. Do multiple times for troublesome downloads
    rsync --bwlimit=1000 fromfile tofileLocally copy with rate limit. It's like nice for I/O
    rsync -az -e ssh --delete ~/public_html/ remote.com:'~/public_html'Mirror web site (using compression and encryption)
    rsync -auz -e ssh remote:/dir/ . && rsync -auz -e ssh . remote:/dir/Synchronize current directory with remote one
    ssh (Secure SHell)
    ssh $USER@$HOST commandRun command on $HOST as $USER (default command=shell)
    •ssh -f -Y $USER@$HOSTNAME xeyesRun GUI command on $HOSTNAME as $USER
    scp -p -r $USER@$HOST: file dir/Copy with permissions to $USER's home directory on $HOST
    ssh -g -L 8080:localhost:80 root@$HOSTForward connections to $HOSTNAME:8080 out to $HOST:80
    ssh -R 1434:imap:143 root@$HOSTForward connections from $HOST:1434 in to imap:143
    ssh-copy-id $USER@$HOSTInstall $USER's public key on $HOST for password-less log in
    wget (multi purpose download tool)
    •(cd dir/ && wget -nd -pHEKk http://www.pixelbeat.org/cmdline.html)Store local browsable version of a page to the current dir
    wget -c http://www.example.com/large.fileContinue downloading a partially downloaded file
    wget -r -nd -np -l1 -A '*.jpg' http://www.example.com/dir/Download a set of files to the current directory
    wget ftp://remote/file[1-9].iso/FTP supports globbing directly
    •wget -q -O- http://www.pixelbeat.org/timeline.html | grep 'a href' | headProcess output directly
    echo 'wget url' | at 01:00Download url at 1AM to current dir
    wget --limit-rate=20k urlDo a low priority download (limit to 20KB/s in this case)
    wget -nv --spider --force-html -i bookmarks.htmlCheck links in a file
    wget --mirror http://www.example.com/Efficiently update a local copy of a site (handy from cron)
    networking (Note ifconfig, route, mii-tool, nslookup commands are obsolete)
    ethtool eth0Show status of ethernet interface eth0
    ethtool --change eth0 autoneg off speed 100 duplex fullManually set ethernet interface speed
    iwconfig eth1Show status of wireless interface eth1
    iwconfig eth1 rate 1Mb/s fixedManually set wireless interface speed
    •iwlist scanList wireless networks in range
    •ip link showList network interfaces
    ip link set dev eth0 name wanRename interface eth0 to wan
    ip link set dev eth0 upBring interface eth0 up (or down)
    •ip addr showList addresses for interfaces
    ip addr add 1.2.3.4/24 brd + dev eth0Add (or del) ip and mask (255.255.255.0)
    •ip route showList routing table
    ip route add default via 1.2.3.254Set default gateway to 1.2.3.254
    •host pixelbeat.orgLookup DNS ip address for name or vice versa
    •hostname -iLookup local ip address (equivalent to host `hostname`)
    •whois pixelbeat.orgLookup whois info for hostname or ip address
    •netstat -tuplList internet services on a system
    •netstat -tupList active connections to/from system
    windows networking (Note samba is the package that provides all this windows specific networking support)
    •smbtreeFind windows machines. See also findsmb
    nmblookup -A 1.2.3.4Find the windows (netbios) name associated with ip address
    smbclient -L windows_boxList shares on windows machine or samba server
    mount -t smbfs -o fmask=666,guest //windows_box/share /mnt/shareMount a windows share
    echo 'message' | smbclient -M windows_boxSend popup to windows machine (off by default in XP sp2)
    text manipulation (Note sed uses stdin and stdout. Newer versions support inplace editing with the -i option)
    sed 's/string1/string2/g'Replace string1 with string2
    sed 's/\(.*\)1/\12/g'Modify anystring1 to anystring2
    sed '/ *#/d; /^ *$/d'Remove comments and blank lines
    sed ':a; /\\$/N; s/\\\n//; ta'Concatenate lines with trailing \
    sed 's/[ \t]*$//'Remove trailing spaces from lines
    sed 's/\([`"$\]\)/\\\1/g'Escape shell metacharacters active within double quotes
    •seq 10 | sed "s/^/      /; s/ *\(.\{7,\}\)/\1/"Right align numbers
    sed -n '1000{p;q}'Print 1000th line
    sed -n '10,20p;20q'Print lines 10 to 20
    sed -n 's/.*T;q'Extract title from HTML web page
    sed -i 42d ~/.ssh/known_hostsDelete a particular line
    sort -t. -k1,1n -k2,2n -k3,3n -k4,4nSort IPV4 ip addresses
    •echo 'Test' | tr '[:lower:]' '[:upper:]'Case conversion
    •tr -dc '[:print:]' < /dev/urandomFilter non printable characters
    •tr -s '[:blank:]' '\t' cut fields separated by blanks
    •history | wc -lCount lines
    set operations (Note you can export LANG=C for speed. Also these assume no duplicate lines within a file)
    sort file1 file2 | uniqUnion of unsorted files
    sort file1 file2 | uniq -dIntersection of unsorted files
    sort file1 file1 file2 | uniq -uDifference of unsorted files
    sort file1 file2 | uniq -uSymmetric Difference of unsorted files
    join -t'\0' -a1 -a2 file1 file2Union of sorted files
    join -t'\0' file1 file2Intersection of sorted files
    join -t'\0' -v2 file1 file2Difference of sorted files
    join -t'\0' -v1 -v2 file1 file2Symmetric Difference of sorted files
    math
    •echo '(1 + sqrt(5))/2' | bc -lQuick math (Calculate φ). See also bc
    •echo 'pad=20; min=64; (100*10^6)/((pad+min)*8)' | bcMore complex (int) e.g. This shows max FastE packet rate
    •echo 'pad=20; min=64; print (100E6)/((pad+min)*8)' | pythonPython handles scientific notation
    •echo 'pad=20; plot [64:1518] (100*10**6)/((pad+x)*8)' | gnuplot -persistPlot FastE packet rate vs packet size
    •echo 'obase=16; ibase=10; 64206' | bcBase conversion (decimal to hexadecimal)
    •echo $((0x2dec))Base conversion (hex to dec) ((shell arithmetic expansion))
    •units -t '100m/9.58s' 'miles/hour'Unit conversion (metric to imperial)
    •units -t '500GB' 'GiB'Unit conversion (SI to IEC prefixes)
    •units -t '1 googol'Definition lookup
    •seq 100 | (tr '\n' +; echo 0) | bcAdd a column of numbers. See also add and funcpy
    calendar
    •cal -3Display a calendar
    •cal 9 1752Display a calendar for a particular month year
    •date -d friWhat date is it this friday. See also day
    •[ $(date -d "tomorrow" +%d) = "01" ] || exitexit a script unless it's the last day of the month
    •date --date='25 Dec' +%AWhat day does xmas fall on, this year
    •date --date='@2147483647'Convert seconds since the epoch (1970-01-01 UTC) to date
    •TZ='America/Los_Angeles' dateWhat time is it on west coast of US (use tzselect to find TZ)
    •date --date='TZ="America/Los_Angeles" 09:00 next Fri'What's the local time for 9AM next Friday on west coast US
    locales
    •printf "%'d\n" 1234Print number with thousands grouping appropriate to locale
    •BLOCK_SIZE=\'1 ls -lUse locale thousands grouping in ls. See also l
    •echo "I live in `locale territory`"Extract info from locale database
    •LANG=en_IE.utf8 locale int_prefixLookup locale info for specific country. See also ccodes
    •locale | cut -d= -f1 | xargs locale -kc | lessList fields available in locale database
    recode (Obsoletes iconv, dos2unix, unix2dos)
    •recode -l | lessShow available conversions (aliases on each line)
    recode windows-1252.. file_to_change.txtWindows "ansi" to local charset (auto does CRLF conversion)
    recode utf-8/CRLF.. file_to_change.txtWindows utf8 to local charset
    recode iso-8859-15..utf8 file_to_change.txtLatin9 (western europe) to utf8
    recode ../b64 < file.txt > file.b64Base64 encode
    recode /qp.. < file.qp > file.txtQuoted printable decode
    recode ..HTML < file.txt > file.htmlText to HTML
    •recode -lf windows-1252 | grep euroLookup table of characters
    •echo -n 0x80 | recode latin-9/x1..dumpShow what a code represents in latin-9 charmap
    •echo -n 0x20AC | recode ucs-2/x2..latin-9/xShow latin-9 encoding
    •echo -n 0x20AC | recode ucs-2/x2..utf-8/xShow utf-8 encoding
    CDs
    gzip < /dev/cdrom > cdrom.iso.gzSave copy of data cdrom
    mkisofs -V LABEL -r dir | gzip > cdrom.iso.gzCreate cdrom image from contents of dir
    mount -o loop cdrom.iso /mnt/dirMount the cdrom image at /mnt/dir (read only)
    cdrecord -v dev=/dev/cdrom blank=fastClear a CDRW
    gzip -dc cdrom.iso.gz | cdrecord -v dev=/dev/cdrom -Burn cdrom image (use dev=ATAPI -scanbus to confirm dev)
    cdparanoia -BRip audio tracks from CD to wav files in current dir
    cdrecord -v dev=/dev/cdrom -audio -pad *.wavMake audio CD from all wavs in current dir (see also cdrdao)
    oggenc --tracknum='track' track.cdda.wav -o 'track.ogg'Make ogg file from wav file
    disk space (See also FSlint)
    •ls -lSrShow files by size, biggest last
    •du -s * | sort -k1,1rn | headShow top disk users in current dir. See also dutop
    •du -hs /home/* | sort -k1,1hSort paths by easy to interpret disk usage
    •df -hShow free space on mounted filesystems
    •df -iShow free inodes on mounted filesystems
    •fdisk -lShow disks partitions sizes and types (run as root)
    •rpm -q -a --qf '%10{SIZE}\t%{NAME}\n' | sort -k1,1nList all packages by installed size (Bytes) on rpm distros
    •dpkg-query -W -f='${Installed-Size;10}\t${Package}\n' | sort -k1,1nList all packages by installed size (KBytes) on deb distros
    •dd bs=1 seek=2TB if=/dev/null of=ext3.testCreate a large test file (taking no space). See also truncate
    •> filetruncate data of file or create an empty file
    monitoring/debugging
    •tail -f /var/log/messagesMonitor messages in a log file
    •strace -c ls >/dev/nullSummarise/profile system calls made by command
    •strace -f -e open ls >/dev/nullList system calls made by command
    •ltrace -f -e getenv ls >/dev/nullList library calls made by command
    •lsof -p $$List paths that process id has open
    •lsof ~List processes that have specified path open
    •tcpdump not port 22Show network traffic except ssh. See also tcpdump_not_me
    •ps -e -o pid,args --forestList processes in a hierarchy
    •ps -e -o pcpu,cpu,nice,state,cputime,args --sort pcpu | sed '/^ 0.0 /d'List processes by % cpu usage
    •ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNSList processes by mem (KB) usage. See also ps_mem.py
    •ps -C firefox-bin -L -o pid,tid,pcpu,stateList all threads for a particular process
    •ps -p 1,2List info for particular process IDs
    •last rebootShow system reboot history
    •free -mShow amount of (remaining) RAM (-m displays in MB)
    •watch -n.1 'cat /proc/interrupts'Watch changeable data continuously
    •udevadm monitorMonitor udev events to help configure rules
    system information (see also sysinfo) ('#' means root access is required)
    •uname -aShow kernel version and system architecture
    •head -n1 /etc/issueShow name and version of distribution
    •cat /proc/partitionsShow all partitions registered on the system
    •grep MemTotal /proc/meminfoShow RAM total seen by the system
    •grep "model name" /proc/cpuinfoShow CPU(s) info
    •lspci -tvShow PCI info
    •lsusb -tvShow USB info
    •mount | column -tList mounted filesystems on the system (and align output)
    •grep -F capacity: /proc/acpi/battery/BAT0/infoShow state of cells in laptop battery
    #dmidecode -q | lessDisplay SMBIOS/DMI information
    #smartctl -A /dev/sda | grep Power_On_HoursHow long has this disk (system) been powered on in total
    #hdparm -i /dev/sdaShow info about disk sda
    #hdparm -tT /dev/sdaDo a read speed test on disk sda
    #badblocks -s /dev/sdaTest for unreadable blocks on disk sda
    interactive (see also linux keyboard shortcuts)
    •readlineLine editor used by bash, python, bc, gnuplot, ...
    •screenVirtual terminals with detach capability, ...
    •mcPowerful file manager that can browse rpm, tar, ftp, ssh, ...
    •gnuplotInteractive/scriptable graphing
    •linksWeb browser
    •xdg-open .open a file or url with the registered desktop application