blog.mirabellette.eu

A blog about digital independence and autonomy

System administration

Why and when install a custom Android distribution?

Written by Mirabellette / 04 september 2018 / no comments

Hello guys,

Sorry for the little delay but I was not sure about what I wanted to write for the month of September.

android_logo

Introduction

Today, I would like to talk about operating system for mobile and especially those based on Android. For those who do not know, Android is an open-source operating system and each manufacturer may customise it with features or tweaks. A customise Android operating system is called a distribution. I do not know the IOS environment that is why I will not talk about it here.

A little lexicon below:

  • IOS: Iphone operating system
  • FAD: Factory Android Distributions
  • CAD: Custom Android Distributions
  • Why and when install a custom Android distribution?

    The issues with the Factory Android Distribution (FAD)

    manufacturers make a lot of work to provide a good mobile phone. However, they are motivated by money contrary to the users who are motivated by good experience and good products.

    Firstly, the most important issue is about updates. Android mobile phone tends to be in general updated for only two years. After this period, your smartphone will not be updated anymore. That means it will contain known vulnerabilities without any possibility to fix it.

    As your phone has very sensitive features (GPS, microphone, camera, sensitive personal data). A mobile phone compromise could create a lot of issues. For example, the GPS could be used in an abusive way. An example with the recent vulnerability published the 29th of August.

    You can find below the list of Android system deploy on smartphones.

    android_version_distribution

    You can see in February 2018, there are:

    • Around 10% in Android 4.4 (published in October 31, 2013)
    • Around 25% in Android 5.0-51 (published in November 12, 2014)
    • Around 28% in Android 6.0 (published in October 5, 2015)
    • Around 25% in Android 7.0-7.1 (published in August 22, 2016)

    I do not know if you understand how bad it is. That just means around 90% of the FAD are not up to date and contain known vulnerabilities. Or, if we are less exigent, it is 65% which is obsolete. For me, that just means one thing. Never trust your Android smartphone or the Android smartphone of your friends. IOS (the operating system for Apple phone) is better but not perfect about security update. I do not find the chart but most of the devices are "up to date".

    Secondly, as they are interested mainly by benefits or have to follow government rules. It appears that some device tracks phone calls, contacts, data and phone usage.

    Pros

    • Custom Android Distribution (CAD) generally tends to provide a more recent Android version. That means better security, better performance, better features and better autonomy
    • CAD do not contain manufacturers features and improvements. You are also free not to install Google applications. That means no tracking features.
    • CAD generally add features which are able to improve the management of your cellular phone. That means, for example, have a better tool to manage backup, update or security. They often have features to manage privacy more precisely. Some applications are made by the maintainers and are free to install.
    • I do not know about the other distributions but LineageOS community provides a very good tutorial about how to install it on your smartphone. An example can be found here with the Galaxy S3.

    Cons

    • Replacing the Factory Android Distribution by one of your choices is not easy and required time. You need to understand the different steps of the process and how an Android operating system works in the main line. Contrary to what you could think, you will not develop at all. You also need to do a little analyse about what you will earn and lose and you need to make the required backup. It required me approximately 12 hours to do it and have a mobile phone which was fully operational whereas I had not a lot of knowledge about the process.
    • CAD do not contain manufacturer features and improvement. It could be positive but it could also be negative. You could lose manufacturer tweaks and have worse performance. You will never know before making a try.
    • Most of the time, unlocking the bootloader (which is a step required to replace your Android distribution) will stop the guaranty.
    • Some features may not work properly (high consumption energy, cameras which do not work or even crash sometimes). However, it could be fixed in the next release which is published each week on LineageOS. For example, I was for one month without a front camera and GPS.
    • Less stable than FAD, the mobile phone may crash and have a higher possibility to lose your data when update. Hopefully, you also have a better tool to get it back but it could not work all the time.

    When to replace the factory Android distribution?

    lineageos_logo replicant_logo

    For casual users or users who do not want a lot of issues,
    when your mobile phone is not updated anymore. When you are in this situation, that means your mobile phone is older than 2 years and the CAD should be quite stable. The tutorial should be quite complete. Issues should be known, fixed or with some work around available.

    For expert users and experimental users,
    some months after the manufacturer releases the new phone. It should let to the maintainers the time to develop enough stable version for your phone. In case of issues, you should be able to roll back to the previous release on your own.

    Advice and warning about a mobile phone with CAD

    • Choose a mobile phone quite popular. The most you have people who use it, the most it is probable than a custom Android distribution will support it well. Quite popular does not mean with a lot of hardware backdoors, you have some choices.
    • Do as little as possible with your phone. First of all, because the mobile phone environment is far more dangerous than the desktop environment. Proprietary applications can literally siphon your data, track your location, use your camera, heard around you.

      Even if you are up to date with a recent phone, your mobile phone could be exploited to hear what it is around you, to locate you, to film around you. Secondly, because you use a CAD, it means less stability, you should be ready for it.

    • Each custom Android distribution has his own purpose. Choose carefully the one you will install regarding stability, performance, security and maintainability.

    Conclusion

    You now have some arguments to make your decision.

    Sources

    Social media

    If you find this article interesting, feel free to subscribe to my RSS flux and to follow me on Mastodon. Don't hesitate to share it if you think he could interest someone else.

Examples of script to renew automaticaly web certificates with let's encrypt

Written by Mirabellette / 13 october 2017 / no comments

Hello everyone,

I know it is a very long time that I didn't post any article but life is life. ^^
Today, I wanted to share two scripts I used to renew my web certificates with let's encrypt. I know there is a lot of documentation about that, but it could help some of you to keep some time.

Generation web certificates with a specific domain name

The script browses the given file and ignore the line which begin with # or ----------. These symbols are used in the given file to make the text easier to read. Each line is one of my domains name or sub domains I managed. I just have to add a new one to this list to be sure the certificate of this new domain name will be automatically renewed.

#!/bin/bash
# file : /root/certs/renew-webcert.sh
# Renew all certificates which are in the given file
logFile="/var/log/renew-cert.log"

serverName=$1
while read c ; do
 if [[ ${c} != "#"* ]]; then
  if [[ ${c} != "----------" ]]; then
   echo $c
   echo "/opt/letsencrypt/letsencrypt-auto --apache --renew-by-default -d $c --rsa-key-size 4096 --uir --redirect" | tee -a $logFile
   /opt/letsencrypt/letsencrypt-auto --apache --renew-by-default -d $c --rsa-key-size 4096 --uir --redirect
  fi
 fi
done <$serverName
service apache2 restart
echo "service apache2 restart"


# file : /root/certs/serverName
toto.example.org
#titi.example.org
----------
tata.example.org

To use this one, I create a cron task which run the script each month
0 6 01 * * /root/certs/renew-webcert.sh /root/certs/serverName
Warning : be careful that /root/certs/renew-webcert.sh need to executable (chmod 700)

A single web certificate with multiple domain name

The second one is very similar to the first one. The main difference is that it creates a single certificate with multiple domain name and do not get a domain name from a file given as parameter.

#!/bin/bash
# file : /root/certs/renew-webcert-mirabellette.sh
logFile="/var/log/renew-cert-mirabellette.log"

serverName="server-name-mirabellette"
cmdRenew="/opt/letsencrypt/letsencrypt-auto --apache --rsa-key-size 4096 --uir --redirect"
while read domainName ; do
 if [[ ${domainName} != "#"* ]]; then
  if [[ ${domainName} != "----------" ]]; then
   echo $domainName
   cmdRenew="$cmdRenew -d $domainName"
  fi
 fi
done <$serverName

echo ${cmdRenew}
${cmdRenew}
service apache2 restart
echo "service apache2 restart"


# file : /root/certs/server-name-mirabellette
blog.mirabellette.eu
privatebin.mirabellette.eu
#lufi.mirabellette.eu

To use this one, I create a cron task which run the script each month
0 6 01 * * /root/certs/renew-webcert-mirabellette.sh

Warning : be careful that /root/certs/renew-webcert.sh need to executable (chmod 700)

sources:
I hope this article gave you some ideas to easily manage how to renew your web certificate.

SWAP : Usage and management

Written by Mirabellette / 23 july 2017 / no comments

System: Debian 8 - linux 3.16

Hello everyone,

Usage

Today, I want to talk about the SWAP, and to increase his size, reduce it or configure the system to load it at boot. Before talking about that, I would like to describe briefly what Ram and SWAP are used for. Ram, and in some situation SWAP, are used by processes to work. To understand better, a picture is often a good idea.
Swap
As you can see in the picture from wikipedia, the swap is a space disk used when the ram space is full. It is always slower than the ram (until disk access are faster than ram access, but it is not for tomorrow). The space disk for the swap must have a specific format and has a size. It is common to determine the size to 1,5 x ram. Nevertheless, this value could be very important, especially when you have a big amount of ram. For example, with 16 go of ram, 1,5 x this is 24 go, it is a lot !

Today, unless you have specific usage like using a lot of virtual machine or in a server architecture, it is very rare to use more than 16 go. (Of course, if you have a small amount of ram, this will happen more often). That's why, I recommend you to fix a small size, for example, 0,1 * ram size and to improve it depending of your usage. Of course, if you have many Giga octet free, you could increase this size, but if you never use it, it is a waste of space disk.

Management

The swap file could be stored in a specific partition. To keep this article as simple as possible, we will not talk about this case. To begin with, we have to determine how much ram and swap do we have ? We can use the top command to know that.

In my case, I have ~= 2go (2009380) of ram and I have decided to fix the swap to ~= 512 mo (524284). Ram and Swap usage
Let's guess that 512 mo is not enough and we would like to increase the size to 1go. To do that, we have to follow this procedure:
  • identify where is the swap file and his size
    swapon -s
  • Swap location and size
  • deallocate the swap
    swapoff /swap
  • delete the previous swapp file
    rm /swap
  • create a new file with specific size
    dd if=/dev/zero of=/pathToTheNewSwap bs=1024 count=1M
    *if you want 512 mo, replace 1M by 512k
  • format the new file to a swap format
    mkswap /pathToTheNewSwap
  • configure the system to use the new swap as swap
    swapon /pathToTheNewSwap
  • configure the system to load it at each boot, you have to delete the line about the previous swap file and add a line for the new one.
    vi /etc/fstab
    /pathToTheNewSwap swap swap sw 0 0
Now, you must have 1go of swap displayed when you launch top and you must see /pathToTheNewSwap as swap file when you do swapon -s

I hope this article help you to understand how is used the swap and how to manage it. Do not hesitate to comment the article.

sources: