+
+
+
+
+
+
+
+
+
+```
+
+### 7.2 - CSS
+
+Add a new file, `/public/styles.css`, with some custom UI styling.
+
+```
+body { font-family: 'EB Garamond', serif; }
+
+.mui-textfield > input, .mui-btn, .mui--text-subhead, .mui-panel > .mui--text-headline {
+ font-family: 'Open Sans', sans-serif;
+}
+
+.all-caps { text-transform: uppercase; }
+.app-container { padding: 16px; }
+.search-results em { font-weight: bold; }
+.book-modal > button { width: 100%; }
+.search-results .mui-divider { margin: 14px 0; }
+
+.search-results {
+ display: flex;
+ flex-direction: row;
+ flex-wrap: wrap;
+ justify-content: space-around;
+}
+
+.search-results > div {
+ flex-basis: 45%;
+ box-sizing: border-box;
+ cursor: pointer;
+}
+
+@media (max-width: 600px) {
+ .search-results > div { flex-basis: 100%; }
+}
+
+.paragraphs-container {
+ max-width: 800px;
+ margin: 0 auto;
+ margin-bottom: 48px;
+}
+
+.paragraphs-container .mui--text-body1, .paragraphs-container .mui--text-body2 {
+ font-size: 1.8rem;
+ line-height: 35px;
+}
+
+.book-modal {
+ width: 100%;
+ height: 100%;
+ padding: 40px 10%;
+ box-sizing: border-box;
+ margin: 0 auto;
+ background-color: white;
+ overflow-y: scroll;
+ position: fixed;
+ top: 0;
+ left: 0;
+}
+
+.pagination-panel {
+ display: flex;
+ justify-content: space-between;
+}
+
+.title-row {
+ display: flex;
+ justify-content: space-between;
+ align-items: flex-end;
+}
+
+@media (max-width: 600px) {
+ .title-row{
+ flex-direction: column;
+ text-align: center;
+ align-items: center
+ }
+}
+
+.locations-label {
+ text-align: center;
+ margin: 8px;
+}
+
+.modal-footer {
+ position: fixed;
+ bottom: 0;
+ left: 0;
+ width: 100%;
+ display: flex;
+ justify-content: space-around;
+ background: white;
+}
+
+```
+
+### 7.3 - Try it out
+
+Open `localhost:8080` in your web browser, you should see a simple search interface with paginated results. Try typing in the top search bar to find matches from different terms.
+
+
+
+> You _do not_ have to re-run the `docker-compose up` command for the changes to take effect. The local `public` directory is mounted to our Nginx fileserver container, so frontend changes on the local system will be automatically reflected in the containerized app.
+
+If you try clicking on any result, nothing happens - we still have one more feature to add to the app.
+
+### 8 - PAGE PREVIEWS
+
+It would be nice to be able to click on each search result and view it in the context of the book that it's from.
+
+### 8.0 - Add Elasticsearch Query
+
+First, we'll need to define a simple query to get a range of paragraphs from a given book.
+
+Add the following function to the `module.exports` block in `server/search.js`.
+
+```
+/** Get the specified range of paragraphs from a book */
+getParagraphs (bookTitle, startLocation, endLocation) {
+ const filter = [
+ { term: { title: bookTitle } },
+ { range: { location: { gte: startLocation, lte: endLocation } } }
+ ]
+
+ const body = {
+ size: endLocation - startLocation,
+ sort: { location: 'asc' },
+ query: { bool: { filter } }
+ }
+
+ return client.search({ index, type, body })
+}
+
+```
+
+This new function will return an ordered array of paragraphs between the start and end locations of a given book.
+
+### 8.1 - Add API Endpoint
+
+Now, let's link this function to an API endpoint.
+
+Add the following to `server/app.js`, below the original `/search` endpoint.
+
+```
+/**
+ * GET /paragraphs
+ * Get a range of paragraphs from the specified book
+ * Query Params -
+ * bookTitle: string under 256 characters
+ * start: positive integer
+ * end: positive integer greater than start
+ */
+router.get('/paragraphs',
+ validate({
+ query: {
+ bookTitle: joi.string().max(256).required(),
+ start: joi.number().integer().min(0).default(0),
+ end: joi.number().integer().greater(joi.ref('start')).default(10)
+ }
+ }),
+ async (ctx, next) => {
+ const { bookTitle, start, end } = ctx.request.query
+ ctx.body = await search.getParagraphs(bookTitle, start, end)
+ }
+)
+
+```
+
+### 8.2 - Add UI functionality
+
+Now that our new endpoint is in place, let's add some frontend functionality to query and display full pages from the book.
+
+Add the following functions to the `methods` block of `/public/app.js`.
+
+```
+ /** Call the API to get current page of paragraphs */
+ async getParagraphs (bookTitle, offset) {
+ try {
+ this.bookOffset = offset
+ const start = this.bookOffset
+ const end = this.bookOffset + 10
+ const response = await axios.get(`${this.baseUrl}/paragraphs`, { params: { bookTitle, start, end } })
+ return response.data.hits.hits
+ } catch (err) {
+ console.error(err)
+ }
+ },
+ /** Get next page (next 10 paragraphs) of selected book */
+ async nextBookPage () {
+ this.$refs.bookModal.scrollTop = 0
+ this.paragraphs = await this.getParagraphs(this.selectedParagraph._source.title, this.bookOffset + 10)
+ },
+ /** Get previous page (previous 10 paragraphs) of selected book */
+ async prevBookPage () {
+ this.$refs.bookModal.scrollTop = 0
+ this.paragraphs = await this.getParagraphs(this.selectedParagraph._source.title, this.bookOffset - 10)
+ },
+ /** Display paragraphs from selected book in modal window */
+ async showBookModal (searchHit) {
+ try {
+ document.body.style.overflow = 'hidden'
+ this.selectedParagraph = searchHit
+ this.paragraphs = await this.getParagraphs(searchHit._source.title, searchHit._source.location - 5)
+ } catch (err) {
+ console.error(err)
+ }
+ },
+ /** Close the book detail modal */
+ closeBookModal () {
+ document.body.style.overflow = 'auto'
+ this.selectedParagraph = null
+ }
+
+```
+
+These five functions provide the logic for downloading and paginating through pages (ten paragraphs each) in a book.
+
+Now we just need to add a UI to display the book pages. Add this markup below the `` comment in `/public/index.html`.
+
+```
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {{ numHits }} Hits
+ Displaying Results {{ searchOffset }} - {{ searchOffset + 9 }}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {{ hit._source.title }} - {{ hit._source.author }}
+ Location {{ hit._source.location }}
+
+
+
+
+
+
+
+
+
+```
+
+Restart the app server (`docker-compose up -d --build`) again and open up `localhost:8080`. When you click on a search result, you are now able to view the surrounding paragraphs. You can now even read the rest of the book to completion if you're entertained by what you find.
+
+
+
+Congrats, you've completed the tutorial application!
+
+Feel free to compare your local result against the completed sample hosted here - [https://search.patricktriest.com/][37]
+
+### 9 - DISADVANTAGES OF ELASTICSEARCH
+
+### 9.0 - Resource Hog
+
+Elasticsearch is computationally demanding. The [official recommendation][38] is to run ES on a machine with 64 GB of RAM, and they strongly discourage running it on anything with under 8 GB of RAM. Elasticsearch is an _in-memory_ datastore, which allows it to return results extremely quickly, but also results in a very significant system memory footprint. In production, [it is strongly recommended to run multiple Elasticsearch nodes in a cluster][39] to allow for high server availability, automatic sharding, and data redundancy in case of a node failure.
+
+I've got our tutorial application running on a $15/month GCP compute instance (at [search.patricktriest.com][40]) with 1.7 GB of RAM, and it _just barely_ is able to run the Elasticsearch node; sometimes the entire machine freezes up during the initial data-loading step. Elasticsearch is, in my experience, much more of a resource hog than more traditional databases such as PostgreSQL and MongoDB, and can be significantly more expensive to host as a result.
+
+### 9.1 - Syncing with Databases
+
+In most applications, storing all of the data in Elasticsearch is not an ideal option. It is possible to use ES as the primary transactional database for an app, but this is generally not recommended due to the lack of ACID compliance in Elasticsearch, which can lead to lost write operations when ingesting data at scale. In many cases, ES serves a more specialized role, such as powering the text searching features of the app. This specialized use requires that some of the data from the primary database is replicated to the Elasticsearch instance.
+
+For instance, let's imagine that we're storing our users in a PostgreSQL table, but using Elasticsearch to power our user-search functionality. If a user, "Albert", decides to change his name to "Al", we'll need this change to be reflected in both our primary PostgreSQL database and in our auxiliary Elasticsearch cluster.
+
+This can be a tricky integration to get right, and the best answer will depend on your existing stack. There are a multitude of open-source options available, from [a process to watch a MongoDB operation log][41] and automatically sync detected changes to ES, to a [PostgresSQL plugin][42] to create a custom PSQL-based index that communicates automatically with Elasticsearch.
+
+If none of the available pre-built options work, you could always just add some hooks into your server code to update the Elasticsearch index manually based on database changes. I would consider this final option to be a last resort, since keeping ES in sync using custom business logic can be complex, and is likely to introduce numerous bugs to the application.
+
+The need to sync Elasticsearch with a primary database is more of an architectural complexity than it is a specific weakness of ES, but it's certainly worth keeping in mind when considering the tradeoffs of adding a dedicated search engine to your app.
+
+### CONCLUSION
+
+Full-text search is one of the most important features in many modern applications - and is one of the most difficult to implement well. Elasticsearch is a fantastic option for adding fast and customizable text search to your application, but there are alternatives. [Apache Solr][43] is a similar open source search platform that is built on Apache Lucene - the same library at the core of Elasticsearch. [Algolia][44] is a search-as-a-service web platform which is growing quickly in popularity and is likely to be easier to get started with for beginners (but as a tradeoff is less customizable and can get quite expensive).
+
+"Search-bar" style features are far from the only use-case for Elasticsearch. ES is also a very common tool for log storage and analysis, commonly used in an ELK (Elasticsearch, Logstash, Kibana) stack configuration. The flexible full-text search allowed by Elasticsearch can also be very useful for a wide variety of data science tasks - such as correcting/standardizing the spellings of entities within a dataset or searching a large text dataset for similar phrases.
+
+Here are some ideas for your own projects.
+
+* Add more of your favorite books to our tutorial app and create your own private library search engine.
+
+* Create an academic plagiarism detection engine by indexing papers from [Google Scholar][2].
+
+* Build a spell checking application by indexing every word in the dictionary to Elasticsearch.
+
+* Build your own Google-competitor internet search engine by loading the [Common Crawl Corpus][3] into Elasticsearch (caution - with over 5 billion pages, this can be a very expensive dataset play with).
+
+* Use Elasticsearch for journalism: search for specific names and terms in recent large-scale document leaks such as the [Panama Papers][4] and [Paradise Papers][5].
+
+The source code for this tutorial application is 100% open-source and can be found at the GitHub repository here - [https://github.com/triestpa/guttenberg-search][45]
+
+I hope you enjoyed the tutorial! Please feel free to post any thoughts, questions, or criticisms in the comments below.
+
+
+--------------------------------------------------------------------------------
+
+作者简介：
+
+Full-stack engineer, data enthusiast, insatiable learner, obsessive builder. You can find me wandering on a mountain trail, pretending not to be lost.
+
+-------------
+
+
+via: https://blog.patricktriest.com/text-search-docker-elasticsearch/
+
+作者：[Patrick Triest][a]
+译者：[译者ID](https://github.com/译者ID)
+校对：[校对者ID](https://github.com/校对者ID)
+
+本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
+
+[a]:https://blog.patricktriest.com/author/patrick/
+[1]:https://blog.patricktriest.com/you-should-learn-regex/
+[2]:https://scholar.google.com/
+[3]:https://aws.amazon.com/public-datasets/common-crawl/
+[4]:https://en.wikipedia.org/wiki/Panama_Papers
+[5]:https://en.wikipedia.org/wiki/Paradise_Papers
+[6]:https://search.patricktriest.com/
+[7]:https://github.com/triestpa/guttenberg-search
+[8]:https://www.postgresql.org/
+[9]:https://www.mongodb.com/
+[10]:https://www.elastic.co/
+[11]:https://www.docker.com/
+[12]:https://www.uber.com/
+[13]:https://www.spotify.com/us/
+[14]:https://www.adp.com/
+[15]:https://www.paypal.com/us/home
+[16]:https://nodejs.org/en/
+[17]:http://koajs.com/
+[18]:https://vuejs.org/
+[19]:https://www.elastic.co/
+[20]:https://lucene.apache.org/core/
+[21]:https://www.elastic.co/guide/en/elasticsearch/guide/2.x/getting-started.html
+[22]:https://en.wikipedia.org/wiki/B-tree
+[23]:https://www.docker.com/
+[24]:https://www.docker.com/
+[25]:https://docs.docker.com/compose/
+[26]:https://docs.docker.com/engine/installation/
+[27]:https://docs.docker.com/compose/install/
+[28]:https://www.gutenberg.org/
+[29]:https://cdn.patricktriest.com/data/books.zip
+[30]:https://www.gnu.org/software/wget/
+[31]:https://theunarchiver.com/command-line
+[32]:https://www.elastic.co/guide/en/elasticsearch/reference/current/full-text-queries.html
+[33]:http://koajs.com/
+[34]:https://github.com/hapijs/joi
+[35]:https://github.com/triestpa/koa-joi-validate
+[36]:https://vuejs.org/v2/guide/
+[37]:https://search.patricktriest.com/
+[38]:https://www.elastic.co/guide/en/elasticsearch/guide/current/hardware.html
+[39]:https://www.elastic.co/guide/en/elasticsearch/guide/2.x/distributed-cluster.html
+[40]:https://search.patricktriest.com/
+[41]:https://github.com/mongodb-labs/mongo-connector
+[42]:https://github.com/zombodb/zombodb
+[43]:https://lucene.apache.org/solr/
+[44]:https://www.algolia.com/
+[45]:https://github.com/triestpa/guttenberg-search
+[46]:https://blog.patricktriest.com/tag/guides/
+[47]:https://blog.patricktriest.com/tag/javascript/
+[48]:https://blog.patricktriest.com/tag/nodejs/
+[49]:https://blog.patricktriest.com/tag/web-development/
+[50]:https://blog.patricktriest.com/tag/devops/
\ No newline at end of file
diff --git a/sources/tech/20180125 Building a Linux-based HPC system on the Raspberry.md b/sources/tech/20180125 Building a Linux-based HPC system on the Raspberry.md
new file mode 100644
index 0000000000..eab5ac90b3
--- /dev/null
+++ b/sources/tech/20180125 Building a Linux-based HPC system on the Raspberry.md
@@ -0,0 +1,153 @@
+Building a Linux-based HPC system on the Raspberry Pi with Ansible
+============================================================
+
+### Create a high-performance computing cluster with low-cost hardware and open source software.
+
+
+Image by : opensource.com
+
+In my [previous article for Opensource.com][14], I introduced the [OpenHPC][15] project, which aims to accelerate innovation in high-performance computing (HPC). This article goes a step further by using OpenHPC's capabilities to build a small HPC system. To call it an _HPC system_ might sound bigger than it is, so maybe it is better to say this is a system based on the [Cluster Building Recipes][16] published by the OpenHPC project.
+
+The resulting cluster consists of two Raspberry Pi 3 systems acting as compute nodes and one virtual machine acting as the master node:
+
+
+
+
+My master node is running CentOS on x86_64 and my compute nodes are running a slightly modified CentOS on aarch64.
+
+This is what the setup looks in real life:
+
+
+
+
+To set up my system like an HPC system, I followed some of the steps from OpenHPC's Cluster Building Recipes [install guide for CentOS 7.4/aarch64 + Warewulf + Slurm][17] (PDF). This recipe includes provisioning instructions using [Warewulf][18]; because I manually installed my three systems, I skipped the Warewulf parts and created an [Ansible playbook][19] for the steps I took.
+
+
+Once my cluster was set up by the [Ansible][26] playbooks, I could start to submit jobs to my resource manager. The resource manager, [Slurm][27] in my case, is the instance in the cluster that decides where and when my jobs are executed. One possibility to start a simple job on the cluster is:
+```
+[ohpc@centos01 ~]$ srun hostname
+calvin
+```
+
+If I need more resources, I can tell Slurm that I want to run my command on eight CPUs:
+
+```
+[ohpc@centos01 ~]$ srun -n 8 hostname
+hobbes
+hobbes
+hobbes
+hobbes
+calvin
+calvin
+calvin
+calvin
+```
+
+In the first example, Slurm ran the specified command (`hostname`) on a single CPU, and in the second example Slurm ran the command on eight CPUs. One of my compute nodes is named `calvin` and the other is named `hobbes`; that can be seen in the output of the above commands. Each of the compute nodes is a Raspberry Pi 3 with four CPU cores.
+
+Another way to submit jobs to my cluster is the command `sbatch`, which can be used to execute scripts with the output written to a file instead of my terminal.
+
+```
+[ohpc@centos01 ~]$ cat script1.sh
+#!/bin/sh
+date
+hostname
+sleep 10
+date
+[ohpc@centos01 ~]$ sbatch script1.sh
+Submitted batch job 101
+```
+
+This will create an output file called `slurm-101.out` with the following content:
+
+```
+Mon 11 Dec 16:42:31 UTC 2017
+calvin
+Mon 11 Dec 16:42:41 UTC 2017
+```
+
+To demonstrate the basic functionality of the resource manager, simple and serial command line tools are suitable—but a bit boring after doing all the work to set up an HPC-like system.
+
+A more interesting application is running an [Open MPI][20] parallelized job on all available CPUs on the cluster. I'm using an application based on [Game of Life][21], which was used in a [video][22] called "Running Game of Life across multiple architectures with Red Hat Enterprise Linux." In addition to the previously used MPI-based Game of Life implementation, the version now running on my cluster colors the cells for each involved host differently. The following script starts the application interactively with a graphical output:
+
+```
+$ cat life.mpi
+#!/bin/bash
+
+module load gnu6 openmpi3
+
+if [[ "$SLURM_PROCID" != "0" ]]; then
+ exit
+fi
+
+mpirun ./mpi_life -a -p -b
+```
+
+I start the job with the following command, which tells Slurm to allocate eight CPUs for the job:
+
+```
+$ srun -n 8 --x11 life.mpi
+```
+
+For demonstration purposes, the job has a graphical interface that shows the current result of the calculation:
+
+
+
+
+The position of the red cells is calculated on one of the compute nodes, and the green cells are calculated on the other compute node. I can also tell the Game of Life program to color the cell for each used CPU (there are four per compute node) differently, which leads to the following output:
+
+
+
+
+Thanks to the installation recipes and the software packages provided by OpenHPC, I was able to set up two compute nodes and a master node in an HPC-type configuration. I can submit jobs to my resource manager, and I can use the software provided by OpenHPC to start MPI applications utilizing all my Raspberry Pis' CPUs.
+
+* * *
+
+ _To learn more about using OpenHPC to build a Raspberry Pi cluster, please attend Adrian Reber's talks at [DevConf.cz 2018][10], January 26-28, in Brno, Czech Republic, and at the [CentOS Dojo 2018][11], on February 2, in Brussels._
+
+### About the author
+
+ [][23] Adrian Reber - Adrian is a Senior Software Engineer at Red Hat and is migrating processes at least since 2010\. He started to migrate processes in a high performance computing environment and at some point he migrated so many processes that he got a PhD for that and since he joined Red Hat he started to migrate containers. Occasionally he still migrates single processes and is still interested in high performance computing topics.[More about me][12]
+
+--------------------------------------------------------------------------------
+
+via: https://opensource.com/article/18/1/how-build-hpc-system-raspberry-pi-and-openhpc
+
+作者：[Adrian Reber ][a]
+译者：[译者ID](https://github.com/译者ID)
+校对：[校对者ID](https://github.com/校对者ID)
+
+本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
+
+[a]:https://opensource.com/users/adrianreber
+[1]:https://opensource.com/resources/what-are-linux-containers?utm_campaign=containers&intcmp=70160000000h1s6AAA
+[2]:https://opensource.com/resources/what-docker?utm_campaign=containers&intcmp=70160000000h1s6AAA
+[3]:https://opensource.com/resources/what-is-kubernetes?utm_campaign=containers&intcmp=70160000000h1s6AAA
+[4]:https://developers.redhat.com/blog/2016/01/13/a-practical-introduction-to-docker-container-terminology/?utm_campaign=containers&intcmp=70160000000h1s6AAA
+[5]:https://opensource.com/file/384031
+[6]:https://opensource.com/file/384016
+[7]:https://opensource.com/file/384021
+[8]:https://opensource.com/file/384026
+[9]:https://opensource.com/article/18/1/how-build-hpc-system-raspberry-pi-and-openhpc?rate=l9n6B6qRcR20LJyXEoUoWEZ4mb2nDc9sFZ1YSPc60vE
+[10]:https://devconfcz2018.sched.com/event/DJYi/openhpc-introduction
+[11]:https://wiki.centos.org/Events/Dojo/Brussels2018
+[12]:https://opensource.com/users/adrianreber
+[13]:https://opensource.com/user/188446/feed
+[14]:https://opensource.com/article/17/11/openhpc
+[15]:https://openhpc.community/
+[16]:https://openhpc.community/downloads/
+[17]:https://github.com/openhpc/ohpc/releases/download/v1.3.3.GA/Install_guide-CentOS7-Warewulf-SLURM-1.3.3-aarch64.pdf
+[18]:https://en.wikipedia.org/wiki/Warewulf
+[19]:http://people.redhat.com/areber/openhpc/ansible/
+[20]:https://www.open-mpi.org/
+[21]:https://en.wikipedia.org/wiki/Conway%27s_Game_of_Life
+[22]:https://www.youtube.com/watch?v=n8DvxMcOMXk
+[23]:https://opensource.com/users/adrianreber
+[24]:https://opensource.com/users/adrianreber
+[25]:https://opensource.com/users/adrianreber
+[26]:https://www.ansible.com/
+[27]:https://slurm.schedmd.com/
+[28]:https://opensource.com/tags/raspberry-pi
+[29]:https://opensource.com/tags/programming
+[30]:https://opensource.com/tags/linux
+[31]:https://opensource.com/tags/ansible
\ No newline at end of file
diff --git a/sources/tech/20180125 Linux whereis Command Explained for Beginners (5 Examples).md b/sources/tech/20180125 Linux whereis Command Explained for Beginners (5 Examples).md
deleted file mode 100644
index 45107b050c..0000000000
--- a/sources/tech/20180125 Linux whereis Command Explained for Beginners (5 Examples).md
+++ /dev/null
@@ -1,108 +0,0 @@
-Linux whereis Command Explained for Beginners (5 Examples)
-======
-
-Sometimes, while working on the command line, we just need to quickly find out the location of the binary file for a command. Yes, the [find][1] command is an option in this case, but it's a bit time consuming and will likely produce some non-desired results as well. There's a specific command that's designed for this purpose: **whereis**.
-
-In this article, we will discuss the basics of this command using some easy to understand examples. But before we do that, it's worth mentioning that all examples in this tutorial have been tested on Ubuntu 16.04LTS.
-
-### Linux whereis command
-
-The whereis command lets users locate binary, source, and manual page files for a command. Following is its syntax:
-
-```
-whereis [options] [-BMS directory... -f] name...
-```
-
-And here's how the tool's man page explains it:
-```
-whereis locates the binary, source and manual files for the specified command names. The supplied
-names are first stripped of leading pathname components and any (single) trailing extension of the
-form .ext (for example: .c) Prefixes of s. resulting from use of source code control are also dealt
-with. whereis then attempts to locate the desired program in the standard Linux places, and in the
-places specified by $PATH and $MANPATH.
-```
-
-The following Q&A-styled examples should give you a good idea on how the whereis command works.
-
-### Q1. How to find location of binary file using whereis?
-
-Suppose you want to find the location for, let's say, the whereis command itself. Then here's how you can do that:
-
-```
-whereis whereis
-```
-
-[![How to find location of binary file using whereis][2]][3]
-
-Note that the first path in the output is what you are looking for. The whereis command also produces paths for manual pages and source code (if available, which isn't in this case). So the second path you see in the output above is the path to the whereis manual file(s).
-
-### Q2. How to specifically search for binaries, manuals, or source code?
-
-If you want to search specifically for, say binary, then you can use the **-b** command line option. For example:
-
-```
-whereis -b cp
-```
-
-[![How to specifically search for binaries, manuals, or source code][4]][5]
-
-Similarly, the **-m** and **-s** options are used in case you want to find manuals and sources.
-
-### Q3. How to limit whereis search as per requirement?
-
-By default whereis tries to find files from hard-coded paths, which are defined with glob patterns. However, if you want, you can limit the search using specific command line options. For example, if you want whereis to only search for binary files in /usr/bin, then you can do this using the **-B** command line option.
-
-```
-whereis -B /usr/bin/ -f cp
-```
-
-**Note** : Since you can pass multiple paths this way, the **-f** command line option terminates the directory list and signals the start of file names.
-
-Similarly, if you want to limit manual or source searches, you can use the **-M** and **-S** command line options.
-
-### Q4. How to see paths that whereis uses for search?
-
-There's an option for this as well. Just run the command with **-l**.
-
-```
-whereis -l
-```
-
-Here is the list (partial) it produced for us:
-
-[![How to see paths that whereis uses for search][6]][7]
-
-### Q5. How to find command names with unusual entries?
-
-For whereis, a command becomes unusual if it does not have just one entry of each explicitly requested type. For example, commands with no documentation available, or those with documentation in multiple places are considered unusual. The **-u** command line option, when used, makes whereis show the command names that have unusual entries.
-
-For example, the following command should display files in the current directory which have no documentation file, or more than one.
-
-```
-whereis -m -u *
-```
-
-### Conclusion
-
-Agreed, whereis is not the kind of command line tool that you'll require very frequently. But when the situation arises, it definitely makes your life easy. We've covered some of the important command line options the tool offers, so do practice them. For more info, head to its [man page][8].
-
-
---------------------------------------------------------------------------------
-
-via: https://www.howtoforge.com/linux-whereis-command/
-
-作者：[Himanshu Arora][a]
-译者：[译者ID](https://github.com/译者ID)
-校对：[校对者ID](https://github.com/校对者ID)
-
-本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
-
-[a]:https://www.howtoforge.com
-[1]:https://www.howtoforge.com/tutorial/linux-find-command/
-[2]:https://www.howtoforge.com/images/command-tutorial/whereis-basic-usage.png
-[3]:https://www.howtoforge.com/images/command-tutorial/big/whereis-basic-usage.png
-[4]:https://www.howtoforge.com/images/command-tutorial/whereis-b-option.png
-[5]:https://www.howtoforge.com/images/command-tutorial/big/whereis-b-option.png
-[6]:https://www.howtoforge.com/images/command-tutorial/whereis-l.png
-[7]:https://www.howtoforge.com/images/command-tutorial/big/whereis-l.png
-[8]:https://linux.die.net/man/1/whereis
diff --git a/sources/tech/20180126 An introduction to the Web Simple Perl module a minimalist web framework.md b/sources/tech/20180126 An introduction to the Web Simple Perl module a minimalist web framework.md
new file mode 100644
index 0000000000..ab8c29b2b6
--- /dev/null
+++ b/sources/tech/20180126 An introduction to the Web Simple Perl module a minimalist web framework.md
@@ -0,0 +1,106 @@
+An introduction to the Web::Simple Perl module, a minimalist web framework
+============================================================
+
+### Perl module Web::Simple is easy to learn and packs a big enough punch for a variety of one-offs and smaller services.
+
+
+
+Image credits : [You as a Machine][10]. Modified by Rikki Endsley. [CC BY-SA 2.0][11].
+
+One of the more-prominent members of the Perl community is [Matt Trout][12], technical director at [Shadowcat Systems][13]. He's been building core tools for Perl applications for years, including being a co-maintaner of the [Catalyst][14] MVC (Model, View, Controller) web framework, creator of the [DBIx::Class][15] object-management system, and much more. In person, he's energetic, interesting, brilliant, and sometimes hard to keep up with. When Matt writes code…well, think of a runaway chainsaw, with the trigger taped down and the safety features disabled. He's off and running, and you never quite know what will come out. Two things are almost certain: the module will precisely fit the purpose Matt has in mind, and it will show up on CPAN for others to use.
+
+
+One of Matt's special-purpose modules is [Web::Simple][23]. Touted as "a quick and easy way to build simple web applications," it is a stripped-down, minimalist web framework, with an easy to learn interface. Web::Simple is not at all designed for a large-scale application; however, it may be ideal for a small tool that does one or two things in a lower-traffic environment. I can also envision it being used for rapid prototyping if you wanted to create quick wireframes of a new application for demonstrations.
+
+### Installation, and a quick "Howdy!"
+
+You can install the module using `cpan` or `cpanm`. Once you've got it installed, you're ready to write simple web apps without having to hassle with managing the connections or any of that—just your functionality. Here's a quick example:
+
+```
+#!/usr/bin/perl
+package HelloReader;
+use Web::Simple;
+
+sub dispatch_request {
+ GET => sub {
+ [ 200, [ 'Content-type', 'text/plain' ], [ 'Howdy, Opensource.com reader!' ] ]
+ },
+ '' => sub {
+ [ 405, [ 'Content-type', 'text/plain' ], [ 'You cannot do that, friend. Sorry.' ] ]
+ }
+}
+
+HelloReader->run_if_script;
+```
+
+There are a couple of things to notice right off. For one, I didn't `use strict` and `use warnings` like I usually would. Web::Simple imports those for you, so you don't have to. It also imports [Moo][16], a minimalist OO framework, so if you know Moo and want to use it here, you can! The heart of the system lies in the `dispatch_request`method, which you must define in your application. Each entry in the method is a match string, followed by a subroutine to respond if that string matches. The subroutine must return an array reference containing status, headers, and content of the reply to the request.
+
+### Matching
+
+The matching system in Web::Simple is powerful, allowing for complicated matches, passing parameters in a URL, query parameters, and extension matches, in pretty much any combination you want. As you can see in the example above, starting with a capital letter will match on the request method, and you can combine that with a path match easily:
+
+```
+'GET + /person/*' => sub {
+ my ($self, $person) = @_;
+ # write some code to retrieve and display a person
+ },
+'POST + /person/* + %*' => sub {
+ my ($self, $person, $params) = @_;
+ # write some code to modify a person, perhaps
+ }
+```
+
+In the latter case, the third part of the match indicates that we should pick up all the POST parameters and put them in a hashref called `$params` for use by the subroutine. Using `?` instead of `%` in that part of the match would pick up query parameters, as normally used in a GET request. There's also a useful exported subroutine called `redispatch_to`. This tool lets you redirect, without using a 3xx redirect; it's handled internally, invisible to the user. So:
+
+```
+'GET + /some/url' => sub {
+ redispatch_to '/some/other/url';
+}
+```
+
+A GET request to `/some/url` would get handled as if it was sent to `/some/other/url`, without a redirect, and the user won't see a redirect in their browser.
+
+I've just scratched the surface with this module. If you're looking for something production-ready for larger projects, you'll be better off with [Dancer][17] or [Catalyst][18]. But with its light weight and built-in Moo integration, Web::Simple packs a big enough punch for a variety of one-offs and smaller services.
+
+### About the author
+
+ [][19] Ruth Holloway - Ruth Holloway has been a system administrator and software developer for a long, long time, getting her professional start on a VAX 11/780, way back when. She spent a lot of her career (so far) serving the technology needs of libraries, and has been a contributor since 2008 to the Koha open source library automation suite.Ruth is currently a Perl Developer at cPanel in Houston, and also serves as chief of staff for an obnoxious cat. In her copious free time, she occasionally reviews old romance... [more about Ruth Holloway][7][More about me][8]
+
+--------------------------------------------------------------------------------
+
+via: https://opensource.com/article/18/1/introduction-websimple-perl-module-minimalist-web-framework
+
+作者：[Ruth Holloway ][a]
+译者：[译者ID](https://github.com/译者ID)
+校对：[校对者ID](https://github.com/校对者ID)
+
+本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
+
+[a]:https://opensource.com/users/druthb
+[1]:https://opensource.com/tags/python?src=programming_resource_menu1
+[2]:https://opensource.com/tags/javascript?src=programming_resource_menu2
+[3]:https://opensource.com/tags/perl?src=programming_resource_menu3
+[4]:https://developers.redhat.com/?intcmp=7016000000127cYAAQ&src=programming_resource_menu4
+[5]:http://perldoc.perl.org/functions/package.html
+[6]:https://opensource.com/article/18/1/introduction-websimple-perl-module-minimalist-web-framework?rate=ICN35y076ElpInDKoMqp-sN6f4UVF-n2Qt6dL6lb3kM
+[7]:https://opensource.com/users/druthb
+[8]:https://opensource.com/users/druthb
+[9]:https://opensource.com/user/36051/feed
+[10]:https://www.flickr.com/photos/youasamachine/8025582590/in/photolist-decd6C-7pkccp-aBfN9m-8NEffu-3JDbWb-aqf5Tx-7Z9MTZ-rnYTRu-3MeuPx-3yYwA9-6bSLvd-irmvxW-5Asr4h-hdkfCA-gkjaSQ-azcgct-gdV5i4-8yWxCA-9G1qDn-5tousu-71V8U2-73D4PA-iWcrTB-dDrya8-7GPuxe-5pNb1C-qmnLwy-oTxwDW-3bFhjL-f5Zn5u-8Fjrua-bxcdE4-ddug5N-d78G4W-gsYrFA-ocrBbw-pbJJ5d-682rVJ-7q8CbF-7n7gDU-pdfgkJ-92QMx2-aAmM2y-9bAGK1-dcakkn-8rfyTz-aKuYvX-hqWSNP-9FKMkg-dyRPkY
+[11]:https://creativecommons.org/licenses/by/2.0/
+[12]:https://shadow.cat/resources/bios/matt_short/
+[13]:https://shadow.cat/
+[14]:https://metacpan.org/pod/Catalyst
+[15]:https://metacpan.org/pod/DBIx::Class
+[16]:https://metacpan.org/pod/Moo
+[17]:http://perldancer.org/
+[18]:http://www.catalystframework.org/
+[19]:https://opensource.com/users/druthb
+[20]:https://opensource.com/users/druthb
+[21]:https://opensource.com/users/druthb
+[22]:https://opensource.com/article/18/1/introduction-websimple-perl-module-minimalist-web-framework#comments
+[23]:https://metacpan.org/pod/Web::Simple
+[24]:https://opensource.com/tags/perl
+[25]:https://opensource.com/tags/programming
+[26]:https://opensource.com/tags/perl-column
+[27]:https://opensource.com/tags/web-development
\ No newline at end of file
diff --git a/sources/tech/20180126 Creating an Adventure Game in the Terminal with ncurses.md b/sources/tech/20180126 Creating an Adventure Game in the Terminal with ncurses.md
new file mode 100644
index 0000000000..221c53a4ed
--- /dev/null
+++ b/sources/tech/20180126 Creating an Adventure Game in the Terminal with ncurses.md
@@ -0,0 +1,324 @@
+Creating an Adventure Game in the Terminal with ncurses
+======
+How to use curses functions to read the keyboard and manipulate the screen.
+
+My [previous article][1] introduced the ncurses library and provided a simple program that demonstrated a few curses functions to put text on the screen. In this follow-up article, I illustrate how to use a few other curses functions.
+
+### An Adventure
+
+When I was growing up, my family had an Apple II computer. It was on this machine that my brother and I taught ourselves how to write programs in AppleSoft BASIC. After writing a few math puzzles, I moved on to creating games. Having grown up in the 1980s, I already was a fan of the Dungeons and Dragons tabletop games, where you role-played as a fighter or wizard on some quest to defeat monsters and plunder loot in strange lands. So it shouldn't be surprising that I also created a rudimentary adventure game.
+
+The AppleSoft BASIC programming environment supported a neat feature: in standard resolution graphics mode (GR mode), you could probe the color of a particular pixel on the screen. This allowed a shortcut to create an adventure game. Rather than create and update an in-memory map that was transferred to the screen periodically, I could rely on GR mode to maintain the map for me, and my program could query the screen as the player's character moved around the screen. Using this method, I let the computer do most of the hard work. Thus, my top-down adventure game used blocky GR mode graphics to represent my game map.
+
+My adventure game used a simple map that represented a large field with a mountain range running down the middle and a large lake on the upper-left side. I might crudely draw this map for a tabletop gaming campaign to include a narrow path through the mountains, allowing the player to pass to the far side.
+
+
+
+Figure 1. A simple Tabletop Game Map with a Lake and Mountains
+
+You can draw this map in cursesusing characters to represent grass, mountains and water. Next, I describe how to do just that using curses functions and how to create and play a similar adventure game in the Linux terminal.
+
+### Constructing the Program
+
+In my last article, I mentioned that most curses programs start with the same set of instructions to determine the terminal type and set up the curses environment:
+
+```
+initscr();
+cbreak();
+noecho();
+
+```
+
+For this program, I add another statement:
+
+```
+keypad(stdscr, TRUE);
+
+```
+
+The TRUE flag allows curses to read the keypad and function keys from the user's terminal. If you want to use the up, down, left and right arrow keys in your program, you need to use keypad(stdscr, TRUE) here.
+
+Having done that, you now can start drawing to the terminal screen. The curses functions include several ways to draw text on the screen. In my previous article, I demonstrated the addch() and addstr() functions and their associated mvaddch() and mvaddstr() counterparts that first moved to a specific location on the screen before adding text. To create the adventure game map on the terminal, you can use another set of functions: vline() and hline(), and their partner functions mvvline() and mvhline(). These mv functions accept screen coordinates, a character to draw and how many times to repeat that character. For example, mvhline(1, 2, '-', 20) will draw a line of 20 dashes starting at line 1, column 2.
+
+To draw the map to the terminal screen programmatically, let's define this draw_map() function:
+
+```
+#define GRASS ' '
+#define EMPTY '.'
+#define WATER '~'
+#define MOUNTAIN '^'
+#define PLAYER '*'
+
+void draw_map(void)
+{
+ int y, x;
+
+ /* draw the quest map */
+
+ /* background */
+
+ for (y = 0; y < LINES; y++) {
+ mvhline(y, 0, GRASS, COLS);
+ }
+
+ /* mountains, and mountain path */
+
+ for (x = COLS / 2; x < COLS * 3 / 4; x++) {
+ mvvline(0, x, MOUNTAIN, LINES);
+ }
+
+ mvhline(LINES / 4, 0, GRASS, COLS);
+
+ /* lake */
+
+ for (y = 1; y < LINES / 2; y++) {
+ mvhline(y, 1, WATER, COLS / 3);
+ }
+}
+
+```
+
+In drawing this map, note the use of mvvline() and mvhline() to fill large chunks of characters on the screen. I created the fields of grass by drawing horizontal lines (mvhline) of characters starting at column 0, for the entire height and width of the screen. I added the mountains on top of that by drawing vertical lines (mvvline), starting at row 0, and a mountain path by drawing a single horizontal line (mvhline). And, I created the lake by drawing a series of short horizontal lines (mvhline). It may seem inefficient to draw overlapping rectangles in this way, but remember that curses doesn't actually update the screen until I call the refresh() function later.
+
+Having drawn the map, all that remains to create the game is to enter a loop where the program waits for the user to press one of the up, down, left or right direction keys and then moves a player icon appropriately. If the space the player wants to move into is unoccupied, it allows the player to go there.
+
+You can use curses as a shortcut. Rather than having to instantiate a version of the map in the program and replicate this map to the screen, you can let the screen keep track of everything for you. The inch() function, and associated mvinch() function, allow you to probe the contents of the screen. This allows you to query curses to find out whether the space the player wants to move into is already filled with water or blocked by mountains. To do this, you'll need a helper function that you'll use later:
+
+```
+int is_move_okay(int y, int x)
+{
+ int testch;
+
+ /* return true if the space is okay to move into */
+
+ testch = mvinch(y, x);
+ return ((testch == GRASS) || (testch == EMPTY));
+}
+
+```
+
+As you can see, this function probes the location at column y, row x and returns true if the space is suitably unoccupied, or false if not.
+
+That makes it really easy to write a navigation loop: get a key from the keyboard and move the user's character around depending on the up, down, left and right arrow keys. Here's a simplified version of that loop:
+
+```
+
+ do {
+ ch = getch();
+
+ /* test inputted key and determine direction */
+
+ switch (ch) {
+ case KEY_UP:
+ if ((y > 0) && is_move_okay(y - 1, x)) {
+ y = y - 1;
+ }
+ break;
+ case KEY_DOWN:
+ if ((y < LINES - 1) && is_move_okay(y + 1, x)) {
+ y = y + 1;
+ }
+ break;
+ case KEY_LEFT:
+ if ((x > 0) && is_move_okay(y, x - 1)) {
+ x = x - 1;
+ }
+ break;
+ case KEY_RIGHT
+ if ((x < COLS - 1) && is_move_okay(y, x + 1)) {
+ x = x + 1;
+ }
+ break;
+ }
+ }
+ while (1);
+
+```
+
+To use this in a game, you'll need to add some code inside the loop to allow other keys (for example, the traditional WASD movement keys), provide a method for the user to quit the game and move the player's character around the screen. Here's the program in full:
+
+```
+
+/* quest.c */
+
+#include
+#include
+
+#define GRASS ' '
+#define EMPTY '.'
+#define WATER '~'
+#define MOUNTAIN '^'
+#define PLAYER '*'
+
+int is_move_okay(int y, int x);
+void draw_map(void);
+
+int main(void)
+{
+ int y, x;
+ int ch;
+
+ /* initialize curses */
+
+ initscr();
+ keypad(stdscr, TRUE);
+ cbreak();
+ noecho();
+
+ clear();
+
+ /* initialize the quest map */
+
+ draw_map();
+
+ /* start player at lower-left */
+
+ y = LINES - 1;
+ x = 0;
+
+ do {
+ /* by default, you get a blinking cursor - use it to indicate player */
+
+ mvaddch(y, x, PLAYER);
+ move(y, x);
+ refresh();
+
+ ch = getch();
+
+ /* test inputted key and determine direction */
+
+ switch (ch) {
+ case KEY_UP:
+ case 'w':
+ case 'W':
+ if ((y > 0) && is_move_okay(y - 1, x)) {
+ mvaddch(y, x, EMPTY);
+ y = y - 1;
+ }
+ break;
+ case KEY_DOWN:
+ case 's':
+ case 'S':
+ if ((y < LINES - 1) && is_move_okay(y + 1, x)) {
+ mvaddch(y, x, EMPTY);
+ y = y + 1;
+ }
+ break;
+ case KEY_LEFT:
+ case 'a':
+ case 'A':
+ if ((x > 0) && is_move_okay(y, x - 1)) {
+ mvaddch(y, x, EMPTY);
+ x = x - 1;
+ }
+ break;
+ case KEY_RIGHT:
+ case 'd':
+ case 'D':
+ if ((x < COLS - 1) && is_move_okay(y, x + 1)) {
+ mvaddch(y, x, EMPTY);
+ x = x + 1;
+ }
+ break;
+ }
+ }
+ while ((ch != 'q') && (ch != 'Q'));
+
+ endwin();
+
+ exit(0);
+}
+
+int is_move_okay(int y, int x)
+{
+ int testch;
+
+ /* return true if the space is okay to move into */
+
+ testch = mvinch(y, x);
+ return ((testch == GRASS) || (testch == EMPTY));
+}
+
+void draw_map(void)
+{
+ int y, x;
+
+ /* draw the quest map */
+
+ /* background */
+
+ for (y = 0; y < LINES; y++) {
+ mvhline(y, 0, GRASS, COLS);
+ }
+
+ /* mountains, and mountain path */
+
+ for (x = COLS / 2; x < COLS * 3 / 4; x++) {
+ mvvline(0, x, MOUNTAIN, LINES);
+ }
+
+ mvhline(LINES / 4, 0, GRASS, COLS);
+
+ /* lake */
+
+ for (y = 1; y < LINES / 2; y++) {
+ mvhline(y, 1, WATER, COLS / 3);
+ }
+}
+
+```
+
+In the full program listing, you can see the complete arrangement of curses functions to create the game:
+
+1) Initialize the curses environment.
+
+2) Draw the map.
+
+3) Initialize the player coordinates (lower-left).
+
+4) Loop:
+
+* Draw the player's character.
+
+* Get a key from the keyboard.
+
+* Adjust the player's coordinates up, down, left or right, accordingly.
+
+* Repeat.
+
+5) When done, close the curses environment and exit.
+
+### Let's Play
+
+When you run the game, the player's character starts in the lower-left corner. As the player moves around the play area, the program creates a "trail" of dots. This helps show where the player has been before, so the player can avoid crossing the path unnecessarily.
+
+
+
+Figure 2\. The player starts the game in the lower-left corner.
+
+
+
+Figure 3\. The player can move around the play area, such as around the lake and through the mountain pass.
+
+To create a complete adventure game on top of this, you might add random encounters with various monsters as the player navigates his or her character around the play area. You also could include special items the player could discover or loot after defeating enemies, which would enhance the player's abilities further.
+
+But to start, this is a good program for demonstrating how to use the curses functions to read the keyboard and manipulate the screen.
+
+### Next Steps
+
+This program is a simple example of how to use the curses functions to update and read the screen and keyboard. You can do so much more with curses, depending on what you need your program to do. In a follow up article, I plan to show how to update this sample program to use colors. In the meantime, if you are interested in learning more about curses, I encourage you to read Pradeep Padala's [NCURSES Programming HOWTO][2] at the Linux Documentation Project.
+
+
+--------------------------------------------------------------------------------
+
+via: http://www.linuxjournal.com/content/creating-adventure-game-terminal-ncurses
+
+作者：[Jim Hall][a]
+译者：[译者ID](https://github.com/译者ID)
+校对：[校对者ID](https://github.com/校对者ID)
+
+本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
+
+[a]:http://www.linuxjournal.com/users/jim-hall
+[1]:http://www.linuxjournal.com/content/getting-started-ncurses
+[2]:http://tldp.org/HOWTO/NCURSES-Programming-HOWTO
diff --git a/sources/tech/20180126 How To Manage NodeJS Packages Using Npm.md b/sources/tech/20180126 How To Manage NodeJS Packages Using Npm.md
new file mode 100644
index 0000000000..ac27816a7b
--- /dev/null
+++ b/sources/tech/20180126 How To Manage NodeJS Packages Using Npm.md
@@ -0,0 +1,372 @@
+How To Manage NodeJS Packages Using Npm
+======
+
+
+
+A while ago, we have published a guide to [**manage Python packages using PIP**][1]. Today, we are going to discuss how to manage NodeJS packages using Npm. NPM is the largest software registry that contains over 600,000 packages. Everyday, developers across the world shares and downloads packages through npm. In this guide, I will explain the the basics of working with npm, such as installing packages(locally and globally), installing certain version of a package, updating, removing and managing NodeJS packages and so on.
+
+### Manage NodeJS Packages Using Npm
+
+##### Installing NPM
+
+Since npm is written in NodeJS, we need to install NodeJS in order to use npm. To install NodeJS on different Linux distributions, refer the following link.
+
+Once installed, ensure that NodeJS and NPM have been properly installed. There are couple ways to do this.
+
+To check where node has been installed:
+```
+$ which node
+/home/sk/.nvm/versions/node/v9.4.0/bin/node
+```
+
+Check its version:
+```
+$ node -v
+v9.4.0
+```
+
+Log in to Node REPL session:
+```
+$ node
+> .help
+.break Sometimes you get stuck, this gets you out
+.clear Alias for .break
+.editor Enter editor mode
+.exit Exit the repl
+.help Print this help message
+.load Load JS from a file into the REPL session
+.save Save all evaluated commands in this REPL session to a file
+> .exit
+```
+
+Check where npm installed:
+```
+$ which npm
+/home/sk/.nvm/versions/node/v9.4.0/bin/npm
+```
+
+And the version:
+```
+$ npm -v
+5.6.0
+```
+
+Great! Node and NPM have been installed and are working! As you may have noticed, I have installed NodeJS and NPM in my $HOME directory to avoid permission issues while installing modules globally. This is the recommended method by NodeJS team.
+
+Well, let us go ahead to see managing NodeJS modules (or packages) using npm.
+
+##### Installing NodeJS modules
+
+NodeJS modules can either be installed locally or globally(system wide). Now I am going to show how to install a package locally.
+
+**Install packages locally**
+
+To manage packages locally, we normally use **package.json** file.
+
+First, let us create our project directory.
+```
+$ mkdir demo
+```
+```
+$ cd demo
+```
+
+Create a package.json file inside your project's directory. To do so, run:
+```
+$ npm init
+```
+
+Enter the details of your package such as name, version, author, github page etc., or just hit ENTER key to accept the default values and type **YES** to confirm.
+```
+This utility will walk you through creating a package.json file.
+It only covers the most common items, and tries to guess sensible defaults.
+
+See `npm help json` for definitive documentation on these fields
+and exactly what they do.
+
+Use `npm install
+
+
+ +
+ + +
+
+
+
+
+
+ {{ selectedParagraph._source.title }}
+ {{ selectedParagraph._source.author }}
+ + +
Locations {{ bookOffset - 5 }} to {{ bookOffset + 5 }}
+
+ + + +
+
+
+
+ {{ paragraph._source.text }}
+
+
+ {{ paragraph._source.text }}
+
+ +
+```
+
+I'm interested in the part between the first set of quotation marks, after `src=`. After some searching for a solution, I found a Python module called [BeautifulSoup][1]. The tasty part of the script I wrote looks like this:
+```
+soup = BeautifulSoup(all_text, 'html.parser')
+match = soup.findAll("img")
+if len(match) > 0:
+ for m in match:
+ imagelist.append(str(m))
+```
+
+We can use this `findAll` method to pluck out the image tags. Here is a tiny piece of the output:
+```
+
+
+
+```
+
+So far, so good. I thought that the next step might be to just carve this down, but when I tried some string methods in the script, it returned errors about this being tags and not strings. I saved the output to a file and went through the process of editing in [KWrite][2]. One nice thing about KWrite is that you can do a "find & replace" using regular expressions (regex), so I could replace `+``` + +I decided to home in on the `src=` piece. One way would be to wait for an occurrence of `s`, then see if the next character is `r`, the next `c`, and the next `=`. If so, bingo! Then what follows between two sets of double quotation marks is what I need. The problem with this is the structure it takes to hang onto these. One way of looking at a string of characters representing a line of HTML text would be: +``` +for c in all_text: +``` + +But the logic was just too messy to hang onto the previous `c`, and the one before that, the one before that, and the one before that. + +In the end, I decided to focus on the `=` and to use an indexing method whereby I could easily reference any prior or future character in the string. Here is the searching part: +``` + index = 3 + while index < linelength: + if (all_text[index] == '='): + if (all_text[index-3] == 's') and (all_text[index-2] == 'r') and (all_text[index-1] == 'c'): + imagefound(all_text, imagelist, index) + index += 1 + else: + index += 1 + else: + index += 1 +``` + +I start the search with the fourth character (indexing starts at 0), so I don't get an indexing error down below, and realistically, there will not be an equal sign before the fourth character of a line. The first test is to see if we find `=` as we're marching through the string, and if not, we march on. If we do see one, then we ask if the three previous characters were `s`, `r`, and `c`, in that order. If that happens, we call the function `imagefound`: +``` +def imagefound(all_text, imagelist, index): + end = 0 + index += 2 + newimage = '' + while end == 0: + if (all_text[index] != '"'): + newimage = newimage + all_text[index] + index += 1 + else: + newimage = newimage + '\n' + imagelist.append(newimage) + end = 1 + return +``` + +We're sending the function the current index, which represents the `=`. We know the next character will be `"`, so we jump two characters and begin adding characters to a holding string named `newimage`, until we reach the following `"`, at which point we're done. We add the string plus a `newline` character to our list `imagelist` and `return`, keeping in mind there may be more image tags in this remaining string of HTML, so we're right back in the middle of our searching loop. + +Here's what our output looks like now: +``` +images/text-frame-link.png +images/text-frame-unlink.png +images/gimpoptions1.png +images/gimpoptions3.png +images/gimpoptions2.png +images/fontpref3.png +images/font-subst.png +images/fontpref2.png +images/fontpref1.png +images/dtp-studio.png +``` + +Ahhh, much cleaner, and this only took a few seconds to run. I could have jumped seven more index spots to cut out the `images/` part, but I like having it there to make sure I haven't chopped off the first letter of the image filename, and this is so easy to edit out with KWrite--you don't even need regex. After doing that and saving the file, the next step was to run another script I wrote called `sortlist.py`: +``` +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# sortlist.py + +import os + +imagelist = [] +for line in open('/tmp/imagelist_parse4.txt').xreadlines(): + imagelist.append(line) + +imagelist.sort() + +outfile = open('/tmp/imagelist_parse4_sorted.txt', 'w') +outfile.writelines(imagelist) +outfile.close() +``` + +This pulls in the file contents as a list, sorts it, then saves it as another file. After that I could just do the following: +``` +ls /home/gregp/development/Scribus15x/doc/en/images/*.png > '/tmp/actual_images.txt' +``` + +Then I need to run `sortlist.py` on that file too, since the method `ls` uses to sort is different from Python. I could have run a comparison script on these files, but I preferred to do this visually. In the end, I ended up with 42 images that had no HTML reference from the documentation. + +Here is my parsing script in its entirety: +``` +#!/usr/bin/env python +# -*- coding: utf-8 -*- +# parseimg4.py + +import os + +def imagefound(all_text, imagelist, index): + end = 0 + index += 2 + newimage = '' + while end == 0: + if (all_text[index] != '"'): + newimage = newimage + all_text[index] + index += 1 + else: + newimage = newimage + '\n' + imagelist.append(newimage) + end = 1 + return + +htmlnames = [] +imagelist = [] +tempstring = '' +filenames = os.listdir('/home/gregp/development/Scribus15x/doc/en/') +for name in filenames: + if name.endswith('.html'): + htmlnames.append(name) +#print htmlnames +for htmlfile in htmlnames: + all_text = open('/home/gregp/development/Scribus15x/doc/en/' + htmlfile).read() + linelength = len(all_text) + index = 3 + while index < linelength: + if (all_text[index] == '='): + if (all_text[index-3] == 's') and (all_text[index-2] == 'r') and +(all_text[index-1] == 'c'): + imagefound(all_text, imagelist, index) + index += 1 + else: + index += 1 + else: + index += 1 + +outfile = open('/tmp/imagelist_parse4.txt', 'w') +outfile.writelines(imagelist) +outfile.close() +imageno = len(imagelist) +print str(imageno) + " images were found and saved" +``` + +Its name, `parseimg4.py`, doesn't really reflect the number of scripts I wrote along the way, with both minor and major rewrites, plus discards and starting over. Notice that I've hardcoded these directory and filenames, but it would be easy enough to generalize, asking for user input for these pieces of information. Also as they were working scripts, I sent the output to `/tmp`, so they disappear once I reboot my system. + +This wasn't the end of the story, since the next question was: What about zombie HTML files? Any of these files that are not used might reference images not picked up by the previous method. We have a `menu.xml` file that serves as the table of contents for the online manual, but I also needed to consider that some files listed in the TOC might reference files not in the TOC, and yes, I did find some. + +I'll conclude by saying that this was a simpler task than this image search, and it was greatly helped by the processes I had already developed. + + +### About the author + + [][7] Greg Pittman - Greg is a retired neurologist in Louisville, Kentucky, with a long-standing interest in computers and programming, beginning with Fortran IV in the 1960s. When Linux and open source software came along, it kindled a commitment to learning more, and eventually contributing. He is a member of the Scribus Team.[More about me][8] + +-------------------------------------------------------------------------------- + +via: https://opensource.com/article/18/1/parsing-html-python + +作者：[Greg Pittman][a] +译者：[译者ID](https://github.com/译者ID) +校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 + +[a]:https://opensource.com/users/greg-p +[1]:https://www.crummy.com/software/BeautifulSoup/ +[2]:https://www.kde.org/applications/utilities/kwrite/ +[7]:https://opensource.com/users/greg-p +[8]:https://opensource.com/users/greg-p diff --git a/sources/tech/20180129 Rapid, Secure Patching- Tools and Methods.md b/sources/tech/20180129 Rapid, Secure Patching- Tools and Methods.md new file mode 100644 index 0000000000..9ac7340c14 --- /dev/null +++ b/sources/tech/20180129 Rapid, Secure Patching- Tools and Methods.md @@ -0,0 +1,583 @@ +Rapid, Secure Patching: Tools and Methods +====== + +It was with some measure of disbelief that the computer science community greeted the recent [EternalBlue][1]-related exploits that have torn through massive numbers of vulnerable systems. The SMB exploits have kept coming (the most recent being [SMBLoris][2] presented at the last DEF CON, which impacts multiple SMB protocol versions, and for which Microsoft will issue no corrective patch. Attacks with these tools [incapacitated critical infrastructure][3] to the point that patients were even turned away from the British National Health Service. + +It is with considerable sadness that, during this SMB catastrophe, we also have come to understand that the famous Samba server presented an exploitable attack surface on the public internet in sufficient numbers for a worm to propagate successfully. I previously [have discussed SMB security][4] in Linux Journal, and I am no longer of the opinion that SMB server processes should run on Linux. + +In any case, systems administrators of all architectures must be able to down vulnerable network servers and patch them quickly. There is often a need for speed and competence when working with a large collection of Linux servers. Whether this is due to security situations or other concerns is immaterial—the hour of greatest need is not the time to begin to build administration tools. Note that in the event of an active intrusion by hostile parties, [forensic analysis][5] may be a legal requirement, and no steps should be taken on the compromised server without a careful plan and documentation. Especially in this new era of the black hats, computer professionals must step up their game and be able to secure vulnerable systems quickly. + +### Secure SSH Keypairs + +Tight control of a heterogeneous UNIX environment must begin with best-practice use of SSH authentication keys. I'm going to open this section with a simple requirement. SSH private keys must be one of three types: Ed25519, ECDSA using the E-521 curve or RSA keys of 3072 bits. Any key that does not meet those requirements should be retired (in particular, DSA keys must be removed from service immediately). + +The [Ed25519][6] key format is associated with Daniel J. Bernstein, who has such a preeminent reputation in modern cryptography that the field is becoming a DJB [monoculture][7]. The Ed25519 format is deigned for speed, security and size economy. If all of your SSH servers are recent enough to support Ed25519, then use it, and consider nothing else. + +[Guidance on creating Ed25519 keys][8] suggests 100 rounds for a work factor in the "-o" secure format. Raising the number of rounds raises the strength of the encrypted key against brute-force attacks (should a file copy of the private key fall into hostile hands), at the cost of more work and time in decrypting the key when ssh-add is executed. Although there always is [controversy and discussion][9] with security advances, I will repeat the guidance here and suggest that the best format for a newly created SSH key is this: + +``` + +ssh-keygen -a 100 -t ed25519 + +``` + +Your systems might be too old to support Ed25519—Oracle/CentOS/Red Hat 7 have this problem (the 7.1 release introduced support). If you cannot upgrade your old SSH clients and servers, your next best option is likely E-521, available in the ECDSA key format. + +The ECDSA curves came from the US government's National Institute of Standards (NIST). The best known and most implemented of all of the NIST curves are P-256, P-384 and E-521\. All three curves are approved for secret communications by a variety of government entities, but a number of cryptographers have [expressed growing suspicion][10] that the P-256 and P-384 curves are tainted. Well known cryptographer Bruce Schneier [has remarked][11]: "I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry." However, DJB [has expressed][12] limited praise of the E-521 curve: "To be fair I should mention that there's one standard NIST curve using a nice prime, namely 2521 – 1; but the sheer size of this prime makes it much slower than NIST P-256." All of the NIST curves have greater issues with "side channel" attacks than Ed25519—P-521 is certainly a step down, and many assert that none of the NIST curves are safe. In summary, there is a slight risk that a powerful adversary exists with an advantage over the P-256 and P-384 curves, so one is slightly inclined to avoid them. Note that even if your OpenSSH (source) release is capable of E-521, it may be [disabled by your vendor][13] due to patent concerns, so E-521 is not an option in this case. If you cannot use DJB's 2255 – 19 curve, this command will generate an E-521 key on a capable system: + +``` + +ssh-keygen -o -a 100 -b 521 -t ecdsa + +``` + +And, then there is the unfortunate circumstance with SSH servers that support neither ECDSA nor Ed25519\. In this case, you must fall back to RSA with much larger key sizes. An absolute minimum is the modern default of 2048 bits, but 3072 is a wiser choice: + +``` + +ssh-keygen -o -a 100 -b 3072 -t rsa + +``` + +Then in the most lamentable case of all, when you must use old SSH clients that are not able to work with private keys created with the -o option, you can remove the password on id_rsa and create a naked key, then use OpenSSL to encrypt it with AES256 in the PKCS#8 format, as [first documented by Martin Kleppmann][14]. Provide a blank new password for the keygen utility below, then supply a new password when OpenSSL reprocesses the key: + +``` + +$ cd ~/.ssh + +$ cp id_rsa id_rsa-orig + +$ ssh-keygen -p -t rsa +Enter file in which the key is (/home/cfisher/.ssh/id_rsa): +Enter old passphrase: +Key has comment 'cfisher@localhost.localdomain' +Enter new passphrase (empty for no passphrase): +Enter same passphrase again: +Your identification has been saved with the new passphrase. + +$ openssl pkcs8 -topk8 -v2 aes256 -in id_rsa -out id_rsa-strong +Enter Encryption Password: +Verifying - Enter Encryption Password: + +mv id_rsa-strong id_rsa +chmod 600 id_rsa + +``` + +After creating all of these keys on a newer system, you can compare the file sizes: + +``` + +$ ll .ssh +total 32 +-rw-------. 1 cfisher cfisher 801 Aug 10 21:30 id_ecdsa +-rw-r--r--. 1 cfisher cfisher 283 Aug 10 21:30 id_ecdsa.pub +-rw-------. 1 cfisher cfisher 464 Aug 10 20:49 id_ed25519 +-rw-r--r--. 1 cfisher cfisher 111 Aug 10 20:49 id_ed25519.pub +-rw-------. 1 cfisher cfisher 2638 Aug 10 21:45 id_rsa +-rw-------. 1 cfisher cfisher 2675 Aug 10 21:42 id_rsa-orig +-rw-r--r--. 1 cfisher cfisher 583 Aug 10 21:42 id_rsa.pub + +``` + +Although they are relatively enormous, all versions of OpenSSH that I have used have been compatible with the RSA private key in PKCS#8 format. The Ed25519 public key is now small enough to fit in 80 columns without word wrap, and it is as convenient as it is efficient and secure. + +Note that PuTTY may have problems using various versions of these keys, and you may need to remove passwords for a successful import into the PuTTY agent. + +These keys represent the most secure formats available for various OpenSSH revisions. They really aren't intended for PuTTY or other general interactive activity. Although one hopes that all users create strong keys for all situations, these are enterprise-class keys for major systems activities. It might be wise, however, to regenerate your system host keys to conform to these guidelines. + +These key formats may soon change. Quantum computers are causing increasing concern for their ability to run [Shor's Algorithm][15], which can be used to find prime factors to break these keys in reasonable time. The largest commercially available quantum computer, the [D-Wave 2000Q][16], effectively [presents under 200 qubits][17] for this activity, which is not (yet) powerful enough for a successful attack. NIST [announced a competition][18] for a new quantum-resistant public key system with a deadline of November 2017 In response, a team including DJB has released source code for [NTRU Prime][19]. It does appear that we will likely see a post-quantum public key format for OpenSSH (and potentially TLS 1.3) released within the next two years, so take steps to ease migration now. + +Also, it's important for SSH servers to restrict their allowed ciphers, MACs and key exchange lest strong keys be wasted on broken crypto (3DES, MD5 and arcfour should be long-disabled). My [previous guidance][20] on the subject involved the following (three) lines in the SSH client and server configuration (note that formatting in the sshd_config file requires all parameters on the same line with no spaces in the options; line breaks have been added here for clarity): + +``` + +Ciphers chacha20-poly1305@openssh.com, + aes256-gcm@openssh.com, + aes128-gcm@openssh.com, + aes256-ctr, + aes192-ctr, + aes128-ctr + +MACs hmac-sha2-512-etm@openssh.com, + hmac-sha2-256-etm@openssh.com, + hmac-ripemd160-etm@openssh.com, + umac-128-etm@openssh.com, + hmac-sha2-512, + hmac-sha2-256, + hmac-ripemd160, + umac-128@openssh.com + +KexAlgorithms curve25519-sha256@libssh.org, + diffie-hellman-group-exchange-sha256 + +``` + +Since the previous publication, RIPEMD160 is likely no longer safe and should be removed. Older systems, however, may support only SHA1, MD5 and RIPEMD160\. Certainly remove MD5, but users of PuTTY likely will want to retain SHA1 when newer MACs are not an option. Older servers can present a challenge in finding a reasonable Cipher/MAC/KEX when working with modern systems. + +At this point, you should have strong keys for secure clients and servers. Now let's put them to use. + +### Scripting the SSH Agent + +Modern OpenSSH distributions contain the ssh-copy-id shell script for easy key distribution. Below is an example of installing a specific, named key in a remote account: + +``` + +$ ssh-copy-id -i ~/.ssh/some_key.pub person@yourserver.com +ssh-copy-id: INFO: Source of key(s) to be installed: + "/home/cfisher/.ssh/some_key.pub" +ssh-copy-id: INFO: attempting to log in with the new key(s), + to filter out any that are already installed +ssh-copy-id: INFO: 1 key(s) remain to be installed -- + if you are prompted now it is to install the new keys +person@yourserver.com's password: + +Number of key(s) added: 1 + +Now try logging into the machine, with: + "ssh 'person@yourserver.com'" +and check to make sure that only the key(s) you wanted were added. + +``` + +If you don't have the ssh-copy-id script, you can install a key manually with the following command: + +``` + +$ ssh person@yourserver.com 'cat >> ~/.ssh/authorized_keys' < \ + ~/.ssh/some_key.pub + +``` + +If you have SELinux enabled, you might have to mark a newly created authorized_keys file with a security type; otherwise, the sshd server dæmon will be prevented from reading the key (the syslog may report this issue): + +``` + +$ ssh person@yourserver.com 'chcon -t ssh_home_t + ↪~/.ssh/authorized_keys' + +``` + +Once your key is installed, test it in a one-time use with the -i option (note that you are entering a local key password, not a remote authentication password): + +``` + +$ ssh -i ~/.ssh/some_key person@yourserver.com +Enter passphrase for key '/home/v-fishecj/.ssh/some_key': +Last login: Wed Aug 16 12:20:26 2017 from 10.58.17.14 +yourserver $ + +``` + +General, interactive users likely will cache their keys with an agent. In the example below, the same password is used on all three types of keys that were created in the previous section: + +``` + +$ eval $(ssh-agent) +Agent pid 4394 + +$ ssh-add +Enter passphrase for /home/cfisher/.ssh/id_rsa: +Identity added: ~cfisher/.ssh/id_rsa (~cfisher/.ssh/id_rsa) +Identity added: ~cfisher/.ssh/id_ecdsa (cfisher@init.com) +Identity added: ~cfisher/.ssh/id_ed25519 (cfisher@init.com) + +``` + +The first command above launches a user agent process, which injects environment variables (named SSH_AGENT_SOCK and SSH_AGENT_PID) into the parent shell (via eval). The shell becomes aware of the agent and passes these variables to the programs that it runs from that point forward. + +When launched, the ssh-agent has no credentials and is unable to facilitate SSH activity. It must be primed by adding keys, which is done with ssh-add. When called with no arguments, all of the default keys will be read. It also can be called to add a custom key: + +``` + +$ ssh-add ~/.ssh/some_key +Enter passphrase for /home/cfisher/.ssh/some_key: +Identity added: /home/cfisher/.ssh/some_key + ↪(cfisher@localhost.localdomain) + +``` + +Note that the agent will not retain the password on the key. ssh-add uses any and all passwords that you enter while it runs to decrypt keys that it finds, but the passwords are cleared from memory when ssh-add terminates (they are not sent to ssh-agent). This allows you to upgrade to new key formats with minimal inconvenience, while keeping the keys reasonably safe. + +The current cached keys can be listed with ssh-add -l (from, which you can deduce that "some_key" is an Ed25519): + +``` + +$ ssh-add -l +3072 SHA256:cpVFMZ17oO5n/Jfpv2qDNSNcV6ffOVYPV8vVaSm3DDo + /home/cfisher/.ssh/id_rsa (RSA) +521 SHA256:1L9/CglR7cstr54a600zDrBbcxMj/a3RtcsdjuU61VU + cfisher@localhost.localdomain (ECDSA) +256 SHA256:Vd21LEM4lixY4rIg3/Ht/w8aoMT+tRzFUR0R32SZIJc + cfisher@localhost.localdomain (ED25519) +256 SHA256:YsKtUA9Mglas7kqC4RmzO6jd2jxVNCc1OE+usR4bkcc + cfisher@localhost.localdomain (ED25519) + +``` + +While a "primed" agent is running, the SSH clients may use (trusting) remote servers fluidly, with no further prompts for credentials: + +``` + +$ sftp person@yourserver.com +Connected to yourserver.com. +sftp> quit + +$ scp /etc/passwd person@yourserver.com:/tmp +passwd 100% 2269 65.8KB/s 00:00 + +$ ssh person@yourserver.com + (motd for yourserver.com) +$ ls -l /tmp/passwd +-rw-r--r-- 1 root wheel 2269 Aug 16 09:07 /tmp/passwd +$ rm /tmp/passwd +$ exit +Connection to yourserver.com closed. + +``` + +The OpenSSH agent can be locked, preventing any further use of the credentials that it holds (this might be appropriate when suspending a laptop): + +``` + +$ ssh-add -x +Enter lock password: +Again: +Agent locked. + +$ ssh yourserver.com +Enter passphrase for key '/home/cfisher/.ssh/id_rsa': ^C + +``` + +It will provide credentials again when it is unlocked: + +``` + +$ ssh-add -X +Enter lock password: +Agent unlocked. + +``` + +You also can set ssh-agent to expire keys after a time limit with the -t option, which may be useful for long-lived agents that must clear keys after a set daily shift. + +General shell users may cache many types of keys with a number of differing agent implementations. In addition to the standard OpenSSH agent, users may rely upon PuTTY's pageant.exe, GNOME keyring or KDE Kwallet, among others (the use of the PUTTY agent could likely fill an article on its own). + +However, the goal here is to create "enterprise" keys for critical server controls. You likely do not want long-lived agents in order to limit the risk of exposure. When scripting with "enterprise" keys, you will run an agent only for the duration of the activity, then kill it at completion. + +There are special options for accessing the root account with OpenSSH—the PermitRootLogin parameter can be added to the sshd_config file (usually found in /etc/ssh). It can be set to a simple yes or no, forced-commands-only, which will allow only explicitly-authorized programs to be executed, or the equivalent options prohibit-password or without-password, both of which will allow access to the keys generated here. + +Many hold that root should not be allowed any access. [Michael W. Lucas][21] addresses the question in SSH Mastery: + +> Sometimes, it seems that you need to allow users to SSH in to the system as root. This is a colossally bad idea in almost all environments. When users must log in as a regular user and then change to root, the system logs record the user account, providing accountability. Logging in as root destroys that audit trail....It is possible to override the security precautions and make sshd permit a login directly as root. It's such a bad idea that I'd consider myself guilty of malpractice if I told you how to do it. Logging in as root via SSH almost always means you're solving the wrong problem. Step back and look for other ways to accomplish your goal. + +When root action is required quickly on more than a few servers, the above advice can impose painful delays. Lucas' direct criticism can be addressed by allowing only a limited set of "bastion" servers to issue root commands over SSH. Administrators should be forced to log in to the bastions with unprivileged accounts to establish accountability. + +However, one problem with remotely "changing to root" is the [statistical use of the Viterbi algorithm][22] Short passwords, the su - command and remote SSH calls that use passwords to establish a trinary network configuration are all uniquely vulnerable to timing attacks on a user's keyboard movement. Those with the highest security concerns will need to compensate. + +For the rest of us, I recommend that PermitRootLogin without-password be set for all target machines. + +Finally, you can easily terminate ssh-agent interactively with the -k option: + +``` + +$ eval $(ssh-agent -k) +Agent pid 4394 killed + +``` + +With these tools and the intended use of them in mind, here is a complete script that runs an agent for the duration of a set of commands over a list of servers for a common named user (which is not necessarily root): + +``` + +# cat artano + +#!/bin/sh + +if [[ $# -lt 1 ]]; then echo "$0 - requires commands"; exit; fi + +R="-R5865:127.0.0.1:5865" # set to "-2" if you don't want + ↪port forwarding + +eval $(ssh-agent -s) + +function cleanup { eval $(ssh-agent -s -k); } + +trap cleanup EXIT + +function remsh { typeset F="/tmp/${1}" h="$1" p="$2"; + ↪shift 2; echo "#$h" + if [[ "$ARTANO" == "PARALLEL" ]] + then ssh "$R" -p "$p" "$h" "$@" < /dev/null >>"${F}.out" + ↪2>>"${F}.err" & + else ssh "$R" -p "$p" "$h" "$@" + fi } # HOST PORT CMD + +if ssh-add ~/.ssh/master_key +then remsh yourserver.com 22 "$@" + remsh container.yourserver.com 2200 "$@" + remsh anotherserver.com 22 "$@" + # Add more hosts here. +else echo Bad password - killing agent. Try again. +fi + +wait + +####################################################################### +# Examples: # Artano is an epithet of a famous mythical being +# artano 'mount /patchdir' # you will need an fstab entry for this +# artano 'umount /patchdir' +# artano 'yum update -y 2>&1' +# artano 'rpm -Fvh /patchdir/\*.rpm' +####################################################################### + +``` + +This script runs all commands in sequence on a collection of hosts by default. If the ARTANO environment variable is set to PARALLEL, it instead will launch them all as background processes simultaneously and append their STDOUT and STDERR to files in /tmp (this should be no problem when dealing with fewer than a hundred hosts on a reasonable server). The PARALLEL setting is useful not only for pushing changes faster, but also for collecting audit results. + +Below is an example using the yum update agent. The source of this particular invocation had to traverse a firewall and relied on a proxy setting in the /etc/yum.conf file, which used the port-forwarding option (-R) above: + +``` + +# ./artano 'yum update -y 2>&1' +Agent pid 3458 +Enter passphrase for /root/.ssh/master_key: +Identity added: /root/.ssh/master_key (/root/.ssh/master_key) +#yourserver.com +Loaded plugins: langpacks, ulninfo +No packages marked for update +#container.yourserver.com +Loaded plugins: langpacks, ulninfo +No packages marked for update +#anotherserver.com +Loaded plugins: langpacks, ulninfo +No packages marked for update +Agent pid 3458 killed + +``` + +The script can be used for more general maintenance functions. Linux installations running the XFS filesystem should "defrag" periodically. Although this normally would be done with cron, it can be a centralized activity, stored in a separate script that includes only on the appropriate hosts: + +``` + +&1' +Agent pid 7897 +Enter passphrase for /root/.ssh/master_key: +Identity added: /root/.ssh/master_key (/root/.ssh/master_key) +#yourserver.com +#container.yourserver.com +#anotherserver.com +Agent pid 7897 killed + +``` + +An easy method to collect the contents of all authorized_keys files for all users is the following artano script (this is useful for system auditing and is coded to remove file duplicates): + +``` + +artano 'awk -F: {print\$6\"/.ssh/authorized_keys\"} \ + /etc/passwd | sort -u | xargs grep . 2> /dev/null' + +``` + +It is convenient to configure NFS mounts for file distribution to remote nodes. Bear in mind that NFS is clear text, and sensitive content should not traverse untrusted networks while unencrypted. After configuring an NFS server on host 1.2.3.4, I add the following line to the /etc/fstab file on all the clients and create the /patchdir directory. After the change, the artano script can be used to mass-mount the directory if the network configuration is correct: + +``` + +# tail -1 /etc/fstab +1.2.3.4:/var/cache/yum/x86_64/7Server/ol7_latest/packages + ↪/patchdir nfs4 noauto,proto=tcp,port=2049 0 0 + +``` + +Assuming that the NFS server is mounted, RPMs can be upgraded from images stored upon it (note that Oracle Spacewalk or Red Hat Satellite might be a more capable patch method): + +``` + +# ./artano 'rpm -Fvh /patchdir/\*.rpm' +Agent pid 3203 +Enter passphrase for /root/.ssh/master_key: +Identity added: /root/.ssh/master_key (/root/.ssh/master_key) +#yourserver.com +Preparing... ######################## +Updating / installing... +xmlsec1-1.2.20-7.el7_4 ######################## +xmlsec1-openssl-1.2.20-7.el7_4 ######################## +Cleaning up / removing... +xmlsec1-openssl-1.2.20-5.el7 ######################## +xmlsec1-1.2.20-5.el7 ######################## +#container.yourserver.com +Preparing... ######################## +Updating / installing... +xmlsec1-1.2.20-7.el7_4 ######################## +xmlsec1-openssl-1.2.20-7.el7_4 ######################## +Cleaning up / removing... +xmlsec1-openssl-1.2.20-5.el7 ######################## +xmlsec1-1.2.20-5.el7 ######################## +#anotherserver.com +Preparing... ######################## +Updating / installing... +xmlsec1-1.2.20-7.el7_4 ######################## +xmlsec1-openssl-1.2.20-7.el7_4 ######################## +Cleaning up / removing... +xmlsec1-openssl-1.2.20-5.el7 ######################## +xmlsec1-1.2.20-5.el7 ######################## +Agent pid 3203 killed + +``` + +I am assuming that my audience is already experienced with package tools for their preferred platforms. However, to avoid criticism that I've included little actual discussion of patch tools, the following is a quick reference of RPM manipulation commands, which is the most common package format on enterprise systems: + +* rpm -Uvh package.i686.rpm — install or upgrade a package file. + +* rpm -Fvh package.i686.rpm — upgrade a package file, if an older version is installed. + +* rpm -e package — remove an installed package. + +* rpm -q package — list installed package name and version. + +* rpm -q --changelog package — print full changelog for installed package (including CVEs). + +* rpm -qa — list all installed packages on the system. + +* rpm -ql package — list all files in an installed package. + +* rpm -qpl package.i686.rpm — list files included in a package file. + +* rpm -qi package — print detailed description of installed package. + +* rpm -qpi package — print detailed description of package file. + +* rpm -qf /path/to/file — list package that installed a particular file. + +* rpm --rebuild package.src.rpm — unpack and build a binary RPM under /usr/src/redhat. + +* rpm2cpio package.src.rpm | cpio -icduv — unpack all package files in the current directory. + +Another important consideration for scripting the SSH agent is limiting the capability of an authorized key. There is a [specific syntax][23] for such limitations Of particular interest is the from="" clause, which will restrict logins on a key to a limited set of hosts. It is likely wise to declare a set of "bastion" servers that will record non-root logins that escalate into controlled users who make use of the enterprise keys. + +An example entry might be the following (note that I've broken this line, which is not allowed syntax but done here for clarity): + +``` + +from="*.c2.security.yourcompany.com,4.3.2.1" ssh-ed25519 + ↪AAAAC3NzaC1lZDI1NTE5AAAAIJSSazJz6A5x6fTcDFIji1X+ +↪svesidBonQvuDKsxo1Mx + +``` + +A number of other useful restraints can be placed upon authorized_keys entries. The command="" will restrict a key to a single program or script and will set the SSH_ORIGINAL_COMMAND environment variable to the client's attempted call—scripts can set alarms if the variable does not contain approved contents. The restrict option also is worth consideration, as it disables a large set of SSH features that can be both superfluous and dangerous. + +Although it is possible to set server identification keys in the known_hosts file to a @revoked status, this cannot be done with the contents of authorized_keys. However, a system-wide file for forbidden keys can be set in the sshd_config with RevokedKeys. This file overrides any user's authorized_keys. If set, this file must exist and be readable by the sshd server process; otherwise, no keys will be accepted at all (so use care if you configure it on a machine where there are obstacles to physical access). When this option is set, use the artano script to append forbidden keys to the file quickly when they should be disallowed from the network. A clear and convenient file location would be /etc/ssh/revoked_keys. + +It is also possible to establish a local Certificate Authority (CA) for OpenSSH that will [allow keys to be registered with an authority][24] with expiration dates. These CAs can [become quite elaborate][25] in their control over an enterprise. Although the maintenance of an SSH CA is beyond the scope of this article, keys issued by such CAs should be strong by adhering to the requirements for Ed25519/E-521/RSA-3072. + +### pdsh + +Many higher-level tools for the control of collections of servers exist that are much more sophisticated than the script I've presented here. The most famous is likely [Puppet][26], which is a Ruby-based configuration management system for enterprise control. Puppet has a somewhat short list of supported operating systems. If you are looking for low-level control of Android, Tomato, Linux smart terminals or other "exotic" POSIX, Puppet is likely not the appropriate tool. Another popular Ruby-based tool is [Chef][27], which is known for its complexity. Both Puppet and Chef require Ruby installations on both clients and servers, and they both will catalog any SSH keys that they find, so this key strength discussion is completely applicable to them. + +There are several similar Python-based tools, including [Ansible][28], [Bcfg2][29], [Fabric][30] and [SaltStack][31]. Of these, only Ansible can run "agentless" over a bare SSH connection; the rest will require agents that run on target nodes (and this likely includes a Python runtime). + +Another popular configuration management tool is [CFEngine][32], which is coded in C and claims very high performance. [Rudder][33] has evolved from portions of CFEngine and has a small but growing user community. + +Most of the previously mentioned packages are licensed commercially and some are closed source. + +The closest low-level tool to the activities presented here is the Parallel Distributed Shell (pdsh), which can be found in the [EPEL repository][34]. The pdsh utilities grew out of an IBM-developed package named dsh designed for the control of compute clusters. Install the following packages from the repository to use pdsh: + +``` + +# rpm -qa | grep pdsh +pdsh-2.31-1.el7.x86_64 +pdsh-rcmd-ssh-2.31-1.el7.x86_64 + +``` + +An SSH agent must be running while using pdsh with encrypted keys, and there is no obvious way to control the destination port on a per-host basis as was done with the artano script. Below is an example using pdsh to run a command on three remote servers: + +``` + +# eval $(ssh-agent) +Agent pid 17106 + +# ssh-add ~/.ssh/master_key +Enter passphrase for /root/.ssh/master_key: +Identity added: /root/.ssh/master_key (/root/.ssh/master_key) + +# pdsh -w hosta.com,hostb.com,hostc.com uptime +hosta: 13:24:49 up 13 days, 2:13, 6 users, load avg: 0.00, 0.01, 0.05 +hostb: 13:24:49 up 7 days, 21:15, 5 users, load avg: 0.05, 0.04, 0.05 +hostc: 13:24:49 up 9 days, 3:26, 3 users, load avg: 0.00, 0.01, 0.05 + +# eval $(ssh-agent -k) +Agent pid 17106 killed + +``` + +The -w option above defines a host list. It allows for limited arithmetic expansion and can take the list of hosts from standard input if the argument is a dash (-). The PDSH_SSH_ARGS and PDSH_SSH_ARGS_APPEND environment variables can be used to pass custom options to the SSH call. By default, 32 sessions will be launched in parallel, and this "fanout/sliding window" will be maintained by launching new host invocations as existing connections complete and close. You can adjust the size of the "fanout" either with the -f option or the FANOUT environment variable. It's interesting to note that there are two file copy commands: pdcp and rpdcp, which are analogous to scp. + +Even a low-level utility like pdsh lacks some flexibility that is available by scripting OpenSSH, so prepare to feel even greater constraints as more complicated tools are introduced. + +### Conclusion + +Modern Linux touches us in many ways on diverse platforms. When the security of these systems is not maintained, others also may touch our platforms and turn them against us. It is important to realize the maintenance obligations when you add any Linux platform to your environment. This obligation always exists, and there are consequences when it is not met. + +In a security emergency, simple, open and well understood tools are best. As tool complexity increases, platform portability certainly declines, the number of competent administrators also falls, and this likely impacts speed of execution. This may be a reasonable trade in many other aspects, but in a security context, it demands a much more careful analysis. Emergency measures must be documented and understood by a wider audience than is required for normal operations, and using more general tools facilitates that discussion. + +I hope the techniques presented here will prompt that discussion for those who have not yet faced it. + +### Disclaimer + +The views and opinions expressed in this article are those of the author and do not necessarily reflect those of Linux Journal. + +### Note: + +An exploit [compromising Ed25519][35] was recently demonstrated that relies upon custom hardware changes to derive a usable portion of a secret key. Physical hardware security is a basic requirement for encryption integrity, and many common algorithms are further vulnerable to cache timing or other side channel attacks that can be performed by the unprivileged processes of other users. Use caution when granting access to systems that process sensitive data. + + +-------------------------------------------------------------------------------- + +via: http://www.linuxjournal.com/content/rapid-secure-patching-tools-and-methods + +作者：[Charles Fisher][a] +译者：[译者ID](https://github.com/译者ID) +校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出 + +[a]:http://www.linuxjournal.com/users/charles-fisher +[1]:https://en.wikipedia.org/wiki/EternalBlue +[2]:http://securityaffairs.co/wordpress/61530/hacking/smbloris-smbv1-flaw.html +[3]:http://www.telegraph.co.uk/news/2017/05/13/nhs-cyber-attack-everything-need-know-biggest-ransomware-offensive +[4]:http://www.linuxjournal.com/content/smbclient-security-windows-printing-and-file-transfer +[5]:https://staff.washington.edu/dittrich/misc/forensics +[6]:https://ed25519.cr.yp.to +[7]:http://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html +[8]:https://blog.g3rt.nl/upgrade-your-ssh-keys.html +[9]:https://news.ycombinator.com/item?id=12563899 +[10]:http://safecurves.cr.yp.to/rigid.html +[11]:https://en.wikipedia.org/wiki/Curve25519 +[12]:http://blog.cr.yp.to/20140323-ecdsa.html +[13]:https://lwn.net/Articles/573166 +[14]:http://martin.kleppmann.com/2013/05/24/improving-security-of-ssh-private-keys.html +[15]:https://en.wikipedia.org/wiki/Shor's_algorithm +[16]:https://www.dwavesys.com/d-wave-two-system +[17]:https://crypto.stackexchange.com/questions/40893/can-or-can-not-d-waves-quantum-computers-use-shors-and-grovers-algorithm-to-f +[18]:https://yro.slashdot.org/story/16/12/21/2334220/nist-asks-public-for-help-with-quantum-proof-cryptography +[19]:https://ntruprime.cr.yp.to/index.html +[20]:http://www.linuxjournal.com/content/cipher-security-how-harden-tls-and-ssh +[21]:https://www.michaelwlucas.com/tools/ssh +[22]:https://people.eecs.berkeley.edu/~dawnsong/papers/ssh-timing.pdf +[23]:https://man.openbsd.org/sshd#AUTHORIZED_KEYS_FILE_FORMAT +[24]:https://ef.gy/hardening-ssh +[25]:https://code.facebook.com/posts/365787980419535/scalable-and-secure-access-with-ssh +[26]:https://puppet.com +[27]:https://www.chef.io +[28]:https://www.ansible.com +[29]:http://bcfg2.org +[30]:http://www.fabfile.org +[31]:https://saltstack.com +[32]:https://cfengine.com +[33]:http://www.rudder-project.org/site +[34]:https://fedoraproject.org/wiki/EPEL +[35]:https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-faults diff --git a/sources/tech/20180129 WebSphere MQ programming in Python with Zato.md b/sources/tech/20180129 WebSphere MQ programming in Python with Zato.md new file mode 100644 index 0000000000..3e53d67201 --- /dev/null +++ b/sources/tech/20180129 WebSphere MQ programming in Python with Zato.md @@ -0,0 +1,262 @@ +WebSphere MQ programming in Python with Zato +====== +[WebSphere MQ][1] is a messaging middleware product by IBM - a message queue server - and this post shows how to integrate with MQ from Python and [Zato][2]. + +The article will go through a short process that will let you: + + * Send messages to queues in 1 line of Python code + * Receive messages from queues without coding + * Seamlessly integrate with Java JMS applications - frequently found in WebSphere MQ environments + * Push MQ messages from [Django][3] or [Flask][4] + + + +### Prerequisites + + * [Zato][2] 3.0+ (e.g. from [source code][5]) + * WebSphere MQ 6.0+ + + + +### Preliminary steps + + * Obtain connection details and credentials to the queue manager that you will be connecting to: + + * host, e.g. 10.151.13.11 + * port, e.g. 1414 + * channel name, e.g. DEV.SVRCONN.1 + * queue manager name (optional) + * username (optional) + * password (optional) + * Install [Zato][6] + + * On the same system that Zato is on, install a [WebSphere MQ Client][7] \- this is an umbrella term for a set of development headers and libraries that let applications connect to remote queue managers + + * Install [PyMQI][8] \- an additional dependency implementing the low-level proprietary MQ protocol. Note that you need to use the pip command that Zato ships with: + + + +``` +# Assuming Zato is in /opt/zato/current +zato$ cd /opt/zato/current/bin +zato$ ./pip install pymqi + +``` + + * That is it - everything is installed and the rest is a matter of configuration + + + +### Understanding definitions, outgoing connections and channels + +Everything in Zato revolves around re-usability and hot-reconfiguration - each individual piece of configuration can be changed on the fly, while servers are running, without restarts. + +Note that the concepts below are presented in the context of WebSphere MQ but they apply to other connection types in Zato too. + + * **Definitions** \- encapsulate common details that apply to other parts of configuration, e.g. a connection definition may contain remote host and port + * **Outgoing connections** \- objects through which data is sent to remote resources, such as MQ queues + * **Channels** \- objects through which data can be received, for instance, from MQ queues + + + +It is usually most convenient to configure environments during development using [web-admin GUI][9] but afterwards this can be automated with [enmasse][10], [API][11] or [command-line interface][12]. + +Once configuration is defined, it can be used from Zato services which in turn represent APIs that Zato clients invoke. Then, external applications, such as a Django or Flask, will connect using HTTP to a Zato service which will on their behalf send messages to MQ queues. + +Let's use web-admin to define all the Zato objects required for MQ integrations. (Hint: web-admin by default runs on
+
+
+
+
+
+
+```
+
+
+I also like the short-bindings provided by Vue, ‘:’ for binding data variables into your template and ‘@’ for binding to events. It’s a small thing, but it feels nice to type and keeps your components succinct.
+
+2\. Single File Components
+
+When most people write Vue, they do so using ‘single file components’. Essentially it is a file with the suffix .vue containing up to 3 parts (the css, html and javascript) for each component.
+
+This coupling of technologies feels right. It makes it easy to understand each component in a single place. It also has the nice side effect of encouraging you to keep your code short for each component. If the JavaScript, CSS and HTML for your component is taking up too many lines then it might be time to modularise further.
+
+When it comes to the .
+
+* Linked stylesheet: We write styles of all the elements in a separate file with .css extension. This file is called Stylesheet.
+
+Let’s have a look at how we defined the inline style of the “div” until now:
+
+```
+-
+
- {{ number }} +
+```
+
+We can write this same style inside `` like this:
+
+```
+div{
+ width:550px;
+}
+```
+
+In embedded styling, the styles we write are separate from the elements. So we need a way to relate the element and its style. The first word “div” does exactly that. It lets the browser know that whatever style is inside the curly braces `{…}` belongs to the “div” element. Since this phrase determines which element to apply the style to, it’s called a selector.
+
+The way we write style remains same: property(width) and value(550px) separated by a colon(:) and ended by a semicolon(;).
+
+Let’s remove inline style from our “div” and “img” element and write it inside the `
+```
+
+```
+
+ 
+
+```
+
+Save and refresh, and the result should remain the same.
+
+There is one big problem though — what if there is more than one “div” and “img” element in our HTML file? The styles that we defined for div and img inside the “style” element will apply to every div and img on the page.
+
+If you add another div in your code in the future, then that div will also become 550px wide. We don’t want that.
+
+We want to apply our styles to the specific div and img that we are using right now. To do this, we need to give our div and img element unique ids. Here’s how you can give an id to an element using its “id” attribute:
+
+```
+Bat Letter
+
+ + After all the battles we faught together, after all the difficult times we saw together, after all the good and bad moments we've been through, I think it's time I let you know how I feel about you. +
+``` + +``` +You are the light of my life
++ You complete my darkness with your light. I love: +
+-
+
- the way you see good in the worse +
- the way you handle emotionally difficult situations +
- the way you look at Justice +
+ I have learned a lot from you. You have occupied a special place in my heart over the time. +
+I have a confession to make
++ It feels like my chest does have a heart. You make my heart beat. Your smile brings smile on my face, your pain brings pain to my heart. +
++ I don't show my emotions, but I think this man behind the mask is falling for you. +
+I love you Superman.
+
+ Your not-so-secret-lover,
+ Batman
+
+```
+
+and here’s how to use this id in our embedded style as a selector:
+
+```
+#letter-container{
+ ...
+}
+```
+
+Notice the “#” symbol. It indicates that it is an id, and the styles inside {…} should apply to the element with that specific id only.
+
+Let’s apply this to our code:
+
+```
+
+```
+
+```
+`, ``, `` and ``:
+
+```
+
+
+
+
+
+
+` tag to define a title for our HTML file. The title tag also, like the link tag, goes inside head. Let’s put “Bat Letter” in our title:
+
+```
+<!DOCTYPE html>
+<html>
+<head>
+ <title>Bat Letter
+
+
+
+
+
+
+```
+
+Our HTML is ready with embedded styling.
+
+However, you can see that as we include more styles, the will get bigger. This can quickly clutter our main html file. So let’s go one step further and use linked styling by copying the content inside our style tag to a new file.
+
+Create a new file in the project root directory and save it as style.css:
+
+```
+#letter-container{
+ width:550px;
+}
+#header-bat-logo{
+ width:100%;
+}
+```
+
+We don’t need to write `` in our CSS file.
+
+We need to link our newly created CSS file to our HTML file using the ``tag in our html file. Here’s how we can do that:
+
+```
+
+```
+
+We use the link element to include external resources inside your HTML document. It is mostly used to link Stylesheets. The three attributes that we are using are:
+
+* rel: Relation. What relationship the linked file has to the document. The file with the .css extension is called a stylesheet, and so we keep rel=“stylesheet”.
+
+* type: the Type of the linked file; it’s “text/css” for a CSS file.
+
+* href: Hypertext Reference. Location of the linked file.
+
+There is no at the end of the link element. So, is also a self-closing tag.
+
+```
+
+```
+
+If only getting a Girlfriend was so easy :D
+
+Nah, that’s not gonna happen, let’s move on.
+
+Here’s the content of our loveletter.html:
+
+```
+
+Bat Letter
+
+ + After all the battles we faught together, after all the difficult times we saw together, after all the good and bad moments we've been through, I think it's time I let you know how I feel about you. +
+``` + +``` +You are the light of my life
++ You complete my darkness with your light. I love: +
+-
+
- the way you see good in the worse +
- the way you handle emotionally difficult situations +
- the way you look at Justice +
+ I have learned a lot from you. You have occupied a special place in my heart over the time. +
+I have a confession to make
++ It feels like my chest does have a heart. You make my heart beat. Your smile brings smile on my face, your pain brings pain to my heart. +
++ I don't show my emotions, but I think this man behind the mask is falling for you. +
+I love you Superman.
+
+ Your not-so-secret-lover,
+ Batman
+
+
+
+```
+
+and our style.css:
+
+```
+#letter-container{
+ width:550px;
+}
+#header-bat-logo{
+ width:100%;
+}
+```
+
+Save both the files and refresh, and your output in the browser should remain the same.
+
+### A Few Formalities
+
+Our love letter is almost ready to deliver to Batman, but there are a few formal pieces remaining.
+
+Like any other programming language, HTML has also gone through many versions since its birth year(1990). The current version of HTML is HTML5.
+
+So, how would the browser know which version of HTML you are using to code your page? To tell the browser that you are using HTML5, you need to include `` at top of the page. For older versions of HTML, this line used to be different, but you don’t need to learn that because we don’t use them anymore.
+
+Also, in previous HTML versions, we used to encapsulate the entire document inside `` tag. The entire file was divided into two major sections: Head, inside ``, and Body, inside ``. This is not required in HTML5, but we still do this for compatibility reasons. Let’s update our code with `Bat Letter
+
+ + After all the battles we faught together, after all the difficult times we saw together, after all the good and bad moments we've been through, I think it's time I let you know how I feel about you. +
+You are the light of my life
++ You complete my darkness with your light. I love: +
+-
+
- the way you see good in the worse +
- the way you handle emotionally difficult situations +
- the way you look at Justice +
+ I have learned a lot from you. You have occupied a special place in my heart over the time. +
+I have a confession to make
++ It feels like my chest does have a heart. You make my heart beat. Your smile brings smile on my face, your pain brings pain to my heart. +
++ I don't show my emotions, but I think this man behind the mask is falling for you. +
+I love you Superman.
+
+ Your not-so-secret-lover,
+ Batman
+
+
+
+
+
+```
+
+The main content goes inside `` and meta information goes inside ``. So we keep the div inside `` and load the stylesheets inside ``.
+
+Save and refresh, and your HTML page should display the same as earlier.
+
+### Title in HTML
+
+This is the last change. I promise.
+
+You might have noticed that the title of the tab is displaying the path of the HTML file:
+
+
+
+
+We can use `Bat Letter
+
+ + After all the battles we faught together, after all the difficult times we saw together, after all the good and bad moments we've been through, I think it's time I let you know how I feel about you. +
+You are the light of my life
++ You complete my darkness with your light. I love: +
+-
+
- the way you see good in the worse +
- the way you handle emotionally difficult situations +
- the way you look at Justice +
+ I have learned a lot from you. You have occupied a special place in my heart over the time. +
+I have a confession to make
++ It feels like my chest does have a heart. You make my heart beat. Your smile brings smile on my face, your pain brings pain to my heart. +
++ I don't show my emotions, but I think this man behind the mask is falling for you. +
+I love you Superman.
+
+ Your not-so-secret-lover,
+ Batman
+
+
+
+
+
+```
+
+Save and refresh, and you will see that instead of the file path, “Bat Letter” is now displayed on the tab.
+
+Batman’s Love Letter is now complete.
+
+Congratulations! You made Batman’s Love Letter in HTML.
+
+
+
+
+### What we learned
+
+We learned the following new concepts:
+
+* The structure of an HTML document
+
+* How to write elements in HTML ()
+
+* How to write styles inside the element using the style attribute (this is called inline styling, avoid this as much as you can)
+
+* How to write styles of an element inside (this is called embedded styling)
+
+* How to write styles in a separate file and link to it in HTML using (this is called a linked stylesheet)
+
+* What is a tag name, attribute, opening tag, and closing tag
+
+* How to give an id to an element using id attribute
+
+* Tag selectors and id selectors in CSS
+
+We learned the following HTML tags:
+
+* Bat Letter
+
+ + After all the battles we faught together, after all the difficult times we saw together, after all the good and bad moments we've been through, I think it's time I let you know how I feel about you. +
+You are the light of my life
++ You complete my darkness with your light. I love: +
+-
+
- the way you see good in the worse +
- the way you handle emotionally difficult situations +
- the way you look at Justice +
+ I have learned a lot from you. You have occupied a special place in my heart over the time. +
+I have a confession to make
++ It feels like my chest does have a heart. You make my heart beat. Your smile brings smile on my face, your pain brings pain to my heart. +
++ I don't show my emotions, but I think this man behind the mask is falling for you. +
+I love you Superman.
+
+ Your not-so-secret-lover,
+ Batman
+
: for paragraphs
+
+*
: for line breaks
+
+*
- ,
- : to display lists
+
+* : for grouping elements of our letter + +*
,
: for heading and sub heading + +*
: to insert an image + +* , : for bold and italic text styling + +*