On Fri, Mar 25, 2011 at 12:00 PM, Rony <gnulinuxist(a)gmail.com> wrote: Link, Please. Or it is just another tupperware. -- Kartik Mistry Debian GNU/Linux Developer IRC: kart_ | Identica: @kartikm

On Fri, 2011-03-25 at 12:00 +0530, Rony wrote: whatever - code is of no use unless it is shared. I suggest you take an account on bitbucket or something, put the script under version control, add a license and put it up. Who knows? Some one some where may find it useful (I think I have seen this sentence somewhere) ps. a small prize for guessing what license Rony will choose ;-) -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Fri, 2011-03-25 at 12:39 +0530, Rony Bill wrote: 1. register for an account at bitbucket and set up a repository - that is easy 2. make sure you have mercurial installed in your system (apt-get install mercurial) 3. put your script and any support files in a separate directory 4. run hg init - you will now have a mercurial repository 5. run hg add <filename> (this will add each file) 6. run hg commit -m 'some comment' -u username 7. the run hg push https://bitbucket.org/bitbucketusername/repositoryname 8. voila - your code is under version control and on the net (noble prize is around the corner) 9. whenever you change your code, do a commit and a push -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Fri, Mar 25, 2011 at 10:01 AM, Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;wrote;wrote: No url available but I am posting the 2 scripts. Create 2 text files called 'employees' and 'present'. In the 'employees' file add your single names (no space) one below the other. The main script is called 'muster' and is given below. #!/bin/bash echo -e "Welcome to Your Company" echo -n "Please enter your name: " read -e USER if grep -q "$USER" employees then echo "Thank you for your entry." else echo "Sorry! Your name does not appear in our records." exit fi if grep -q "$USER" present then echo "Sorry! You have already logged in today." else DATE=$(date +%d-%m-%Y) MONTH=$(date +%b-%Y) CUR=$(date +%s) REF=$(date +%s -d 'today 10am') DIFF=$(( $CUR - $REF )) streamer -c /dev/video0 -b 16 -q -o $USER.jpeg convert $USER.jpeg -resize 60x40 $USER-$DATE.jpeg rm -f $USER.jpeg MIN=$(($DIFF/60)) echo "$DATE $USER $MIN" >> $USER-$MONTH.csv echo "$USER" >> present fi exit The other script is called 'absent' and is given below. #!/bin/bash DATE=$(date +%d-%m-%Y) MONTH=$(date +%b-%Y) for i in $(cat employees); do if grep -q "$i" present then echo > /dev/null else echo "$DATE $i Absent" >> $i-$MONTH.csv fi done All you need is a linux compatible webcam and the 2 scripts and the 2 text files and you are ready with the Low Cost Attendance Registering System with Biometrics. This script will run even on older machines that cannot handle server software. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message.Regards, Rony.

On Friday 25 March 2011 04:18 PM, Abdus Samad Ansari wrote: The camera clicks a photo of the person who is entering a user_name. The photo click is for record keeping only and does not have any face recognition feature. If it is found that some employees are punching in their friends' names, too the records help the boss in knowing who is the person in the picture. It acts as a watchdog over the punching activity. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Friday 25 March 2011 05:56 PM, Binand Sethumadhavan wrote: I will check it out. There must be some grep option to look for absolute values. I did find some extra code that could be removed. For eg. The streamer and convert can use the same name for the jpeg and avoid the rm -rf $USER.jpeg line. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

Hi, Am Samstag, den 26.03.2011, 23:18 +0530 schrieb Osric Fernandes: as discussed in the meeting, this is not sufficient. Safer would be $ fgrep -qx "$USER" present Greetings, Joachim -- Joachim "nomeata" Breitner mail: mail(a)joachim-breitner.de | ICQ# 74513189 | GPG-Key: 4743206C JID: nomeata(a)joachim-breitner.de | http://www.joachim-breitner.de/ Debian Developer: nomeata(a)debian.org

On Sunday 27 Mar 2011, Binand Sethumadhavan wrote: Both are unsafe. Consider the user who enters his username as (literally): Raj `rm -rf /`Mathur Then your grep command translates to: grep -q "^Raj `rm -rf /`Mathur$" present and if your app is running as root, voila! no more files on your system! The user is marked present too :) The OP needs to do much more thinking about input sanitisation. Regards, -- Raj -- Raj Mathur raju(a)kandalaya.org http://kandalaya.org/ GPG: 78D4 FC67 367F 40E2 0DD5 0FEF C968 D0EF CC68 D17F PsyTrance & Chill: http://schizoid.in/ || It is the mind that moves

Hi, Am Sonntag, den 27.03.2011, 08:16 +0530 schrieb Raj Mathur (राज माथुर): No, this line is safe with $ fgrep -qx "$USER" present Thanks to the quotes around $USER, the `...` part would not be executed. But the quotes should be around every use of USER, in the later part of the code your exploit works. Greetings, Joachim -- Joachim Breitner e-Mail: mail(a)joachim-breitner.de Homepage: http://www.joachim-breitner.de ICQ#: 74513189 Jabber-ID: nomeata(a)joachim-breitner.de

2011/3/27 Joachim Breitner &lt;mail(a)joachim-breitner.de&gt;de>: Hmm... you are right. Bash seems enclose variable expansions with single quotes by default in case the value contains special characters nowadays. See: http://pastebin.com/gxUeGyhx Binand

2011/3/27 Raj Mathur (राज माथुर): So, given BASH's treatment of quoted variables, is there any difference between the two? grep -q "^$USER$" present fgrep -qx "$USER" present Regards Osric Xavier Fernandes

On Sunday 27 March 2011 02:38 AM, Joachim Breitner wrote: Thanks Joachim. For the first time I actually saw how a code can be cracked into, via an input string only. For the benefit of those who were not present, Joachim was able to crack the user name even though that name was not in the list. Instead of a known username, he used a username string expression that only looked for an alphabet and it was naturally found among the many names. That allowed him in as a valid user. This is a very good example of how opening the code allows it to be improvised and become free of bugs. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Sunday 27 March 2011 12:14 PM, Joachim Breitner wrote: After your inputs, as a precaution, I will not run the script as root. Seperate folders will be made for the scripts which will be owned and grouped by root only and users will be 'others' and will get only execute permissions. Read and Write will be removed for them. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

Hello, In the said attendance system, the customer's plan was to mark all those who are earlier than the reference time or absent as 0. They maintain a regular register too and that will show absent or present. At present the system was just meant to calculate the total time an employee is late every month. However this lack of facility in the software was pointed out by Mehul and other members at the meet and I thought of a way out. Once the company decides the man hours per month -> day -> number of hours per day, we can get the total minutes for the day which is a constant value. Therefore instead of marking the person absent as 0, the daily total hours/min value could be added for that day. Thus in the monthly summation, it will accurately cut the person's day salary as required. The exact value of daily hours/min will be custom decided by the company management. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

Yesterday at the client's place Debian 6 was installed on one spare machine and the attendance system was installed without the camera temporarily on it. Although the plan was to avoid running the scripts as root, the problem was that whenever the user ran the script, the photos and csv files are created with user's ownership and group. This made the files easy to edit and remove the bad records. Therefore I had to put everything in a root owned container and the sudoer's file was edited to allow the user only this particular command as root. Thus all data was root owned and inaccessible to the user. Maybe some experts on the list can suggest how to make a command run as user but keep the data generated from it safe from editing by the user. Today I bought the web cam iBall 8.0 Face2Face. It worked fine in my Ubuntu 10.04 netbook. It was detected by Debian 6 but worked only in the GUI using the 'cheese' utility. It did not work with 'streamer'. After spending half a day with different options, finally in the evening, I had to knock off Debian and install Ubuntu 10.04. The script works fine. However the "^$USER" had to be changed to "$USER", only then the fgrep -x options work (in all systems). Ubuntu had to be tweaked to remove a lot of user access to disks and devices, something that is natural in Debian. Everything is set properly and tomorrow will be the D-day when it will be used by the employees. Thanks to everyone who helped in making this a success. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

2011/4/1 Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;om>: Bachche ki jaan loge kya? It is about 25 lines of shell script which he has posted here and has been dissected to death already. :-) Binand

2011/4/1 Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;om>: Which point is it beside to? He has released the code, and he specified the license under which he has released it. What more do you want? Binand

2011/4/1 Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;om>: [snip] Fortunately or unfortunately, the world has a different definition of open source. Why would a developer go through all this if she does not intend to support the code or continue development on it? Releasing open source code shouldn't be a millstone. Binand

2011/4/1 Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;om>: You could start here: http://opensource.org/docs/osd 1. Complying with the chosen license - there is no question of the author having to comply with any license. The license is for the rest of the world. 2. Ticketing - yes, it indicates a commitment to maintain, so the author might not want to do this. Ditto for version control and all the rest. Depends. I doubt if I need version control and ticketing for the script I use to extract IP addresses from a log file. Well, I didn't want to answer this - but since you insist, I wouldn't change my actions to suit your wishes. If you don't like it, you are welcome to take corrective action at your end. Binand

On Friday 01 April 2011 04:28 PM, Binand Sethumadhavan wrote: Its a he not she. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Friday 01 April 2011 12:10 PM, Binand Sethumadhavan wrote: Scripting and programming is not my main field of work. Since 1988 I have been into electronics and maintenance like VCRs, fax machines and later computers. During those early years I used to even design and assemble my own digital circuits, made my own circuit boards at home, made transparent PCB sticker designs that were then given outside for better finish. In those days there used to be black tapes, dots etc. of various sizes to make PCB drawings. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Friday 01 April 2011 07:29 AM, Kenneth Gonsalves wrote: Repos are generally servers with binary packages. This one is a raw bash script. I am thinking of putting it up on a wiki and let others add code to it. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Saturday 02 April 2011 06:34 AM, Kenneth Gonsalves wrote: deb or rpm or tar.gz packages. Since this script is still not encapsulated in any package, it should be put on a wiki (which I will do ASAP). -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Sat, 2011-04-02 at 14:28 +0530, Kenneth Gonsalves wrote: and please do not put your script in a wiki - a wiki is not the place for support and maintainence of code. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Sat, 2011-04-02 at 16:50 +0530, Rony wrote: anyway I am inspired to do a python port of the scripts. Here: https://bitbucket.org/lawgon/lcars/overview -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Sat, 2011-04-02 at 21:08 +0530, Rony Bill wrote: btw, unless you put GPL notice in *all* the files, some bad guy is going to steal your code. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Mon, 2011-04-04 at 11:26 +0530, Rony wrote: open any file in any GPL'd software on your machine and you will see how. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Mon, 2011-04-04 at 12:45 +0530, Rony wrote: it is ok - but the script won't run. Comment the GPL lines. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Mon, 2011-04-04 at 17:53 +0530, Rony wrote: and I think the hashbang has to be the *first* line -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

2011/4/5 Rony &lt;gnulinuxist(a)gmail.com&gt;om>: It means, your script should look like: #!/bin/bash # This program is free software blah blah... echo "stuff" The sequence "#!" is called the hashbang. The hash needs to be the first byte in the file, and the bang needs to be the second. Binand

On Wed, 2011-04-06 at 11:08 +0530, Vishal Shinde wrote: all the best in your efforts. ps kindly refrain from top posting. Also try to use standard english grammar and spelling. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Wed, 2011-04-06 at 12:05 +0530, Vishal Shinde wrote: unfortunately English is the prime language for FOSS, and you will not get far if you ignore the rules of grammar and composition. It is one thing if English is not your first language, and therefore construction of sentences is awkward - no one objects to that. But deliberately mangling the language is another thing. You will find in the international lists that this irritates people and you will not be respected s/didn't/dint and please refrain from top posting. If you do not know what is top posting and why it is bad, please take the trouble to find out. -- regards KG http://lawgon.livejournal.com Coimbatore LUG rox http://ilugcbe.techstud.org/

On Wed, Apr 6, 2011 at 12:05 PM, Vishal Shinde &lt;vishal.linux85(a)gmail.com&gt; wrote: ^^^ I think the reference is to SMS speak. -- Arun Khan

On Monday 04 April 2011 12:06 PM, Binand Sethumadhavan wrote: I saw that. I want to see what license gets better results. :-) -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

2011/4/4 Kenneth Gonsalves &lt;lawgon(a)thenilgiris.com&gt;om>: Doesn't putting up code on a public-access website one controls imply "releasing"? Is "teach you a lesson" a valid reason for violating someone else's copyright? Binand

Hi, Am Montag, den 04.04.2011, 11:15 +0530 schrieb Kenneth Gonsalves: not quite. If there is no license mentioned, then one cannot do legally anything with the code. After all, the GPL _gives_ you right that you do _not_ have without. OTOH, a bad guy can steal the code no matter what notice you put there :-) Greetings, Joachim -- Joachim Breitner e-Mail: mail(a)joachim-breitner.de Homepage: http://www.joachim-breitner.de ICQ#: 74513189 Jabber-ID: nomeata(a)joachim-breitner.de

2011/3/31 Rony &lt;gnulinuxist(a)gmail.com&gt;om>: This is almost always a bad idea. There are any number of possible attacks - path based, fire redirection based etc. that is possible with this. For example, how does the "stramer" program work - does it overwrite the file specified by -o? In that case, what will happen if I do this first: ln -s /etc/passwd ./binand.jpeg and run your script? Binand

Hi, Am Freitag, den 01.04.2011, 19:32 +0530 schrieb Rony: create a special user just for this purpose, make the directory with the configuration and images only writable by that user, and use sudo to enable everyone to run your script (and only your script) as this special user. Greetings, Joachim -- Joachim "nomeata" Breitner mail: mail(a)joachim-breitner.de | ICQ# 74513189 | GPG-Key: 4743206C JID: nomeata(a)joachim-breitner.de | http://www.joachim-breitner.de/ Debian Developer: nomeata(a)debian.org

On Saturday 02 April 2011 11:01 PM, Joachim Breitner wrote: I did it. The wiki will also be updated with this modification. Thanks. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Friday 25 March 2011 05:56 PM, Binand Sethumadhavan wrote: I created a test script like the above #!/bin/bash echo -n "Please enter your name: " read -e USER if grep -q "$USER" namelist then echo $USER else echo "Name does not exist" fi In namelist file I added Rony, Macrony and karan. While both rony and Rony are accepted, for the other 2 names they are even case sensitive and do not accept macrony or Karan. Even prabhakaran and karunakaran are rejected. Why rony is not case sensitive is still a mystery. -- As a proper list etiquette..... Please trim your replies. Avoid cross posting to other lists. Members do not want to waste time answering same queries that may have been answered on other lists. Replies from other lists, to cross posted mails are not available to our members. Post your replies below the relevant original text, leaving a line space. Do not re-use old messages to write new ones. For new messages, create a new message. Regards, Rony.

On Fri, Mar 25, 2011 at 11:56:51PM +0530, Rony wrote: I've heard that awk is very good at these text things. Ever gave it a try? I don't know much about it, just giving a hint. Btw, there is this string of tutorials on awk at bashshell.net starting with: http://bashshell.net/stream-filtering-utilities/exercise-1-learning-awk-bas… -- Regards, Nitesh Mistry | www.mistrynitesh.com PGP key id: A6FEF696 | 'geekosopher' on freenode irc