Download the official Linux x86_64 tarball

curl -O https://install.speedtest.net/app/cli/ookla-speedtest-1.2.0-linux-x86_64.tgz

Extract the binary

tar -xvf ookla-speedtest-1.2.0-linux-x86_64.tgz

Run it directly without root privileges

./speedtest

Isolation of firefox from the internet script to communicate only with openwebui.

#!/bin/bash

# --- CONFIGURATION ---
NS_NAME="restricted_net"
VETH_HOST="172.200.1.1"
VETH_NS="172.200.1.2"
TARGET_IP="192.168.1.100"

# 1. CLEANUP (Wipe the slate clean)
echo "Cleaning up..."
sudo ip netns delete $NS_NAME 2>/dev/null
sudo ip link delete veth-host 2>/dev/null
# Clean old NAT/Forward rules to avoid "Rule already exists"
sudo iptables -t nat -D POSTROUTING -s $VETH_NS/32 -j MASQUERADE 2>/dev/null
sudo iptables -D FORWARD -s $VETH_NS/32 -j ACCEPT 2>/dev/null
sudo iptables -D FORWARD -d $VETH_NS/32 -j ACCEPT 2>/dev/null

# 2. CREATE NAMESPACE & LINK
sudo ip netns add $NS_NAME
sudo ip link add veth-host type veth peer name veth-ns
sudo ip link set veth-ns netns $NS_NAME

# 3. ADDRESSING
sudo ip addr add $VETH_HOST/24 dev veth-host
sudo ip netns exec $NS_NAME ip addr add $VETH_NS/24 dev veth-ns

# 4. BRING UP INTERFACES
sudo ip link set veth-host up
sudo ip netns exec $NS_NAME ip link set veth-ns up
sudo ip netns exec $NS_NAME ip link set lo up

# 5. ROUTING: The "Precision" Path
# We tell the bubble: "To reach your specific target, go through the host."
sudo ip netns exec $NS_NAME ip route add $TARGET_IP/32 via $VETH_HOST dev veth-ns

# 6. SYSTEM-WIDE FORWARDING (Kernel Level)
sudo sysctl -w net.ipv4.ip_forward=1 > /dev/null

# 7. FIREWALL: Open the "Gates"
# This tells the Debian firewall to allow the traffic to pass through the host
sudo iptables -A FORWARD -s $VETH_NS/32 -j ACCEPT
sudo iptables -A FORWARD -d $VETH_NS/32 -m state --state ESTABLISHED,RELATED -j ACCEPT

# 8. NAT (MASQUERADE)
# This makes the target see your host's IP instead of the 10.200.x.x IP
sudo iptables -t nat -A POSTROUTING -s $VETH_NS/32 -j MASQUERADE

# 9. PERMISSION TO DRAW WINDOWS
xhost +local: > /dev/null

echo "-------------------------------------------------------"
echo "Targeting: $TARGET_IP"
echo "Testing path with 2 pings..."
sudo ip netns exec $NS_NAME ping -c 2 -W 2 $TARGET_IP
echo "-------------------------------------------------------"

# 10. LAUNCH FIREFOX
# --no-remote is CRITICAL
# sudo ip netns exec $NS_NAME sudo -u $USER firefox --no-remote         # No Auto Redirection
sudo ip netns exec $NS_NAME sudo -u $USER firefox --no-remote "http://192.168.1.100:8080"

Now lets configure a new shortcut so that when firefox executes, the script to run the namespace configuration is initialised every time it’s launched leaving firefox in its own bubble. Your sudo password will be prompted.

Save the following config in:

.local/share/applications/vault-firefox.desktop

  GNU nano 8.4            .local/share/applications/vault-firefox.desktop                     
[Desktop Entry]
Categories=Network;WebBrowser;
Comment=Isolated Firefox for VM Access
Exec=kdesu /home/bee/namespace/LAN-only-Firefox.sh
Icon=firefox-esr-symbolic
Name=Firefox Vault
NoDisplay=false
Path=
PrefersNonDefaultGPU=false
StartupNotify=true
Terminal=false
TerminalOptions=
Type=Application
X-KDE-SubstituteUID=false
X-KDE-Username=

---

As before, try to first answer ALL questions from memory.
Only after that should you use internet, your notes, slides, or console to find the answer.

SERIES 1

1. Give commands to display:
   a) ip address of the machine
   ip a
   b) ip address of the default gateway
   ip route | grep default
   c) ip address of DNS server(s)
   cat /etc/resolv.conf or resolvectl status
2. What is the contents of ~/.ssh/id_rsa file?
   The content is a string of characters representing the private key of a key-pair and which is specific to an specific public key.
3. What is the contents of ~/.ssh/authorized_keys file?
   These are the public keys that are allowed in a server to permit the connection from a client machine that has the specific private key for secure connection (ssh).
4. Give command to generata keys required for key-based SSH authentication:
   ssh-keygen -t ed25519 -f mykey
5. Give command to setup key-based SSH authentication between current account and account jerry on machine 1.2.3.4. :
   ssh-copy-id jerry@1.2.3.4
6. Recall UFW. Give a command to:
   a) display whether UFW is enabled or list all currently used rules:
   sudo ufw status, sudo ufw status numbered
   b) display all rules numbered:
   sudo ufw status numbered
   c) delete rule number 3:
   sudo ufw delete [rule number OR name]
   d) allow incoming connections to port 6667 via TCP protocol:
   sudo ufw allow 6667/tcp
   e) allow incoming connections for ntp service:
   sudo ufw allow ntp

As before, try to first answer ALL questions from memory.
Only after that should you use internet, your notes, slides, or console to find the answer.

SERIES 2

1. Give command to create a symbolic link named ‘followme’ pointing to /etc/network directory

• ln -s /etc/network followme

1. Give command to remove symbolic link ~/subdirlink

• unlink ~/subdirlink

1. Give 2 reasons why symbolic links are used, give 1 example of each

• it creates a shortcut in the windows sense but it can do much more.
• Backward compatibility by pointint the old standard dirs and files to new current location like in the example of folder /bin and /sbin that currently were moved to /usr/bin and /usr/sbin

1. Give a command to view or change what possible programs can be used as ‘vi’ command in /usr/bin/vi.

• sudo update-alternatives –config vi

As before, try to first answer ALL questions from memory.
Only after that should you use internet, your notes, slides, or console to find the answer.

SERIES 3

Write a command using sed (and other commands) to:

1. display the first 5 lines of /etc/group file where all colons : have been replaced with commas ,
   • head -n5 /etc/group | sed ‘s/:/,/g’
2. display the contents of /etc/hosts where any occurence of 127 is changed to word LOCAL
   • sed ‘s/127/LOCAL/g’ /etc/hosts
3. take the output of ‘ls -l ~/’ command and replace any occurence of rwx in it with word ALL
   • ls -l ~/ | sed ‘s/rwx/ALL/g’
4. display lines 5,6,7 of /etc/passwd
   head /etc/passwd -n7 | tail -n3 OR sed -n ‘5,7p’ /etc/passwd
   Hint: try head and tail
5. Recall command ‘top’. If a computer has 8 cores and they’re all occupied at 75% what will be the value of ‘load’ displayed by command top?
   • is the number of cores times decimal percentage expression: 8 X 0.75 = 6
6. Explain meaning of each of the following shell operators in one sentence and give one example of use

> Write to OR overwrite to file

>> Append to file

2> send stderr code to
&> send everything to
2>&1 send stderr to ?
< redirects standard input FROM a file
| pipe is used to transfer stdout to the next command
; semicolon separator makes second command to execute regardless
&& AND operator only executes second command if first one succeeds
|| OR operator executes second command only when the first one failed

As before, try to first answer ALL questions from memory.
Only after that should you use internet, your notes, slides, or console to find the answer.

SERIES 4

1. Find out how many (approximately) programs named ‘bash’ are currently running on your system.
   ps -aux | grep bash
2. Find out what is the program that takes most RAM or CPU
   ps aux –sort=%cpu
3. Create a backup of entire /etc into a file saved in /tmp directory (you pick an appropriate file name in /tmp)
   tar -zvcf /tmp/etc_backup.tar.gz /etc
4. Restore backup of /etc/ directory previously created into /tmp directory (do NOT override originals is /etc)
   tar -zxvf /tmp/etc_backup.tar.gz -C /tmp/etc2
5. Run cp /etc/passwd /tmp/users.txt. Then use gzip to compress /tmp/users.txt
   cp /etc/passwd /tmp/users.txt
   gzip /tmp/users.txt
   Verify that compressing it worked and users.txt.gz exists.
   ls -l users.txt.gz
6. Uncompress the file you compressed in previous step.
   gunzip /tmp/users.txt.gz /tmp
   ls -l users.txt
7. [multiple answers] Start Firefox.

• How can you find out what is the PID of that process? Do it.
  ps aux | grep firefox
• How can you terminate the process? Do it.
  kill PID
• How would you terminate the process forcefully?
  kill -9 PID

1. How would you terminate all processes started from executable named ‘less’ ?
   killall less OR pkill less
2. Write a command that will check if group named ‘admin’ exists in /etc/group. If the group exists – your command should display message “found it” and if not “no such group”. Make sure you don’t display anything else. Repeat the same command looking for group named ‘adm’.
   if cut -d: -f1 /etc/group | grep -q “^adm$”; then echo “found it”; else echo “is not there”; fi

As before, try to first answer ALL questions from memory.
Only after that should you use internet, your notes, slides, or console to find the answer.

TASK 1.

Create script called taller.sh.
Script requires exactly 4 parameters.
parameters 1 and 3 are names (any text).
parameters 2 and 4 are heights (numbers).

Script will compare heights and then say
which person is taller.

Note: do NOT worry about the case when they are the same height.

Example console session:

./taller.sh JJ JJ JJ
Error: 4 parameters required
Usage exampe: taller.sh Jenny 165 Timmy 182

./taller.sh Jenny JJ Timmy 156
Error: JJ is not a number

./taller.sh Eva 176 Martin 165
Eva is 176 which is taller than Martin who is 165

./taller.sh Mimi 166 Maxim 172
Maxim is 172 which is taller than Mimi who is 166

#! /bin/bash

echo "Provide name1 heught1 name 2 height2"

# VALIDATE 4 PARAMETERS
if [ "$#" -ne "4" ]; then
        echo "error: you must provide four parameters: name1, height1, name2, height2"
        exit
fi

# VALIDATE 2nd and 4th params are valid integers
echo "$2$4" | grep -E "^[0-9]+$" &>/dev/null
if [ "$?" -ne "0" ]; then
        echo "Error: Heights must be a positive valid integer in cms"
        exit
fi

# PART 3 DOIT

if [ "$2" -eq "$4" ]; then
        echo "Both have the same height"
else
        if [ "$2" -gt "$4" ]; then
                echo "$1 is taller than $3"
        else
                echo "$3 is taller than $1"
        fi
fi

TASK 2.

Create script findline.sh.
Script requires two parameters on command line.
Parameter 1 must be a valid path to a regular file you can read.
Parameter 2 is any text.
The script will use grep to find out how many lines of file (Parameter 1) contain the word passed as Parameter 2.

Example console session:

./findline.sh
Error: invalid number of parameters.
Usage: findline.sh pathtofile word

./findline.sh blah.txt jerry
Error: file blah.txt is not a regular file.

./findline.sh /etc/passwd stud
Word stud found in 1 line(s) in /etc/passwd

#!/bin/bash
 
# 1. Check if exactly two parameters are provided
if [ "$#" -ne 2 ]; then
    echo "Error: invalid number of parameters."
    echo "Usage: findline.sh pathtofile word"
    exit 1
fi

# Assign parameters to descriptive variables
FILE_PATH="$1"
SEARCH_WORD="$2"

# 2. Check if the file is a regular file (-f) and is readable (-r)
if [ ! -f "$FILE_PATH" ] || [ ! -r "$FILE_PATH" ]; then
    echo "Error: file $FILE_PATH is not a regular file."
    exit 1
fi

# 3. Use grep to count the matching lines
# -c counts matching lines, -w ensures it matches the exact word
LINE_COUNT=$(grep -c "$SEARCH_WORD" "$FILE_PATH")

# 4. Output the result
echo "Word $SEARCH_WORD found in $LINE_COUNT line(s) in $FILE_PATH"

TASK 3

Create executable script santafriend.sh.
Script takes multiple names of people as parameters.
You do NOT have to verify the number of parameters passed or their values.

For every name on the list of parameters say “Hello …” with the name.
However, if the name is “Santa” do NOT say “Hello…” but instead say “WOW, you, really?”

Example console session:

./santafriend.sh Jerry Terry Santa Marry
Hello Jerry
Hello Terry
Wow, you, really?
Hello Marry

#! /bin/bash

# set -x

# 1 3 5 7 9

# VALIDATION
# if [ "$#" -eq 1 ]; then SAME RESULT
if [ "$#" -lt 1 ]; then
        echo "Error: you must enter at least one parameter (name or names)"
        exit
fi

for NAME in "$@"; do
        if [ "$NAME" = "Santa" ] || [ "$NAME" = "santa" ]; then
                echo "Wow, you, really?"
        else
                echo "Hello $NAME"
        fi

done

TASK 4

Create executable findlucy.sh
Interactively ask user for a list of friends names.
Require that the list is not empty.
If the list is empty then terminate with error message.
Print each friend’s name and if you find name “Lucy” as one of the name print out a special greeting.

Example console session:

./findlucy.sh
Enter list of names on one line

Error: you must have some friends.

./findlucy.sh
Enter list of names on one line
Jerry Lucy Terry
You’re friends with Jerry
OMG, you know Lucy too!
You’re friends with Terry

Hint: to compare for empty use … = “”

#! /bin/bash

# set -x

echo "Enter list of names on one line and press Enter"
read LIST

# Alternative you can use read -p to set the variable LIST
#read -p "Enter list of names in one line and press Enter: " LIST


# VALIDATION
if [ "$LIST" == "" ]; then
        echo "Error: you must enter at least one name"
        exit 1
fi

for NAME in $LIST; do
        if [ "$NAME" == "Lucy" ]; then
                echo "OMG, you know Lucy too!?"
        else
                echo "Hello $NAME"
        fi

done

Network Configuration Summary: Dual-Interface DNS

1. The Strategy

• Uniform DNS: Force Quad9 on both Wired and Wireless profiles to prevent DNS “Race Conditions.”
• Predictable Routing: Use Route Metrics to ensure the Wired connection is always preferred over Wi-Fi when both are active.
• Isolation: Ignore ISP-provided DNS settings entirely.

Verify from where NetworkManager is getting its DNS. Usually Netowrk Manager will get DNS configuration from DHCP server. If your secondary network adapter (in this case a wifi adapter connected to the ISP router) is getting ISP DNSs, that might conflict with the default configuration of the wired adapter and force it to use the ISP DNS. We dont want this as we want to use QUAD9 DNS.

sudo ls /var/lib/NetworkManager/

Verify current DNS configuration:

cat /etc/resolv.conf 

---

2. Implementation Commands

A. Wired Connection (Primary)

Goal: Highest priority, direct Quad9 access.

# Set DNS and Ignore DHCP DNS
nmcli con mod "Wired connection 1" ipv4.dns "9.9.9.9, 149.112.112.112"
nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns yes

# Set Metric to 100 (Lower = Higher Priority)
nmcli con mod "Wired connection 1" ipv4.route-metric 100

# Apply
nmcli con up "Wired connection 1"

B. Wireless Connection (Backup)

Secondary priority, still forced to Quad9.

# Set DNS and Ignore DHCP DNS
nmcli con mod "ISP_WiFi_Name" ipv4.dns "9.9.9.9, 149.112.112.112"
nmcli con mod "ISP_WiFi_Name" ipv4.ignore-auto-dns yes

# Set Metric to 600 (Higher = Lower Priority)
nmcli con mod "ISP_WiFi_Name" ipv4.route-metric 600

# Apply
nmcli con up "ISP_WiFi_Name"

---

3. Operational Behavior

Scenario	Data Path	DNS Provider	Latency
Only Wired Active	OpenWRT	Quad9	Instant
Only Wireless Active	ISP Router	Quad9	Instant
Both Active	Wired (via Metric 100)	Quad9	Instant

---

4. Troubleshooting & Verification

• Check DNS Order: cat /etc/resolv.confIf both interfaces are up, you should see only Quad9 IPs. If you see the ISP router IP, ipv4.ignore-auto-dns was not set correctly.
• Check Active Metrics: ip route show defaultLook for the metric value. The interface with the lowest number is your active internet path.
• Force Refresh: If settings don’t seem to apply:Bashsudo systemctl restart NetworkManager

---

5. Key Parameters for Records

• Quad9 Primary: 9.9.9.9
• Quad9 Secondary: 149.112.112.112
• Preferred Metric: 100 (Wired)
• Failover Metric: 600 (Wireless)

Note: Always use the specific connection names found in nmcli con show when running these commands. If your SSID has spaces, wrap it in quotes: "My ISP WiFi".

[Unit]
Description=Set CPU governor at boot
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/bin/cpupower frequency-set -g ondemand

[Install]
WantedBy=multi-user.target

auto-cpufreq setup

To get a “flawless” setup on an Intel-based Debian laptop, you should avoid the Snap version and use the Git Installer. This ensures you get the power_helper.py script and proper system integration that Snaps often lack.

1. Full Installation Instructions
   Open your terminal and run these in order:

Bash

1. Install dependencies

sudo apt update
sudo apt install git python3-dev python3-pip python3-venv python3-setuptools dmidecode libcairo2-dev libgtk-3-dev gcc python3-gi

2. Clone the repository

git clone https://github.com/AdnanHodzic/auto-cpufreq.git
cd auto-cpufreq

3. Run the installer

sudo ./auto-cpufreq-installer
During installation, choose i to install the daemon.

2. The Critical “Debian/Intel” Cleanup
   As you saw, your governor was stuck. This is because Debian/GNOME services are fighting auto-cpufreq.

Step A: Disable the Conflict

Bash
sudo systemctl stop power-profiles-daemon
sudo systemctl mask power-profiles-daemon
Step B: Configure for Cooling (Your 800MHz Heat Issue)
Create the config file to force powersave and kill turbo (the main cause of idle heat).

Bash
sudo nano /etc/auto-cpufreq.conf
Paste this exactly:

Ini, TOML
[charger]
governor = powersave
turbo = never

[battery]
governor = powersave
turbo = never
Save and exit (Ctrl+O, Enter, Ctrl+X).

Step C: Restart the Daemon

Bash
sudo systemctl restart auto-cpufreq

3. Setup Questions (To refine your “Flawless” config)
   To tailor this specifically to your Intel hardware, answer these:

What is the output of cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_driver?

If it is intel_pstate, we should check your HWP (Hardware P-State) settings.

If it is acpi-cpufreq, your CPU is older and might need different governor names.

Does your laptop have a dedicated GPU (Nvidia)?

If yes, the 800MHz heat is likely the GPU “leaking” heat to the shared CPU heatsink.

Are you using a GNOME desktop environment?

GNOME has a “Power” slider in the top right menu. If you touch that slider, it can sometimes override these settings.

What is the age/generation of the Intel CPU? (e.g., i5-8250U, i7-12700H)

12th gen and newer (Hybrid architecture) require specific handling of E-cores vs. P-cores.

Would you like me to show you how to check your C-States now that we’ve (hopefully) forced the powersave governor?

I know, this is very unsafe if your login credentials are stolen but it serves as a proof of concept!!!

1. The Goal

To provide secure, external access to the Cockpit Web Console via https://example.site/cockpit/ without opening extra ports (like 9090) on the router and without managing separate SSL certificates for the dashboard.

2. Architecture Flow

1. User requests https://example.site/cockpit/.
2. OpenWrt (HAProxy) receives traffic on port 443 and passes it to the Debian LXC (192.168.1.16:443).
3. Apache (inside LXC) terminates the SSL using Let’s Encrypt certificates.
4. Apache proxies the request internally to 127.0.0.1:9090.
5. Cockpit processes the request and responds through the tunnel.

---

3. Key Configurations

A. Apache VirtualHost (/etc/apache2/sites-available/...)

We used mod_proxy and mod_rewrite to handle both standard web traffic and the persistent WebSocket connections required for the Cockpit terminal.

# WebSocket Upgrade (Fixes "Login then Blank Page" issue)
RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /cockpit/(.*) ws://127.0.0.1:9090/cockpit/$1 [P,L]

# Subfolder Proxy
<Location /cockpit/>
    ProxyPass http://127.0.0.1:9090/cockpit/
    ProxyPassReverse http://127.0.0.1:9090/cockpit/
</Location>

B. Cockpit Config (/etc/cockpit/cockpit.conf)

Crucial for preventing CSRF (Cross-Site Request Forgery) security blocks and allowing the unencrypted internal “handshake.”

[WebService]
Origins = https://hissite.org
ProtocolHeader = X-Forwarded-Proto
AllowUnencrypted = true
UrlRoot = /cockpit

4. Troubleshoot Log & Fixes

• Issue:sscg: command not found.
  • Fix: Installed sscg package to satisfy Cockpit dependencies.
• Issue:gnutls_handshake failed: A TLS fatal alert.
  • Reason: Cockpit was expecting HTTPS but Apache was sending HTTP.
  • Fix: Added AllowUnencrypted = true and restarted cockpit.socket.
• Issue: Blank page after login.
  • Reason: WebSockets (the “live” part of the site) were failing to tunnel through Apache.
  • Fix: Added specific RewriteRule for ws:// protocol.

---

5. Security Hardening Applied

• Consolidated SSL: All traffic uses the main site’s hardened TLS 1.2/1.3 settings.
• Internal Communication: Apache talks to Cockpit over 127.0.0.1 (local loopback), meaning no unencrypted traffic ever touches your LAN or the WAN.

---

6. Maintenance Commands

If Cockpit ever stops responding, run these in order:

1. sudo systemctl restart cockpit.socket (Restarts the listener)
2. sudo systemctl restart apache2 (Restarts the proxy)
3. sudo journalctl -u cockpit -f (To watch live logs if a crash occurs)