Unix-Cribsheet

General

Disk by uuid

Attached disks by uuid in directory: /dev/disk/by-uuid

netmask syntax

IPv4 numbers are 32 bit, represented as:
8bit.8bit.8bit.8bit
The netmask is AND'ed with the packet ip. For example 255.255.255.0 is really 11111111 . 11111111 . 11111111 . 00000000 making the last 8 bits (byte) zero'd out - effectively a wildcard.
/xx syntax masks out this many bits. So /8 would be 255.0.0.0, /16 would be 255.255.0.0, /24 is 255.255.255.0 etc.

xhost

Default configuration for X server is to ignore TCP requests. Won't be able to setenv DISPLAY <remotehost> Re-enable in /etc/gdm.conf: DisallowTCP=false

sed

sed -e <expression>
Useful tcsh script to convert graphic file formats (assumes imagemagick installed):

tcsh> foreach i (*.bmp)
foreach? convert $i `sed -e s/bmp/png/`
foreach? end

rsync

When using in windows: rsync -rvTL

GRUB

See grub-cribsheet. Included here:

+ show block

GRUB

Tips and Tricks

From Ref. [1]:

On my USB flash memory key, I created a root folder named boot to hold all the data necessary for USB booting (see figure 2). Under the boot folder, I created a directory named grub for GRUB-related files, images which are initial ramdisk (initrd), floppy, or disk images, and finally kernels to hold all the kernels

…you’ll need to copy some of GRUB’s stage files, including stage1, stage2, and fat_stage1_5, and put them into the boot/grub directory on the USB flash memory key

…install GRUB to the Master Boot Record (MBR) of the USB flash memory key. Luckily, it’s the same process as installing to a hard drive.

One cool trick is to use GRUB and memdisk to boot floppy disk images.

Install process example:

Find boot images: grub> find (hd2,0)/boot/im<TAB>
grub> root (hd2,0)
grub> setup (hd2)

First, download the DSL ISO9660 image, and either burn it to a CD, or mount it via loopback:

mkdir dsl-test
mount -t iso9660 -o loop dsl-image.iso dsl-test

Next, copy the KNOPPIX file, kernel, and initial ramdisk:

cp dsl-test/KNOPPIX/KNOPPIX /media/usb/boot/images/dsl
cp dsl-test/boot/isolinux/linux24 /media/usb/boot/kernels/dsl-linux24
cp dsl-test/boot/isolinux/minirt24.gz /media/usb/boot/images/dsl-minirt24.gz
sync
umount dsl-test && rmdir dsl-test

This assumes that your USB flash memory key is mounted at /media/usb. Next, edit the /media/usb/boot/grub/menu.lst file and make sure it looks like the entry in Sidebar 1. You might have noticed that the root line at the top of the menu.lst file says (hd0,0) even though we used (hd2,0) earlier. When you boot from the USB flash memory key, the key itself becomes hd0, even before the primary master hard drive.

DSL entry in menu.lst From Sidebar 1:

title DSL 1.2 (2.4.26) 1024x768 (save to RAM)
kernel /boot/kernels/dsl-linux24

ramdisk_size=100000
init=/etc/init
lang=us
apm=power-off
vga=791
toram nomce noapic quiet
knoppix_dir=images
knoppix_name=dsl

initrd=/boot/images/dsl-minirt24.gz

Manual

From Ref. [2]

Naming convention

First number: disk (starting with zero)
Second number: partion (starting with zero - extended partition numbering starts at 4)
Examples:
(hd1,0): 2nd disk, first partition
(hd0,4): 1st disk, first extended partition

Boot Linux

• Use find w/ <TAB> completion to locate vmlinuz
• Load the kernel: grub> kernel /vmlinuz root=/dev/hda1
• grub> boot

menu.lst

Syntax: configuration

• Comment lines with hash (#)
• default <num>: Set which entry <num> to load on default, starting with 0
• timeout <sec>: Number of seconds to wait before booting default
• title <desc>: Delimits entries. Include a short description to be displayed in the menu
• root <device>: Set the root device grub will use. Device holds path to kernel file on next line
  • Specify root device directly to find kernel: kernel (hd1,0)/vmlinuz root=/dev/hdb1
• kernel <file> <flags>: device/path to file for grub to load. <flags> are passed verbatim as the kernel command-line.
• initrd <file>: device/path to INITial RamDisk for boot image
• No need to end with a boot command, grub will call automatically

Chainloader

Use to hand off boot process to another bootloader. Of course it could be another GRUB

Typical chainload

grub> rootnoverify (hdX,Y)
grub> chainloader +1
grub> makeactive
grub> boot

The +1 on chainloader hands off booting to the first block of the current device

Boot USB from hardrive GRUB menu

Assuming USB stick device maps to (hd2) when grub loads off the hard drive:

grub> root (hd2,0)
grub> chainloader (hd2)+1
grub> boot

The (hd2)+1 on chainloader hands off booting to the first block of the specified device, in this case (hd2). This
seems to be necssary if grub loaded off of a different device.

Change default boot device

Construct menu.lst items so that the operating system selected will be the default boot operating system on next startup.

See savedefault and default. Also consider fallback.

# By specifying saved here the default entry is the entry previously saved with the command savedefault
default saved

title O/S 1
root (hdX,Y)
kernel /boot/KERN root=/dev/sdZZ
initrd /boot/INITRD
savedefault

title O/S 2
root (hdA,B)
kernel /boot/KERN
savedefault

Boot an ISO

See Linuxquestions

title KNOPPIX
root (hd0,0)
kernel /linux26 ramdisk_size=100000 fromhd=/dev/hda4
initrd /minirt26.gz
savedefault
boot

Bibliography

1. Free Software Magazine, Grub tips and tricks

2. GNU, GRUB Manual

Tiger

Tiger security output explanation use: tigexp <output code>

gdb

+ show block

• Gnu GDB page: http://sourceware.org/gdb/download/
• For windows, get gdb under MinGW: http://www.mingw.org/download.shtml
• See good example usage here: http://freedroid.sourceforge.net/dev_docu/node4.html Following is excerpted from this reference
  • Start debugger: gdb
  • Inside debugger cd to the executable directory
  • Specify program to run: file <program>
  • Execture loaded file with: run
  • After it crashes run: info stack
  • Record debugger output and send to developer

Chmod permissions

+ show block

• A numeric mode is from one to four octal digits (0-7), derived by adding up the bits with values 4, 2, and 1. Any omitted digits are assumed to be leading zeros.
  • The first digit selects the set user ID (4) and set group ID (2) and sticky (1) attributes.
  • The second digit selects permissions for the user who owns the file: read (4), write (2), and execute (1)
  • The third selects permissions for other users in the file's group, with the same values
  • The fourth for other users not in the file's group, with the same values.

Apache

• enable mods with a2enmod, for example to startup php:
  • a2enmod php5

Postfix

+ show block

You have several choices for general configuration at this point. If you have your debconf priority set to 'low' or 'medium', you will be asked more questions later. You can always run dpkg-reconfigure —priority=low postfix at a later point if you want to see these questions again.

No configuration - IF YOU WANT THE INSTALL TO LEAVE YOUR CONFIG ALONE, CHOOSE THIS OPTION. no configuration changes will be done now: If you have not already configured Postfix, your mail system will be broken and should not be used. You must then do the configuration yourself by editing /usr/share/postfix/main.cf.dist and saving your changes as /etc/postfix/main.cf, or by running dpkg-reconfigure Postfix. main.cf will not be modified by the Postfix install process.

Internet site - mail is sent and received directly using SMTP. If your needs don't fit neatly into any category, you probably want to start with this one and then edit the config file by hand.

Internet site using smarthost - You receive Internet mail on this machine, either directly by SMTP or by running a utility such as fetchmail. Outgoing mail is sent using a smarthost. optionally with addresses rewritten. This is probably what you want for a dialup system.

Satellite system - All mail is sent to another machine, called a "smart host" for delivery. No mail is received locally.

Local delivery only - You are not on a network. Mail for local users is delivered.

Video for Linux (v4l)

+ show block

Requires ivtv-utils to be installed.

• Reference: [http://wilsonet.com/mythtv/fcmyth.php#capture|Myth(Tv)ology]
• List tuner card inputs: /usr/bin/v4l2-ctl -n
• Set tuner card input for usage: /usr/bin/v4l2-ctl -i <num>
• Tune card to a channel: /usr/bin/ivtv-tune -c <channel]>
• Test video capture: cat /dev/video0 > /tmp/test_capture.mpg (ctrl-c to stop capture)
• Test captured video: mplayer -vo xv /tmp/test_capture.mpg
• Display all available information about current settings: /usr/bin/v4l2-ctl —all
• List standards — could be particularly useful to set a specific pal variant: /usr/bin/v4l2-ctl —list-standards
• Test tuner: mplayer /dev/video0

But do note that not all cards have their tuner input at position 0, so take a look at the output of v4l2-ctl -n to see what your other options might be.

NFS

+ show block

• See: [http://ubuntuguide.org/wiki/Ubuntu:Feisty#NFS_Server|here]
• For ubuntu, nfs package: aptitude install nfs-kernel-server nfs-common portmap
• Create /etc/exports, ex:
  • # NFS exports of shared directories
  • /video/recordings gamut(ro)
  • /video2 gamut(rw)
• export the exports: sudo exportfs -a
• mount: sudo mount -t nfs iris:/video2 /mnt
• add an /etc/fstab entry, ex:
  • iris:/video2 /mnt/video2 nfs

fsck

+ show block

Q. I want to force fsck on the next reboot? How do I force fsck? Is there any configuration file that I need to alter….
A. fsck is used to check and optionally repair one or more Linux file systems. You don't have to create or alter/modify any file. All you need to do is just create empty file /forcefsck.

By creating /forcefsck file you will force the Linux system (or rc scripts) to perform a full file system check.

On ext2/ext3 file systems (optional -v for verbose, recommended:
Find and mark bad blocks with:
fsck -vcc <device> (-cc does a read/write not destructive test -c just does a read test)
Force a filesystem check:
fsck -vfp (-p for preen, to autofix if possible. Run without for manual fixing which may be necessary if bad blocks were found by -c)

dd

+ show block

Source: Ubuntu docs
Creating disc images using dd

Suitable for backing up entire disks. Open a terminal (in the examples you will need to replace hda with the partition you wish to backup).

Create a hard disk image:
dd if=/dev/hda1 of=/home/hda1.bin

Create a compressed disk image:
dd if=/dev/hda1 | gzip > /home/hda1.bin.gz

Back up the MBR:
dd if=/dev/hda of=/home/hda.boot.mbr bs=512 count=1

Restore MBR (from a Live CD):
dd if=/mnt/hda1/home/hda.boot.mbr of=/dev/hda bs=512 count=1

Backup a drive to another drive:
dd if=/dev/hda of=/dev/hdb conv=noerror,sync bs=4k

The command:
dd -if /dev/hda1 > partitionimage.dd
will backup "/dev/hda1", the first partition on hda1. A whole drive (including the MBR) could be backed up using just /dev/hda as the input "file". Restoring is done by:
dd -if partitionimage.dd -of /dev/hda1

You can use the "loopback device" to mount this partition image, making it easy to read the old version of files and still keep your current version untouched. [WWW] Mounting disks with Linux's loopback device by Jason Boxman

tar

• Useful flags: -C, —directory=DIR : change to directory DIR
• Example: tar cf - . | tar —directory=/targetdir -xvf -

Backup database

+ show block

mysqldump —all-databases > outfile.sql
to specify the root database user and prompt for the password:
mysqldump -u root -p —all-databases > outfile.sql
The most common use of mysqldump is probably for making a backup of an entire database: mysqldump db_name > backup-file.sql
You can read the dump file back into the server like this: mysql db_name < backup-file.sql

Set timezone

tzconfig

ps

• Process table queries for ps: -p pid, —user <username> -l long format -f full listing -w wide format
  • ps -p <pid> eww

Netstat

• useful flags: -v verbose, —numeric-ports, -c continuous update, -p program and process ids, —inet inet protocol
  • netstat -vpn —inet

grep

• Useful flags: -v, —invert-match : invert match sense

Iptables

+ show block

Useful command lines

• iptables -L -v : List current rules
• iptables -I INPUT 3 -s \! <ip-number> -j DROP : Insert rule number 3 to drop all packets not originating from source <ip-number>
• iptables -D INPUT -s \! <ip-number> -j DROP : Delete previous rule
• iptables-save is used to dump the contents of an IP Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file.

Detailed Information

• For example, to save rules after a reboot, do iptables-save > /etc/iptables.rules then in /etc/network/interfaces add the rule under the primary network interface: pre-up iptables-restore < /etc/iptables.rules Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.
• Useful Flags:
  • -L, —list [chain]; List all rules in the selected chain. If no chain is selected, all chains are listed.
  • -v, —verbose; Verbose output. This option makes the list command show the interface name, the rule options (if any), and the TOS masks.
  • TARGETS: ACCEPT, DROP, QUEUE, or RETURN.
    • ACCEPT means to let the packet through.
    • DROP means to drop the packet on the floor.
    • QUEUE means to pass the packet to userspace.
    • RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain.
  • TABLES: -t, —table table
  • -s, —source [!] address[/mask]: Source specification. Address can be either a network name, a hostname (please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea), a network IP address (with /mask), or a plain IP address.
    • filter: This is the default table (if no -t option is passed). It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets).
  • -d, —destination [!] address[/mask] Destination specification. See the description of the -s (source) flag for a detailed description of the syntax. The flag —dst is an alias for this option.
  • -j, —jump target This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.
    • TARGET EXTENSIONS
    • REDIRECT: This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains. It redirects the packet to the machine itself by changing the destination IP to the primary address of the incoming interface
    • REJECT: This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to DROP so it is a terminating TARGET, ending rule traversal.
    • TARPIT: Captures and holds incoming TCP connections using no local per-connec- tion resources. Connections are accepted, but immediately switched to the persist state (0 byte window), in which the remote side stops send-ing data and asks to continue every 60-240 seconds. Attempts to close the connection are ignored, forcing the remote side to time out the connection in 12-24 minutes.

• Verbose list of rules w/ reverse DNS: iptables -L -v
• List rules w/o reverse DNS: iptables -n -L
• Great Examples from [http://oceanpark.com/notes/firewall_example.html|Oceanpark.com]
  • I save this file as /etc/sysconfig/iptables-precursor and then source it and run iptables-save to create /etc/sysconfig/iptables, which is an input file consumed by the script /etc/rc.d/init.d/iptables, which in turn makes use of the script sbin/iptables-restore.
  • To configure the set of iptables rules:
    • /etc/rc.d/init.d/iptables stop
    • source /etc/sysconfig/iptables-precursor
  • To save the current set of iptables rules for use at next reboot:
    • iptables-save > /etc/sysconfig/iptables
  • To dynamically restart iptables after modifying /etc/sysconfig/iptables:
    • /etc/rc.d/init.d/iptables restart
    • Note that /etc/rc.d/init.d/iptables is a script. You can read it to gain understanding of how iptables uses iptables-restore to restore iptables firewall rules at reboot.
  • To examine the current set of rules in effect:
    • /etc/rc.d/init.d/iptables status OR
    • iptables -nvL -t filter
    • iptables -nvL -t nat
  • To configure iptables to be used at next system reboot:
    • chkconfig —add iptables
  • To see if iptables is currently configured to start at boot, do:
    • chkconfig —list iptables
  • the script is just for a single server IP, hence all of the "/32" network masks below.
  • I place the echo commands into /etc/rc.d/rc.local so that they will be executed at boot time. To permit machines internal to the network to be able to send IP packets to the outside world, enable IP Forwarding:
    • echo 1 > /proc/sys/net/ipv4/ip_forward
  • Prevent SYN floods from consuming memory resources:
    • echo 1 > /proc/sys/net/ipv4/tcp_syncookies
  • Defaults are to DROP anything sent to firewall or internal network, permit anything going out.
    • iptables -P INPUT DROP
    • iptables -P FORWARD DROP
    • iptables -P OUTPUT ACCEPT
  • Flush (-F) all specific rules
    • iptables -F INPUT
    • iptables -F FORWARD
    • iptables -F OUTPUT
    • iptables -F -t nat
  • The rest of this file contains specific rules that are applied in the order listed. If none applies, then the above policy rules are used.
  • Forward all packets from eth1 (internal network) to eth0 (the internet).
    • iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
  • Forward packets that are part of existing and related connections from eth0 to eth1.
    • iptables -A FORWARD -i eth0 -o eth1 -m state —state ESTABLISHED,RELATED -j ACCEPT
  • Permit packets in to firewall itself that are part of existing and related connections.
    • iptables -A INPUT -i eth0 -m state —state ESTABLISHED,RELATED -j ACCEPT
  • Allow all inputs to firewall from the internal network and local interfaces
    • iptables -A INPUT -i eth1 -s 0/0 -d 0/0 -j ACCEPT
    • iptables -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT
  • Deny any packet coming in on the public internet interface eth0 which has a spoofed source address from our local networks:
    • iptables -A INPUT -i eth0 -s x.y.z.s/32 -j DROP
    • iptables -A INPUT -i eth0 -s x.y.z.c/32 -j DROP
    • iptables -A INPUT -i eth0 -s 192.168.0.0/24 -j DROP
    • iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DROP
  • Accept all tcp SYN packets for protocols SMTP, HTTP, HTTPS, and SSH: (SMTP connections are further audited by our SMTP server)
    • iptables -A INPUT -p tcp -s 0/0 -d x.y.z.m/32 —destination-port 25 —syn -j ACCEPT
    • iptables -A INPUT -p tcp -s 0/0 -d 0/0 —destination-port 80 —syn -j ACCEPT
    • iptables -A INPUT -p tcp -s 0/0 -d 0/0 —destination-port 443 —syn -j ACCEPT
    • iptables -A INPUT -p tcp -s 0/0 -d 0/0 —destination-port 22 —syn -j ACCEPT
  • For some other custom server running here listening on port <port number>:
    • iptables -A INPUT -p tcp -s 0/0 -d 0/0 —destination-port <port number> —syn -j ACCEPT
  • For Samba (smbd and nmbd), restricted to specific local client hosts (x.y.z.c):
    • iptables -A INPUT -p tcp -s x.y.z.c/32 -d x.y.z.s/32 —destination-port 139 —syn -j ACCEPT
    • iptables -A INPUT -p udp -s x.y.z.c/32 -d x.y.z.s/32 —destination-port 137 -j ACCEPT
  • Finally, DENY all connection requests to any UDP port not yet provided for and all SYN connection requests to any TCP port not yet provided for. Using DENY instead of REJECT means that no 'ICMP port unreachable' response is sent back to the client attempting to connect. I.e., DENY just ignores connection attempts. Hence, use of DENY causes UDP connection requests to time out and TCP connection requests to hang. Hence, using DENY instead of REJECT may have the effect of frustrating attackers due to increasing the amount of time taken to probe ports.
    • iptables -A INPUT -s 0/0 -d 0/0 -p udp -j DROP
    • iptables -A INPUT -s 0/0 -d 0/0 -p tcp —syn -j DROP

samba

+ show block

• To check the ability to access the smbd daemon services, execute the following: smbclient -L localhost -U%
• Now verify that Samba correctly handles being passed a username and password, and that it answers its own name. Execute the following: smbclient -L server -Uroot%password
• Test smb.conf config syntax: testparm
• Ubuntu restart server /etc/init.d/samba restart
• Samba HOWTO
• Samba By-Example
• To mount a windows share

mount -t smbfs -o username=<user> //<host>/<dir> /mnt
or
mount -t cifs -o user=<user> //<host>/<dir> /mnt

• List public SMB shares with: smbclient -L //server -U user
• Connect to a SMB share with: smbclient //server/share -U user Enter you user password.
• Connect directly with: smbclient //server/share -U user%password Enter help for commands

nmap

+ show block

• nmap -v scanme.nmap.org

This option scans all reserved TCP ports on the machine scanme.nmap.org -v option enables verbose mode.

• nmap -sS -O scanme.nmap.org/24

Launches a stealth SYN scan against each machine that is up out of the 255 machines on class C to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and OS detection.

• nmap -sV -p 22,53,110,143,4564 198.116.0-255.1-127

Launches host enumeration and a TCP scan at the first half of each of the 255 possible 8 bit subnets in the 198.116 class B address space. This tests whether the systems run sshd, DNS, pop3d, imapd, or port 4564. For any of these ports found open, version detection is used to determine what application is running.

Fedora

+ show block

rpm

• Query all installed packages

alias rpmlist rpm -aq

• List installed files in a package (requires package name)

alias rpmfiles rpm -ql

• List info on a package (requires package name)

alias rpminfo rpm -qi

• Install a package (requires package name)

alias rpminstall rpm -ivh
alias lsyum yum list installed

• Show a list of all available packages including those not currently installed

alias lsallpkgs up2date —showall

• Show a list of all available packages but are not currently installed

alias lsavail up2date —show-available
alias showservs chkconfig —list

• From: https://lists.dulug.duke.edu/pipermail/yum/2006-August/009021.html

It sounds like you need to rebuild your RPM database. When you killed yum, I'm sure it had the RPM db open and now it's in an inconsistent state.
Kill all yum and rpm processes.
rm -f /var/lib/rpm/__db*
rpm —rebuilddb (add -vv if you want to see what it's doing)
Retry yum update.

• Yum Faq: http://wiki.linux.duke.edu/YumFaq?

Ubuntu

Services

• Howto Bootup
  • Make the init.d script not-executable… you'll get an error in startup, but it won't run.
• More clean way with config

Runlevels

• sysv-rc-conf

Package management

aptitude

+ show block

Here is some basic information on how to use the Apt package management tools.

• Installing packages: sudo aptitude install <packagename>
  • Examples: sudo aptitude install mpd sbackup
• Removing packages: sudo aptitude remove <packagename>
  • Examples: sudo aptitude remove mpd sbackup
• Searching for packages: sudo aptitude search <keywords>
  • The most common states are:
    • p, meaning that no trace of the package exists on the system
    • c, meaning that the package was deleted but its configuration files remain on the system
    • i, meaning that the package is installed
    • v, meaning that the package is virtual
  • Examples: sudo aptitude search Music MP3
  • Examples: sudo aptitude search "Text Editor"

• Updating Apt database (used after adding/removing Apt repositories): sudo aptitude update

• Upgrading packages: sudo aptitude upgrade
• Upgrade entire distribution: sudo aptitude dist-upgrade

dpkg

+ show block

• Install downloaded Ubuntu (Debian) package (.deb): sudo dpkg -i package.deb
• Remove Ubuntu (Debian) package: sudo dpkg -r package
• Reconfigure/Repair installed package: sudo dpkg-reconfigure package
  • Examples: sudo dpkg-reconfigure mpd
• dpkg -l | —list package-name-pattern … List packages matching given pattern.
• dpkg -s | —status package-name … Report status of specified package.
• dpkg -L | —listfiles package … List files installed to your system from package.
• dpkg -S | —search filename-search-pattern … Search for a filename from installed packages.
• dpkg -p | —print-avail package Display details about package, as found in /var/lib/dpkg/available.
• dpkg —configure <packagename> : configure <packagename>

apt-get

+ show block

• apt-get -s <command> : Simulate <command> to show what would happen if run without -s flag
• apt-get autoremove : Remove packages that were installed as dependencies but are no longer needed
• apt-get -f <command> : Fix broken packages. If it can't find a solution use dpkg —remove to manually delete problem packages.
• dpkg —get-selections: List installed packages
• apt-cache search <string>

Configure X

+ show block

Reference here

• Rerun the autodetect script: sudo dpkg-reconfigure xserver-xorg
• To run the detection script and request input values from user: sudo dpkg-reconfigure -plow xserver-xorg

Alacarte

• Configure GNOME menus using Alacarte by pressing Alt+F2 and typing alacarte

locale

To see the list of valid locales, enter the following command:

locale -a

Listing hardware

• lshw -C disk List disk hardware devices
• lshw -short
• lsusb
• lspci

Compiz

Manually launch Compiz Configuration Settings Manager using ccsm. Useful if window manager is broken, and you can only get an xterm in failsafe mode.

Compiz services can be selectively turned off by deleting their entry in ~/.config/compiz/compizconfig/Default.ini

Also, debug the directory ~/.gconf/apps/compiz especially general/allscreens.
In one particular case, I broke compiz by enabling Accessiblity/Magnifier
Edit ~/.gconf/apps/compiz/general/allscreens/options/%gconf and remove the entry for mag.

GNOME

If window manager is broken, consider purging/renaming ~/.gconf directory. If that fixes it, see if you can find the offending configuration setting.