On Wed, 2011-06-08 at 08:49 +0200, Per Jessen wrote:

Gary Hodder wrote:

...

Hi all,

can somebody help me with a script using mp3info that will only print out number of files in a directory and number of files with a bit rate of less than 192k. I look after a community radio station and a presenter is modifying the station music collection, I need to catch this guy in the act. I want to run this script from cron before and after his show and send it to a smb printer in the office.

Hi Gary,

would it suffice to look at the most recently changed files? That could be easily done with find, and you could have the results emailed.

/Per

Hi Per, He is also changing the name, date and time stamp to the same as the original. Thanks Gary. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, 2011-06-08 at 09:35 +0200, Per Jessen wrote:

Gary Hodder wrote:

...

On Wed, 2011-06-08 at 08:49 +0200, Per Jessen wrote:

...

Gary Hodder wrote:

...

Hi all,

can somebody help me with a script using mp3info that will only print out number of files in a directory and number of files with a bit rate of less than 192k. I look after a community radio station and a presenter is modifying the station music collection, I need to catch this guy in the act. I want to run this script from cron before and after his show and send it to a smb printer in the office.

Hi Gary,

would it suffice to look at the most recently changed files? That could be easily done with find, and you could have the results emailed.

/Per

Hi Per,

He is also changing the name, date and time stamp to the same as the original.

Okay - how about using md5sum to create checksums then? Those are easily done too, and the check is also simply done by running md5sum again.

Ok md5sum works well but doesnt catch all. find ./ -type f -print0 | xargs -0 md5sum >> /file.md5 Then to check md5sum -c --quiet /file.md5 This worked fine no failed files. There are text files for each mp3 that holds fade times etc, so removed a carriage return at the end of one file. That file failed checksum on next scan. Replaced the carriage return rescanned and all was ok. So with md5sum a file can be modified then put back to the original state before the next scan and md5sum wont pick that up. Thanks Gary. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Gary Hodder said the following on 06/08/2011 07:43 AM:

So with md5sum a file can be modified then put back to the original state before the next scan and md5sum wont pick that up.

Thanks Gary.

In one sense this is no different from the traditional hacker-security spiral. So long as the "bad guy" has adequate access power he can keep moving ahead of you. The only way you are going to be able to address this is to STRUCTURE the directories and files so that there is a clear separation between what can be changed ad-hoc and what can't be .... an by whom. Yes, Linux access controls are up to this, probably without even using extended ACL. You need to think in terms of GROUPS rather than simply "everyone" and "root". You need to remember that many of the operations you've talked about relate to directory rather than file access. So long as the directories concerned are writeable by "other" none of the techniques discussed are solid enough to escape subversion. As you say, the perpetrator can always keep a copy of the original and restore it, then use 'touch' to reset the times. You need to apply access controls to directories and that will mean restructuring some of the 'hierarchy'. All that being said, there are two other avenues worth looking at. The first amounts to logging. If this is being done with a shell, then there will be a shell history. Yes, the perpetrator can zap that file, but doing so is also evidence. I'm sure you can figure a way to make his .bash_history "append only" or mirror it to something impermeable. Suggestions, people? There are other ways of command logging, and failing that, a restricted shell. A menu is the ultimate restricted shell: you can only do what's in the menu. The second is a bit more extensive. Ultimately this use of the file system is treating it as a database. If you re-implemented it s a database then the set of commands, the logging and the access control would be different and possibly more constrained. This is worth looking at as a mental exercise since it will make you think about the roles and access and how they can be applied to the file system model. -- If you need to be told what your values are the implication is that you don't hold them right now. If you hold your values strongly enough, you don't need to print them out and stick them on a wall. If everyone shares them, they don't need to read them off a wall, either. -- Marcus J. Ranum -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Gary Hodder said the following on 06/08/2011 09:10 AM:

Hi Anton,

a little more history needed. I am the only one that has a shell account, the rest don't no what Linux is let alone use it.

Lacking a shell account there is a limit to what they can do. Not all Linux file attributes and access cotnrols are mapped to Windows.

All access is by samba, the main comp (winblows) thats a player and also does automation needs full access to the music directories.

I doubt that very much! It just looks that way! The automation process needs access but that doesn't mean the relevant directories have to be universal rw. I can think of a number of ways of addressing that. The key is that the process runs under an ID that permits access. This is a Linux file system, yes, so there is going to be some kind of ID mapping. I've seen this done at client sites but I'm no SAMBA expert. I have run into the converse problem: an ID of mine on the windows network that can't access a Linux file of mine in my home tree that is SAMBA mounted. Annoying but ultimately resolved -- it had to do with ID mapping.

When new material is added to the library you have to run a cataloger which makes a catalog in the top directory and a small file for each mp3 that contains cross fades levels etc. so the find song can find the new stuff.

If worst comes to worst there are overlay file systems ... How about mounting the FS rw when the cataloguer has to run then remounting it ro ??

Its a no win situation, this thing has no security at all. I have setup a rivendell box but they are to scared to use it, might have to put the good stuff on it and force them onto it.

Tell me again, why is this important? Why does it matter, other than as an intellectual exercise and a personal afront? . -- What is wanted is not the will to believe, but the will to find out, which is the exact opposite. --Bertrand Russell, _Skeptical Essays_ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R. said the following on 06/08/2011 10:54 AM:

On 2011-06-08 15:24, Anton Aylward wrote:

...

The automation process needs access but that doesn't mean the relevant directories have to be universal rw.

Windows normally expects RW. If the application they use allows editing the mp3 metadata, it needs RW and will check for it (ie, try to open files RW). Or, it needs RW for the auxiliary files where the other info they need for the station.

Yes, but WHAT rw? Samba doesn't demand the "other" rw bits to be set. Don't forget: Linux system permissions take precedence over Samba permissions. If I have a file -rw------- 1 anton anton 2106714 Nov 18 2009 bookmarks.html then what? I can also use the "read list", "valid users", "admin users" and "invalid users" The first is good- sets READ ONLY. I can also use both userid and group, so I can set a user to be read only if he's not in a specific group. Which gets back to what I was saying earlier. It helps to know a bit about sets when setting up groups. For example, -rw-rw---- 1 anton anton 2106714 Nov 18 2009 bookmarks.html is very different from -rw-rw---- 1 anton users 2106714 Nov 18 2009 bookmarks.html in the second case valid users = .... @users will grant permission, whereas in the first it won't. Of course you still need the username mapping of the Windows login "Joe Sixpack" to the Linux ID "sixpackj" and the entry in /etc/groups I've seen many sites where access control is ignored and "guest" is used and files are rw-rw-rw-. The root cause of this is laziness mixed with frustration. If that's the case then there's no further point in discussing this. -- "We stand behind all of our products, except for the manure spreader." -- Corporate motto of an equipment manufacturer -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Carlos E. R. said the following on 06/08/2011 03:07 PM:

On 2011-06-08 17:34, Anton Aylward wrote:

...

Carlos E. R. said the following on 06/08/2011 10:54 AM:

...

Yes, but WHAT rw?

...

Samba doesn't demand the "other" rw bits to be set. Don't forget: Linux system permissions take precedence over Samba permissions.

...

If I have a file -rw------- 1 anton anton 2106714 Nov 18 2009 bookmarks.html then what?

If the user that samba presents to linux is anton, it will be RW to windows. Any other user, will be -r.

That's my point, as I went on to discuss in my original posting, the stuff you've snipped. SAMBA doesn't break Linux access controls. Let me repeat: Linux system permissions take precedence over Samba permissions. The kicker is to make use of ID. If the Windows users don't log on and identify themselves individually then all bets are off - you can't identify *who* is doing a particular operation. But if they do, you can make files and directories read-only with respect to specific users or groups of users. That's WINDOWS users. -- 'Faith' means not _wanting_ to know what is true. -- Nietzsche, Der Antichrist -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Gary Hodder writes:

I got the below from your script.

./192check: line 8: [: Variable: integer expression expected ./192check: line 8: [: Variable: integer expression expected Total number of mp3 files: 2169 Total number of mp3 files < 192 kbps: 1108

Guessing here line 8 the rate, is the mp3 doesn't contain bit rate in the id3 tag?

Strange, I don't think I have seen a mp3 with no bitrate info. Try getting a list of the offending files with something like this: ---- #!/bin/sh for i in *.mp3 do rate=`mp3info -p "%r" "$i"` if [[ $rate != [0-9]* ]]; then echo "$i" fi done ---- and look at them manually.

In another directory it picked up a corrupted mp3 and named it, excellent thank you very much.

No problem. Charles -- "If you want to travel around the world and be invited to speak at a lot of different places, just write a Unix operating system." (By Linus Torvalds)