Protocol digging

The netgear DGND3300 will log certain things to a remote listening syslogd, but they don't document facilities/priorities which makes it a lot less useful.

So from wireshark:

1. auth.info logins/login attempts
2. local0.warning external probes on the firewall (rule match)
3. syslog.info ntp requests to time-g.netgear.com (weird facility)
4. syslog.notice ddns requests and outcomes

Letters have no meaning

Xephyr occasionally gets more than a little confused about the current keyboard settings (caps lock get forced on... etc). One or more of the following sometimes restore normality:

• xkbset nullify lock
• setxkbmap gb
• restart the window manager as a last resort 

Into the Box

Mounting a box account as a file system on gentoo - as root:

1. unmask net-fs/davfs2-1.4.7 in portage
2. emerge -av davfs2
3. gpasswd -a ${your_user} davfs2
4. mkdir -p /dav/${your_user}
5. chown ${your_user}:${your_user} /dav/${your_user}
6. echo 'https://www.box.com/dav /dav/${your_user} davfs rw,user,noauto 0 0' >> /etc/fstab

Then as ${your_user}:

1. mkdir -p ~/.davfs2
2. echo "https://www.box.com/dav ${box_username} ${box_password}" >> ~/.davfs2/secrets
3. chmod 0600 ~/.davfs2/secrets
4. echo "use_locks 0" >> ~/.davfs2/davfs2.conf
5. mount /dev/${your_user}

The output from from df is wrong, but whatever... from the davfs2 README:

- If the server does not support RFC 4331 (most servers don't), davfs2 cannot
  calculate the free disk space on the server. ... So davfs can't help but lie. I tried to
  make the numbers look funny, so you will notice they are faked.

User env & non-interactive ssh

HP-UX has /etc/PATH which is read by /etc/profile except when you use ssh for remote command execution.

The trick to get a custom PATH is to add this to authorized_keys:

...
environment="BASH_ENV=.profile" ssh-dss AAAAB3NzaC1k{rest of relevant key}
...


Also check that this is set in sshd_config:

PermitUserEnvironment yes

check before/after with: ssh server env

Back-words & fore-words

xsel to move text selections back and forth from a tvtwm nested in a Xephyr and another display (e.g. the parent):

"C"   = m4 : all : f.exec "xsel -o | xsel --display :0.0 -i"
"V"   = m4 : all : f.exec "xsel --display :0.0 -o | xsel -i"

Super_L+C copies the current selection in a tvtwm managed display to :0.0
Super_L+V copies the current selection from :0.0 into the tvtwm managed display selection

mod4 (m4)  is Super_L, mapped to the MSWin key, when:

1. Windows Key is Super_L from xev 
2. Super_L is mapped inside Xephyr to mod4

And the mapping from inside the Xephyr display can be determined by:

$ xmodmap -p|grep Super_L
mod4        Super_L (0x85),  Super_R (0x86),  Super_L (0xce),  Hyper_L (0xcf)

$

The opposite direction from KDE4 to Xephyr:

System-Settings->Shortcuts and Gestures->Custom Shortcuts->Edit->New->Global Shortcut->Command/URL

The two new shortcuts can be put into a their own group and then exported/imported.

LXC through the looking glass

Checklist for an lxc gentoo (taken from a pre-existing image) container hosted on gentoo:

1. Start with Diego's static device tarball (to avoid TIOCSCTTY "open /dev/tty failed errors" "could not set controlling tty" from sshd)
2. To see boot up messages and avoid warnings from /etc/issue add: mknod -m 600 console c 5 1
3. Remove udev and all other not-relevant services (/etc/runlevels)
4. The container config should have: 'lxc.tty = 12' and 'lxc.pts = 128'
5. The container fstab should not have a /dev/pts devpts mount (cf newinstance mount option)
6. Stop the guest init from running gettys as required.

Then all that is needed is:

1. lxc-start -n konuk
2. lxc-console -n konuk
3. lxc-stop -n konuk

Debug

Useful for debugging are:

1. List running processes in the lxc: pstree $(lxc-info -n sakc1 --pid | awk '{ print $2 }')
2. The guest container log when the guest is started with: lxc-start -n konuk -l DEBUG -o /tmp/lxc.log
3. The guest /var/log/auth.log (configure sshd to report to it - /etc/ssh/sshd_config)

Cherrypick patch from the staging lxc on github:

--- lxc-ps_orig    2012-11-21 21:19:11.000000000 +0000

+++ lxc-ps      2013-01-20 22:24:32.000000000 +0000

@@ -56,7 +56,8 @@

                init_cgroup=${fields#*:}

 

                # Get the filesystem mountpoint of the hierarchy

-               mountpoint=$(grep -E "^cgroup [^ ]+ [^ ]+ ([^ ]+,)?$subsystems(,[^ ]+)? " /proc/self/mounts | cut -d ' ' -f 2)

+               mountpoint=$(awk -v subsysregex="(^|,)$subsystems(,|\$)" \

+                           '$3 == "cgroup" && $4 ~ subsysregex {print $2}' /proc/self/mounts)

                if [ -z "$mountpoint" ]; then continue; fi

 

                # Return the absolute path to the containers' parent cgroup

fstab

sysfs needs to be mounted so that the net scripts can see the various network interfaces are present - they check for entries in: /sys/class/net

Add to the container fstab (note: localmount may not run):

...

sysfs                   /lxc/konuk/sys                  sysfs   defaults 0 0

...

The symptom is:

 * Bringing up interface lo

 *   Caching network module dependencies

 *   ERROR: interface lo does not exist

 *   Ensure that you have loaded the correct kernel module for your hardware

 * ERROR: net.lo failed to start

Long delays ssh'ing into HP-UX

Easy to fix when you know:

# cd /var/adm

# cp /dev/null wtmps

# cp /dev/null btmps

Nesting X

The Xephyr kdrive X server for running a more development oriented X11 window manager (xterm's) inside another environment (e.g. kde). For gentoo setting the kdrive use flag will cause Xephyr to be built.

#!/bin/bash
# kde system-settings->keyboard settings->advanced->Alt/Win key behaviour->
#   -> Meta is mapped to Left Win
nest_display=${1:-":7"}
geometry=${2:-"1915x1150"}

nohup Xephyr -ac -screen $geometry -nolisten inet6 $nest_display &

sleep 2

export DISPLAY=$nest_display

delayed()
{
    xrdb ~/.Xdefaults
    setxkbmap ie

    xmodmap ~/.xmodmap
}

(sleep 7; delayed ) &

# -s : only manage the specified display (DISPLAY)
exec tvtwm -s

vmware through a keyhole

Finding all your vm's mice borked? (restricted to the top right hand area of the screen - broken everywhere else)

Try putting this into your environment:

VMWARE_USE_SHIPPED_GTK=yes

And ignore startup theme errors.

Thanks to forums.gentoo.org

One mbox to hold 'em all

Roll your own IMAP mailbox into gmail:

1. git clone git://github.com/rgrove/larch.git
2. git clone git://gitorious.org/trollop/mainline.git
3. emerge -av highline

The larch Copy all folders recursively option gave me some problems, and since I wanted to do some mapping of folder names to different labels on gmail:

1. Make a list of folders on the from server - I used the contents of my thunderbird directory. E.g. something like:

   find . -name '*.msf' | sed -e 's/.msf//' -e's/.sbd//g' -e 's/-1//' -e 's/.\///'|sort|uniq

2. xemacs above to create a file, with one line for each folder with a simple format: from_format to_label
3. Feed into a script something like:

while read from to ; do
ruby -Imainline/lib:larch/lib  \
 larch/bin/larch \
      --from imap://imap.example.foo --from-user XYZ --from-pass OPW \
      --to imaps://imap.gmail.com --to-user ABC --to-pass DEF \
      --from-folder $from --to-folder $to
done

push the button Max, err Gunther

Why did I want this in the first case? - but anyway, it seems to work by:

1. Following the tip

2. Download tweetdeck or just:

wget http://www.tweetdeck.com/beta/TweetDeck_0_25.air

For 26.4 (8 July 2009) this changed to:

http://downloads.tweetdeck.com/TweetDeck_0_26.air

3. Running the app with (note slight typo fix for app directory to tip in #1):

/opt/AIR-SDK/bin/adl -nodebug /opt/AIR-apps/TweetDeck_0_25/META-INF/AIR/application.xml /opt/AIR-apps/TweetDeck_0_25

It complains about:

I/O warning : failed to load external entity "/etc/opt/Adobe/certificates/crypt//config.xml"
Unable to parse Document: /etc/opt/Adobe/certificates/crypt//config.xml.

But otherwise appears to run, just with lots of warnings like:

warning: unable to bind to property 'tTextHTML' on class 'Object' (class is not an IEventDispatcher)
warning: unable to bind to property 'tSource' on class 'Object' (class is not an IEventDispatcher)
warning: unable to bind to property 'tUserID' on class 'Object' (class is not an IEventDispatcher)

Wait Up

If you find service startup (e.g. samba) failing because an interface started in the background isn't up in time, then waitup may be an answer:

#!/bin/bash

IFACE=$1
count=0
echo -n "Wait for ${IFACE}"

while ! /sbin/ifconfig ${IFACE} 2>/dev/null | grep -q "UP" ; do
  echo -n "."
  sleep 1
  count=`expr $count + 1`
  if [ $count -gt 10 ] ; then
     echo "not found in 15sec - bailing"
     exit 1
  fi
done

echo ". ($count)"

exit 0

Trust in Alsa

The Trust SC-5500p usb sound box isn't picked up by ALSA directly (audacious seems to work?) - the result is bad distorted/garbled sound. ALSA configuration is more complicated than most need.

Adding an asoundrc with channels 6 seems to get sound out at least (no dmix/mixing yet):

pcm.!default complex_convert

pcm_slave.sl3 {
   pcm "hw:0,0"
   channels 6
}
pcm.complex_convert {
   type plug
   slave sl3
}

Get Smart

smartmontools is a good thing -

• smartctl -a /dev/sda (dump all the SMART info on the disk)
  
• smartctl -t short /dev/sda (run a short self test)
  
• smartctl -t long /dev/sda (run a long self test)
  
• smartctl -l selftest /dev/sda (list the available self test results)
  
• smartctl -s on /dev/sda (to turn on SMART if its not on by default)
  

Running one long test a week is the suggestion here:

0     8      *   *     0     smartctl -t long /dev/sda >>/var/log/smart.log 2>&1
0     9      *   *     0     smartctl -l selftest /dev/sda >>/var/log/smart.log 2>&1

Setting:

SMARTD_OPTS="--interval=3600"

in /etc/conf.d/smartd is the only non default setting I made (for a laptop).

Funnies:

• One disk didn't have SMART enabled (all the rest did...)
• One (other) disk didn't list self tests in progress
• RAID confuses SMART on two servers I tried it on (a test started on one side of a mirror showed up on both

virtual runabout

To move a vm (on vmare 5.5.5) from

kernel 2.6.18-gentoo-r6 (old tools from the iso image)

to

kernel 2.6.24-gentoo-r3 and open-vm-tools (keyworded in portage)

1. the kernel LSI scsi driver is borked - resulting in the kernel panicing when it can't find the root device. Fix that by hand applying this patch.
2. the pcnet32 driver loads, but its interrupt is immediately disabled and no interface is created- so switch to the e1000 driver and be happy.
   

The vmx incantation to get an e1000 is:

ethernet0.virtualDev = "e1000"

And an updated patch:

--- mptbase.c_orig 2008-03-20 21:15:32.000000000 +0000
+++ mptbase.c 2008-03-20 21:17:46.000000000 +0000
@@ -2844,6 +2844,18 @@
pfacts->IOCStatus = le16_to_cpu(pfacts->IOCStatus);
pfacts->IOCLogInfo = le32_to_cpu(pfacts->IOCLogInfo);
pfacts->MaxDevices = le16_to_cpu(pfacts->MaxDevices);
+
+ /*
+ * VMware emulation is broken, its PortFact's MaxDevices reports value
+ * programmed by IOC Init, so if you program IOC Init to 256 (which is 0,
+ * as that field is only 8 bit), it reports back 0 in port facts, instead
+ * of 256... And unfortunately using 256 triggers another bug in the
+ * code (parallel SCSI can have only 16 devices).
+ */
+ if (pfacts->MaxDevices == 0) {
+ pfacts->MaxDevices = 16;
+ }
+
pfacts->PortSCSIID = le16_to_cpu(pfacts->PortSCSIID);
pfacts->ProtocolFlags = le16_to_cpu(pfacts->ProtocolFlags);
pfacts->MaxPostedCmdBuffers = le16_to_cpu(pfacts->MaxPostedCmdBuffers);

Switching to the buslogic driver (especially for new systems) would seem to be a better medium term solution.

The e1000 needs to be blacklisted to allow vmxnet grab the virtual ethernet dev - but a job for another day.

Following the golden thread

1. create TAGS

$ cd ~/src/TAGS && find . -name "*.[cph]" -print | etags --language=c++ --members -

2. tell xemacs where it is (e.g. .xemacs/init.el): (setq tags-file-name "~/src/TAGS")

3. Hit <meta>. to start finding things

4. read this for more options

Network Slight of Hand

The mysql proxy cookbook has this recipe:

iptables -t nat -I PREROUTING \
-s ! 127.0.0.1 -p tcp \
--dport 3306 -j \
REDIRECT --to-ports 4040

It redirects remote clients attempting to connect to the default mysqld listen port to the mysql proxy daemon instead.

I had a legacy application with no support for port selection:

iptables -t nat -I PREROUTING \
-p tcp --destination dummyhostname --dport 3306 \
-j REDIRECT --to-ports 4040

This directs any connection to the dummy host port 3306 to instead go to the proxy - neat.

From this HP-UX security summary we see that HP-UX has ipfilter (new enough versions seem to have nat - older ones don't) and puts filter rules in /etc/opt/ipf/ipf.conf :

rdr lan0 20.20.20.5/32 port 80 -> 192.168.0.5 port 8000

redirects traffic from port 80 to port 8000, or how about some load balancing:

rdr lan0 20.20.20.5/32 port 80 -> 192.168.0.5,192.168.0.6 port 8000

A useful trick where the legacy application doesn't know about off host destinations and you would like to punt some of the load to another box.

ipf won't act as a reflector, which appears to mean that something like this doesn't work, even when I think that it should:

/etc/opt/ipf/ipnat.conf:
rdr lo0 127.0.0.1/32 port 7777 -> 192.168.0.42 port 23

# ipnat -CF -f /etc/opt/ipf/ipnat.conf
# ipnat -l
# ipnat -sv

Curious, as the interfaces are different.

Its also not clear if you have to enable ip forwarding on HP-UX with:

# ndd -set /dev/ip ip_forwarding 1
# ndd -get /dev/ip ip_forwarding

gentoo recovery

gentoo based rescue disk options - the lwn distributions page is a good starting point:

1. sabayonlinux - appears to be kept up to date & comes in a mini-edition
2. the official 2007.0 gentoo live CD is getting on a bit now (SATA) [update 2008.0 beta]
   
3. the liveusb path is paved with bitrot.
4. flashlinux from 2005.
5. gnap - catalyst based...
6. sysresccd - catalyst based... USB install instructions look good (and is what I used in the end)
   
7. linux-live is a possible for pre-686 hardware
   

other random reading:

1. lwn has a good/scary article on gentoo for developers
2. paludis vs portage article
3. random blog posts sometimes pertaining to gentoo; drobbins blog

A False Sense of Security

Creating self signed certs is straight forward:

umask 277

openssl genrsa 1024 > host.key

openssl req -new -x509 -nodes -sha1 -days 365 -key host.key > host.cert

cat host.cert host.key > host.pem


You then import the generated cert in a client; e.g. with php/curl, the incantation is:

curl_setopt($ch, CURLOPT_CAINFO, '.../ssl/host.pem');

Et Voilà! we have a 'secure' communication path between client and server...

The hunt for AFK's

qcheck(1) is the key to looking for inconsistencies between what portage installed and a live system: qcheck -aTC

or with nice colour: qcheck -aT

Filtering out python, ... etc false positives (AFK appears to be qcheck code for missing files):

#!/bin/sh
DATE=`date +%Y%m%d`
OUT=${DATE}.log

qcheck -aTC >$OUT 2>&1

filter='/usr/lib/python2.4|/usr/lib/gimp/2.0/python|\
/usr/share/javatoolkit/pym|\/usr/kde/3.5/share/doc|\
/usr/share/icons/hicolor|/usr/share/webapps/phpmyadmin'

grep AFK $OUT | egrep -v $filter | sort >${DATE}-afk.log
grep MD5-DIGEST $OUT | egrep -v $filter | sort >${DATE}-md5.log