Hugh's Notes

Check if SSL CSR, Key and CRT match

2023-04-11T12:15:00.002-07:00

To view the md5 hash of the modulus of the private key:

$ openssl rsa -noout -modulus -in mykey.key | openssl md5

To view the md5 hash of the modulus of the CSR:

$ openssl req -noout -modulus -in mycsr.csr | openssl md5

To view the md5 hash of the modulus of the certificate:

$ openssl x509 -noout -modulus -in mycert.crt | openssl md5

If all three hashes match, the CSR, certificate, and private key are compatible. You can use

diff3

to compare the moduli from all three files at once:

$ openssl req -noout -modulus -in mycsr.csr > csr-mod.txt
$ openssl x509 -noout -modulus -in mycert.crt > cert-mod.txt
$ openssl rsa -noout -modulus -in mykey.key > privkey-mod.txt
$ diff3 csr-mod.txt cert-mod.txt privkey-mod.txt

If all three files are identical,

diff3

will produce no output.

Quickly Expand Linux Volume

2023-03-07T20:29:00.003-08:00

There are various complicated ways to expand a Linux volume. Here is an easy one using parted.

First, use command lsblk to show disk volume info, for example:

$ lsblk
NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
fd0           2:0    1    4K  0 disk 
sda           8:0    0   40G  0 disk 
├─sda1        8:1    0    1G  0 part /boot
└─sda2        8:2    0   19G  0 part 
  ├─cl-root 253:0    0   17G  0 lvm  /
  └─cl-swap 253:1    0    2G  0 lvm  [SWAP]

To expand cl-root volume, enter command:

parted ---pretend-input-tty /dev/sda resizepart 2 100%;
partx -u /dev/sda; pvresize /dev/sda2;
lvextend -r /dev/cl/root /dev/sda2

If the command does not work, just update parted by yum update parted. This works in CentOS 7.

Share mapped network drive for all users

2023-01-10T14:09:00.004-08:00

Normally a shared network drive is only accessible to the user who mapped it. Even when you use net use command in Command Prompt or PowerShell to map a network drive as Administrator, you will be surprised to find the drive is only available within the elevated Command Prompt or PowerShell window itself. It will not show in File Explorer.

In a small network environment, it is useful to allow all users using the same computer have ready access to the same mapped network drive, for example you have a team file server. You could use a login script to map drives for each and every user, or use a registry setting to share the mapped drive for all users.

Just create HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections DWORD and set the value to 1. Restart the computer to take effect.

You could use File Explorer to map network drives, or use command to do the same with option to enter different credential for access.

net use z: \\file_server\share_name password_here /user:username_here /persistent:Yes

Change Password Complexity Setting in Local Group Policy

2021-04-18T15:01:00.005-07:00

The Password complexity is a Local Policy setting named "Passwords must meet complexity requirements" under Computer Configuration/Windows Settings/Security Settings/Account Policies/Password Policy.

In a Server Core installation there is no graphical user interface to set this policy.
Instead use secedit to import and export the security settings from a Full Installation of Windows Server 2008.

First export your security configuration using the following command:

secedit /export /cfg C:\securityconfig.cfg
Then open notepad.exe and edit the C:\securityconfig.cfg file.
Under [System Access] you should find PAssword complexity = 1
Change the value to 0 and save the file.
Then fire up the next command to import the configuration:

secedit /configure /db C:\Windows\security\new.sdb /cfg C:\securityconfig.cfg /areas SECURITYPOLICY

Unlock and install custom ROM on LG G6 H872

2020-07-17T10:07:00.001-07:00

Lots of steps to get it done. I love it when everything is done. My LG G6 H872 abandoned by T-Mobile is now running Android 10 using Havoc OS 3.7 smoothly.

Generally followed the steps from https://forum.xda-developers.com/tmobile-g6/how-to/root-h872-to-including-11g-t3775518. For simplicity and memory, below is my steps in brief.

Download and install ADB platform on Windows computer.
Download and install LG G6 USB driver.
Plug in LG G6 via USB to ensure the connection is stable and USB driver loads correctly.
In phone Settings, tap Software Build six time to enable Developer Mode.
In phone Settings, get into Developer Mode to enable Developer Connection and Debugging
With phone plugged in USB, run ADB command adb devices to verify the phone is online.
Run ADB command adb reboot bootloader
When the phone is rebooted into Download Mode, enter command fastboot oem unlock. Command fastboot devices may not show the phone, but it works with oem unlock command. Finally adb reboot to reboot the phone. This completes bootloader unlock.
Hold Volume Up button, without touching power button, plug in phone to USB. It will get phone into download mode.
Download the special LGUP program.
Run it detect the plugged in phone in Download Mode,
Download the image of another LG phone with laf
Flash LG G6 with the image for laf only. Be careful with laf flashing. As soon as laf flashing step is over, pull the USB cable immediately. The process only take one or two seconds. So be careful to pull quickly.
Download the current stock ROM the phone is using.
Flash the ROM using LGUP to phone again but without laf.
Download FWULL and burn it into USB flash drive.
Boot computer using FWUL USB flash drive.
Make sure the computer has wire connection to Internet
Connect phone in Download Mode to FWUL computer.
Enter a few commands (search online) in FWUL to download and install TWRP recovery system onto laf partition. This completes TWRP installation.
Reboot computer into Windows for more ADB commands.
Hold Volume Up button and plugin phone to get into Download Mode. Wait a while, it will go into TWRP.
In TWRP, ignore password, do a factory reset.
Download custom ROM Havoc OS for LG G6 and GAPPS 10 for ARM micro. Copy them into ADB folder.
Put phone into Sideload mode,
Run ADB command to sideload custom ROM zip file and GAPPS zip file: adb sideload filename.zip.
Reboot when sideload is complete by command adb reboot.
This completes custom ROM installation. Enjoy.

Note: TWRP is only installed in laf partition, to get into TWRP in future, must plug in USB to computer while holding Volume Up key.

Zabbix Monitor IIS Application with Anti-Forgery Token Log In Process

2020-07-13T09:30:00.002-07:00

Use Variables and some regex manipulation, Zabbix Web Monitor can follow the IIS Web Application's Log In process. It takes four steps:

Step 1, Front Page. Get Anti-Forgery token for log in.

Variable Name: {token}

Value: regex:"__RequestVerificationToken" type="hidden" value="([A-Za-z0-9+=\-\_]+?)"

Step 2, Login. Post all values needed for login and virtually click Submit.

The value names can be found through Inspect function in Chrome. Submit button does not need value. Lastly, the anti-forgery value name is __RequestVerificationToken, value is {token}

Step 3, Look for strings on page to see if it is logged in sate.

Step 4, Log out. Usually the logout is just a simple log out URL like https://my.domainname.com/account/logoff/?returnUrl=/

Zabbix Slack Integration

2020-07-10T07:12:00.003-07:00

Have been using Zabbix Slack AlertScript for sending alert to Slack happily on Zabbix 3.4. On a new install of Zabbix 4.4, tried the built-in Slack Media Type utilizing new Bot User instead of custom Incoming Webhook. After testing, I went back to install AlertScript on Zabbix 4.4 to get everything working as expected, although AlertScript documentation says Zabbix 4.4 should use the built-in Slack Media Type. Zabbix documentation indicates that custom alertscripts is still an option in later version of Zabbix.

Below are issues I found with built-in Slack Media Type:

Concurrent sessions setting in Slack Media Type must be higher than the number of Slack recipients of a single alert.
With multiple Slack recipients, often some recipients miss recovery notification.
With a single Slack recipient, recovery notification could also fail. The error message on Zabbix is "channel not found".
The notification content template is a custom script instead of standard Zabbix Action Operations template. The custom script is difficult to customize.

The missing recovery notification is probably caused by the new behaviour of recovery notification,which, instead of sending a new one of recovery, it searches for the previous problem notification and replace it with a recovery one. The search often fails, probably due to permission and Slack's upgrade of its internal working. hence the failure of recovery notification. Another downside of replacing previous notification with recovery one is the original notification is lost. As alert history, it is important to see when the original alert happened.

AWS Linux WorkSpaces Creation Failure

2020-05-07T15:26:00.002-07:00

With a quick setup of WorkSpaces and AD Connector, Windows WorkSpaces could be created without too much hassle. However Linux WorkSpaces creation may fail, or has very high failure rate. Out of ten attempts, I only got one successful. Each attempt took two hours. After spent some time, I figured it out.

The AD directory service account must be a member of Domain Admins group or with equivalent permissions in managing domain computers. Using a basic AD account, Windows WorksSpaces can be joined into domain, but Liunx WorkSpace can not be joined. When it fails, WorkSpaces console displays an error message about lack of permission of AD account.
The subnets of WorkSpaces must be present in AD Site and Service's Subnet list. Again, Windows can join AD without correct subnet setup, Linux can not. When Linux WorkSpaces fails to join domain, WorkSpaces console just show a generic error and suggest contacting Amazon Support if it keeps failing.

Power on/off/reboot Android phone without using power button

2019-09-29T20:54:00.003-07:00

Works without rooting the phone.

Power Off and Reboot

In Google Play Store, install app Button Mapper: Remap your keys. Remap one of the volume key to Power Dialogue. You can set Up Volume Long Press to bring up Power Dialogue.

Power On

It may not work with every phone. Plug in power cable to charge it. When it show a simple charging (flash) icon on screen but not yet showing animated charging picture with percentage, unplug the cable. Wait a while, the phone will boot.

If your phone supports wireless charging, simply put it on charger. It will boot the phone right away.

Running Bitcoin Full Node on 10 year old Netbook

2019-09-10T17:28:00.000-07:00

Recently installed a fully functioning Bitcoin Full Node on a ten year old Asus Eee PC 900HA. The hardware and software are lower than official requirement, but they work fine.

CPU: Intel Atom N270 (32bit, 1.7GHz)
Memory: 2GB
Hard Drive: 500GB HD not SSD
OS: 32bit Centos 6

Bitcoin Core has a 32bit installer.

The only catch is autostarting bitcoind daemon using non-root user at boot. After some research this command worked.

Edit /etc/rc.d/rc.local, add one line:
su - user -c "bitcoind -daemon".

If using SSD instead of regular hard drive, it is nice to include a scheduled trim script in /etc/cron.weekly.
nano dofstrim
Add content:
#! /bin/sh
#for mount in / /boot /home; do
fstrim $mount
#done

Make it excutable:
chkmod +x dofstrim

Lastly, set up forward forwarding in router and add TCP 8333 to firewall iptables:
nano /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

Running Bitcoin Full Node with weak hardware only affects the initial block download and verification time. It took my netbook two weeks. When it is fully running and accepting incoming traffic, it handles 30 traffic without sweat.

Be careful buying phones from Aliexpress

2019-08-28T07:55:00.001-07:00

Recently bought two refurbished LG G6 H873 from Aliexpress for CAD$130. Both of them are defective and I can't return them because I updated the ROM trying to fix the problem myself. Although I just updated to a later version of official ROM without rooting, the seller denied my request for return and refund

Below is the brief recount of my unfortunate experience:

Placed an order for a H873 to a seller. The seller did not respond for a week.
After waiting for a week, I cancelled the first order and placed second order to another seller review says responds quickly. Yes, the seller responded in a few hours and within 24 hours the phone is shipped.
The first seller responded that my cancellation of first order is rejected because the phone has been shipped, although online status did not show.
So I waited for the two phones thinking I could use them both or sell one of them on Kijiji.
The second phone arrived in two weeks. Quick delivery.
I found I can't make and receive calls on Freedom Mobile. After a lot of testing, I determined the 3G Band 4 AWS/1700 is dead on this phone.
Attempted to fix the issue through resetting and updating to the latest official ROM. All failed.
Contacted the second seller for return and refund. The seller's response is:
"upgrading the system by yourself or auto updating is not supported since we have tested the phone carefully and upgraded the system to the most stable stytem before shipment.and we will not be responsible for such case."
So essentially even automatic official update is not supported and void warranty.
The first phone came. It works with voice calls, but its Wi-Fi and Bluetooth is dead. After a lot of attempts to fix it myself, including updating to the latest official ROM, I came to realize it is a hardware defect, caused by bad contacts of wifi/bluetooth ic on the motherboard.
https://forum.xda-developers.com/general/help/qa-wifi-stuck-mac-020000000000-g2-g3-g4-t3452133
Also contacted the first seller for return and refund. The seller offered a 20% refund. This is better than the second seller, because it is better than nothing, so I accepted the offer. Then I cracked open the phone to fix it myself following above mentioned instructions. Voila! The phone is clearly assembled out of used parts, and most importantly, there NO wifi/bluetooth chip on the motherboard!

Lesson learned.

Update:

I was wrong about the second phone that I thought had bad 3G Band 4. Last week I updated it to official ROM Android 9. Everything starts to work. Incoming and outgoing voice calls work well. Also Android 9 works noticeably faster than Android 8. So the takeaway from this incident is still, be careful when buying phones from Aliexpress.

Useful OpenSSL Commands

2019-02-12T07:50:00.001-08:00

Generate new SSL private key and CSR file:

openssl req -new -newkey rsa:4096 -nodes -keyout mydomain.key -out mydomain.csr

Convert RSA private key to PEM format:

openssl rsa -in mydomain.key -text > mydomain-key.pem

Convert key, cert and ca-bundle into pfx format to be imported into IIS:

openssl pkcs12 -export -out mydomain.pfx -inkey mydomain.key -in mydomain.crt -certfile intermediateCA.crt

Convert everything into Tomcat keystore file such as for JIRA:

In Linux, concatenate all *.pem files (cert first, followed by interca cert) into one pem file, like all.pem Then create keystore in p12 format with private key + all.pem

openssl pkcs12 -export -inkey private.key -in all.pem -name test -out test.p12

Then go into Windows, use Java included keytool to export p12 into jks

keytool -importkeystore -srckeystore test.p12 -srcstoretype pkcs12 -destkeystore test.jks

For Jira, make sure the "name" is "alias", use "jira" as "name".

The path of keystool.exe in Windows is at C:\Program Files\Java\jre7\bin

When done, list the content of the keystore file:

Keytool -list -keystore test.jks

A Perfect ROM for Asus Zenfone 2 ZE551ML(Z00A)

2019-02-04T12:46:00.000-08:00

Recently upgraded my three year old Asus Zenfone 2 ZE551ML(Z00A) from Android 6 CleanStock to Android 7.1.2 Groovy Android. It works perfectly. All around better than Android 6 CleanStock which has stopped updating long ago. Groovy Android seems will keep updating.

https://forum.xda-developers.com/zenfone2/development/rom-groovy-android-t3756429

Why do you need a $1000 new phone like iPhone while a $100 old phone works perfectly well with a good ROM.

Freedom Mobile and Choice of Phones

2018-12-08T09:14:00.002-08:00

Freedom Mobile in Canada has a very useful plan for $15 per month. It is called Home 250. It includes 100 minutes outgoing call air time, unlimited incoming, unlimited short messages and 256M full speed (30Mbps) data. After using 256M full speed data, there are no overage charge, the speed is just throttled down to 256Kbps, which is good enough for voice calls over Internet, such as Hangout Dialer calls, not to mention all messaging such as WhatsApp and Wechat. So essentially, the $15 covers most of people's smart phone plan requires except video watching, which will use up bigger data plan pretty fast too.

Having found and tested this plan, the next step is finding a right phone. The choice is limited if you want to find a cheap and good one by yourself due to requirement of cellular network. Unlike big carriers like Rogers and Bell, Freedom Mobile's network requirement is rather special.

Check this out:
https://www.reddit.com/r/freedommobile/comments/8ao4tu/a_guide_to_freedom_mobiles_network/

So we need:

Must support UMTS1700/2100 (Band 4). This band is used for voice calls. Without both 1700 and 2100 in Band 4, even the phone has Internet network, calls will fail. It will dial but the receiving end will never ring. Data works on this band if all other bands are not available. Please note there is the misconception that some phone lists UMTS2100 and claim to work with Freedom Mobile. It won't. UMTS1700 is more important than UMTS2100.
Should support LTE1700/2100 (Band 4). This band is used for high speed data network for better data connection.
Better support LTE1700/2100 (Band 66). This band is the new high speed band for data network. It has much more space to avoid congestion. Not many phones support this band.
Nice to support LTE700 (Band 13), LTE2600 (Band 7) and LTE2600 (Band 41). Freedom Mobile is using these bands in congested area like shopping malls.

I found phonedb.net has most accurate and readable specification data on phones. GSMArena.com is confusing or occasionally not correct.

There are a few good choice of phones supporting Freedom Mobile currently available. They all support UMTS Band 4, LTE Band 4 and LTE Band 66:

OnePlus5/5T
Sony Xperia XA2
Essential Phone PH-1
Xiaomi Mi A2
LG G6 H873

Configuring AWS VPN with Cisco ASA

2018-09-23T08:56:00.002-07:00

Recently configured Amazon AWS VPN connection with Cisco ASA 5500 series. The documentation provided by Amazon is correct. The downloaded configuration for ASA is also good. However the troubleshooting information from Amazon is useless by just stating the general rules which experienced Network Admins are fully aware.

Below are the catches that got me stumped for some time.

There are no logs on both sides of VPN, making the whole work difficult to troubleshoot when not working.
The local subnets on both AWS VPC and office network must be fully operational including routing and firewall before the VPN connection comes up.
The VPN must see a round-trip packet initiated from office internal subnet outside ASA or from the internal network interface on ASA, and SUCCESSFULLY returned from VPC subnet to truly bring up the VPN connection.
Pinging from ASA without specifying originating port toward VPC has no effect. Ping from VPC toward office network has no effect either. Amazon provided ASA configuration file contains a sla monitor for ASA to ping VPC every 5 seconds to maintain the connection works. But when troubleshooting, better use a OS in office internal network to ping an live OS instance IP on AWS VPC. AWS' local gateway x.x.0.1 and DNS IP x.x.0.2 do not respond to pings from remote subnets so do not ping them to bring up VPN
Disable Public Network Firewall in Windows on AWS VPC to respond to pings.
Check connection status on ASA using command show crypto isakmp sa and show crypto ipsec sa. They shows no sa when VPN is not up even when all configuration are correct. It just needs a ping. The Connection Status on AWS VPN Connection has a big time lag of several minutes to show correct status.
Use show access-list to see the hit count of both VPN mapped access-list and VPN filter access-list to help determining where the packets have reached
Don’t forget adding route outside rules and no-nat-in rules.
VPN traffic access control should be done using group policy filter access list, not through mapped VPN Access List.
The syntax of group policy filter access list is different from regular access list. For example, to allow local subnet to SSH to remote subnet, the command is access-list acl_amzn-vpn-filter extended permit tcp [remote_subnet] [remote_mask] eq ssh [local_subnet] [local_mask]. The access list rule syntax for inbound traffic is the same as regular command, like this access-list acl_amzn-vpn-filter extended permit tcp [remote_subnet] [remote_mask] [local_subnet] [local_mask] eq ssh. Some documentation say the outbound is implicitly added when inbound is permitted. It is not the case for me.

Convert Apache SSL certificates into Tomcat keystore

2018-04-11T11:27:00.001-07:00

Found a quick way on some online forum to convert PEM format SSL certificates into Tomcat NIO keystore format.

In Linux, concatenate all *.pem files (cert first, followed by interca cert) into one pem file, like all.pem Then create keystore in p12 format with private key + all.pem

openssl pkcs12 -export -inkey private.key -in all.pem -name test -out test.p12

Then go into Windows, use Java included keytool to export p12 into jks

keytool -importkeystore -srckeystore test.p12 -srcstoretype pkcs12 -destkeystore test.jks

BitBucket Environment Variable Change

2018-04-11T11:19:00.003-07:00

BitBucket is based on Tomcat, but for version 5.6 and higher, its environment variable including Java Local Machine location is configured in new ways instead running tomcat.exe

Java Home variable is easy to configure. It is in System Properties - Advanced system settings - Environment Variables - System variables - JAVA_HOME. This variable will be used in installation of Bitbucket. However if Bitbucket is already installed, it will not be automatically used by existing Bitbucket services.

Their Java Virtual Machine location has to be manually specified.

Start with AtlassianBitbucketElasticsearch first.

Copy the text string in "Path to executable" in Services console . It is "C:\path\elasticsearch-service-x64.exe //RS//AtlassianBitbucketElasticsearch".
Paste it into Command Prompt window, edit it to: C:\path\elasticsearch-service-mgr.exe //ES//AtlassianBitbucketElasticsearch. Execute It.
In the configuration windows, go to Java tab, edit the Java Virtual Machine box with correct path to jvm.dll, for example, c:\program files\java\jdk1.8.0_71\bin\server\jvm.dll
Apply and OK. You can start the service now.

Second configure AtlassianBitbucket.

Copy the text string in "Path to executable" in Services console . It is "C:\path\bserv64.exe //RS//AtlassianBitbucket".
Paste it into Command Prompt window, edit it to: C:\path\bservmgr.exe //ES// AtlassianBitbucket . Execute it.
In the configuration windows, go to Java tab, edit the Java Virtual Machine box with correct path to jvm.dll, for example, c:\program files\java\jdk1.8.0_71\bin\server\jvm.dll
Apply and OK. You can start the service now.

Use iptables on Linux to port forward

2018-03-26T12:58:00.001-07:00

IPTABLES on Linux can be configured to replace Web Reverse Proxy in some cases to redirect ports. Below is how on Ubuntu.

Enter command below in SSH session to redirect port 80 to port 8080. Port 8080 will keep working.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

Verify it it is working. Then make sure the configuration will be loaded every time Linux starts.

sudo iptables-save | sudo tee /etc/iptables.conf

to save your current iptables rules to /etc/iptables.conf and then insert these lines in /etc/rc.local:

# Load iptables rules from this file
iptables-restore < /etc/iptables.conf

Cisco UCS Blade Server Setup Hints

2018-03-25T13:00:00.000-07:00

The online information for Cisco UCS mainly covers concepts, but lacking on specifics, like cabling and admin access issues. Here is my notes.

Java Compatibility

Cisco UCS Admin Console is only compatible with Java 7, not Java 8.

The KVM console also requires Flash, so Firefox with Flash has the best compatibility. Chrome does not work with KVMconsole

Cabling

Plug two, four or eight ports on the first network module on Chassis to Fabric Interconnect A, starting from left. If Fabric Interconnect is configured in cluster mode, two, four or eight ports on the second network module connect to Fabric Interconnect B.

In UCS Admin Console, set these ports on Fabric Interconnect as Server Ports. When done, chassis will show.

In UCS Admin Console, set some ports on Fabric Interconnect as Uplink Ports for connection into company network. Set speed to 1Gb if company network is 1Gb, otherwise the link will come up.

Use copper Ethernet SFP+ transceiver to connect Fabric Interconnect quickly into copper network.

Network Setup

Use LAN Pin Group to assign ports to network.

Small Cron Job Tricks

2018-03-25T10:30:00.000-07:00

While troubleshooting a Linux script that fails to run, learned following three tricks about cron job:

Check system log at /var/log/cron to see if the job has been executed on time.
The last cron command in file, say a file in /etc/cron.d, must be followed by an empty line. Otherwise the last cron command will not be executed.
Add “2>&1” to the end of cron command to disable sending STD to email. By default, root receives email, or address specified by "MAILTO=user@somehost.tld"

Chinese Wireless Router LB-Link

2018-03-25T10:17:00.001-07:00

Recently I bought a couple cheap wireless router LB-Link BL-600N from China during my trip there. I bought it because I found people were discussing on Chinese router forum saying it is the cheapest router (less than CAD$10) with very high spec (dual band 600M, gigabit Lan and USB) and supports Tomato firmware. Although people says it runs super hot and suffers from wireless dropouts, I bought it anyway because I have been always pretty lucky buying cheap routers and configure them with 3rd party firmware to run stably. I believe I can attach heatsink to it to solve the heat problem and the wireless dropout issue seems to be heat related.

After a months of effect, I admit my confidence is defeated.

First is the temperature. One guy on the forum used a laser thermometer tested the running temperature. Without heatsink mod, the inner metal shield case runs 90 degree celcius. With heatsink covering the entire metal shield case, the temperature lowers to 70 degrees celcius. I do not have thermometer but by touching, it can attest the claim. Without heatsink mod, in other words with stock setup, the router starts to restart itself randomly after two weeks obviously due to high temperature. And it keeps restarting every few hours as long as the temperature is not lowered. With heatsink mod, it does not restart itself anymore.

Second, after restarting problem solved, I come to realize the wifi dropouts. It is happening with and without heatsink mod and on both of my routers. The heatsink I used is from an old Nvidia fanless video card and it almost as big as the router itself. It does not runs too hot to touch. So either the wifi part of the router is defective or the temperature should be even lower, which I will try if I come across a giant heatsink in future, LOL.

Edit after a year.

I have now been running this LB-Link BL-600N for a year without rebooting. I ended up sticking a big heatsink onto the metal shield of the router, with plastic case removed of course. Wi-Fi is also disabled because it is not stable with or without heatsink. I plugged a dual band Lenovo Newfi router configured as AP for wireless signal. This setup has been rock solid ever since.

The firmware running on LB-Link BL-600N is Tomato Shibby for Tenda N60.

Microsoft AD Replication Status Tool Is Very Useful

2016-07-12T13:09:00.001-07:00

Having been fighting with Active Directory replication issues lately. I was surprised I did not catch up with good handy tools for AD troubleshooting.

Microsoft actually made AD Replication Status Tool a couple years back to help with troubleshooting. It even has Microsoft Replication Error Guide and knowledgebase integrated. It becomes an easier job with this tool on one side and Command prompt window on the other running all types of repadmin commands.

https://www.microsoft.com/en-ca/download/details.aspx?id=30005

Unlock iTalkBB's VoIP Adapter Linksys SPA2012-R Through Phone Reset

2016-07-05T07:53:00.002-07:00

Got an old Linksys SPA2012-R VoIP phone adaptor locked to iTalkBB from a friend. Successfully unlocked it. Below is what I found.

Older versions of SPA2012-R can be unlocked by sniffing network traffic to find its admin password because the adaptor tries to log on iTalkBB's provision server using unencrypted message. It is not the case for my SPA2012-R. After DNS resolution, the provisioning logon starts establishing SSL tunnel first.

My SPA2012-R does not accept all user and admin login password found on internet, but it can be reset using a phone attached to it. On the phone, enter the configuration menu (****) and try a user reset (877778#) removes user password. Factory reset (73738#) removes admin password. The reset process does not ask for any password. This is that simple! It is important that the adaptor must not connect to Internet when and after reset because as long as provision server is not removed from configuration, it always auto-provisions and locks itself right away.

After unlocking user and admin password, log into the Web GUI, remove the provision server. The Restricted Access Domain is greyed out and can not be removed. Fortunately, this restriction only applies to phone port 1 not port 2. So just configure port 2 with a SIP account and you are good to go.

佛道说的是什么

2016-06-06T12:20:00.000-07:00

宗教不是崇拜，不是信仰，不是迷信，是改造自我潜意识中的不合理之处，以实现更完美的生命状态。

经书是指引，是提示，让我们看到我们潜意识中的错误。

在进入自己潜意识的过程中，我们会产生幻觉，同时也会产生新的更准确和深入视野。这种幻觉和新视野的杂合，就是神话。也就是说，神话中有幻觉，也有真实。真实的部分只有能自主掌控自己潜意识的人才能看到，一般人无法了解。因为绝大多数人只对自己的表层意识有自主的感觉，所以大众公认的见解常常是错误的，比如在地心说的年代，地球是宇宙的中心才是正确的，其它都是异端邪说，说疯人说梦话。

那些能自主掌控自己潜意识的人，当他们把自己的潜意识净化之后，他们看到的世界才是真实的。这个真实的世界，就是佛教说的“实相”，而普通人则生活在“颠倒梦想的世界”。

潜意识看到的世界比普通人的表层意识看到的世界要恢宏得多，因为潜意识占据了人脑大部分的脑细胞，所以潜意识视野的广度和深度远远超出普通人对世界的理解。佛教说“不可思议”，“不可言说”。

阻碍人们进入潜意识的屏障是人们的自我心理，即各种情绪。佛家说的“贪嗔痴”就是自我情绪的典型表现。快乐、悲伤、嫉妒、骄傲等等七情六欲都是屏障。佛道的修炼要让人们静下心来，看清这些情绪的变化只是水面的波浪，是不平衡的表现，是暂时的，不是真正的水。看清之后人们得以放下对情绪目标的执着，深入自己的内心。

各种宗教名词的高深莫测，一方面出于当年没有心理学时人们对心理状态描述的困难，一方面出于以讹传讹的偏差积累。同时我们也要明白，现在心理学的研究也是有限的，在发展的，以后会发现更多更深的内容，而修炼者进入自己的潜意识后看到的内外“实相”，远超过现在心理学的范围。

“实相”是什么？佛道都不说，其实已经说了，但普通人也没有明白。不说是因为普通人的理解能力会误解看到“实相”者说的内容，就象成人很难向儿童解释成人的世界。已经说了是因为“实相”已经摆在每个人面前，得道者们也在努力地说，只是普通人因各种情绪的“障”而看不见，听不到。而悟道者到处见法，所有人所有事物都在讲法讲道，“道在屎溺”，一切皆法。

佛家和道家的区别在于说和不说，以及对身体的重视程度。道家源于讲究实干的中华，也注重强身健体，所以道不说。佛家源于喋喋不休的印度，同时印度的气候炎热，不必太注重身体，静心就好。

ASUSWRT vs Tomato

2015-01-26T07:09:00.000-08:00

Tried ASUS RT-N10P with stock ASUSWRT and Tomato. ASUSWRT is a fork of Tomato. ASUS put a fancy and heavy GUI to Tomato, and cut off many useful Tomato features. After a week of using ASUSWRT, I finally switched back to good and old Tomato. Below are some grips that make me ditched ASUSWRT.

ASUSWRT's Admin GUI only supports single logged-in session. If you closed the admin GUI on one computer, you will not be able to login on another computer unless you log out the GUI session from the first computer.
ASUSWRT's QoS does not support classification based on source port. It is critical for remote admin on a router swamped with traffic. On Tomato, you can set TCP 8080 highest to ensure you remote admin session from office to home router is always responsive.
ASUSWRT's QoS rules can not be re-ordered for best execution efficiency.
When configuring ASUSWRT without WAN port plugged in, the admin GUI is very slow.
ASUSWRT only has PPTP VPN server and client. There is no OpenVPN support.
ASUSWRT's QoS does not have the useful QoS gragh/pie chart.

There are actually tons of features in Tomato that you may find useful but can not be found in ASUSWRT. Nevertheless, it is a good thing for average home users who just want to set up and go in a few minutes. And QoS in ASUSWRT works well while most of QoS in other home routers fail. For people who wants and enjoy tweaking, Tomato wins hand down.

I eventually flashed Tomato Shibby into my RT-N10P bought for $10 from TigerDirect, and have a big smile on my face.