iSmooth Blog

Generate Root Certificates Compliant with Apple Requirements

noreply@blogger.com (Saleem Almajed) — Thu, 10 Jun 2021 17:12:00 +0000

To be honest, I recently digged into my Homelab and I repurposed my good old ODROID-XU4 with Ubuntu 20.04 and configured it as a Bitwarden server on some Docker containers to provide a secure password management service for my network devices.

Today, we're going to learn how to properly generate self-signed Trusted Root Certificates with OpenSSL meeting the requirements of Apple for iOS 13 or macOS 10.15 and newer versions, including the upcoming iOS 15 and so on.

Apparently, one of my client devices happens to be an Apple iPhone 7 running on iOS 14 which is actually requiring strict standards for Downloaded Certificate Profiles in order to be installed properly as a Trusted Root Certificate and that's when I had to figure it all out.

Create OpenSSL Configuration File

That's like the magic touch for this particular tutorial, please note that I am running Ubuntu 20.04 on my micro server but it really doesn't matter which Linux/Unix distribution you are running on your end.

You can SSH into the terminal of your server on any device, enter the commands below.

cd ~/
nano bitwarden.cnf

Change "bitwarden" to the name of your project, that's going to create a configuration file needed for certificate generation as a result please input the following.

[ req ]
default_bits           = 4096
default_md             = sha512
prompt                 = no
encrypt_key            = no
distinguished_name     = req_distinguished_name
x509_extensions        = usr_cert

[ req_distinguished_name ]
countryName            = "US"                        # Two Digit Country Code
stateOrProvinceName    = "California"                # State or Province Name
organizationName       = "Perpetual Technologies"    # Organization Name
commonName             = "Bitwarden"                 # Project or Domain Name (FQDN)
emailAddress           = "your-name@gmail.com"       # Any Email Address

[ usr_cert ]
basicConstraints       = critical, CA:true, pathlen:0
nsCertType             = sslCA
keyUsage               = digitalSignature, keyEncipherment
extendedKeyUsage       = serverAuth, clientAuth
nsComment              = "OpenSSL CA Certificate"
subjectAltName         = @alt_names

[alt_names]
DNS.1                  = localhost    # Local Hostname or Public Domain Name
IP.1                   = 127.0.0.1    # Local or Public IP Address

Here comes the important part, you have to adapt with the parameters commented above according to your preferences and requirements.

If you are going to use this certificate on a server that has an actual local hostname or public domain name please change localhost to match your case.

Otherwise, if your server is lacking a domain name and you are going to work on either a local or public IP address, in this case please change 127.0.0.1 to match the IP address of your server, it can work with both LAN or WAN networks. For example, in my case I set this to 192.168.1.100 the IP address of my own Bitwarden server.

Once finished, you can save the file by using the CTRL + O keystrokes on your keyboard.

Generate TLS/SSL CA Certificate with OpenSSL

Now, we can steadily generate self-signed certificates configured exactly as we wanted, you can proceed with the openssl command on terminal of your server.

sudo openssl req -x509 -keyout /etc/ssl/private/bitwarden.key -out /etc/ssl/certs/bitwarden.crt -config ~/bitwarden.cnf -days 365

Of course, you don't have to keep using "bitwarden" as a name of such files, you can use your own.

Okay, you should have a certificate now generated as /etc/ssl/certs/bitwarden.crt just examine it.

cat /etc/ssl/certs/bitwarden.crt

Either, create a file with the same content or find a way to copy this file into your desired client Apple device, you can then send it by email, Google Drive, AirDrop or whatever as you wish.

Install Trusted Root Certificate on Apple iOS

The process is going to consist of two stages, the downloaded file is treated as a profile that's used to install and configure the certificate on Apple iOS client devices.

Install Certificate Configuration Profile

Once you receive the certificate file at your end client device which is Apple iPhone 7 running iOS 14 in my case, just click it and there will be a configuration profile automatically downloaded into your device.

In order to install the profile, navigate to Settings > General > Profiles where under “DOWNLOADED PROFILE” click on the target and press the install button then confirm the dialog and be done with it.

Enable Full Trust for Root Certificates

Similarly, once you have successfully installed the downloaded certificate profile, navigate to Settings > General > Aboout > Certificate Trust Settings where under "ENABLE FULL TRUST FOR ROOT CERTIFICATES" click on the target and toggle the switch on.

Install Trusted Root Certificate on Apple macOS

When it comes to macOS a simple Double-click on the certificate file will do. Then, you can install it in your login keychain. Once clicked, just make sure to specify “Always Trust” from the scroll down menu when using the certificate.

Finally! We're done, if you have any questions or issues do not hesitate to discuss in the comment section right below.

How to Use Pi Hole on your OpenWrt Router

noreply@blogger.com (Saleem Almajed) — Wed, 09 Jun 2021 09:43:00 +0000

Back then, I published a tutorial on how to configure Pi Hole on pfSense, it did actually attract a good amount of traffic from the web to this blog. Well, since I started using my old OpenWrt equipment in my Homelab again there's going to be a new post.

I decided to write this article to help beginners who have installed Pi Hole on a VM or maybe some other network device and don't really know how to configure thier OpenWrt router properly with Pi Hole as the primary DNS server.

The big idea is simple, once we are finished, any client device on your network that connects to your OpenWrt router device with DHCP is automatically assigned with the Pi Hole address as DNS.

Determine IP Address Information

Now, I suppose you have to determine the IP addresses of both:

OpenWrt Router
Pi Hole VM or Network Device

Please make sure you have assigned a static IP address for the Pi Hole server.

Configure OpenWrt Router with Pi Hole

From your OpenWrt web control panel which happens to be on this address https://192.168.1.1 in my case. Please proceed from the menu above to Network > Interfaces where you should find this:

Our target for this implementation is the LAN interface, go ahead and click on "Edit" the blue button where you will arrive at the following window as a result.

Please refer to the image above and make sure you navigate to DHCP Server > Advanced Settings then just add the Pi Hole IP address which is 192.168.1.10 in my case right into the DHCP-Options but make sure it's in the this shape 6,192.168.1.10 instead. After that, simply click on "Save" the green button.

Okay, from the interfaces page find the "Save & Apply" the blue button down below and click on it, now that everything is saved I recommend that you restar your OpenWrt router just in case. You can do that from System > Reboot in the menu above.

That's it, now you can proceed to the final step which is confirming everything is working as intended.

Ensure Pi Hole is Working

Go to your Pi Hole admin panel which is in my case hosted on this address http://192.168.1.10/admin/ then you should open a web browser on any of your OpenWrt router client devices, try visiting any website and observe what's happening on the Pi Hole admin panel overview.

If you can see live information about the DNS queries that Pi Hole server is receiving while surfing the web on your client devices, that indicates everything is configured properly.

How to Use OpenWrt Router as a Wi-Fi Receiver

noreply@blogger.com (Saleem Almajed) — Mon, 31 May 2021 07:27:00 +0000

Well, so I returned back for using OpenWrt equipment devices which had already been a part of my humble Homelab for many years. The idea we're going to discuss here in this tutorial is how to convert your OpenWrt router to a Wi-Fi signal receiver.

The benefit of such a setup is acquiring an internet connection for your OpenWrt client devices that are connected to the router, they simply get to access the Wi-Fi network we're connecting that router device into.

Okay, start by navigating from your browser to your OpenWrt "Luci" web control panel which happens to be on address 192.168.1.1 by default.

Connect to a Wireless Network in Client Mode

You should find the option to do so right the from the Menu above Network > Wireless so please note that you could either go with 2.4 GHz or 5GHz bands. I would recommend to use 2.4 GHz since it tends to be more stable from a long distance.

Once you have decided, click on Scan to search for networks, find your target wireless network and click on Join Network correspondingly, refer to the example from the image below.

Alright, just make sure to set "Name of the new network" to wwan then assign the firewall zone to wan and save it. Now, finalize your configuration from the main page click on the Save & Apply blue button down there.

Configure OpenWrt Firewall to Allow Forwarding

Here we go the final magical step, navigate to Network > Firewall from the menu above to access the firewall "General Settings" and make sure it looks like this.

What is important is having "Foward" set to accept and similarly click on Edit the blue button from "Zones" to configure the "lan" firewall zone like below.

Additionally, it's also very important to make sure that both "Masquerading" and "MSS clamping" options are ticked on the "lan" firewall zone settings.

By now, I suppose all clients that are connected to your OpenWrt router device can access the said network, and thus able to access the internet. It really doesn't matter whether you have your client devices connected to OpenWrt by a wired ethernet connection or wireless.

How to Install Best Realtek Network Drivers for pfSense

noreply@blogger.com (Saleem Almajed) — Sat, 20 Feb 2021 05:56:00 +0000

Apparently, there's no need anymore to bother and maually compile network interface drivers for your pfSense router which happens to have Network Interface Chips by Realtek.

If you haven't updated yet to the latest pfSense 2.5.0 stable version, please do so . In fact, the drivers are now officially included in a package of FreeBSD which is the operating system that pfSense is built on.

Introduction

From my experience while running my own Homelab and still being involved in the Reddit community for many years on that particular topic.

People have always suffered from Realtek Network Interface Chips because of the poor kernel driver support provided by default on the FreeBSD operating system. Thus, everyone was facing stability issues, and at worst it's leading the ethernet link to be completely out of commission, it's basically unreal.

Meanwhile, the Homelab Community has always been trying to fix the issue, mostly by telling users to manually compile Realtek Drivers which replaces the default buggy and instable ones.

Alright, so the FreeBSD distribution maintainers now provide that solution by default on the system, that's making it much more convenient for users to install a simple package including the compiled drivers, and we can now count them responsible for updates, maintainance and combatibility.

FreeBSD Realtek Network Driver Stability Issueus

Indeed, the default Realtek Network Drivers that are provided by default on the FreeBSD kernel space is a living hell that's causing all sorts of issues! Let me state the some points showing how broken they are:

When the ethernet link is under load, it doesn’t respond to the software watchdog in time, and thus it resets with a timeout.
Ethernet interfaces go down and up in a sudden for no reason.
You cannot get maximum speed out of the Gigibit link bus.
Realtek Network Chips by default are difinitely unusable on pfSense.

That's it! Feel free to contribute more in the comment section. Basically, in this tutorial we're going to shift the driver all the way from Kernel Space to be replaced with an User Space module.

Install Official Realtek Network Interface Driver

Here we go, navigate to the command line of any client on the network, please make sure that you know the IP address of the target pfSense router device which is 172.16.1.1 in my case.

If you do not have any client that can run command line shell, you can use Putty SSH Client for Windows instead.

Installation

Now, we need to SSH into the FreeBSD operating system that's running pfSense, here's how.

ssh admin@172.16.1.1

Just enter the password that you use for pfSense web control panel, when authenticated successfully make sure to input number 8 into the dialog so that we can access the shell.

We can now tell the package manager on FreeBSD to install the package for us.

pkg install realtek-re-kmod

Just in case, when it asks for confirmation just input y for "yes" and be done with it.

Configuration

Well, I am going to recommend using the web control panel of pfSense instead of the command line for this one, just because it's much easier to use the text editor on gui than command line.

From the browser address bar, navigate to 172.168.1.1 which is serving the web control panel for pfSense in my case.

Okay, now just login and from the menu above navigate to Diagnostics > Edit File and enter /boot/loader.conf.local as the path for the file and then click on "Load" so that we can work on it.

There should be a square dialog below we're going to tell pfSense to use the newly installed drivers instead, make sure to input the following:

if_re_load="YES"
if_re_name="/boot/modules/if_re.ko"

The final step to finish the configuration process is through clicking on that "Save" button. Now, reboot your pfSense router device which can be done from the menu Diagnostics > Reboot > Submit or the physical hardware button if you prefer.

Confirmation

After reboot, verify if module is installed through SSH again with the "kldstat" command as shown below.

kldstat

Output:

Id Refs Address                Size Name
 1   10 0xffffffff80200000  3aea538 kernel
 2    1 0xffffffff83cec000   11e230 if_re.ko
 3    1 0xffffffff84111000     1000 cpuctl.ko
 4    1 0xffffffff84112000     8cd0 aesni.ko
 5    1 0xffffffff8411b000      b28 coretemp.ko

Simply, if you can find if_re.ko in the output, it means the newly released Realtek Network Drivers for FreeBSD are properly installed and working as intended.

How to Configure OpenVPN Client Perfectly on pfSense

noreply@blogger.com (Saleem Almajed) — Sun, 10 Jan 2021 11:46:00 +0000

So, I started integrating the VPN category and its topics into my blog, you should find the section added to the main menu in the top while pfSense is the backbone for routing on my own Homelab and that's why I have a lot of experience in this field

Correspondingly, as an openning for the series we started with explaing how to set up an OpenVPN server on Linux along with client configuration for different operating systems.

This time around, we will go ahead and explain how to configure a pfSense firewall as client for a server running OpenVPN which is going to let every device connecting to the router to be a part of the VPN private network, thus having the same public IP as the hosting server instead.

Advantages of OpenVPN Client on pfSense

In fact, you can configure any device as an OpenVPN cient for a VPN server, but if you already have all of your devices connected to a central pfSense router, you can utilize that conveniently.

It would definitely make sense to set the firewall itself to be configured as the sole OpenVPN client and let it handle session management to the server instead, here's a couple of advanatges for that setup.

You can assign a public static IP address to your pfSense router matching the VPN server.
You can bypass the Carrier Grade NAT (CGN or CGNAT) restrictions which enables you to host your own services from home.
You can connect multiple clients to an OpenVPN service and only use a single session, especially when the server has a limit on the number of sessions available.
You don't need to bother with OpenVPN configuration for each client but only configure the router once.
Some client devices may not have the ability to be configured as an OpenVPN client which is irrelevant in this case.

I don't even think the list ends here, many people will want to use VPN to hide and protect their identity. There's no limit for the possibilities, you can always define your own and find a purpose.

Configure OpenVPN Certificates on pfSense

On one hand, if you have previously followed our tutorial to set up your own OpenVPN server then you should know by now that the end result for client configuration is an ".ovpn" file which contains all the certificates and authentication keys needed.

In the other hand, if your are using a public VPN provider that's internally using OpenVPN to provide users with the service then again the result is the same, go ahead and refer to that ".ovpn" file, it doesn't matter.

There's a section called Certificate Manager on pfSense panel which you can find by navigating to System > Cert. Manager and you sould have your browser pointing to there by now to start.

Add CA Certificate

From the Certificate Manager, navigate to the CAs tab and press on the green Add button to add a new CA certificate.

Once clicked, you will find multiple input fields so just define your VPN service provider name in the "Descriptive name" field and change "Method" to Import an existing Certificate Authority so we can insert the certificate data.

Now, from the ".ovpn" file provided to you as client, copy everything in between the openning <ca> and closing </ca> tags and paste that into the "Certificate data" field then just press on the blue Save button.

Add Client Certificate

The instructions are almost the same for this as well, but this time navigate to the Certificates tab and from there press on the green Add button to add a new certificate.

Then again, once clicked you will find multiple fields so just define your VPN service provider name in the "Descriptive name" field and change "Method" to Import an existing Certificate so we can insert the certificate data and its private key data as well for this particular case.

Now, from the ".ovpn" file provided to you as client, copy everything in between the openning <cert> and closing </cert> tags and paste that into the "Certificate data" field.

Additionally, copy everything in between the openning <key> and closing </key> tags and paste that into the "Private key data" field, now you can safely press on the blue Save button to save the certificate.

Configure OpenVPN Client on pfSense

In order to successfully configure and authenticate an OpenVPN client on pfSense you must have all certificates correctly added and configured into the Certificate Manager as expained above, so make sure everything is set to proceed.

Add Client

Apparently, it's simple to add and configure pfSense as an OpenVPN client, from the main menu just naviage to VPN > OpenVPN > Clients and once you arrive at Clients tab, you have to press on the green Add button.

Configure Client

You should now be presented with a set of options to configure the OpenVPN client and those should match the configurtion on the server, if you have followed our tutorial it would be pretty much standard options otherwise you might have to slightly change some options to match the configuration given specifically by your VPN service provider.

NOTE:

You should keep all settings presented in their default values except for the ones that will be mentioned to be changed down below.

In fact, you don't have to worry much about it because once you acquire the ".ovpn" file it should contain all the information needed to do so, lets start.

Server host or address: Change this to the IP address or the hostname for the VPN service provider.
Description: You can change this to the name of the VPN service provider.
Automatically generate a TLS Key: Untick this option then find what's in between the openning <tls-crypt> and closing </tls-crypt> tags and insert that key into the TLS Key field.
TLS Key Usage Mode: Change this to "TLS Encryption and Authentication" from the drop-down listed options.
TLS keydir direction: Change this to "Both directions" from the drop-down listed options.
Peer Certificate Authority: Select the CA certificate that we previously configured right from the drop-down listed options.
Client Certificate: Select the Client certificate that we previously configured right from the drop-down listed options.
Encryption Algorithm: Select "AES-256-CBC" right from the drop-down listed options unless for some reason confiugred differently by your VPN service provider.
Enable Negotiable Cryptographic Parameters: Untick this option unless for some reason required by your VPN service provider.
Auth digest algorithm: Select "SHA512" right from the drop-down listed options unless configured differently by your VPN service provider.
Use fast I/O operations with UDP writes to tun/tap: I recommend ticking this option on.
Gateway creation: I recommend ticking "Both" from the options available.

Normally, these steps are everything you need to follow in order to fully configure OpenVPN client for pfSense especially if you have used an installation script on the server.

You might need to do a little more or change few options in some cases, when required specifically by your VPN service provider.

Configure VPN Interface on pfSense

Assuming you have corretly configured the OpenVPN client on pfSense, we can now proceed to adding the VPN interface.

Add VPN Interface

Now, if you navigate to Interfaces > Assignments you should see that there's a new interface called "ovpnc1" available to be added.

You have to go ahead and click "Add Interface" then just give it a name in the "Description" field, simply use "VPN" and save it.

Configure Outbound NAT

You have to allow mapping of the VPN interface through the firewall, so navigate to Firewall > NAT > Outbound and follow instructions.

Once your arrive at the Outbound tab change Mode to "Manual Outbound NAT rule generation. (AON - Advanced Outbound NAT)" from the options available.

Now, if you look under "Mappings" you will find entries originally created for the WAN interface, you have to similarly re-create every entry but this time for the VPN interface we have just added.

The easiest way is to use the second option beside every entry from "Actions" column, this will duplicate any entry you want, the only thing you have to change is the interface from "WAN" to "VPN" when duplicated.

Verify Connectivity

There're two methods, you can refer to the "Interfaces" widget available on the pfSense dashboard, if you can see that VPN interface is up and has acquired an IP address on the VPN private nework, that means everything is well.

Alternatively, I think it's more convient by navigating to Status > OpenVPN then just check whether the service is alive with Virtual Address and Remote Host assigned correctly as you would expect matching the server.

How to Install OpenVPN Server Ultimately on Ubuntu 20.04

noreply@blogger.com (Saleem Almajed) — Tue, 05 Jan 2021 04:36:00 +0000

Here we going again diving into the Homelab world, I recently got my pfSense router to act as a client for my OpenVPN setup on a VPS instance that is specifically running Ubuntu 20.04 which has public static address for both Internet Protocol standards namely IPv4/IPv6 versions.

The idea is allowing your home network to be a part of another network, which is in my case helping to bypass the Carrier Grade NAT (CGN or CGNAT) that is restricting me from self hosting my own services, that is one benefit for VPN but many people will want to use it for privacy purposes especially hiding your own identity.

However, anyone as a Homelab enthusiast can definitely use this to benefit from the staic IP address provided on a VPS instance, and then you can host hour own services through pfSense firewall from home in case your Internet Service Povider (ISP) doesn't offer you a public IP address, which is awesome.

Install OpenVPN Server on Linux

To be precise, I will explain the easiest and most automated method you will ever find to configure and set up an OpenVPN server in less than a minute on the following Linux distributions:

Ubuntu
Debian
CentOS
Fedora

We will make use of a bash script in the process, I am running Ubuntu 20.04 LTS on my end.

Download Installation Script

This bash script will automatically install and configure OpenVPN and here's how you can pull it.

wget https://git.io/vpn -O openvpn-install.sh

Once downloaded into your home directory you should make it executable.

chmod -v +x openvpn-install.sh

If you are curious about its content do not hesitate to check it out.

nano openvpn-install.sh

Run Installation Script

Well, now we can run the script which is going to ask some information to input.

sudo ./openvpn-install.sh

I recommend that you use defaults for all settings by pressing Enter on your keyboard except for one, when it asks you to enter the first client certificate name which is preferably pfSense in my case or any other descriptive name for your use case.

Customize OpenVPN Server Subnet

If you wish to change the default subnet on 10.8.0.0/24 for IP addresses given to OpenVPN clients by the server, then you can follow the instructions below, otherwise you can completely skip this section.

Modify OpenVPN Server Configuration

We'll configure 10.10.10.0/24 subnet instead which looks fanatastic.

sudo nano /etc/openvpn/server/server.conf

Look for 10.8.0.0 and change it to 10.10.10.0 or your own preferred private subnet IP address.

Fix OpenVPN Firewall Rule Configuration

sudo nano /etc/systemd/system/openvpn-iptables.service

You will find four occurances of 10.8.0.0/24 just change all of them to 10.10.10.0/24 or your own preferred private subnet.

Restart OpenVPN Services

sudo service openvpn-iptables restart
sudo service openvpn-server@server restart

This will assure that all of our changes are taking effect.

How to Add New OpenVPN Client

If you wish to add another client and produce a new client certificate, then you should run the installation script again on your OpenVPN server.

sudo ./openvpn-install.sh

This time around, since it's already installed you should see the following displayed to you.

OpenVPN is already installed.

Select an option:
   1) Add a new client
   2) Revoke an existing client
   3) Remove OpenVPN
   4) Exit
Option:

Input 1 as an option and press enter, then just follow the instructions.

Configure OpenVPN Client Device

Here's how you can connect any OpenVPN client running on Windows, Linux, Android or iOS with the server using the configuration file provided to you.

The installation wizard should have automatically created an ".ovpn" configuration file in the path /root/[Client Certificate Name].ovpn which you should save and copy to your client device to connect with the OpenVPN server.

Save OpenVPN Client Configuration

In my case, it's actually /root/pfSense.ovpn on the OpenVPN server since that's the name I set for my first client. Lets copy that configuration file to our current user home directory.

sudo cp /root/pfSense.ovpn ~/

Okay, now that file will be used on the client device to connect with the server, just make sure to change "pfSense" marked in white to your own client certificate name that you have set during script installation.

cat ~/pfSense.ovpn

This way you can view the content of that configuration file and then use on the client device, but I recommend that you copy the entire file instead, as an example I will copy that file from the OpenVPN server to my Linux desktop.

scp ~/pfSense.ovpn [user]@[Linux Desktop IP]:~/

I should be able to access that file on the home directory inside my Linux desktop now.

Enable OpenVPN Client on Linux Desktop

First of all, make sure you have OpenVPN software package installed on your target Linux desktop client device, for instance if you are running Ubutnu you can install it.

sudo apt install openvpn

Assuming we have the client configuration file on the home directory we can proceed and overwrite it with OpenVPN client file.

sudo cp ~/pfSense.ovpn /etc/openvpn/client.conf

One again, remember to replace the "pfSense" client name marked in white with your own name, which you have set during script installatiion.

Test Connectivity

sudo openvpn --client --config /etc/openvpn/client.conf

Just start the OpenVPN client service on your Linux desktop, once connectivity is confirmed.

sudo systemctl start openvpn@client

That's it.

Troubleshoot OpenVPN Issues

I will provide information on how to troubleshoot OpenVPN issues on the server and client.

Check OpenVPN Services

The ideal approach to inspect issues is by exposing the logs of the services running on the OpenVPN server, let's start with the main process.

sudo service openvpn-server@server status

And then, we also have the firewall service which is specifying rules for iptables.

sudo service openvpn-iptables status

Make sure that they're both active and running well, otherwise check for logs displayed to indentify errors and solve them.

Check OpenVPN Logs

sudo journalctl --identifier openvpn

You can also use this as a general command to find all logs for OpenVPN server. You are welcome to post your issue and ask for help in the comment section below.

How to Install FTP Server for Apache or Nginx on Ubuntu 20.04

noreply@blogger.com (Saleem Almajed) — Mon, 28 Dec 2020 02:20:00 +0000

Well, I have found many articles on the web which claim to explain the installation of an FTP Server running specifically on Ubuntu 20.04 LTS but none of them seem to actually deliver a clear working and feasible solution, and that means one thing, welcome to my Homelab.

In this article, I am going through all the steps necessary for anyone to install an FTP service using VSFTPD on an instance with TLS/SSL and properly integrate it with the main web server directory for either Apache or Nginx, the way it should be done.

The end result is going to be one system user that you can use to authenticate an FTP client like FileZilla to any website root directory you have on /var/www which is the path used for web services specifically on Ubuntu itself.

Getting Started on Linux Ubuntu

Get remote access to your instance with superuser credentials provided to you. Now, lets prepare this operating system environment with the software required for an FTP server running VSFTPD.

Install Software Package

sudo apt update
sudo apt install vsftpd
sudo service vsftpd status

You should now see that VSFTPD service is actually active and running without any issues.

Setting Permissions

sudo chgrp -R www-data /var/www/*
sudo find /var/www -type f -exec chmod 664 {} \;
sudo find /var/www -type d -exec chmod 775 {} \;
sudo find /var/www -type d -exec chmod g+s {} \;
sudo chown root:root /var/www

That's like the magic touch for this particular tutorial, which is setting a proper directory permissions for our websites document root.

Configure UFW Firewall

sudo ufw allow 20,21,22,990,40000:50000/tcp
sudo ufw enable

Then, you can confirm firewall status to observe whether firewall is truly enabled with the ports forwarded.

sudo ufw status

You will only need this if your are going to use the firewall on your Ubuntu instance, otherwise you can completely skip this step.

Create FTP System User

sudo useradd sftp -d /var/www
sudo passwd sftp
sudo adduser sftp www-data
sudo echo "DenyUsers sftp" >> /etc/ssh/sshd_config
sudo systemctl reload sshd

Here we're creating the system user to authenticate an FTP client while restricting SSH access which means it's only going to be valid for use through the FTP protocol, just make sure to specify a password that you can remember.

Configure VSFTPD to Enable FTP Server

In order for VSFTPD to work on your Linux Ubuntu environment, it needs to be configured accordingly with special settings.

VSFTPD Configuration

sudo mv /etc/vsftpd.conf /etc/vsftpd.conf.bak
sudo nano /etc/vsftpd.conf

This will create a backup for the original configuration file while defining new settings. So, insert the following inside the config file created:

# FTP
listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
force_dot_files=YES
pasv_min_port=40000
pasv_max_port=50000
allow_writeable_chroot=YES

# SSL
ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

That's like everything typically needed for a perfect implementation of VSFTPD alongside a web server like Apache or Nginx running on Linux Ubuntu.

Enable SSL over TLS for VSFTPD

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

Finally, we will create an SSL certificate for FTP over TLS.

Verify FTP Server Implementation

You must restart the VSFTPD service for all changes to take effect.

sudo systemctl restart vsftpd

There you go, navigate to your favourite FTP client which happens to be FileZilla for my own preference. In particular, you will need to specify your host address, username, password and port settings.

As a result, you will use sftp for username and 21 for port, when successful you will be presented with a welcome dialog showing SSL over TLS certificate information, just confirm to complete authorization.

Starting a Library for UFW Application Profiles

noreply@blogger.com (Saleem Almajed) — Thu, 24 Dec 2020 01:52:00 +0000

Hooray, I started experimenting with UFW Firewall and thus I created some custom application profiles specifically for a Linux Ubuntu 20.04 instance runnin on my Homelab hypervisor.

So, I decided to publish and maintain a library to contain any type of application which should enhance the overall firewall experience.

Introduction for UFW Firewall on Linux Ubuntu

Uncomplicated Firewall is an advanced front-end for iptables on Linux which is an awesome firewall at its core. One of its features is Application Profiles which are INI-style files that contain profile information and numerous port settings.

This allows packages to include their own firewall settings and make them available to UFW when installed to use with simple commands.

UFWApp Library for Application Profiles

Anyway, while experimenting with default application profiles that are normally provided for UFW during software packages installation. I found that many of those settings are usually irrelevant and most of the time are very messy with bad description.

In addition, you will find that one application is installing multiple profiles for a single purpose, which is hilarious. In fact, I came up with my own implementation to sort this mess out for you, I call it the UFWApp Library which should be available on GitHub by the time I finish writing this article.

GitHub Repository

Click Here!

List of Available Applications

Please note that application type (eg. Web Server, File Transfer, Secure Shell, ETC) is what actually matters when specifying settings for UFW firewall.

Apache (Web Server)
NGINX (Web Server)
OpenSSH (Secure Shell)
Postfix (Mail Submission)
Dovecot (Mail Management)
VSFTPD (File Transfer)
FileZilla (File Transfer)
Odoo (Odoo Server)
Jekyll (Jekyll Server)

These and many more, any other alternative for such applications should apply.

How to Install UFWApp Library on Linux Ubuntu

Clone the repository provided above into your system and install the required files.

Installation

git clone https://github.com/iSmoothBlog/UFWApp.git
cd UFWApp
sudo make install

You will find a backup for old profiles in /etc/ufw/backup after installation.

NOTE:

This will swap messy profiles configured on your system to be replaced with UFWApp implementation instead.

Usage

Once installed, proceed to list all applications then exchange * with a selected profile:

sudo ufw app list
sudo ufw allow "*"

A profile selected will work for all applications in the same field. So, continue setting allow rules until you are satisfied.

Finally, you must verify UFW firewall status then reboot your system accordingly.

sudo ufw status
sudo reboot

Enjoy!

How to Configure Odoo on Reverse Proxy with SSL Certificate

noreply@blogger.com (Saleem Almajed) — Wed, 09 Dec 2020 13:26:00 +0000

If you are going to run your business with Odoo ERP in a production environment, then there's no doubt that you need a software like Nginx to act as an intermediary between the clients and the server.

Moreover, this will allow you to acquire an SSL Certificate from Let's Encrypt for free with an efficient Reverse Proxy to enable your setup. In adition, you will be able to access your Odoo web interface while using your naked domain.

On one hand, a reverse proxy will direct the traffic driven through the common 80/443 ports right into the port used by your Odoo Server configuration. On the other hand, it will run an encrypted SSL session on Nginx to provide trusted and secure connection for all users.

Getting Started on Linux Ubuntu

If you follow this tutorial it really doesn't matter what distribution of Linux you are running. However, we initially started this series of articles with Odoo ERP installed on Ubuntu 20.04 LTS so that means the only difference will be the package manager for software installation.

Install Software Packages

sudo apt install nginx certbot python3-certbot-nginx

Enable Proxy Mode on Odoo Server

In fact, please make sure that you have entered the correct path of the config file for your particular case. Otherwise, if you are following our Odoo ERP series then it should be exactly as stated below.

sudo nano /etc/odoo-server.conf

Now, ensure that you uncomment proxy_mode = True from the options available, or just input that line anywhere if it's not present. If you want to go next level with security measures. In addition, you can bind Odoo Server with local connections only and let the Revere Proxy handle the rest.

proxy_mode = True
xmlrpc_interface = 127.0.0.1
netrpc_interface = 127.0.0.1

Enable Reverse Proxy with SSL on Nginx

Hey, lets make it clear that we're going to teach you here how to set the perfect Reverse Proxy with SSL connection for Odoo Server.

Prepare Nginx for SSL

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
sudo mkdir -p /var/lib/letsencrypt/.well-known
sudo chgrp www-data /var/lib/letsencrypt
sudo chmod g+s /var/lib/letsencrypt

Create SSL Snippets

We will start with Let's Encrypt configuration snippets.

sudo nano /etc/nginx/snippets/letsencrypt.conf

Given the above, please insert the following inside the config file created:

location ^~ /.well-known/acme-challenge/ {
  allow all;
  root /var/lib/letsencrypt/;
  default_type "text/plain";
  try_files $uri =404;
}

After that, we have the SSL session and stapling configuration snippets.

sudo nano /etc/nginx/snippets/ssl.conf

As a result, please insert the following inside the config file created:

ssl_dhparam /etc/ssl/certs/dhparam.pem;

ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;

That sums it up as a whole for those snippets.

Configure Odoo Website on Nginx

Okay, please make sure right from now to change all occurrences of example.com with your own domain.

sudo nano /etc/nginx/sites-available/example.com

Given the above, please insert the following inside the config file created:

server {
    listen 80;

    server_name example.com;

    root /var/www/html;
    index index.nginx-debian.html;

    include snippets/letsencrypt.conf;

    location / {
        try_files $uri $uri/ =404;
    }
}

Well, now lets create another server block for production purposes, that's because the first one will only be used to generate the SSL Certificate and thus removed.

sudo nano /etc/nginx/sites-available/example.com.production

As a result, please insert the following inside the config file created:

# Odoo Servers
upstream odoo {
 server 127.0.0.1:8069;
}

upstream longpolling {
 server 127.0.0.1:8072;
}

# HTTP -> HTTPS
server {
    listen 80;
    server_name www.example.com example.com;

    include snippets/letsencrypt.conf;
    return 301 https://example.com$request_uri;
}

# WWW -> NON WWW
server {
    listen 443 ssl http2;
    server_name www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    include snippets/ssl.conf;
    include snippets/letsencrypt.conf;

    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    proxy_read_timeout 720s;
    proxy_connect_timeout 720s;
    proxy_send_timeout 720s;

    # Proxy headers
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;

    # SSL parameters
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    include snippets/ssl.conf;
    include snippets/letsencrypt.conf;

    # log files
    access_log /var/log/nginx/odoo.access.log;
    error_log /var/log/nginx/odoo.error.log;

    # Handle longpoll requests
    location /longpolling {
        proxy_pass http://longpolling;
    }

    # Handle direct requests
    location / {
       proxy_redirect off;
       proxy_pass http://odoo;
    }

    # Cache static files
    location ~* /web/static/ {
        proxy_cache_valid 200 90m;
        proxy_buffering on;
        expires 864000;
        proxy_pass http://odoo;
    }

    # Gzip
    gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
    gzip on;
}

Last, you need to enable the web server block we have just created.

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo service nginx reload

That's it for this part. Go next!

Generate SSL Certificate from Let's Encrypt

Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. What should we care about? It will enable the SSL connection on Nginx for us once we run a few commands.

Create SSL Certificate

sudo certbot certonly --agree-tos --email yourname@gmail.com --webroot -w /var/lib/letsencrypt/ -d example.com -d www.example.com

Enable Odoo Website for Production

sudo rm -rf /etc/nginx/sites-available/example.com
sudo mv /etc/nginx/sites-available/example.com.production /etc/nginx/sites-available/example.com
sudo service nginx reload
sudo service odoo restart

Automate Certificate Renewal

sudo nano /etc/letsencrypt/renewal/example.com.conf

Given the above, please insert the following line right below [renewalparams] inside the config file:

renew_hook = systemctl reload nginx

This will act as a renewal hook that will automatically reload the config files on Nginx once a new certificate has been issued. Thus, there will be no need for any interaction from your side anymore.

How to Install Odoo 14 on Ubuntu 20.04

noreply@blogger.com (Saleem Almajed) — Mon, 07 Dec 2020 05:42:00 +0000

Here we go as I started my journey with ERP initially on my personal Homelab, this article explains how to fully install and configure an Odoo environment for production purposes.

This is a true experience that I had on a Linux VPS instance running Ubuntu 20.04 LTS while I am an extreme IT Expert, trust every step.

By the way, since I have been enjoying an instance on x4 CPU Cores with 8GB RAM configuration from Contabo which is a german hosting service provider, let me tell you that it's the best price to features deal you will ever find.

Getting Started on Linux Ubuntu

Get remote access to your instance with root credentials provided to you. Now, lets prepare this operating system environment with the software required for an Odoo ERP system.

Install Software Packages

apt update
apt install git postgresql python3-pip build-essential wget python3-dev python3-venv python3-wheel libfreetype6-dev libxml2-dev libzip-dev libldap2-dev libsasl2-dev python3-setuptools node-less libjpeg-dev zlib1g-dev libpq-dev libxslt1-dev libldap2-dev libtiff5-dev libjpeg8-dev libopenjp2-7-dev liblcms2-dev libwebp-dev libharfbuzz-dev libfribidi-dev libxcb1-dev node-less node-clean-css nodejs npm
npm install -g rtlcss

Okay, we actually need to install a compatible "wkhtmltopdf" package for Odoo 14 instead of the one available in the official repositories.

sudo wget https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6-1/wkhtmltox_0.12.6-1.bionic_amd64.deb
sudo apt install ./wkhtmltox_0.12.6-1.bionic_amd64.deb

That's like all the software packages required to proceed.

Create System User

useradd -m -d /opt/erp -U -r -s /bin/bash erp
passwd erp
usermod -aG sudo erp
su - erp

Note that we're setting /opt/erp as home directory for the new user account. By now, your terminal should have switched user to erp and thus we will start issuing commands with sudo.

sudo su - postgres -c "createuser -s erp"

The postgresql database system is the core for Odoo where all data will be stored, just make sure to create a database user with the same name as the one we created for the system itself.

Get Logging Directory

sudo mkdir /var/log/odoo
sudo chown erp:erp /var/log/odoo

This sums it up for a preparation plan! Now, the star of the show Odoo is awating.

Install Odoo Community Edition

Typically, you can pull the community version of Odoo ERP from GitHub that will gaurantee the latest updates and fixes. In fact, you should have Odoo 14 as the latest version availale on the stable branch, by the date we published this article.

Clone GitHub Repository

git clone https://www.github.com/odoo/odoo --depth 1 --branch 14.0 /opt/erp/odoo
cd /opt/erp

Install Python Requirements

python3 -m venv odoo-venv
source odoo-venv/bin/activate

Once created, you can proceed to install the python dependencies.

pip3 install wheel
pip3 install -r odoo/requirements.txt
deactivate

We're utilizing a Python Virtual Environment here. At its core, the main purpose is to create an isolated environment for Odoo itself and no other.

Configure Odoo Server

mkdir /opt/erp/odoo-addons
sudo nano /etc/odoo-server.conf

Given the above, please insert the following inside the configuration file created:

[options]

; General
admin_passwd = YOUR-MASTER-PASSWORD
#proxy_mode = True
longpolling_port = 8072
xmlrpc_port = 8069
#xmlrpc_interface = 127.0.0.1
#netrpc_interface = 127.0.0.1

; Database
db_host = False
db_port = False
db_user = erp
db_password = False

; Workers
#limit_memory_hard = 2684354560
#limit_memory_soft = 2147483648
#limit_request = 8192
#limit_time_cpu = 600
#limit_time_real = 1200
max_cron_threads = 1
workers = 0

; File Paths
logfile = /var/log/odoo/odoo-server.log
addons_path = /opt/erp/odoo/addons,/opt/erp/odoo-addons

Finalize your configuration process with giving odoo the permissions for access:

sudo chown erp:erp /etc/odoo-server.conf
sudo chmod 640 /etc/odoo-server.conf

Enable Odoo Server to Run on Startup

To summarise, you should have Odoo Server completely set and configured by this time, it's ready to work on serving business application for a website. Therefore, create a system service that works on system boot, and it will run the server automatically whithout any interaction.

Create System Service

sudo nano /etc/systemd/system/odoo.service

As a result, please insert the following inside the service file created:

[Unit]
Description=odoo
Requires=postgresql.service
After=network.target postgresql.service

[Service]
Type=simple
SyslogIdentifier=odoo
PermissionsStartOnly=true
User=erp
Group=erp
ExecStart=/opt/erp/odoo-venv/bin/python3 /opt/erp/odoo/odoo-bin -c /etc/odoo-server.conf
StandardOutput=journal+console

[Install]
WantedBy=multi-user.target

Run Odoo Server

sudo systemctl daemon-reload
sudo systemctl enable --now odoo
sudo systemctl status odoo
sudo journalctl -u odoo

In conclusion, ensure that Odoo Server is alive and running fine with commands stated above. To illustrate, open your browser and type in address bar http://<your_domain_or_IP_address>:8069 then enjoy your new life in business.

A Journey with an Advanced ERP Software

noreply@blogger.com (Saleem Almajed) — Sat, 21 Nov 2020 11:48:00 +0000

It's been long since the last time I have posted on this blog, I recently decided to start a freelance job locally at Bahrain which happens to be my home country. In fact, I actually worked for about 6 months officially under a well known company in the same field.

Here we come, Odoo previously known as OpenERP the Open Source ERP and CRM software which contains a large collection of business-related applications and modules such as CRM, Sales, Purchase, Inventory Management and many more. Well, lets make it clear that ERP stands for Enterprise Resource Planning.

The Beginning of the Journey

Of course, it's my Homelab which is going to be the star of the show for this one. Initially, I have downloaded the official Ubuntu 20.04.1 LTS (Focal Fossa) image and registered the ISO at VMWare ESXI Hypervisor operating on my Dell PowerEdge R720 server.

By the way, there're two options to go with this ERP software for your business, it's either you choose their enterprise solution or you fly with the Community Edition which is completely open source and must be self-hosted. Here, you can find the project code on GitHub while apparently I myself wil be hosting Odoo Version 14 for a long time.

Exploring Odoo ERP System

So, I followed the instructions on GitHub to setup the software on my Linux instance and it went smoothly. After that, I navigated to the IP address of that VM in my case on 10.10.10.18:8069 where the fun started I played around and installed a handful of applications, I won't lie the most interesting one was the Point of Sale module.

Definitely, I won't be walking you through all the features and modules avaiable but I can tell you it's unbelievable. I reached this point after analysing the Inventory Management module from where I created a couple of product templates to demonstrate the process, I defined multiple warehouses with stock locations as well to go with.

The example above shows a particular product quantity on hand being distributed between all the stock locations available within my virtual company. Moreover, you can do a lot more like transfering stock from one location to another and much more.

The Journey Has Begun

Indeed, I can guess that you can tell where this blog is going to focus on, I will be preparing a lot of tutorials related to ERP and how to troubleshoot Odoo from all kind of errors and issues. Additionally, I will be supporting this development platform for a very long time, I am planning to be known and sometime hired as an Odoo Developer from now on.

How to Connect Cisco Switch with Serial Console Port on Linux

noreply@blogger.com (Saleem Almajed) — Fri, 19 Jul 2019 00:34:00 +0000

Yeah, I managed to put my hands on a Cisco Catalyst 3560G Series switch which was specifically meant for enterprise use cases and I actually got it from the local market selling used stuff at my country, it's working perfectly in a very good condition.

Of course, the first thing you will have to do after purchasing a used network switch is resetting it to factory settings and it's really straight forward when it comes to Cisco switches, I will write about that later on in a new post.

Then, you definitely want to configure it to work in your own network with specific settings because it is a smart switch for which you want to reach its command line through the serial console interface and that's what I am going to explain in details today.

Since I am labeling this as a Homelab tutorial where we mostly like to run Linux on our servers and desktop computers, I would rather explain through steps specifically on that operating system and its widely known distributions including:

Debian based distributions like Ubuntu, Elementary OS, Mint, etc.
RPM Package Manager (RPM) based distributions like CentOS, Fedora, etc.
Pacman Package Manager based distributions like Arch and Manjaro.

And many others, there's no limit for the diversity of an open source project like Linux but definitely the software and steps we are going to use are the same.

Install Minicom from Package Manager

That's why I've been mentioning each distribution matched with its package manager. We need to install the package for "Minicom" which is described by the maintainer as follows:

Minicom is a text-based serial port communications program. It is used to talk to external RS-232 devices such as mobile phones, routers, and serial console ports.

Now, just figure out what is the package manager for your Linux distribution and open up a terminal on your screen.

Debian/Ubuntu

sudo -s
apt update
apt install minicom
exit

RPM

sudo -s
yum install minicom
exit

Pacman

sudo -s
pacman -S minicom
exit

That's about it, you should now be ready to go.

Connect RJ45 Console Port to Linux Computer

In order to connect with the RJ45 console port on the back of your Cisco switch you have two options.

RS232 to RJ45

This is actually the cable that comes packed originally in the box when you buy the switch, if you don't have one of these just buy from AliExpress or Amazon. I got mine from this seller on that link.

This won't work if your Linux computer motherboard doesn't have an RS232 DB9 COM Serial Port which leaves you with the second option.

USB to RJ45

This might be the ideal choice for many of you, because every motherboard will definitely include some USB ports. I also happen to have one of these and I bought it from this seller on that link.

Configure Minicom to Work with Cisco Switch

Okay, it's time to create a Minicom configuration file.

Find Serial Connection Path

The moment you connect the switch from its RJ45 console port to your Linux computer, open up a terminal and enter.

dmesg | grep tty

Let me show you a sample output if you are using an RS232 to RJ45 cable.

[    0.000000] console [tty0] enabled
[    0.726168] 00:08: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A

In the other hand if you are using an USB to RJ45 cable, you should get something like this.

[155582.296838] usb 3-2: FTDI USB Serial Device converter now attached to ttyUSB0

What you are looking for is the text marked with white colour as shown in the samples above. Now, accordingly for each output sample the serial connection path is:

/dev/ttyS0
/dev/ttyUSB0

Note yours down and proceed to the next step.

Create Configuration File

Again, open the terminal and enter.

sudo minicom -s

You will be greeted with the main menu list for Mnicom now go to Configuration → Serial Port Setup and you should see another menu to define which serial port path you are going to use.

Now, press A on your keyboard and enter the serial connection path that you have noted from the previous step which is for example something like this /dev/ttyUSB0 in my case, then press Enter to go back to the serial port setup menu.

Next, press E on your keyboard, resulting in another menu for Bps/Par/Bits rate, from that menu press C to set the rate to 9600 8N1 then press Enter to go back to the serial port setup menu.

Last but not least, I prefer to enable the Hardware Flow Control so just press F on your keyboard and toggle that option to Yes then press Enter to go back to Minicom main menu.

In the main menu choose the Save setup as option and give it a name, in my case I named it as cisco then finally press Enter and you have successfully created a Minicom configuration file to connect with your Cisco switch.

Communicate with Cisco Switch Serial Console

Basically, every time you want to communicate with your Cisco switch you will only have to load the configuration file that you have created for Minicom with a simple single command from the terminal.

sudo minicom cisco

Notice that I am running Minicom calling the "cisco" configuration file that we created earlier, if everything is done correctly press "Enter" right after you run that command and you will be presented with something like this:

Welcome to minicom 2.7.1

OPTIONS: I18n 
Compiled on Aug 13 2017, 15:25:34.
Port /dev/ttyUSB0, 02:35:45

Press CTRL-A Z for help on special keys


Switch>

If you can see the hostname "Switch" then that indicates it has connected successfully, enter any command to the switch like show interface for example, and see if you are getting a response to make sure.

How to Install VMware ESXi 6.7 on Dell PowerEdge R720

noreply@blogger.com (Saleem Almajed) — Mon, 01 Jul 2019 07:31:00 +0000

As I stated in the previous post, I am building a computer lab at home and I acquired a Dell PowerEdge R720 server which is going to be the backbone of my homelab.

This awesome machine was built for the sole purpose of serving as a powerhouse for enterprise use cases, even the giant Google is using a special rebranded variant of that Dell server model at their data centers.

Today, I decided to utilize all my server resources for virtualization where I can host as many operating systems as I wish with whatever software or service I desire. Thus, I am going to install the famous VMware ESXi 6.7 U3 hypervisor and explain every step on this article.

Get DellEMC Customized Image for VMware ESXi 6.7 U3

Now, even though the R720 is not officially supported by this new image, trust my word that it will work perfectly on this server especially for a homelab user. The only disadvantage is that you are not getting official support from Dell which can only concern enterprise users.

Download

Click Here!

Just scroll down to find the download link for the ISO Image and get that.

Flash Installation Image

Even though you can typically burn the ISO file into a DVD as the server has a drive for it. I would suggest that you use a USB flash memory stick which is more convenient at least in my opinion. So, we're going to use a small utility called Rufus, visit their website and grab your link.

Insert the flash device into your machine.
Select your installation media under "Device" where in my case it was a 8GB USB flash memory.
Select "MBR" partition scheme.
Choose "BIOS or UEFI" as your target system.

Now, click the "Start" button and wait for that bar to be fully green in "READY" state as shown in the picture above, then remove the installation media when finished.

Boot Installation Media on Dell R720 Server

First of all, I prefer installing the VMware hypervisor into the internal USB flash port not to be confused with the installation media itself. If you open the top cover you will find a USB port inside the case near the power supply housing on the motherboard where you can insert a flash drive.

This way we will avoid wasting a whole hard drive to contain solely the hypervisor itself. I will bring a spare USB flash to be permanently attached to the internal USB port where I will install the hypervisor to it after booting to the installation media that we just prepared.

Insert the installation flash drive into the front USB port then power on your R720 server.
Wait for the system to boot then press "F11" to enter the "UEFI Boot Manager".
On the "Boot Manager Main Menu" select "UEFI Boot Menu".
From the boot options appearing on your screen select "Disk Connected to front USB".

There you are, now ESXi is supposedly loading the installer.

Install VMware ESXi Hypervisor

Well, nothing too fancy here when you get into the installation screen just follow the dialogs and accept the terms and conditions. What is important is that when it asks you Select a Disk to install or upgrade please make sure to choose the internal USB drive or whatever else you want to put the hypervisor on.

After that, it will ask you about your preferred "Keyboard Layout" configuration and then you will be presented with a dialog to set your root password which will be used mainly to enter the management interface, that's all.

Please make sure to remove your installation media after it finishes, it will ask you to do so anyway before rebooting the system.

Network Configuration for Management Interface

The first thing I would do on my first boot is configuring a static IP address which will make the web management interface for that server much easier to reach on my internal network. Now, if you have done any configuration it will automatically defaults to DHCP but I don't want that.

To manually configure the network interface:

Press "F2" to enter the system customization menu from the host machine.
Authenticate yourself by entering the same password that you have specified for root during he installation.
Select "Configure Management Network".

Okay, in my case I went to IPv4 Configuration then I ticked "Set static IPv4 address" and enter my network configuration. I set it up on an IP address of 10.0.0.200 since this is the main subnet on my homelab network.

Finally, you can save configuration then logout.

Final Thoughts

I should now be able to reach my management interface for that hypervisor host server on this address https://10.0.0.200, so let me enter this on my browser.

Yes success! I am welcomed with a login screen, I entered "root" as the username and the password that I have set during the installation. Let me learn more about it and then I will be back to share my experience.

How to Use Pi Hole on your pfSense Router

noreply@blogger.com (Saleem Almajed) — Thu, 27 Jun 2019 23:02:00 +0000

I've started experimenting at home with enterprise grade gear of network switches and servers, this trend is referred to as a Homelab and there's a big community around it.

Soon I will be covering every part of my humble homelab in a separate post. For now, I decided to write this article to help beginners who have installed Pi Hole on a VM or maybe a Raspberry Pi and don't really know how to configure thier pfSense router properly with Pi Hole as the primary DNS server.

Determine IP Address Information

Now, I suppose you have to determine the IP addresses of both:

pfSense Router
Pi Hole VM or Device

Please make sure you have assigned a static IP address for the Pi Hole server.

Configure pfSense Router with Pi Hole

From your pfSense control panel which happens to be on this address https://10.0.0.1 in my case. Please proceed from the menu above to System → General Setup → DNS Server Settings where you should find this:

Please refer to the image above and make sure you have added the Pi Hole IP address as a new DNS Server which is 10.0.0.100 in my case. In addition to that, untick both of those options you can find at the bottom.

Allow DNS server list to be overridden by DHCP/PPP on WAN
Do not use the DNS Forwarder/DNS Resolver as a DNS server for the firewall

After that, proceed to Services → DNS Resolver → General Settings where you will find settings related to pfSense native DNS resolver, now make sure you have all of the following options ticked:

Enable DNS resolver
Enable DNSSEC Support
Enable Forwarding Mode

That's it, now you can proceed to the final step which is confirming everything is working as intended.

Ensure Pi Hole is Working

Okay, now you can go to your Pi Hole admin panel which is in my case hosted on this address http://10.0.0.100/admin/ then you should open a web browser on any of your pfSense router client devices, try visiting any website and observe what's happening on the Pi Hole admin panel overview.

If you can see live information about the DNS queries that Pi Hole server is receiving while surfing the web on your client devices, that indicates everything is configured properly.

How to Remove DRM from Dark Horse Comics

noreply@blogger.com (Saleem Almajed) — Sat, 28 Jan 2017 12:51:00 +0000

Over the past 5 years, we've been providing many tutorials on how to remove DRM from eBooks and such. Today, I'd like to share with you a method that will let you download a DRM-Free copy of your legally purchased Dark Horse Comics content directly from browser through their official site.

You can follow this tutorial for instructions about DRM Removal simply by using user scripts on your browser. If you have any question or concerns about whether is it legal or not you are welcome to see our DRM Policy.

This is only legal as long as you are the original owner of the content and you are planning to remove DRM to fully gain the right of ownership NOT for sharing it.

How Does it Work

Basically, you will need to enable user scripts over Greasy Fork, depending on your browser you have to install a certain addon, then navigate to acquire and install what seems to be some sort of a Dark Horse Comics Downloader script.

With that being said, let me post a quotation written by the original author of this script:

Made by Hayden Schiff (oxguy3), license is Creative Commons Zero.

This script makes it really easy to download a DRM-free copy of your digital comics on Dark Horse Digital. Simply go to your Dark Horse bookshelf, then disable "Stack by Series" and switch to Gallery View if you haven't already. You will now see a "Download" button below all your comics.

When you click the download button for any of your comics, it'll open the reader for that comic, then start downloading the comic. A red box in the middle of the screen will show you the progress of the download (be warned that things may be a bit laggy while it's downloading). Once it's done, a .CBZ file will pop into your downloads!

If you aren't familiar, a .CBZ file is just a zip file full of JPGs. You can easily open it with a reader app or convert it to a PDF or whatever.

Do not send the (DRM-Free) content to anybody else and keep it only for self-use and also keep in mind that the purpose of removing DRM is to enjoy your legally purchased Books or Media on other devices.

How to Use

Well, I can sum things up in order within the following steps to make it easier:

Enable User Scripts: To be able to run user scripts, you need to install a specific addon according to your browser.
Install Script: Simply install the required script for Dark Horse Comics by pressing on the green button.
Download DRM-Free Copy: Go to your Dark Horse bookshelf, then disable "Stack by Series" and switch to Gallery View if you haven't already.

When everything is done correctly, you should now see a "Download" button below all your comics, that will let you download a clean copy as a ".CBZ" file that can be converted easily to any other format including PDF or EPUB.

JekySimple is a Static Site Management Tool for Jekyll

noreply@blogger.com (Saleem Almajed) — Sat, 14 Jan 2017 20:47:00 +0000

Recently, I started my journey with Jekyll that led me to discover a whole new approach to the blogging realm which is basically a Static Site Generator that let you create extremely accessible and functional static websites including blogs, of course.

In fact, during the course of my experience I found that it's extremely frustrating to keep going through many steps to achieve some routine management tasks such as building, previewing, posting, deploying, etc.

So, that motivated me to create an easy-to-use tool which does all those things simply with individual commands, and I decided to assign JekySimple for a name representing my humble project as a whole, the tool now is available on a git repository.

GitHub Repository

JekySimple

JekySimple Overview

JekySimple is a humble bash script created for Jekyll as a management tool to steadily generate static sites with simple and individual commands on Linux based operating systems, it only requires one-time configuration for a single user along with the ability to support multiple accounts.

Main Features

Lets start listing the most desirable features that JekySimple does offer:

Ability to initialize and automatically configure Git Repositories for Jekyll.
Ability to post dynamically into Jekyll including date with pre-configured post templates.
You can specify a text editor to be used when ever you want to create a post.
You can preview your changes with a simple command locally.
You can build Jekyll easily using one command with all your preferred settings.
It has a "clean" function to automatically clear all temporary and unnecessary files.
Ability to deploy your site into Git Repositories or local Webservers.
Support for auto-deploy and auto-commit features.
GitHub Pages integration with an option to specify "master" or "gh-pages" branch for deployment.
You can create multiple configuration files for different users with unique settings.
All variables fall back to default when empty or missing from user config file.

That and many more, I would like to state that each task will require a single command to perform, which makes routine management much easier for you to do.

Requirements

This means you can't use JekySimple without the following conditions:

Any Linux OS with Bash.
Git initializing and deployment features require a "git" package to be installed.
You must already be able to build Jekyll normally just to make sure that everything is working.

So, that's all as far as I can tell.

Limitations

I would like to highlight the following limiting factors:

It cannot work if you haven't installed and configured Jekyll properly.

I will be listing more while testing, I am not entirely sure at the moment.

Usage

Basically, after you prepare a special config file with your desired settings, you let Jekysimple do all the stuff that are pre-configured already with a single command.

Initialize Git Repository

jekysimple init

This command will let you either initialize a completely new git repository that you have just created remotely, or clone an already existing Jekyll project to be paired with JekySimple. Anyway, if you prefer to just initialize git manually by yourself, then just fill required git information inside config file and skip this.

New Post

jekysimple post

This option is used whenever you want to publish a new post, it will automatically enclose the date within a typical post template that you can customize. After that, it will launch your favorite text editor for you to edit the new post and save it.

Preview Jekyll Locally

jekysimple preview

That will technically perform jekyll serve command but with your pre-configured settings for JekySimple, which will execute a local web service into the system so that you can preview the site on your browser before deploying it.

Build Jekyll Site

jekysimple build

Similarly, that will technically perform jekyll build command but with your pre-configured settings for JekySimple.

Deploy to Git/Webserver

jekysimple deploy

Once you are confident and satisfied with the results after building/previewing, you can use this command to deploy changes online into your git repository host, make sure that you have identified git credentials correctly inside the config file.

Clean Build/Metadata

jekysimple clean

Well, nothing too fancy here it's quite self explanatory, this will firstly delete the built site from your system since you don't need that after deploying. Secondly, it will clean the source from Jekyll cache and metadata.

How to Add Simple Numeric Page Navigation Feature for Blogger

noreply@blogger.com (Saleem Almajed) — Sun, 18 Dec 2016 01:47:00 +0000

Unfortunately, Blogger platform has no support for Numeric Page Navigator by default, and that might be confusing for the regular reader. Probably, because it's something that they are unfamiliar with, and not the mention how simple it can make your blog to navigate.

Of course, everyone knows that Blogger is extremely flexible and customizable blogging platform. Today, I am going to show you how to add basic page navigation with numbers featuring Font Awesome arrow icons as Next and Previous buttons.

Demo

Live View

Numeric Pager Navigation Features

This is our implementation of this numbered pages blogger modification, and we focused mostly on making it as simple and functional as possible, here are the features:

You can reach first and last page from anywhere.
The list of pages wont exceed more than three at a time.
Font Awesome arrow icons support.
Implemented with minimal JavaScript and CSS.
Works on blog index pages and labels as well.
Works very well with responsive templates.

That's all, you can post your suggestions in the comment section below, if you wish to see further improvements and features to this modification.

How to Add Numbered Pager to Blogger

From your Blogger Dashboard go directly to Template → Edit HTML then follow the steps accordingly.

Ensure Font Awesome Support

You have to make sure that your template support Font Awesome icons by adding the following code (ABOVE) your </head> ending tag.

<link href='//maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css' rel='stylesheet'/>

If your template already has this code, then just skip this and proceed to the next step.

Add JavaScript/CSS for Numeric Navigation

Look for </body> ending tag and put the following code (ABOVE) it:

<script type='text/javascript'>
//<![CDATA[
    var perPage = 5;
    var numPages = 3;
    var prevText = '<i aria-hidden="true" class="fa fa-angle-double-left"></i>';
    var nextText = '<i aria-hidden="true" class="fa fa-angle-double-right"></i>';
    var urlactivepage = location.href;
    var home_page = "/";
    var noPage;
    var currentPage;
    var currentPageNo;
    var postLabel;
    pagecurrentg();

    function looppagecurrentg(pageInfo) {
        var html = '';
        pageNumber = parseInt(numPages / 2);
        if (pageNumber == numPages - pageNumber) {
            numPages = pageNumber * 2 + 1
        }
        pageStart = currentPageNo - pageNumber;
        if (pageStart < 1) pageStart = 1;
        lastPageNo = parseInt(pageInfo / perPage) + 1;
        if (lastPageNo - 1 == pageInfo / perPage) lastPageNo = lastPageNo - 1;
        pageEnd = pageStart + numPages - 1;
        if (pageEnd > lastPageNo) pageEnd = lastPageNo;
        var prevNumber = parseInt(currentPageNo) - 1;
        if (currentPageNo > 1) {
            if (currentPage == "page" && currentPageNo == 2) {
                html += '<span class="showpage prevpage"><a href="' + home_page + '">' + prevText + '</a></span>'
            } else if (currentPage == "label" && currentPageNo == 2) {
                html += '<span class="displaypageNum prevpage"><a href="/search/label/' + postLabel + '?&max-results=' + perPage + '">' + prevText + '</a></span>'
            }
        }
        if (currentPageNo > 2) {
            if (currentPage == "page") {
                html += '<span class="displaypageNum prevpage"><a href="#" onclick="redirectpage(' + prevNumber + ');return false">' + prevText + '</a></span>'
            } else {
                html += '<span class="displaypageNum prevpage"><a href="#" onclick="redirectlabel(' + prevNumber + ');return false">' + prevText + '</a></span>'
            }
        }
        if (pageStart > 1) {
            if (currentPage == "page") {
                html += '<span class="displaypageNum"><a href="' + home_page + '">1</a></span>'
            } else {
                html += '<span class="displaypageNum"><a href="/search/label/' + postLabel + '?&max-results=' + perPage + '">1</a></span>'
            }
        }
        if (pageStart > 2) {
            html += ' ... '
        }
        for (var jj = pageStart; jj <= pageEnd; jj++) {
            if (currentPageNo == jj) {
                html += '<span class="pagecurrent">' + jj + '</span>'
            } else if (jj == 1) {
                if (currentPage == "page") {
                    html += '<span class="displaypageNum"><a href="' + home_page + '">1</a></span>'
                } else {
                    html += '<span class="displaypageNum"><a href="/search/label/' + postLabel + '?&max-results=' + perPage + '">1</a></span>'
                }
            } else {
                if (currentPage == "page") {
                    html += '<span class="displaypageNum"><a href="#" onclick="redirectpage(' + jj + ');return false">' + jj + '</a></span>'
                } else {
                    html += '<span class="displaypageNum"><a href="#" onclick="redirectlabel(' + jj + ');return false">' + jj + '</a></span>'
                }
            }
        }
        if (pageEnd < lastPageNo - 1) {
            html += '...'
        }
        if (pageEnd < lastPageNo) {
            if (currentPage == "page") {
                html += '<span class="displaypageNum"><a href="#" onclick="redirectpage(' + lastPageNo + ');return false">' + lastPageNo + '</a></span>'
            } else {
                html += '<span class="displaypageNum"><a href="#" onclick="redirectlabel(' + lastPageNo + ');return false">' + lastPageNo + '</a></span>'
            }
        }
        var nextnumber = parseInt(currentPageNo) + 1;
        if (currentPageNo < lastPageNo) {
            if (currentPage == "page") {
                html += '<span class="displaypageNum nextpage"><a href="#" onclick="redirectpage(' + nextnumber + ');return false">' + nextText + '</a></span>'
            } else {
                html += '<span class="displaypageNum nextpage"><a href="#" onclick="redirectlabel(' + nextnumber + ');return false">' + nextText + '</a></span>'
            }
        }
        var pageArea = document.getElementsByName("pageArea");
        var blogPager = document.getElementById("blog-pager");
        for (var p = 0; p < pageArea.length; p++) {
            pageArea[p].innerHTML = html
        }
        if (pageArea && pageArea.length > 0) {
            html = ''
        }
        if (blogPager) {
            blogPager.innerHTML = html
        }
    }

    function totalcountdata(root) {
        var feed = root.feed;
        var totaldata = parseInt(feed.openSearch$totalResults.$t, 10);
        looppagecurrentg(totaldata)
    }

    function pagecurrentg() {
        var thisUrl = urlactivepage;
        if (thisUrl.indexOf("/search/label/") != -1) {
            if (thisUrl.indexOf("?updated-max") != -1) {
                postLabel = thisUrl.substring(thisUrl.indexOf("/search/label/") + 14, thisUrl.indexOf("?updated-max"))
            } else {
                postLabel = thisUrl.substring(thisUrl.indexOf("/search/label/") + 14, thisUrl.indexOf("?&max"))
            }
        }
        if (thisUrl.indexOf("?q=") == -1 && thisUrl.indexOf(".html") == -1) {
            if (thisUrl.indexOf("/search/label/") == -1) {
                currentPage = "page";
                if (urlactivepage.indexOf("#PageNo=") != -1) {
                    currentPageNo = urlactivepage.substring(urlactivepage.indexOf("#PageNo=") + 8, urlactivepage.length)
                } else {
                    currentPageNo = 1
                }
                document.write("<script src=\"" + home_page + "feeds/posts/summary?max-results=1&alt=json-in-script&callback=totalcountdata\"><\/script>")
            } else {
                currentPage = "label";
                if (thisUrl.indexOf("&max-results=") == -1) {
                    perPage = 20
                }
                if (urlactivepage.indexOf("#PageNo=") != -1) {
                    currentPageNo = urlactivepage.substring(urlactivepage.indexOf("#PageNo=") + 8, urlactivepage.length)
                } else {
                    currentPageNo = 1
                }
                document.write('<script src="' + home_page + 'feeds/posts/summary/-/' + postLabel + '?alt=json-in-script&callback=totalcountdata&max-results=1" ><\/script>')
            }
        }
    }

    function redirectpage(numberpage) {
        jsonstart = (numberpage - 1) * perPage;
        noPage = numberpage;
        var nameBody = document.getElementsByTagName('head')[0];
        var newInclude = document.createElement('script');
        newInclude.type = 'text/javascript';
        newInclude.setAttribute("src", home_page + "feeds/posts/summary?start-index=" + jsonstart + "&max-results=1&alt=json-in-script&callback=finddatepost");
        nameBody.appendChild(newInclude)
    }

    function redirectlabel(numberpage) {
        jsonstart = (numberpage - 1) * perPage;
        noPage = numberpage;
        var nameBody = document.getElementsByTagName('head')[0];
        var newInclude = document.createElement('script');
        newInclude.type = 'text/javascript';
        newInclude.setAttribute("src", home_page + "feeds/posts/summary/-/" + postLabel + "?start-index=" + jsonstart + "&max-results=1&alt=json-in-script&callback=finddatepost");
        nameBody.appendChild(newInclude)
    }

    function finddatepost(root) {
        post = root.feed.entry[0];
        var timestamp1 = post.published.$t.substring(0, 19) + post.published.$t.substring(23, 29);
        var timestamp = encodeURIComponent(timestamp1);
        if (currentPage == "page") {
            var pAddress = "/search?updated-max=" + timestamp + "&max-results=" + perPage + "#PageNo=" + noPage
        } else {
            var pAddress = "/search/label/" + postLabel + "?updated-max=" + timestamp + "&max-results=" + perPage + "#PageNo=" + noPage
        }
        location.href = pAddress
    }
//]]>
</script>

Note: You can configure this script (if you want) to suit your blog layout by changing values marked at the top of the code.

Option (1): Change 5 to the number of posts shown in each page.

Option (2): Change 3 to the number of pages shown at one time inside the navigator.

Option (3): Change <i aria-hidden="true" class="fa fa-angle-double-left"></i> to any other Font Awesome navigation arrow or even just a simple text to indicate the (Previous) button.

Option (4): Change <i aria-hidden="true" class="fa fa-angle-double-right"></i> to any other Font Awesome navigation arrow or even just a simple text to indicate the (Next) button.

Now lets proceed to the next step, we need to include the CSS style code into the template, search for </head> ending tag again and add the following code (ABOVE) it.

<style type='text/css'>
.blog-pager {
    background: none;
    clear: both;
    text-align: center;
    font-family: 'Open Sans';
    font-size: 13px;
    font-weight: 700;
    padding: 0;
    margin-top: 20px!important;
    margin-bottom: 30px!important;
    position: relative;
    height: 23px;
}

.blog-pager a {
    font-family: 'Open Sans';
    color: #666;
    display: inline-block;
    padding: 5px 10px;
    margin-left: 2px;
    margin-right: 2px;
    border-radius: 2px;
    transition: all .6s linear;
}

.blog-pager a:hover {
    background-color: #eee;
    color: #8493A0;
    text-decoration: none;
    transition: all .2s linear;
}

.blog-pager-newer-link {
    float: left
}

.blog-pager-older-link {
    float: right
}

.blog-pager a.home-link {
    text-transform: uppercase;
    font-weight: bold;
    background-color: transparent;
    color: #666;
    position: absolute;
    left: 50%;
    -webkit-transform: translateX(-50%);
    transform: translateX(-50%)
}

.blog-pager a.home-link:hover {
    background-color: #eee;
    text-decoration: none;
    color: #8493A0;
}

.displaypageNum a,
.showpage a,
.pagecurrent {
    padding: 5px 10px;
    display: inline-block;
    background-color: #fff;
    color: #666;
    margin-left: 2px;
    margin-right: 2px;
    border-radius: 2px;
    transition: all .6s linear;
}

.displaypageNum a:hover,
.showpage a:hover,
.pagecurrent {
    background-color: #eee;
    color: #8493A0;
    text-decoration: none;
    transition: all .2s linear;
}

.showpage,
.pagecurrent {
    font-weight: bold;
    color: #888;
}

.pages {
    background-color: #fff;
    color: #666;
    transition: all .2s linear;
}

span.displaypageNum.nextpage {
    float: right;
}

span.displaypageNum.prevpage {
    float: left;
}

span.showpage.prevpage {
    float: left;
}
</style>

Change Post Navigation Links to Font Awesome

This step is not necessary however, it will make your navigation text links inside blog posts appear as Font Awesome icon buttons same as the blog index and label pages, look for <data:newerPageTitle/> then replace it with:

<i aria-hidden='true' class='fa fa-angle-double-left'/>

After that, search for <data:olderPageTitle/> and replace it with:

<i aria-hidden='true' class='fa fa-angle-double-right'/>

How to Fix Label Pages

It seems that Blogger will show 20 pages each by default on a label page specifically, so to fix that behavior you will have to change every expr:href='data:label.url' inside your template to the following code.

expr:href='data:label.url + "?&amp;max-results=5"'

Change the highlighted number 5 to the number of posts that you want to be displayed inside each page, it has to be exactly the same as your configuration of JavaScript code above.

How to Activate GPU Hardware Acceleration on Firefox & Tor Browser

noreply@blogger.com (Saleem Almajed) — Wed, 14 Dec 2016 22:11:00 +0000

Nowadays, the main issue for the regular user of Linux distributions (Ubuntu, Debian, Arch, etc) is the lack of GPU Hardware Acceleration on Firefox and Tor Browser or any other one built upon the former. Well, I am not saying there is no support for the feature at all.

I am implying that you have to force activate it manually as it doesn't seem to work by default, I have no idea why but today we're going to learn how to force hardware acceleration and confirm that it's working as intended.

Anyway, even though this tutorial is mostly targeted at Linux users, it should apply the same for any other operating system including Windows and Mac OS X. Previously, by the way I wrote an article explaining how to activate GPU hardware acceleration on Chrome and Chromium browser.

How to Confirm Working GPU Hardware Acceleration

Of course, before you go playing with options here and there you should ensure that your browser does actually NOT have acceleration enabled. So, enter about:support into the address bar, and that will display for you the current stat of the GPU process.

GPU Hardware Acceleration Disabled

When there is no hardware acceleration, the result should be Soft Rendering which is something like this:

GPU Hardware Acceleration Enabled

In the other hand, if you see something like below which is in my case "OpenGL":

Then, this tutorial might not be of an use to you unless you're here to enrich your general technical knowledge. So, just make sure it's not "Basic" and that's it

How to Enable GPU Hardware Acceleration on Firefox

Now, this will require two conditions to be met as explained below.

Enable Acceleration in Firefox Preferences

First of all, you have make sure that hardware acceleration option is actually ticked from end-user settings. Navigate directly to about:preferences#advanced from address bar then Preferences → Advanced → Browsing and from there tick (Use hardware acceleration when available) on.

Override Software Rendering

Basically, this option will ignore the irrelevant GPU blacklist and force enable hardware acceleration, navigate to about:config from address bar and search for layers.acceleration.force-enabled then right click on that and toggle it to "True".

That's it! Relaunch your browser to take effect then follow instructions above to confirm that acceleration is working as intended and enjoy surfing the world wide web smoothly.

How to Activate GPU Hardware Acceleration on Chrome & Chromium Browser

noreply@blogger.com (Saleem Almajed) — Tue, 13 Dec 2016 03:35:00 +0000

Unfortunately, it seems that recent versions of Chrome and Chromium Browser are not working with GPU Hardware Acceleration by default on most Linux distributions in particular like Ubuntu, Debian, Arch, etc.

Well, that is unless you enable it manually with certain developer options to force your browser to take advantage of the GPU driver on your system. Although, this tutorial might be targeted at Linux users, it should apply and work just fine for any other system running Chrome Browser including Windows and Mac OS X.

How to Confirm Working GPU Hardware Acceleration

Of course, before you go playing with options here and there you should ensure that your browser does actually NOT have acceleration enabled. So, enter chrome://gpu into the address bar, and that will display for you the current stat of the GPU process.

GPU Hardware Acceleration Disabled

When there is no hardware acceleration, the result should be Software Acceleration which is something like this:

GPU Hardware Acceleration Enabled

In the other hand, if you see something like this:

Then, this tutorial might not be of an use to you unless you're here to enrich your general technical knowledge.

How to Enable GPU Hardware Acceleration in Chrome

Now, this will require two conditions to be met as explained below.

Enable Acceleration in Chrome Settings

First of all, you have make sure that hardware acceleration option is actually ticked from end-user settings in Chrome. Navigate directly to chrome://settings from address bar then Show advanced settings → System and from there tick (Use hardware acceleration when available) on.

Override Software Rendering List

Basically, this option will ignore the irrelevant GPU blacklist and force enable hardware acceleration, navigate to chrome://flags from address bar and look for Override software rendering list to enable it.

That's it! Relaunch your browser to take effect then follow instructions above to confirm that acceleration is working as intended and enjoy surfing the world wide web smoothly.

Improve Performance with GPU Rasterization

This is optional and might not suit your case however, if you wish to go one step further with performance then again navigate to chrome://flags from address bar and search for GPU rasterization to enable it. Next, look for Number of raster threads and choose number "4" from the list.

Install Latest Intel GPU Driver on Debian Jessie – Activate “SNA” Hardware Acceleration

noreply@blogger.com (Saleem Almajed) — Fri, 09 Dec 2016 02:52:00 +0000

Usually, after installing Debian Jessie on your computer running an Intel processor with integrated GPU, the first question that comes in mind is whether hardware acceleration is activated or not. Next, you might want to ensure that you are running the latest drivers available.

Honestly, the simple answer for first question is that; Debian Linux desktop distributions will originally come packed with hardware acceleration configured by default during installation for Intel processors just in case you would rely on the integrated GPU.

However, what we are going to cover in this article is upgrading that outdated driver to latest version to maximize performance, and how to solve tearing issues, after we force the use of the bleeding edge “SNA” on X11 instead of “UXA” as the default Hardware Acceleration method.

How to Install Latest Intel GPU Driver

You can follow same instructions below to either install latest Intel GPU driver from scratch or simply to perform an upgrade to the currently outdated driver package, the general idea is pulling the bleeding edge version of xserver-xorg-video-intel package from Debian jessie/backports repository branch.

Add “jessie/backports” Branch to APT Sources

Basically, one easy way to achieve that is by issuing this command into the terminal, like this:

sudo echo "deb http://ftp.debian.org/debian/ jessie-backports main contrib non-free" >> /etc/apt/sources.list

Install Backported “xserver-xorg-video-intel” Package

Now, just install the package using apt-get utility from terminal.

sudo apt-get -t jessie-backports install "xserver-xorg-video-intel"

Note that if you already have an older version then it will just upgrade it to the build corresponding to the latest package available on jessie/backports automatically.

How to Activate “SNA” Hardware Acceleration

Well, the default behavior after you install the latest driver is that it will automatically choose the suitable hardware acceleration method according to your processor architecture.

For instance, starting from Intel Haswell which is the "fourth-generation core" successor to the Ivy Bridge architecture, without configuring anything it will default to “SNA” settings. However, sometimes I do not trust everything to go as intended.

Besides, we need to force enabling "TearFree" "true" option to prevent graphics tearing during either 3D OpenGL rendering or direct window moving/scrolling actions. So, according to this we must to create an xorg.conf file to manually define our own desired options, anyway.

Create “xorg.conf” File with our Settings

You need to create the configuration file exactly at this path /etc/X11/xorg.conf so execute your preferred text editor from terminal to that location, we will use nano as an example:

sudo nano /etc/X11/xorg.conf

Note that if you happen to already have this file created somehow, it will just attempt to edit it otherwise it will automatically create it.

Configure X11 with Intel Graphics

Now, just input the following content, into the text editor and save it.

Section "Device"
   Identifier  "Intel Graphics"
   Driver      "intel"
   Option      "AccelMethod" "sna"
   Option      "TearFree" "true"
EndSection

If you are using an old Intel processor that doesn't support “SNA” consider changing the option marked above with white color to "AccelMethod" "uxa" instead to avoid any issues.

Reboot System

That's it for now, restart your system to take effect then proceed to the next step just in case you want to confirm that GPU Hardware Acceleration and everything is working as intended.

How to Confirm Working GPU Hardware Acceleration

I have prepared a simple command with an expected output so that we can confirm everything is going our way, in terminal issue this command:

cat /var/log/Xorg.0.log | grep SNA && cat /var/log/Xorg.0.log | grep DRI

You should expect to receive an output similar to this in my case:

[    12.953] (II) intel(0): SNA compiled: xserver-xorg-video-intel 2:2.99.917+git20161105-1~bpo8+1 (Vincent Cheng )
[    12.953] (II) intel(0): SNA compiled for use with valgrind
[    13.033] (II) intel(0): SNA initialized with Haswell (gen7.5, gt1) backend
[    13.044] (II) intel(0): [DRI2] Setup complete
[    13.044] (II) intel(0): [DRI2]   DRI driver: i965
[    13.044] (II) intel(0): [DRI2]   VDPAU driver: va_gl
[    13.044] (II) intel(0): direct rendering: DRI2 enabled
[    13.507] (II) GLX: Initialized DRI2 GL provider for screen 0

Last but not least, I will be writing two other articles related to this subject this week, as we know that currently browsers available for Linux distributions like FireFox and Chrome aren't configured correctly to make use of Intel GPU Hardware Acceleration by default, so we'll be solving that.

Blogger Social Media Optimization (SMO) with Open Graph Protocol

noreply@blogger.com (Saleem Almajed) — Tue, 06 Dec 2016 08:59:00 +0000

Nowadays, the importance of implementing SEO (Search Engine Optimization) techniques has decreased significantly, since Google and other web giants do not prioritize search results based on that anymore but mostly according to the quality of your content.

Instead, let me put it to you that way; Social Media sites are becoming more of a SEO factor than what SEO itself used to be. That's exactly why my blog is optimized with the OGP (Open Graph Protocol) Meta Tags, which is by the way a Blogger (or Blogspot) blog.

What is OGP (Open Graph Protocol)

The Open Graph Protocol enables any web site or blog to identify and establish itself magnificently as an object within the boundaries of a particular social graph through Meta Tags embraced within <head> and </head> in a web page HTML header.

Well, so my blog has certain and unique OGP meta tags included in each page or blogs post, the information given by those particular tags differ according to the page content or type.

Now for instance, if you request source code for the blog home page through your browser, you should see in the page header there's some thing like this:

<html lang='en-US' prefix='og: https://ogp.me/ns#'>
<head>
<!-- [ SMO ] -->
<meta content='iSmooth Blog' property='og:title'/>
<meta content='website' property='og:type'/>
<meta content='http://www.ismoothblog.com/' property='og:url'/>
<meta content='http://www.ismoothblog.com/favicon.ico' property='og:image'/>
<meta content='Delivers latest information and support for technology, mobile devices and social networking to help users, all in a bundle of uniqueness.' property='og:description'/>
<meta content='iSmooth Blog' property='og:site_name'/>
<meta content='https://www.facebook.com/iSmoothBlog' property='article:publisher'/>
<meta content='en_US' property='og:locale'/>
<meta content='en_GB' property='og:locale:alternate'/>
<meta content='id_ID' property='og:locale:alternate'/>
<meta content='summary' name='twitter:card'/>
<meta content='iSmooth Blog' name='twitter:title'/>
<meta content='@iSmoothBlog' name='twitter:site'/>
<meta content='@SaleemAlmajed' name='twitter:creator'/>
</head>

As you can see, there's information about the blog name, page type, language and author profile including other relevant social media queries and accounts used by the creator. In the other hand, if you check a blog post page header, say for example my previous article:

<!-- [ SMO ] -->
<meta content='iSmooth Blog: Host Blogger CSS, JavaScript and HTML Files on GitHub Pages' property='og:title'/>
<meta content='article' property='og:type'/>
<meta content='http://www.ismoothblog.com/2016/11/host-blogger-css-javascript-files-using-github-pages.html' property='og:url'/>
<meta content='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgD-KmmoCVxP6lN2zhP6OM8G4KFibc_q-Xm2msoKvdRndPEKxRjeWN3Gn6puZUfM2jWNknzA7Q5odRF8hAW6j7BdROSmWU3AoRsP_JTv76Z78AR0DL-NuCWgq-1CxFfCmTdFq1OIvP6CsU/s400/GitHub-Pages-Free-Hosting-Service-Blogger.png' property='og:image'/>
<meta content='How to host CSS, JavaScript, HTML Files and even photos for Blogspot blogs with unlimited bandwidth and storage space for free using GitHub Page service.' property='og:description'/>
<meta content='iSmooth Blog' property='og:site_name'/>
<meta content='https://www.facebook.com/iSmoothBlog' property='article:publisher'/>
<meta content='en_US' property='og:locale'/>
<meta content='en_GB' property='og:locale:alternate'/>
<meta content='id_ID' property='og:locale:alternate'/>
<meta content='summary' name='twitter:card'/>
<meta content='iSmooth Blog: Host Blogger CSS, JavaScript and HTML Files on GitHub Pages' name='twitter:title'/>
<meta content='@iSmoothBlog' name='twitter:site'/>
<meta content='@SaleemAlmajed' name='twitter:creator'/>

Note that there's multiple entries changing in respect to page type, most notable ones are og:title followed by og:type and most importantly og:image while this behavior is done automatically by a single code I use inside my Blogger custom template.

The image property tag for example provide a suitable photo taken from your embed material, this will tell social media sites which photo to use and display when your post gets shared within their social service or application, like as a thumbnail and many other uses according to their technology.

SMO (Social Media Optimization) for Blogger

We should know exactly by now why we would want to implement SMO right, so in order to make use of my OGP implementation for your own Blogger blog, navigate to your template editor from your blogger control panel Template → Edit HTML and search for </head> then add this code ABOVE or (before it):

<!-- [ SMO ] -->
<b:if cond='data:blog.url == data:blog.homepageUrl'> 
<b:if cond='data:blog.pageType == &quot;item&quot;'> 
<b:if cond='data:blog.pageType == &quot;static_page&quot;'>  
<b:if cond='data:blog.url'>
<meta expr:content='data:blog.url' property='og:url'/>
</b:if>
<meta expr:content='data:blog.title' property='og:site_name'/>
<b:if cond='data:blog.pageName'>
<meta expr:content='data:blog.pageName' property='og:title'/>
</b:if></b:if></b:if></b:if>
<meta expr:content='data:blog.pageTitle' property='og:title'/>
<b:if cond='data:blog.pageType == &quot;item&quot;'>
<meta content='article' property='og:type'/>
<b:else/>
<meta content='website' property='og:type'/>
</b:if>
<meta expr:content='data:blog.canonicalUrl' property='og:url'/>
<b:if cond='data:blog.postImageUrl'>
<meta expr:content='data:blog.postImageUrl' property='og:image'/>
<b:else/>
<b:if cond='data:blog.postImageThumbnailUrl'>
<meta expr:content='data:blog.postThumbnailUrl' property='og:image'/>
<b:else/>
<meta expr:content='data:blog.blogspotFaviconUrl' property='og:image'/>
</b:if></b:if>
<b:if cond='data:blog.metaDescription'>
<meta expr:content='data:blog.metaDescription' property='og:description'/>
</b:if>
<meta expr:content='data:blog.title' property='og:site_name'/>
<meta content='https://www.facebook.com/YOUR-BLOG-PAGE' property='article:publisher'/>
<meta content='en_US' property='og:locale'/>
<meta content='en_GB' property='og:locale:alternate'/>
<meta content='id_ID' property='og:locale:alternate'/>
<meta content='summary' name='twitter:card'/>
<meta expr:content='data:blog.pageTitle' name='twitter:title'/>
<meta content='@YOUR-BLOG' name='twitter:site'/>
<meta content='@YOUR-PERSONAL-ACCOUNT' name='twitter:creator'/>

Note: Twitter accounts and Facebook page entries highlighted at the bottom of the code above is personal and should be changed manually to your own settings, any other field is dynamic which means it will be defined automatically according to your blogger settings.

One last simple step remains and it's very important, which is to propagate that your blog is covered under the OGP (Open Graph Protocol), to do that search exactly for <html which should be found at the third line of your template then replace it with the following code:

<html prefix='og: http://ogp.me/ns#'

Basically, you have to add prefix='og: https://ogp.me/ns#' inside your HTML opening tag. That's all.

OGP Structured Properties

The implementation explained above for Bogger is not limited, you can expand its functionality and add more OGP Structured Properties to identify your site with further information to the social graph, you can find and learn about that by following instructions available on the Open Graph Protocol official website.

Host Blogger CSS, JavaScript and HTML Files on GitHub Pages

noreply@blogger.com (Saleem Almajed) — Thu, 24 Nov 2016 16:23:00 +0000

Recently, I shifted all and every CSS and JavaScript code snippet including other HTML files to be hosted for free on GitHub Pages. This service is known to provide people with unlimited bandwidth and storage space, without paying for anything.

Your files are being hosted on a cloud technology known as the Git Repository, which is such a great solution to synchronize your files between multiple devices and work spaces allowing version control capability as well and many other features.

An Awesome Touch to Blogger

After I migrated to GitHub pages as the main host for my scripts, the source code between <head> and </head> tags of this blog has been presented to end users like this:

<head>

<!-- [ JavaScript ] -->
<link href='http://repository.ismoothblog.com/ajax/libs/highlight.js/9.8.0/styles/default.min.css' rel='stylesheet'/>
<script src='http://repository.ismoothblog.com/ajax/libs/highlight.js/9.8.0/highlight.min.js'></script>
<script src='http://repository.ismoothblog.com/js/thumbnail-resize.js' type='text/javascript'></script>
<script src='http://repository.ismoothblog.com/ajax/libs/jquery/3.1.1/jquery.min.js'></script>
<script src='http://repository.ismoothblog.com/js/sticky-widget.js'></script>
<script src='http://repository.ismoothblog.com/js/misc.js'></script>

<!-- [ CSS ] -->
<link href='http://repository.ismoothblog.com/font-awesome/4.7.0/css/font-awesome.min.css' rel='stylesheet'/>
<link href='http://repository.ismoothblog.com/css/global.css' rel='stylesheet'/>
<link href='http://repository.ismoothblog.com/css/index.css' rel='stylesheet'/>
<link href='http://repository.ismoothblog.com/css/blog.css' rel='stylesheet'/>
<link href='http://repository.ismoothblog.com/css/static.css' rel='stylesheet'/>
<link href='http://repository.ismoothblog.com/css/error.css' rel='stylesheet'/>

</head>

If that's not enough, as you can see in the code above I highlighted the URL links just in case, so yes you can use the sub-domain of your own top-level custom domain for the repository that will be hosting your blog files, it reflects a feeling of professionalism and that's awesome!

Otherwise, if you don't have a custom domain they will just give a cool and short free domain, for example if I hadn't happen to have my own the custom domain in my case, I would've just used the following domain name: ismoothblog.github.io instead, which is already reserved and available for me to use at anytime.

Get Started with GitHub Pages

First of all, of course you will have to register an account on GitHub to get things started, then follow the steps:

Step 1 (Create a new git repository)

Once you are done, login into your account then create a new repository:

Then make sure to name the repository after the domain that you wish to acquire, remember it has to be YOU.github.io if you are going for the free solution, even if you have a custom domain you should still reserve a free domain, you can change it later to whatever you want.

Well, you must select the Public repository option as Private repositories are reserved for premium users, it's no big deal. Make sure to initialize the repository with a README file to avoid further complications.

We are done! Now just upload your files and links should be alive for you to use on your Blogger blog.

Step 2 (Upload your files)

The git control process for Windows users is explained here on GitHub by using their application, if you are a Linux user follow these instructions, also don't forget to read the mini-guide for GitHub Pages service presented on the official site.

Blogger Custom Sub-Domain for GitHub Pages Hosting

If you want the files being served on the same domain of your Blogger blog, you have to create a CNAME Record by logging into your Admin Console through your DNS domain provider website, here's what I did, add a record with the following enteries:

Host Name: repository
Address: ismoothblog.github.io
Record Type: CNAME

Make sure to change repository to your desired sub-domain of your own top-level custom domain and ismoothblog.github.io to your corresponding GitHub default domain in your case.

Last but not least, create a file named exactly as CNAME inside your main git repository index, then input inside that file your custom sub-domain, like this in my case:

repository.ismoothblog.com

That's all, your new sub-domain should be alive in around 30 minutes according to my experience depending on your domain provider Time to Live (TTL) value configured on their DNS servers.

By the way, I've been building and designing a Jekyll Blog which can be used in corporation with GitHub Pages service to host your own personal blog or website, I will be writing about my progress soon so stay tuned!

Feel free to drop a comment in the section below, do not hesitate to share your thoughts, so what do you think about this service and my implementation on this Blogger blog?

10 Best Example Blogs hosted on GitHub Pages with Jekyll

noreply@blogger.com (Saleem Almajed) — Fri, 18 Nov 2016 06:44:00 +0000

The era of Wordpress and Blogger being on top as the only feasible blogging platforms may come to an end, today I am posting a list of the most gorgeous and successful blogs hosted directly on GitHub Pages free hosting service by a script called Jekyll which is a Static Site Generator with various features that let people create extremely functional, simple and lightweight websites.

So I've been doing research for the past few days to gather information concerning the best looking and most famous blogs around, in reference to my own opinion and my research here's a top 10 list out of what I came up with.

1. Development SEED

Development Seed is using GitHub to host their blog, they publish information and posts about their projects there, the main layout does really look awesome and functional with many features and I think it's the most interesting site to show you what Jekyll is capable of.

2. Josh Habdas's Blog

Josh Habdas's personal blog is about freelance web and mobile app development, blogging, Raspberry Pi and retro gaming. It really has an elegant design and feature-rich blog layout enough to show you how Jekyll can professionally run your blog.

3. Scott's Blog

Scott's weblog is created by an IT professional specializing in virtualization, networking, open source, and cloud computing. It's the greatest example of how lightweight and simple you can go by using Jekyll, and still implement every essential blogging element required for your blog to run perfectly.

4. Yevgeniy Brikman's Blog

Yevgeniy Brikman's blog is one reason why Jekyll and GutHub pages are the best tools to host a blog if you are a developer, many developers like him are hyped about it due to integration of the most famous and beloved development platform which is GitHub featuring git repository hosting and version control services.

5. Perfection Kills

Perfection Kills is a well-known blog about JavaScript rants and findings, it also serves a Quiz mainly focuses on knowledge of scoping and function expressions, it's been a popular among JavaScript geeks. As the name suggests, this blog is a great example of how you can make use of JavaScript and implement it on Jekyll in your own site.

6. Zach Holman's Blog

Zach Holman's blog is managed by one of GitHub engineering hires, he helped build and grow their product and culture over five years, from nine employees all the way to 250. He was the top committer at GitHub for the last two years of his time there.

7. Nicholas C. Zakas's Blog

Nicholas C. Zakas's blog is focused on front-end technology such as HTML, CSS, and JavaScript, digging in and learning all of the skills and tricks necessary to make performant, beautiful, and maintainable front-ends.

8. UX Design Blog

UX Design blog is about product designing & web development created by Lee Munroe and he focuses on designing and shipping web, mobile & desktop applications that solve problems and offer users an enjoyable experience.

9. JMPerez Blog

JMPerez blog is created by José Manuel Pérez and he is a software engineer dedicated to web development and committed to web performance optimization. He really enjoys developing websites for desktop and mobile devices, having into account most recent technologies.

10. Barry Clark's Blog

Barry Clark's blog is about building products that solve real, human problems. Author is passionate about programming, design, user experience, customer driven development, and continually improving as a manager.

What do you think about this top 10 list? Don't hesitate to share thoughts with me and drop a comment in the section below.

Requiem Resurrection – iTunes & iBooks Fairplay DRM Removal

noreply@blogger.com (Saleem Almajed) — Tue, 15 Nov 2016 21:41:00 +0000

Requiem is the only software that allowed everybody to circumvent Fairplay DRM completely for free, this blog has been supporting various DRM Removal tools for many years providing Requiem tutorials as well as download links for binaries and source code of every tool at our download section.

Requiem is the only true Fairplay DRM Removal tool ever released, I simply can't stand watching it die just like that without trying to do something.

Fake Fairplay DRM Removal Software being Spread

That being said, unsurprisingly the web is being flooded with countless sites claiming removal of iTunes DRM, charging people a hell lot of money for a far inferior and poor quality software that doesn't truly remove DRM but only convert content to another extension by re-encoding it.

Instead of paying our hard earned money to jerky services we should have donated to worthy developers of open source software like Requiem which by the way was originally coded by a person known as @Brahms at that time.

Resurrection of The Requiem

Today, I decided to create a GitHub repository with source code and binaries available for the two most successful versions: Requiem 3.3.6 which is best at decrypting iBooks and Requiem 4.1 which was the latest release supporting iTunes media (Music & Movies) DRM removal , as an attempt to resurrect Requiem once again.

This way we as a community can continue the development of that software and hopefully come up with a new release supporting the latest version of iTunes & iBooks to put an end to that farcical mess of fake DRM Removal services known today.

Recruiting Java Developers

Any one with experience at Java can help and contribute to the resurrection of Requiem, please clone the GitHub repository and if you figure something out just send me pull requests.

Our main goal is to attain and keep the software compatibility with latest versions of iTunes since old Requiem releases are limited to only support obsolete iTunes version. That is the only obstacle preventing people from using the tool freely, so that's what we should try to overcome at the first place.

Of course, efficiency improvements and bug fixes or adding new features to Requiem are more than welcome however, we shouldn't let our focus scatter around preventing us from achieving our main goal.

GitHub Repository

Click Here!

If you have any question or doubts, please do not hesitate to drop a comment in the section below to join the conversion and share thoughts together.

Is it Safe to Charge iPhone Faster with iPad Charger?

noreply@blogger.com (Saleem Almajed) — Sat, 12 Nov 2016 03:56:00 +0000

If you are an Apple fan you will most likely happen to own both an iPad along with an iPhone, users might want to charge their iPhone with the iPad 12W/10W USB Power Adapter, so they have no choice but to wonder whether it is safe or not to do so.

Technically, according to specifications for the power adapter of iPad it supplies 5 Volts along with current up-to 2.1 Amps (12W). In the other hand, we have iPhone original power adapter that supplies 5 Volts while unlikely pushes 1 Amp (5W) at max which is less current than the later.

Can I Safely use iPad Charger for iPhone?

Yes, it is completely safe to charge any iPhone with iPad Power Supply, that's your answer in advance just before we go explaining further. Apparently, it's not only safe to use but even more interestingly you can charge your iPhone FASTER than usual using the iPad power adapter instead.

Why it is Safe

That being said, when it comes to electronics it's known that devices draw current from the power supply on demand, meaning it doesn't matter if Amperes are higher than minimum requirement as long as the power adapter rated at the same voltage value which is in our case 5 Volts for both iPad and iPhone.

Charge iPhone Faster

The reason for why it's actually more efficient to charge your iPhone using the iPad adapter is that it can supply double the amount of current than the original iPhone adapter, and since devices draw current on demand that makes iPhone able to draw from 2.1 Amps (12W) available, the iPhone will be able to charge noticeably faster than being limited to 1 Amp (5W) of current only.

Proof

You can look at the specifications and compatibility list of devices supported by the Apple 12W USB Power Adapter at official Apple online shop, you will see all iPhone models are supported. Also, many people asked Apple stores around their area the same question and they gave users green light, they've been talking about this on many reddit posts.