Machine Cycle

Digging Tunnels: Connection Problem on Debian

2012-01-27T03:57:00.000-08:00

If you follow the instructions on my first "Digging Tunnels" post, to setup ssh tunneling over SSL with stunnel, then you may find that you can't access your Debian box from another Debian box. I got the following error:

SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The fix (found on serverfault.com) is to make sure you have the following in lines in /etc/stunnel/stunnel.conf:

sslVersion = all
options = NO_SSLv2

Boot Floppy and ISO Images with GRUB2 on Debian

2012-01-20T07:09:00.000-08:00

I've once described my setup for booting floppy disk images. That setup works rather nicely, but there's a better way of doing this on Debian:

install grub-imageboot:
```
aptitude install grub-imageboot
```
put all image files you want to be able to boot in /boot/images
run (as root):
```
update-grub
```

and that's it!

grub-imageboot performs the same task as my original setup, in much the same way, but it also supports ISO images, is easier to install and much easier to uninstall.

A related tool, from the same authors (the fine Grml team) is grml-rescueboot, which lets you boot into a Grml rescue system from Grml ISO images placed in /boot/grml.

Stuttering Video Playback Due To USB Device Reset

2012-01-12T09:01:00.000-08:00

My kids don't usually complain when they're watching a movie on my PC, if video playback stutters. It seems that as long as playback resumes in a second or less, they don't mind the interruptions. I guess they've learned that if they do complain, chances are that they'll have to wait several long minutes, until their OCD inflicted dad "fixes" the problem.

I hate it when video playback stutters. So much so that I usually first download whatever video I want to watch and then watch it offline. Which is why I am a get-flash-videos fanboy.

But last time we were hit with such a problem, our lame ISP was not the culprit. This time, the video source was a backup ISO image of some DVD, stored on an external hard disk, connected to a Debian box (my old, headless laptop) over USB, accessed via SAMBA over a wireless connection, and played back on my WinXP laptop. The hiccups were rather noticeable, even by my lag-tolerant kids, to the point that they complained about it.

At first, it seemed that debugging this would be a daunting task - there are just so many factors involved. But I got lucky - I tried playing that same DVD image on my wife's laptop, over a wired network connection, and was hit by the same playback hiccups. This ruled out most of the suspects except for my old Debian laptop.

And yet, I had no idea what to look for now, especially because I can't just playback video on my old laptop - it's screen is busted... So I just browsed for any suspicious message in the output of dmesg - and found the following message, repeated several times:

"reset high speed USB device using ehci_hcd and address 3"

These messages seemed very relevant, and a quick search brought me to several blog posts, forum threads and bug reports.
I tried one the solutions/workarounds suggested on those links:

echo 128 > /sys/block/sdc/device/max_sectors

and it actually did the trick and made the hiccups go away.

The next challenge was to make this happen on system start-up. The Right Thing™ to do would have been to modify /etc/sysctl.conf, but there's always the chance that the relevant block device would be renamed, e.g. when another external disk drive is attached. So I ended up adding the following line line to /etc/init.d/bootmisc.sh:

echo 128 > /sys/block/$(readlink -f /dev/data | sed -e 's/1//g' -e 's/\/dev\///g')/device/max_sectors

where /dev/data is a symbolic link that points to this block device, which is generated with an appropriate UDEV rule.

UnDBX in Debian!

2011-10-18T13:44:00.000-07:00

UnDBX is now officially packaged in Debian!

Configuring hpodder To Handle Compressed Podcast Feeds

2011-07-29T13:28:00.000-07:00

My Nokia 2730 classic dumbphone is surprisingly smart. Unbeknownst to me at the time of purchase, was the fact that it has a 2GB MicroSD card, and can play MP3 files. But eventually I did stumble upon this feature and it wasn't too long before I started tuning in on podcasts.

I use hpodder (launched from a cron job) to follow podcast feeds and download episodes to my computer, and a semi-scripted procedure to move these files to my phone's memory card over a USB connection.

Lately, hpodder started complaining:

*** 12: Failure parsing feed: Lexical error in  file http://escapepod.org/feed/  at line 1 col 1:
  unrecognised token: ^_\213^H^@

So I tried to download the feed manually:

$ curl http://escapepod.org/feed/

and the terminal filled up with gibberish to the point that I had to blindly type reset in order to fix it.

That was weird: after all, the feed is nothing more than an XML file - a text file, which should be perfectly readable with the naked eye.

I saved the feed with

$ curl -o feed.bin http://escapepod.org/feed/

and then determined its type:

$ file -b -i feed.bin
application/x-gzip; charset=binary
$ zcat feed.bin | file -b -i - 
application/xml; charset=utf-8

I.e. a GZIP compressed XML file.

So hpodder choked on a compressed feed.

I consulted the manual and found out that hpodder delegates downloads to cURL. I skimmed through the cURL manpage, found about the --compressed command line option, tried the download again - and got the uncompressed XML contents. Hoozah!

Apparently, the server, that's serving that particular feed, is mis-configured to always compress its replies, even if not specifically asked to do it. The --compressed command line options tells cURL to request the server to compress its replies, and cURL decompresses them.

I tried downloading other feeds with the --compressed added, and it worked fine. So either this option is supported by all the other servers on my list of feeds, or that cURL does nothing when the reply is not compressed. I dunno.

All that I needed now was a way to convince hpodder to launch cURL the same way.

Turns out that hpodder is a rather nice piece of software (and rather well documented too). The hpodder manual pointed me to ~/.hpodder/curlrc:

$ echo compressed >> ~/.hpodder/curlrc

and now hpodder works like a charm again (and probably faster than before, because it always asks for compressed replies).

Cloning a GitHub GIT Repository on Ubuntu 8.04 LTS

2011-07-22T09:20:00.000-07:00

At work, we're still running Ubuntu 8.04 LTS on most PCs with Linux. Most of the time the age of the operating system isn't a problem - but sometimes it can be a pain. Case in point: cloning a GIT repository hosted on GitHub. This used to work just fine, until they switched to HTTPS:

$ git clone https://github.com/user/repo.git
Initialized empty Git repository in /current/directory/repo/.git/
Cannot get remote repository information.
Perhaps git-update-server-info needs to be run there?

When this first happened, I shrugged it off as a problem with the remote end, and just downloaded a source tarball from https://github.com/user/repo/tarball/master. But a few weeks later I got this error again with a different repository, and got annoyed. I tried the same command at home (Debian/testing, GIT version 1.7.5.4):

$ git clone https://github.com/user/repo.git
Cloning into repo...
remote: Counting objects: 81, done.
remote: Compressing objects: 100% (72/72), done.
remote: Total 81 (delta 34), reused 55 (delta 8)
Unpacking objects: 100% (81/81), done.

So, this is a problem with either GIT at work, or the Net connection. I downloaded the GIT source tarball and installed it locally in my account (at ~/local):

wget -c http://kernel.org/pub/software/scm/git/git-1.7.6.tar.bz2
tar xvjf git-1.7.6.tar.bz2
cd git-1.7.6
ls
./configure --prefix=$HOME/local
make
make install

and since we're using tcsh at work (don't ask), I also had to type rehash in order to convince the shell to use the newly installed GIT.

Here's what I got this time:

$ git clone https://github.com/user/repo.git
Cloning into repo...
error: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed while accessing https://github.com/user/repo.git/info/refs

fatal: HTTP request failed

... which is useful: Google directed me to a question on Stack-Overflow. Most of the answers there deal with installing CA certificates, but the following trick works nicely with git version 1.5.4.3 on Ubuntu 8.04.4 LTS:

$ env GIT_SSL_NO_VERIFY=true git clone https://github.com/user/repo.git
Cloning into repo...
remote: Counting objects: 81, done.
remote: Compressing objects: 100% (72/72), done.
remote: Total 81 (delta 34), reused 55 (delta 8)
Unpacking objects: 100% (81/81), done.

(no need for env in bash).

And while we're at it, here's another trick that might be handy in the future:

$ env GIT_CURL_VERBOSE=1 git clone https://github.com/user/repo.git
Cloning into repo...
* Couldn't find host github.com in the .netrc file, using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 207.97.227.239... * Connected to github.com (207.97.227.239) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Expire cleared
* Connection #0 to host github.com left intact
* Couldn't find host github.com in the .netrc file, using defaults
* Connection #0 seems to be dead!
* Closing connection #0
* About to connect() to github.com port 443 (#0)
*   Trying 207.97.227.239... * Connected to github.com (207.97.227.239) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Expire cleared
* Connection #0 to host github.com left intact
error: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed while accessing https://github.com/user/repo.git/info/refs

fatal: HTTP request failed

Backup a Blogger Blog - Revisited

2011-04-29T09:36:00.000-07:00

I recently found out that the method I used to backup this blog automatically, has stopped working. It all hinged on the observation that one can retrieve a single web page with the full text of all the posts of a given Blogger blog, by retrieving the link

http://blogname.blogspot.com/search?max-results=N

with a large enough N, e.g. 10000. This is not true anymore - at the moment I can only retrieve the latest 42 posts on this blog, from a total of 178.

I'm not sure when this method stopped working, or, for that matter, if it ever really worked. The fact remains, however, that I have a blog that I want to backup, so I spent the better part of an evening figuring out how to properly do this.

My new Blogger blog backup script, shown below, makes use of the Google Data services API to export and download the blog archive in XML format, and then extracts from it the links of all the posts, and mirrors these pages locally, with HTTrack:

#! /bin/bash

BLOGGER_EMAIL=user@gmail.com
BLOGGER_PASSWD=password
BLOGGER_BLOGID=000000000000000000
BLOGGER_BLOG=blogname

DEST_DIR=/path/to/backup/directory/
mkdir -p ${DEST_DIR}
cd ${DEST_DIR}

eval $( \
    curl -s "https://www.google.com/accounts/ClientLogin" \
    --data-urlencode Email=$BLOGGER_EMAIL --data-urlencode Passwd=$BLOGGER_PASSWD \
    -d accountType=GOOGLE \
    -d source=MachineCycle-cURL-BlogBackup \
    -d service=blogger | grep 'Auth='
)

curl -s "http://www.blogger.com/feeds/$BLOGGER_BLOGID/archive" \
    --header "Authorization: GoogleLogin auth=$Auth" \
    --header "GData-Version: 2" \
    | xml_pp > ${BLOGGER_BLOG}.blogspot.com.archive.xml

grep -o -e '<link href="http://'$BLOGGER_BLOG'.blogspot.com/..../[^\.]*.html" rel="alternate" title=' \
    ${BLOGGER_BLOG}.blogspot.com.archive.xml | \
    sed -e 's@.link href="@@g' -e 's@" rel="alternate" title=@@g' | \
    sort -ur > ${BLOGGER_BLOG}.links

mkdir -p ${BLOGGER_BLOG}
cd ${BLOGGER_BLOG}
httrack \
    -%v0 \
    -%e0 \
    -X0 \
    --verbose \
    --update \
    -%L ../${BLOGGER_BLOG}.links \
    -"http://${BLOGGER_BLOG}.blogspot.com/" \
    -"${BLOGGER_BLOG}.blogspot.com/*widgetType=BlogArchive*" \
    -"${BLOGGER_BLOG}.blogspot.com/search*" \
    -"${BLOGGER_BLOG}.blogspot.com/*_archive.html*" \
    -"${BLOGGER_BLOG}.blogspot.com/feeds/*" \
    -"${BLOGGER_BLOG}.blogspot.com/*.html?showComment=*" \
    +"*.gif" \
    +"*.jpg" \
    +"*.png"

A few comments are in order:

the script contains the Blogger username and password - keep it safe!
the blog id is the number that appears in the URL of most links accessible from the Blogger dashboard, after the blogID= part
the XML blog archive may later be used to restore/migrate the blog
local mirroring isn't really necessary - I just like it that I can view the blog contents offline
another unnecessary step: I use xml_pp to beautify the exported XML file
currently, the script performs no error checking - I may add some checks if and when I observe failures
sources: Using cURL to interact with Google Data services, Blogger export format

Fixing Normalize Audio Feature in K3b

2011-04-15T02:34:00.000-07:00

I usually burn and copy optical media with K3b. I don't do this often, but when I do, it usually just works. Except when it doesn't.

My wife asked me to create an audio CD for her, from an assortment of audio tracks she collected from various sources. It was easy enough to accomplish this with K3b. But the resulting audio CD was annoying to listen to, because I had to change the volume setting for each track.

It's a classic noob's mistake: I should've enabled audio normalization.

So I tried it again, but found that I couldn't enable audio normalization in K3b. Turns out that K3b uses an external application (called - surprise! - normalize-audio) to perform this task, and K3b just couldn't find it - a fact that was clearly (?) stated in the programs section of the K3b settings dialog.

I tried launching normalize-audio at the command line, and it seemed to be installed alright. A quick Net search brought me to Debian bug #597155 and Ubuntu bug #45026. The root cause of the problem is that normalize-audio reports its version number as

normalize 0.7.7

while K3b expects

normalize-audio 0.7.7

This can be fixed either in K3b or in normalize-audio, and patches for both sides have already been posted. But neither has been incorporated yet. In the meantime, I've implemented a workaround, based on suggestions in those bug reports:

create (as root) an executable script named normalize-audio under /usr/local/bin/ with the following contents:

#!/bin/bash
case "$1" in    
    --version)
        /usr/bin/normalize-audio --version | sed -e 's/normalize/normalize-audio/g'
        ;;
    *)
        /usr/bin/normalize-audio "$@"
        ;;
esac

make this script executable:

chmod a+x /usr/local/bin/normalize-audio

this script is supposed to be used as a wrapper for normalize-audio, so make sure that /usr/local/bin/ appears in the PATH environment variable, and that it comes before /usr/bin
launch K3b from a new command shell - it should now detect normalize-audio and allow you to use it

Time to Burn!
[05 Nov 2011] UPDATE: fixed script to work with file names/paths that contain spaces (Thanks anonymous commenter!)

Setting Default Laptop Screen Brightness when Running on Battery Power

2011-03-18T07:48:00.000-07:00

A few weeks ago the screen of my "new" laptop (read: my wife's old WinXP laptop) started flickering.

It was almost imperceptible at first, but it got worse over time, to the point that the screen would, at random intervals, suddenly dim gradually and then brighten back, for a second or so.

I suspected that the laptop screen was failing. The prospect of having another headless laptop made me anxious. But after a while I noticed that whenever the screen brightness flickered, a battery icon would show up momentarily in the system tray.

So I came up with a theory: it may be some kind of a power supply problem that causes the laptop, for very brief periods of time, to think that it is disconnected from the mains power, causing it to switch to battery power, which, in turn, causes the OS to lower the screen brightness in order to reduce power consumption.

This theory seemed plausible, but with the warranty long-since expired, and without spare parts (power cord, power supply, battery, motherboard, etc.), my only option was to let it go. After all, other than this issue, the laptop seemed to be as functional as it can be.

The flickering, however, made me crazy, so I searched for a way to prevent Windows from automatically darkening the screen when the laptop is switched to battery power.

Well, it's easy, but it ain't obvious:

disconnect the laptop from the mains power - the screen dims
use the screen brightness controls to brighten the display back to the same brightness level when the mains power is connected
reconnect the mains power

That's it - I kid you not.

A few days ago the laptop switched to battery power and stayed there. I took a little chance and purchased a replacement AC adapter over at eBay. Surprisingly enough, that was it. Happy Happy Joy Joy.

Getting Rid of rkhunter's False Warning about Xzibit Rootkit

2011-03-04T00:52:00.000-08:00

I've installed rkhunter a long while ago, mostly because it seemed irresponsible not to install some sort of "protection". But, as is the case with any such tool, I started getting warnings, which, after I got over the induced anxiety attacks, were invariably confirmed as false positives.

It was usually rather simple to silence these warnings from the rkhunter configuration file /etc/rkhunter.conf - most of the time it was just a matter of un-commenting one or more lines, and occasionally updating rkhunter:

rkhunter --propupd

(say, for instance, after upgrading packages).

One false positive that was somewhat more complicated to disable was a warning about the Xzibit Rootkit. This warning is triggered by files containing the string hdparm - it's a known bug (see Debian bug #576680), and the workaround is to "use the RTKT_FILE_WHITELIST option to whitelist initscripts stating this string" - e.g. /etc/init.d/hdparm ...

The comments in the configuration file, suggest that the proper method of whitelisting a file is to also add it to USER_FILEPROP_FILES_DIRS and then update rkhunter. But this makes rkhunter complain that /etc/init.d/hdparm is an executable script, so I had to also add it to SCRIPTWHITELIST.

Bottom line - add the following lines to /etc/rkhunter.conf:

USER_FILEPROP_FILES_DIRS="/etc/init.d/hdparm /etc/init.d/.depend.boot"
SCRIPTWHITELIST=/etc/init.d/hdparm
RTKT_FILE_WHITELIST="/etc/init.d/hdparm /etc/init.d/.depend.boot"

and the run

rkhunter --propupd

Verify by running:

rkhunter --check

I can only hope that I won't hit any false negatives...

One Liner: Pretty Print, Syntax Highlight and Page Online XML Data

2011-02-25T12:18:00.000-08:00

Useful when leaching a bunch of video clips from YouTube:

curl -s "http://gdata.youtube.com/feeds/api/playlists/916175AB005C0FB6" | xml_pp | pygmentize -l xml | less -R

(required packages: curl, xml-twig-tools, python-pygments)

Actually, xml-pp isn't really needed with YouTube - it can do the pretty-printing for you:

curl -s "http://gdata.youtube.com/feeds/api/playlists/916175AB005C0FB6?prettyprint=true" | pygmentize -l xml | less -R

Firefox Crash Recovery

2011-02-18T06:21:00.000-08:00

Just the other day, I was left with no option other than to power-cycle my Ubuntu workstation at work. After this, Firefox, which was open when my workstation died on me, would not start anymore. It just insisted that "Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system." - a useless piece of ~~crap~~ advice.

This happened to me before, but I never bothered to document the recovery process. I learned my lesson, thank you very much:

step #0: find the location of the default Firefox user profile, and then cd to it:
```
cd ~/.mozilla/firefox/pefasakk.default/
```
step #1: remove the previous session's lock file:
```
rm .parentlock
```
you may be lucky, and all may just work now. I wasn't, and it didn't.
step #2: if Firefox complains that bookmarks and history have been disabled, then you should move away the places database and try again:
```
mv places.sqlite places.sqlite.backup
mv places.sqlite-journal places.sqlite-journal.backup
```
the good news is that Firefox will most likely start with your bookmarks intact, the bad news is that you've just reset your browsing history...
step #3: I thought I was out of the woods - everything looked normal enough, until I restarted Firefox - a few hours later - only to discover that Firefox stopped saving cookies, so that I had to re-login to every web site that required it (so many!). I fixed this by moving away the cookies database:
```
mv cookies.sqlite cookies.sqlite.backup
mv cookies.sqlite-journal cookies.sqlite-journal.backup
```

Now back to our regularly scheduled programming (pun intended).

How To Disconnect from a Network Share on Windows

2011-02-11T22:37:00.000-08:00

My wife's employer issued her an Asus Eee PC 1005P Netbook. She rarely needs to use it, so that it's usually turned off. But, whenever it is turned on, I encounter new system administration problems. The latest problem was with network shares.

Windows 7 Starter, which is the OS installed on this netbook, doesn't seem to allow access to multiple network shares, with different credentials. One has to disconnect from the currently connected network share before connecting to another one.

Disconnecting from a network share that's been mapped as a network drive is easy enough (the menu item to look for starts with 'Disconnect' ...) - but there's no obvious way to disconnect from a network share that has not been mapped as a network drive.

I found a solution on this forum thread - run the following command in a command window:

net use \\MACHINE\share /d

where you should replace \\MACHINE\share with the path of the network share you want to disconnect from.

Highlight #if 0 ... #else ... #endif in Emacs

2011-02-04T04:13:00.000-08:00

This seems to be a FAQ, and a rather annoying missing feature in Emacs. Especially once you see it working in Vim. I guess it's the closest I can get to penis envy.

Well, envy no more - just add the code below to your .emacs and you're good to go.

It'll highlight, as comments, bits of C/C++ code that are disabled with #if 0 ... #else ... #endif and #if 1 ... #else ... #endif. This is done by configuring cpp-highlight-buffer to recognize "0" as an undefined C preprocessor label and "1" as defined, and then causing cpp-highlight-buffer to be called every time the buffer is highlighted.

If you feel adventurous, I suggest you remove the first few lines - those that start with (setq ... - and use, instead, the Emacs customization interface to configure cpp-highlight-buffer:

M-x customize-group RET cpp RET

It should be pretty easy to recreate the setup below, and then you may want to experiment:

handle any #ifdef ... #else ... #endif blocks, by adding more pre-defined labels (e.g. HAVE_CONFIG_H)
make disabled code read-only
make disabled code completely invisible!
use (background-color . "gray") instead of font-lock-comment-face, so that disabled code is still syntax highlighted as usual, only grayed-out
...

(don't forget to save your settings once done)

To be fair with Vim, this is a (potentially CPU intensive) hack, but then again, what isn't?

(setq cpp-known-face 'default)
(setq cpp-unknown-face 'default)
(setq cpp-known-writable 't)
(setq cpp-unknown-writable 't)
(setq cpp-edit-list '(("0" font-lock-comment-face default both)
                      ("1" default font-lock-comment-face both)))

(defun my-c-mode-font-lock-if0 (limit)
  (cpp-highlight-buffer t)
  nil)

(defun my-c-mode-common-hook ()
  (font-lock-add-keywords
   nil
   '((my-c-mode-font-lock-if0 (0 font-lock-comment-face prepend)))
   'add-to-end))

Digging Tunnels (part 2)

2011-01-28T05:55:00.000-08:00

WARNING: following the instructions below can get you in trouble.

REMINDER: most system administrators can and do google.

As promised, this time I'll show how to tunnel from your workstation at work, to your PC at home, through a protocol aware firewall - only that this time with the client workstation running Windows.

Server setup is the same as in the previous post. If your home machine runs Windows, then you may want to research setting up Cygwin with an SSH daemon and stunnel directing traffic to it. I haven't done it myself, so you're on your own here.

Client side, at work, is easy, if you already have Cygwin installed there:

install stunnel using Cygwin's setup.exe
add the following stanza in ~/.ssh/config (where sshd.example.com stands for the address of your home PC):
```
Host sshd.example.com
  Port 443
  ProxyCommand stunnel3 -c -f -r %h:%p   
```

If you don't have Cygwin, then do this:

download and install stunnel for Windows
open stunnel.conf for editing by selecting 'Edit stunnel.conf' from the newly created stunnel sub-menu in the Windows Start menu

replace its contents with the following:

client = yes
debug = 7
[putty]
accept = localhost:60022
connect = sshd.exmaple.com:443

(replace the stuff in red with your own stuff)

start stunnel by selecting 'Run stunnel' from the same stunnel sub-menu as before
use PuTTY to connect to your home PC, by pointing it to localhost:60022
if you hit any problem, then you may be able to troubleshoot it by going over the stunnel log messages, which can be accessed from the stunnel tray icon context menu

Digging Tunnels (part 1)

2011-01-21T12:07:00.000-08:00

WARNING: following the instructions below can get you in trouble.

REMINDER: most system administrators can and do google.

You're at work, behind a restrictive protocol-aware firewall, which allows outgoing connections only through HTTP (port 80) and HTTPS (port 443), and blocks other protocols, specifically SSH, regardless of the destination port (read about Deep Packet Inspection, to see how it's done).

And you want to access your Debian/Linux box at home, over SSH.

As long as said firewall allows HTTPS, you can use stunnel to tunnel SSH traffic through the firewall.

Server side (PC at home):
1. configure your firewall to accept connections on port 443
2. configure your SSH daemon to listen to (the default) port 22 (note that it need not be accessible to the outside world)
3. install stunnel:
```
aptitude install stunnel4
```
4. comment out unwanted services from /etc/stunnel/stunnel.conf and add the following:
```
[sshd]
accept  = 443
connect = 22
TIMEOUTclose = 0
```
5. generate (as root) a new self-signed SSL certificate:
```
openssl req -new -x509 -days 999999 -nodes -out /etc/ssl/certs/stunnel.pem -keyout /etc/ssl/certs/stunnel.pem
openssl gendh >> /etc/ssl/certs/stunnel.pem
```
6. enable the stunnel daemon in /etc/default/stunnel4 like this:
```
ENABLED=1
```
7. start the daemon:
```
invoke-rc.d stunnel4 start
```
Client side (PC at work):
1. download, compile and install stunnel in your account
2. add the following stanza in ~/.ssh/config (where sshd.example.com stands for the address of your home PC):
```
Host sshd.example.com
  Port 443
  ProxyCommand stunnel3 -c -f -r %h:%p   
```

You should now be able to connect to your home PC over SSH.

Next time: same scenario, but with your work PC running Windows.

BaculaFS v0.1.7: Batch Mode

2010-12-31T00:31:00.000-08:00

Last night I released BaculaFS v0.1.7. I've added two main features:

batch mode: in this mode BaculaFS behaves as a frontend for the bextract utility, and will launch it in order to extract the list of files, specified by BaculaFS' cache prefetch options, to the path pointed to by the mount point parameter
cache prefetch from a list of files

These two features were designed to allow operations like the following:

incremental update of a snapshot on a mounted storage device, in a single command:

baculafs -o batch_extract,prefetch_diff=/path/to/snapshot,cleanup -o client=client-fd,fileset=client-fileset /path/to/snapshot/

if the destination snapshot is on a remote file system, you can either mount it as a local filesystem (e.g. with sshfs) and then use -o prefetch_diff to prefetch the modified files before copying them with rsync, or generate the file prefetch list with rsync like this:

# mount a view of the current bacula backup
baculafs -o client=client-fd,fileset=client-fileset,prefetch_symlinks /path/to/first/mount/point
# mount another view, this time with prefetch list generated by rsync
rsync -in --out-format='/%n' -a /path/to/first/mount/point/ /url/or/path/of/remote/snapshot/ | baculafs -o prefetch_list=-,client=client-fd,fileset=client-fileset /path/to/second/mount/point
# and now copy files for real
rsync -a /path/to/second/mount/point/ /url/or/path/of/remote/snapshot/
fusermount -u /path/to/first/mount/point
fusermount -u /path/to/second/mount/point

Happy New Year!

SSH and DBUS Sessions

2010-12-10T00:51:00.000-08:00

Applications that need access to the current D-BUS session bus, require special attention when launched from within an SSH session.

Sometimes it's enough to just set the DISPLAY environment variable to the appropriate X display number (e.g. localhost:0.0, or localhost:10.0 - the default when forwarding X connections over SSH), but it's usually not enough.

These applications need to know the so called D-BUS session bus address. This may be scraped from the environment of applications that are already running, and do have access to the session bus, as the value of DBUS_SESSION_ADDRESS, like this:

export $(strings /proc/*/environ| grep DBUS_SESSION | tail -1)

But there may be several possible values when more than one X session is used, and you'll need to select the right one, maybe by also matching the value of DISPLAY.

There is, however, a somewhat cleaner way to do this. The D-BUS environment variables may be set by running one of the machine generated files under ~/.dbus/session-bus - the files there all have names like 479864458729b195d5497c4bb663c100-10, where the string of hexadecimal digits before the dash is the machine UUID and the number after the dash is the X display number.

Here's how I do it in my ~/.bashrc:

session="$HOME/.dbus/session-bus/$(dbus-uuidgen --get)-$(echo $DISPLAY | sed -e 's/\([^:]*:\)//g' -e 's/\..*$//g')"
if [ -e $session ] ; then
    source $session
fi

Update No-IP.com and DynDNS.com Dynamic DNS with ddclient

2010-11-05T09:50:00.000-07:00

I have registered several host names with two dynamic DNS service providers: DynDNS.com and No-IP.com, and I've been using ddclient and noip2 to update my dynamic IP address with these services, respectively.

I've recently installed a wireless router, so I poked at ddclient trying to figure out how to use it when the computer running it is behind a router, such that its IP address is an internal address (10.x.x.x) and not the external IP address that needs to be sent over to the dynamic DNS service.

This turns out to be pretty easy: just add use=web to /etc/ddclient.conf to have ddclient discover the external IP via the DynDNS.com IP checking service.

Along the way I've discovered that ddclient also supports No-IP.com - a fact that's only mentioned in the usage message that's displayed when running

ddclient --help

and after some futzing around I've come up with the following configuration file, in order to update both services with the same client, using their respective IP checking services:

use=web
web=http://ip1.dynupdate.no-ip.com/
protocol=noip, login=username, password='password' group_or_comma_separated_host_list
protocol=dyndns2, use=web, web=dyndns, server=members.dyndns.org, login=username, password='password' hostname

(according to the help message, it should've been possible to specify the first two lines inside the third line, but this doesn't work for some reason - I guess it's a bug).

Windows x64 Cross Compiling with Microsoft Visual Studio 2010 Express

2010-10-29T07:57:00.000-07:00

Here's what works for me:

Download, install and register Microsoft Visual Studio 2010 Express - it's free of charge
Download and install the Windows SDK - be sure to install the x64 toolchain (and/or the Itanium toolchain)

Create a shortcut on the desktop for each hardware platform you want to compile for:

C:\WINDOWS\system32\cmd.exe /E:ON /V:ON /T:0E /C ""C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd" /x86 & "C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\VCExpress" /useenv"

(replace /x86 with /x64 and /ia64 for x64 and Itanium, respectively).
The "Start in" folder should be set to

"C:\Program Files\Microsoft SDKs\Windows\v7.1\"

Launch VCExpress via one of these shortcuts, and open a project that you want to cross compile. If it already contains the needed platform, then just switch to it and build. Otherwise, you should first use the configuration manager to add a new solution platform to the project - it's pretty straight forward

Cygwin/X Keyboard Layout Switching

2010-10-15T09:36:00.000-07:00

The current Cygwin X server supports keyboard layouts! what a nice surprise! and it can all be configured at the command line!

Here's how I launch X on my wife's new laptop, with two keyboard layouts (us/il) and SHIFT-CAPS used to switch between layouts:

C:\cygwin\bin\run.exe /usr/bin/bash.exe -l -c '/usr/bin/startxwin -- -xkblayout us,il -xkbmodel pc105 -xkbvariant ,lyx -xkboptions grp:shift_caps_toggle'

Ain't it cool?

(you've probably guessed by now: I suffer from an extreme case of sleep deprivation)

Automatically Launching Cygwin's X Server

2010-09-18T05:38:00.000-07:00

We have a new Dell Inspiron 13R laptop. One of the first things I do on any Windows machine I get is install Cygwin on it. One of the main reasons for this is to be able to run an X Server.

I wanted the X Server to start automatically at login, so I copied the shortcut named "XWin Server" that was installed to the Start->Programs->Cygwin-X menu and pasted it into the Start->Programs->Startup menu. This shortcut launches Cygwin's startxwin, which, in turn, launches the XWin server itself.

This works nicely, except for one annoyance: startxwin, by default, launches an X terminal. This makes sense if you manually click the "XWin Server" shortcut, but not (in my opinion) when it's launched automatically. I wanted it to start silently.

I followed a few false trails before I bothered to Read The Fine Man-page. The solution is pretty simple: create an empty .startxwinrc in my home directory:

$ touch ~/.startxwinrc

Changes

2010-09-03T07:40:00.000-07:00

A few weeks ago, following an overdose of bad luck, we bought a new laptop for my wife - a Dell Inspiron 13R (marketed locally as N3010).

Along with the new machine we bought an EDIMAX BR-6424n V2 wireless router, in order to network all of our three laptops.

About the same time, we finally replaced both of our failing cellular phones with a new pair of Nokia 2730phones.

And two weeks later my wife started a new part time job, where they issued her an ASUS Eee PC 1015P Netbook- when it rains it pours.

My plan is to setup the new box for my wife, take over her old laptop, and convert it to Debian (I'll probably replace its 80GB hard disk drive with a larger one).

So, I'm up to my neck with system administration chores. I intend to post some updates as soon as the dust settles down.

Cron Daemon Complains About PHP Warnings

2010-08-18T11:59:00.000-07:00

A recent upgrade of php5-common brought with it an annoying side effect - the root account is being spammed with email messages from the Cron Daemon, every 30 minutes:

Date: Wed, 18 Aug 2010 20:09:01 +0300                                                                                                                                                             
From: Cron Daemon                                                                                                                                                        
To: root@machine-cycle.home                                                                                                                                                                       
Subject: Cron    [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -n 200 -r -0 rm  
                                                                                                                                                                                                  
PHP Warning:  Directive 'register_long_arrays' is deprecated in PHP 5.3 and greater in Unknown on line 0                                                                                          
PHP Warning:  Directive 'magic_quotes_gpc' is deprecated in PHP 5.3 and greater in Unknown on line 0

First, I had to determine the package causing the trouble:

# dpkg -S /usr/lib/php5/maxlifetime
php5-common: /usr/lib/php5/maxlifetime

While some of the bugs listed at the Debian BTS seemed relevant, none seemed to match my exact situation.

I searched for the exact error messages I got, and found a few references on the PHP BTS. Some of these revolved around a problem with disabling warning reports from the PHP interpreter.

I decided it was time to follow the code instead of hyperlinks.

The file /usr/lib/php5/maxlifetime is a short shell script which calls the PHP command line interpreter, like this:

php5 -c /etc/php5/apache2/php.ini -r 'print ini_get("session.gc_maxlifetime");'

I tried it at the command line, and I got the same warnings. Got it!

But now what? after all, I know next to nothing about PHP...

Well, it did seem plausible that the problem had to do with the configuration file /etc/php5/apache2/php.ini, so I stared at it for a while until I found that warning messages can be disabled like this:

error_reporting  =  E_ALL & ~E_NOTICE & ~E_WARNING

I got rid of the annoying email messages alright, but I didn't really solve the problem - it's just a workaround.

Life's full of workarounds, and I'm slowly getting used to it.

Enlarge VirtualBox NTFS Disk Image

2010-07-30T05:49:00.000-07:00

I ran out of disk space on my virtual Windows XP computer. I deleted some files and uninstalled a few unnecessary applications, but this didn't quite cut it, so I decided to enlarge the disk image from 10GB to 30GB - a sizeable upgrade, that should be enough for quite a while:

backup and then shutdown the Windows VM
create a new virtual disk with the appropriate size, via the File->Virtual Media Manager tool
attach this disk image to the Windows VM via the storage settings dialog
download the GParted Live ISO image (I used the "testing" image)
mount the ISO image on the Windows' VM virtual optical drive (again, via the storage settings dialog)
boot the VM from the ISO image (should happen automatically)
use GParted to copy the NTFS partition from the small disk image, and then paste it to the new large disk image
GParted should now ask you for the size of the new pasted partition: modify its size so that it takes up all available space on the new disk image
apply the chages, and wait for the process to finish
set the boot flag on the new partition
close GParted and shutdown the VM
remove the CD image from the virtual optical disk drive, and set the new disk image as the only disk image attached to the VM
start the Windows VM - it should boot (unless you missed the boot flag part above) and then Windows will automatically run a disk check and start normally afterwards