server on CoderOnline

samba4

Thu, 30 May 2024 20:20:53 +0200

Samba cheat sheet #

Main configuration file (FreeBSD /usr/local/etc/smb4.conf)

[global]
    workgroup = WORKGROUP
    realm = workgroup.local
    netbios name = NAS

[coderonline]
    path = /home/coderonline
    public = yes
    writable = yes
    printable = no
    guest ok = no
    valid users = coderonline

user accounts must exist, password login not necessarily, because user accounts are handled independant, users added with:

pdbedit -a -u max

list all users on a samba server: pdbedit -L -v

pipewire

Fri, 03 Dec 2021 22:04:17 +0100

why pipewire and not pulseaudio #

Short answer: Because you have no other choice if you want to share your screen in a video conferencing tool, like BigBlueButton under a wayland session compositor, like e.g. sway.

list default recording device #

I could not find a simple method to determine the default sink and source yet, but at least the following two command lines work for now:

pw-dump | jq -r ".[$(pw-cat -r --list-targets | egrep -o '^\*\s[0-9]+' | cut -f2)].info.props.\"node.description\""
pw-cat -r --list-targets | egrep '^\*\s[0-9]+' | grep -o "\".*\"" | tr -d "\""

list default playback device #

The only nice thing about both commands is, that changing one character is enough to display either the default recording or playback device.

pulseaudio

Fri, 03 Dec 2021 22:04:17 +0100

Network Server #

A Pulseaudio network server is easy to configure and comes handy when you have multiple computers or virtual machines and just one pair of speakers. Further more do not all remote desktop solutions deliver sound.

Firewall #

The server awaits incoming connections on port 4731, which is why this port must be accessible through the firewall.

Redirection to Jack Audio Server #

pacmd load-module module-jack-sink channels=2

Connecting a client to a running Server #

pactl load-module module-tunnel-sink-new sink_name=server_name channels=2 rate=48000 server=127.0.0.1

where 127.0.0.1 is the IP-Address or host name of the pulseaudio server and all other parameters are optional.

DLNA

Thu, 21 Oct 2021 00:00:00 +0000

minidlna can be used to advertise and provide a DLNA server services in the local network. Other solutions are gerbera or plexmediaserver (proprietary), which offer a nicer http interface.

The VLC media player can be used to discover existing servers on the network. For that use View -> Playlist and in the sidebar select universal plug'n'play. The DLNA server should then appear automatically, if configured correctly.

A firewall can potentially make the server undiscoverable. The UDP port 1900 has to be opened to allow incoming traffic, which is coming from 239.255.255.250, but we will skip that for this initial test to make it easier to read:

OpenVPN

Wed, 28 Sep 2016 03:06:21 +0200

Note: This page is under development

#!/bin/bash
set -x
export EASYRSA_BATCH=1

easyrsa init-pki
cp /etc/easy-rsa/openssl-easyrsa.cnf pki/
cp /etc/easy-rsa/openssl-easyrsa.cnf pki/safessl-easyrsa.cnf
cp -r /etc/easy-rsa/x509-types pki/
EASYRSA_REQ_CN="`hostname -f`" EASYRSA_KEY_SIZE=4096 easyrsa build-ca


easyrsa build-serverClient-full serverclient1 nopass
easyrsa build-serverClient-full serverclient2 nopass
easyrsa build-serverClient-full serverclient3 nopass

# easyrsa gen-req         client1 nopass
# easyrsa sign-req client client1
# easyrsa gen-req         server1 nopass
# easyrsa sign-req server server1

openssl dhparam -out dh.pem 4096

client1.conf

powerdns

Sun, 10 Jul 2016 04:14:08 +0200

Note: This page is under development

# setup a database
psql -h dbhost.local -U powerdns -d powerdns -a -f /usr/local/share/doc/powerdns/schema.pgsql.sql

# SOA
insert into records (domain_id, name, content, type, ttl, prio) values (1,'blog.entwicklerseite.de', 'ns1.first-ns.de postmaster.robot.first-ns.de 2016062901 3000 3000 604800 300', 'SOA', 3600, NULL);

# A
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'www.blog.entwicklerseite.de', '78.46.199.146', 'A', 3600, NULL);

# MX
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'blog.entwicklerseite.de', 'blog.entwicklerseite.de', 'MX', 3600, NULL);

# NS
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'example.com', '127.0.0.1', 'NS', 3600, NULL);

# enable axfr for all servers with an NS entry
insert into domainmetadata (domain_id, kind, content) values (1,'ALLOW-AXFR-FROM','AUTO-NS');

Problems and solutions #

Unable to retrieve SOA for some.thing #

This error can have many causes, but basically means, that your slave cannot reach the master. You can easily get this error if you forgot to open UDP port 53, which is confusing if your host -t axfr some.thing [dns.master.ip.address] worked, because only TCP port 53 is open.

ssh

Wed, 25 May 2016 03:08:34 +0200

Agent admitted failure to sign using the key #

Auf dem Client

ssh-agent starten, falls der noch nicht läuft

ssh-add laufen lassen, um der laufenden Instanz von ssh-agent die aktuellen keys hinzufügen

Auf dem Server

systemctl start sshd startet den ssh-daemon

einstellungen der firewall dahingehend überprüfen, ob der ssh-port zugänglich ist (normalerweise 22)

Regenerate Diffie-Hellman group exchange key #

This is to prevent LogJam attack from successful happening.

ssh-keygen -G moduli-2048.candidates -b 2048 && ssh-keygen -T moduli-2048 -f moduli-2048.candidates
mv -i moduli-2048 /etc/ssh/moduli

postgresql server

Thu, 21 Jan 2016 01:31:54 +0100

important binaries are: database management createdb createuser postgres cli interface psql useful commands:

du   # list users
list # list all databases
dt   # list all tables
dS+  # list schema and size (all tables)

psql -h 10.0.0.10 -U powerdns -d powerdns -a -f schema.pgsql.sql

permissions to connect from outside #

this must explicitly be allowed using a pg_hba.conf, which is located under /usr/local/pgsql/data/pg_hba.conf or /etc/postgresql/9.3/main/. This file can be edited like that:

rsync

Tue, 15 Dec 2015 16:59:59 +0100

rsync can be used to copy and synchronize files in the local file system or over different kind of connections. The program has several modes of operation. It can be for example be used to communicate over a secure shell (ssh) connection, but it can also be configured to act as a server. In that case clients can ask for a list of shares the rsync server provides and download them. The big advantage of using rsync comes into play here: The daemon can run under a different user account then the clients. This can be used to make backups.

asterisk

Sat, 31 Jan 2015 21:31:06 +0100

This command converts all files from a folder into an asterisk compatible format

# either with sox
find -name '*.wav' -exec basename "{}" .wav ; |\
         xargs -iQ sox "Q".wav -t raw -b 16 -r 32000 "Q".sln32

# or with ffmpeg
find -name '*.wav' -exec bash -c 'FILE="{}" &&\
         echo $FILE "=>" ${FILE/wav/alaw}   &&\
         ffmpeg -i "$FILE" -ar 8000 -ac 1 -ab 64k -f alaw ${FILE/wav/alaw} ' \;

Folders #

folder	description
`/var/spool/asterisk/voicemail/default`	where voicemail stores files
`/usr/local/etc/asterisk/`	main configuration files

netboot

Thu, 01 May 2014 04:38:04 +0200

Setting up a netboot server is surprisingly easy, but I could not find comprehensive guides. What you really need:

DHCP Server, from which your client receives an IP-Address and the Address to a tftp server
TFTP Server, where a bootloader and one or more images are located

TFTP Server #

First install a tftp server package with support for xinet (usually included in plain xinet)

xinetd is a daemon, which listens on specified ports and pipes the traffic to a program one can specify in config. In this case we want a tftp config file, where you can also specify a root path for your tftp server:

Mon, 01 Jan 0001 00:00:00 +0000

Desktop streaming (e.g. via bbb or jitsi) #

pulseaudio did not work for me and had to be replaced with pipewire, because it brings these systemd user services to enable desktop streaming:

  pipewire-media-session.service
  pipewire-pulse.service
  pipewire.service

Graphical Java applications #

Do not start and say: `Error Can't connect to X11 window server using 'wayland-1'` #

Run it under Xwayland, e.g. with env DISPLAY=:0 java program.java

Matrix

Mon, 01 Jan 0001 00:00:00 +0000

synapse #

‘reference’ implementation in python
Can be slow at times.
Creates a huge on disk cache for images.
has a very long configuration file.
requires to have a valid TLS certificate in the config

dendrite #

does not always provide meaningful error messages, e.g. when files are inaccessible due to permission issues.
does not yet have a lot of documentation
seems to maintain its cache status in the database. Clearing the cache in the file system is not enough.

conduit #

works really good.
adds a lightning to user names by default (can be deactivated in the config)

conduwuit #

fork of conduit
works as drop in replacement
not yet available as binary package on FreeBSD :(
development seems to move faster.

OpenLDAP

Mon, 01 Jan 0001 00:00:00 +0000

mkdir /usr/local/etc/openldap/slapd.d/ cp -v /usr/local/etc/openldap/slapd.ldif.sample /usr/local/etc/openldap/slapd.d/slapd.ldif

now edit the file slapd.ldif and at least change: #

12,13c12,13
< olcArgsFile: /var/db/run/slapd.args
< olcPidFile: /var/db/run/slapd.pid
---
> olcArgsFile: /var/run/openldap/slapd.args
> olcPidFile: /var/run/openldap/slapd.pid

because that is where FreeBSD expects openldap to put these files.

WIP #

This does not work yet

# create the configuration database out of the ldif file:
slapadd -n0 -F /usr/local/etc/openldap/slapd.d/ -l /usr/local/etc/openldap/slapd.d/slapd.ldif
# start slapd with debug option to see error messages (CTRL-c if it works)
/usr/local/libexec/slapd -d1 -F /usr/local/etc/openldap/slapd.d/

# /etc/rc.conf.local
slapd_enable="YES"
# the following line makes slapd use slapd.d folder instead of slapd.conf
slapd_cn_config="YES"

This worked #

Edit /usr/local/etc/slapd.conf, add further schema and enable the correct backend:

server on CoderOnline

samba4

Samba cheat sheet #

pipewire

why pipewire and not pulseaudio #

list default recording device #

list default playback device #

pulseaudio

Network Server #

Firewall #

Redirection to Jack Audio Server #

Connecting a client to a running Server #

DLNA

OpenVPN

powerdns

Problems and solutions #

Unable to retrieve SOA for some.thing #

ssh

Agent admitted failure to sign using the key #

Regenerate Diffie-Hellman group exchange key #

postgresql server

permissions to connect from outside #

rsync

asterisk

Folders #

netboot

TFTP Server #

Desktop streaming (e.g. via bbb or jitsi) #

Graphical Java applications #

Do not start and say: Error Can't connect to X11 window server using 'wayland-1' #

Matrix

synapse #

dendrite #

conduit #

conduwuit #

OpenLDAP

now edit the file slapd.ldif and at least change: #

WIP #

This worked #

Do not start and say: `Error Can't connect to X11 window server using 'wayland-1'` #