CoderOnline - where visions become reality on CoderOnline

Link aggregation

Sun, 08 Dec 2024 16:41:02 +0100

Problem statement #

The new switch supports 2,5 Gigabits, the computer connected to it has multiple network ports all of which have only 1Gbit and we want more speed than a single port offers, so we connect multiple ports to the switch.

Nomenclature #

This is sometimes referred to as “Link aggregation” and also sometimes called “Trunk Group Setting”, which is confusing because Cisco calls its 802.11q VLAN tagging something with trunk as well (that is unrelated to link aggregation).

samba4

Thu, 30 May 2024 20:20:53 +0200

Samba cheat sheet #

Main configuration file (FreeBSD /usr/local/etc/smb4.conf)

[global]
    workgroup = WORKGROUP
    realm = workgroup.local
    netbios name = NAS

[coderonline]
    path = /home/coderonline
    public = yes
    writable = yes
    printable = no
    guest ok = no
    valid users = coderonline

user accounts must exist, password login not necessarily, because user accounts are handled independant, users added with:

pdbedit -a -u max

list all users on a samba server: pdbedit -L -v

omg!ipv6

Thu, 24 Mar 2022 23:30:38 +0100

When I say I got ipv6 working I can imagine you may be asking how that is special and you are right, theoretically at least. Practically I faced a surprising amount of difficulties when I tried to configure my FreeBSD router to get an ipv6 address from my internet service provider. Because of that I configured my OpenVPN to route ipv6 traffic as an intermediate solution. That however also took more time than I would have expected, because there is just not enough documentation on the internet at this point in time and especially when it comes to the question: How to route ipv6 from a jail over an epair device. I mean… Try it, if you like, but I will soon publish an article about that topic here and that could help you to save a lot of time. So either believe me or proof to yourself, that you are more intelligent than me and that you can do the same thing with ease. No problem, only that I refuse to add a comment section to my website, so nobody will ever get to know, except… Wait… You could very well post about your success on some social network. Feel free to do so and do not forget to link my website. I like visitors, but google does not like my site.

uniprompt.sh

Tue, 01 Feb 2022 00:00:00 +0000

In the early 90ies I used ansi.sys under DOS to get a colored prompt. With that it got much easier to spot where the last command was executed. Ten years later I switched to Linux and hardly missed that. The configuration of PS1 was one of the first more advanced configurations I ever did and I reworked my prompt every now and then and made it better every time. This version is a slightly modified version of it, which I was using for the last five years. It has proven to work under different operating systems, is easy to understand and much faster than powerline. I know, that it looks a lot like powerline, but it was not really inspired by that. There are simply not many characters compatible with the linux console and virtual terminals.

Windows

Tue, 11 Jan 2022 13:37:00 +0100

special locations (Win+r) #

shell:sendto

shortcuts #

win+x quick access to traditional places, e.g. apps features, event viewer, system, computer management, settings, shut down or sign out

Boot #

Error 0xc0000225: a required device is not connected or can’t be accessed

The Windows partition is searched by its UUID and if it changes for some reason, it can be restored with:

gdisk /dev/nvmen1p3
x<CR>
p<CR>
c<CR>

pipewire

Fri, 03 Dec 2021 22:04:17 +0100

why pipewire and not pulseaudio #

Short answer: Because you have no other choice if you want to share your screen in a video conferencing tool, like BigBlueButton under a wayland session compositor, like e.g. sway.

list default recording device #

I could not find a simple method to determine the default sink and source yet, but at least the following two command lines work for now:

pw-dump | jq -r ".[$(pw-cat -r --list-targets | egrep -o '^\*\s[0-9]+' | cut -f2)].info.props.\"node.description\""
pw-cat -r --list-targets | egrep '^\*\s[0-9]+' | grep -o "\".*\"" | tr -d "\""

list default playback device #

The only nice thing about both commands is, that changing one character is enough to display either the default recording or playback device.

pulseaudio

Fri, 03 Dec 2021 22:04:17 +0100

Network Server #

A Pulseaudio network server is easy to configure and comes handy when you have multiple computers or virtual machines and just one pair of speakers. Further more do not all remote desktop solutions deliver sound.

Firewall #

The server awaits incoming connections on port 4731, which is why this port must be accessible through the firewall.

Redirection to Jack Audio Server #

pacmd load-module module-jack-sink channels=2

Connecting a client to a running Server #

pactl load-module module-tunnel-sink-new sink_name=server_name channels=2 rate=48000 server=127.0.0.1

where 127.0.0.1 is the IP-Address or host name of the pulseaudio server and all other parameters are optional.

base16-vtrgb

Mon, 25 Oct 2021 00:00:00 +0000

The base16 for virtual terminals repository can be used with any base16-builder to create base16 color schemes compatible with setvtrgb, but a static version is always kept up to date in the repository in the consolecolors folder and ready be used or tried.

The color schemes can be applied during the early boot stage and there is a initcpio hook for Arch Linux available in the AUR Package. With it the encryption password can be entered with the color scheme already applied:

lm_sensors

Mon, 25 Oct 2021 00:00:00 +0000

How to set up #

After installing lm_sensors most users would typically use sensors-detect --auto to configure it and usually a successive call of sensors already shows most sensor readings correctly. There is also the lm_sensors daemon, which can be activated with something like systemctl enable lm_sensors (, if your system uses systemd that is).

The issue with automatic sensors-detection #

But there are always some superfluous values in the output and often some to cause an ALARM. This is not a big issue as long as the tool is called manually. But there is also the lm_sensors service, which is there to constantly monitor the sensors and can be used to inform the admin about malfunctions via syslog or even via email, if configured correctly. This is of cause an issue, if it happens every single time the monitoring daemon runs the test.

Released emocli

Sat, 23 Oct 2021 14:50:38 +0200

emocli is a little bash script, which is able to display most of the emoticons and symbols found in Wikipedia articles about Unicode and Charsets. The tool does not present an overview and is not meant as a replacement for gnome-characters, but better suited to test the capabilities of different terminal emulators: The script can add modifiers to the smilies and request a text-only representation by doing so. Not all terminal emulators support that today. You can also use it to test ’new’ standards, e.g. the emoticons skin color tone after Fitzpatrick and wonder how few emoticons are supported at this time.

DLNA

Thu, 21 Oct 2021 00:00:00 +0000

minidlna can be used to advertise and provide a DLNA server services in the local network. Other solutions are gerbera or plexmediaserver (proprietary), which offer a nicer http interface.

The VLC media player can be used to discover existing servers on the network. For that use View -> Playlist and in the sidebar select universal plug'n'play. The DLNA server should then appear automatically, if configured correctly.

A firewall can potentially make the server undiscoverable. The UDP port 1900 has to be opened to allow incoming traffic, which is coming from 239.255.255.250, but we will skip that for this initial test to make it easier to read:

Released vim-under-the-cursor

Sat, 09 Oct 2021 23:14:43 +0200

vim-under-the-cursor Underlines all occurances of the word under the cursor and additionally displays the color under the cursor if it is written as a hex value. The alpha-channel (#rgba colors) is also supported and changes the brightness of colors.

Released vim-fancy-line

Sun, 16 May 2021 00:00:00 +0000

vim-fancy-line was released today: A minimalistic, fast and good looking status- and tabline for Vim.

Xfce/Thunar contribution

Sun, 14 Mar 2021 00:00:00 +0000

This is no spectacular change, but it is really awesome how easy it is to contribute to the Xfce project thanks to its maintainers like Alexander Schwinn. Thank you! This really encourages further involvement.

apu4d4

Sun, 07 Mar 2021 00:00:00 +0000

I was looking for a way to use FreeBSD as router OS in my home. Its purpose was to route OpenVPN traffic from and to my network, so that an individual host configuration becomes unnecessary. My first setup was based on a raspberry pi and that works good enough and is so simple, that it can easily be fixed if something breaks.

I further improved the setup and installed a local DNS recursor in order to get DNS under my control. That allowed me to name my devices relative to a local domain, optimize the recursor cache to my needs and use DNS servers from the opennic project for which I needed the cache optimizations the most.

locale

Sun, 21 Feb 2021 00:00:00 +0000

Per user configuration #

The manual man 5 locale is very brief, but it lists man 7 locale under SEE ALSO. The main purpose of the manual is to describe the format of /etc/locale.conf. The xdg-standard however also allows per-user locale settings in a file ~/.config/locale.conf with a similar format.

LANG=de_DE.utf8
LC_CTYPE=de_DE.utf8
LC_NUMERIC=de_DE.utf8
LC_TIME=de_DE.utf8
LC_COLLATE=C
LC_MONETARY=de_DE.utf8
LC_MESSAGES=en_US.utf8
LC_PAPER=de_DE.utf8
LC_NAME=de_DE.utf8
LC_ADDRESS=de_DE.utf8
LC_TELEPHONE=de_DE.utf8
LC_MEASUREMENT=de_DE.utf8
LC_IDENTIFICATION=de_DE.utf8
LC_ALL=de_DE.utf8

firefox

Sun, 14 Feb 2021 23:23:23 +0102

Disable searches via the address bar #

This script can be used to automate the reconfiguration of firefox

#!/bin/bash -x
FIREFOX_HOME=~/.mozilla/firefox
DEFAULT_PROFILE=$(awk -F= '/Default=/{ print $2 ; exit }' $FIREFOX_HOME/profiles.ini)
USER_JS=$FIREFOX_HOME/$DEFAULT_PROFILE/user.js

cat > $USER_JS <<END
// User Preferences

user_pref("browser.urlbar.suggest.searches", false);
user_pref("browser.fixup.alternate.enabled", false);
user_pref("keyword.enabled", false);
END

Raspberry infrared camera drill template

Sun, 07 Feb 2021 00:00:00 +0000

This camera is available online and gets seriously warm when turned on. Also it is hard to mount in this form. Or short: A case is necessary and here is the drill template for it (in SVG-Format)

And the result is good enough:

Smart home

Tue, 01 Dec 2020 00:00:00 +0000

I have never found it noteworthy that I have installed LED strips behind my main monitors, because it used to be too dark there and was hurting my eyes. For many years I had a crude LED-strip in a cable tie construction, not very nice from a construction point of view, but as durable as such temporary solutions always get. I have now upgraded the setup and for anybody interested in how my desktop looks like today, here it is:

TTY basics

Wed, 04 Nov 2020 16:33:35 +0200

TTY is the abbreviation for TeleTYpewriter. A typewriter can be described as a device, which gets input and delivers output. We call such a device a terminal. The methods shown here will partially not work in a terminal emulator, like xterm. That is, because an emulator does not necessarily implement each existing terminal function. I recommend to switch to a real terminal for testing. That can ordinarily be done with [STRG]+[ALT]+{[F1]-[F12]}

Released vim-recently-used

Thu, 16 Jul 2020 22:27:58 +0200

vim-recently-used shows a list of recently used files from the current directory when starting Vim.

Vim contribution

Tue, 07 Jul 2020 00:00:00 +0000

I am confident to speak for others as well when I thank Bram Moolenaar for accepting my pull request so quickly.

I am really impressed, that you really did that by yourself. I was not expecting that, because its unusual to be recognized by rock stars when participating in their concerts.

However I realized, that what this means to me could potentially be something I could give to others as well. Not because I am a rock star, but rather because nobody is. We are all humans and we can change the world for the better. Thanks for reminding me!

cgit

Mon, 11 May 2020 00:00:00 +0200

creating a file called noweb within the root of a repository prevents scan-path from adding it.

IMG_20200430_225948-small

Thu, 30 Apr 2020 23:45:13 +0200

IMG_20200430_225755-small

Thu, 30 Apr 2020 23:42:29 +0200

And still...

Tue, 07 Apr 2020 00:06:06 +0200

Some time ago my blog software broke and I could not help but did not feel like fixing it. That was now the situation for almost one year and until today and it was never supposed to take that long, nor does it mean that I will quit with anything. I am still here, I still work on my projects and below you find a picture of my latest project, which I will eventually release as an open source project.

new_display

Mon, 06 Apr 2020 23:59:45 +0200

IMG_20191117_000539

Sun, 17 Nov 2019 00:12:21 +0100

IMG_20191116_234350

Sat, 16 Nov 2019 23:56:08 +0100

coreboot

Sat, 16 Nov 2019 23:17:40 +0100

coreboot

Sat, 16 Nov 2019 23:16:53 +0100

Coreboot is an alternative and open source firmware. Together with its payloads it can replace a BIOS or UEFI.

I was not able to find binary packages of coreboot. Maybe that is, because it is so hardware specific and would somehow make its usefulness questionable. However the latest source code version is here.

Why?

Take back control: Own a hardware device and its software!
Brand your device so that even removing the hard disk does not help.
Write your own low level code. You know what? User space programs have no direct access to the contents of the flash.
Your life bores you and you want to risk something - clearly speaking: This procedure can very well brick your device!

Hardware requirements #

You better have one of these chip clips, best searched with soic16 clip. The cheapest I could find has a small pin pitch (see pictures). I once soldered a soic8 clip, but this time I used modified header cables and flexible heat shrink and only press fitted these. I found that very convenient and it worked perfectly, see here:

sway

Sun, 23 Jun 2019 17:52:15 +0200

Crash when starting terminal from within Thunar
To fix: Edit-> Configure Custom Actions-> "Open Terminal Here" and disable "Use Startup Notification"

Configure keyboard layout
The implementation is still work in progress, but as part of wlroots. The easiest workaround is to create or reuse the /etc/environment and add something like:

XKB_DEFAULT_OPTION="keypad:pointerkeys,grp_led:caps,grp:caps_toggle"
XKB_DEFAULT_LAYOUT="us(altgr-intl),de"

gnupg

Wed, 08 May 2019 23:28:47 +0200

# Generate a password
gpg --armor --gen-random 1 20

gpg --list-secret-keys

# export private key to an encrypted file
gpg --armor --export-secret-keys [KEYID|mail-address]  | gpg --armor --symmetric --output encrypted-key.sec.asc

Pinentry #

~/.gnupg/gpg-agent.conf

default-cache-ttl 300
max-cache-ttl 999999
enable-ssh-support
pinentry-program /usr/bin/pinentry-curses
# pinentry-program /usr/bin/pinentry-gnome3
disable-scdaemon

Followed by:

gpgconf --reload
# or
systemctl --user restart gpg-agent

gnuplot

Sun, 10 Mar 2019 23:36:57 +0100

This is such a mighty tool and it is so sad, that I have not used it more often.

Uptime graph #

gnuplot and perl is 💖

#!/bin/env perl

my $days = 20;

# set terminal dumb size 160, 30;
# set grid;
# set format x "%d.%m.%Y";
$C = <<GNUPLOT;
    gnuplot -p -e '
    unset border;
    unset key;

    set colorsequence classic;
    set terminal dumb ansirgb noenhanced size 160,37;

    set title "Login duration during the last $days days" font "sans-serif,12";

    set xdata time;
    set ydata time;
    set xtics nomirror rotate 86400 font "sans-serif,8" scale 0;
    set ytics nomirror        time  font "sans-serif,8" scale 0;

    set autoscale xfix;

    set format x "%a\n|%d\n|%m\n|%y";
    set format y "%M:%S";

    plot 
        "-" using (timecolumn(1, "%Y-%m-%d")):(timecolumn(2, "%M:%S")) with impulses lc rgb "#6000ad"  lt 6 lw 2,
    '
GNUPLOT

my $total = 0; my $count = 0;
# TODO: maybe utmpdump /var/log/wtmp is better?
$O = qx[last --time-format iso reboot -R];
$O =~ s/(\d{4}-\d{2}-\d{2}).*\d{4}-\d{2}-\d{2}.*\((\d{2}):(\d{2})\)/$dates{$1}+=(60.0*$2)+$3/eg;
open (W, '|'.$C) or print $!;
@list = reverse sort keys(%dates);
foreach (splice @list, 0, $days) { 
    my $d = $dates{$_};
    my $m = $d % 60;
    my $h = ($d - $m) / 60;

    $total += $d;
    $count ++;
    # printf(  "%s\t%02d:%02d\n", $_, $h, $m);
    printf(W "%s\t%02d:%02d\n", $_, $h, $m);
}
close(W);


# $total += 7.5 * 60 + 7.5 * 60 + 10 * 60;
printf("summary: %.2f hours per day during the last $count days\n", $total / $days / 60.0);

Drill templates for analog meters

Wed, 21 Nov 2018 00:00:00 +0000

Here are some drill templates for cheap analog meters. No waranties, worked for me (tm).

50-43 #

glabels, pdf

85c1-85l1 #

glabels, pdf

85x1_85l1_dh670 #

glabels, pdf

FreeBSD kernel panic

Tue, 01 May 2018 23:07:48 +0200

In system program the UEFI BIOS

Sat, 17 Mar 2018 16:55:08 +0100

Apart from looking so crude: This device actually worked! I was able to re-flash the UEFI BIOS directly on the motherboard and the computer starts again! More important is though, that after that worked, there is no reason to NOT further play around with the BIOS anymore. Watch out for news or try it on your own. An interesting low-level world has forgotten to lock its gate ;) The whole story: I faced a serious issue with my computer the other day, when it wasn't booting any more and stuck on the BIOS logo screen. I tried DEL and the F* keys, but the system did not respond by any means. But I further noticed, that -within a certain time frame- the NUM lock key worked with a remarkable delay before the LED reacted. I removed all components, even one of the two RAM sticks I have- still the same thing. Since the board had a dual bios, I tried to re-flesh the first from the second by holding the on switch for a few seconds. Although that seemed to work it did not fix the issue. I removed and reinserted the bios battery and started bridging pins of the BIOS chip in order to erase it until I managed to get the computer in an even worse state in which it turned on and again off very quickly without showing anything on the screen. I managed to destroy my BIOS and that used to be something for which you have send your board back to its manufacturer or buy a new one. But I was still not ready to give up on it and after some soldering and bug fixing I came up with a really crude solution, which I now want to share with you, because this thing looks so terrible, even though it worked :D Note: I also tried a direct connection with a more recent Raspberry Pi 3, but for that additional resistors would be required.

Raspi as serial programmer

Sat, 17 Mar 2018 16:54:13 +0100

solder fume extracting lamp

Sat, 27 Jan 2018 23:47:28 +0100

Upcycling of an old and defective ATX power supply by using its case, because that already has a hole and a huge fan and a carbon filter can easily be placed inside…

At least one switch is required to turn the fan on and off. That is if you ever like to enjoy light and silence altogether ;)

IMG_6239

Sat, 27 Jan 2018 23:43:16 +0100

IMG_6236

Sat, 27 Jan 2018 23:43:14 +0100

IMG_6234

Sat, 27 Jan 2018 23:43:12 +0100

IMG_6231

Sat, 27 Jan 2018 23:43:11 +0100

IMG_6230

Sat, 27 Jan 2018 23:43:09 +0100

Kellerjoch, Schwaz/Tirol

Tue, 10 Oct 2017 18:50:53 +0200

Kellerjoch, 2017

Tue, 10 Oct 2017 18:48:26 +0200

icinga

Sun, 08 Oct 2017 22:45:53 +0200

icinga is a promising fork of the popular nagios monitoring tool. As such it helps to keep track, which of your hosts are up and running and which need administration, e.g. system updates. All that is presented in a fancy web ui:

Configuration #

The configuration wasn't enjoyable, even though it was not as bad as with nagios. Theoretically should all nagios plugins work with icinga. However I found, that the asterisk monitoring did not. For that reason I kind-of reverse engineered the SIP/VOIP protocol in order to find a suitable and generic test pattern.

Screenshot_2017-10-08_22-27-03

Sun, 08 Oct 2017 22:28:59 +0200

bash snippets

Thu, 04 May 2017 20:34:14 +0200

convert binary number to hexadecimal #

printf '0x%08x\n' "$((2#10000))"

Create a preview png for every stl in a folder #

for f in \*.stl; do stl2thumbnail ${f%%.\*}.stl ${f%%.*}.png -s 800; done

it's a robot

Fri, 17 Feb 2017 16:14:34 +0100

cool-sample11

Fri, 17 Feb 2017 16:14:26 +0100

pogo

Thu, 12 Jan 2017 03:08:16 +0100

A Wolfs Dream

Wed, 11 Jan 2017 00:25:06 +0100

Its ridiculous how bad I am in drawing. Because of that I started to learn Blender some years ago. One of my last drawings was a scene from a dream I once had. With Blender I was finally able to catch the mood of that scene in an image:

pogo night

Wed, 11 Jan 2017 00:24:16 +0100

Charliecube

Tue, 13 Dec 2016 00:19:41 +0100

Again on lighting. This time it is a 4x4x4-LED-cube I had laying around for several month. Building such a thing takes a bit of patience, but turned out to be relaxing as playing with lego. Programming it can get challenging, but the software provided does a good job in simplifying it by providing graphics primitives.

parts and sources #

aglick.com original author,
thingiverse.com/thing:501651 printed parts/tools,
hackerspace-bielefeld.de software modifications,
sites.google.com/site/rgbledcubes pinout correction,
instructables.com/id/charliecube… hippynerd’s step-by-step instructions

why? #

Mainly I wanted to have one, because they look so great. On the other hand this is also an interesting project, because the exercise is to control 192 light emitting diodes (LEDs) with a single microcontroller.

Winterlight

Wed, 07 Dec 2016 22:59:26 +0100

Now that the dark season of the year is coming, I felt the need for a better lighting concept in my room. The blue light is meant to remind me on how the blue summer sky looks alike. I liked the blue energy saving lamps even better than its LED counterparts, because they deliver cooler light. The construction of the lamp is kept as simple as possible.

An IKEA PRÖJS desk pad forms the lamps body and acts as diffuser. It is held together with a punched metal strip and M3 nuts and bolds and 3M double sided tape, all of which I had lying around.

img_5416

Wed, 07 Dec 2016 22:57:39 +0100

img_5412

Wed, 07 Dec 2016 22:57:36 +0100

img_5405_01

Wed, 07 Dec 2016 22:57:33 +0100

img_5404_01

Wed, 07 Dec 2016 22:57:28 +0100

database theory

Sun, 20 Nov 2016 08:02:47 +0100

Database normalization #

I find the description of the normal form unintuitive and I found it to be copied all over the web without explaining it well.

What is it? #

It is all about good database design and in which way it differs from what we are sometimes using tables for in print.

How is it archived? #

We want just one kind of information in each and every column. In a books keyword index, we do not want it sometimes referring to pages, sometimes to chapters. It is perfectly fine to use both methods as long as they do not get mixed up.

OpenVPN

Wed, 28 Sep 2016 03:06:21 +0200

Note: This page is under development

#!/bin/bash
set -x
export EASYRSA_BATCH=1

easyrsa init-pki
cp /etc/easy-rsa/openssl-easyrsa.cnf pki/
cp /etc/easy-rsa/openssl-easyrsa.cnf pki/safessl-easyrsa.cnf
cp -r /etc/easy-rsa/x509-types pki/
EASYRSA_REQ_CN="`hostname -f`" EASYRSA_KEY_SIZE=4096 easyrsa build-ca


easyrsa build-serverClient-full serverclient1 nopass
easyrsa build-serverClient-full serverclient2 nopass
easyrsa build-serverClient-full serverclient3 nopass

# easyrsa gen-req         client1 nopass
# easyrsa sign-req client client1
# easyrsa gen-req         server1 nopass
# easyrsa sign-req server server1

openssl dhparam -out dh.pem 4096

client1.conf

The new Server is doing a good job

Mon, 29 Aug 2016 23:24:57 +0200

Not only does it serve virtually 'everything' much faster, but is also highly configurable and therefor tweakable. I am really satisfied with the result. Besides from that I have also set up a system monitor and log file analyzer, which I haven't had for a while. But in order to deliver relevant content the importance of such tools should never be underestimated. I also have moved my voice mailbox from an old raspberry pi b+ to this server. This simplifies my backups, improves its reliability and as a bonus I do not have to deliver my voice mails across the internet or at least I don't have to let asterisk know any of my smtp passwords ;)

goaccess

Wed, 17 Aug 2016 17:13:51 +0200

chromium

Fri, 05 Aug 2016 12:15:43 +0200

deactivate autosearch #

For web developers it is a nightmare, that chromium automatically redirects not resolvable URLs to the next search engine, especially when you are debugging http get session id code or such.

special urls #

chrome://net-internals chrome://settings/

Hotkeys #

function	key(s)
change tab	Ctrl-PgUp Ctrl+PgDown
move tab	Ctrl-Shift-PgUp Ctrl+Shfit+PgDown

chromium-annoying-omnicompletion

Fri, 05 Aug 2016 12:15:20 +0200

monitoring

Fri, 29 Jul 2016 18:02:36 +0200

Hard disk drives #

lsblk -f: tree overview over all block devices, partitions, uuid’s, labels and mountpoints
hdparm -C /dev/sda: displays the drive’s state (active, standby)
smartctl -s standby,now /dev/sda: put the drive into standby
hdparm -S240: automatically put the drive into standby after 20 minutes of inactivity
smartctl -a /dev/sda: displays all smart information about the drive
smartctl -lscttemp /dev/sda: displays the drives temperature over time (other -l options exist, wakes drive up from standby)
hddtemp /dev/sda: can spin sleeping drives up, but does not do that by default, shows the drive’s description/manufacturer, configurable as daemon

SIP #

As the SIP specification is very comprehensive it is not easy to find simple plain text tests. I found it is possible to make a simple call by sending this

qjackctl13

Sun, 10 Jul 2016 14:24:41 +0200

applications-office

Sun, 10 Jul 2016 14:23:59 +0200

ladebalken-unsharp-mask4

Sun, 10 Jul 2016 14:19:04 +0200

video-interior blender

Sun, 10 Jul 2016 14:16:38 +0200

powerdns

Sun, 10 Jul 2016 04:14:08 +0200

Note: This page is under development

# setup a database
psql -h dbhost.local -U powerdns -d powerdns -a -f /usr/local/share/doc/powerdns/schema.pgsql.sql

# SOA
insert into records (domain_id, name, content, type, ttl, prio) values (1,'blog.entwicklerseite.de', 'ns1.first-ns.de postmaster.robot.first-ns.de 2016062901 3000 3000 604800 300', 'SOA', 3600, NULL);

# A
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'www.blog.entwicklerseite.de', '78.46.199.146', 'A', 3600, NULL);

# MX
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'blog.entwicklerseite.de', 'blog.entwicklerseite.de', 'MX', 3600, NULL);

# NS
insert into records (domain_id, name, content, type, ttl, prio) values (1, 'example.com', '127.0.0.1', 'NS', 3600, NULL);

# enable axfr for all servers with an NS entry
insert into domainmetadata (domain_id, kind, content) values (1,'ALLOW-AXFR-FROM','AUTO-NS');

Problems and solutions #

Unable to retrieve SOA for some.thing #

This error can have many causes, but basically means, that your slave cannot reach the master. You can easily get this error if you forgot to open UDP port 53, which is confusing if your host -t axfr some.thing [dns.master.ip.address] worked, because only TCP port 53 is open.

fail2ban

Fri, 08 Jul 2016 01:26:46 +0200

This intrusion detection system can be configured to analyse log files with giving regular expressions and generate firewall rules for different firewalls. Also fail2ban is written in python, which makes it a very portable solution, which can be used under many different operating systems.

Configuration #

The configuration is simple: We assume the settings folder of fail2ban to be called /usr/local/etc/fail2ban and this may vary. But inside that folder we have subfolders called action.d, filter.d and jail.d and once one knows how files under jail.d are expected to look like, the configuration becomes relatively trivial:

webalizer screenshot

Mon, 04 Jul 2016 02:37:59 +0200

awstats screenshot

Mon, 04 Jul 2016 02:34:32 +0200

Migration sucessfull

Thu, 30 Jun 2016 03:21:34 +0200

I have moved my infrastructure to my own virtual server and now have a central point to administrate everything. Thanks to FreeBSD and it's jails I was able to separate services, which are known to have security issues regularly. Also I have already operated that server for two years and fine tuned many things, like firewall rules and kernel parameters. I am now pretty happy with the result. Among many other advantages which I gained by doing so, I have also improved the accessibility for my visitors: My sites are available over IPv6 and HTTPS, which tended to be too expensive on my previously used shared webspace. I am currently thinking about writing an article or creating a video about what I have learned about the differences and similarities between self hosted environments and shared webspace, because I managed to run unsupported code and languages on my shared space for years, which some of you may find interesting.

nintendo-entertainment-system

Thu, 09 Jun 2016 01:30:53 +0200

Blender: NES Console

Thu, 09 Jun 2016 01:12:08 +0200

ssh

Wed, 25 May 2016 03:08:34 +0200

Agent admitted failure to sign using the key #

Auf dem Client

ssh-agent starten, falls der noch nicht läuft

ssh-add laufen lassen, um der laufenden Instanz von ssh-agent die aktuellen keys hinzufügen

Auf dem Server

systemctl start sshd startet den ssh-daemon

einstellungen der firewall dahingehend überprüfen, ob der ssh-port zugänglich ist (normalerweise 22)

Regenerate Diffie-Hellman group exchange key #

This is to prevent LogJam attack from successful happening.

ssh-keygen -G moduli-2048.candidates -b 2048 && ssh-keygen -T moduli-2048 -f moduli-2048.candidates
mv -i moduli-2048 /etc/ssh/moduli

rj45-crossover

Wed, 09 Mar 2016 01:01:57 +0100

Things I frequently forget...

Fri, 26 Feb 2016 12:11:52 +0100

scrub mdraid #

echo check > /sys/block/md0/md/sync_action
watch cat /proc/mdstat
cat /sys/block/md0/md/mismatch_cnt

Disallow users to shut down #

sudo systemd-inhibit  --who='max' --why='Updating the system. Does not take long. Please be patient.' bash -c read

Recently saved files #

Clear (delete!) and disable

ln -sf /dev/null .local/share/recently-used.xbel
ln -sf /dev/null ~/.recently-used

gpg: ssh and signing #

gpg --list-keys [EMAIL]
gpg --export-ssh-key [EMAIL] > ssh_id.pub
gpg --armor --export [EMAIL] > signing_key.key
# ...and add this to ~/.profile:
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

rj45 crossover pinout #

poor mans null modem adapter

Sat, 20 Feb 2016 02:52:01 +0100

actually... it works :) ;)

poor-mans-nullmodem-cable

Sat, 20 Feb 2016 02:50:33 +0100

IMG_4146

Sat, 20 Feb 2016 02:49:16 +0100

IMG_4146

Sat, 20 Feb 2016 02:48:38 +0100

interior furnishing with blender

Tue, 16 Feb 2016 17:10:26 +0100

first complete 360 degree rendering took 4 hours (without baking anything)

home2016

Tue, 16 Feb 2016 17:07:09 +0100

thunar file manager

Thu, 21 Jan 2016 02:05:55 +0100

recognized url schemes #

smb:// ftp:// ssh:// sftp:// davs://

Some are supported dynamically when the correct gvfs integration is installed, e.g. gvfs-smb. This has eventually been deprecated by gio. The gio command can also be used to control gvfs from the command line.

There are environment variables which can dynamically deactivate certain features and that leads to unclear error messages, e.g.

GIO_USE_VFS=help gio list network://
gvfs - 10
local - 0

GIO_USE_VFS=local gio list network://
gio: network://: Operation not supported

GIO_USE_VFS=gvfs gio list network://

postgresql server

Thu, 21 Jan 2016 01:31:54 +0100

important binaries are: database management createdb createuser postgres cli interface psql useful commands:

du   # list users
list # list all databases
dt   # list all tables
dS+  # list schema and size (all tables)

psql -h 10.0.0.10 -U powerdns -d powerdns -a -f schema.pgsql.sql

permissions to connect from outside #

this must explicitly be allowed using a pg_hba.conf, which is located under /usr/local/pgsql/data/pg_hba.conf or /etc/postgresql/9.3/main/. This file can be edited like that:

blender-animation-ladeanzeige

Thu, 14 Jan 2016 12:36:34 +0100

loading

Thu, 14 Jan 2016 06:20:55 +0100

150x150-2

Thu, 14 Jan 2016 06:16:24 +0100

output

Mon, 11 Jan 2016 13:55:09 +0100

3,5"HDD disassembly time lapse

Sat, 09 Jan 2016 23:23:48 +0100

how to disassemble a 3,5" hard disk drive to salvage useful parts

policykit

Tue, 05 Jan 2016 12:57:51 +0100

If you have found this page you may already have trouble with this policykit. Afaik the major issue is, that policykit by itself does not log what it prohibits. To activate logging and debug successfully you need a special policykit rule file under /etc/polkit-1/rules.d/, which was written in javascript for some evil reason:

// /etc/polkit-1/rules.d/99-logall.rules
polkit.addRule(function(action, subject) {
                polkit.log("action=" + action);
                polkit.log("subject=" + subject);
});

The number 99 is believed to be the last rule file in that directory, so that when it gets called it will log to syslog. Check journalctl -xef while running the command that previously failed to get an understanding what wents wrong. Note, that policykit is smart enough to recognize rule changes by itself so that changing or adding files to that directory is enough. Just in case systemctl restart polkit restarts polkit.

Android

Thu, 31 Dec 2015 01:30:08 +0100

special files and paths

/data/local/userinit.sh # init script
/etc/security/cacerts # root certificates

BL  = BootLoader
AP  = PDA (Firmware)
CP  = Phone
CSC = CSC

List encrypted volumes #

mount | grep dm-

Package Manager #

pm help
pm list packages
pm list features
pm list path <PACKAGE> (returns the path to the apk)
pm install <APK-FILE>
pm list users
pm create-user

# list all apks...
for i in $(pm list packages) ; do  q=$(pm path ${i#package:}) ; echo ${q#package:}   ; done

To make an installed package available for another user, look up $UID with pm list users and $APPID with pm list packages, then run:

rsync

Tue, 15 Dec 2015 16:59:59 +0100

rsync can be used to copy and synchronize files in the local file system or over different kind of connections. The program has several modes of operation. It can be for example be used to communicate over a secure shell (ssh) connection, but it can also be configured to act as a server. In that case clients can ask for a list of shares the rsync server provides and download them. The big advantage of using rsync comes into play here: The daemon can run under a different user account then the clients. This can be used to make backups.

qspacestatus

Thu, 03 Dec 2015 06:17:53 +0100

qspacestatus is a program to display the status (open/closed) of your hackerspace in the notification area. Source code and binaries for Linux and Windows are available for download, packages for different distributions will follow.

GIT repository now officially online!

Thu, 03 Dec 2015 06:15:19 +0100

My GIT repository is finally reachable via http://git.entwicklerseite.de/

fedora

Thu, 03 Dec 2015 04:28:24 +0100

How to migrate from a virtual machine to a native host #

Normally one might simply take a disk, put it in another computer and start it there as a virtual machine e.g. by using kvm, xen or virtualbox. But in some cases the system hangs while booting and if you are very patient you will eventually get a message, that the UUID of the disk could not be found. The dracut shell helped me to find the cause of that error: ls /dev/ simply showed no active disk devices (were you would expect hdX, sdX or vdX devices). This implies that their drivers are missing in the kernel. As this whole rescue shell comes from the initramfs image: How to add those drivers to it? Well: Start your virtual machine again using a virtual IDE interface and issue:

orage-add-external-source

Tue, 24 Nov 2015 13:58:08 +0100

orage-exchange data

Tue, 24 Nov 2015 13:56:57 +0100

owncloud

Tue, 24 Nov 2015 13:52:45 +0100

machine owncloud.example.com
login [owncloud-user]
password [owncloud-password]

0 * * * * wget --no-check-certificate 'https://[owncloud.example.com]/remote.php/caldav/calendars/[owncloud-user]/personal?export' -O $HOME/.local/share/orage/owncloud.ics
0 * * * * wget --no-check-certificate 'https://[owncloud.example.com]/remote.php/caldav/calendars/[owncloud-user]/contact_birthdays?export' -O $HOME/.local/share/orage/owncloud-birthdays.ics

qjackctl: new logo

Thu, 12 Nov 2015 10:23:23 +0100

My logo made it into the official build :)

I created it, because the old icon had only 32x32 pixels and looked ugly when scaled up. However I liked it and tried to keep mine close to the original.

see: http://qjackctl.sourceforge.net/

todays icon

Tue, 13 Oct 2015 03:56:22 +0200

unix rosetta

Sun, 04 Oct 2015 00:02:50 +0200

This cheat sheet is under development #

purpose	Arch	Fedora	FreeBSD	debian
list files installed by a specific binary package	pacman -Ql pkg	rpm -ql pkg	pkg info -l pkg	dpkg-query -L pkg
list verbose information about an available, but not installed binary package	pacman -Qi pkg		pkg search -f pkg
create a loopback device out of a file	modprobe loop loop_max=16 && losetup /dev/loop0 [file]	modprobe loop loop_max=16 && losetup -o32256 /dev/loop0 [file]	mdconfig -f [file] /dev/md0
create a loopback device out of a file	sudo [username]	sudo [username]	su -m [username]
list block devices	lsblk	ls -l /dev/disk/by-id/	geom disk list

Programs (alternatives) #

industrial standard	alternative
Indesign	Scribus
Photoshop	Krita or Gimp
Illustrator	Inkscape

Basis tools #

dc - desktop calculator #

One of the oldest unix programs (even older then C) is hard to use, but available within all distributions, sometimes as part of bc, but bc is much newer. It uses reverse-polish notation and works by putting inputs on an internal stack. The input can be done line-wise, but also joined into one:

pfctl cheat sheet

Sat, 03 Oct 2015 19:09:40 +0200

Generic #

Only those commands, which you will probably require for setting pf up.

pfctl -s Tables              ;# lists all tables currently loaded
pfctl -t [TABLENAME] -T show ;# shows content of table [TABLENAME]

tcpdump -n -e -ttt -r /var/log/pflog
tcpdump -n -e -ttt -i pflog0

Anchors #

Fail2ban has recently switched to using anchors to avoid unnecessary reloading of the whole rule set. That was the first time I had to do with anchors and since I could not figure out a simple way to display the contents of all private tables (which can be described as subtables of anchors), I came up with this solution for my collectd monitoring:

libreoffice

Wed, 02 Sep 2015 22:29:28 +0200

Fixes #

Hyperlinks #

Hyperlinks are not working any more with the error message

Entry Point Not Found

failed to execute default file manager

Create a file /usr/local/bin/thunar-workaround:

FILE=$(echo $1 | perl -pe 's/%([0-9a-f]{2})/sprintf("%s", pack("H2",$1))/eig')
thunar "$FILE"

…and register that file as default file manager. For Xfce this can be found under Settings -> Preferred Applications -> Utilities -> File Manager -> Other.

ipfw configuration

Thu, 27 Aug 2015 21:51:26 +0200

Here comes an ipfw-configuration on which I was working on. It should redirect some ports to the host system, others into jails and on top of that limit on which ports jails and host are allowed to communicate with outside. Additionally I have configured a one second delay for the initial SSH connection, which is supposed to render brute force attacks less attractive.

# /usr/local/etc/2015-10-01.ipfw
# ================================================================================
# clean up/ reset everything...
flush
queue flush
pipe flush
table all flush
resetlog

# ================================================================================
# table 1: dns
table 1 add 213.133.99.99   
table 1 add 213.133.100.100 
table 1 add 213.133.98.98   

# table 2: jails
table 2 add 10.0.0.0/24

# nat 
nat 1 config if vtnet0 redirect_port tcp 10.0.0.100:8080 172.31.1.100:80

# pipes (requires kldload dummynet)
pipe 1 config delay 1000
pipe 2 config delay  200

# ================================================================================
add 100 pass all from any to any via lo0
add 200 deny all from any to 127.0.0.0/8
add 300 deny ip  from 127.0.0.0/8 to any    // ipv4 lo0 oubound
add 400 deny all from any to ::1            // ipv6 lo0 inbound
add 500 deny all from ::1 to any            // ipv6 lo0 outbound

add 1000 set 0 allow icmp      from any to me  in via vtnet0 // icmp4 incoming
add 1100 set 1 allow ipv6-icmp from any to me6 in via vtnet0 // icmp6 incoming 
add 1200 set 0 allow icmp      from me to any out via vtnet0 // icmp4 outgoing

# ================================================================================
add 1400 allow udp from me to table(1) 53 out   // allow dns

# slow down first ssh connection (setup) by using pipe 1...
add 1500 allow  tcp from me 22 to any           // ssh->any
add 1600 allow  tcp from any to me 22 not setup // any->me(22), not setup
add 1700 pipe 1 tcp from any to me 22 setup     // any->me(22), setup

# ================================================================================
add 2000 check-state
add 2100 allow ip from me to any setup keep-state out // outgoing connections

# ================================================================================
add 64000 nat 1 udp from any to any                  // udp->nat
add 64000 nat 1 tcp from any to me dst-port 80  in   // tcp->nat
add 64000 nat 1 tcp from me to any              out  // nat->any

# ================================================================================
add 65000 deny log ip from any to any // deny everything else, but log it

NAS4Free

Wed, 19 Aug 2015 12:07:39 +0200

NAS4Free ist ein auf FreeBSD basierendes System, welches als Livesystem auf Dateiservern eingesetzt werden kann. Damit habe ich mich eine Zeit lang beschäftigt. Heute sehe ich, dass ein Forenbeitrag von mir mit Erwägungen zu passender Hardware und dem Umgang mit ZFS bereits 10000 Mal gelesen wurde.

Nextcloud

Sun, 02 Aug 2015 11:33:00 +0200

Add custom mime types #

To register .norg files, add to config/mimetypemappings.json:

"norg": [
        "text/markdown"
]

and run (both required):

php occ maintenance:mimetype:update-js
php occ maintenance:mimetype:update-db --repair-filecache

openssl

Mon, 27 Jul 2015 20:59:14 +0200

this is one of the most annoying programs I know of. Why? Because its command line interface sucks! This is one of those programs where you find people claiming “This is fairly easy to do with openssl” to then present you a long command line script with pipes and parameters and even useless stuff nobody needs.

generate self signed certificates #

openssl req -newkey rsa:4096 -x509 -nodes -keyout lighttpd.pem -out lighttpd.pem

you can also choose two different file names and cat them together. This may be needed for some web servers and the keyout file is the private key so take care.

Harz4

Sun, 26 Jul 2015 01:28:16 +0200

network

Sat, 04 Jul 2015 11:44:56 +0200

netctl #

Using netctl is the preferred way over NetworkManager for servers. The main reason is, that normal users should not be allowed to alter the network configuration in case of a server.

VLANs #

VLANs are used when you only have one Network adapter and want to use it for multiple ip networks at a time. A router with VLAN support is also needed. TCP-Packages get a special Tag attached, which identifies the virtual interface they belong to. With netctl it is pretty simple to setup and examples can be found unter /etc/netctl/examples/.

Blender can now render anaglyph images :)

Sun, 14 Jun 2015 03:25:33 +0200

not bad as a first test

serverroom44-stereo

Sun, 14 Jun 2015 03:24:56 +0200

Universalstuhl von Heinz und Bodo Rasch

Sun, 07 Jun 2015 00:51:21 +0200

Because it is so hard to imagine how such a chair would be adjustible, here comes an animation:

chair

Sun, 07 Jun 2015 00:50:06 +0200

In reality

Tue, 02 Jun 2015 17:03:30 +0200

20150501droege2mitmessung_00417

Tue, 02 Jun 2015 17:02:30 +0200

An encrypted network drive using iscsi

Sat, 30 May 2015 20:08:27 +0200

An encrypted network drive: using iscsi #

The motivation is to backup data on a server and encrypt them on the fly. One FreeBSD Webserver and a local linux system is the base setup for this test, which finally worked out quiet well: I was able to create an encrypted network device, which gets decrypted on the local machine.

The FreeBSD Server #

Setup remote freebsd machine:

portal-group pg0 {
  discovery-auth-group no-authentication
  listen 127.0.0.1
  listen [::1]
}

target iqn.2012-06.com.example:target0 {
  auth-group no-authentication
  portal-group pg0

  lun 0 {
    path /home/max/nbd-test.raw
    size 512M
  }
}

append rc.conf with:

Greenscreen: A first try

Wed, 13 May 2015 02:40:14 +0200

chromatest05-greenscreen

Wed, 13 May 2015 02:40:04 +0200

custom icon set

Mon, 27 Apr 2015 13:58:34 +0200

I am currently producing a custom icon theme. Work in progress:

icons-sample

Mon, 27 Apr 2015 13:57:31 +0200

arch

Wed, 08 Apr 2015 14:55:41 +0200

This is specifically written for Arch Linux users, even so many of those methods can be applied to other distributions as well, because they are using the same packages. Little changes might be needed depending on the configuration of those packages.

force preboot environment #

In order to get into the base hook of mkinitcpio even so nothing is broken

break=premount

can be specified as kernel parameter. It is called APPEND ... break=premount when using syslinux as boot manager.

awstats

Sun, 05 Apr 2015 10:38:18 +0200

Why? #

because server stats are important… #

The quality of your website also happens to depend on the number of mistakes they have. A professional website is supposed to have less dead links for example. Search engines use information like this to rank your site. It is also good to know which specific pages are the most frequently visited on your site:

optimize your content to fit the expectations of your audience
never ever delete a page which is frequently visited, also known as the Cool URIs don't change-rule.

and compared to other tools… #

Compared to the popular and fast webalizer, which is written in C and requires little dependencies awstats has a few advantages:

Understanding the sort order: LC_COLLATE

Fri, 03 Apr 2015 11:40:58 +0200

The environment variable LC_COLLATE is part of the POSIX standard. It controls the locale specific sort order for tools like sort. It can be found in man 5 locale and man 7 locale

The following bash script can be used to create the table below. It shows the most common characters from the ASCII charset – 32 to 126. That will most likely cover all chars you ever used in file names and allows a prediction in which order they will appear, if you prefix file and folder names, e.g. with ~:

iptables

Thu, 26 Mar 2015 05:14:26 +0100

iptables is used to configure the linux kernel based firewall. Quite substatial is its ability to open and close ports, which I will discuss here. One should also be aware that iptables can be used to route traffic as well.

View active rules #

To view the rules in action watch can be used like so:

watch -d -n.1 iptables -L -v -n --line-numbers

This will output a number of tables, called CHAIN, which are usually named INPUT, OUTPUT and FORWARD. As that name suggests these indicate the direction the traffic comes from or goes to.

Dovecot

Wed, 25 Mar 2015 19:01:17 +0100

Dovecot ist ein IMAP Server. Er kann von Postfix aber auch als SMTP Authentifizierungsserver genutzt werden, wodurch eine einheitliche Konfiguration möglich wird. Mit dovecot -a lässt sich herausfinden was in dovecot hinein kompiliert wurde. Es kann daher passieren, dass der Befehl nichts zurück gibt. Über die FreeBSD Ports kann man sich eine eigene Version kompilieren:

cd /usr/ports/mail/postfix-current/
make config   # in diesem Schritt dovecot2 aktivieren!
make
make install  # ggf. make reinstall anstattdessen

Die Einrichtung ist gut im Dovecot-Wiki beschrieben

erster raum

Wed, 25 Mar 2015 01:08:11 +0100

Neue Webseite

Sat, 07 Mar 2015 13:15:29 +0100

Auftrag gemäß Kundenwunsch erledigt

nullzwomusik2015

Sat, 07 Mar 2015 13:14:51 +0100

wordpress

Tue, 03 Mar 2015 03:44:55 +0100

Beim Upload von Bildern kommt die Fehlermeldung HTTP-Error

AddHandler php5-cgi .php

increase upload size #

it is commonly known, that the php.ini has values for that:

post_max_size = 256M
upload_max_filesize = 256M
max_execution_time = 300

Note, that if you have configured your wordpress to be a network-installation you will also have to check your admin-panel under My Sites-> Network Admin-> Settings-> Max upload file size.

asterisk

Sat, 31 Jan 2015 21:31:06 +0100

This command converts all files from a folder into an asterisk compatible format

# either with sox
find -name '*.wav' -exec basename "{}" .wav ; |\
         xargs -iQ sox "Q".wav -t raw -b 16 -r 32000 "Q".sln32

# or with ffmpeg
find -name '*.wav' -exec bash -c 'FILE="{}" &&\
         echo $FILE "=>" ${FILE/wav/alaw}   &&\
         ffmpeg -i "$FILE" -ar 8000 -ac 1 -ab 64k -f alaw ${FILE/wav/alaw} ' \;

Folders #

folder	description
`/var/spool/asterisk/voicemail/default`	where voicemail stores files
`/usr/local/etc/asterisk/`	main configuration files

windows 7

Sun, 11 Jan 2015 13:22:30 +0100

It is allowed to make exactly one backup copy: source: windows 7 license terms (EULA), section 10
It is allowed to run windows directly on hardware and in a virtual machine as long as both run on the same computer and just one at a time: source: windows 7 license terms (EULA), section 3d
IPv6 sends keep alive messages to microsoft, so that microsoft knows for how long your computer is running each day: solution: can be deactivated by netsh; source: windows 7 license terms (EULA), section 7a, IPv6 Network Address Translation
Windows Media Player will contact microsoft periodically to update WMDRM data. Microsoft is also allowed to revoke permission it previously granted.: solution: you can prohibit media player updates; source: windows 7 license terms (EULA), section 7a
Windows regualy checks the validity of its activation and therefor contacts microsoft sending your serial number and hardware specs: solition: disconnect network, unknown; source: windows 7 license terms (EULA), section 5b
Plug and Play: If Windows does not have drivers for a connected device it will contact microsoft and automatically download those: solution: can be deactivated somehow; source: windows 7 license terms (EULA), section 7a
Network Awareness: passively monitors your network or activly sends http queries: solution: active query feature can be deactivated in the registry; source: windows 7 license terms (EULA), section 7a
Internet Explorer "Accelerators" send private information when just hovering them with the mouse: solution: do not use internet explorer; source: windows 7 license terms (EULA), section 7a

network bridging

Tue, 30 Dec 2014 00:47:57 +0100

One major case in which you want network bridging is when using virtualization. Because it allows you to expose your virtual machines to the rest of the network as if they were physically there. One limitation I found is that the bridge cannot be configured to have an own ip address. This justified using network bonding even less in my case, but read on!

NetworkManager #

Current versions of Network Manager let you configure bridges with the mouse, but they ain't well pre configured and you have to manually disable dhcp on the bridge.

rechtslinks2-dec2014-background

Thu, 18 Dec 2014 06:36:47 +0100

Pilatus, Luzern

Thu, 18 Dec 2014 05:47:56 +0100

IMG_2215-720

Sun, 14 Dec 2014 04:04:39 +0100

Invitation

Mon, 01 Dec 2014 17:48:06 +0100

10000b :: birthday - made with blender

The /etc/mail_aliases

Tue, 11 Nov 2014 04:05:23 +0100

The file /etc/aliases contains who is available under which address.

The file format is USERNAME: ADDRESS

An entry for the root user can redirect all EMails for this user to an external mail address. Alternatively every user can create a .forward file under $HOME to forward local mails to another address.

For that to work a mail-transport-agent like postfix must be reachable via that machine.

postfix

Mon, 10 Nov 2014 06:06:44 +0100

Postfix is an email server. That is the software which is normally used to receive and send emails. Postfix supports the smtp protocol, which can be used to send and receive, but not for reading your mail. There are other services like pop3 or imap for that and they require further server software, which can then be configured to work together with postfix. Most of us use pre configured mail servers from free email providers and postfix can also be configured to act as a simple client for those.

apache configration

Thu, 16 Oct 2014 17:35:33 +0200

cgi scripts #

These can be written in any language, but in most cases perl is used. See 'testing' to get an idea of the requirements a cgi script must meet independant of its language. In order to run scripts apache has the mod_cgi script, which can be an external module or compiled in. If it is an external module it must be activated like so:

/etc/httpd/conf/httpd.conf

LoadModule cgi_module modules/mod_cgi.so # do not mix this up with mod_cgid

We also need to configure where cgi scripts are allowed to be executed. the criteria can be a path or a file extension and if you have an AllowOverride All directive in your httpd.conf you can also use a .htaccess-file to tell apache which files are cgi scripts. In the first case this is done by defining a ScriptAlias, a path in which only cgi-scripts are allowed to be, because anything will get exected. I do not like this at all. You better specify AddHandler cgi-script pl cgi in a .htaccess in the folder where your scripts are or in the main configuration for that folder, which might look something like this:

Frankfurt: Willy-Brand-Platz

Mon, 06 Oct 2014 01:57:29 +0200

“little planet”-image of the european central bank in Frankfurt, Germany.

It is unfortunate, that I had to take the photo free handed, because I had no tripod with me. But the result is still decent, I think.

Frankfurt

Mon, 06 Oct 2014 01:56:15 +0200

Backups: An introduction

Mon, 22 Sep 2014 03:17:12 +0200

online data redundancy #

Drives fail more often, than one would expect. Google has done a representative statistic concerning normal hard disk drives. In the FAQ of LUKS I learned, that even SSD's ain't guaranteed to last much longer. Therefore it seems wise to have the data saved twice or more in a production environment, where three drives seem to be the sweet spot in this manner. Even then your data is not safe! The next thunderstorm will come and terrible things are likely to happen if a lightning directly hits a power cable in your street. Lightning safe plugbars or uninterrupted power supply devices cannot avoid damage in all cases and professional grade over voltage protection must also include the whole building gets really expensive. It is very likely to be more economical to turn your devices off and pause your work while being close to the thunderstorm. But there is more: Even a storm on the sun can flip some bits on your hard disk or in your random access memory.

Justitia

Thu, 18 Sep 2014 14:40:51 +0200

Eine 212 Kilobyte große Gif-Datei als eye catcher für blog.malzeiten.de. Fotografiert mit Canon EOS 650D

justitia

Thu, 18 Sep 2014 14:40:11 +0200

know your caches

Wed, 10 Sep 2014 11:24:17 +0200

It is somehow alerting how much information can be found in a cache folder. I will try to create a list of all caches I could find. This document stays work in progress, of cause.

But consider how important this is. The caches may contain personal data, such as:

email addresses from your mail program
telephone numbers if you synchronize contacts with your mobile phone
photos either from your phone, skype, facebook and where ever they were shown
which music you have on your computer, because media players automatically download cover arts and store them on your disk (also the download could be tracked, of cause)
passwords, because some applications even cache passwords :/
all your personal photos and every movie you have got on your disk, because many image viewers and filemanagers will create thumbnails for them.
visited websites can be found in your browser caches.

Browser Caches #

$HOME/.cache/chromium/
$HOME/.cache/mozilla/
$HOME/.cache/midori/

steckdosenleiste2

Mon, 08 Sep 2014 01:05:10 +0200

Schuko plug and socket

Mon, 08 Sep 2014 00:58:46 +0200

Blendermodell einer Steckdosenleiste, gerendert mit cycles. Versionen mit und ohne Schalter/ Kann man ja immer mal gebrauchen sowas... ;)

TraumWecker

Sun, 07 Sep 2014 05:10:05 +0200

TraumWecker

Sun, 07 Sep 2014 04:57:56 +0200

TraumWecker

Sun, 07 Sep 2014 04:54:22 +0200

TraumWecker

Sun, 07 Sep 2014 04:48:37 +0200

microcontroller_programming

Sun, 07 Sep 2014 04:37:12 +0200

LCDd extension: maxilcd

Thu, 04 Sep 2014 12:39:41 +0200

My LCDd extensions is a simple bash script and it integrates well with lcdproc. Nevertheless it displays things I missed in lcdproc:

ip-address
hostname
hard disk(s) temperatures
CPU utilization
CPU temperature (alias physical id 0)

Prerequirements #

Make sure, that LCDd is running. Your tools:
```
vim /etc/lcdd.conf
systemctl start lcdd
systemctl status lcdd
systemctl enable lcdd
```
If you see a permission denied error, then a restart helps for an unknown reason.

disk encryption

Fri, 29 Aug 2014 05:57:45 +0200

Ratio: Why? #

Encryption comes at a price: You will have to spend time on it, because you have to decide how to do it and you will permanently use computing resources when using it. But what seems to be unattractive can pay out in situations, when your drive can be accessed by any foreigners, which might include:

a person who has stolen it from you
if your drive has failed and you returned it for guarantee the manufacturer will not repair exactly your drive, but will in most cases collect them and send you an already repaired drive back, which someone else had sent in before

Choosing an encryption algorithm #

This really is a problem, because you never know which algorithm will be proven to be insecure tomorrow. Sadly the cryptsetup command expects a not well documented format for its --cipher parameter. The man page just says that it defaults to aes-xts-plain64 when using LUKS. I found two methods to find out which encryptions are supported by your kernel. First and recommend is the usage of

sendmail

Sat, 23 Aug 2014 07:31:21 +0200

This is the standard MTA under FreeBSD and its package name is mini_sendmail. New setups and jails come with sendmail pre installed. It might not be interesting to use sendmail as a public mail transport agent, but if you want to avoid to configure another client every time these configurations might come handy. The main configuration path is /etc/mail/ The easiest way to configure sendmail under FreeBSD is by using the Makefile, which can be found under /etc/mail/. After having created a new jail it can be used by changing to that folder and executing make (without arguments). This first step will create files called $HOSTNAME.mc and $HOSTNAME.submit.mc out of the freebsd.mc and freebsd.submit.mc, where it is discouraged to edit the latter, because they may get replaced with the next update. So it is advisable to edit the $HOSTNAME*-files instead. To make sendmail redirect mails to another jail one needs this configuration:

zfs

Mon, 18 Aug 2014 01:07:18 +0200

basics #

The two major programs you must learn to use are called zfs and zpool. Both of them are as important to know as mkfs.ext3 and e2fsck when using an ext file system. The syntax sometimes looks a bit inconsistent, because some commands given to these programs expect the name of a zpool, some of a dataset and some need both separated with a slash. [DO NOT COPY AND PASTE, BUT UNDERSTRAND AND TRY ONE BY ONE!]{style=“display: block; background-color: red; text-align: center; color: white; font-weight: bold;”}

wpid-wp-1407441366809.jpg

Thu, 07 Aug 2014 21:56:42 +0200

Hackerspace Bielefeld in 3D

Thu, 07 Aug 2014 21:48:21 +0200

Gerade bin ich dabei ein 3D-Modell von diesem etwas schrägen Gebäude herzustellen. Vielleicht demnächst als Level für einen Egoshooter oder zum Planen der Inneneinrichtung. Jedenfalls sieht es schonmal ganz cool aus und schmückt das Wiki vom HSB.

grundriss23-lineart

Thu, 07 Aug 2014 21:45:14 +0200

grundriss24

Thu, 07 Aug 2014 21:44:59 +0200

shell's keyboard mapping

Mon, 07 Jul 2014 20:54:52 +0200

This is about assigning keys right, especially the well known [CTRL]+[left arrow] to move the cursor back one word. Looking for this I spent lots of time reading this outstanding page and others. But none of them kept these information as short as possible and that is what I am going to try here. Notice that this is not shell independent, so that we need to individually setup this. First off to find a keys corresponding keycode (which you need for any config) there are several possibilities:

netboot

Thu, 01 May 2014 04:38:04 +0200

Setting up a netboot server is surprisingly easy, but I could not find comprehensive guides. What you really need:

DHCP Server, from which your client receives an IP-Address and the Address to a tftp server
TFTP Server, where a bootloader and one or more images are located

TFTP Server #

First install a tftp server package with support for xinet (usually included in plain xinet)

xinetd is a daemon, which listens on specified ports and pipes the traffic to a program one can specify in config. In this case we want a tftp config file, where you can also specify a root path for your tftp server:

Keyboard layouts, variants and options

Tue, 29 Apr 2014 12:10:40 +0200

General #

The easiest way to control the keyboard layout is localectl, because that is the one-tool-for-all-solution.

localectl list-keymaps
localectl set-x11-keymap de_DE
localectl --help

However if you haven't that installed or available on your OS, you can probably find the available keyboard layouts in the manual:

man xkeyboard-config

X-Server #

available layouts, variants and models can be found with

setxkbmap de               ;# short form
setxkbmap -variant intl us ;# with intl variant (more keys with right alt)
setxkbmap -layout de,us    ;# long form with two layouts

Variants #

grep -E ^xkb_symbols < /usr/share/X11/xkb/symbols/us
setxkbmap us -variant intl
setxkbmap us -variant colemak
grep -E ^xkb_symbols < /usr/share/X11/xkb/symbols/de
setxkbmap de -variant neo

Options #

reset keyboard options (like caps:none or caps:swapescape)

Solder fume extractor version 2.0

Mon, 17 Mar 2014 20:29:58 +0100

A 3D printer can sometimes be a substitute for a milling machine. That is now the second version, the first you see in the background.

Material #

Aktivkohlefilter (130x130mm)
120mm Gehäuselüfter -
Netzteil (12V)
Gehäuse aus PLA

lötdampf2

Mon, 17 Mar 2014 20:29:20 +0100

lötdampf1

Mon, 17 Mar 2014 20:29:18 +0100

IMG_1339-mediaplayer-prototype

Thu, 13 Mar 2014 13:00:18 +0100

IMG_1340-mediaplayer-trash

Thu, 13 Mar 2014 13:00:02 +0100

Progress: 3D printer

Thu, 13 Mar 2014 12:45:31 +0100

Success! My do it youself 3D printer prints for the first time:

IMG_1338-first-prints

Thu, 13 Mar 2014 12:44:56 +0100

IMG_1332

Sat, 01 Mar 2014 23:57:55 +0100

IMG_1327_small

Thu, 06 Feb 2014 14:10:37 +0100

IMG_1327

Thu, 06 Feb 2014 14:09:53 +0100

IMG_1327

Thu, 06 Feb 2014 14:09:32 +0100

result-cpu19

Tue, 28 Jan 2014 08:42:16 +0100

result-cpu02

Fri, 24 Jan 2014 13:30:12 +0100

result-cpu01

Fri, 24 Jan 2014 12:29:29 +0100

result-gpu01-mode

Fri, 24 Jan 2014 09:55:01 +0100

3D model of me (not scanned)

Fri, 24 Jan 2014 09:47:51 +0100

result-gpu01

Fri, 24 Jan 2014 09:47:27 +0100

output3

Thu, 23 Jan 2014 15:09:49 +0100

output3

Thu, 23 Jan 2014 15:06:15 +0100

raspberry pi model

Thu, 23 Jan 2014 14:46:50 +0100

A game with geometry and solid surface modelling

output3

Thu, 23 Jan 2014 14:45:56 +0100

output2

Thu, 23 Jan 2014 14:45:17 +0100

cloud

Wed, 22 Jan 2014 11:02:27 +0100

davdroid

Wed, 22 Jan 2014 10:57:32 +0100

screen02

Wed, 22 Jan 2014 10:57:30 +0100

screen01

Wed, 22 Jan 2014 10:57:28 +0100

vcf file normalization by email

Fri, 17 Jan 2014 01:27:34 +0100

This little perl file is to convert unique UIDs of VCards into mail=... which is where the claws mail program finds duplicates.

#!/usr/bin/perl

open(FILE, '2014-01-17.vcf');
my $content = join('', <FILE>);
close(FILE);

sub found()
{
        my $vcard = $1;
        if($vcard =~ /^EMAIL.*:(.+)rn/m)
        {
                my $mail = $1;
                $vcard =~ s/UID:.*/UID:mail=$mail\,ou=people\,dc=typesafe\,dc=de/g;
        }
        print qq[$vcardrnrn];

}
$content =~ s/(BEGIN:VCARD.*?END:VCARD)/found/gmes;

avr isp mkii

Wed, 01 Jan 2014 06:56:19 +0100

Set up under linux #

If you find that your programmer is only usable by the root user, that is probably a permission issue. udev can set the correct permissions once configured:

// /etc/udev/rules.d/avr-isp-mkii.rules
SUBSYSTEM=="usb", SYSFS{idVendor}=="03eb", SYSFS{idProduct}=="2104", GROUP="users", MODE="0660"

, where 03eb and 2104 can be aquired using lsusb and one needs a user group to which users typically belong. Many linux systems have such a group simply named users, but you can choose anything else, as long as you are member of that group.

myself-sculpt06-blender2.69-04e

Thu, 07 Nov 2013 03:09:19 +0100

license-windows8

Sun, 20 Oct 2013 12:03:59 +0200

prusa_mendel

Sun, 20 Oct 2013 11:51:38 +0200

Screenshot - 10202013 - 09:22:32 AM

Sun, 20 Oct 2013 09:24:04 +0200

Screenshot - 10202013 - 09:20:16 AM

Sun, 20 Oct 2013 09:23:39 +0200

myself-sculpt06-gimp

Sun, 20 Oct 2013 09:15:37 +0200

myself-sculpt07-02-gimp

Sun, 20 Oct 2013 09:10:04 +0200

Windows 8 license allows surveillance

Wed, 02 Oct 2013 11:56:15 +0200

An important but yet often unnoticed paragraph in the Microsoft license of Windows 8: It is necessary to grant Microsoft access to personal data in order to install it. Some of these ‘features’ can be deactivated later on, but that does not make it any better for me.

slow-keys

Fri, 29 Mar 2013 10:53:42 +0100

OpenBox

Tue, 26 Mar 2013 20:11:16 +0100

OpenBox has no own panel. That is why it is often used together with lxpanel, but of cause any panel would do.

Keyboard shortcuts to maximize windows #

To maximize windows with Super+X horizontally and Super+C vertically this configuration can be used:

<!-- ~/.config/openbox/rc.conf" -->

<keybind key="W-X">
  <action name="ToggleMaximize">
    <direction>horizontal</direction>
  </action>
</keybind>
<keybind key="W-C">
  <action name="ToggleMaximize">
    <direction>vertical</direction>
  </action>
</keybind>

Also see #

http://openbox.org/wiki/Help:Bindings http://openbox.org/wiki/Help:Actions

arrow1-32x32

Thu, 21 Mar 2013 15:14:36 +0100

arrow1-64x64

Thu, 21 Mar 2013 15:14:35 +0100

easy_click im settings-editor von xfce4

Sat, 16 Mar 2013 12:09:45 +0100

blender

Thu, 14 Mar 2013 07:16:46 +0100

Displaysteuerung

Wed, 13 Mar 2013 21:13:15 +0100

nordpark-wordpress.png

Tue, 12 Mar 2013 19:53:20 +0100

xorg x11: slow/sticky keys deaktivieren

Mon, 25 Feb 2013 15:20:22 +0100

Something, that some window manager already could do was now implemented into the X-Server: Hold a key for more than 15 seconds to activate a key hold, so that every further key must also be pressed for 15 seconds. That behaviour is called sticky keys and it is annoying, especially when working with image manipulation programs (in which long key presses use to have a special meaning).

It is not possible to deactivate this problematic feature in the default configuration file xorg.conf yet, but there is xkbset to the rescue:

AVM FritzBox specific

Mon, 28 Jan 2013 20:21:56 +0100

What is my IPv4 address? #

# get_ipaddress.py
from SOAPpy import SOAPProxy
print SOAPProxy(proxy='http://192.168.178.1:49000/upnp/control/WANCommonIFC1',
                namespace='urn:schemas-upnp-org:service:WANIPConnection:1',
                soapaction='urn:schemas-upnp-org:service:WANIPConnection:1#GetExternalIPAddress',
                noroot=True).GetExternalIPAddress()

Older methods #

wget -qO- "http://192.168.178.1:49000/igdupnp/control/WANIPConn1" --header \
"Content-Type: text/xml" --header \
"SoapAction:urn:schemas-upnp-org:service:WANIPConnection:1#GetExternalIPAddress" \
--post-data="" | xmllint --xpath 'string(//NewExternalIPAddress)' -

What is my IPv6 address? #

wget -qO- "http://192.168.178.1:49000/igdupnp/control/WANIPConn1" --header \
"Content-Type: text/xml" --header \
"SoapAction:urn:schemas-upnp-org:service:WANIPConnection:1#X_AVM_DE_GetExternalIPv6Address" \
--post-data="" | xmllint --xpath 'string(//NewExternalIPv6Address)' -

Force a reconnection #

curl "http://fritz.box:49000/upnp/control/WANIPConn1" -H 'Content-Type: \
text/xml; charset="utf-8"' -H 'SoapAction: \
urn:schemas-upnp-org:service:WANIPConnection:1#ForceTermination' -d '     '

bash-script: Prompt without

Sat, 11 Aug 2012 20:17:33 +0200

To create a menu with bash, which reacts after a keypress and not only after <Return> is possible, but poorly documented. What used to be choice under DOS can be written in a bash script like so:

#!/bin/bash
# flush reads characters as long as characters are available
function flush()
{
  while [[ true ]]; do
    read -t0
    case $? in
      0) read -n1 ;;
      *) break    ;;
    esac;
  done;
}

while [ not $CHOICE ]; do
  flush
  read -n1 -s -p"[1,2,(3)] " CHOICE
  case $CHOICE in
    1) echo "selection 1"; break ;;
    2) echo "selection 2"; break ;;
    'q') break ;;
    *) unset CHOICE ;;
  esac
  echo
done

Zeile 3 Empties the input buffer: All previous keypresses are flushed.

Video: Bouldern im Speicher1

Sun, 06 May 2012 13:54:52 +0100

Blender

blender model of my room

Sun, 25 Mar 2012 01:13:27 +0100

My first blender model in scale

edged a pcb

Fri, 10 Dec 2010 03:40:45 +0100

I edged my first pcb for the alarm clock of my dreams :)

prototype: alarm clock

Tue, 16 Nov 2010 03:24:41 +0100

This is my first working prototype. It:

plays mp3 music from sd memory card,
shows status messages on an spi interfaced display,
communicates via rs-232,
receives and decodes the dcf-77 signal to drive a precise clock

rs-232

Tue, 21 Sep 2010 10:26:06 +0200

I got the RS-232 connection working. Nothing special, but from that helps a lot when debugging

HD44780 8bit init

Thu, 13 May 2010 18:09:20 +0200

I had success interfacing the HD44780 display

DEM-16217

Thu, 13 May 2010 18:09:19 +0200

I am using the 8 bit mode of an Atmel ATtiny2313 to drive the display, because the 8 bit mode seemed to be the simpelst.

I am not exactly proud of the following code, but it used to work and it is very close to the instructions from the data sheet:

#include <avr/io.h>
#include <util/delay_basic.h>
 
typedef enum
{
  FUNCTION_SET    = 0b00111000,
  DISPLAY_CONTROL = 0b00001111,
  DISPLAY_CLEAR   = 0b00000001,
  DISPLAY_HOME    = 0b00000010,
  ENTRY_MODE_SET  = 0b00000110
} INSTRUCTIONS;
 
void execute()
{
  PORTD |= 0b01000000;
  _delay_loop_2(1024);
  PORTD &= 0b10111111;
}
 
int main()
{
  DDRB = 0xFF;
  DDRD = 0xFF;
 
  PORTB = FUNCTION_SET;
  execute();
  PORTB = DISPLAY_CONTROL;
  execute();
  PORTB = DISPLAY_CLEAR;
  execute();
  PORTB = ENTRY_MODE_SET;
  execute();
 
  char* c = "Max ";
  while(1)
  {
    int i;
    for(i=0; c[i]!='\0'; i++)
    {
      PORTB = c[i];
      execute();
    }
    _delay_loop_2(32768);
  }
  return 0;
}

uC programming

Mon, 26 Apr 2010 23:26:01 +0200

Worth an entry: The first day I have ever programmed a µ-controller myself. My aim was to build a digital alarm clock and this led me directly into the world of digital electronics.

qemu-kvm und libvirt

Sun, 21 Mar 2010 20:32:48 +0100

libvirt #

Running anything as root always has security implications and so has libvirt. Therefor make sure you have your user set in /etc/libvirt/qemu.conf:

# /etc/libvirt/qemu.conf
...
user  = "max"
group = "kvm"
...

which implies, that your virtual machines are accessable by the defined user and group as well. They usually live under /var/lib/libvirt/images when using libvirtd, where you can mount anything.

manually call qemu with kvm #

You can use this script to start virtual machines manually and with many features enabled.

The biggest maze in the world

Tue, 23 May 1989 14:26:01 +0200

Drawn in my early school days. If your child does something like that, I suggest you support it becoming an electronic engineer or a programmer, like me.

Mon, 01 Jan 0001 00:00:00 +0000

Find names of WLAN adapters #

sysctl -n net.wlan.devices

Mon, 01 Jan 0001 00:00:00 +0000

command cheat sheet #

cal / ncal #

Mon, 01 Jan 0001 00:00:00 +0000

create a jail skel #

find  /usr/jails/_basejail14.0/ -mindepth 1 -maxdepth 1 | sed -e 's/.*\///' | xargs -IQ ln -s basejail/Q
rm    var proc dev mnt media net root sys tmp usr etc
mkdir var proc dev mnt media net root sys tmp usr
cp -Rav /usr/jails/_basejail14.0/etc .
find  /usr/jails/_basejail14.0/usr/ -mindepth 1 -maxdepth 1 | sed -e 's/.*\///' | xargs -IQ ln -s ../basejail/usr/Q usr/
rm    usr/local
mkdir usr/local

zfs create            zroot/jails/templates/template01
bsdinstall jail       /usr/local/jails/templates/template01

mkdir                 /usr/local/jails/templates/template01/basejail
mount -t nullfs -o ro /usr/local/jails/basejails/bsdinstall_jail \
                      /usr/local/jails/templates/template01/basejail


# delete and recreate /usr
rm -rf  /usr/local/jails/templates/template01/usr
mkdir   /usr/local/jails/templates/template01/usr

# link stuff from basejail into usr
ln -s ../basejail/usr/* .

# create exceptions, local to the jail for which the template is
rm     local obj tests
mkdir  local obj tests


cd /usr/local/jails/templates/template01

chflags -R noschg  sbin           rescue           libexec           lib           boot                        bin
rm -rf             sbin           rescue           libexec           lib           boot                        bin
ln -sf             basejail/sbin  basejail/rescue  basejail/libexec  basejail/lib  basejail/boot basejail/bin  .

force a shutdown #

jail -r

Mon, 01 Jan 0001 00:00:00 +0000

Implementations #

The most popular implementations of netcat are:

nmap implements ncat
GNU netcat
OpenBSD netcat is simply called nc

While all serve the same purpose, they differ in feature richness.

netcat #

Has a feature, that allows it to be used to execute a command with post data from STDIN. That makes netcat a good standalone server and more versatile than nc.

nc #

port scan with nc #

nc -z host.example.com 20-30

Mon, 01 Jan 0001 00:00:00 +0000

Systemd #

Encryption #

make devices from /etc/crypttab available #

systemctl daemon-reload
systemctl start systemd-cryptsetup@zfspool.service

Mon, 01 Jan 0001 00:00:00 +0000

Desktop streaming (e.g. via bbb or jitsi) #

pulseaudio did not work for me and had to be replaced with pipewire, because it brings these systemd user services to enable desktop streaming:

  pipewire-media-session.service
  pipewire-pulse.service
  pipewire.service

Graphical Java applications #

Do not start and say: `Error Can't connect to X11 window server using 'wayland-1'` #

Run it under Xwayland, e.g. with env DISPLAY=:0 java program.java

Mon, 01 Jan 0001 00:00:00 +0000

Delock-5114 #

What makes a good gadget? Its customizable and this device is. Thanks Delock.

The manual has these URLs to control the device, but it offers other options as well.

curl http://delock-5114.fritz.box/?cmnd=Power%20TOGGLE  # toggle on/off 
curl http://delock-5114.fritz.box/?cmnd=Power%20On      # toggle on/off 
curl http://delock-5114.fritz.box/?cmnd=Power%20off     # toggle on/off

and all these can be combined with username and password

curl http://delock-5114.fritz.box/?user=admin&password=<password>&cmnd=Power%20off

Mon, 01 Jan 0001 00:00:00 +0000

longan nano #

The examples for this Microcontroller do not work any more (framework hell as always) and you get an error message:

HTTPClientError: You do not have permission for this request

Download dependencies elsewhere #

Download everything with gd32.*linux in its name from sourceforge and place it in a new subfolder packages/ of a sample platformio-project, recognizable by a platformio.ini in its root.

Extract and rename files #

Extract the (four) packages and remove from their names everything including and after -linux.

Mon, 01 Jan 0001 00:00:00 +0000

First Upgrade #

Default username and password:

username: ubnt
password: ubnt

The Android app Unifi Network searches for devices on port 8443, but the port was not open:

U6-Lite-BZ.5.43.14# netstat -ln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:8873          0.0.0.0:*               LISTEN
tcp        0      0 :::22                   :::*                    LISTEN
udp        0      0 0.0.0.0:41171           0.0.0.0:*
udp        0      0 0.0.0.0:10001           0.0.0.0:*
udp        0      0 0.0.0.0:38933           0.0.0.0:*
udp        0      0 :::47289                :::*
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING       1556 /var/run/lldpd.socket
unix  2      [ ACC ]     STREAM     LISTENING       1064 /var/run/ubus.sock
unix  2      [ ACC ]     STREAM     LISTENING       4445 /tmp//mtk_bt_service

U6-Lite-BZ.5.43.14# upgrade https://dl.ui.com/unifi/firmware/UAL6/5.43.23.12533/BZ.mt7621_5.43.23+12533.201222.2019.bin
Downloading firmware from 'https://dl.ui.com/unifi/firmware/UAL6/5.43.23.12533/BZ.mt7621_5.43.23+12533.201222.2019.bin'.

Scheduling firmware upgrade...
Inform or provisioning in progress. Upgrade will start soon.
Waiting for upgrade to start...
Waiting for upgrade to start...
[...]
Waiting for upgrade to start...
Connection to 192.168.178.30 closed by remote host.
Connection to 192.168.178.30 closed.

Mon, 01 Jan 0001 00:00:00 +0000

Yubikey #

Unlock the PIN (defaults to 123456) with the PUK: Personal Unlock Key (defaults to 12345678):

# entered the wrong pin three times? Try

ykman piv      access unblock-pin
ykman opengpg  access unblock-pin

# ...you get the idea. Check the result with:

ykman openpgp info

Or start fresh over

# delete opengpg from yubikey and reset pin/puk counters
ykman openpgp reset

# KEYID is going to be the main key id (not the keyid of subkeys). The
# following command may require a password.
gpg --export-secret-keys --armor  KEYID > /tmp/file_backup.txt

# sanity check what has been exported
gpg --show-keys  /tmp/file_backup.txt


# 2. Transfer the key to the yubikey (move not copy, because copy impossible)
# edit the key in expert mode so you can skip entering `admin`
gpg --expert --edit-key  KEYID

Mon, 01 Jan 0001 00:00:00 +0000

Which java-version is installed? #

There is java -version, an undocumented java --full-version in openjdk and the format of the output differs between implementations. An stable way to find the version is:

	echo 'System.out.println(System.getProperty("java.version"))' | jshell  - 2>/dev/null

Mon, 01 Jan 0001 00:00:00 +0000

Veracrypt is currently the only encryption software I am aware of, which runs under Windows, Linux and BSD. That makes it a good choice for external storage devices. Web: veracrypt

A really cool feature veracrypt offers is nested encryption.

First steps #

Veracrypt comes with a GUI interface, which is not beginner friendly, but does its job. I will however concentrate on the command line interface, which is better called with -t as first parameter, because even veracrypt -t --help would otherwise show its help in a window.

Mon, 01 Jan 0001 00:00:00 +0000

There are two versions of netcat available, usually called ncat and nc. Which one is the default is distribution specific.

Port scanning with nc #

nc -z host.example.com 20-30

Mon, 01 Jan 0001 00:00:00 +0000

Onlinereferenzen

Referenzen

	2016 www.salzerfilm.de python/django
	2016 www.dock33-filmproduktion.de php/wordpress
	2015 www.nullzwomusik.de php/wordpress
	2014 www.halbtotal.de php/IceBreaker-OOS
	2012 www.balke-sgc.de html/ssi
	2010 www.salzerfilm.de php/IceBreaker-OOS
	2009 www.shah-photographies.de perl/CGI
	2008 wwwhomes.uni-bielefeld.de/mpohle2 Übersicht der aktuellen Projekte von mir aus der Uni
	2008 www.salzermusik.de Neuaufbau der Webseite von Salzer Perl/IceBreaker-OOS
	2008 www.kontaktderfilm.de html/ssi
	2007 www.asta-carsharing.de Autovermietung �ber den AStA Uni Bielefeld in Kooperation mit cambio
	2007 www.halbtotal.de Fotografie und Film von Marcus Wildelau php/IceBreaker-OOS
	2007 www.waranema.com Waranema, eine Bielefelder Band
	2006 www.ayurveda-zentrum-lemgo.de Ayurveda Zentrum Lemgo perl/IceBreaker-OOS 0x
	2006 www.asta-bielefeld.de Allgemeiner Studierendenausschuss der Universit�t Bielefeld perl/IceBreaker-OOS 0x
Webseite Vlothoer Malschule">	2003 www.Malzeiten.de Homepage der Vlothoer Malschule perl/CoderOnline CMS
	2006 www.eye-coaching.de HTML/SSI
Webseite CamAlert">	2004 CamAlert Raum�berwachungsprogramm, das mit Webcams funktioniert (wurde u.A. bei PC-Welt, Sat1, Heise-Online, ZDNet und GMX ins Downloadregister aufgenommen)
Webseite Abiturjahrgang 2003 am WGV">	2001 AbianaBeach Abitursseite meines Abiturjahrgangs (innerhalb von einem Jahr �ber 50000 Besucher)
Webseite Lesido - Der Lesezirkus">	2005 Lesido - Der Lesezirkus Inhalte von Sabrina H. und Katharina R.
Webseite Vocabulary Training Center">	2000 Vocabulary Training Center Vokabeltrainer mit eigenwilliger Oberfl�che und Funktionen (Mein erstes Sharewareprogramm, inzwischen kostenlos zu haben)
Webseite Perl Shopping System (Demo)">	2005 Perl Shopping System Demonstrationsseite meines Internetshoppingsystems (Interessenten gesucht, vollst�ndig individuelle Anpassung m�glich)
Webseite Facharbeit in Mathematik">	2003 Facharbeit in Mathematik mit Thema: Der Spearmansche Rangkorrelationskoeffizient
Webseite Tippgeschwindigkeit">	2004 Tippgeschwindigkeit Online k�nnen Sie sich mit anderen messen

Au�erdem von mir im Netz...

	Meine Codes bei Planet-Source-Code.com
	2006 Eine R�uber-Beute-Simulation in Java die als Applet l�uft
	2008 Eine in der Simulationssoftware Breve geschriebene Agentensimulation

CamAlert

Mon, 01 Jan 0001 00:00:00 +0000

Similar to a motion detector CamAlert reacts on changes in the webcam picture. It can be used for simple surveillance tasks, but was originally written to capture pictures for animated GIFs. Back in the day there was hardly any program around to make use of a Webcam. That motivated me to write my own.

The program is in german and it has no english translation.

CamAlert was developed in 1999 and maintained until 2004. In that time frame I counted over one million downloads. Even today I sometimes receive feedback from its users.

dig

Mon, 01 Jan 0001 00:00:00 +0000

The dig tool, often found in a package bind-utils is a very versatile tool when it comes to DNS server and recursor debugging.

Expire times from a SOA record #

Let us start with

$ dig @8.8.8.8 soa  +multiline coderonline.de

; <<>> DiG 9.16.13 <<>> @8.8.8.8 soa +multiline coderonline.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26205
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;coderonline.de.		IN SOA

;; ANSWER SECTION:
coderonline.de.		3599 IN	SOA coderonline.de. webmaster.coderonline.de. (
				2020090108 ; serial
				3600       ; refresh (1 hour)
				1800       ; retry (30 minutes)
				3600000    ; expire (5 weeks 6 days 16 hours)
				3600       ; minimum (1 hour)
				)

;; Query time: 47 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Mar 31 22:38:06 CEST 2021
;; MSG SIZE  rcvd: 89

Notes #

The serial number (2020090108 in this example) is important to let other name servers know, that something has changed in the zone when it changed. The ‘resolvers to be notified’ use that value either when getting notified or occasionally on their own.

Impressum

Mon, 01 Jan 0001 00:00:00 +0000

Responsible for content of this site

Max Christian Pohle
Erich-Zeigner-Allee 41
04229 Leipzig

webmaster@coderonline.de

Matrix

Mon, 01 Jan 0001 00:00:00 +0000

synapse #

‘reference’ implementation in python
Can be slow at times.
Creates a huge on disk cache for images.
has a very long configuration file.
requires to have a valid TLS certificate in the config

dendrite #

does not always provide meaningful error messages, e.g. when files are inaccessible due to permission issues.
does not yet have a lot of documentation
seems to maintain its cache status in the database. Clearing the cache in the file system is not enough.

conduit #

works really good.
adds a lightning to user names by default (can be deactivated in the config)

conduwuit #

fork of conduit
works as drop in replacement
not yet available as binary package on FreeBSD :(
development seems to move faster.

OpenLDAP

Mon, 01 Jan 0001 00:00:00 +0000

mkdir /usr/local/etc/openldap/slapd.d/ cp -v /usr/local/etc/openldap/slapd.ldif.sample /usr/local/etc/openldap/slapd.d/slapd.ldif

now edit the file slapd.ldif and at least change: #

12,13c12,13
< olcArgsFile: /var/db/run/slapd.args
< olcPidFile: /var/db/run/slapd.pid
---
> olcArgsFile: /var/run/openldap/slapd.args
> olcPidFile: /var/run/openldap/slapd.pid

because that is where FreeBSD expects openldap to put these files.

WIP #

This does not work yet

# create the configuration database out of the ldif file:
slapadd -n0 -F /usr/local/etc/openldap/slapd.d/ -l /usr/local/etc/openldap/slapd.d/slapd.ldif
# start slapd with debug option to see error messages (CTRL-c if it works)
/usr/local/libexec/slapd -d1 -F /usr/local/etc/openldap/slapd.d/

# /etc/rc.conf.local
slapd_enable="YES"
# the following line makes slapd use slapd.d folder instead of slapd.conf
slapd_cn_config="YES"

This worked #

Edit /usr/local/etc/slapd.conf, add further schema and enable the correct backend:

rclone

Mon, 01 Jan 0001 00:00:00 +0000

With rclone file systems can be copied from [local]host to [local]host. In a way it is comparable to rsync, but it works multi-threaded.

rclone is available for Windows, Linux and FreeBSD and has modes to copy or copy and delete, called sync. It used to require a configuration file .config/rclone/rclone.conf, but can nowadays also work with command line arguments alone. That however has made the command line interface a little bit unintuitive to rsync users.

Unifi controller

Mon, 01 Jan 0001 00:00:00 +0000

Important files #

/var/db/mongodb/mongod.log
/usr/local/share/java/unifi/data/system.properties
/usr/local/etc/mongodb.conf
/usr/local/share/java/unifi/logs/server.log

Update mongodb36 to mongodb44 #

You will notice that this is necessary when you get this error message in /var/db/mongodb/mongod.log:

"ctx":"initandlisten","msg":"Failed to start up WiredTiger under any
compatibility version. This may be due to an unsupported upgrade or
downgrade."}

If running in a jail add allow.mlock to the jail.conf, because it is required since mongodb42 and otherwise will log in /var/db/mongodb/mongod.log: