bash.vi's IT experiences

#Chaos

Fri, 17 May 2013 12:11:30 +0200

#Chaos

Hey I'm currently working on improving apache wave's documentation and just wanted to check if we could form your post on admin tips into a wiki page? Thanks

Mon, 15 Apr 2013 12:02:58 +0200

Definitely! I’d be glad if you did so.

Some Apache Wave administration tips

Sun, 27 Jan 2013 22:52:00 +0100

Change your password

(according to this: http://www.mail-archive.com/wave-dev@incubator.apache.org/msg02088.html )

add the bot “passwd-bot” to a new wave.
Type passwd -help <Enter> to get help
Type passwd <old password> <new password> <Enter> to change password

Configure the admin account

By default, no admin account is set. You can define the admin account by changing the

<property name=”admin_user” value=”@${wave_server_domain}” />

variable in the server-config.xml file and regenerating the config with

ant -f server-config.xml

All you have to do is put the name of the account that should have administration privileges in front of the @ sign.

I strongly recommend first creating the account, then stopping wave and setting the variable to make sure that no one grabs the name before you can.

Change other users password

The admin account can change the password of other users. The process is very similar to changing one’s own password.

login with the admin account
create a new wave
add passwdadmin-bot to the wave
type passwdadmin -help to get help
type passwdadmin username new_password to change a users password

Delete a user

It might happen that a user asks you to delete their account. Or that you would like to delete a user for some reason. This can be done relatively easy:

ssh into your wave server
stop wave (Not sure if that’s really necessary, but it’s definitely saver to do so)
change into the wave installation directory
to into the _accounts directory
ls will list you the files, each representing a user. Conveniently they’re named <username>@<yourdomain>.account
rm the file according to the user you want to delete
restart wave

TODO: delete the users waves
TODO: remove the user from waves he participated in

Delete these strange, empty waves

When using wave it can happen that strange empty waves will appear in the bottom of your inbox. Attempting to open them will always result in an error.
There is a somewhat ugly and unsave way of deleting them.

ssh into your wave server
stop wave (Not sure if that’s really necessary, but it’s definitely saver to do so)
change into the wave installation directory
go into the _deltas directory
ls will show a number of subdirectories with alphanumeric names. Each one of these represents a wave.
du -h * will show the size of each of these directories
The very smalest ones (usually about 20K) are most likely to be empty waves
back them up with tar cvf ../backup.tar directory1 directory2
restart the wave server

If you ended up deleting the wrong waves, restore them from the backup tar file generated in step 8. If the waves you still need are all still there, it should be save to delete the backup.

Again - this is dangerous. You might end up deleting the wrong waves. So be sure to make a backup first!

Export waves

Apache Wave comes with means to export all of a users waves and import them into another server or just store them for backup purposes.

You don’t have to do that on the server. It can be done from any client computer as well, so the users can export their waves themselves.

download and compile the Apache Wave source
There now is a file called run-export.sh. Make it executable (chmod +x run-export.sh)
Execute the script without any parameters to get help

The script takes a number of options. It also wants at least two arguments: The url of the server (including http:// or https://) and the directory to store the exported waves to. All options must follow after these arguments.

If you just run the script with these two arguments, it will show you a URL to paste into the browser. You will then be asked to allow or deny permission. If you allow it, you’ll see a long string. Paste this into the command line to let the script proceed. Now it will export all your waves, including their attachments.

You can limit the number of waves to be exported. One way of doing so is with the search parameter. It will take the same searches that work in the webgui too. (for example in:inbox).

Another way to filter the output would certainly be to use the include and exclude options. But I was unable to figure out what exactly is meant with waveid and how this needs to be formated

Add your CA to Java

http://www.mikepilat.com/blog/2011/05/adding-a-certificate-authority-to-the-java-runtime/

If your wave is running with SSL and you signed your ssl cert with your own CA, you should add that CA to Java’s trusted list of CAs. Otherwise the internal bots, such as the passwd bot, and scripts, such as the export script, might not work.

To do this you’ll need your CAs public cert. It can be in pem format.

Then type:

keytool -import -trustcacerts -file /path/to/cakey.pem -alias honet -keystore $JAVA_HOME/jre/lib/security/cacerts

You’ll be asked for a password. The default password is

changeit

Chane your Avatar

The Avatars used in wave are served from Gravatar.

https://wave-protocol.googlecode.com/hg-history/b33cce2dd3eca50e1167a28cb2031615fcb66ac3/src/org/waveprotocol/box/server/robots/operations/GravatarProfilesFetcher.java

Gravatar creates an image based on the hash of an email address. In case of wave <username>@<domain> is being hashed and sent to Gravatar for Avatar creation.

You can sign up to Gravatar and then change your image. This will instantly change your image on all sites that use Gravatar. After signing up with one Email Address, you can add more.

However: Gravatar will send a confirmation email to each of these addresses with a link to be klicked. This is why it’s not gonna work for your Wave account.

This can be solved by setting up an Email server to retrieve the confirmation email. It’s pretty easy too! On Debian (wheezy) just do:

apt-get install postfix

During the installation, you’ll be asked for some things. Tell it to run on the internet (and not just locally) It is VERY important that you tell it your waves domain name when asked for it.

Now your mail server is running and ready to receive emails already. But you’ll have to make sure it works for your wave account too. Easiest way for doing this is to just add a unix user with the same name as your wave account.

(THIS IS UGLY! DONT DO IT!)

useradd -m -d /home/<username> -s /bin/bash <username>

Now go to gravatar, klick on “My account” and then “Add an Email Address”. Type in <username>@<wavedomain>. The email will appear in /var/mail/<username>. You can look at it with a less, cat or a text editor.

For me, the confirmation string was a bit messed up. It should be

https://secure.gravatar.com/verify/add-identity/<some random string>/<username>@<wavedomain>

Go there to add that address to your Gravatar account.

A prettier way for receiving the email is to create a catch-all rule for postfix. Go Google that yourself though ;)

Make firefox shut up about plugins

Tue, 29 May 2012 21:06:33 +0200

I, for myself, decided to live without ANY plugins (not extensions!) in Firefox. For security reasons and because I believe in the free web.

Though every time I come to a website with plugin content, Firefox keeps asking me if I want to install that plugin - Of course I DON’T WANT TO!

So I went into Firefox’ about:config to find the option to disable that behavior. And here it is:

The option is called plugins.hide.infobar.for.missing.plugin. Just set the value to true and Firefox will stop asking :)

Importing contacts the hard way

Sun, 04 Mar 2012 00:04:50 +0100

Three days ago, I got my Nokia N9 and everything was fine.

One day later I flashed PR1.2 onto it. This broke Contact synchronization via Exchange. No matter what I tried, I couldn’t get it to work.

The synchronization not working is one thing, but not having the contacts on the phone at all is pretty bad, so I needed to find a way to bring them on there.
The N9 doesn’t support importing contacts from any files. The next best thing that came to my mind, were QrCodes.

Easy-peasy, just open up Google contacts, point the phone camera to the QrCodes of one contact after another and save it. But wait! Google Contacts doesn’t show any QrCodes. So I had to generate them myself. Of course I could upload the exported file with all contacts to a website and get back the Codes, but that’d mean that I’d transfer all my contact data to some strange website - not an option either.

The Linux program qrencode can convert contact data to a QrCode. That’s easy enough. Just use:

qrencode -o name.png “`cat name.vcf`”

Toying around, I found that Vcard was the only format supported by both Google Contacts export and the N9 Qr Code program.

So, the last problem I had, was that I’d have to download every contact’s vcard file. That’s a lot of work.

I ended up, exporting all the contacts at once and writing a Python program to separate the data into files for each contact:
(It’s uggly code, I’m not using Python that often…)

import vobject
from vobject import readComponents
import StringIO
import subprocess

file = open(‘contacts.vcf’)
io = StringIO.StringIO(file.read())
string = io.getvalue()

for vcard in readComponents(string):
print vcard.fn.value

filename = vcard.fn.value+”.vcf”
filename = filename.replace(” “, “.”)
filename = filename.lower()

out = open(filename, ‘w’)

v = str(vcard.serialize())
out.write(v)

out.close()

Afterwards, I used a (very small) Shellscript to generate the png files:

#!/bin/bash
for line in *.vcf;
do
qrencode -o $line.png “`cat $line`”
done

(You can use my code under the WTF Public License 2.0 http://sam.zoy.org/wtfpl/COPYING)

Bronies React to Teens React to My Little Pony: Friendship is...

Thu, 16 Feb 2012 21:21:06 +0100

Bronies React to Teens React to My Little Pony: Friendship is Magic. Nnnnnnice!

Spark tablet pre-order registration

Thu, 16 Feb 2012 21:15:50 +0100

Spark tablet pre-order registration:

I just registered for the pre-order of the Open Source driven spark tablet.

cron based alarm clock playing podcast on N900

Tue, 14 Feb 2012 15:35:50 +0100

To make getting up in the morning easier, I’d like my phone to play the latest episode of the InfoSec Daily Podcast that comes out while I’m sleeping.
That wouldd be totally doable with a proper cron daemon.
When I reset my N900 lately, I finally got around installing a cron daemon.

http://wiki.maemo.org/Fcron explains how to install Fcron on the Nokia N900, I just followed all their steps.

The first problem I had afterwards was, that I was unable to use fcrontab -e with the default user account. That sucks! I could not find a solution for this problem, but a workaround: As root user, just do

fcrontab -u user -e

Now you can edit the users crontab :)

To do the alarm clock with the podcast, I need two scripts: One downloading the newest episode and a second one playing it. I start the first one about 45min befor the second, as I can’t predict how long it will take to do the download.
I’m using the GPodder Podcast client on my N900 (that thing’s amazing!). Luckily, Gpodder offers a command line interface that can be called via the gpo command.
The download script looks a bit like this:

#/bin/bash

gpo update http://feeds.feedburner.com/InfosecDaily » download.log

gpo download http://feeds.feedburner.com/InfosecDaily » download.log

The second script was a bit trickier. The main problem is, that mplayer, for some reason, doesn’t work from within the cronjob. So I decided to use ffplay.
That didn’t fully solve the problem though. ffplay absolutely wants to spawn a window, even when started with the “-nodisp” option (that’s apparently a bug that’s solved in newer versions of ffplay).
This requires the SDL variable to be set, and that’s normally not the case from within the script.
The script looks like this:

#/bin/bash

cd /home/user/MyDocs/Podcasts/InfoSec\ Daily\ Podcast/

/bin/ls infosec-daily-podcast-episode-* > episodes.list

episode=$(sort -n episodes.list | tail -1)

echo $episode » /home/user/play.log

DISPLAY=:0.0 ; export DISPLAY

ffplay -nodisplay $episode » /home/user/play.log 2> /home/user/error.log

Both scripts are only started during week days, the second one at the time I want to get up.

There’s still a minor problem: When I run the second script manually as user, ffplay runs fine, using about 20% of the CPU, according to htop. But when started by the cronjob, ffplay uses 100% and still has minor lag.
I couldn’t figure out why this is or how to solve it yet :(

full privileges to 'root'@'%' in MySQL

Tue, 14 Feb 2012 15:16:34 +0100

I just had the problem that I was unable to do certain things when logged in as root to a remote MySQL Server. I was wondering a bit why this was, after all, I’m root.

The problem turned out to be quite simple. MySQL has two root accounts. One is root@localhost (when coming from localhost, obviously) and on is root@% (when coming from any other host).
The root@% hasn’t full permissions by default. Changing this is quite simple:

1. Login from localhost

mysql -u root -p

2. Change permissions for the remote root account

mysql> GRANT ALL PRIVILEGES ON *.* TO ‘root’@’%’;

That’s all :)

My Linux Kernel Config

Sun, 12 Feb 2012 23:44:15 +0100

Configuring a Linux Kernel can be a lot of work and one has to remember a lot of things. It’s boring work but yet, you have to be concentrated.

To avoid forgetting important things that I need in my Gentoo Kernels, I made a list of things that need to be turned on. Here it is:

Processor type and features —->
   [ ] Machine Check / overheating reporting
   [*]   Intel MCE Features
   [ ]   AMD MCE Features
         Processor family (Core 2/newer Xeon) —->
   (16) Maximum number of CPUs
   [*] Symmetric multi-processing support
   [*] Enable KSM for page merging
   [*] Paravirtualized guest support —->
       [*]   KVM paravirtualized clock
       [*]   KVM Guest support
       -*-   Enable paravirtualization code
       [*]     Paravirtualization layer for spinlocks

Executable file formats / Emulations —->
   [*] IA32 Emulation

File systems —->
<*> Second extended fs support
<m> Ext3 journalling file system support
<*> The Extended 4 (ext4) filesystem
<*> FUSE (Filesystem in Userspace) support
Pseudo Filesystems —->
    [*] /proc file system support
    [*] Virtual memory file system support (former shm fs)
Partition Types —->
    [*] Advanced partition selection
      [*] EFI GUID Partition support
CD-ROM/DVD Filesystems —->
    <M> UDF Filesystem support

Networking support —->
    Networking options —->
        <*> 802.1d Ethernet Bridging
        <*> 802.1Q VLAN Support

Device Drivers —->
[*] HID Devices —->
    <*>   USB Human Interface Device (full HID) support
[*] Multiple devices driver support (RAID and LVM) —->
    <*> Device mapper support
    <*> Crypt target support
    <*> RAID support
[*] Block Devices —->
    <*> Loopback device support
[*] Hardware Monitoring Support —->
    <*> Intel Core/Core2/Atom temperature sensor
Graphics support —->
    /dev/agpgart (AGP Support) —->
      <*> Intel 440LX/BX/GX, I8xx and E7x05 chipset support
    Direct Rendering Manager (XFree86 4.1.0 and higher DRI support)
      <*> Intel 830M, 845G, 852GM, 855GM, 865G (i915 driver) i915 d
      <*> Intel 830M, 845G, 852GM, 855GM, 865G (i915 driver) i915 d
      [*]    Enable modesetting on intel by default
Input device support —->
    <*> Event interface
[*] Network device support —->
    -*- Network core driver support
    <M>   Universal TUN/TAP device driver support

[*] Cryptographic API —->
<*> SHA256 digest algorithm
<*> AES cipher algorithms
<*> RIPEMD-160 digest algorithm
<*> SHA384 and SHA512 digest algorithms
<*> Whirlpool digest algorithms
<*> LRW support (EXPERIMENTAL)
<*> XTS support (EXPERIMENTAL)
<*> AES cipher algorithms
<*> Serpent cipher algorithm
<*> Twofish cipher algorithm

Power management and ACPI options —->
[*] ACPI (Advanced Configuration and Power Interface) Support —->
    <*> AC Adapter
    < > Battery
    -*- Button
    -*- Video
    <*> Fan
    <*> Processor
    <*> Thermal Zone
    [*] Power Management Timer Support
CPU Frequency scaling —->
    [*] CPU Frequency scaling
          Default CPUFreq governor (ondemand) —->
    <*>   ‘performance’ governor
    < >   ‘powersave’ governor
    <*>   ‘userspace’ governor
    <*>   ‘ondemand’ governor
    <*>   ‘conservative’ governor
          x86 CPU frequency scaling drivers —->
          <*> ACPI Processor P-States driver

[*] Virtualization —->
    —- Virtualization
    <M> Kernel-based Virtual Machine (KVM) support
    <M>   KVM for Intel processors support

I’ll post a list of sources for these settings soon.

One week ago...

Fri, 06 Jan 2012 23:51:33 +0100

One week ago the 28c3 had ended. These four days definitely were one of the best times I had in my entire life! Awesome people, awesome talk, awesome tech, awesome experiences - it was amazing!

Before leaving, we helped tearing down the tables and some of the network stuff and then went off to go to the after party at the c-base.
I hadn’t been at a hackerspace before actually and certainly not at such a big one as the c-base.

It was very busy there with a lot of people coming over from the 28c3, but it was absolutely great.

If I can get a ticket, I’ll definitely go to the 29c3 and also visit the c-base again.

Thanks to everyone who was there and especially to all the angels!

No Coca Cola for one week!

Thu, 28 Jul 2011 19:12:24 +0200

Every day, just after lunch, I’m getting myself an 1/2l bottle of Coca Cola (the _real_ one, not zero or diet).

However, this week, I decided not to! No Coca Cola for one week (or at least 5 days).
Turns out, that’s pretty hard! For the first two days I felt really odd and my stomach felt strange all afternoon!

Wednesday wasn’t that bad anymore, but still strange.

Today now went ok. Just after lunch it was still strange but then it became OK very quickly.
Amazing, how hard it is not to drink Coca Cola!

Linux: Desura getting ported to Linux

Thu, 28 Jul 2011 19:08:46 +0200

Linux: Desura getting ported to Linux:

reallinux:

Gamers today all know Steam, a platform for buying games online and installing them and for the community to interact.

Desura provided a similar concept but is oriented more towards indie games and the community.

Desura has had a Linux gamers group for a long time and now they are…

Microsoft congratulates Linux to it's 20th birthday

Wed, 20 Jul 2011 21:24:00 +0200

reallinux:

Microsoft just want to say Happy Birthday! | The Linux Foundation Video Site - http://video.linux.com/video/2127

The LinuxFoundation has asked for videos for the 20th birthday of Linux. This one was submitted by Microsoft.

Escaping the search bubble...

Thu, 14 Jul 2011 22:20:47 +0200

Yesterday, newsbeuter.org was offline, so I could not download the source.

Today, it’s online again and I could compile the latest version. Newsbeuter, a CLI based RSS reader, has support for Google-reader synchronization, which is somewhat important to me, because it allows me to keep the feeds I read at home and at work synced.

Google Reader was the last Google-related tab that I still had constantly opened. With that one gone, I can now logout from Google and that way escape the filter bubble :)

What’s a filterbubble, you ask? Watch this then: http://www.youtube.com/watch?v=SG4BA7b6ORo

Jabra Clipper review

Mon, 11 Jul 2011 20:29:24 +0200

I like Bluetooth headsets, because then I don’t have to worry about a cable going from my ears down to my trousers that entangles everywhere.

I got my first Bluetooth headset almost 4 years ago. It’s quite a big model from Motorola, I never knew the specific model identification.
The fact that the connection between the two auricles goes behind the head and not over it allowed me to wear it under my fedora.
Even after almost four years of usage, the battery lasted for very long. I normally charged the headset on Sunday and then listened to music for about 2h/day, for the rest I just let it in stand-by.

But this spring, I lost the upholstery for one of the sides - the other one looks terrible as well.

So now I finally got a new headset. I could not find a similar model to the one I had before that would fit my needs, so I got the Jabra Clipper.
It plugs/clips to any kind of cloth and then has a cable going to the ears. That way the cable still does not go down the whole body.

So here are some pros and cons (IMO) for the Jabra Clipper:
Pros:

Establishing connection with the phone is reliable
it’s pretty light-weight and doesn’t get in the way, so I can leave it on all day
Wearing the Jabra Clipper certainly looks better than the Motorola model I had before ;)
It didn’t cost a lot.

Cons:

The in-ear-hadphones that came with the Clipper produce a very deep sound on podcasts, I’m now using other headphones I had lying around.
The battery only lasts for 6 hours of music, so I have to charge it quite frequently and can’t leave in in stand-by all the time.
The connection is not quite as stable. This might also be, because the clipper is often shielded by my own body.

It makes me feel much more secure to know that there won’t...

Wed, 29 Jun 2011 21:03:39 +0200

It makes me feel much more secure to know that there won’t be anything tricking me before I ever use new storage devices, so I’ll wipe the mbr even before mounting it for the very first time.

Found that again after one year :) Really thought I had lost it...

Wed, 29 Jun 2011 20:57:08 +0200

Found that again after one year :)

Really thought I had lost it forever. Was in a pair of shorts I’m not wearing that often. It has been in the washing machine several times.
However, it’s still working :) It’s the fastest flash-memory-stick I’ve ever had!

Linux: Mint is slowly taking over as the #1 most popular Linux distribution...

Mon, 27 Jun 2011 18:22:29 +0200

Linux: Mint is slowly taking over as the #1 most popular Linux distribution...:

reallinux:

Mint is slowly taking over as the #1 most popular Linux distribution according to DistroWatch-data. Over the last 7 days, Mint had significantly more hits per day than Ubuntu (2056 vs. 1680). http://distrowatch.com/index.php?dataspan=1

Even in the last 30day period, Mint is in…

I want a Nokia N950

Tue, 21 Jun 2011 21:21:29 +0200

I’ve got my Nokia N900 phone for almost exactly one year by now.
I loved it from the first day! It’s a great device which many capabilities that allows me to do almost any thing I could imagine. I love the freedom of the Maemo operating system and I love that it’s plain Linux!

Many of my friends got smartphones with more powerful hardware by now and with Android versions that are ways more responsive than the N900 is but I wouldn’t want to change with any of them. The N900 is just amazing!

However, the world is moving along and I’d be happy about a new device, if just it was as open as the N900.
There have been rumors about a succession device for quite a while now. Rumors were that there would be a phone called Nokia N9 with a slide keyboard (love that!) and with MeeGo.

Yesterday Nokia announced the N9. But it’s not the device I’ve been waiting for. It’s a consumer-oriented device without a keyboard and without a memory-card slot that will probably be locked down in some way.
That’s certainly not the device I want.

The device I’ve been waiting for and that I want is the Nokia N950 that was also presented yesterday.
It’s targeted at developers (so it’s designed to be open and it’s probably easier to get root-access) and it has, what looks like, a very decent keyboard!

However, Nokia won’t sell the N950. Instead it will only be available for developers in specific development programs.
I can see that Nokia doesn’t want end-users to end up buying a half-finished phone, but I think they’ve gone too far! I would want to be able to buy the phone on their website as soon as I logged in as developer. It would keep away end-users and would make devs. happy.

So as I absolutely want the N950, I registered on their portal today and applied for their Launchpad. I really really hope that I’ll get the chance to get an N950!

Until then, I’ve ordered a MicroSDHC card class 10 for my N900 so I can dualboot MeeGo and get started with some development.