Recent content in Blogs on Here be dragons
Back when we started with a signed shim in Debian, the tooling was Windows-only and required me to do a reboot dance and it was all quite tedious. Over time, more and more of the tooling has migrated to Linux and it all works quite well. The signing is done with an EV code signing cert from SSL.com and stored on a Yubikey. Getting the certificate onto the key is a bit tedious, but reasonably…
Debian uses LDAP for storing information about users, hosts and other objects. The wrapping around this is called userdir-ldap, or ud-ldap for short. It provides a mail gateway, web UI and a couple of schemas for different object types. Back in late 2018 and early 2019, we (DSA) removed support for ISO5218 in userdir-ldap, and removed the corresponding data. This made some people upset, since they…
OpenSSH has this very nice setting, VerifyHostKeyDNS , which when enabled, will pull SSH host keys from DNS, and you no longer need to either trust on first use, or copy host keys around out of band. Naturally, trusting unsecured DNS is a bit scary, so this requires the record to be signed using DNSSEC. This has worked for a long time, but then broke, seemingly out of the blue. Running ssh -vvv…
I moved my blog around a bit and it appears that static pages are now in favour, so I switched to that, by way of Hugo . CSS and such needs more tweaking, but it’ll make do for now. As part of this, RSS feeds and such changed, if you want to subscribe to this (very seldomly updated) blog, use https://err.no/personal/blog/index.xml
I’ve had a half-broken temperature monitoring setup at home for quite some time. It started out with a Atom-based NAS, a USB-serial adapter and a passive 1-wire adapter. It sometimes worked, then stopped working, then started when poked with a stick. Later, the NAS was moved under the stairs and I put a Beaglebone Black in its old place. The temperature monitoring thereafter never really…
Apparently, people care when you, as privileged person (white, male, long-time Debian Developer) throw in the towel because the amount of crap thrown your way just becomes too much. I guess that’s good, both because it gives me a soap box for a short while, but also because if enough people talk about how poisonous the well that Debian is has become, we can fix it. This morning, I resigned…
I’m running a local unbound instance on my laptop to get working DNSSEC. It turns out that with the captive portal NSB (the Norwegian national rail company), this doesn’t work too well and you get into an endless series of redirects. Changing resolv.conf so you use the DHCP-provided resolver stops the redirect loop and you can then log in. Afterwards, you’re free to switch back…
Dustin Kirkland recently wrote that “Fingerprints are usernames, not passwords”. I don’t really agree, I think fingerprints are fine for lightweight authentication. iOS at least allows you to only require a pass code after a time period has expired, so you don’t have to authenticate to the phone all the time. Replacing no authentication with weak authentication (but only…
NSCA is a tool used to submit passive check results to nagios. Unfortunately, an incompatibility was recently introduced between wheezy clients and old servers. Since I don’t want to upgrade my server, this caused some problems and I decided to just get rid of NSCA completely. The server side of NSCA is pretty trivial, it basically just adds a timestamp and a command name to the data sent by…
Recently, there’s been discussions on IRC and the debian-devel mailing list about how to notify users, typically from a cron script or a system daemon needing to tell the user their hard drive is about to expire. The current way is generally “send email to root” and for some bits “pop up a notification bubble, hoping the user will see it”. Emailing me means I get far…
Update: This isn’t actually that much better than letting them access the private key, since nothing is stopping the user from running their own SSH agent, which can be run under strace. A better solution is in the works. Thanks Timo Juhani Lindfors and Bob Proulx for both pointing this out. At work , we have a shared SSH key between the different people manning the support queue. So far,…
Over the last couple of weeks, I have been working on getting binary packages for Varnish modules built. In the current version, you need to have a built, unpacked source tree to build a module against. This is being fixed in the next version, but until then, I needed to provide this in the build environment somehow. RPMs were surprisingly easy, since our RPM build setup is much simpler and…
Michael Biebl and I are giving a talk on systemd in Debian at FOSDEM on Sunday morning at 10. We’ll be talking a bit about the current state in Wheezy, what our plans for Jessie are and what Debian packagers should be aware of. We would love to get input from people about what systemd in Jessie should look like, so if you have any ideas, opinions or insights, please come along. If…
gitano is not entirely unlike the non-web, server side of github. It allows you to create and manage users and their SSH keys, groups and repositories from the command line. Repositories have ACLs associated with them. Those can be complex (“allow user X to push to master in the doc/ subtree) or trivial (“admin can do anything”). Gitano is written by Daniel Silverstone, and…
We recently switched from Buildbot to Jenkins at work , for building Varnish on various platforms. Buildbot worked-ish, but was a bit fiddly to get going on some platforms such as Mac OS and Solaris. Where buildbot has a daemon on each node that is responsible for contacting the central host, Jenkins uses SSH as the transport and centrally manages retries if a host goes down or is rebooted. All in…
At work, we have a rotation of who is on call at a given time. We have few calls, but they do happen and so it’s important to ensure both that a person is available, but also that they’re aware they are on call (so they don’t stray too far from their phone or a computer). In the grand tradition of abusing spreadsheets, we are using google docs for the roster. It’s basically…
Before I start, I’ll admit that I’m not a real RPM packager. Maype I’m approaching this from completely the wrong direction, what do I know? I’m in the process of packaging Varnish 3.0.2 which includes mangling the spec file. The top of the spec file reads: %define v_rc %define vd_rc %{?v_rc:-%{?v_rc}} Apparently, this is not legal, since we’re trying to define v_rc…
We use SugarCRM at work and I’ve complained about its not-very-RESTy REST interface. John Mertic a (the?) SugarCRM Community Manager asked me about what problems I’d had (apart from its lack of RESTfulness) and I said I’d write a blog post about it. In our case, the REST interface is used to integrate Sugar and RT so we get a link in both interfaces to jump from opportunities to…
Just this morning, I was setting up TLS on a LDAP host, but slapd refused to start afterwards with a bizarre error message: TLS init def ctx failed: -207 The key and certificate was freshly generated using openssl on my laptop (running wheezy, so OpenSSL 1.0.0d-3). After a bit of googling, I discovered that -207 is gnutls-esque for “Base64 error”. Of course, the key looks just fine and…
It’s sometimes necessary to be able to access HTTP resources from inside VCL. Some use cases include authentication or authorization where a service validates a token and then tell Varnish whether to proceed or not. To do this, we recently implemented libvmod_curl which is a set of cURL bindings for VCL so you can fetch remote resource easily. HTTP would be the usual method, but cURL also…
A while ago, we got another machine for hosting Alioth and so we started thinking about how to use that machine. It’s a used machine and not massively faster than the current hardware, so just moving everything over wouldn’t actually get us that much of a performance upgrade. However, Alioth is using FusionForge, which is supposed to be able to run on a cluster of machines. After all,…
Every so often, we get bug reports about Varnish leaking memory. People have told Varnish to use 20 gigabytes for cache and they discover the process is eating 30 gigabytes of memory and they get confused about what’s going on. So, let’s take a look. First, a little bit of history. Varnish 2.0 had a fixed per-object workspace which was used for both header manipulations in vcl_fetch as…
Last night, I finally got my temperature sensors going, including a nice and shiny munin plugin giving me pretty graphs . So far, I only have a sensor in the loft, but I’ll spend some days putting sensors in the rest of the house as well. Robert McQueen asked me on twitter how this all was set up, so I figured I’d blog about it. The sensors I’m using are the DS18B20 ones from…
I recently got my hands on a Kenwood AT641 , a fruit juicer attachment for the Chef/Major series of kitchen machines, and now I’ve had the pleasure of actually using it. The AT641 is a high-speed, rotational juicer which works by the principle of making a puree of the apples (or whatever else you’re juicing), using a spinning plate with sharp studs on it, and then accelerating the…
Ben Nevis is the tallest mountain on the British Isles and also the name of one of the beers that the Bridge of Allan brewery makes. We visited the brewery around the start of the year. One of the beers we brought back was a Ben Nevis, described as a ruby red IPA. I’d classify it as more of a dark amber or brown ale. The taste is quite hoppy without being too bitter and with a fair amount of…
GNOME’s current sysadmin team is entirely volunteer-based, but as they are having problems finding enough (trusted) volunteers they are looking at hiring a part-time sysadmin. From looking at the GNOME wiki, it looks like they have had a meeting about the shortage of sysadmins. Citing from the minutes The biggest problem that we’ve always had with the maintaining an active sysadmin…
Russell Coker recently reviewed the Yubikey. The article mentions me, so I figured I’d correct a minor thing and respond to one of the comments. First, the yubikey-server-c is my reimplementation of the Yubikey authentication protocol. Yubico provides two implementations, one in PHP and one in Java, neither which I’m particuarly interesting on building my system security on. Any bugs,…
I recently upgraded kemper.freedesktop.org to lenny. Collabora are nice enough to sponsor some of my sysadmin work for freedesktop and so making sure we are actually running a supported distribution was a good start. The actual dist-upgrade went fine, but when I rebooted with a 2.6.26 kernel, it just hung in the early boot phase. Luckily, a newer kernel worked fine. However, a newer kernel also…
Lucas asks about how free the N900 is, whether he can download and recompile and reflash. I’ll try to answer some of those questions. No, you can’t download all the source. Part of it is just not open. I am not privy to Nokia’s decisions on why or why not to open up, but it seems like the user interface bits are only partially open. Hildon itself is open so you can poke at…
I’ve been using an iphone since late 2007 as my primary phone and so I’ve gotten quite a few contacts and SMS conversations stored on it. Now that Collabora has given me a nice and shiny N900, I wanted to move my contacts and conversations over, but this proved to be a bit more work than expected. Please note that the following procedure worked for me, I have tried to take reasonable…
Collabora was kind enough to buy N900s for all its employees. Yay! I got mine on Friday and has been playing around with it quite a bit. It’s very shiny and the user experience is a lot better than the N810. There are a few graphical glitches, it seems it’s XDamage damaging a bit of a window and it’s just not quick enough to repaint. Not a problem, and it has far fewer instances…
In my last post about the ekey, I complained about two things: memory leak in the server and missing reconnects if the client was disconnected for any reason. I’ve meaning to blog about the follow up for while, but haven’t had the time before now. Quite quickly after my blog post, Simtec engineers got in touch on IRC and we worked together to find out what the memory leak problem was.…
As 3.0 format packages are now allowed into the archive, I am thinking about what I would like the workflow to look like and hoping one of them fits me. For new upstream releases, I am imaginging something like: New upstream version is released. git fetch + merge into upstream branch. Import tarballs, preferably in their original format (bz2/gzip), using pristine-tar . Merge upstream to debian…
Back at the Debian barbeque party at the end of August, I got myself an EntropyKey from the kind folks at Simtec . It has been working so well that I haven’t really had a big need to blog about it. Plug it in and watch /proc/sys/kernel/random/entropy_avail never empty. However, Collabora, where I am a sysadmin also got one. We are using a few virtual machines rather than physical machines as…
Dear whoever runs the Telefonica APs in both Rio de Janeiro and Sao Paulo airports: Your DNS servers are returning SERVFAIL and has been doing so for quite a while. This is not helpful, perhaps you should set up some monitoring of them?
A little while ago, I read robster’s post about librest , and it looked quite neat. I have had a plan for visualising GPX files for quite a while, hopefully with something that allows you to look at data for various bits of a track, like speed and the time you where there, but for various reasons, I haven’t had the time before. Last night, I took a little time to glue librest and…
Currently, varnishlog does not support very advanced filtering. If you run it with -o , you can also do a regular expression match on tag expression. An example would be varnishlog -o TxStatus 404 to only show log records where the transmitted status is 404 (not found). While in Brazil, I needed something a bit more expressive. I needed something that would tell me if I had vcl_recv call pass and…
It is sad to see how people complain about how packaging Ruby gems is painful. It seems like it is the Java packaging game all over again where any application ships its dependencies in a lib/ directory (or in the case of Rails, vendor/ ). Mac OS X applications seem to do some of the same thing by shipping lots of libraries in their application bundle, which is really just a directory with some…
qurzaw (0.0.0.0) Fri Nov 28 21:34:28 2008 Keys: Help Display mode Restart statistics Order of fields quit Last 60 pings 1. 10.125.123.1 ............................................................ 2. 10.84.0.1 .??????.......??????.......??????......???????......??????.. 3. c9110002.virtua.com.br .????????.....??????..?..?????????..??????????.?..?.??????.? 4. embratel-G2-0-1-ngacc01.…
I tend to have a bunch of reference material stored in my home directory. Everything from RFCs, which is trivial to get at again using a quick rsync command (but immensely useful when I want to look up something and am not online) to requirements specifications for systems I made years and years ago. If I didn’t use a VCS, I would just store those in a directory off my home directory, to be…
Part of my job nowadays is regular Linux consulting for various clients. As part of this, I end up having to reconfigure my network quite a lot, and often by hand. Two examples: I am setting up some services on a closed server network. I am connected to this using regular, wired Ethernet. This network does not have access to the internet, so I also have access to a WLAN which does. However, I need…
(when your wife/SO is not around) Finally get around to play with the PowerPC you have had standing besides your desk for about a month. Discover that it still doesn’t boot, since it can’t find its hard drive. Also discover that it doesn’t want to talk to your USB keyboard. After a while, think of removing and replugging the SAS connectors, which fixes the boot problem. The…
A little while ago, I discovered Emacs has D-Bus support now. I wanted to play around with it, and I discovered Alban’s collaborative editing page . It seems like Emacs’s D-Bus documentation is somewhat lacking, though CVS has some more docs. Alban’s work seems to need a well-known name, something Emacs can’t yet do, so I’ll probably add a method to…
I finally got around to releasing eweouz 0.2 tonight. It is still a bridge between emacs and Evolution Data Server, now with both gnus and wanderlust support. Changes include: Actually works now, sans stupid typo A bit more documentation Now handles non-ASCII names, thanks to setlocale. Be a bit more paranoid and fail if opening addressbooks and such fails. eweouz now also has a mailing list and a…
I just released the first version of eweouz, the interface between emacs and evolution-data-server. Sources are available, no packages yet. It is now possible to both add contacts from within gnus and search for contacts. Patches and feedback is of course welcome.
Today, I submitted my two first patches to the kernel. One is fairly trivial (remove a USB ID from the pl2303 driver), the other is a fixup of a patch from some other guy, which adds support for DTR, RTS and CTS to the ch341 driver. Yay, hopefully they’ll get accepted. The reason for this journey into kernel land is I got a TEMPer USB thermometer in the mail yesterday. After a fair bit of…
Some years ago , when I hacked on a TDB backend for Evolution Data Server (EDS), I also wrote something about writing some command line tools for accessing my contacts and so on. I’ve finally gotten my act together and wrote the necessary glue to have addres completion between Gnus and EDS. It’s nowhere as feature-complete as BBDB is, but it allows you to complete addresses, at least.…
Various people have been posting about what to do when the zombies attack. You are in a mall when zombies attack. You have: 1. One weapon 2. One song blasting on the speakers 3. One famous person to fight along side you. Katana. Doesn’t run out of ammo and should slice up those zombies quite nicely. One of the songs from the soundtrack of “The Rock”. I can’t remember which…
(This post is mostly as a reminder to myself on how I’ve set up my backup system. It should probably go on a wiki instead so I can keep it up to date.) After the recent OpenSSL debacle in Debian and Ubuntu, I found that all my backups were encrypted with something amounting to a well-known secret key. Ouch. I was not entirely happy with how my old backup system worked either (it was based on…
15:58 [Canonical] -!- Irssi: Disconnecting from server irc.canonical.com: [kthxbye!] 15:58 [Canonical] -!- Irssi: Connection lost to irc.canonical.com From tomorrow on, I’m working full-time for Linpro , a Norwegian Linux consulting company.