Blogs on Andrew's Memory Blog

Uploading to the webserver from Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 08 Apr 2026 23:14:09 -0700

To get Hugo up to the webserver, I had to scp the files up there using my keyfile. For that, I started with the image that I gave the docker tag, which is one of the default Forgejo images.

Setting up variables
#

First I set up a bunch of variables:

WEBSERVER_SSH_USERNAME: my username on the webserver
WEBSERVER_SSH_HOST: the hostname of the webserver I upload to
WEBSERVER_HTML_DIR: the directory where the webserver files get sent

Setting up secrets
#

I ended up with two secrets:

SSH_PRIV_KEY: my private key
SSH_KNOWN_HOSTS: I also needed to set up my ~/.ssh/known_hosts so that I wouldn’t get errors when connecting via scp. I temporarily threw away my existing deploy.yaml and built a new one that did a little (very little) ssh using sftp:

.forgejo/workflows/deploy.yaml

on: [push]
 deployscp:
 runs-on: docker
 steps:
 - run: |
 echo dir > ftpbatch
 echo bye >> ftpbatch
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 ssh-keyscan ${{ vars.WEBSERVER_SSH_HOST }} >> ~/.ssh/known_hosts
 cat ~/.ssh/known_hosts
 - name: push public
 run: |
 echo about to sftp
 sftp -i ~/.ssh/id_rsa_webserver -b ./ftpbatch ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}
 echo did sftp

The first time I ran that, I copied the output of the cat ~/.ssh/known_hosts line into the secret SSH_KNOWN_HOSTS. Then I updated deploy.yaml to use the secret instead:

.forgejo/workflows/deploy.yaml

on: [push]
 deployscp:
 runs-on: docker
 steps:
 - run: |
 echo dir > ftpbatch
 echo bye >> ftpbatch
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 echo "${{ secrets.SSH_KNOWN_HOST }}" > ~/.ssh/known_hosts
 chmod 0600 ~/.ssh/known_hosts
 - name: push public
 run: |
 echo about to sftp
 sftp -i ~/.ssh/id_rsa_webserver -b ./ftpbatch ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}
 echo did sftp

I was hoping that Forgejo would preserve the line separators that I pasted into the secret dialog. It did! Nice!

Add Hugo back to the build and really upload
#

With a working sftp (and presumably a working ssh) and a good private key, I could add the hugo step back. It packages up the build, then the docker image retrieves the build and uploads the important bit. Here’s the whole enchilada:

.forgejo/workflows/deploy.yaml

on: [push]
jobs:
 buildhugo:
 runs-on: hugo
 steps:
 - run: hugo version
 - uses: actions/checkout@v4
 with:
 submodules: 'recursive'
 - name: run hugo
 run: hugo --gc --minify
 - name: fix up RSS
 run: cp ./public/index.xml ./public/rss.xml
 - name: stash public files
 uses: https://code.forgejo.org/forgejo/upload-artifact@v4
 with:
 name: public
 path: ./public/ 

 deployscp:
 runs-on: docker
 needs: buildhugo
 steps:
 - name: grab public files
 uses: https://code.forgejo.org/forgejo/download-artifact@v4
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 echo "${{ secrets.SSH_KNOWN_HOST }}" > ~/.ssh/known_hosts
 chmod 0600 ~/.ssh/known_hosts
 - name: push public
 run: |
 ssh -i ~/.ssh/id_rsa_webserver ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }} 'rm -rf /home/${{ vars.WEBSERVER_SSH_USERNAME }}/${{ vars.WEBSERVER_HTML_DIR }}/*'
 scp -r -i ~/.ssh/id_rsa_webserver ./public/* ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}:/home/${{ vars.WEBSERVER_SSH_USERNAME }}/${{ vars.WEBSERVER_HTML_DIR }}/

This makes it look easy. It wasn’t. I was nervous about the process, and started with echo ssh -i ~/... and echo scp -r -i ~/... instead of actually running the ssh and scp commands. I made sure things looked right in the Actions window on the Forgejo server before I did the scp for real, and it took me a couple more deep breaths before I did the ssh (which does a rm -rf).

Ultimately, I had to run things 70 times — I counted — before I got a working deploy. Lots of echo and ls -al to make sure I was oriented. And probably a third of the commits were fixes for this error:

Workflow was not executed due to an error that blocked the execution attempt.
Unable to parse supported events in workflow: yaml: line 25: found a tab character where an indentation space is expected

I really need to set my Emacs up so it uses only spaces for yaml files. Esc-X untabify was my best friend.

Now, I have a website that updates automatically when I push the code. Not when I commit — I’m still trying to remember that git push origin after publishing. I think I’ll commit this and do that now.

Running Hugo from the runner on Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 08 Apr 2026 22:33:06 -0700

I’m taking a shortcut here. With the benefit of foresight which is really hindsight, I set my runner up to run Hugo already with the label hugo. So this is really about the automation I used to do the build. I started with attempts to install Hugo using apk add with the Docker image. That was a side quest that led nowhere.

Then when I decided to split things up, it took me a while to find the right image. The official Hugo Docker image luckily it includes Node.js so it can run the checkout and upload-artifact actions.

However, you can’t do everything on the Hugo image. That means the build has to be split up into two parts. This part is only for running Hugo. Luckily, when it runs, Hugo can store the files it built (./public/) in an artifact, so it’s not too hard to get them later for uploading.

You also need to check out the right thing. For Hugo with Blowfish installed, that means checking out submodules.

If you want to avoid the shortcut and do what I really did, check out the Forgejo Actions quick start guide and build a “hello world” action first.

This is the file I ended up creating in my local repo:

.forgejo/workflows/deploy.yaml

on: [push]
jobs:
 buildhugo:
 runs-on: hugo
 steps:
 - run: hugo version
 - uses: actions/checkout@v4
 with:
 submodules: 'recursive'
 - name: run hugo
 run: hugo --gc --minify
 - name: fix up RSS
 run: cp ./public/index.xml ./public/rss.xml
 - name: stash public files
 uses: https://code.forgejo.org/forgejo/upload-artifact@v4
 with:
 name: public
 path: ./public/

This checks out the git repo with submodules, runs hugo --gc --minify on that, copies index.xml to rss.xml because I started with Astro and didn’t want to have to migrate everyone’s links, then uploads the ./public/ directory with the name public to Forgejo’s artifact repo.

Once you’ve done that, you can:

git add .forgejo/workflows/deploy.yaml
git commit
git push origin

That triggers the automation that will (first time) download the Hugo image, then build the website, then stash it in an artifact called public.

But that’s only half the story for deploy.yaml. Read about uploading to the webserver here.

Setting up a Forgejo runner for Hugo and others

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 02 Apr 2026 22:16:05 -0700

I spent a lot of time messing around because I thought the runner was the thing that ran my actions. Nope, it’s the thing that runs the Docker image that builds your images. That makes life easier. Here’s how I set up mine:

Get the runner token
#

You need the runner token to configure a runner. So do that first. You need to be an admin to set up the runner.

Under the profile menu on the far right, click on “Site administration.”
Under “Admin settings” expand Actions to click on “Runners”

Over on the right, click the “Create a new runner” button. This opens a dialog with a token in it. Copy that token to a text editor.

Setting up a runner
#

I spent a lot of time messing around because I thought the runner was the thing that ran my actions. Nope, it’s the thing that runs the Docker image that builds your images. That makes life easier.

Make a directory for the runner, put the Dockerfile in it, and grab the image. These instructions look at lot like the ones at the OCI image installation instructions on the Forgejo website.

cd /data/shared/forgejo
mkdir runner
cd runner
wget https://code.forgejo.org/forgejo/runner/raw/branch/main/Dockerfile
docker run --rm data.forgejo.org/forgejo/runner:11 forgejo-runner --version

Create a setup.sh in runner/ that looks like this. (Make sure to update the chown line to use the UID and GID you specified in the Forgejo docker-compose.yaml):

setup.sh

#!/usr/bin/env bash
cd /data/shared/forgejo/runner
set -e

mkdir -p data/.cache
chown -R 2000:2000 data
chmod 775 data/.cache
chmod g+s data/.cache

Edit the Dockerfile to use your user info. Look for the USER line and put in your UID and GID:

USER 2000:2000

Run setup.sh

bash ./setup.sh

Create a docker-compose.yaml. Based on the Forgejo instructions, it should look like this (but remember to change the user: to your UID and GID). Yeah, I know it should be a different UID and GID but I’m lazy:

docker-compose.yaml

version: '3.8'

services:
 docker-in-docker:
 image: docker:dind
 container_name: 'docker_dind'
 privileged: 'true'
 command: ['dockerd', '-H', 'tcp://0.0.0.0:2375', '--tls=false']
 restart: 'unless-stopped'

 runner:
 image: 'data.forgejo.org/forgejo/runner:11'
 links:
 - docker-in-docker
 depends_on:
 docker-in-docker:
 condition: service_started
 container_name: 'runner'
 environment:
 DOCKER_HOST: tcp://docker-in-docker:2375
 # User without root privileges, but with access to `./data`.
 user: 2000:2000
 volumes:
 - ./data:/data
 restart: 'unless-stopped'

 command: '/bin/sh -c "while : ; do sleep 1 ; done ;"'
# command: '/bin/sh -c "sleep 5; forgejo-runner daemon --config config.yml"'

Fire up the runner and attach to the shell in the runner image.

docker compose up -d
docker exec -it runner /bin/sh

From within the Docker image shell, run:

forgejo-runner generate-config > config.yml
forgejo-runner register

This will run a script. I used the following values. For the runner labels, what they really want is the label followed by a colon followed by the URL of the docker image, with each entry separated by commas. Since I wanted my runner to run Hugo, I added a label for hugo and a pointer to the Hugo image as well as a “docker” label which is one of the defaults:


INFO Enter the Forgejo instance URL (for example, https://next.forgejo.org/):
http://myforgejoserver.acornwall.net:3000

INFO Enter the runner token:
d41d8cd98f00b204e9800998ecf8427e32d6c11747e037155210

INFO Enter the runner name (if set empty, use hostname: 3b586057879f):
runner

INFO Enter the runner labels, leave blank to use the default labels (comma-separated, for example, ubuntu-20.04:docker://node:20-bookworm,ubuntu-18.04:docker://node:20-bookworm):
hugo:docker://ghcr.io/gohugoio/hugo:v0.152.2,docker:docker://data.forgejo.org/oci/node:20-bullseye

All that creates a .runner file in the Docker image, which gets mapped to the data directory that setup.sh created.
Now, shut the image down.

docker compose down

Next, edit the docker-compose.yaml. Comment out the command that just spins, and uncomment the command that does the thing:

docker-compose.yaml

...
# command: '/bin/sh -c "while : ; do sleep 1 ; done ;"'
 command: '/bin/sh -c "sleep 5; forgejo-runner daemon --config config.yml"'

Bring the runner back up:

docker compose up -d

If you did everything right, you should see a runner show up under Admin settings - Actions - Runners.

Getting the runner to restart on reboot
#

Another bout with systemd, ‘cause we’d like this to start on reboot as well.

/etc/systemd/system/forgejo-runner.service

[Unit]
Description=Forgejo Runner
After=forgejo.service
Requires=forgejo.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml up --detach"
ExecStop=/bin/bash -c "/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml down"

[Install]
WantedBy=multi-user.target

And then the requisite:

/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml down
sudo systemctl start forgejo-runner
sudo systemctl status forgejo-runner
sudo systemctl stop forgejo-runner
sudo systemctl enable forgejo-runner
sudo systemctl start forgejo-runner

Installing a minimal Forgejo via Docker on Ubuntu 24.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 02 Apr 2026 20:54:05 -0700

I’ve been wanting to play with Forgejo for a while. It’s the open source DevOps platform behind Codeberg and I like the idea of self-hosted automation. I wanted a minimal one — I didn’t need mail but I wanted automation on push.

If you know Docker (the current version of Docker) you’ll find it pretty easy to install. Here’s how to do it.

Pull Forgejo from Docker
#

Ubuntu 24.04 doesn’t come with the new Docker, or sqlite3. So:

sudo apt install docker-compose-v2 sqlite3

Grab the Docker image:

docker pull codeberg.org/forgejo/forgejo:14

Create a docker-compose.yaml based on the one at forgejo.org/docs/next/admin/installation/docker/. I changed three places the USER_UID, USER_GID, and the path to the volume (I used a hard-coded one rather than ./forgejo. The file I ended up with was:

docker-compose.yaml

networks:
 forgejo:
 external: false

services:
 server:
 image: codeberg.org/forgejo/forgejo:14
 container_name: forgejo
 environment:
 - USER_UID=2000
 - USER_GID=2000
 restart: always
 networks:
 - forgejo
 volumes:
 - /data/shared/forgejo/forjego:/data ← was ./forgejo:/data
 - /etc/localtime:/etc/localtime:ro
 ports:
 - '3000:3000'
 - '222:22'

Bring the image up:

docker compose up -d

Open a browser on the host’s port 3000 (which I’ll call myforgejoserver.acornwall.net:3000) to initialize Forgejo.
In the browser, leave everything as default except the server domain and base URL. That means I’m using the default sqlite

I skipped email settings and server/third-party service settings, and entered the administrator account settings, then clicked Install Forgejo:

Next I restarted Forgejo and made sure that the settings stuck. If you have the storage volume wrong in the docker-compose.yaml, as I did the first time, you get to enter everything again after fixing it.

docker compose down
docker compose up -d

Creating a Git Repo Into Forgejo
#

Once things were set up, I could log in and create a repo in Forgejo. Here’s what I did.

Navigate to the + dropdown and click “New repository”.
Fill out the form. I called my repo “andrewmemory” and set my user as the owner. I checked “Make repostitory private.” I also checked “Initialize repository” which lead to some issues later, but hey, it looked good at the time. I added both “Emacs” and “Hugo” to .gitignore — I didn’t realize I could do both the first time I tried. I went with CC-BY-NC-ND-4.0 for the license. Then I clicked “Create repository.”

There, the repo is created!

Verifying your public key
#

Once the repo was created on Forgejo, I needed to add my private cert to Forgejo. That meant clicking the dropdown on the right with my avatar, clicking “Settings,” then navigating to “SSH / GPG keys”. From there I could click “Add key” under SSH Keys. I pasted my public key in there. Then click “Add key.”
Once you’ve done that, you’ve got something like this. Click “Verify”:
After clicking verify, you’re presented with a token and a string to paste into a terminal. Copy the string, paste it into the terminal, but edit the filename if your private key is not id_ed25519.

echo -n 'ee2cd80b5f8f4e95800ddca4d92053998bc3f8e7a9cc1dd60fe30e7ad83b87d6' | ssh-keygen -Y sign -n myforgejoserver.acornwall.net -f ~/.ssh/id_rsa

Running that command will dump a wad into your terminal that looks like this:

-----BEGIN SSH SIGNATURE-----
U1mIU0lHAAAAAQA
...
+wrNHO9W
-----END SSH SIGNATURE-----

Copy the whole wad including the BEGIN and END parts, then paste that into the section that says “Armored SSH signature” and press the “Verify” button.
If you’ve done everything right your key is now verified.

Connecting the old repo
#

Finally, I could start moving my website (which is in a git repo on disk) into Forgejo. That wasn’t terrible, although it took me a couple of tries because I wasn’t sure how to do it. Here’s what I did.

cd andrewmemory-hugo
git remote rm origin # It took me a couple of tries, so I had to remove the old origin
git remote add origin ssh://git@myforgejoserver.acornwall.net:222/andrew/andrewmemory
git pull --allow-unrelated origin main

This resulted in a bunch of merge conflicts in .gitignore that I manually took care of. Once that was done, I could:

git push --set-upstream origin main

Setting Forgejo to restart after reboot
#

This is all groovy, but next time I install Linux patches, I’m going to have to reboot my machine. So I created a systemd (boo) service to do that.

/etc/systemd/system/forgejo.service

[Unit]
Description=Forgejo
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/usr/bin/docker-compose -f /data/shared/forgejo/docker-compose.yaml up --detach"
ExecStop=/bin/bash -c "/usr/bin/docker-compose -f /data/shared/forgejo/docker-compose.yaml down"

[Install]
WantedBy=multi-user.target

Then, I made sure it worked and enabled it on boot:

sudo systemctl start forgejo
sudo systemctl status forgejo
sudo systemctl stop forgejo
sudo systemctl enable forgejo
sudo systemctl start forgejo

Ok, Forgejo is set up!

Website automation with Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 29 Mar 2026 21:54:05 -0700

If you see this, then my Forgejo web automation is working.

It took a few steps:

Setting up systemd resolv.conf

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 15 Feb 2026 23:08:05 -0700

Like every intelligent person, I hate systemd. But Linux seems determined to undo all good things, and Debian has adopted it.

In my Ubuntu 22.04 install, I’d disabled it and gone back to normal resolv.conf resolution. That didn’t work for 24.04. So I had to figure out the stupid resolution the systemd way.

To fix DNS on Ubuntu 24.04 — which, I will note, works perfectly for every other system that gets provisioned from my DHCP server — I had to go into /etc/systemd/resolved.conf and uncomment a bunch of stupid crap.

/etc/systemd/resolved.conf

...
[Resolve]
DNS=(my DNS server IP address)
...
Domains=(my local domain)
DNSSEC=yes
...
DNSStubListener=no
...

Migrating from Astro to Hugo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 14 Dec 2025 00:08:05 -0700

For a while, I’ve been uncomfortable with Astro. I’m not a big fan of npm’s policy on security which is basically “yeah, just upload it here.” Every time I upgrade npm packages, they break. There are workarounds to some security issues with configurations like npm in a box but the developer experience for npm is still kind of like having a rash.

So I decided to give Hugo a shot.

Moving there was surprisingly easy. There were a few quirks. Here’s what I ended up doing:

Set up Hugo
#

I installed Hugo from the .deb that’s linked from gohugo.io/installation/linux. I’d have preferred to have installed from the Ubuntu package manager, but its version was… less than recent. I’ll have to rememer to update this manually.
Hugo doesn’t come with a default theme, so I had to pick one (from themes.gohugo.io/) or roll my own. I picked Blowfish because it has light and dark modes, has good docs, tags, and search.
I walked through the Blowfish installation instructions. I was very careful to avoid the npm tools that they provided — my whole reason for doing this was to get away from that.

Incidentally, I get a warning:

WARN Module "blowfish" is not compatible with this Hugo version: 0.141.0/0.152.2 extended; run "hugo mod graph" for more information.

It doesn’t seem to affect things.

Copy the old posts over
#

Next, I needed to copy my old posts into the new structure. That wasn’t too bad:

cp -R ~/andrewmemory-astromicroacademic/src/content/blog/ ~/andrewmemory-hugo/content/posts/

Fix the posts
#

Fix the time. After copying the posts over, I started to get errors left and right. Hugo is pickier about time formats than Astro. By default, Hugo uses 2025-12-14T00:08:05-0700. Astro was OK with 2025-12-14 00:08:05 GMT-7. Hugo doesn’t really care about the T, I discovered, so all I had to do was:

find . -name index.md -print0 | xargs -0 sed -i 's/ GMT-7/-0700/1'

Change from description to summary. I discovered that Hugo uses summary: where Astro uses description: in the front matter. So…

find . -name index.md -print0 | xargs -0 sed -i 's/description:/summary:/1'

Update internal links. Since Astro wants its blog posts in /blog/ and Hugo wants them in /posts/, I needed to update. I could probably have renamed posts to blog, but I figured, let’s go with the Hugo way. You might not want to do this. I had to undo it. Scroll down a few sections to see why.

find . -name index.md -print0 | xargs -0 sed -i 's|/blog/|/posts/|g'

Fix links to static files. Astro requires that you put static files in /public for them to be visible. Hugo apparently lets you keep them in their associated directories! So my post with a Perl script can just say [convertcsv.pl](convertcsv.pl). Nice! I copied the static assets into their appropriate directories.

Tweak code blocks to allow filenames
#

I had modified Astro to enable filenames on code blocks. I needed to do the same thing for Hugo. I found a few good references, particularly Roger Steve Ruiz’s blog. There were a few steps here:

Create directories ~/andrewmemory-hugo/layouts/_default and ~/andrewmemory-hugo/layouts/_default/_markup/.
Add a render-codeblock.html file there. I wanted the titles to stick out a little more, so I abused the <mark> tag. I also decided to set isVerbatim to false because I prefer it that way. I ended up with:

layouts/_default/_markup/render-codeblock.html

{{/* this file is exists at `layouts/_default/_markup/` in your Hugo project */}}
{{- $isVerbatim := false -}}
{{- if isset .Attributes "verbatim" -}}
{{- $isVerbatim = .Attributes.verbatim -}}
{{- end -}}
<figure class="highlight">
 {{- with .Attributes.title }}
 <figcaption>
 {{- if $isVerbatim -}}
 <span><mark>{{ . }}</mark></span> {{/* As a file name */}}
 {{- else -}}
 <span><mark>{{ . | markdownify }}</mark></span> {{/* As a code description */}}
 {{- end -}}
 </figcaption>
 {{- end }}
 {{- if transform.CanHighlight .Type }}
 <pre tabindex="0" class="chroma"><code class="language-{{ .Type }}" data-lang="{{ .Type }}">
 {{- with transform.HighlightCodeBlock . -}}
 {{ .Inner }}
 {{- end -}}
 </code></pre>
 {{- else }}
 <pre tabindex="0"><code class="language-{{ .Type }}" data-lang="{{ .Type }}">{{ .Inner }}</code></pre>
 {{- end }}
</figure>

Finally, I needed to change the references from the old Astro syntax:

```bash:/usr/local/bin/file
My file contents
```

to:

```bash {title = "/usr/local/bin/file"}
My file contents
```

I didn’t have enough code blocks with filenames to script this, so I this by hand. I used this one-liner to find out where I needed to make changes:

find . -name index.md -print0 | xargs -0 grep '```' | grep '`.*:'

Move things to match the old site
#

Ok, it looks as if Hugo doesn’t have an easy way to alias a section, so I can’t define a global /blog/ that redirects to /posts/. If I put everything in /posts/ it will break existing links. I have to undo it. So much for the Hugo way…

Undo the sed that I did above:

find . -name index.md -print0 | xargs -0 sed -i 's|/posts/|/blog/|g'

Move the posts/ directory under content/ to blog/:

mv posts blog

Update the Blog link

./config/_default/menus.en.toml

...
[[main]]
 name = "Blog"
 pageRef = "blog" # was posts
 weight = 10
...

I’d love to add a link for the old RSS. But I can’t figure out how to rename it. Boo. I guess I can add that when I build the site.

Prettify the RSS feed
#

By default, the RSS that Hugo/Blowfish has is pretty spartan. I found a great blog post called Hugo RSS Improvements that got me started. Here’s what I did:

Create a file in /assets/img/ called rss_image.png. Mine is 475 by 475 pixels. I read on rss.com that Apple wants a minimum of 3000 by 3000. 🙄
Copy the theme’s XML from themes/blowfish/layouts/_default/rss.xml into layouts/_default/rss.xml.
Change the RSS to include the image under the <generator> line:

layouts/_default/rss.xml

...
 <image>
 <url>{{ $.Site.BaseURL }}img/rss_image.png</url>
 <title>{{ if eq .Title .Site.Title }}{{ .Site.Title }}{{ else }}{{ with .Title }}{{.}} on {{ end }}{{ .Site.Title }}{{ end }}</title>
 <link>{{ $.Site.BaseURL }}</link>
 </image>
...

Change the RSS <description> to include content rather than summaries:

layouts/_default/rss.xml

...
 <description>{{ .Content | html }}</description>
...

Now my RSS feed is 600 K and only going to grow, but I can read the blog from the RSS feed in AntennaPod.

Build the static site
#

On to building and testing. That’s easy:

killall hugo
cd ~/andrewmemory-hugo
rm -rf public resources
hugo --gc --minify
cd public
cp index.xml rss.xml # Yuck
python3 -m http.server &

Hey, it looks good! Everything works… except search. Hmm… there’s a lot of questions in the Hugo community about that. The RSS file is just copied, which means I’ll have to do that every time.

Is it possible that search isn’t working because I’m not under my domain? Close your eyes, take a breath, and try it out.

Install the static site
#

Blow away the existing site.
Upload everything in the new public/ to the site.

Images are broken
#

Hmm… that appears to be something weird with HostGator. I changed Hotlink Protection Management to block links to .png, but allowed direct URL requests. Don’t ask, that just has to happen. Websites -> Settings -> Hotlink Protection -> Manage -> Click .png, Click Allow direct requests

Fixing Van Heusen Shirt Pockets

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 10 Dec 2025 19:53:05 -0700

I like Van Heusen Men’s fitted poplin dress shirts. They’re one of the few that still has a left shirt pocket — and that’s where my cell phone goes. But the shirts have a problem: after you put your phone in the pocket a few times, the stitching on the pocket lets go.

As they break, I’ve been fixing them by machine sewing the pockets back together. To do that, I need to match the new thread to the fabric. Here’s what I’ve used so far:

Shirt Colour	Matching Thread	Comments
Black	don’t own
Cameo Blue	tbd
Dark Leaf	tbd
Deep Sea	tbd
Desert Rose	tbd
Flame	Coats & Clark 2160 Atom Red	Need to verify
Grey	don’t own
Greystone	don’t own
Lavender	Coats & Clark 3340 Light Violet	Good match
Leaf	Coats & Clark 6050 Powder Green	Thread is just a little light
Lemon Glaze	don’t own
Light Grey	don’t own
Magenta	Coats & Clark 2820 Barberry Red	Good match
Mist	tbd
Ocean Mist	Amann Mettler 2105 Vintage Blue	Good match
Pacifico	Coats & Clark 4450 Pilot Blue	Good match
Persian Blue	don’t own
Persimmon	tbd
Purple Velvet	Coats & Clark 3660 Deep Violet	Good match
Scallop	don’t own
Stone	don’t own
White	don’t own

As usual, nothing says they have to keep the same colour, dye lots may vary, they may change the stitch thread and not the shirt colour, you know the drill.

Shrinking files on AntennaPod

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 12 Sep 2025 22:32:08 -0700

I like to listen to podcasts, and my favourite podcast app for Android is AntennaPod. I like the control it gives me, the fact that it deals reasonably with non-audio RSS feeds, the wide range of speed controls, and the searchability.

But I download a lot of podcasts. That means there’s a lot of stuff ready for me when I go on flights and things like that, but otherwise it’s, you know, waiting. Some podcast feeds think I want really high quality audio. Like 256 or 320 k/second. Nope, don’t need that.

Finally I figured out that it might be smart to recode some of the podcasts to free up space on my chronically overfilled phone. That’s what I did. Here’s how I did it. First, you have to be in developer mode and be able to connect over adb. Then:

adb shell "ls /storage/emulated/0/Android/data/de.danoeh.antennapod.debug/files/media/"
adb pull "/storage/emulated/0/Android/data/de.danoeh.antennapod.debug/files/media/your-podcast-directory-name"
cd your-podcast-directory-name
mkdir recoded
for i in *.mp3; do echo $i; lame -V6 "$i" "recoded/$i"; done
cd recoded
for i in *.mp3; do echo $i; adb push "$i" "/storage/emulated/0/Android/data/de.danoeh.antennapod.debug/files/media/your-podcast-directory-name/$i"; done

(Replace your-podcast-directory-name with something that exists. Oh, and I’m running the debug version ‘cause I build it from source… you’ll probably just want de.danoeh.antennapod instad of de.danoeh.antennapod.debug.)

By doing this on my two fattest podcast directories, I was able to save 4+ G. Nice!

Fixing OpenBSD console mode for a new HDMI monitor

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 04 Jul 2025 22:56:08 -0700

My old monitor recently lost the magic smoke. I think it’s probably repairable with a new capacitor or two, but I took the opportunity to upgrade to an Acer SA272UE QHD monitor instead. It’s been good with one minor nit: when I switch to my OpenBSD firewall, I don’t get video.

That’s not quite true: I get video when the device (a HUNSN Micro Firewall Appliance, Mini PC, VPN, Router PC, Intel N5105, HUNSN RJ03, AES-NI, 4 x Intel 2.5GbE I226-V LAN, Type-C, TF, M.2 WiFi 6 Slot, Barebone, NO RAM, NO Storage, NO System) starts up in VGA mode. But once OpenBSD switches over to the framebuffer console, the monitor goes black and tells me Cable Not Connected.

The OpenBSD FAQ was not much help — it still references the old 80x50 text mode console rather than a framebuffer console. The BSD site daemonforums.org, however, had a wealth of information.

$ dmesg | grep wsdisplay
wsdisplay0 at inteldrm0 mux 1: console (std, vt100 emulation), using wskbd0
wsdisplay0: screen 1-5 added (std, vt100 emulation)

The recommended action was to boot to UKC — the kernel configurator — and disable the Intel DRM driver. I tried that, but wasn’t able to use it because of a five-year-old problem with USB keyboards.

So… I created /etc/bsd.reconfig and added the line:

/etc/bsd.reconfig

disable inteldrm0

After reboot, I saw

$ dmesg | grep wsdisplay
wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
$ stty size
160 45

I’m still using the framebuffer console, but now with the EFI driver instead of the Intel driver. That’s cool — I can still run X if I need to, and I still get a 160x45 console.

I did run into one problem after doing this, which I’m not sure is related or not. When I installed patch 77_008, I saw:

Relinking to create unique kernel... failed!
!!! "/usr/libexec/reorder_kernel" must be run manually to install the new kernel

I typed in the magic command — that appeared to fix it. If that doesn’t persist, I might need to regenerate /var/db/kernel.SHA256.

Jackery Explorer 2000v2 Specifications

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 10 Jun 2025 21:53:05 -0700

In June of 2025, I bought a Jackery Explorer 2000 v2. Finding specifications for it has been a pain — I think Jackery makes them difficult to discover because they want you to buy their accessories.

But I already had a couple of 100 W panels that had Anderson Powerpoles on them so I needed to build a few cables. Here’s the result:

Specifications

Solar panel input connector: DC8020.
Connector polarity: center positive.
Voltage: 11.0–60 V DC. According to the manual, if you’re below 16 V you’ll get 8 A maximum no matter how many panels you have plugged in; if you’re over 16 V you’ll get up to 12 A with one panel and 21 A with two panels.
MPPT: one.

Undocumented Button Presses

Soft reset? With the power turned on, hold Power and DC/USB simultaneously for 3 seconds. Resets WiFi and Bluetooth.
Another soft reset Hold Power for 10 seconds?
Hard reset? Hold Power and DC/USB for 13 seconds. Enters BMS recalibration mode? (Discharge to 0%, then charge back to 100%)?
Switch AC frequency Hold AC for 3 seconds to switch between 50 Hz and 60 Hz power. (Difference between EU and US models?)

Error Codes

Most of these and their solutions are from an troubleshooting article about the E2000, the Explorer 2000 Pro manual, and the European Jackery Helpcenter.

Code	Meaning	What to do
F0	BMS communications error
F1	inverter communications error
F2	charging module communication error	Try unplugging/replugging 8 mm charging cables?
F3	battery failure
F4	battery overvoltage
F5	battery undervoltage
F6	inverter error	Load power more than that of the power supply? Unplug the load and reset the Jackery. Could also be internal hardware failure if a reset doesn’t fix it.
F7	power supply module error
F8	battery overcurrent/short	Unplug everything (all charging and load cables).
F9	DC output overcurrent/short	Unplug all the load cables.
FA	power mismatch?	Happens when two Jackerys are ganged and one is 60 Hz while the other is 50 Hz. Possibly not applicable to the 2000 v2.
FB
FC
FD
FE

Comments

The DC8020 is an 8 mm outer diameter connector with a 2 mm center pin. I used the GINTOOYUN pigtail from Amazon which helpfully provides two cables.
Avoid the 7909 connector, which looks similar but is 7.9 mm and the pin is smaller (0.9 mm).
Even if you ordered a DC8020 connector, measure the pin. I’d first ordered from a different manufacturer and they shipped a DC7909. It will still plug in (7.9 mm is almost 8 mm), but the pin won’t make contact.
Half the vendors on Amazon think the 7909 is the “Jackery connector” while the other half think the 8020 is. They’re both half right.
Both 8 mm jacks are connected to the single MPPT controller in the Jackery. The 12 A maximum is a limit of the connector. This also means you’ll need balanced voltages on two panels if you connect each one into an 8 mm connector. Alternately, you can plug them in series as long as you’re under 60 V total, and then can connect to both connectors using a Y cable.

Frequently Asked Questions

Q: My panel isn’t charging the battery. Why not?
A: Any of a number of reasons:

Make sure you’ve got a DC8020 connector (“thick pin”) and not a DC7909. The pin size should be 2 mm (about 5/64") and not 0.9 mm (about 9/256").
Verify you’re getting at least 11 V from the panel.
Verify you’re not getting more than 60 V from the panel.
Make sure the power to the Jackery is turned on.
Make sure the DC8020 is pushed all the way in. It takes some force to do this, and you might bend the plastic shell of the Jackery a little. Be careful not to snap it.
Make sure you’re not in battery saver mode if your charge is already near 85%. I discovered that if you are at 84%, the solar panel won’t charge the battery in battery saver mode.
Make sure it’s not colder than 0 C (32 F) or warmer than 45 C (113 F).
If all else fails, make sure you can still charge from the wall socket.

Q: Is the solar panel connector (DC8020) center positive or center negative?
A: Center positive.

Q: I have an older Jackery and the DC8020 doesn’t fit. Why?
A: Older models used the DC7909. If you have an older Jackery, you’ll need the 0.9 mm “thin pin” connector.

Something wrong? Get in touch with me. My username is andrewmemoryblog (no “s”) on a well-known Google email provider.

More on using Uniden Sentinel BCDx36HP on Ubuntu 24.04 under Wine

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 16 Apr 2025 22:45:00 -0700

Running the Uniden Sentinel (BCD436HP/BCD536HP) programming software didn’t work on Wine when I was running on X on Ubuntu 24.04. After installing several versions of Wine with no joy, winetricksing random things, switching to the Intel non-free graphics driver, and more reinstalls than I want to remember, I finally hit upon success.

My problem was that, after I’d started the BCDx36HP.exe, I’d see a dialog box. Then the editor window would come up. And then… the editor window would disappear.

The breakthrough came when I realized I could drag the editor window as it was drawing, and it would redraw correctly and stay on the screen. However, it would redecorate from the classic look to a more modern look.

So… I turned that setting off under the Graphics tab of winecfg:

Once I’d done that, the usual instructions for using Sentinel worked.

Downloading an APK from Android

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 08 Apr 2025 21:34:29 -0700

I keep needing to search to find this, so I’ll write it down.

To download an APK from Android, you need to do the following:

adb shell pm list packages --user 0
adb shell pm path your.package.name
adb pull /data/app/your/path/to/package/foo.apk

If there are multiple APKs (base.apk, arm64_v8a.apk, etc.) it’s an Android app bundle (AAB). You get only the APKs specific to your device.

Incidentally, the publicly accessible data directory for Android apps is in /shared/Android/data/your.package.name/.

Fixing buffer bloat on OpenBSD 7.2

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Feb 2025 01:28:19 -0700

I learned a little today about buffer bloat, which is latency introduced when uploading/downloading. After that, I headed straight over to WaveForm’s buffer bloat test and got a D.

Luckily, the WaveForm page pointed me to a solution, which I found at Paul Smith’s blog.

Following Paul’s instructions, I added a Queue section to my /etc/pf.conf:

#---------------------------------#
# Queues
#---------------------------------#
queue outq on $ext_if flows 1024 bandwidth 10M max 10M qlimit 1024 default
queue inq on $lan_if flows 1024 bandwidth 225M max 225M qlimit 1024 default

then reloaded the rules:

doas pfctl -n -f /etc/pf.conf && doas pfctl -f /etc/pf.conf

I didn’t get an A, but I did move up to a C, which means I’ve at least halved the latency problem. There’s a warning in a comment on Paul Smith’s page:

“This works well if you have OpenBSD acting as a firewall/NAT appliance only, but doesn’t work if you have multiple downstream interfaces, or run any services on the OpenBSD server at all (facing either the LAN or the internet).” The commenter suggests an explict parent queue with the whole LAN bandwidth and subqueues for internet and everything else.

Anyway, I went to CloudFlare’s speed test and I’m “great.”

Converting ePub to PDF

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 07 Dec 2024 15:18:19 -0700

I bought the Michael w Lucas book Dear Abyss through the Kickstarter. When it arrived in my email inbox, Bookfunnel didn’t have an option to download it as PDF. It did, however, have an EPUB option.

Luckily, I know how to do the conversion. It took me a minute or two to remember, so this time I’m writing it down.

Install Calibre with sudo apt install calibre.
Run Calibre from the command line calibre.
Click the “Add books” button.
.
Select the ePub file.
Click the “Convert books” button.
Change the Output format to PDF in the dialog that pops up.
Click “OK”.
Calibre spins for a bit and then deposits the PDF in the library directory. In my case that was “~/Calibre Library/(author)/(title) (n)”, where n is the number of the book in the library.

And there you go — next time I’ll remember this.

Removing Copilot from Windows 10 (at least today)

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 02 Dec 2024 22:05:10 -0700

It finally happened — after my latest Windows update, I had a Copilot button on my desktop. I didn’t ask for it, didn’t want it, but Microsoft knows better than you do. Here’s my best attempt to kill it with fire.

Remove it from Edge. Open Edge, go to Settings, type Copilot, click on that and turn off “Show Copilot”.
Remove it from the task bar by clicking “Unpin from Taskbar”
Run gpedit.msc and go to User Configuration -> Administrative Templates -> Windows Components -> Windows Copilot. Open that and double-click on “Turn off Windows Copilot.” Select “Enabled”.
Make sure you have TurnOffWindowsCopilot set to 1 (DWORD 32-bit) under HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot.
Uninstall the Windows Copilot component under Add/Remove Software.
Block copilot.microsoft.com connections at DNS.

local-zone: "copilot.microsoft.com" redirect
local-data: "copilot.mircosoft.com A 127.0.0.1"

Odds are good that won’t be sufficient, but maybe that will last until Microsoft gives up on Windows 10 updates.

Adding code titles (filenames) to astro-micro-academic

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 17 Nov 2024 18:53:29 -0700

I wanted to add code titles to astro-micro-academic. I’m brand new at this so here’s instructions that a newbie can use. I’m using How to add filename to a code block in Astro blog as my guide.

First, install the remark-code-titles plugin:

$ cd ~/myblogdirectory
$ npm install remark-code-titles

Next, edit astro.config.mjs. I added this line:

import remarkCodeTitles from "remark-code-titles";

and also added

 remarkPlugins: [remarkCodeTitles],

to the markdown: section. Ultimately, my astro.config.mjs ended up looking like this:

./astro.config.mjs

import tailwind from "@astrojs/tailwind";
import { defineConfig } from "astro/config";
import { rehypeHeadingIds } from "@astrojs/markdown-remark";
import remarkToc from "remark-toc";
import { rehypeAccessibleEmojis } from "rehype-accessible-emojis";
import rehypeKatex from "rehype-katex";
import remarkMath from "remark-math";
import remarkEmoji from 'remark-emoji';
import remarkCodeTitles from "remark-code-titles";
import mdx from "@astrojs/mdx";
import sitemap from "@astrojs/sitemap";
import pagefind from "astro-pagefind";

// https://astro.build/config
export default defineConfig({
 site: "https://astro-micro-academic.vercel.app",
 integrations: [tailwind(), sitemap(), mdx(), pagefind()],
 markdown: {
 shikiConfig: {
 theme: "css-variables",
 },
 rehypePlugins: [rehypeHeadingIds, rehypeAccessibleEmojis, rehypeKatex],
 remarkPlugins: [remarkToc, remarkMath, remarkEmoji],
 remarkPlugins: [remarkCodeTitles],
 },
 server: { port: 1234, host: true}
});

Next, I needed to do something in CSS to make the headers look good. Here’s what I came up with to add to the end of global.css:

./src/styles/global.css

.remark-code-title {
 @apply border-dashed border-2 border-indigo-600;
 @apply bg-neutral-300 dark:bg-slate-800;
}

.astro-code {
 @apply mt-0;
}

Here’s how to use them:

```bash:/usr/local/bin/file
My file contents
```

or if you don’t have a file type:

```:/tmp/file
My file contents
```

Incidentally, the file types appear to be listed at github.com/jincheng9/markdown_supported_languages. (Hey, Smalltalk is a supported language! Cool!)

Some day I’ll need to look into what that site: "https://astro-micro-academic.vercel.app", implies. I think I’ll have to change it to my site when I go live.

Installing VNC on Ubuntu 24.04 with X

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 17 Nov 2024 16:51:20 -0700

After I “upgraded” to Ubuntu 24.04, I had to install X in order to use xscreensaver, since Wayland is way too immature. This meant I couldn’t use the integrated VNC, so I had to install another one. I found a good starting point at forums.bunselnabs.org. I ended up making a few changes. First, I needed VNC and xscreensaver and needed to add it to the autostart:

sudo apt install x11vnc xscreensaver
mkdir ~/.x11vnc
x11vnc -storepassword mySecretPassword ~/.x11vnc/passwd
mkdir ~/.config/autostart

Then I created files much like those from BunsenLabs. I made a few changes to get things to work and to secure them.

~/.config/autostart/x11vnc.desktop

[Desktop Entry]
Encoding=UTF-8
Type=Application
Name=X11VNC
Comment=Start the X11 VNC server
Exec=/usr/local/bin/x11vnc-start
StartupNotify=false
Terminal=false
Hidden=false

~/.config/autostart/xscreensaver-desktop

[Desktop Entry]
Encoding=UTF-8
Type=Application
Name=XSSVR
Comment=Start the X screensaver
Exec=/usr/local/bin/xscreensaver-start
StartupNotify=false
Terminal=false
Hidden=false

/usr/local/bin/xscreensaver-start

#!/bin/bash -
/usr/bin/xscreensaver -no-splash &

/usr/local/bin/x11vnc-start

#!/bin/bash -
/usr/bin/x11vnc -forever -display "$DISPLAY" -rfbauth /home/"$USER"/.x11vnc/passwd &

Set up some good permissions:

sudo chmod 600 ~/.x11vnc/passwd
sudo chmod 700 ~/.x11vnc
sudo chmod 755 /usr/local/bin/xscreensaver-start
sudo chmod 755 /usr/local/bin/x11vnc-start

Disable Automatic Screen Lock in Gnome’s Privacy settings. Configure xscreensaver with xscreensaver-settings.

Shutdown and restart to make sure it works — that you can VNC in, that VNC requires the right password, and that the screensaver comes on when expected. The autostart commands show up in Startup Applications, which is nice. I can also type capital letters on this VNC — I couldn’t do that on the 22.04 integrated VNC.

Building Emacs 29.4 on Ubuntu 22.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 24 Aug 2024 20:10:15 -0700

I recently had to rebuild Emacs to diagnose a problem. It turned out the problem wasn’t the Ubuntu Emacs build, but since I had to figure it out, I’m writing it down so I will remember next time.

Grab the GNU public keys
#

GNU has to be different. Rather than signing with some sane thing, they sign their files with gpg. 🙄 Anyway, here’s how to do that:

$ curl https://ftp.gnu.org/gnu/gnu-keyring.gpg --output gnu-keyring.gpg$ gpg --import gnu-keyring.gpg
# Yes, it just imported 552 keys.

Download Emacs and validate the signature
#

Feel free to substitute your favorite mirror for ftp.gnu.org

$ curl https://ftp.gnu.org/gnu/emacs/emacs-29.4.tar.gz.sig --output emacs-29.4.tar.gz.sig
$ curl https://ftp.gnu.org/gnu/emacs/emacs-29.4.tar.gz --output emacs-29.4.tar.gz
$ gpg --verify emacs-29.4.tar.gz.sig
emacs-29.4.tar.gz
gpg: Signature made Sat 22 Jun 2024 08:04:31 AM MST
gpg: using RSA key BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D
gpg: issuer "stefankangas@gmail.com"gpg: Good signature from "Stefan Kangas <stefan@marxist.se>" [expired]
gpg: aka "Stefan Kangas <skangas@skangas.se>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: CEA1 DE21 AB10 8493 CC9C 6574 2E82 323B 8F43 53EE
Subkey fingerprint: BB02 E407 AE9E AA87 C9E7 2A1D 2D4E 1FE9 5957 135D

I guess? that means it’s trustworthy?

Install dependencies
#

In order to build you’ll need some dependencies, so install those using apt.

$ sudo apt install libgtk-3-dev libgif-dev libgnutls28-dev texinfo

Extract, build and install Emacs
#

Next, extract the files. Then configure Emacs for your environment, build it and finally install it.

$ tar xzvf emacs-29.4.tar.gz
$ cd emacs-29.4/
$ ./configure (or use ./configure --with-x-toolkit=no if you don't want X support)
$ make clean; make
$ sudo make install (this installs emacs in /usr/local/bin)
$ /usr/local/bin/emacs
(if you want to uninstall)
$ sudo make uninstall

This build installed Emacs in /usr/local/bin, which is ahead of /usr/bin in my path, so I can have both the version I built and the package version installed at the same time. Either change your path, alias emacs=/usr/local/bin/emacs, or uninstall the Ubuntu emacs package.

Clean up
#

Once you’re done, you can remove libgtk-3-dev, libgif-dev, libgnutls28-dev and texinfo. Or keep ’em around, they won’t hurt anything.

Locking weirdness between Ubuntu, CIFS and Emacs

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 24 Aug 2024 01:37:20 -0700

I’d run into a strange problem that made working with Emacs really painful. Any time I edited a file with Emacs on my CIFS mounted drive on Ubuntu 22.04, I’d see:

Unlocking file: Invalid argument

… when I opened it. Then, when I tried to save, I’d get a message that the save failed. I couldn’t exit Emacs, even when I said to abandon changes. (The changes themselves got saved successfully.) I could kill with a SIGTERM, but that left the file locked so I couldn’t edit it again.

I tried rebuilding Emacs from source. Same issue. I suspect there’s a problem with CIFS file locking everywhere on Ubuntu, not just Emacs. Some day I’ll turf the Ubuntu built-in CIFS and go back to Samba. In the meantime, sometimes all you have is a rock when you want to pound in a nail. Adding:

;; Something weird going on with file locking on CIFS. Disable it.
(setq create-lockfiles nil)

to my ~/.emacs solved the problem.

Changing the MTA's maximum message size (postfix)

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 13 Jun 2024 23:36:45 -0700

I have a local machine that I use for backup. For the past week I haven’t been seeing status messages. Looking into my /var/log/syslog, I saw:

Jun 13 04:37:07 foureyes postfix/postdrop[138227]: warning: uid=0: File too large
Jun 13 04:37:08 foureyes postfix/sendmail[138226]: warning: mail_stream_cleanup: close error
Jun 13 04:37:08 foureyes postfix/sendmail[138226]: fatal: root(0): message file too big
Jun 13 04:37:08 foureyes CRON[138018]: (root) MAIL (mailed 12798406 bytes of output but got status 0x004b from MTA#012)

I guess that means what I’m printing out for the backup is bigger than the ~10M that the Postfix default allows. Time to do something about that:

$ postconf | grep message_size_limitmessage_size_limit = 10240000
$ sudo postconf message_size_limit=0
$ postconf | grep message_size_limitmessage_size_limit = 0

Hopefully that did it.

Setting up and using Uniden Sentinel BCDx36HP on Ubuntu 22.04 under Wine

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 15 Jan 2024 22:37:00 -0700

I finally have had success in programming my Uniden BCD436 (and would probably succeed with the Uniden BCD586 if I owned one) under Wine! This has been a problem that has persisted for ages, and now it appears that things have advanced enough that it’s possible.

Installation
#

First, uninstall Wine: (warning: this will blow away all your Wine configs, so if you use it for more than just Sentinel, save everything first)

$ sudo apt remove wine
$ sudo apt autoremove

Next, install Wine from the WineHQ repo by adding the winehq key, adding it to your list of repos, and instaling the package (these instructions come from https://wiki.winehq.org/Ubuntu):

$ sudo wget -O /etc/apt/keyrings/winehq-archive.key https://dl.winehq.org/wine-builds/winehq.key
$ sudo wget -NP /etc/apt/sources.list.d/ https://dl.winehq.org/wine-builds/ubuntu/dists/jammy/winehq-jammy.sources$ wine --versionwine-8.0.2

Install Sentinel. Download it from info.uniden.com and you’ll have a zip file with a name like: BCDx36HP_Sentinel_Version_2_xx_yy.zip

$ unzip BCDx36HP_Sentinel_Version_2_xx_yy.zip$ cd BCDx36HP_Sentinel_Version_2_xx_yy$ wine setup.exe

Follow the normal Sentinel setup procedure.

I’ve got Sentinel data files stored on my shared drive. Because of this, I had to do the following to get it reading my shared config. You probably won’t do this:

Start Sentinel and download the master database.
Exit Sentinel
cd ~/.wine/drive_c/users/_myuser_/Documents/Uniden
mv BCDx36HP BCDx36HP-old
ln -s /my/shared/uniden/data-directory BCDx36HP (this is the directory on the SMB share that contains ActivityLog, DiscoveryLog, FavoriteLists and Profile)
Start Sentinel again and confirm you can read it.
Exit Sentinel

Using Sentinel
#

I adapted these instructions from https://wiki.radioreference.com/index.php/Sentinel_(Uniden_software)#Using_Sentinel_Under_Wine

Step 1: Connect the BCD436 to your Linux device by turning it on and selecting “Mass Storage Mode” (press the E/yes key). You’ll see it automount on Linux.

Step 2: Start Sentinel by clicking on Activities in the upper left and typing bcd, then clicking on the icon:

Step 3: Cancel out of the “Run updates” dialog. Instead, run winecfg from the terminal.

Step 4: In the dialog that comes up, click the Drives tab and then use cursor down to highlight the drive letter of the /media/ path that Ubuntu used when it automounted the drive.

Step 5: Click “Show Advanced” and change the Type from “Autodetect” to “Floppy Disk”. Press “Apply” and then “OK”.

Step 6: In Sentinel, Update -> Update Firmware…

If all went well, you should see:

Step 7. Click OK. Your firmware just got updated.

At this point you should be able to Update -> Update Master Database(HPDB). You can also make changes. Once you’ve made your changes, Scanner -> Write to Scanner…

Note: the Linux driver that talks to the scanner can be very slow when writing. You’ll have plenty of time to get a coffee, especially if you select “Force Write Full Database”. Just remember to come back in time to tell Sentinel how to handle conflicts.

Step 8: When you’re done, shut down Sentinel and then unmount the device, then eject it:

Turn the radio off. Then unplug the cable. Congratulations, you’re done.

Stop "[Application]" Is Not Responding on Ubuntu 22.04/Gnome

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 28 Oct 2023 14:17:41 -0700

Since upgrading to Ubuntu 22.04, I’ve been seeing a lot more of those messages from Gnome that say:

“

\[Some Application\]

” is not responding. You may choose to wait a short while for it to continue or force the application to quit entirely.

Probably Ubuntu 22.04 takes up more resources on my underpowered mini PC. This error pops up when an app is not responsive for more than 5 seconds.

Luckily, that timeout is configurable. I’m not as impatient as the Gnome developers, so I adjusted mine to 15 seconds. In theory this gets stored so you don’t need to do anything to make it permanent:

$ gsettings get org.gnome.mutter check-alive-timeout uint32 5000
$ gsettings set org.gnome.mutter check-alive-timeout 15000

You probably don’t want to set this much below 1000 or you’re going to be dealing with lots of dialogs that block the rest of the UI.

Block Ad Sites and Nasties on OpenBSD 7.4

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 22 Oct 2023 22:03:47 -0700

One of the benefits of building your own firewall is that you get to decide what you want to block. I’d been using a list from pgl.yoyo.org/adservers. There’s a utility called Pf-badhost that blocks evil hosts. I wanted to do a little more: block bad IPs (sorry, Cloudflare, I know you hate that) and have better control over when things get updated.

So I ultimately decided to adapt some of Pf-badhost to a few scripts I created. First, a script to get the latest list of bad hostnames from pgl.yoyo.org — grab-bad-hosts.sh:

Grabbing Bad Hostnames
#

#! /bin/sh
/usr/local/bin/wget -O ./pgl-adhosts.conf 'https://pgl.yoyo.org/adservers/serverlist.php?hostformat=unbound&showintro=1&mimetype=plaintext'
grep -v -f /var/unbound/etc/unbound-whitelist-ads.txt pgl-adhosts.conf > unbound-adhosts.conf
grep -f /var/unbound/etc/unbound-whitelist-ads.txt pgl-adhosts.conf > unbound-adhosts-whitelist.conf
echo "In a root shell, run:"
echo "cat unbound-adhosts.conf > /var/unbound/etc/unbound-adhosts.conf"
echo "cat unbound-adhosts-whitelist.conf > /var/unbound/etc/unbound-adhosts-whitelist.conf"
echo "rcctl restart unbound"
echo "(or run root-update-hosts.sh as root)"

This builds two files: /var/unbound/etc/unbound-adhosts.conf and /var/unbound/etc/unbound-adhosts-whitelists.conf based on a file I created, /var/unbound/etc/unbound-whitelist-ads.txt, which I had to add to make other users happy. /var/unbound/etc/unbound-whitelist-ads.txt looks like this:

adservice.google.com[^.]
googleadservices.com[^.]

… and I’m going to set up unbound to allow one host to have the whitelisted ads.

Grabbing Bad IPs
#

I used Pf-badhost as a source of places to grab bad IP addresses from. I ended up with this script, grab-bad-ips.sh:

#! /bin/sh
/usr/local/bin/wget -O ./banlist_firehol_level1 https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset
/usr/local/bin/wget -O ./banlist_firehol_level2 https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset
/usr/local/bin/wget -O ./banlist_binarydefence https://www.binarydefense.com/banlist.txt
/usr/local/bin/wget -O ./banlist_emergingthreats https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
cat ./banlist_firehol_level1 > pf-badguys.table
printf "\n">> pf-badguys.table
cat ./banlist_firehol_level2 >> pf-badguys.table
printf "\n">> pf-badguys.table
cat ./banlist_binarydefence >> pf-badguys.table
printf "\n">> pf-badguys.table
cat ./banlist_emergingthreats >> pf-badguys.table
printf "\n">> pf-badguys.table
grep '^[0-9]' pf-badguys.table | sort | uniq > pf-badguys.table.sort.uniq
mv pf-badguys.table.sort.uniq pf-badguys.table
echo "In a root shell, run:"
echo " cat pf-badguys.table > /etc/pf-badguys.table"
echo " pfctl -F Tables -f /etc/pf.conf"
echo "(or run root-update-ips.sh as root)"

This script creates /etc/pf-badguys.table, which I’ll plug into my PF configuration.

Configuring unbound to use the bad hosts lists
#

It’s not hard to have unbound import the bad hosts, which are already formatted to redirect to 127.0.0.1. Here’s a sample from /var/unbound/etc/unbound-adhosts.conf:

local-zone: "1-1ads.com" redirect
local-data: "1-1ads.com A 127.0.0.1"

unbound-adhosts-whitelist.conf looks the same, but only contains the whitelisted ad servers. After the last local-data:/local-data-ptr: pair for my network, I added the following:

 # open a hole for ad servers
# 192.168.150.180 is unblocked desktop
access-control-view: 192.168.150.180/32 adview

After my access-control: directives, I added:

# Host addresses - spam to block
#
include: /var/unbound/etc/unbound-adhosts.conf
include: /var/unbound/etc/unbound-adhosts-whitelist.conf
include: /var/unbound/etc/unbound-adhosts-local.conf

At the end of the unbound.conf file I added:

view:
name: "adview"
include: /var/unbound/etc/unbound-adhosts.conf
include: /var/unbound/etc/unbound-adhosts-local.conf

Then a quick:

# unbound-checkconf
# rcctl restart unbound

… and I was blocking ad servers. I could update this in cron, but I prefer to do it manually every week or so.

Configuring PF to block the bad IP addresses
#

I know there’s an argument for not blocking bad IP addresses. After all, there may be legitimate sites that are hosted on the same IP address. But… so far I’ve only run into one. So I’m happy to continue blocking them. In my pf.conf, after the table, I added a table:

table <badguys> persist file "/etc/pf-badguys.table"

Then after the block for martians, I added an equivalent for badguys:

# Block addresses in the badguys table
# We use the "quick" parameter here to make this rule the last.
# Note that badguys might contain martians, but they get handled before
# this rule.
block in quick on $ext_if from <badguys> to any
block return out quick on $ext_if from any to <badguys>

Then pfctl -F Tables -f /etc/pf.conf to reread the table.

This post is part of a series on setting up an OpenBSD 7.4 firewall device.

Setting up Wireguard on an OpenBSD 7.4 firewall device

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 22 Oct 2023 21:09:01 -0700

It took me a little while after I set up my firewall device to set up Wireguard as a VPN. It’s probably something I should have done right away — the benefits of being able to log in from home (and block ads) while on the road is really nice.

Wireguard needs a publicly available IP or domain name. I used DuckDNS. I posted about that a while back so I won’t do it again here, but you’ll need to do that first.

Wireguard is in the kernel in 7.4. Prior releases required you to pkg_add wireguard_tools, but these days you don’t need to.

The way Wireguard works is that you generate public and private keys. Each device gets its own private key, and you share the public keys. Wireguard has tools to do that. On the OpenBSD firewall side:

# mkdir /etc/wireguard
# chmod 700 /etc/wireguard
# wg genkey > /etc/wireguard/private.key
# chmod 600 /etc/wireguard/private.key
# wg pubkey < private.key > public.key

Next, you need to generate private and public keys on each of your clients. Then set up /etc/wireguard/wg0.conf to contain the firewall’s private key and also the public keys of the client. I decided to do this on a completely different network — 172.16. I assigned individual IP addresses for each device. It’s a little more management headache, but makes it easy to delete something if I lose a device. The /etc/wireguard/wg0.conf looks like this:

[Interface]
PrivateKey = the private key from /etc/wireguard/private.key
ListenPort = 51820
[Peer]
# My first peer - a laptop
PublicKey = the public key from the laptop
AllowedIPs = 172.16.0.2
[Peer]
# My second peer - an Android device running Wireguard from F-Droid
PublicKey = the public key from the device
AllowedIPs = 172.16.0.3
# ... etc...

Obviously, on each device you have to do the reverse: specify the private key generated on device, and put the firewall’s public key in as the peer. Next, you need an /etc/hostname.wg0 to bring the network up:

inet 172.16.0.1 255.255.255.0 NONE up
!/usr/local/bin/wg setconf wg0 /etc/wireguard/wg0.conf

Before you can go further, you need to unblock the Wireguard interface in /etc/pf.conf:

(after the lan_if macro)
vpn_if="wg0"
vpn_port="51820"
(at the end after the NAT rules)
#---------------------------------#
# WireGuard
#---------------------------------#
pass in on $vpn_if
pass in inet proto udp from any to any port $vpn_port
pass out on egress inet from ($vpn_if:network) nat-to ($ext_if:0)

From there, you can restart pf and reload the new rules and sh /etc/netstart wg0.

This post is part of a series on setting up an OpenBSD 7.4 firewall device.

Set up networking for an OpenBSD 7.4 firewall device

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 21 Oct 2023 17:14:44 -0700

I had a few wrinkles because I’d already set up networking, and I didn’t want to have to go through and redo all my static IPs. But I wanted to make my network more rational. I had devices on 192.168.150.*/24 and I wanted something bigger, so I decided to go with /20. That gave me a range of 92.168.144.1–192.168.159.254. (I admit I used an IP subnet calculator for that.) My ISP gives me IPv4, so I’m using that and not worrying about IPv6.

First things first: let’s make the box forward packets:

# sysctl net.inet.ip.forwarding=1
# echo 'net.inet.ip.forwarding=1' >> /etc/sysctl.conf

Configure Network Adapters
#

I have two Intel NICs. I’m connecting igc0 to my cable modem. I’m connecting igc1 to a 16-port switch which is my internal network. I’ve got another network port that was autodetected, but I’m not using it yet, so I’ll remove it.

# echo "inet autoconf" > /etc/hostname.igc0
# echo "inet 192.168.144.1 255.255.240.0 NONE" > /etc/hostname.igc1
# rm /etc/hostname.igc2
# sh /etc/netstart.sh

Setting up the PF packet filter
#

Now, set up PF. I got my instructions for this mostly from home.nuug.no/~peter/pf/en/ftpproblem.html. Here’s how I edited /etc/pf.conf:

#---------------------------------#
# Macros
#---------------------------------#
ext_if="igc0"
lan_if="igc1"
ftpproxy="127.0.0.1"
ftpproxyport="8021"
#---------------------------------#
# Tables
#---------------------------------#
table <localonly> { \
# Addresses that can talk to the local network but not to the rest of the world
\
# Local printer
192.168.158.1/32 \
}
# This is a table of non-routable private addresses.
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
#---------------------------------#
# Protect and block by default
#---------------------------------#
set skip on lo0
set block-policy drop
# Spoofing protection for all NICs.
block in from no-route
block in quick from urpf-failed
# Block non-routable private addresses.
# We use the "quick" parameter here to make this rule the last.
block in quick on $ext_if from <martians> to any
block return out quick on $ext_if from any to <martians>
# Default blocking all traffic in on all LAN NICs from any computer or device
# attached.
block return in on { $lan_if }
# Default blocking all traffic in on the external NIC from the Internet/ISP,
# we'll log that too.
block drop in log on $ext_if
# Don't allow ICMP from outside. Commented out this section.
# Yeah, I know people hate that.
#
#match in on $ext_if inet proto icmp icmp-type {echoreq } tag ICMP_IN
#block drop in on $ext_if proto icmp
#pass in proto icmp tagged ICMP_IN max-pkt-rate 100/10
# We need the router to have access to the Internet, so we'll default allow
# packets to pass out from our router through the external NIC to the Internet.
pass out inet from $ext_if
#---------------------------------#
# LAN Setup
#---------------------------------#
# Allow any computer or device on the LAN to send data packets in through the NIC.
# This means any computer attached to this network interface can pass in data
# reaching anywhere, i.e. the Internet or any of the computers attached to the
# router.
pass in on $lan_if
# Always block DNS queries not addressed to our DNS server.
block return in quick on $lan_if proto { udp tcp } to ! $lan_if port { 53 853 }
# Block localonly from seeing the internet
block in quick on lan_if from <localonly>
# Allow data packets to pass from the router out through the NIC to the
# computers or devices attached to it on the lan NIC.
# Without this we can't even ping computers attached to the lan NIC from
# the router itself.
pass out on $lan_if inet keep state
#---------------------------------#
# FTP
#---------------------------------#
# allow ftp clients to work
anchor "ftp-proxy/*"
pass in quick on $lan_if inet proto tcp to port ftp divert-to $ftpproxy port $ftpproxyport
# no ftp servers so don't pass out
# pass out proto tcp from $ftpproxy to any port ftp
#---------------------------------#
# NAT
#---------------------------------#
pass out on $ext_if inet from $lan_if:network to any nat-to ($ext_if)

Then you can test things out and restart pf. I think my network connection dropped at this point:

# pfctl -n -f /etc/pf.conf
# pfctl -F all
# pfctl -f /etc/pf.conf

Configure dhcpd
#

Now I need to configure serving IPs from this machine. (My old firewall is still on the network at this point and serving real IPs as well as doing DNS, but I need to get the new firewall enabled.) So time to edit /etc/dhcpd.conf:

# $OpenBSD: dhcpd.conf,v 1.1 1998/08/19 04:25:45 form Exp $
#
# DHCP server options.
# See dhcpd.conf(5) and dhcpd(8) for more information.
#
# This is for 192.168.144.* to 192.168.159.*
subnet 192.168.144.0 netmask 255.255.240.0 {
option domain-name "lan.example.net";
option domain-name-servers 192.168.144.1;
option routers 192.168.144.1;
########################################
# Dynamic IP addresses
########################################
range 192.168.145.1 192.168.149.254;
########################################
# Fixed IP machines that humans don't
# (normally) see - WAPs etc.
########################################
host wap {
hardware ethernet dc:9f:44:11:22:33;
fixed-address 192.168.144.13;
}
########################################
# Fixed IP machines that humans see.
########################################
# These are machines I normally ssh
# or telnet to, or run servers on.
#
host fileserver {
hardware ethernet 22:33:44:55:66:77;
fixed-address 192.168.150.171;
option host-name "fileserver";
}
host weather {
hardware ethernet 88:99:00:AA:BB:CC;
fixed-address 192.168.150.177;
option host-name "weather";
}
#... etc...
# I'm putting my laptop on a non-150 address for testing purposes.
# That way I can plug it into the server and get a DHCP address that
# should route on to the internet.
host laptop {
hardware ethernet 00:22:44:66:88:ff;
fixed-address 192.168.161.2;
}
} # subnet

Next, start serving DHCP:

rcctl enable dhcpd
rcctl start dhcpd

At this point I could plug my laptop into the new firewall and get an IP address.

Start Unbound for DNS
#

On my old firewall I was using bind. That was heavyweight, so I decided to do something different here. Originally I thought I needed NSD and Unbound for DNS (I was looking at some instructions at jamsek.dev/blog/2019/Jul/28/openbsd-dns-server-with-unbound-and-nsd/) but eventually realized I could get away with just unbound.

# rcctl enable unbound
# rcctl start unbound

Next, I changed my DNS server so the new firewall was getting it locally instead of going to the old firewall. In /etc/resolv.conf:

nameserver 127.0.0.1
lookup file bind

After that, configure DNSSEC:

# unbound-anchor -a "/var/unbound/db/root.key"
# ftp -S do -o /var/unbound/db/root.hints https://www.internic.net/domain/named.root

With root.key downloaded, I could set up my /var/unbound/etc/unbound.conf:

# $OpenBSD: unbound.conf,v 1.21 2020/10/28 11:35:58 sthen Exp $
server:
interface: 192.168.144.1
interface: ::1
# override the default "any" address to send queries; if multiple
# addresses are available, they are used randomly to counter spoofing
access-control: 0.0.0.0/0 refuse
access-control: ::0/0 refuse
access-control: 127.0.0.0/8 allow
access-control: 192.168.144.0/20 allow
access-control: ::1 allow
hide-identity: yes
hide-version: yes
# Perform DNSSEC validation.
#
auto-trust-anchor-file: "/var/unbound/db/root.key"
root-hints: "/var/unbound/db/root.hints"
qname-minimisation: yes
val-log-level: 2
# Synthesize NXDOMAINs from DNSSEC NSEC chains.
# https://tools.ietf.org/html/rfc8198
#
aggressive-nsec: yes
# Serve zones authoritatively from Unbound to resolver clients.
# Not for external service.
#
local-zone: "lan.example.net." static
#
# Host addresses - infrastructure
#
local-data: "firewall.lan.example.net. IN A 192.168.144.1"
local-data-ptr: "192.168.144.1 firewall.lan.example.net"
#
# Host addresses - named servers
#
local-data: "fileserver.lan.example.net. IN A 192.168.150.171"
local-data-ptr: "192.168.150.171 fileserver.lan.example.net"
local-data: "weather.lan.example.net. IN A 192.168.150.177"
local-data-ptr: "192.168.150.177 weather.lan.example.net"
# ... etc...
remote-control:
control-enable: yes
control-interface: /var/run/unbound.sock

With all that set up, I could make sure I didn’t have any syntax errors and restart unbound:

# unbound-checkconf
# rcctl restart unbound

I think it was at this point that I made the switch from using the old firewall to the new firewall. I changed the new firewall to have the same MAC as the old one (my ISP wanted to see a specific MAC) and then put the new one in place:

# echo "inet autoconf lladdr 11:22:33:44:55:66" > /etc/hostname.igc0
# sh /etc/netstart

Having two devices with the same MAC is a Bad Thing, and I had a lot of weirdness on my network until I unplugged the old firewall.

This post is part of a series on setting up an OpenBSD 7.4 firewall device.

Setting up an OpenBSD 7.4 Firewall Device

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 15 Oct 2023 23:59:39 -0700

My PC Engines ALIX running the (mumble) version of OpenBSD has been a great firewall. But now that it looks like PC Engines is wrapping up, it’s time to find something new. For a while I’ve suspected that the ALIX is a little underpowered. It’s harder to find 4G CF cards these days. Plus I want something with a HDMI port so I can put it on a KVM switch and don’t need to worry about serial port speeds.

So… here’s the order of operations:

Here goes!

Installing OpenBSD 7.4 for a Firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 15 Oct 2023 23:45:00 -0700

Installing OpenBSD 7.4 was pretty simple. I followed the OpenBSD installation guide and used dd on a Linux box to write install74.img to a USB stick. Don’t use the .iso, it doesn’t boot. Then I booted off the USB stick. (You don’t have to disable UEFI.) I used a standard layout

At the time I wondered if I should install all the packages or not. I decided that maintenance would be simpler if I just went for everything, so I added all the packages including X. That turned out to be the right decision.

I used a relatively standard partitioning scheme, although I think I bumped up a few of the sizes. I probably should have bumped up X11R6 more, right now it’s at 41%:

/dev/sd0a 986M /
/dev/sd0l 295G /home
/dev/sd0d 291M /tmp
/dev/sd0f 5.8G /usr
/dev/sd0g 986M /usr/X11R6
/dev/sd0h 19.4G /usr/local
/dev/sd0k 5.8G /usr/obj
/dev/sd0j 2.9G /usr/src
/dev/sd0e 34.4G /var

Set up doas
#

After installing, I set up doas ‘cause I like seatbelts:

$ su
# vi /etc/doas.conf
permit persist andrewmemory as root
permit persist keepenv root as root

Install patches and packages
#

After that I installed patches:

$ doas syspatch
$ doas shutdown -r now

Next I installed a few useful packages:

$ doas pkg_add -i emacs mutt firefox wget

I picked the -no_x11 version for emacs, and the normal (not gpge, not sasl, not slang) version for mutt. I’m not going to be mailing to the world from this box, just looking at local emails. I also installed Firefox, which turned out to be another good idea. It’s a lot easier to search for doc on the firewall box itself than to ssh in.

Set up mfs for /tmp
#

Finally, I’m paranoid about wearing out my SSD, so I set up /tmp to be mfs in /etc/fstab using the useful instructions from Solene Rapenne:

$ doas vi /etc/fstab
#f1ea06b71e2dca43.d /tmp ffs rw,nodev,nosuid 1 2
swap /tmp mfs rw,nodev,nosuid,-s=300m 0 0

… and I had to boot to single-user mode to fix up permissions for /tmp:

$ doas umount /tmp
$ doas chmod 1777 /tmp
$ doas mount /tmp

Apparently tmpfs has been removed because it’s not supported, so mfs it is. I’ve got plenty of RAM for a /tmp file system, but I have delusions of putting most of /var in its own mfs file system, so I restricted /tmp to 300M.

Once that was done, I could log into a few other machines on my network to establish fingerprints for them. I also tested X by running startx, and then firefox, and it worked.

There were some noisy beeps
#

By default, OpenBSD rings the bell when you mistype certain things. That was annoying other people in the house, so I had to shut those up. That took two things. In ~/.login I added:

/sbin/wsconsctl keyboard.bell.volume=0

Then, I created ~/.xsession and added:

/usr/X11R6/bin/xset b off

This post is part of a series on setting up an OpenBSD 7.4 firewall device.

Buying new hardware for an OpenBSD firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 15 Oct 2023 23:30:53 -0700

I knew going in that I wanted more than two ethernet ports for my OpenBSD firewall device. I had visions of multiple networks and/or a spare port that I could use when I screwed up my pf configuration. I also knew that I wanted HDMI so I could pop the firewall on my KVM switch - I’d used serial to the APU2 and that was not always wonderful. The Linux box would sometimes forget about the serial ports when they were plugged in for a while.

In the end, I got a random Intel N5105 mini-PC with four Intel ethernet ports. The HUNSN Micro Firewall Appliance, Mini PC, VPN, Router PC, Intel N5105, HUNSN RJ03, AES-NI, 4 x Intel 2.5GbE I226-V LAN, Type-C, TF, M.2 WiFi 6 Slot, Barebone, NO RAM, NO Storage, NO System was around $250 US. Add a Western Digital NVMe 500G drive and 16G of Cruical laptop RAM and I had something on which I could install a system. It’s low-powered enough that I don’t mind keeping it running 24/7, and high-powered enough that I’m not worried about it being a bottleneck.

[

I learned afterwards that the I226-V might potentially have a problem if you want to do 2.5G ethernet. So far, I haven’t experienced any network instability because of that.

As a belt-and-suspenders kind of thing, I bought a “silent” USB fan that sits on top of the case, just because the server room can get a little warm.

This post is part of a series on setting up an OpenBSD 7.4 firewall device.

Setting up DuckDNS on OpenBSD

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 20 May 2023 15:59:54 -0700

Well, that was easy. I’ve been thinking about setting up WireGuard on my firewall. That will give me ad blocking by default as well as a way into my system when I want to do something. But… that means I need a way to know what my external IP is. Dynamic DNS to the rescue!

I looked around at the providers, and DuckDNS appears to be the one whose ideology aligns most closely to mine. I went to their “Install” page and they don’t have OpenBSD. But they have something close — linux bsd cron. So I adapted their script to use OpenBSD’s ftp (which, despite its name, does https as well) instead of curl, which isn’t in the base OpenBSD distribution.

#!/bin/sh -
# Update the DNS at duckdns.org with my IP
DOMAINS="mydnshost" # comma-separated, just the hostnames, not the FQDNs
TOKEN="badcafe-dead-beef-b001-fa11ca2eba3e" # from DuckDNS
tmpfile=`/usr/bin/mktemp /tmp/duckdns.XXXXXXXXXX`
if [ $? -ne 0 ]; then
/usr/bin/logger -i -p daemon.err "duckdns update failed, couldn't create temp file"
exit 1
fi
/usr/bin/ftp -d -o $tmpfile "https://www.duckdns.org/update?domains=${DOMAINS}&token=${TOKEN}"
return_val=$?
url_out=`/bin/cat $tmpfile`
/bin/rm $tmpfile
if [ $return_val -eq 0 ]; then
if [ $url_out == "OK" ]; then
/usr/bin/logger -i -p daemon.info "duckdns update ok"
else
/usr/bin/logger -i -p daemon.info "duckdns update failed: $url_out"
fi
else
/usr/bin/logger -i -p daemon.err "duckdns update failed, returned: $return_val"
fi

Note that this doesn’t account for multiple external WANs, something I want to do in the future. It also requires IPv4. There are ip= and ipv6= parameters if you want IPv6 or a different address for different WANs.

Then all I had to do was chmod 700 and stick it in a cron file:

crontab -e
~/15 * * * * ~/duckdns/duckdns >/dev/null 2>&1

Now I can get my IP anywhere. (I’m using ~/15 instead of */15 so I don’t get 503s when everyone else decides it’s time to update.)

Logging into Ubuntu 22.04 Remote Desktop

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 16 Jan 2023 16:54:36 -0700

I’d set up and configured remote desktop on my Ubuntu desktop machine, but when I tried logging in from Windows I always saw an error (“An authentication error has occurred. The token supplied to the function is invalid”):

mstsc

Luckily I found this Ubuntu bug with the workaround: use .\username instead of username because Microsoft is defaulting to something stupid.

Update: That was interesting. It works until the screen locks. Luckily there’s an extension for Gnome that lets you set up remote desktop to allow you to log in when the screen’s locked.

Ubuntu 22.04 logs not rotating

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 26 Nov 2022 15:56:40 -0700

I happened to look at my /var/log and discovered that it was completely full! How’d that happen?

It looks as if 22.04 broke log rotation. So the log files just keep growing until they max out the device and then stop. Yay Ubuntu!

I did a couple of things - first was to expand the size of my log device (I’m using log2ram)

# sudo emacs /etc/log2ram.conf
SIZE=120M

Next, change how much the journal keeps:

# sudo emacs /etc/systemd/jourlnald.conf
SystemMaxUse=40M

Clear out the journal:

# sudo journalctl --vacuum-size 40M

Then I went looking for the problem. Luckily, two other people had run into this and documented it on StackOverflow. I tried the same test:

# sudo logrotate /etc/logrotate.d/rsyslog --debug

and saw the same results:

error: skipping "/var/log/syslog" because parent directory has insecure permissions (It's world writable or writable by group which is not "root")
Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

And then made the same change to almost everything in /etc/logrotate.d (alternatives apport bootlog btmp dpkg log2ram ppp sane-utils ufw wtmp) and to each I added to the config file (before the monthly, weekly, daily - right at the top):

# sudo emacs (one of the following: alternatives apport bootlog btmp dpkg log2ram ppp sane-utils ufw wtmp)
su syslog syslog

Then make sure they all work:

sudo logrotate /etc/logrotate.d/alternatives --debug
sudo logrotate /etc/logrotate.d/apport --debug
sudo logrotate /etc/logrotate.d/bootlog --debug
sudo logrotate /etc/logrotate.d/btmp --debug
sudo logrotate /etc/logrotate.d/dpkg --debug
sudo logrotate /etc/logrotate.d/log2ram --debug
sudo logrotate /etc/logrotate.d/ppp --debug
sudo logrotate /etc/logrotate.d/sane-utils --debug
sudo logrotate /etc/logrotate.d/ufw --debug
sudo logrotate /etc/logrotate.d/wtmp --debug

Finally, clear out all the emacs droppings because otherwise logrotate will still try to run them:

sudo rm /etc/logrotate.d/*~
sudo rm /etc/logrotate.d/\#*
sudo rm /etc/systemd/journald.conf~
sudo rm /etc/log2ram.conf~

And… that’s it, I hope!

ssh unable to negotiate

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 28 Aug 2022 22:24:49 -0700

My upgrade to Ubuntu LTS 22.04.1 from 20.04 was pretty smooth, but I ran into one issue. When I tried to ssh to a few other boxes around the network, I saw:

Unable to negotiate with 192.168.1.x port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

Looks like I need to upgrade my ssh server on some machines. But I can’t do that if I can’t ssh to them! So I added a couple of lines to my /etc/ssh/ssh_config instead:

HostKeyAlgorithms ssh-rsa,rsa-sha2-512,rsa-sha2-256
PubkeyAcceptedKeyTypes ssh-rsa,rsa-sha2-512,rsa-sha2-256

I’ll need to undo that once I fix the server, but until then I can log into it.

Merging multiple PDFs

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 24 Jul 2022 17:25:34 -0700

I’d recently downloaded a bunch of separate PDFs that I wanted to turn into a handy file that I could carry around. After grabbing the PDFs, I merged them with:

$ pdfunite *.pdf really-big-output.pdf

PDFUnite is part of Poppler, so be sure to:

$ sudo apt install poppler-utils

… if you don’t have it already. That’s it!

Building TQSL 2.6.4 for Ubuntu 20.04 (or TQSL 2.6.5 for Ubuntu 22.04)

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 26 Jun 2022 23:28:10 -0700

It’s the day after Field Day, and I’m too lazy to grab my old laptop that has TQSL and FLDigi on it to enter my logs. So I decided to install FLDigi and TQSL on my desktop machine instead.

Bad news, though: Ubuntu has an outdated version of TQSL, and the ARRL doesn’t provide a package for Ubuntu. Boo. However, building it was pretty painless, with only a few attempts. The result:

The machine I started with already had a basic development environment. But if yours doesn’t, you’ll probably need to grab a few things first:

$ sudo apt install make cmake gcc libappimage-dev

Next you need to download the latest file from arrl.org/tqsl-download and stash it somewhere on your filesystem. The day I tried it, the latest was tqsl-2.6.4.tar.gz. So…

$ tar xzvf tqsl-2.6.4.tar.gz
$ cd tqsl-2.6.4

I was happy to see a nice linux-make-appimage.sh script ready for consumption. If you look at the INSTALL file (which I didn’t) you’ll see you need to install a few prerequisites. I didn’t bother downloading them, but just used the ones that were already built for Ubuntu:

$ sudo apt-get install libssl-dev liblmdb-dev libdb-dev libexpat1-dev libcurl4-openssl-dev libwxgtk-media3.0-gtk3-dev libzlcore-dev
$ sh ./linux-make-appimage.sh

After a few false starts (yes, it clones the repo every time you try to build) I ended up with a pretty TQSL-x86_64.AppImage in my build directory. I wanted to run that from the command line, so I did the following:

$ sudo apt remove trustedqsl # need to make sure the old package isn't there
$ sudo cp TQSL-x86_64.AppImage /usr/local/bin/TQSL_2.6.4-x86_64.AppImage
$ sudo chmod 555 /usr/local/bin/TQSL_2.6.4-x86_64.AppImage
$ sudo ln -s /usr/local/bin/TQSL_2.6.4-x86_64.AppImage /usr/local/bin/tqsl

That left me with a tqsl symbolic link pointing to /usr/local/bin/TQSL_2.6.4-x86_64.AppImage in /usr/local/bin (which is on my $PATH). That’s it!

Oh yeah, after all that I ended up having to boot the old laptop anyway. I needed to extract my old TQSL config (exported to tqslconfig.tbk) in order to import it to this version. When importing the preferences I got an error message about an unknown token, but it worked anyway… and I got the same message when importing into a Windows build that the ARRL created. Go figure.

I didn’t need to re-import my certs - they were already there.

Changes for TQSL 2.6.5
#

Looks like they broke the AppImage build in TQSL 2.6.5. If I try it on Ubunutu 22.04, I get:

ERROR: Icon entry missing in desktop file: AppDir/usr/share/applications/tqsl.desktop

So instead of the sh ./linux-make-appimage.sh above, I did the following:

$ cd /wherever you put it/tqsl-2.6.5
$ cmake .
$ make

And then created a shell script /usr/local/bin/tqsl to run tqsl from where I’d built it:

#!/bin/bash -
cd /wherever you put it/tqsl-2.6.5/apps
./tqsl

You can’t just copy the binary because it needs some libraries that it builds as well. I tried make install but that’s broken on Ubuntu 22.04 as well. Don’t forget:

$ sudo chmod 550 /usr/local/bin/tqsl

Setting up Ubuntu 20.04 LTS

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 30 Oct 2021 02:07:06 -0700

I recently had the chance to set up Ubuntu on several different hard drives I iterated through. I’ve come up with a procedure that seems to work for me to set up my environment the way I like it.

# Get started
sudo apt install emacs meld cifs-utils samba-common nfs-client hardinfo default-jre
### Done
# Configure git
git config --global user.email "andrewmemory@example.com"
git config --global user.name "Doctor Memory"
git config --global core.autocrlf input
git config --global credential.helper cache --timeout=36000
git config --global diff.tool meld
### Done
# Swizzle userids
# as andrewmemory
sudo adduser andrewmemorybackup
# edit /etc/group and replace andrewmemory with andrewmemory,andrewmemorybackup
# change andrewmemory to 3000
# change sambashare to 3001
# as andrewmemorybackup
sudo vipw
cd /home/
sudo chown -R andrewmemory.andrewmemory andrewmemory
# while we're here, let's put us in dialout
sudo usermod -a -G dialout andrewmemory
sudo usermod -a -G dialout andrewmemorybackup
### Done
# Set up CIFS credentials
credentials directory in /etc/samba/credentials
700
file in /etc/samba/credentials/server
user=andrewmemory
password=secret
### Done
# Add to /etc/fstab:
tmpfs /tmp tmpfs size=512m 0 0
tmpfs /var/tmp tmpfs size=512m 0 0
//server.example.com/music /music cifs x-systemd.automount,uid=3000,gid=3001,credentials=/etc/samba/credentials/server,sec=ntlmssp 0 2
server.example.com:/shared /shared nfs4 defaults,user,exec 0 2
server.example.com:/shared /nfsshared nfs4 defaults,user,exec 0 2
### Done
# Get most of the packages
sudo apt install \
emacs \
git \
nfs-client \
cifs-utils \
samba-common \
hardinfo \
default-jre \
gnucash \
gcc \
abcde \
audacity \
imagemagick \
bind9-dnsutils \
net-tools \
brasero \
bsdutils \
bzip2 \
cdparanoia \
default-jdk-headless \
dnsutils \
dos2unix \
dosfstools \
e2fsprogs \
easytag \
evince \
exfat-fuse exfat-utils \
ffmpeg \
filezilla \
flac \
toilet \
toilet-fonts \
flatpak \
font-manager \
fontmatrix \
ftp \
g++ \
gawk \
gdb \
genisoimage \
ghostscript \
gnuplot \
growisofs \
icc-profiles-free \
icc-profiles \
keepassx \
lame \
make \
meld \
ntpdate \
ntp \
obs-studio \
openscad \
patch patchutils \
ps2eps psmisc pstoedit psutils \
python3 \
rsync \
sharutils \
sntp \
splat \
tcl tk \
unrar unzip zip \
vice \
vorbis-tools \
wget \
wine-stable \
whois \
xz-utils
### Done
sudo apt remove rhythmbox; sudo apt autoremove
### Done
# TeXlive
sudo mkdir /usr/local/texlive
sudo chown andrewmemory.andrewmemory /usr/local/texlive
cd /shared/archive/apps/TeX/TeX2021/TEXCOL2021/texlive
./install-tl --gui
# default paper size Letter
### Done
# TeXstudio
sudo apt --no-install-recommends install texstudio
### Done
# Gimp
flatpak install https://flathub.org/repo/appstream/org.gimp.GIMP.flatpakref
cp /shared/backup-home/usr.bin.gimp ~
# Where usr.bin.gimp is just a call to
# flatpak run org.gimp.GIMP//stable "$@"
sudo cp ~/usr.bin.gimp /usr/bin/gimp
sudo chmod 755 /usr/bin/gimp
cp /shared/gimp/*.scm ~/.var/app/org.gimp.GIMP/config/GIMP/2.10/scripts
### Done
# KiCAD
sudo add-apt-repository --yes ppa:kicad/kicad-5.1-releases
sudo apt update
sudo apt install --install-recommends kicad
# If you want demo projects
sudo apt install kicad-demos
### Done
# Firefox
# Disable sharing info
# Under Downloads, "Always ask where to save files"
# Under Startup, "Restore previous session"
# Under Data Collection, uncheck all
### Done
# any crontabs? - no
### Done
# ltspice - executable called LTspice.exe - install under wine
# there are links on the desktop, some config under /home/andrewmemory/andrewmemory/.wine/drive_c/Program Files/LTC/
# FontForge
# Go to https://fontforge.org/en-US/downloads/gnulinux-dl/
# See if there's anything newer than 2020-11-07
# if there is, get it, otherwise copy from /shared/backup-home/home/andrewmemory/andrewmemory
cp /shared/backup-home/home/andrewmemory/andrewmemory/FontForge-2020-11-07-21ad4a1-x86_64.AppImage ~
### Done
# the AppImages: under /home/andrewmemory/andrewmemory (or get the latest)
FreeCAD_0.18-16146-Linux-Conda_Py3Qt5_glibc2.12-x86_64.AppImage
# Android Studio
sudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i386 lib32z1 libbz2-1.0:i386 openjdk-11-jdk
sudo add-apt-repository ppa:maarten-fonville/android-studio
sudo apt update
sudo apt install android-studio
# Install KVM
sudo apt install cpu-checker
kvm-ok
# Assuming it's OK:
sudo apt-get install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils
sudo adduser andrewmemory libvirt
sudo adduser andrewmemory kvm
sudo adduser andrewmemorybackup libvirt
sudo adduser andrewmemorybackup kvm
sudo chmod u+x /var/run/libvirt/libvirt-sock
sudo chmod g+x /var/run/libvirt/libvirt-sock
# Reboot
sudo chmod 755 /opt
cd /opt/android-studio/bin
./studio.sh
# Update everything...
# Open project /shared/development/AndroidStudioProjects/
# Tools -> Create Desktop Entry
# File -> Settings
# Install Android SDK Command-line Tools, Google Play services
# Accept licenses
yes | ~/Android/Sdk/cmdline-tools/latest/bin/sdkmanager --licenses
# Build -> Rebuild Project
# ... go away for 30 minutes (!)
# Click "Select a JDK" in the event log and pick /opt/android-studio/jre
# Tools -> AVD Manager
# Create Pixel 4a, Download Android 30
# Settings -> Memory Settings, choose IDE Max Heap 2048M
#
# Just so I can build projects with the shared keys I used before:
cd ~
cp /shared/backup-home/debug.keystore ~/.android/
### Done
# Arduino
# Download from https://www.arduino.cc/en/software
# Extract the .tar.gz (currently in Downloads)
tar xf arduino-1.8.16-linux64.tar.xz
cd arduino-1.8.16/
sudo ./install.sh
# Need to install libraries as well...
# Set up environment
# /home/andrewmemory (with VISUAL, EDITOR, etc...)
# at the end of ~/.bashrc put:
export VISUAL=/usr/bin/emacs
export EDITOR=$VISUAL
export PATH=/usr/local/texlive/2021/bin/x86_64-linux:$PATH
# Log out and back in
### Done
# Set up log2ram (I probably should have done this earlier)
echo "deb http://packages.azlux.fr/debian/ buster main" | sudo tee /etc/apt/sources.list.d/azlux.list
wget -qO - https://azlux.fr/repo.gpg.key | sudo apt-key add -
sudo apt update
sudo apt install log2ram
# To control: sudo systemctl stop log2ram
# To uninstall: sudo apt purge --remove log2ram
### Done
# Don't forget the udev rules for things I did...
# Fonts
sudo apt install fonts-noto fonts-noto-extra fonts-noto-mono
# Manually install:
# /shared/fonts/*.?tf
### Done
# Also manually install brscan / brother stuff
# go to https://www.brother-usa.com/support/mfcl2750dw
# Download linux-brprinter-installer-2.2.3-1.gz
gunzip -d linux-brprinter-installer-2.2.3-1.gz
sudo bash ./linux-brprinter-installer-2.2.3-1 MFC-L2750DW
# Specify DeviceURI? I said "No", although it says to say "Yes" for network.
### Done
# Thunderbird
thunderbird -ProfileManager
# create a "Default User" profile and an "andrewmemory network" profile
# exit Thunderbird
# edit ~/.thunderbird/profiles.ini and set the andrewmemory network profile to:
Name=andrewmemory network
IsRelative=0
Path=/shared/thunderbird/andrewmemory
# I also set Default=/shared/thunderbird/andrewmemory
thunderbird -ProfileManager
# Set to open andrewmemory network by default
### Done
# GnuCash
# Start GnuCash
# Click Cancel
# Open /shared/accounts/accounts.gnucash
# Expand Accounts and click on Checking Account
# View -> Transaction Journal
### Done
# Set up my static IP
ifconfig
# eno1 says ether 00:01:02:03:04:05
ssh root@firewall
# delete the lease from /var/db/dhcpd.leases
ps -aux | grep dhcp
# Kill /usr/sbin/dhcpd
rw
emacs /etc/dhcpd.conf
host newhost {
hardware ethernet 00:01:02:03:04:05;
fixed-address 192.168.1.2;
option host-name "newhost";
}
# save
cd /var.named/named/etc/namedb
emacs db.example
newhost.example.com. IN A 192.168.1.2
# update serial number
# save
emacs db.example.rev
2.1.168.192.in-addr.arpa. IN PTR newhost.example.com.
# update serial number
# save
reboot ### On firewall, not on the desktop!
# wait a bit until you can ssh into firewall again
# reboot the desktop
ifconfig
# verify that the IP address is right
sudo apt install openssh-server
### Done
# Cura
# Install latest Cura .appImage in ~ from
# https://ultimaker.com/software/ultimaker-cura
# Create (non-networked) Creality Ender 3 with default options
# Open Marketplace, go to Plugins, install OctoPrint Connection
# Quit and restart Cura ~/Ultimaker*
# Load a model and slice
# Settings -> Extruder 1 -> Materials -> Manage Materials
# Create 3D Solutech PLA as a copy of Generic PLA, set cost, weight
# I just used 1000g because... that's what it started out as
# Set Print Settings build plate temp to 60 C
# Create Hatchbox PLA as a copy of 3D Solutech PLA
# Settings -> Printers -> Creality 3 -> Manage Printers
# Turn on octopi.example.com
# Connect Ocotoprint
# Add octopi - octopi.example.com - 80 - /
# Request API key
# Log into OctoPrint
# Select "Start print job after uploading" and "Connect to printer before sending". Deselect the rest.
# Uncheck "Automatically discover local OctoPrint instances"
# Settings -> Setting Visibility -> Check All
# For each profile: Profiles -> Customize
# Z Seam Alignment = Randomize
# Preferences -> General -> Currency ($)
# Opening and saving files -> Unselect "Add machine prefix to job name"
# Uncheck "Send anonymous print information"
### Done
# OpenSCAD
# There's a setting under "Advanced" that lets you undock. Enable that.
### Done
- "rss-feed"

Setting up NFS on Ubuntu 20.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 30 May 2021 14:11:18 -0700

I have been experiencing random weirdness with CIFS on Ubuntu 20.04. Every now and then the current working directory will disappear. I can usually get things back to normal by “cd ..; cd myDir” but that’s a pain - more of a pain when a build has failed because the current directory evaporated on the Gradle script.

So I decided to try NFS. Setting up NFS is not too hard. I found a very useful page on LinuxConfig.org that got me 90% of the way there.

Server setup

In short, on the server:

$ sudo apt install nfs-kernel-server
$ sudo systemctl enable --now nfs-server

Then edit /etc/exports on the server to include the line:

/myshareddisk 192.168.1.0/8(rw,sync,no_subtree_check)

It looks as if there’s no easy way for NFS to handle DHCP unless the file server can look up the IP. Boo. Going onward and knowing my network is now less protected:

$ sudo exportfs -arv

At this point, the LinuxConfig.org instructions start pointing you to server configuration. However, there’s a vital step omitted - pretty much every sane app will fail with “no locks available.” Why? StackExchange to the rescue. Enabling NFS doesn’t enable rpc-statd.

$ sudo systemctl enable rpc-statd
$ sudo systemctl start rpc-statd

As the StackExchage article says, “Thanks, systemd!”

Client setup

Next you can set up the client:

$ sudo mount -t nfs4 my-server-fqdn:/myshareddisk /localmnt

Hey, it mounted, and it looks like a file system. Now anyone on my network can mount my NFS server! Exposing it to ransomware and all sorts of excellent things like that. Err… good?

Last step is to make it automount on the client by editing /etc/fstab:

my-server-fqdn:/myshareddisk /localmnt nfs4 defaults,user,exec 0 2

I’m really unsure about this, and may need to undo it or at least find a way to stop it advertising to everyone. But it’s that way for now.

Mounting a partition from a raw disk image

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 28 Nov 2020 15:20:55 -0700

In the past I’d backed up an SD card with

dd if=/dev/sdc of=mydisk.img

Now I wanted to get something off of it. However, the SD card had two partitions on it. I wondered if there was a more elegant way to get data out than just writing it to another SD card. Turns out, there is! There’s a great post at dustymabe.com/2012/12/15/mounting-a-partition-within-a-disk-image that explains how to do it.

sudo losetup -v -f mydisk.img sudo losetup -a

This gives me the /dev/loop* device that my image is mounted as. In my case, it was /dev/loop18. Next, I could use partx to create loop devices for the partitions:

sudo partx -v --add /dev/loop18

This created /dev/loop18p1 through /dev/loop18p(however many partitions I had). Once those partitions have been created, you can mount them like any other partition on a regular block device. Once you’re done,

sudo partx -v --delete /dev/loop18

will get rid of both the device and its partitions.

Annealing PLA in powdered salt using sous vide

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 31 Oct 2020 03:53:26 -0700

Stefan of CNC Kitchen recently posted about annealing (and later re-melting) PLA prints to improve their strength and temperature resistance. I decided to do some experiments of my own.

My method was to print out some PLA objects, pack them in a salt powder that gets vacuum-sealed, and then toss that in the sous vide for 18 hours. The sous vide doesn’t get hot enough to re-melt PLA, so it doesn’t have exactly the same characteristics, but it does gain some benefit. The advantage to the sous vide method is that it’s more available than a constant-temperature oven.

I did informal tests on the annealed prints for a few characteristics:

Smoothing - did the texture of the print change?
Strength between layers - was the print any stronger between layers?
Waterproofing - did the print eventually get waterlogged when placed in water?
Temperature resistance - did the print get as flexible when subjected to increased temperatures as a non-annealed print?

Procedure
#

I used four objects: a hollow spheroid, a 30x5x5 mm bar, a calibration cube, and a box with tabs that were oriented perpendicular to the layers. I ground up plain (uniodized) salt in a spice mill, and put that into a FoodSaver bag that was double-sealed at the bottom. Relative humidity when I sealed the bag was around 33%.

I nestled my prints in the salt, then vacuum-sealed the bag and double-sealed the top.

Sealed in the bag. The salt prevented sharp edges from poking holes.

Next, I tossed the bag in a pot of water along with an Anova Nano sous vide stick. I set the temperature for 80 C (176 F) and left it that way for 18 hours.

Cooking at 80 C

After that, I turned the sous vide stick off and let the pot come to room temperature.

Observations
#

When I removed the salt from the bag, it had formed a solid mass that could be broken apart by hand. I carefully extracted the printed objects. The box lid and letters on the calibration cube letters were packed with salt, but that could be washed out easily.

I measured most of the objects, and found that they had indeed changed size - all were a few percent smaller than before annealing. So I knew annealing did something:

Print	Original dimension (mm)	After annealing (mm)	Change (as % of original)
Calibration cube X	20.13	19.98	99.3
Calibration cube Y	20.08	19.89	99.1
Calibration cube Z	20.15	19.98	99.2
Spheroid diameter	20.08	19.78	98.5
Spheroid height (Z)	24.82	24.72	99.6
Bar length (X)	30.23	30.06	99.4
Bar width (Y)	5.14	5.06	98.4
Bar height (Z)	5.00	4.95	99.0

Results
#

Tabs broke off just as easily after annealing

Smoothing: unlike Stefan’s experiments with PLA re-melting, the annealed objects did not change texture. The plastic still showed the same layer lines and other 3D printer artifacts that non-annealed prints did. I attribute that to the fact that the plastic never flowed - the annealing temperature was always below the melting point.
Strength: when I assembled the box, the tabs broke off exactly as they had when I printed non-annealed PLA using the “wrong” orientation. I couldn’t measure it, but I don’t think annealed PLA was any stronger between layers.
Waterproofing: after immersing the spheroid in water for a week, it seemed to sink a little lower, but then stop. I don’t think I’d want to claim that annealing changed the waterproofing of the prints.
Temperature resistance: this did appear to change. I put both the annealed and non-annealed bar prints on the printer bed at 73 C (163 F). After a few minutes, the non-annealed bar was flexible enough that it could be bent between my fingers. In contrast, the annealed print remained solid, and in fact snapped when I applied more pressure.

The non-annealed part was flexible after heating to 73 C. The annealed part was not.

Conclusion
#

Annealing sous vide is useful for imparting temperature resistance to PLA, and may be a valuable technique for PLA objects that need to live in a hot environment (such as a car in the summertime). Sous vide annealing is easier and more reliable than trying to anneal in a kitchen oven. Annealing alone does not change texture, strength between layers or waterproofing characteristics.

Persistent serial ports on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 30 Jun 2020 01:12:11 -0700

Last time I rebooted my file server (which has a couple of serial devices attached), it picked the wrong ones for /dev/ttyUSB0 and /dev/ttyUSB1. That meant the speeds (which I’d configured in minicomrc files) were wrong.

I needed to make the serial ports persistent. Again with the udev rules!

Luckily, there was a handy page at: indilib.org/support/tutorials/157-persistent-serial-port-mapping.html

with what I needed to know. I ended up adding two rules in /lib/udev/rules.d/99-serial-aliases.rules: # portal SUBSYSTEMS=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", ATTRS{serial}=="AM00NPHK", MODE="0666", SYMLINK+="ttyPortal" # wally SUBSYSTEMS=="usb", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", ATTRS{serial}=="0130D901", MODE="0666", SYMLINK+="ttyWally"

I got these values by running lsusb -v (which in truth gives you everything you need to know) and: udevadm info -a -n /dev/ttyUSB0 | grep serial | head -1 and udevadm info -a -n /dev/ttyUSB1 | grep serial | head -1 on my two serial ports. (I could also grep idProduct and idVendor, but lsusb gave me the right ones already.)

Then delete (sigh) /lib/udev/rules.d/99-serial-aliases.rules~ that Emacs left over. Cause it gets read if you don’t. Sigh. I always forget.

After that a quick: sudo udevadm control --reload-rules sudo udevadm trigger and I had my /dev/ttyPortal and /dev/ttyWally. Now to fix up those minicom configs…

Finding the characteristic impedance of an antenna cable

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 24 May 2020 16:29:11 -0700

I recently stumbled on a cool video that showed how to compute the impedance of an antenna cable. Unfortunately it’s almost five minutes long, so I thought I’d summarize:

Measure the capacitance of the cable when it’s open (C) in farads (F).
Short one end.
Measure the inductance of the cable from the non-shorted end (L) in henrys (H).
Impedance (Z) = √(L/C) in ohms (Ω).

It works for both coaxial cables and ladder line. Neat trick!

Fixing a busy CP210x serial device on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 05 Apr 2020 21:04:06 -0700

I had the opportunity to reorganize my local machines. As part of that, I wanted to plug my firewall’s serial port into USB serial and pop that into my server. I have a CP2104 serial device that I bought with my PC Engines apu2 which I use for a firewall.

The USB serial device worked fine when plugged into my Windows 8 laptop, but I want my server to be able to connect to my firewall even when the network is down. Because the apu2 is headless, it’s nice to have something that’s plugged into a monitor when I need to fix things.

I plugged the USB serial port in, and tried to connect to my firewall with minicom. I got this instead:

$ minicom
minicom: cannot open /dev/ttyUSB0: Device or resource busy

So, time to look at who has /dev/ttyUSB0 open:

$ sudo lsof | grep ttyUSB0
gpsd 416 root 3u CHR 188,0 0t0 176 /dev/ttyUSB0

Ok, why is gpsd holding /dev/ttyUSB0 open? It’s true I have a GPS attached to my server, but that runs as /dev/ttyACM0 and has nothing to do with /dev/ttyUSB0. Hmm… time to search and find this in the gpsd FAQ: Why does GPSD open non-GPS USB devices?

That made me suspicious. See, gpsd is trying to be too friendly - and to do that, it opens a whole bunch of possibly GPS devices even if they’re not GPS devices! Could that be my problem?

$ lsusb
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 008 Device 003: ID 10c4:ea60 Cygnal Integrated Products, Inc. CP210x UART Bridge / myAVR mySmartUSB light
Bus 008 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 040: ID 1546:01a7 U-Blox AG
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

Hmm… let’s take a peek in /lib/udev/rules.d/60-gpsd.rules:

... blah blah blah...
# Cygnal Integrated Products, Inc. CP210x Composite Device (Used by Holux m241 and Wintec grays2 wbt-201) [linux module: cp210x]
ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="gps%n", TAG+="systemd", ENV{SYSTEMD_WANTS}="gpsdctl@%k.service"
... more blah...

So in an effort to detect the Holux m241 and Wintec grays2 wbt-201, it’s matching the vendor and product ID of my CP2104 serial device as well! Luckily, I don’t have any of those GPS devices, so a quick snip:

# Cygnal Integrated Products, Inc. CP210x Composite Device (Used by Holux m241 and Wintec grays2 wbt-201) [linux module: cp210x]
# commented out because it interferes with Andrew's PC Engines 2104 USB serial cable
#ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="gps%n", TAG+="systemd", ENV{SYSTEMD_WANTS}="gpsdctl@%k.service"

was all it took. Now my USB serial device shows up as a serial device, and is not held open by a GPS daemon.

I have to disagree with the GPSD FAQ’s statement, “It’s not a problem we can solve with clever programming, the devices simply don’t yield enough information about themselves to avoid conflicts.” Err, no… clever programming would have the user run through an install procedure which involved plugging the device in, and detecting the device. Then they could update the udev rules so that only the device that a user owned was stolen by gpsd, and not all serial devices on the planet that happened to match a vendor/product ID that they knew about.

Programing with a PICkit 2 on Linux

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 08 Jan 2020 23:17:28 -0700

I recently bought a PICkit 2 clone (the ICA03) from PICCircuit.com. Programming it has been something of a challenge, mostly because Microchip no longer really supports Linux programming of PIC chips.

First, I needed to get pk2cmd. There are lots of pointers to Microchip’s website, but all of them go to 404s. What I ended up using is a github repo: https://github.com/psmay/pk2cmd. After reading the threatening license agreement, I cloned the repo and built it with make then sudo make install.

git clone https://github.com/psmay/pk2cmd
cd pk2cmd/pk2cmd
make linux
sudo make install

Even after installing PK2DeviceFile.dat in /usr/share and including /usr/share/pk2 on the path (ugh) per the instructions, I still wasn’t able to use it from anywhere except the directory I built it from. At some point I’ll need to look into that.

I plugged the PIC into the ZIF socket with the marking near the top, and made sure the selection switch was on 28-40.

Next, I took my .hex file and stuffed it in ~/pk2cmd/pk2cmd/. Then:

~/pk2cmd/pk2cmd$ sudo pk2cmd -P
Auto-Detect: Found part PIC16F886.

Yay! Let’s try writing the file:

~/pk2cmd/pk2cmd$ sudo ./pk2cmd -PPIC16F886 \
-f my_hex_file.hex -MPC -Y

(I didn’t include IE on the -M switch because I think my hex file has ID and EEPROM memory in it. -Y does the verification.)

PICkit 2 Program Report
8-1-2020, 23:12:12
Device Type: PIC16F886
Program Succeeded.
PICkit 2 Verify Report
8-1-2020, 23:12:12
Device Type: PIC16F886
Verify Succeeded.
Operation Succeeded

Yay!

Mapping a USB volume knob into a keyboard on Linux for SDR

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 16 Dec 2019 00:21:10 -0700

I recently discovered the existence of USB volume knobs. A Reddit user posted an article about reflashing the firmware on one to convert it to a keyboard.

Inspired, I picked one up for $18 on eBay ("USB Volume Controller Knob Adjuster Switcher for Tablet PC Speaker Audio") and thought that I might be able to do something similar.

It turns out, under Linux, this is pretty easy.

First, I plugged in the volume knob and saw that Linux detected it correctly and used it to adjust the volume. That was a promising start. I could see it show the “HDMI / DisplayPort” volume - and it went up when I turned the knob to the right, down when I turned the knob to the left, and muted when I pressed the knob.

Next, I wanted to see what events were being generated. I found some very useful instructions at https://yulistic.gitlab.io/2017/12/linux-keymapping-with-udev-hwdb/ and did them:

$ cat /proc/bus/input/devices
...
I: Bus=0003 Vendor=0483 Product=572d Version=0111
N: Name="STMicroelectronics USB Volume Control"
P: Phys=usb-0000:00:1d.0-1.7.2.4.3.1/input0
S: Sysfs=/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.7/2-1.7.2/2-1.7.2.4/2-1.7.2.4.3/2-1.7.2.4.3.1/2-1.7.2.4.3.1:1.0/0003:0483:572D.0008/input/input14
U: Uniq=2070363C4250
H: Handlers=kbd event8
B: PROP=0
B: EV=13
B: KEY=3800000000 e000000000000 0
B: MSC=10
...

This showed me a few useful things:

The device vendor for my device is 0483 (the “I:” line)
The product ID for my device is 572d (also on the “I:” line)
The device is attached on /dev/input/event8 (on the “H:” line)

So now I could scan the events that came across when I moved the knob:

$ sudo evtest /dev/input/event8
Input driver version is 1.0.1
Input device ID: bus 0x3 vendor 0x483 product 0x572d version 0x111
Input device name: "STMicroelectronics USB Volume Control"
Supported events:
Event type 0 (EV_SYN)
Event type 1 (EV_KEY)
Event code 113 (KEY_MUTE)
Event code 114 (KEY_VOLUMEDOWN)
Event code 115 (KEY_VOLUMEUP)
Event code 163 (KEY_NEXTSONG)
Event code 164 (KEY_PLAYPAUSE)
Event code 165 (KEY_PREVIOUSSONG)
Event type 4 (EV_MSC)
Event code 4 (MSC_SCAN)
Properties:
Testing ... (interrupt to exit)
Event: time 1576479720.245227, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00e9
Event: time 1576479720.245227, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 1
Event: time 1576479720.245227, -------------- SYN_REPORT ------------
Event: time 1576479720.253248, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00e9
Event: time 1576479720.253248, type 1 (EV_KEY), code 115 (KEY_VOLUMEUP), value 0
Event: time 1576479720.253248, -------------- SYN_REPORT ------------
Event: time 1576479722.325231, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00ea
Event: time 1576479722.325231, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 1
Event: time 1576479722.325231, -------------- SYN_REPORT ------------
Event: time 1576479722.333224, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00ea
Event: time 1576479722.333224, type 1 (EV_KEY), code 114 (KEY_VOLUMEDOWN), value 0
Event: time 1576479722.333224, -------------- SYN_REPORT ------------
Event: time 1576479724.381251, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00e2
Event: time 1576479724.381251, type 1 (EV_KEY), code 113 (KEY_MUTE), value 1
Event: time 1576479724.381251, -------------- SYN_REPORT ------------
Event: time 1576479724.389251, type 4 (EV_MSC), code 4 (MSC_SCAN), value c00e2
Event: time 1576479724.389251, type 1 (EV_KEY), code 113 (KEY_MUTE), value 0
Event: time 1576479724.389251, -------------- SYN_REPORT ------------

Neat, even more useful things. In particular:

When I turn the knob to the right, I get an MSC_SCAN event of type c00e9 (along with a KEY_VOLUMEUP event)
When I turn the knob to the left, I get an MSC_SCAN event of type c00ea (along with a KEY_VOLUMEDOWN event)
When I push on the knob, I get an MSC_SCAN event of type c00e2 (along with a KEY_MUTE event)
Apparently the firmware supports KEY_NEXTSONG, KEY_PREVIOUSSONG and KEY_PLAYPAUSE as well. Huh.

I want to map those MSC_SCAN events to different key codes. In particular, I want a cursor-left key when I turn the knob to the left, a cursor-right key when I turn the knob to the right, and something useful (say, pressing the “m” key) when I press the knob. So I created a hwdb file for my device:

$ cat /etc/udev/hwdb.d/99-usb-knob.hwdb
evdev:input:b*v0483p572D*
KEYBOARD_KEY_c00ea=left
KEYBOARD_KEY_c00e9=right
KEYBOARD_KEY_c00e2=m

You’ll recognize the vendor (0483) and the device (572d) that I found earlier. It’s important to use uppercase hex codes for vendor and product in the hwdb file - but not for the scan codes, which should be lowercase. The values on the right have to be lowercase, and correspond to the KEY_LEFT, KEY_RIGHT and KEY_M values from /usr/include/linux/input-event-codes.h. (You can pick any of the KEY_ values from there.) Then a quick bit of Linux magic to update the hardware database:

$ sudo systemd-hwdb update
$ sudo udevadm trigger

…and… exactly the same as before. I got the volume control displayed when I turned the knob.

After scratching my head and doing some searching, I happened on https://catswhisker.xyz/log/2018/8/27/use_vecinfinity_usb_foot_pedal_as_a_keyboard_under_linux/ which gave me the clue I needed. My knob was being detected, but not as a keyboard - so it wasn’t being used as a keyboard input device.

So I created this file:

$ cat /etc/udev/rules.d/99-usb-knob.rules
ACTION=="add|change", KERNEL=="event[0-9]*",
ATTRS{idVendor}=="0483", ATTRS{idProduct}=="572d",
ENV{ID_INPUT_KEYBOARD}="1"

(That’s all on one line on my machine.) You’ll recognize the vendor and product ID from earlier, using lowercase for the hex this time. I added ID_INPUT_KEYBOARD to the list of attributes for this device. Unplug the device, plug it back in, and hooray! I’m doing what I wanted to! When I turn the knob left, I go left. When I turn the knob right, I go right. When I press the knob, “m” shows up on the screen.

Now I just need to install an SDR program… and an SDR….

Updating OpenBSD

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 12 Aug 2019 01:56:06 -0700

OpenBSD has a few different mechanism to update, depending on what the update is for.

For packages: pkg_add -u

For the kernel and base system: syspatch

For firmware: fw_update

All of these need to get run with doas if you’re not root.

Finally, if you’re moving from one version to another: sysupgrade sysmerge pkg_add -u

Using an esp32 as an iBeacon

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 04 Aug 2019 17:07:31 -0700

I recently discovered the esp32, which is an interesting device that has Bluetooth as well as wifi built in. That got me thinking about setting one up as an iBeacon.

First, I added my board in the File->Preferences->Additional Boards Manager URLs: https://dl.espressif.com/dl/package_esp32_index.json was what I needed.

My next move was to install the 1.0.1 version of ESP32 BLE Arduino by Neil Kolban. Tools->Manage Libraries-> Select 1.0.1 and click Install.

From there, the BLE iBeacon example should be available. Under “Examples from Custom Libraries” you’ll File->Examples and under “Examples from Custom Libraries” you’ll see ESP32 BLE Arduino->BLE_iBeacon.

Strangely, this example gets the BLE ID backwards according to my scanner app. It looks as if there might be a fix in the latest (1.0.1-dev) source, but for now I just enter my UUID backwards. On the line

#define BEACON_UUID "00112233-4455-6677-8899-aabbccddeeff" // UUID 1 128-Bit

I use instead:

#define BEACON_UUID "ffeeccdd-bbaa-9988-7766-554433221100" // UUID 1 128-Bit

Thanks to C, I didn’t need to do the two’s complement of the signal power myself:

 oBeacon.setSignalPower(-58);

Finally, I was getting advertising packets for multiple things (including an old test I’d tried). I had to erase the flash:

esptool.py --chip esp32 --port /dev/ttyUSB0 erase_flash

and then re-download in order to have only my iBeacon transmitting.

Changing the search bar text outside of Thunderbird

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 29 Jun 2019 00:22:20 -0700

I run Thunderbird on a shared Samba drive. Because of that, it crashes. I know, it’s not supported. But I want to be able to load the profile from multiple clients - one at a time - and can live with it.

Frustratingly, sometimes it doesn’t crash. That means every time I start Thunderbird, the text in the search bar is the thing I searched for back in 2018. I finally got annoyed enough at that to figure out how to change it.

In the Thunderbird profile is a file called session.json which includes what the last session state was. Inside that is the “quickFilter”, which determines what the filter shows. Mine was:

{"quickFilter":{"filterValues" : {"text" : {"text" : "thing I didn't want to search for anymore", "states" : {"sender" : true, "recipients" : true, "subject" : true, "body" : false}}, "results" : 8}, "visible" : true}} I replaced “thing I didn’t want to search for anymore” with "" and life was good. Incidentally, I usually want to quick filter by sender, recipients, subject but not body - you can set all those with the appropriate booleans.

If you never want to see the quick filter, “visible” : false is your friend.

Finding out which disk is which on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 09 Jun 2019 00:44:05 -0700

My file server often has various disks swapped in and out. It can get confusing which /dev/sd? corresponds to which drive. While reading the man page of findfs, I stumbled on this:

The complete overview about filesystems and partitions you can get for example by:
  lsblk –fs
  partx –show
  blkid

These three things (along with judicious use of e2label and the other *label commands) is going to make my life a lot easier!

Fixing Brother printing on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 15 Mar 2019 18:14:10 -0700

Since moving to Ubuntu 16.04.3, printing to my Brother MFC-J650DW printer has been broken. I can print fine, but it’s always offset by a bit, never where it should be on the page.

Turns out this is a bug and there’s a workaround. So I don’t forget next time I set up printers:

lpadmin -p "Brother_MFC_J650DW" -o pdftops-renderer-default=pdftops

Changing AllStar screen resolution

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 25 Dec 2018 20:20:17 -0700

The Problem
#

I recently became interested in AllStarLink, and had a HamVoip image installed on a Raspberry Pi. (I was using “RPi2-3 includes 3B+ Image Version 1.5rc19”.)

The AllStarLink image booted to 1366x768, which was the screen’s default resolution. However, the screen itself was a 7 inch HDMI screen. That was hard to read.

Things that didn’t work
#

I decided to change the resolution by editing /boot/cmdline.txt. My first attempt was to add:

framebuffer_width=720
framebuffer_height=400

before the root= line at the beginning of the file. That resulted in a kernel panic:

Kernel Panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

After a while, I realized that root= had to come first. Then I tried:

root=/dev/mmcblk0p2 rw rootwait bcm2708_fb.fbwidth=720 bcm2708_fb.fbheight=400
console=ttyAMA0,115200 console=tty1 selinux=0 plymouth.enable=0
smsc95xx.turbo_mode=N dwc_otg.lpm_enable=0 kgdboc=ttyAMA0,115200 elevator=noop
hdmi_safe=1
hdmi_group=1
hdmi_mode=1

but my cmdline.txt values seemed to be ignored.

Finally I wised up: apparently when the Pi reads the root line it starts booting, ignoring everything after it in cmdline.txt. So, I had to pass the video size as a kernel parameter instead.

I did:

cat /proc/cmdline

and saw:

8250.nr_uarts=0 bcm2708_fb.fbwidth=1366 bcm2708_fb.fbheight=768
bcm2708_fb.fbswap=1 vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000
root=/dev/mmcblk0p2 rw rootwait console=ttyS0,115200 console=tty1 selinux=0
plymouth.enable=0 smsc95xx.turbo_mode=N dwc_otg.lpm_enable=0 kgdboc=ttyS0,115200 elevator=noop

The Solution
#

(For Linux / AllStarLink newbies: in order to get to the terminal, I picked menu item 9 - open a bash shell.)

I went into /boot/cmdline.txt with a text editor:

nano /boot/cmdline.txt

and inserted the following two parameters on the existing line that begins with “root=”:

bcm2708_fb.fbwidth=720 bcm2708_fb.fbheight=400

I put these right after the rootwait parameter, so in /boot/cmdline.txt I now had:

root=/dev/mmcblk0p2 rw rootwait bcm2708_fb.fbwidth=720 bcm2708_fb.fbheight=400
console=ttyAMA0,115200 console=tty1 selinux=0 plymouth.enable=0
smsc95xx.turbo_mode=N dwc_otg.lpm_enable=0 kgdboc=ttyAMA0,115200 elevator=noop

(Note that root line is all one long line - not broken up with line separators!)

Once I did that and saved it, the Raspberry Pi booted up in glorious 80x25 text. Now we could read it!

Let me know (mail me) when there's an error

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 05 Sep 2018 23:42:04 -0700

I’ve got a shell script where I’d like to know when an error happens. Typically when that happens, something gets written to stdout or stderr - and I’d like to see that. But when things are just peachy, I don’t want to be bothered.

Here’s an easy way to achieve that. At the beginning of my script, I have:

WEATHEROUT=`/bin/mktemp`
WEATHERERR=`/bin/mktemp`

(Did I mention this is a script for a weather station? Yep.)

Then in the body of the script, I have:

/usr/local/bin/do-the-thing > ${WEATHEROUT} 2> ${WEATHERERR}
/usr/local/bin/do-the-other-thing >> ${WEATHEROUT} 2>> ${WEATHERERR}

Finally, at the end of the script, there’s:

if [ -s ${WEATHERERR} -o -s ${WEATHEROUT} ]; then
cat ${WEATHEROUT} ${WEATHERERR} | /usr/bin/mail -s "Weather command error" me@myaddr
fi

That’s all!

Ubiquiti AP enters reset state but never leaves

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 20 Jul 2018 13:11:31 -0700

I did something dumb recently. I had a network failure at my ISP, so I had to kill my dhclient and restart it. After restarting, everything seemed cool - until I reset my Ubiquiti AP. At that point, the AP entered the “Restarting” state and never came out.

After a few minutes of poking around on the Ubiquiti management screen, I saw this:

Apparently I killed off my DHCP server too. Oops.

One restart of the DHCP server later, my AP was back online (it detected when the DHCP server started). Some day I really should put the AP on its own static IP. That’s what I get for being lazy…

What's up with mod_security and User-Agent? (406 Not Acceptable)

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 01 May 2018 21:25:32 -0700

So… what’s the deal with mod_security and User-Agent? I tried to browse to HandheldRadio.net using Lynx, and was greeted with this 406 error:

 Not Acceptable
An appropriate representation of the requested resource / could not be
found on this server.
Additionally, a 406 Not Acceptable error was encountered while trying
to use an ErrorDocument to handle the request.

A few searches and I discovered this was due to Apache mod_security.

I don’t get it. Why would you exclude based on User-Agent? That’s something that can be changed at will by any program that decides to be nefarious. This seems like security theatre rather than real security.

Even in the best case, this kind of “security” just turns into a red queen’s race to the bottom where everything will now lie about what it is because someone screwed up a config file somewhere.

And so I’ve started lying (in my .bashrc):

alias lynx='lynx -useragent="Mozilla/5.0 (X11; Ubuntu Lynx; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0"'

Damn, that’s stupid.

Setting a user and group for Samba drives

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 14 Apr 2018 21:06:43 -0700

The last time I tried to set a user and password on my Samba drive, I ran into a strange problem: even though my credentials were correct, I was still using the user and group I was logged in as, rather than the one I’d stored with the Samba config.

Luckily, these days there’s an easy way around it in /etc/fstab:

//mysvr/music /music cifs uid=1000,gid=1000,credentials=/etc/samba/credentials/mysvr

Simply adding the uid= and gid= lines fixed up the problem for me.

What the hell, Gnome? Canonical?

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 01 Jan 2018 23:00:29 -0700

Today when I started working on my desktop, I saw a crash in gom-media-tracker. What? Why is there a media tracker on my desktop?

I learned this is part of Gnome (what? Why is there a media tracker in Gnome?) and it’s included in Ubuntu 16.04 LTS (why is Canonical including tracking software in Ubuntu?)

Screw that. I removed it.

$ sudo apt remove gnome-online-miners
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be REMOVED:
gnome-documents gnome-online-miners gnome-photos ubuntu-gnome-desktop
0 upgraded, 0 newly installed, 4 to remove and 0 not upgraded.
After this operation, 6,472 kB disk space will be freed.
Do you want to continue? [Y/n] y
dpkg: warning: files list file for package 'fonts-gfs-complutum' missing; assuming package has no files currently installed
(Reading database ... 493027 files and directories currently installed.)
Removing ubuntu-gnome-desktop (0.58.3) ...
Removing gnome-documents (3.18.3-0ubuntu0.16.04.1) ...
Removing gnome-photos (3.18.2-1) ...
Removing gnome-online-miners (3.14.3-1ubuntu2) ...
Processing triggers for libglib2.0-0:amd64 (2.48.2-0ubuntu1) ...
Processing triggers for man-db (2.7.5-1) ...
Processing triggers for hicolor-icon-theme (0.15-0ubuntu1) ...
Processing triggers for gnome-menus (3.13.3-6ubuntu3.1) ...
Processing triggers for desktop-file-utils (0.22-1ubuntu5.1) ...
Processing triggers for bamfdaemon (0.5.3~bzr0+16.04.20160824-0ubuntu1) ...
Rebuilding /usr/share/applications/bamf-2.index...
Processing triggers for mime-support (3.59ubuntu1) ...
$

Now that I’ve done that, I don’t appear to have lost anything I use. (Why is an optional packages forcing other packages out?)

I don’t want random tracking software on my machine.

wiki.gnome.org/Projects/Tracker, you suck. Gnome, you suck. Canonical, you suck.

Updating to the latest TeX on Ubuntu 16.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 20 Nov 2017 16:42:26 -0700

I had problems running the TeXLive package manager tlmgr on my Ubuntu 16.04 LTS install. Apparently the package manager changed formats in 2016, so the version that is included with Ubuntu is out of date (and presumably so is TeX/LaTeX).

Luckily, there’s a repo with the latest TeX as described here: tipsonubuntu.com/2016/09/16/install-tex-live-2016-ubuntu-16-04-14-04/

In short, if you have TeX already installed, do this:

sudo add-apt-repository ppa:jonathonf/texlive sudo apt update; sudo apt upgrade

After that you’ll run into the following bug: bugs.debian.org/cgi-bin/bugreport.cgi?bug=824137 You’ll need to do the following to get around it: sudo apt -f remove texlive-base texlive-fonts-recommended texlive-latex-extra texlive-latex-recommended texlive-pictures texlive-pstricks texlive-base-bin prosper texlive-fonts-recommended-doc texlive-fonts-extra-doc texlive-latex-base texlive-generic-recommended texlive-latex-base-doc texlive-latex-extra-doc texlive-latex-recommended-doc texlive-pictures-doc texlive-pstricks-doc tipa sudo apt install texlive-base texlive-fonts-recommended texlive-latex-extra texlive-latex-recommended texlive-pictures texlive-pstricks texlive-base-bin prosper texlive-fonts-recommended-doc texlive-fonts-extra-doc texlive-latex-base texlive-generic-recommended texlive-latex-base-doc texlive-latex-extra-doc texlive-latex-recommended-doc texlive-pictures-doc texlive-pstricks-doc tipa

After that, you should be running the latest TexLive.

Upgrading Mythbuntu from Trusty to Xenial

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 25 Jun 2017 16:35:29 -0700

Yesterday I took the plunge and upgraded my Mythbuntu install from Trusty to Xenial. Except for a few heart-stopping moments, it went smoothly.

Things I wish I’d known about the upgrade
#

There’s a bug with upgrading MySQL when you have the Mythbuntu tweaks installed. As a result, the upgrade fails to install MySQL properly - and then everything looks broken. Ouch. You can find out more about the defect here. The symptom is the message “\[ERROR\] unknown variable ’table_cache=128’ " which scrolls off the screen when you do an upgrade (or dpkg –configure -a). The fix is to change

table_cache = 128

table_open_cache = 128

in /etc/mysql/conf.d/mythtv-tweaks.cnf.

During the upgrade, I got prompted for which user to use for the database. (With the recommendation to use “root” if you don’t thoroughly understand the permissions models.) But of course “root” didn’t work. What did work was the default, debian-sys-maint.
After install, lirc didn’t work. I uninstalled lirc using Mythbuntu Control Center and rebooted; that appeared to fix things and now my Streamzap remote is being detected as a keyboard device with the appropriate mappings. (I get a warning about a plugin using MCC, but hey, it seems to work.)
Next, I got warnings using apt. Probably due to the upgrade failure, I had a file called 50unattended-upgrades.ucf-old left over in /etc/apt/apt.conf.d. Nuking that fixed things.
It looks as if mythfrontend and mythbackend are using different users now. I’m not sure why, but some day I’ll need to go through and fix permissions / unify those two users.
I had to go into mythtv-setup and assign directories for music and music art. (Since I didn’t have an art directory, I created one under my music directory. That seems to work.)
Probably as a result of the botched upgrade, mythweb was broken. I installed php7.0-mysql, then removed/installed mythweb and it was working again.
Finally, I tried to look into mythconverg. In this release the admin user is debian-sys-maint, and the password for that user is stored in /etc/mysql/debian.cnf.

US coin values by weight

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 06 Feb 2017 23:57:10 -0700

One thing that it’s often wise to have for emergencies is a handful of change. If you’re stuck somewhere where there’s nothing to eat but vending machine goodness, it might mean the difference between having a meal or not.

But if you bring change, what sort of change should you bring? Going strictly by weight, the $1 coin is the best value for weight right now. But there’s one drawback to that: some vending machines don’t take $1 coins. So what should you carry if you want to get maximum snacks?

The US Mint has a list of US coin weights as part of their specifications. That tells you what you need to know. Here’s a table based on the weight of mint condition coins (coins lose mass as they get used):

Coin Value ($)	Coin Weight (g)	Weight (g) for $1
0.01	2.5	250.0
0.05	5.0	100.0
0.10	2.268	22.68
0.25	5.670	22.68
1.00	11.34	11.34

That reveals some interesting facts.

Nickles weigh exactly 5 g each
Two pennies weigh the same as one nickle
$10 in nickels or $4 in pennies weigh 1 kg
Quarters and dimes have the same value by weight
Dollar coins are twice as valuable as quarters and dimes by weight

So if you’re on a road trip and plan to dine at the automat, grab your dollar coins first, then your dimes and quarters. Skip the nickles (unless you think that you’ll have to weigh something — it might be handy to have a few 5g weights around). And there’s a reason that only zinc producers like pennies.

Dockerizing TicketsCAD

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 04 Jan 2017 23:10:52 -0700

Over the recent holiday, I decided to teach myself about Docker by using it to build a running TicketsCAD system. It turned out to be pretty slick. Here’s what I did.

TicketsCAD is a PHP application that requires an SQL backend. It does computer dispatching for public safety answering points (PSAPs). Yes, I have weird hobbies.

When I first started, I grabbed the official Docker PHP image, then tried to customize it by installing a MariaDB server. But that turned out to be a bad idea. (It’s certainly possible, but not the right thing to do.) After a little while, I did a search for “Docker philosophy”, which brought me to this page: techblog.constantcontact.com/devops/a-tale-of-three-docker-anti-patterns which set me straight. The right way to do what I wanted to do was to have two separate (but linked) Docker container instances - one with the web server and PHP (customized the way I wanted) and the other with the SQL database. So here’s what I came up with.

Grab TicketsCAD
#

I grabbed the files from the TicketsCAD download area: tickets_3.12A_082516.

Next I created a directory for everything. In that, I put a directory for the ticketscad server (I cleverly called it ticketscad) and another directory for the ticketscad SQL server (even more cleverly called ticketscadmariadb). Then I created var-www-html in ticketscad, and untarred the TicketsCAD files into it.

Dockerfile for TicketsCAD
#

Here’s the first Docker file (named Dockerfile in the ticketscad directory).

FROM php:7.0-apache
# Set the timezone
RUN echo Canada/Eastern > /etc/timezone && dpkg-reconfigure -f \
noninteractive tzdata
# get PHP GD libraries
RUN apt-get update && apt-get install -y \
libfreetype6-dev \
libjpeg62-turbo-dev \
libmcrypt-dev \
libpng12-dev \
&& docker-php-ext-install -j$(nproc) iconv mcrypt \
&& docker-php-ext-configure gd \
--with-freetype-dir=/usr/include/ \
--with-jpeg-dir=/usr/include/ \
&& docker-php-ext-install -j$(nproc) gd
# Install Mariadb client
RUN apt-get install mariadb-client -y
RUN docker-php-ext-install mysqli pdo pdo_mysql
# Fix permissions for ticketscad
RUN chown -R www-data.www-data /var/www/html
RUN chmod -R u+w /var/www/html

From top to bottom, here’s the explanation.

I used the official PHP Docker build with Apache from hub.docker.com. There were some issues with TicketsCAD and PHP 7.1, so I went down to PHP 7.0. (Docker made this very easy to do.)
I set the timezone. This is a bit of Docker weirdness - there’s no standard way in Linux to set timezones, so you need to know how to do it in the distribution you’re using. This is how to do it in the PHP distribution. More details about timezones are at www.ivankrizsan.se/2015/10/31/time-in-docker-containers
I installed the PHP GD libraries. This is stolen from the PHP Core Extensions section of PHP on hubs.docker.com, and it installs a few other things I probably don’t need (mcrypt, etc.) I just copied and pasted.
I installed the MariaDB client and PHP SQL extensions.
TicketsCAD wants to write to /var/www/html and its subdirectories, so I made them rw. (I’m not sure how that makes me feel about security - I’d kind of prefer it not to do that and to store configuration somewhere not visible to the world. But that’s how it works.)

Now that I had that running, I needed a SQL backend. Luckily, there’s an official MariaDB Docker build as well. The Dockerfile for this is so simple that I almost don’t need it, but hey, I had a directory created already, so here it is:

Dockerfile for MariaDB
#

FROM mariadb:10.1
RUN echo Canada/Eastern > /etc/timezone && dpkg-reconfigure -f \
noninteractive tzdata
RUN chown -R mysql.mysql /var/lib/mysql

Pretty self-explanatory. I don’t know for sure that I need that chown, but it doesn’t hurt.

docker-compose.yml
#

I built a docker-compose.yml in my parent directory. This is a way to start both instances at the same time.

version: '2'
services:
ticketscadmariadb:
build: ./ticketscadmariadb
image: ticketscadmariadb:1.0
volumes:
- ./ticketscadmariadb/var-lib-mysql:/var/lib/mysql
ports:
- "3306:3306"
environment:
- MYSQL_ROOT_PASSWORD=secret
- MYSQL_DATABASE=ticketscaddb
- MYSQL_USER=ticketscaduser
- MYSQL_PASSWORD=ticketscadpassword
ticketscad:
build: ./ticketscad
image: ticketscad:1.0
volumes:
- ./ticketscad/var-www-html:/var/www/html
ports:
- "8080:80"
links:
- ticketscadmariadb

There’s a lot in there. I’ll break it down.

I’m using version 2 of the docker-compose.yml file format. Gotta say so.
First I specified the way to build ticketscadmariadb. I pointed to the subdirectory that holds the Dockerfile and gave it an image name.
I exposed the directory on my local machine that will hold the MariaDB database. (It’s /var/lib/mysql on the Docker instance; I called it var-lib-mysql in the ticketscadmariadb directory on my local machine.) Why did I do this? So the SQL database would persist across Docker rebuilds. Needless to say, I created an empty var-lib-mysql under ticketscadmariadb on my local system.
I exposed the MariaDB SQL port (3306) and mapped it to 3306 on my local machine. If you have SQL running on your local machine already, you’ll need a different local port.
I specified a bunch of environment variables for MariaDB. The MariaDB Docker image is smart enough to know that if it sees those variables, it creates a database with the specified name / user / password / root user. Thanks, MariaDB Docker image! (You’ll probably want different passwords than I used.)
Now it’s time for the TicketsCAD image (PHP/Apache server). I pointed to the ticketscad subdirectory (which holds the Dockerfile) and gave it an image name.
I mapped the /var/www/html directory on my Docker image to ./ticketscad/var-www-html on my local machine. Why not just COPY? Because TicketsCAD writes to /var/www/html and /var/www/html/incs, and I want that to persist across builds.
I exposed port 80 on the Docker image as port 8080 on my local machine.
Finally, I told Docker that I want to be able to have the ticketscad image talk to the ticketscadmariadb image using the links: command. (If I didn’t do this, the two images wouldn’t be able to communicate.)

Building and running
#

So now everything’s set up. At this point, I can go to the parent directory and type:

docker-compose up

That reads docker-compose.yml by default, downloads the files that are needed and creates my images. And voilà, a working TicketsCAD install is ready to go.

Well, almost ready to go. Because Docker assigns IP addresses for each build, I had to interrogate the running images in order to figure out what they were. First I used docker ps to find out that the container ID of the ticketscadmariadb instance was 2e13d01384ac, then I used docker inspect to discover its IP address. I needed to know the IP address for the TicketsCAD configuration screen.

docker ps
docker inspect 2e13d01384ac | grep IPAddress

For me it was 172.17.0.2.

Because I have the TicketsCAD port 80 exposed on my local machine as 8080, I can now go to localhost:8080 to run TicketsCAD.

What next?
#

This is enough to get TicketsCAD up and running in a “play” environment. In a real environment, you’d want to harden things. In particular, remove the install.php script and save the Docker image after installation, and make sure that random yahoos on the Internet can’t write to /var/www/html. Give the machines real hostnames. Set up real certificates and put them on the network. Run something to prevent DDOS attacks. All them devops things.

Hey TicketsCAD guys!
#

You’ve got some cool software. If possible, it would be nice for TicketsCAD to have a check box to delete install.php for you after running it - then it would be more compatible with Docker.

A few more more useful things
#

1. If you want to look into a running Docker instance, this is nice to know:

docker exec -it containerID bash

It brings you to a root shell running bash on the instance.

2. I ran into problems after I removed some images with docker -rmi. stackoverflow.com/questions/37454548/docker-compose-no-such-image solved my problem (in short: docker-compose down).

3. Sometimes you’ll need to rebuild.

docker-compose up --build

is a handy way to do that.

My directory structure
#

docker-ticketscad/
docker-compose.yml
ticketscad/
Dockerfile
  var-www-html/
(all the TicketsCAD files go here)
ticketscadmariadb/
Dockerfile
var-lib-mysql/

Tracking and blocking BRW70188B

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 02 Jan 2017 03:00:00 -0700

I’ve been monitoring wifi traffic on my network. I’ve seen a large amount sent up by one device, which was reported as starting with BR70188B (mac address 70:18:8b) with manufacturer HonHaiPr.

HonHaiPr is Hon Hai Precision Industry, which makes network devices. The one in question (with the name BRW70188Bxxyyzz) was from a Brother MFC-650DW that is on the network.

Now that I’ve identified the printer, what to do about it? It was spewing lots of uploaded data - perhaps just to the clients that printed from it, but I’m perhaps a little paranoid. (It seems strange that it’s uploading almost as much as gets downloaded to the printer, though.) So I decided to knock it off the Internet to see what happened.

First, I gave it a static IP address in my dhcpd.conf:

host mfc650dw {
hardware ethernet 70:18:8B:xx:yy:zz;
fixed-address 192.168.1.253;
option host-name "mfc650dw";
}

Next, I updated it in DNS (db and db.rev files) just ‘cause now that it’s static it’s handy to have a name to deal with.

Finally, I added a rule to my pf.conf:

block out log quick from 192.168.1.253/32 to ! 192.168.1/24

Now if the printer’s trying to send data up to the Internet, it’s not going to make it through the firewall.

After I did all this, the printer wouldn’t work - Brother apparently stores the IP address but doesn’t refresh if it can’t find it. So I needed to download the Brother Network Connection Repair Tool to tell the Windows printer driver to look for the printer again. Sheesh.

Translation of Evangeline Acadian Queen

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 03 Dec 2016 19:50:07 -0700

Angèle Arsenault wrote this back in 1977, and I haven’t been able to find a translation that I really liked. So I had to do it myself. It’s from her album Libre (SPPS Disques, PS-19903) and was my first introduction to Acadia.

I’m going to talk to you of someone that you know Yes but don’t deceive yourself, she did not come from the States Even if a certain fellow who was called Longfellow Popularized her two hundred years ago She was called Évangéline, she was very very fine She loved Gabriel on earth as if in heaven They lived in Acadia, they were damned rich1 But one day the English were no longer satisfied So they deported them, Gabriel disappeared Discouraged2 Évangéline searched for him as long as she could She searched for him in Acadia in Quebec in Ontario Then in the United States in Florida in Idaho Arriving in Louisiana with her cousin Diane She said I have lost my time3 She was 75 years old4 Working a the hospital, she cared for the sick Then she saw her Gabriel who was leaving for heaven She jumped on his neck And said thank you very much At the hour that you’re interred I will be able to return I’m going to invest in the companies of the future So that the name of Évangéline will be bloody well known5

Évangéline Fried Clams Évangéline Salon Bar Évangéline Sexy Ladies Wear Évangéline Comfortable Running Shoes Évangéline Automobile Springs Évangéline Regional High School Évangéline Savings Mortgage and Loans Évangéline The only French Newspaper in New Brunswick Évangéline Acadian Queen

This is “riches en maudit” in the original.
This is “déconfortée"in the original.
This proves that Angèle didn’t come from Clare, since she wrote “soixante et quinze” instead of “septante-cinq.”
This is “A dit là j’perdrai pu mon temps.” It seems to indicate both past and future.
This was the hardest to translate, “soit connu en câline.” Literally, “will be known in cuddly” but câline is a milder form of the sacre (expletive) câlisse or chalice.

Ubuntu 16.04.1 - cron mail not working

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 19 Sep 2016 00:08:08 -0700

I recently ran into a strange issue. I wasn’t getting mail from cron - even though I could mail myself locally without incident. My cron daemon was running fine, and I had MAILTO=user specified in the crontab.

The first piece of advice everyone says when you search about this is “make sure you can send mail to yourself.” And I could - using mail or mailx and sending to andrew. And if you try searching for help after that, you get lost in the weeds of people trying to send mail to Gmail, and setting up postfix, and going insane.

After a little poking around, I noticed this in my /var/log/mail.log:

Sep 12 04:28:01 myserver postfix/qmgr[2902]: A292710059B:
from=<root@myserver.mydomain.com>, size=800, nrcpt=1 (queue active)
Sep 12 04:28:01 myserver postfix/error[20839]: A292710059B:
to=<andrew@myserver.mydomain.com>, orig_to=<andrew>, relay=none, delay=1.4,
delays=1/0.12/0/0.25, dsn=5.0.0, status=bounced (myserver.mydomain.com)

I’ve been faking my domain name and it looks like when I upgraded to Ubuntu 16.04.1 things stopped working. (I have a sneaking suspicion that the upgrade process yanked the domain address out of /etc/hosts. But maybe cron changed and started using my FQDN instead of my local mail address.)

But even after changing my hosts file from:

127.0.1.1 myserver

to:

127.0.1.1 myserver myserver.mydomain.com

things weren’t mailing again. I finally changed my crontab to MAILTO=andrew@localhost instead. But that seems kind of bogus. If you’ve got better ideas (/etc/mailname maybe?) let me know.

Making use of GIMP plugins

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 01 Sep 2016 22:03:20 -0700

(or how to draw an arrow with an outline)
#

As part of a project that I’m working on, I found myself drawing lots of red arrows with yellow outlines. To do this I was using the GIMP image editor.

This was tedious. I would draw a yellow arrow for the outline, then draw a red arrow slightly smaller, then merge down so I had one layer. I started wondering about scripting it.

First I started by just calling the FU_arrow.scm script with my values. It wasn’t hard to write a script that did that. In my case, I did:

    (FU-arrow image drawable
            80.0
            25
            TRUE
            75
            500 ; brush thickness
            FALSE ; use forst point as head
            FALSE ; delete path after arrow was drawn
            TRUE ; use new layer for arrow
            FALSE ; draw double headed arrow
            FALSE ; useless
            )

In other words, my plugin just called the FU-arrow plugin. Next I added a little bit of code around that:

    (gimp-image-undo-group-start image)
    (gimp-context-push)
(gimp-palette-set-foreground '(255 255 0)) ; yellow
(FU_arrow image drawable 80.0 ...) ; draw outer (bottom) layer
(gimp-palette-set-foreground '(255 0 0)) ; red
(FU_arrow image drawable 80.0 ...) ; draw inner (top) layer
(gimp-context-pop)
(gimp-image-undo-group-end image)

This saved the state and set the foreground colours appropriately so I didn’t have to, and also made it easy to undo in a single action.

You can see that I called FU_arrow twice. Next I needed to merge them down. For that, I used the facility in the arrow plugin that lets you create the arrow as a new layer. New layers are added at the top of the layer stack, so it’s fairly easy to grab that and work with it. The interesting code is:

    (set! current-layers (cadr (gimp-image-get-layers image)))
    (set! arrow-foreground-layer
      (vector-ref current-layers 0))

Once I have a handle on the foreground layer, I can use gimp-image-merge-down with CLIP-TO-BOTTOM-LAYER to merge the two layers:

(gimp-image-merge-down image arrow-foreground-layer CLIP-TO-BOTTOM-LAYER)

Because I know nobody else created a layer between the two layers I created, it’s easy to get a handle on the new layers the FU-arrow plugin made.

On Gimp 2.10, I noticed that the thickness of my arrow was tracking the thickness of the currently-selected paintbrush. To fix that, I chose the brush width explicitly using:

(gimp-context-set-brush-size 30)
(gimp-context-set-brush-hardness 1.00)

for the outer brush, and 20 for the inner brush.

My total plugin is:

(define
(script-fu-quick-arrow image drawable)
(let *
(
(arrow-background-layer -1)
(arrow-foreground-layer -1)
(current-layers -1)
)
(gimp-image-undo-group-start image)
(gimp-context-push)
(gimp-context-set-brush-size 30)
(gimp-context-set-brush-hardness 1.00)
(gimp-palette-set-foreground '(255 255 0))
(FU-arrow image drawable
80.0
25
TRUE
75
500 ; brush thickness
FALSE ; use forst point as head
FALSE ; delete path after arrow was drawn
TRUE ; use new layer for arrow
FALSE ; draw double headed arrow
FALSE ; useless
)
(set! current-layers (cadr (gimp-image-get-layers image)))
(set! arrow-background-layer
(vector-ref current-layers 0))
(gimp-context-set-brush-size 20)
(gimp-palette-set-foreground '(255 0 0))
(FU-arrow image drawable
80.0
25
TRUE
75
1 ; brush thickness
FALSE ; use first path as head
TRUE ; delete path after arrow was drawn
TRUE ; use new layer for arrow
FALSE ; draw double headed arrow
FALSE ; useless
) ;script-fu-draw-arrow function call
(set! current-layers (cadr (gimp-image-get-layers image)))
(set! arrow-foreground-layer
(vector-ref current-layers 0))
(if (= -1 arrow-foreground-layer) (gimp-message "Foreground is -1"))
(if (= -1 arrow-background-layer) (gimp-message "Background is -1"))
(gimp-image-merge-down image arrow-foreground-layer
CLIP-TO-BOTTOM-LAYER )
(gimp-context-pop)
(gimp-image-undo-group-end image)
) ; let
) ;define
; Register with GIMP:
(script-fu-register "script-fu-quick-arrow"
_"Quick Arrow"
_"Draw a nearly arbitrary arrow in your image in red with a yellow outline. Arrow will be created in a separate layer. Needs FU_arrow.scm"
"Andrew"
"2016, Andrew"
"2016-09-01"
"*"
SF-IMAGE "The image" 0
SF-DRAWABLE "The drawable" 0
)
(script-fu-menu-register "script-fu-quick-arrow" "/Script-Fu/")

Quick edit: to install the script, copy it to the scripts directory. You can find that with Edit -> Preferences -> Folders -> Scripts (I used the user folder rather than the system folder). Then Filters -> Script-Fu -> Refresh Scripts. Et voilà!

Building Signalink Cables

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 12 Jun 2016 23:58:18 -0700

Many of us have sound card interfaces for our radios that use the standard RJ-45 plug on one end and a custom connector for the radio on the other. If you’ve got more than one radio, it’s sometimes possible to buy additional interface cables. That can get pricey, though – and depending on the connector on your radio, an interface cable might no longer be available.

For many rigs it’s possible to buy a connector that ends in bare wire fairly cheaply. I hit eBay and found a cheapie Kenwood connector for $2.49 (“4 Wire Speaker Mic Cable for Baofeng UV5R Kenwood TK-240”).

While holding one of these in my hand, I noticed that the individual wires in the radio cable were roughly the same diameter as the wires in cat-5 network cable.

Before doing anything else I wrote down which wires connected to which pins on the radio. All of the wires in my cable had different colors, which made identification a lot easier. Next, I determined which pin in the RJ-45 plug should be connected to which wire. This varies depending on the radio connector and sound card interface you use. In my case, green went to the 2.5mm plug tip aka speaker, red went to the 3.5mm ring aka mic, black went to the 3.5mm sleeve aka PTT, and white went to the 2.5mm sleeve aka ground. I found this Tigertronics page useful.

After that, I cut the interface cable straight across with diagonal cutters. My cable came with an integrated strain relief, and I cut that off as well. Then I carefully removed a little more than half an inch (about 13mm) of the cable jacket, being careful not to nick the wires inside.

I arranged the wires in the correct order they’d need to be into the RJ-45 plug. The wires were solid core, so I was able to spread them more or less into position. Next I inserted the cable into the RJ-45 plug, being careful to slip each wire into the appropriate channel. One or two recalcitrant wires needed persuasion with a pin to find the right home.

Once all the wires were in their channels, I pushed hard on the cable to ensure all the wires were as far forward in the plug as they would go. At this point I crimped the RJ-45 plug. There are two nice things about an RJ-45 crimp: there’s no need to strip the wires (the plug bites down on them to make the connection), and the crimp forces part of the plug’s shell against the cable, which keeps it in place.

Then came the moment of truth: I tested continuity of each pin on the connector. Success!

The radio’s connectors were in the right place, and I had a professional-looking interface cable for a radio that needed it.

Mounting a Pi with Wheezy read-only

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 06 Apr 2016 23:08:22 -0700

A while back, I had a need to make a Raspberry Pi have a read-only filesystem. I used the instructions at: github.com/tvdzwan/hyperion/wiki/Make-Raspbian-Read-Only to do so.

Just in case that goes away or changes, here’s what I did:

dphys-swapfile swapoff
dphys-swapfile uninstall
update-rc.d dphys-swapfile disable
aptitude install unionfs-fuse

Then create an executable script as follows in /usr/local/bin/mount_unionfs:

#!/bin/sh
DIR=$1
ROOT_MOUNT=$(awk '$2=="/" {print substr($4,1,2)}' < /etc/fstab)
if [ $ROOT_MOUNT = "rw" ]
then
/bin/mount --bind ${DIR}_org ${DIR}
else
/bin/mount -t tmpfs ramdisk ${DIR}_rw
/usr/bin/unionfs-fuse -o cow,allow_other,suid,dev,nonempty ${DIR}_rw=RW:${DIR}_org=RO ${DIR}
fi

Next, make / read-only and mount /etc and /var as ramdisk in /etc/fstab:

/dev/mmcblk0p1 /boot vfat ro 0 2
/dev/mmcblk0p2 / ext4 ro,noatime 0 1
mount_unionfs /etc fuse defaults 0 0
mount_unionfs /var fuse defaults 0 0

Finally, make the magic directories:

cp -al /etc /etc_org
mv /var /var_org
mkdir /etc_rw
mkdir /var /var_rw
reboot

Recently, I had to add a user to a group. To do that, I used:

umount /etc
mount -o remount,rw /

to make /etc/ writable again.

Turning a Raspberry Pi 2 into a packet station

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 31 Mar 2016 23:25:27 -0700

I keep thinking it’s a good idea for emergency communications to have a packet station. Since I’m cheap, I didn’t want to get extra hardware - instead I wanted to use what I had. Luckily, Dire Wolf is better than any hardware packet decoder out there. Here’s how I got a working packet station on a Pi 2 running Raspbian Jessie Lite.

Connect the radio to the Pi. In my case, I had a spare Signalink SL1+ hanging around which made things easier. I bought a Syba CMedia USB sound card to talk from the Pi to the Signalink, and a Kenwood speaker mic cable to talk from the Signalink to the radio. Here’s a useful hint: the diameter of the wires in the speaker mic cable are roughly the same as the diameter of the wires in regular Ethernet cable - meaning that you can (if you’re careful) strip the outer jacket, put the inner wires in the right places of an RJ-45 connector and crimp direct to them with no soldering at all.
Download and build Dire Wolf. Instructions for doing so on a Pi are here. I mounted my home directory on a networked drive to make life easier.
Configure Dire Wolf with your callsign (I used the SSID -15 after my call) and sound card. Be sure to avoid the “# ADEVICE - plughw:1,0” line - it looks a lot like the correct “ADEVICE plughw:1,0” line, but takes input from stdin instead of the sound card.
Run “direwolf” and tune the radio to 144.390 (APRS). Make sure you’re decoding packets. You might have to go to alsamixer and adjust input/output. Mine ended up being 51 for speaker, 29 and 12 for mic. Also adjust the radio volume so it’s not too high or too low. (Hit F6 to get your sound card, then F5 to see all devices. I’m not sure which mic I was using; I had two - a stereo and a mono one. The mono one was 29, the stereo one was 12.) It’s probably a good idea to turn off the squelch on the radio as well.
sudo apt-get install ax25-tools ax25-apps
Edit /etc/ax25/axports and set one line to: vhf mycall-15 1200 255 2 VHF link (1200 bps)
Make sure all the other lines in axports have # in front of them (it doesn’t like blank lines).
Run “direwolf -p” to get the KISS port. It will show up as something like /dev/pts/2. Once it’s running, move to another terminal window.
Change frequency to the freq that you’re going to use.
sudo /usr/sbin/kissattach /dev/pts/2 vhf (your IP address in AMPR 44.0.0.0)
sudo /usr/sbin/kissparms -p vhf -t 200 -s 20 -r 64 -l 50 -f n These parameters took a little tweaking. If the transmit delay (-t) was too big, things timed out. If it was too small, things stepped on each other. I had to adjust transmit tail delay as well (-l). I found this page useful for some values.
sudo route del -net 44.0.0.0 netmask 255.0.0.0 (because I’d set up a route beforehand and needed to nuke it)
sudo /sbin/route add -net 44.0.0.0 netmask 255.0.0.0 dev ax0
ping -i 10 (someone else’s IP who also has a machine on the AMPR 44.0.0.0 net)
Assuming that works, you might want to apt-get install telnet telnetd talk talkd and try to log into your friend’s machine or have your friend log into yours.
Last but not least: I ran into problems with arp. I increased the arp timeout in /etc/sysctl.d/local.conf:net.ipv4.neigh.default.base_reachable_time_ms=1200000

Turning a Raspberry Pi 3 into an iBeacon

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 29 Mar 2016 23:31:23 -0700

Wow, that was easy. Straight out of the box, you can turn your Raspberry Pi 3 into an iBeacon. All you need is Raspbian Jessie - it’s got hcitool installed.

Here’s how to do it. First, decide on your iBeacon UUID and major/minor. For instance, I picked at random:

UUID: c9407f30-f5f8-466e-aff9-25556b57fe6d Major: 179 Minor: 3

Next, convert the UUID to 16 byte big-endian hex, and convert major/minor to 4 byte big-endian hex:

UUID: C9 40 7F 30 F5 F8 46 6E AF F9 25 55 6B 57 FE 6D Major: 00 B3 Minor: 00 03

Plug those numbers into the magic command:

sudo hcitool cmd 0x08 0x0008 1E 02 01 1A 1A FF 4C 00 02 15 UUID Major Minor C8

For example:

sudo hcitool cmd 0x08 0x0008 1E 02 01 1A 1A FF 4C 00 02 15 C9 40 7F 30 F5 F8 46 6E AF F9 25 55 6B 57 FE 6D 00 B3 00 03 C8

Finally, turn advertising on with:

sudo hcitool cmd 0x08 0x000A 01

or turn it off with

sudo hcitool cmd 0x08 0x000A 00

That was too easy!

Incidentally, the 4C 00 is the magic bit that says it’s an Apple product, 02 means iBeacon, 15 is the (hex) length of the remaining data. The trailing C8 is the two’s complement of the transmit power at 1m, so c8 is -56. More details can be found at: https://stackoverflow.com/questions/18906988/what-is-the-ibeacon-bluetooth-profile.

Increasing Netbook Screen Size

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 21 Mar 2016 22:32:06 -0700

I’ve got an old Acer Aspire One 521 netbook that I’ve had for ages. One of the downsides of netbooks is that their screen resolution is 1024x600 - which is too low for a lot of programs. In particular, all the interesting buttons of the MFJ-226 control program “T-Series Vector Impedance Analyzer” are below the bottom of the screen.

I found a workaround that appears to work on Windows 7 and higher. I found it here: http://www.tlbhd.com/how-to-get-better-resolution-on-your-standard-10-inch-netbook-2772/

The solution: use regedit to search for all instances of “Display1_DownScalingSupported” and change the value 0 to 1. (According to various things I’ve read, you’ll need to do that for all instances, not just one.) Then reboot. When I did this, I ended up in 1024x768 (which looks strange).

Strange isn’t bad, though. Now I can change resolutions to 1024x768 or 1152x864 if an inconsiderate programmer decides he wants to use more than my screen.

Controlling T-Series Vector Impedance Analyzer from a netbook

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 21 Mar 2016 22:22:58 -0700

I’ve been using the T-Series Vector Impedance Analyzer program from Times Technology Company to control my dad’s MFJ-226 antenna analyzer (aka Times Technology T200). Both he and I ran into problems with it on a netbook with a screen size of 1024x600. Most of the “interesting” buttons were off screen!

The right solution for Windows 7 and higher appears to be to allow scaling of the netbook’s screen. That’s documented here. But for those unfortunates who are stuck on Windows XP or for some other reason can’t increase the screen size, here’s what I ended up doing.

To start/stop the connection to the analyzer:

Click the “SWR” button
Press \[Tab\] \[Tab\] \[Cursor back <-\] \[Space\]

To load a file from the analyzer:

Click the “Save to File” button
Click “Cancel”
Press \[Tab\] \[Tab\] \[Tab\] - you are now on the file to load
Press \[Backspace\] \[Backspace\] \[Backspace\] \[Del\] \[Del\] \[Del\]
Enter the file you want to load from the analyzer (1, 3, 12, etc.)
Press \[Shift-Tab\]
Press \[Enter\]
Now you can click the “Save to file” button and save the data.

Setting up Raspian Jessie on a Pi

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 15 Mar 2016 21:29:27 -0700

There are a few changes to setting up Raspian Jessie on a Pi. Here’s what I do:

Burn the image
#

Get the Raspbian image from the Raspberry Pi downloads page. I’ve been using Jessie Lite, since I don’t need the full package.
Unzip it on a Linux box (mine saw the SD card as /dev/sdb, use your SD card device and don’t wipe your hard drive)
Pop the card out of the Linux box and into the Pi

The command to write that I used:

sudo dd if=2015-01-31-raspbian.img of=/dev/sdb bs=4M

Configure the Pi
#

When the Pi boots into raspi-config, do the following:

Expand Filesystem
Change User Password
Internationalisation Options / Change Locale, pick en_US UTF-8
Internationalisation Options / Change timezones, pick yours
Internationalisation Options / Change Keyboard Layout, pick US PC 104, accept defaults

Set up the network
#

I have my Pi configured with a static IP. The first time I boot I attach a network cable.

Edit /etc/dhcpcd.conf (not /etc/network/interfaces) so the wired interface is static
My /etc/resolv.conf was configured automatically by dhcp and was mostly right (missing domain and search, but I guess I can live with that)
Now would be a good time to edit /etc/hostname as well
Edit /etc/hosts to use the new hostname and hostname.domainname

(Thanks to https://pi-hole.net/faq/how-do-i-set-a-static-ip-address-in-raspbian-jessie-using-etcdhcpcd-conf/ for the revised instructions for a static IP.)

I added the following to the end of my /etc/dhcpcd.conf:

# Configure eth0 to be static
interface eth0
static ip_address=192.168.17.5
static routers=192.168.17.1
static domain_name_servers=192.168.17.1
static domain_name=mydomain.foo

Install an editor
#

I can do a few things like adding users while updates are happening. So:

sudo aptitude update
sudo aptitude install zile

Update the OS
#

This takes a while, but you can continue on while this is happening.

sudo apt-get install rpi-update
sudo aptitude dist-upgrade

Add my user
#

I don’t like to use the default user, so I add my own.

sudo addgroup –gid 3009 myshare
sudo adduser –uid 3000 myuser
sudo usermod -a –groups adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,spi,i2c,gpio,myshare myuser log out, log in - make sure I can sudo with the new user
prevent login as pi

To prevent the pi login, I do:

sudo vipw -s

and replace the password for pi with *.

Update everything else
#

Once the dist-upgrade has completed and it’s time to reboot:

sudo /sbin/shutdown -r now

Now you can log in again and upgrade the firmware:

sudo rpi-update
sudo /sbin/shutdown -r now

Get things I know I’ll need
#

I like to have an emacs clone:

zile ~/.bash_aliases
alias emacs='zile'

I also like tightvncserver on non-Lite images:

sudo aptitude install tightvncserver
tightvncserver
(set password)

Finally, make emacs the default editor by appending this to ~/.bashrc:

export EDITOR=/usr/bin/zile

Mounting a CIFS drive
#

I don’t like to do more writing than I have to, so:

sudo mkdir /etc/samba/credentials
sudo chmod 700 /etc/samba/credentials
sudo chown root.root /etc/samba/credentials
sudo mkdir /shared
sudo zile /etc/fstab
sudo zile /etc/samba/credentials/myserver

In /etc/fstab, I add:

//myserver/shared /shared cifs credentials=/etc/samba/credentials/myserver 0 0

While in /etc/fstab, I change the following to reduce wear on the SD card:

/dev/mmcblk0p1 /boot vfat noatime 0 0
/dev/mmcblk0p2 / ext4 defaults,noatime 0 2

{Edit} I used to have ro,noatime on /boot but the Pi gets really unhappy when you try to upgrade the OS if /boot isn’t writable. So out it came.

In /etc/samba/credentials/myserver, I add:

username=myuser
password=mypass

“rss-feed” That’s about it.

Formatting an SD card as exfat

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 17 Dec 2015 22:32:07 -0700

On Android, by default SD cards with 64M or more on them are formatted as exfat, while smaller cards are formatted as fat32. But what if you want to force an SD card to be exfat? Here’s how to do it. You’ll need a Linux box.

sudo apt-get install fuse-exfat exfat-utils
Partition the card if it’s not already partitioned
sudo mkfs -texfat /dev/sdf1

Mostly this post is to remind me that the new format is called exfat, since I keep forgetting that.

Rescuing a hard drive with ddrescue

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 05 Nov 2015 23:13:45 -0700

A while ago, one of my Windows hard drives gave up the ghost. Unfortunately, the last backup I’d done on it was a while ago. Lesson #1: Don’t forget to back things up.

The hard drive had been staring at me on my desk for a while, so I decided to see what I could do about it. My searches led me to CGSecurity and two pages on their website: TestDisk and the Damaged Hard Disk page. They in turn led me to ddrescue.

Here’s what I’ve done so far:

Have a nice server that has a motherboard advanced enough to hot-mount SATA drives. This is very useful if the disk disappears now and then and needs to be remounted.
Mount the drive in a spare slot in the server.
sudo apt-get install lzip because ddrescue is stored in lzip archives
Grab the latest stable build from the ddrescue download directory. (I used version 1.20.)
lzip -d then extract the ddrescue tar file.
cd into the ddrescue directory and configure; make
Next I tried plain ddrescue: sudo ./ddrescue -n /dev/sde /data/sde_rescue sde_map
That seemed to be having trouble, so I reversed direction: sudo ./ddrescue -n -R /dev/sde /data/sde_rescue sde_map
That whirred for a few days. Next I decided to try mounting as a raw device, on the theory that the kernel cache might be obscuring things.
sudo /sbin/modprobe raw
sudo raw /dev/raw/raw1 /dev/sde
sudo ./ddrescue -n -R /dev/raw/raw1 /data/sde_rescue sde_map

So far I’ve theoretically recovered 130M of my 500M disk. When reading the raw device, I don’t get an estimate of time remaining (which was about a year). It will be interesting to see if this actually gets recovered, or if I’m just grabbing random numbers at this point.

Unlocking a Windows 8.1 machine with MSN password

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 20 Sep 2015 15:39:31 -0700

Recently, I inherited a laptop that came with Windows 8.1 installed. The previous owner had forgotten the login password, and no longer had the phones/accounts that were associated with the machine either. (If you have the choice, I’d recommend you avoid Alzheimer’s disease. It sucks.) I wanted to get the user information off before wiping it and reinstalling. Unfortunately, this machine had a Windows Live / MSN password, rather than a local password.

I started with these instructions. They take advantage of an exploit to enable a command shell from the login screen. In short:

Go into Advanced Startup Options and Troubleshoot -> Advanced Options -> Command Prompt
copy c:\windows\system32\utilman.exe c:\
copy c:\windows\system32\cmd.exe c:\windows\system32\utilman.exe
Reboot
Click the “Ease of Access” icon at the bottom left of the login screen. Now this will open a command shell.
If the user had a local account, you’d be home free now. (net user “username” new-password and then copy the original utilman.exe back). But I wasn’t - instead I saw “System error 8646 : The system is not authoritative for the specified account”. That was because the machine had a MSN login / Microsoft Live password. So instead…
net user brandnewuser secretpassword
Reboot again (probably not necessary, but I did this)
Get back into the “Ease of Access” shell
net localgroup Administrators brandnewuser /add
Reboot
Log in as brandnewuser rather than the original user.
Wait a really really long time (10 minutes or so) for Windows to rebuild the desktop for the new user.
At this point, you can navigate to C:\Users and copy the files from the original user to somewhere else. You will probably have to run the Explorer as Adminstrator in order to do this. I recall being prompted with “You don’t have access to this directory, do you want to get it permanently” once or twice. I said “Yes”.
And that’s it - the pictures can now be copied to CD for preservation (except the ones that were stored in Windows Live, of course). After that you can create restore media and wipe/reinstall.

Changing user and group ID on Unix

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 02 May 2015 21:05:32 -0700

Recently I’ve set up a file server for both Windows and Linux. When I went to mount the file system on Linux, things were broken - because I hadn’t paid attention to user ID and group ID when I created users on my different Unix machines.

So I needed to change the UID and GID of a user, then update the files. Luckily, someone had already done the work:

https://muffinresearch.co.uk/linux-changing-uids-and-gids-for-user/

In short:

usermod -u <NEWUID> <LOGIN>    
groupmod -g <NEWGID> <GROUP>
find / -user <OLDUID> -exec chown -h <NEWUID> {} \;
find / -group <OLDGID> -exec chgrp -h <NEWGID> {} \;
usermod -g <NEWGID> <LOGIN>

One wrinkle that I wasn’t expecting: you can’t change the user ID of a user who has a running process. So I had to create a second user with adduser, add that user as in /etc/groups for sudo, log in as that user, and then change the user ID of the original user.

When I ran this on Ubuntu and Raspbian, I saw about 4 errors in /proc which I ignored. There’s probably a faster way to do to this using xargs rather than running -exec each time, but I was a little worried I might exceed what I could pass in on a command line (I had hundreds of thousands of files) so I let it do its thing.

Setting up a static IP for a Raspberry Pi over wifi using OpenBSD dhcpd

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 01 May 2015 00:54:05 -0700

Like the rest of the world, I wanted to have a static IP for a Raspberry Pi that was on a wifi network. Like the rest of the world, I couldn’t figure out how to do it after three attempts. At that point, like the rest of the world I gave up and decided to make my DHCP server do the work instead of the Pi.

Here’s how I did it:

1. On the Pi, edit /etc/wpa_supplicant.conf and add:

network={
    ssid="My_SSID"
    psk="My_wifi_password"
}

2. Reboot and get an IP address through DHCP.

3. Confirm that I can see the world with the DHCP address.

4. ifconfig wlan0 and copy down the hardware Ethernet address for wlan0 (let’s pretend it was 00:11:22:33:44:56).

5. Go to the box running DHCP, and add a stanza inside my shared-network:

       host myserver {
               hardware ethernet 00:11:22:33:44:56;
               fixed-address 192.168.1.17;
               option host-name "myserver";
       }

6. Kill and restart the DHCP daemon.

7. Reboot the pi and confirm it’s getting the right static IP address now.

Samba - let Windows execute even if execute bit not set

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 23 Apr 2015 23:24:54 -0700

I’ve set up Samba once again, and it’s still not easy, especially with Cygwin in the mix. I still haven’t figured out Cygwin, but I did get the magic phrase that lets Windows machines run exe files without having to set the execute bit.

This is an option that’s not documented in the /etc/samba/smb.conf file, but that’s where it goes: # Allow Windows machines to execute things that don't have # the execute bit set acl allow execute always = True

Thanks to forge.univention.org/bugzilla/show_bug.cgi?id=33785 for the info!

Setting up a WD Red drive for use in a NAS

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 12 Apr 2015 13:56:55 -0700

It’s in bits and pieces all over the net, but I haven’t seen it all in one place yet. Western Digital Red drives have 4k (4096 byte) sectors rather than the old 512 byte sectors. In order to use them optimally, you need to format them aligned on those sectors.

The first trick is to use parted rather than fdisk/cfdisk to define the partitions, and parted version 2.2 or higher, as described on this Western Digital support article.

Next, you need to decide what your partition table should look like. For maximum compatibility, use msdos. But if you have drives larger than 2G, you will probably want to use gpt instead.

Assuming you’re using /dev/sdd as your drive:

# parted -a optimal /dev/sdd
(parted) mklabel msdos
(parted) q

Next, you will want to add the partition. In my case, I wanted to create an ext4 partition that took up the whole disk. Here’s how:

# parted -a optimal /dev/sdd
(parted) mkpart primary ext4 0% 100%
(parted) p
Model: ATA WDC WD20EFRX-68A (scsi)
Disk /dev/sdd: 2000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Number  Start   End     Size    Type     File system  Flags
 1      1049kB  2000GB  2000GB  primary  ext3
(parted) q

The -a optimal is the magic bit that tells parted to partition on 4k boundaries for a 4k drive. My ext4 partition actually got created as an ext3 partition, since those are the same partition type.

Then you need to create a file system on the partition you just created. I add a label afterwards so I can mount it via label in /etc/fstab. (There’s a way to add a label in the mkfs command, but I can never remember it, so I do it in two steps.)

# mkfs -t ext4 /dev/sdd1
# e2label /dev/sdd1 mynewdrive

Then edit /etc/fstab to add the new drive to it:

LABEL=mynewdrive /newdrivemountpoint ext4 defaults 0 2

The label matches the label I specified on e2label, and the /newdrivemountpoint is the directory in the Unix file system that I want the drive to be mounted on. The last two numbers say “don’t dump” (0) and “do fsck after the root drive” (2). See the man page or the Ubuntu fstab page for more details on that.

Setting up Direwolf/Xastir on a Raspberry Pi

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 22 Mar 2015 19:55:50 -0700

A long time ago I set up Soundmodem for Ubuntu. Recently, I tried setting up an igate using WB2OSZ’s Direwolf instead. Things are much nicer these days.

The Direwolf site includes a very nice guide to setting up a Raspberry Pi as an igate, so I won’t go over it here. Instead, this is just to record the steps I took to set up my Raspberry Pi v2 as an igate server.

1. Set up the Raspberry Pi to run Raspbian

Follow along with the setup guide:

sudo apt-get remove --purge pulseaudio # I didn't need to do this since it wasn't installed, but better safe than sorry
sudo apt-get install libasound2-dev xastir # Note that I'm installing xastir at the same time - this is different from the direwolf guide
cd ~
git clone https://www.github.com/wb2osz/direwolf
cd direwolf
git checkout 1.2
make
sudo make install
make install-rpi
make install-conf

Next, make sure the sound card is plugged into USB (I used the bottom slot). When I plugged it in, the system rebooted, so it’s probably smart to shut down before plugging the sound card in. For a sound card, I used the Syba SD-CM-UAUD USB Stereo Audio Adapter, C-Media Chipset from Amazon.

From there, run aplay -l to see: card 1: Device [C-Media USB Audio Device], device 0: USB Audio [USB Audio]

Now I know the device is card 1 device 0. We’re almost ready to edit direwolf.conf. First, though - something that wasn’t documented on the Direwolf site. Igates need a secret code so they can log into the tier 2 servers. It’s based on your callsign, and there’s a utility called callpass in Xastir that will compute it for you. callpass {my-real-call}

This gives you a 5 or 6 digit integer that you should remember. I’ll call it {my-code}.

Now edit direwolf.conf:

uncomment ADEVICE plughw:1,0 - if you got a different number from aplay above, you might have to modify it.
change MYCALL NOCALL to MYCALL {my-real-call}-10. I used -10 because that’s the APRS SSID for igates. (APRS SSIDs are documented here.) In the direwolf.conf that I got, the NOCALL had a ^J after it; I had to take that out
uncomment IGSERVER noam.aprs2.net (maybe use a different server if you’re not in North America)
uncomment IGLOGIN and change it to IGLOGIN {my-real-call} {my code}
direwolf

Yay, you’re igating. But what’s around? Set up Xastir for that:

xastir
In the first menu that comes up, set your callsign to {my-real-call}-10 and (if desired) set your lat/long/position ambiguity
Interface -> Interface Control, Add, Networked AGWPE, Add. Leave Pass-code blank, save and Start. Now you’re getting APRS from over the air displayed on your Xastir maps.
Not enough for you? Interface -> Interface Control, Add, Internet Server, Add. Set Pass-code to {my-code}, save and Start. Now you’re getting APRS from the network as well.
Want to see it on maps? I wasn’t able to get all the maps going, but things worked when I picked Maps -> Map Chooser and selected only Online/osm_tiled_mapnik.geo and worldhi.map.

Adding ATtiny support to Arduino IDE 1.6.1

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 22 Mar 2015 19:28:04 -0700

I recently upgrade from the 1.0.5 version of the Arduino IDE to 1.6.1. Things aren’t completely smooth - in particular, I was using Coding Badly’s cores for ATtiny85, ATtiny84 and ATtiny2313.

Unfortunately, those haven’t yet been updated for the new layout specified in the 1.6.x IDE. So instead I switched for now at least to the damellis cores (which support ATtiny85 and ATtiny84, but not ATtiny2313/4313).

Installing this is a matter of unzipping it in the sketchbook/hardware folder (on my Windows box in C:\Users\{my user}\Documents\Arduino).

In Windows cmd shell: cd "C:\Users\{my user}\Documents\Arduino" mkdir hardware unzip c:\{whatever}\attiny-ide-1.6.x.zip cd hardware move ..\attiny-ide-1.6.x\attiny . cd .. rmdir attiny-ide-1.6.x

At some point in the future either the Coding Badly cores will support IDE 1.6 (hopefully with the nice variants structure that the damellis cores use) or the damellis cores will do ATtinyX313s.

Setting up Raspbian on a Pi

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 26 Feb 2015 01:56:39 -0700

These instructions are for Wheezy. You can find updated instructions for Jessie here.

I’ve been working on setting up a Raspberry Pi to do APRS using Dire Wolf and Xastir. That actually works fairly well, and I’ll write something about it later - this post is because I was using a flaky SD card, which decided to croak at an inopportune moment. Consequently, I had to reinstall Raspian again.

Since it’s easier to write it down than to remember, here’s what I did:

Burn the image
#

Get the Raspbian image from the Raspberry Pi downloads page.
Unzip it on a Linux box (mine saw the SD card as /dev/sdb, use your SD card device and don’t wipe your hard drive)
Pop the card out of the Linux box and into the Pi

The command to write that I used:

sudo dd if=2015-01-31-raspbian.img of=/dev/sdb bs=4M

Configure the Pi
#

When the Pi boots into raspi-config, do the following:

Expand Filesystem
Change User Password
Internationalisation Options / Change Locale, pick en_US UTF-8
Internationalisation Options / Change timezones, pick yours
Internationalisation Options / Change Keyboard Layout, pick US PC 104, accept defaults

Set up the network
#

I have my Pi configured with a static IP. The first time I boot I attach a network cable.

Edit /etc/network/interfaces so the wired interface is static
My /etc/resolv.conf was configured automatically by dhcp and was right
Now would be a good time to edit /etc/hostname as well

The iface eth0 stanza in my interfaces file looks like:

iface eth0 inet static
address 192.168.17.15
netmask 255.255.255.0
gateway 192.168.17.1

Update the OS
#

This takes a while, but you can continue on while this is happening.

sudo aptitude update
sudo aptitude dist-upgrade

Add my user
#

I don’t like to use the default user, so I add my own.

sudo adduser myuser
edit /etc/group to add my user to all the pi groups (including sudo)
log out, log in - make sure I can sudo with the new user
prevent login as pi

To prevent the pi login, I do:

sudo vipw -s

and replace the password for pi with *.

Update everything else
#

Once the dist-upgrade has completed and it’s time to reboot:

sudo /sbin/shutdown -r now

Now you can log in again and upgrade the firmware:

sudo rpi-update
sudo /sbin/shutdown -r now

Get things I know I’ll need
#

I like to have an emacs clone:

sudo aptitude install zile
zile ~/.bash_aliases
alias emacs='zile'

I also like tightvncserver:

sudo aptitude install tightvncserver
tightvncserver
(set password)

Finally, make emacs the default editor by appending this to ~/.bashrc:

export EDITOR=/usr/bin/zile

That’s about it.

Foot Switch for the Insane

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 28 Dec 2014 15:28:28 -0700

I’ve been looking for a foot switch for a while now to act as a PTT for a radio. Yesterday at a thrift store, I came across the Koino KH-8012: [

Do you see anything wrong with this picture? That is indeed a SPST foot switch with a NEMA 1-15 plug on the end. I can’t think of any reason that you would want to do that - the switch is rated at 15 A / 125 V AC (as well as 14 V DC), so it’s not like it was meant for a European destination where the corresponding socket wouldn’t be found in the wild.

The label is a lie too - it’s normally open, and conducts when closed. It is not SPDT: there are only two conductors coming out of the switch.

I’ve since rendered it safe and unable to short out household wiring by cutting off the NEMA 1-15 and adding a 1/4 inch jack instead.

All I can find about this switch is that it’s available from China and Vietnam, and costs USD $6.49 each when bought in large lots. Any idea what this was originally used for, or why on earth anyone would want to terminate it in a way that seems designed to blow fuses? Leave a comment.

Using Cygwin git on Samba

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 23 Dec 2014 14:02:39 -0700

When I last updated the Cygwin git, it stopped working on my Samba drive. Normally running git on a network drive is not recommended, but I do it anyway. After a git upgrade, I started seeing:

error: invalid object
error: Error building trees

when I did a commit. After a little searching, I discovered this Stack Overflow post which suggested one answer:

git config --add "core.createobject" rename

This appears to have solved the problem for me.

Repairing a MFJ-259B Antenna Analyzer

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 29 Nov 2014 21:48:24 -0700

I’ve had an MFJ-259B antenna analyzer for a while, and for the most part it’s been pretty good. However, in the last few months I’ve seen it intermittently give me really high SWR as opposed to normal SWR.

Usually, that means there’s a break in a transmission line somewhere, but I kept seeing it on different lines. Curiously, it usually went away when I touched the antenna connector.

I wondered if I was adding capacitance or something to the system, but finally I realized it happened when the feedline cable pulled down on the analyzer. It was just a break between the antenna connector and the analyzer.

I took the analyzer apart, re-soldered the SO-239 and I was back in business.

Here’s what I learned when I took the antenna analyzer apart:

Take the battery cover off first (two screws on the bottom)
Next, unscrew both sides (four screws on each side)
At this point, you’ll have access to the battery compartment. Take out the two top batteries and the two bottom batteries (don’t need to take out the rest).
You’ll see four screws that hold the battery compartment to the analyzer. Actually, that’s a lie - only the two right-side screws hold the battery compartment to the analyzer. The left screws are screwed into Delrin insulators. Don’t unscrew the left screws or the insulators will drop off and you’ll have to look under the table for them. Just unscrew the right screws (top and bottom).
At this point you can move the battery compartment to the side, and get easy access to the SO-239 connector. Don’t lose the lock washers that are under the screws.
I suspect they used lead-free solder to solder the connector, which is more prone to cracking than 60/40. I upped the heat a little and mixed in some 60/40 solder to make it more durable.
At this point you can put the 4 batteries back in and test with a dummy load and a good cable. I did this and verified my problems with mystery SWR were gone.
Put things back together in the reverse order that you took them apart.

Signal out of range on Soyo Topaz S

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 25 Nov 2014 00:01:51 -0700

I recently upgraded my monitor from an old Sharp 12" to a Soyo Topaz S. Things seemed to be going well with the new monitor until I rebooted my Ubuntu Server (which was on 12.04 LTS). When I did that, I got the message “Signal Out of Range” from the monitor, and I couldn’t see what was being displayed.

According to a number of sources, this was because my monitor was being detected incorrectly and choosing the wrong resolution or colour depth. Lots of articles explained that you can change the mode in the config file /etc/default/grub.

To start with, I booted SysRescCD with the option gfxpayload=640x480. This got me to the point where I could see the file system, do an fsck (I’d gone 327 days without one) and mount my root drive in /mnt.

Naturally, when I did that, I discovered the file /mnt/etc/default/grub didn’t exist. That’s because I had upgraded originally from 8.04 LTS and that had never upgraded my grub to grub2.

But at least now I could ssh into my server again. I updated, then upgraded to 14.04.1 LTS because hey, the server needed it anyway. Immediately after doing that, I saw an error with every command, “no talloc stackframe at ../source3/param/loadparm.c, leaking memory”. The quick fix for that (as described in this ubuntuforums thread) was to run pam-auth-update and remove “SMB password synchronization”. As far as I can tell, that hasn’t changed anything with respect to what passwords are used for my shares.

Then I followed the instructions to upgrade from grub to grub2.

After that, I still couldn’t see my screen when I booted… but I had an /etc/default/grub. So I edited it, uncommented the line:

GRUB_GFXMODE=640x480

and had a booting system again. Yay! Eventually I figured out that I could go up to 1024x768 with no problems.

After that I realized I couldn’t do anything with the grub menu. I booted into the system, but couldn’t choose the OS to load with my USB keyboard.

So the next time I booted, I had to switch “USB Keyboard Support” in my BIOS from “OS” to “BIOS”. That fixed the grub menu problem.

Trying to resurrect a dead Linksys WRT54GS router

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 01 Sep 2014 01:47:09 -0700

I recently went through heroic efforts to bring a dead Linksys WRT54GS router back to life. These routers are great for Broadband Hamnet so I really wanted to get it working, but no dice.

But I don’t want to forget what I did, so I’m documenting it here.

Fix the hardware
#

The first problem was that the router made a strange buzzing sound. I opened the router and discovered that LX2 in particular, but also LX1 (two chokes at the power supply input) were actually vibrating when I put my finger on them. In addition, the capacitors near it were hot to the touch.

This was described in this post as an electrolytic capacitor problem. Sure enough, when I replaced CX2 with a new 220 uF 25 V electrolytic capacitor, the device settled down. At this point, the power LED was flashing (a bad sign) but at least it was now flashing at a regular speed. While I was soldering, I took the time to add a 12-pin header to the router’s JTAG port.

Reflash the Firmware
#

Following the unbrick article here, I wasn’t able to ping the router. No matter what, I’d get “destination host unreachable” - even though my IP was the same as the router, ostensibly. So I figured flashing was required.

I started out by trying to get a SEGGER J-Link talking to the JTAG port. I used the pinouts for the WRT54G described here for the WRT54GS, and the pinouts for the J-Link described here. Note that RESET on the J-Link is nSRST on the WRT54GS.

After I’d done that, I wasn’t able to get the J-Link talking. It looks as if the J-Link software wants to talk only to devices it knows about - or at least, that’s all I could figure out about it. Trying to set it to MIPS mode to impersonate EJTAG didn’t yield any success either.

So it was time for a different option. I didn’t have a parallel port handy, but I did have a Raspberry Pi. And a wonderful individual has taken the time to port tjtag to the Raspberry Pi. I cloned the Git repo to my Pi and built it. I had to use:

git clone git://github.com/oxplot/tjtag-pi.git

to grab the Git repo, since https wants an auth key and I don’t have one. After that I followed the Setup instructions and got tjtag built.

I connected things up as described in the wiring diagram, and had success! I was able to probe the router. (I had to run sudo ./tjtag -probeonly instead of just ./tjtag.)

Then I went off to the tjtag instructions here. The first few times I did:

sudo ./tjtag -backup:cfe

I got different results. It appears that tjtag on the Pi spends so much time sending output to the console that it messes up its timing. So I redirected the output to /dev/null, and after that I got consistent backups.

Once I had an nvram backup, I tried erasing the nvram:

sudo ./tjtag -erase:nvram

This worked, but didn’t solve my problem. So I thought I might have had a corrupted CFE. I located the CFE for my router here and modified it to have my IP addresses using imgtool_nvram. I used the following command:

imgtool_nvram.exe wrt54gs1.0-CFE.
BIN et0macaddr=00:11:22:33:44:55 il0macaddr=00:11:22:33:44:56

(substituting my real MAC address and one higher than it.) Then I dumped that back on the Pi as CFE.BIN, and did:

sudo ./tjtag -flash:cfe > /tmp/out

That worked, but still no joy in Mudville after I did the flash. No matter what, when I pinged I got destination unreachable. I wondered if it was Windows messing with me, so I booted to Kali to see what happened there. Still no dice.

Finally, I thought it might be a bad kernel, so I nuked it:

sudo ./tjtag -erase:kernel

Even with that, the router’s still not responding. Other than re-reflashing the CFE on the assumption that the bad kernel corrupted it, I’m out of ideas.

Drat, I thought I had it when I saw the instructions about setting the address with arp. (arp -s 192.168.1.1 aa-bb-cc-dd-ee-ff if you’re on Windows.) But even when I did that (using the MAC address that I flashed), I still had nothing. I even stuffed Wireshark on the end to listen for any packets. He’s dead, Jim.

Making the Netgear WGR614 a bridge

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 16 Aug 2014 20:51:55 -0700

For the longest time, I’ve had a Netgear WGR614 acting as a NAT for my wifi traffic. That meant I had a separate network for wifi traffic, rather than sharing traffic with my wired network.

Eventually this lead to problems. Some phone apps want to search the network for printers or set top boxes, for instance - and because the wireless devices were on a different network, they’d never find the wired devices.

After a long time thinking about this, I decided to see what it would take to turn my wifi router into a bridge. Turns out the Netgear WGR614 is very nicely suited to that. All it takes is one plug change and a few settings changes, and now my wireless and wired traffic is all on the same IP address range.

I found a few useful posts for this:

http://www.fieldsnet.com/2009/10/how-to-use-a-netgear-wgr614-wireless-router-as-a-bridge/

http://puzzling.org/uncategorized/2006/08/netgear-wgr614/

http://kb.netgear.com/app/answers/detail/a_id/19852

Note that this assumes you’ve got something else on the network that’s going to serve IP addresses for you. If you don’t know, you probably shouldn’t do this.

Here’s how to do it:

Unplug the Netgear WGR614 from everything except one laptop. Make sure the laptop is plugged into a regular port, not the WAN port.
Hard-reset the Netgear WGR614 (push the button that’s inset next to the WAN port for 10 seconds).
After the router reboots, connect to http://192.168.0.1 from the laptop. After a reset, the account is “admin” and the password is “password”.
You’ll be asked if you want to step through the configuration. Select “No, I know what I’m doing”.
First off, change that password. Choose the “Set Password” tab on the left and make it something better.
Next, go into the Wireless Settings tab. Set the SSID, security to WPA2-PSK and passphrase for WPA2.
If you know what channels other routers in your neighbourhood use, now is a good time to set the wifi channel as well.
Go to the LAN Setup tab and unclick “Use Router as DHCP Server”.
Next, on the LAN Setup tab set the IP address for the router to something in your static address range.
Now unplug the laptop and plug what was the WAN uplink cable into a regular port (non-WAN) on the router.
Unplug and re-plug the router.

Once you’ve done all that, your router will be acting as a bridge for traffic between the wifi and wired networks.

One warning: I originally didn’t hard-reset the router. This left it with an IP address of my internal wired network on the WAN port. Once I’d done that, I couldn’t connect to it over the LAN interface, since it saw that as an address conflict. So just hard-reset it.

Incidentally - this isn’t strictly a bridge, since the router has an IP address on the LAN. But it’s routing the packets from wifi to wired and back.

Hacking the APC Smart-UPS 1000

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 18 May 2014 12:31:28 -0700

I have an old APC Smart-UPS 1000 (SU1000NET) that recently started giving me bad battery warning beeps. I’ve had that in the past, and replacing the battery has always solved it. This time it didn’t.

First I read that sometimes the battery constant for these UPS devices can get confused. (I read that at: http://www.conetrix.com/Blog/post/Manually-esetting-an-APC-Smart-UPS-battery-constant-after-new-battery-replacement.aspx). So I did the reset procedure described there.

A few things to keep in mind before you do this:

You need an APC cable, not a plain serial cable. In my case I had one that I hooked up to an FTDI USB serial cable.
The instructions from the site above aren’t exact - they make reference to pressing **1** but they really mean press 1
There is no need to type any keys other than the ones specified. No returns, etc.
The keys are case-sensitive. Y is not y.

So I hooked the cable up, connected a terminal at 2400/8/N/1 Xon and changed the value of the battery constant from 79 back up to A0, which I’d read was the correct value for the SU1000NET. Here are the keys I entered:

Y (you see SM) 1 (then wait 1 second) 1 (you see PROG) 0 (I saw 79) +++++++ (and kept on pressing + slowly until I saw A0) R (you see BYE)

I pressed Y0R to see that it had been properly set. Then I pressed the self-test button and… more beeps and another battery failure indication. Boo.

So I figure something has gone awry with this UPS. I wanted to shut off the beeps at least. That led me to this wonderful site: http://www.networkupstools.org/ups-protocols/apcsmart.html

That describes the entire PowerChute protocol. So I decided to turn off the weekly self-test. I did: Y (see SM) E (see 336) + (see OK) E (see 168) + (see OK) E (see ON) + (see OK) E (see OFF) R (see BYE)

Hopefully that will turn the annoying beeps at 3am off. In the meantime, my UPS still tells me that the new batteries are bad. But when it loses power, it still does the right thing… so hopefully this will work.

Renaming an Android shortcut in TouchWiz (the hard way)

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 23 Feb 2014 22:14:47 -0700

Warning: the information presented below might break your phone. It’s quite easy to make a typo and delete all your shortcuts… which will leave you pretty much up the creek. I probably should have backed up launcher.db before I did all this, but I didn’t. Shame on me. So don’t do this unless you know what you’re doing. If you break things it’s not my fault.

I recently switched from using Astro File Manager to ES File Explorer. In almost all respects, ES File Explorer is a better file manager - but it has one significant shortcoming. In Astro, you can create a shortcut and specify its name at create time; in ES File Explorer your shortcut is named whatever the file was originally named.

This left me with ugly file names (including extension) on the home screen. I needed a way to rename. Lots of articles on the web pointed to apps that would do it, but it seemed unnecessary to have to download a whole other app just to rename something. In the end I figured out how to do it.

To start with, you’ll need the following (all of which I had installed on my phone already):

root access
an sqlite3 shell (I got mine from Titanium Backup Pro)
Android Terminal Emulator

Incidentally, my phone is a Samsung Infuse running Froyo… other phones may be different, and I don’t think you’ll find TouchWiz on non-Samsung phones.

First, I had to locate where the TouchWiz database was on my phone. This thread on xda-developers pointed me to /dbdata/databases/com.sec.android.app.twlauncher/launcher.db.

So… start up Terminal Emulator and do: $ su # cd /dbdata/databases/com.*twlaunch* # pwd pwd /dbdata/databases/com.sec.android.app.twlauncher # ls shared_prefs launcher.db

Groovy, there’s the launcher.db in the right place. Next I inspected it with sqlite3: # sqlite3 launcher.db SQLite version 3.7.6.3-Titanium Enter ".help" for instructions Enter SQL statements terminated with a ";" sqlite> .schema CREATE TABLE android_metadata (locale TEXT); CREATE TABLE apps (_id INTEGER PRIMARY KEY,componentname TEXT,top_number INTEGER NOT NULL DEFAULT 65535,page_number INTEGER NOT NULL DEFAULT 65535,cell_number INTEGER NOT NULL DEFAULT 65535); CREATE TABLE favorites (_id INTEGER PRIMARY KEY,title TEXT,intent TEXT,container INTEGER,screen INTEGER,cellX INTEGER,cellY,INTEGER,spanX INTEGER,spanY INTEGER,itemType INTEGER,appWidgetId INTEGER NOT NULL DEFAULT -1,isShortcut INTEGER,iconType INTEGER,iconPackage TEXT,iconResource TEXT,icon BLOB,uri TEXT,displayMode INTEGER); CREATE TABLE gestures (_id INTEGER PRIMARY KEY,title TEXT,intent TEXT,itemType INTEGER,iconType INTEGER,iconPackage TEXT,iconResource TEXT,icon BLOB); sqlite>

My educated guess based on the tables and what was in them was that the table “favorites” would be useful. Not only did it have a title and an intent, but cellX, cellY, spanX and spanY looked like things that might be used for shortcuts.

From there it was simple to look at what was in the table: sqlite> select * from favorites; ... 149|VE_Manual_Web_FINAL_2013.pdf|file:///mnt/sdcard/saved-pdf/VE_Manual_Web_FINAL_2013.pdf#Intent;action=android.intent.action.VIEW;type=application/pdf;launchFlags=0x10000000;end|-100|1|1|2|1|1|1|-1||0|com.estrongs.android.pop|com.estrongs.android.pop:drawable/format_pdf|||

Luckily, it looks like shortcuts are added by _id, and the number for _id increases as new shortcuts are added. That means the latest shortcut added is probably going to be at or near the end.

So… update the record and see what happens: sqlite> update favorites set title="VE Manual" where _id=149; sqlite> .quit #

Then go back to the launcher and look at my shortcut. Boo, it’s still the same as it was. So then kill TouchWiz by holding “Home”, clicking the “Ram Manager” tab, pressing the “Level 2” button and then the “Clear Memory” button… success! The shortcut is renamed. Tapping it causes the same behaviour as before… in all respects it’s the same shortcut, just the title has changed.

Incidentally, I ran into what looks like a problem with doing this. If I rename the shortcut then reboot, the shortcut loses its icon information. I think this has something to do with ES File Explorer being stored on SD. Strangely, it doesn’t happen when I don’t rename the file. Astro fills in the icon BLOB, but ES File Explorer doesn’t.

Editions of ARRL Hints and Kinks Books

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 14 Feb 2014 21:51:02 -0700

I’ve been looking around the web for a list of the ARRL “Hints & Kinks for the Radio Amateur” editions. I wasn’t able to find one, so here’s what I know:

Edition	Year	Orig Price	Preface
First volume (unlabeled)	1933	0.50
Volume Two	1937	0.50	Ross A. Hull (VK3JU operating as ARRL station W1MK/W1AW?)
Volume Three	1945	0.50	unsigned
Volume Four	1949	1.00	A. L. Budlong (W1BUD)
Volume Five	1954	1.00	A. L. Budlong (W1BUD)
Volume Six	1959	1.00	A. L. Budlong (W1BUD)
Volume Seven	1965	1.00	John Huntoon W1LVQ
8th Edition	1968	1.00	John Huntoon W1LVQ
9th Edition	1973? 1974?	2.00
Edition	Year	Orig Price	Editor
10th Edition	1978	4.00	Stuart Leland W1JEC
11th Edition	1982	4.00	Charles L. Hutchinson K8CH, Stuart B. Leland W1JEC, Larry D. Wolfgang WA3VIL
12th Edition	1989	5.00	Charles L. Hutchinson K8CH, David Newkirk AK7M
13th Edition	1992	10.00	David Newkirk WJ1Z
14th Edition	1997	12.00	Robert Schetgen KU7G, David Newkirk W9VES
15th Edition	2000	12.00	Larry Wolfgang WR1B
16th Edition	2003	15.95	Steve Ford WB8IMY
17th Edition	2004	17.95	Dana G. Reed W1LC
18th Edition	2012	22.95	Steve Ford WB8IMY

All the editions from 10 on are the large format (8 x 11 inches) and have an editor; the editions from 1 through 9 are 6 x 9 inch and sometimes have the writer of the preface/forward listed. N4MW has info about the earlier editions as well as other classic ARRL publications.

Thanks also to James Smith for clarifications about three of the earlier editions.

Optoelectronics Cub battery replacement

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 05 Jan 2014 18:46:31 -0700

I’m in the process of replacing the battery in an Optoelectronics Cub frequency counter I recently inherited. Unfortunately, the battery pack for this frequency counter (and the Optoelectronics Scout and apparently a bunch of others) is fixed in the device with double-stick tape and not really intended to be removed. A new one is available here: www.optoelectronics.com but that costs more than I want to pay, especially since it wears out after a while.

Instead, I decided to replace the battery pack with a battery holder that could hold NiMH batteries. The connector on the main board was about 5.3 mm wide and 4.4 mm high, with connectors about 2.5 mm apart. I think it’s a JST XH 2-pin connector.

According to the multimeter, the left pin is ground facing the socket. Unfortunately, this means the wires on my connector are the wrong colour - so I trimmed them short and soldered them to the correct wires on the battery holder with a quick bit of heat shrink.

The no-load voltage across the connector is 10 V. Since the battery claims to have 4 NiCd cells, I’m guessing (hoping?) it’s 4 * 1.2 V cells in series. Because the battery pack is designed to be charged fairly continuously, I also hope that it’s a slow charger as described here so I can use NiMH without danger.

Fitting the battery connector into the frequency counter requires a little work. First, it needs to go face down, so the curvature of the batteries matches the curvature of the case. Next, at least with the one I have, there’s a wire that goes across the connector from one side to the other. This needs to be at the bottom… which means the wires have to be run down the middle of the connector. Finally, the components on the PCB stick a little too far down. I had to remove some of the plastic on the left and right.

I used a Dremel with a sanding bit to make room down the back:

Putting back together required a little squishing, and I didn’t feel comfortable tightening the screws at the bottom that held the board down all the way. For now they’re just a little loose… a better option might be to get a few small washers under the board.

Useful parts:

Battery holder Radio Shack 2700391 ($2.49)
Connector pins eBay Micro JST 2.5 XH 2-Pin Connector with Wire Male Female x 10 set ($6)

Using the TinyLoadr to program ATtiny84s

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 27 Nov 2013 20:51:20 -0700

I’ve been using the excellent TinyLoadr Shield to program a bunch of ATtiny2313 chips I’ve got. Doing so was easy.

But when I moved over to program ATtiny84s, I ran into a bunch of problems. First, I’d get an error when burning the bootloader:

configuration file for part ATtiny84
avrdude: Yikes! Invalid device signature.

This was because, although I’d switched all the switches on in the second bank (and off in the first and third banks), I’d neglected to move the three jumpers below them from ATtinyx313 to Other.

Once I did that, I started getting different errors:

avrdude: stk500_paged_write(): (a) protocol error, expect=0x14, resp=0x64
avrdude: stk500_cmd(): protocol error

and

avrdude: stk500_paged_write(): (a) protocol error, expect=0x14, resp=0x64
avrdude: stk500_cmd(): programmer is out of sync

This is due to a defect in Arduino 1.0. Luckily, more information about the problem is here:

http://code.google.com/p/arduino/issues/detail?id=661

The upshot: I went into c:\Program Files\Arduino\hardware\arduino\cores\arduino and edited HardwareSerial.cpp to have the following:

#if (RAMEND < 1000)
#define SERIAL_BUFFER_SIZE 16
#else
// Was 64; changed to 128 for serial buffer overflow problem
// http://code.google.com/p/arduino/issues/detail?id=661
#define SERIAL_BUFFER_SIZE 128
#endif

I then reburned ArduinoISP on my Uno, then plugged the TinyLoadr back in. After that, I was able to burn ATtiny84s with no problem.

Upgrading Mythbuntu from Lucid to Precise

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 22 Sep 2013 00:30:28 -0700

Recently I decided to finally take the plunge and upgrade my Mythbuntu installation from Lucid (10.04) to Precise (12.04). I’d been getting prompts to do the release upgrade for a while, and I knew if I put it off too long then the upgrade path would disappear and I’d have to do a full reinstall.

The upgrade process was mostly painless. I did: sudo do-release-upgrade and walked away for quite a while. I had to kill X, and while churning the upgrade noticed that I’d modified /etc/sysctl.conf for the HDHomeRun: net.core.rmem_max=2097152

The big issue was lirc - the StreamZap remote has been turned into a devinput device by default, meaning it behaves like a keyboard. I decided that I would rather have the old lircd behaviour where different apps could have different keys. Here’s what I had to do:

1. Add a file /usr/share/X11/xorg.conf.d/90-streamzap.conf with the following contents: Section "InputClass" Identifier "Ignore Streamzap IR" MatchProduct "Streamzap" MatchIsKeyboard "true" Option "Ignore" "true" EndSection This tells X not to treat the StreamZap remote as a keyboard. That means lirc has a shot at getting the keystrokes, and means that only one keystroke will be generated (rather than 2 - one from lirc and one from the devinput driver).

I didn’t do this first, which led me to problems. (I ended up pushing the Mute button, which muted a bunch of my audio devices which I then had to undo.)

2. sudo dpkg-reconfigure lirc

I’m not sure how often I did this (I did it more than once). I also made sure to select the Streamzap remote in the Mythbuntu Control Centre. At the end, here’s what my /etc/lirc/lircd.conf looked like:

#This configuration has been automatically generated via
#the Ubuntu LIRC package maintainer scripts.
#
#It includes the default configuration for the remote and/or
#transmitter that you have selected during package installation.
#
#Feel free to add any custom remotes to the configuration
#via additional include directives or below the existing
#Ubuntu include directives from your selected remote and/or
#transmitter.
#Configuration for the Streamzap PC Remote remote:
include "/usr/share/lirc/remotes/streamzap/lircd.conf.streamzap"

Here’s what the first stanza of my /etc/lirc/hardware.conf looked like:

# /etc/lirc/hardware.conf
#
#Chosen Remote Control
REMOTE="Streamzap PC Remote"
REMOTE_MODULES="lirc_dev streamzap"
REMOTE_DRIVER=""
REMOTE_DEVICE="/dev/lirc0"
REMOTE_SOCKET=""
REMOTE_LIRCD_CONF="streamzap/lircd.conf.streamzap"
REMOTE_LIRCD_ARGS=""

3. Save your existing ~/.lirc/mythtv files, and any others you don’t want to lose. (I didn’t do this, and regretted it later.)

4. Run the following two lines:

mythbuntu-lirc-generator
mythbuntu-lircrc-generator

This nukes your exsisting ~/.lirc/mythtv (and ~/.lircrc) and creates new ones based on Mythbuntu defaults.

5. My mythtv file in the end (after putting my modifications back) looked like this:

# LIRCRC Auto Generated by Mythbuntu Lirc Generator
# Author(s): Mario Limonciello, Nick Fox, John Baab
# Created for use with Mythbuntu
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_0
config = 0
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_1
config = 1
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_2
config = 2
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_3
config = 3
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_4
config = 4
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_5
config = 5
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_6
config = 6
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_7
config = 7
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_8
config = 8
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_9
config = 9
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_MUTE
config = |
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_CHANNELUP
config = Up
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_VOLUMEUP
config = ]
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_CHANNELDOWN
config = Down
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_VOLUMEDOWN
config = [
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_UP
config = Up
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_LEFT
config = Left
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_OK
config = Return
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_RIGHT
config = Right
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_DOWN
config = Down
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_MENU
config = M
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_EXIT
config = Escape
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_PLAY
config = P
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_PAUSE
config = P
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_STOP
config = Escape
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_PREVIOUS
config = Q
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_NEXT
config = Z
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_RECORD
config = R
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_REWIND
config = PgUp
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_FORWARD
config = PgDown
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_POWER
config = Escape
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_BLUE
config = I
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_RED
config = D
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_YELLOW
config = A
repeat = 0
delay = 0
end
begin
remote = Streamzap_PC_Remote
prog = mythtv
button = KEY_GREEN
config = W
repeat = 0
delay = 0
end

I’ve got the blue button pushing I (for info), the red button pushing D (for delete), the green button pushing W (for width) and the yellow button pushing A (for playback speed).

I also set the power button to be another Escape, and Forward to PgDown and Backwards to PgUp.

You want to make sure the remote = Streamzap_PC_Remote, not the devinput remote.

Edit: Ha, I spoke too soon. I’m troubled by endless “Sorry, Ubuntu 12.04 has experienced an internal error” passwords. Luckily, this post explains how to at least turn them off, if not fix the problems.

Standard for 12 volt DC Edison sockets

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 02 Sep 2013 18:15:21 -0700

I recently decided to create a 12 V DC lamp for emergency lighting. I started with a 120 V AC desk lamp from a big box store ($5.99) and added one of the 2W 12V DC bulbs that use the Edison E26/E27 socket.

Of course, I needed to remove the existing NEMA 1 plug and replace it with something that can’t be plugged into household current. I chose PowerPole connectors. That brought up the question: what should be the positive terminal and what should be the negative?

I did a lot of searching in RV and boat wiring, but couldn’t find anything regarding polarity of Edison E26 / E27 sockets. So in the end I just went with what seemed sensible. I wired what used to be connected to the wide blade of the 120 V plug (neutral) to negative, and what used to be connected to the narrow blade to the positive terminal.

This means that in the E26 / E27 socket, the brass projection ends up connected to the + terminal and the shell ends up connected to the - terminal.

That seems to make sense to me - but if anyone knows a better standard I’d love to hear about it.

Connecting to HSMM-Mesh and the Internet from a laptop

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 03 Aug 2013 17:39:03 -0700

Note: This page does not discuss connecting HSMM mesh to the Internet. It’s just about talking to the mesh and the Internet from the same client device.

I’ve been playing with hsmm-mesh lately on my laptop. Up until now, when I’ve done this I could either view the HSMM mesh or the Internet, but not both. There were a couple of reasons:

1. My routing tables didn’t know how to direct traffic to the HSMM mesh network.

To solve this, I needed to tell the laptop to send traffic in the 10.*.*.* range to the HSMM mesh rather than to the default gateway:

ip route add 10.0.0.0/8 via 172.27.0.1 dev eth0

2. I had to make sure things were resolving right for DNS (in my /etc/resolv.conf):

domain austin.tx.us.mesh
search austin.tx.us.mesh
nameserver 172.27.0.1
nameserver 192.168.1.1

DNS is still a bit of an issue. 172.27.0.1 resolves anything in *.austin.tx.us.mesh, so my local network is never found. But at least I can browse the web and HSMM.

Android superuser not coming up

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 17 Jun 2013 23:54:25 -0700

I ran into a weird problem on an Android 2.2 (Froyo) phone that I had. Although it was rooted, and Superuser was installed, su wouldn’t come up. Trying to root it again with SuperOneClick didn’t seem to work either. Starting Titanium Backup (which worked in the past) yielded “asking for root rights”, and trying to run Terminal Emulator and su just hung.

Finally, I stumbled my way to something working. I ran SuperOneClick 2.3.1 first. I turned off the “automatically start” option of LBE Privacy Guard. I rebooted, then ran ADB shell and was able to get root from there:

C:\super1click\adb\adb shell
$ su
#

From there, I figured out what device /system was:

# cat /proc/mounts

From this I determined that /system was mounted on /dev/block/stl9, so:

# mount -ro remount,rw /dev/block/stl9 /system
# chown root.root /system/bin/su
# chmod 6777 /system/bin/su

At this point, I was able to start su and do the “check for update”. su determined that it was out of date, and downloaded a new version, fixing the permissions as it did so. (6777 is a little lax, but I couldn’t remember what su was supposed to be.)

I have no explanation as to why su would break. I have no explanation why this would fix it, but it did for me. Maybe it will for you as well.

Solving Firefox "window sent to back" when opening new window

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 17 Jun 2013 23:54:25 -0700

Since I’ve had Firefox on my Windows 7 machine, I’ve noticed that with certain websites when you open a new window, it will be opened, but then moved behind the current window. Not life-threatening, but an annoying quirk. Tonight I finally was annoyed enough to find the solution.

I found an answer on this post at the support forum for Mozilla - which in turn pointed me to this article from Adobe.

Short answer: disable “protected mode” on Flash to prevent this behaviour. It’s frustrating to have to make Flash less secure to solve this, but I rationalize it by saying it’s no less secure than Flash on XP.

How to do this? From the Explorer, navigate to c:\windows\system32\notepad.exe and select “Run as Administrator”, then open:

C:\windows\system32\macromed\flash\mms.cfg

(or c:\windows\system64\flash\mms.cfg if you’re on Windows 64 bit). Add the following to the end of the file:

ProtectedMode=0

Save the file and you’re done.

Useful resources for filter design

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 30 Mar 2013 01:58:45 -0700

Some useful links I’ve found for designing passive RF filters:

Migrating from Lotus Approach to LibreOffice Base

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 10 Mar 2013 15:02:44 -0700

I had a number of databases in Lotus Approach. Luckily, I’d had the foresight to make them dBASE databases, which LibreOffice knows a little about.

However, it doesn’t look as if LibreOffice knows much about Lotus Approach, which means all my existing forms were history. I started migrating them to LibreOffice forms. The form designer is a little rustic in LibreOffice (shift to multiselect on Windows, still can’t figure snap to grid out), but it’s enough to do what I need.

I used the automated form wizard to create forms from the fields first. That was enough to get started.

Next, I had a couple of fields that were combo boxes in Approach. To change the text field in LibreOffice Base to a combo box, I followed the instructions here:

listarchives.libreoffice.org/global/users/msg12693.html

In case that goes away, here’s the summary of what I did:

Click on the text field that the wizard created
Since that field is actually a group, pop up the context menu and say Group->Ungroup
Click on the text field rather than the label
Pop up the context menu and say Replace With->Combo Box
Pop up the context menu and select “Control…” to open control properties
All my combo boxes were populated from the database. To do that, choose the Data tab
Change “Type of list contents” from “Table” to “Sql”
For “List content”, enter SELECT DISTINCT “field” FROM “table” (e.g., SELECT “ARTIST” FROM “CD” for my CD database)
Close the Properties dialog
Re-group the field with its label

The same thing worked for dropdown lists - Replace With->List Box, change “Type of list contents” from “Valuelist” to “Sql” and use similar SQL to generate the list. I used “SELECT DISTINCT” rather than just “SELECT” because I didn’t want multiple copies showing up in my list box.

Creating headers in LibreOffice

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 20 Feb 2013 23:57:10 -0700

Recently I had to create headers in LibreOffice. It’s not hard, but neither is it obvious. Here’s how I did it:

Insert->Header->Default
Format->Page->Header and unclick “Same page left/right”
Edit the header to have all the text you want (sans fields)
Insert the fields in the right places. I wanted Chapter and Page Number, so I did Insert->Fields->Page Number and Insert->Fields->Other->Chapter. I used tab to space them out. (In general, page number goes on the left for even pages and on the right for odd pages.)
That was cool and all, but left me with a page number on page one, which I didn’t want. Luckily, I found this site which explained the magic. Go to the first page, then click Format->Styles and Formatting. Pick the fourth box (Page Styles) and double-click on “First Page”.

Done! Now I have headers that look like books or magazines.

Migrating from Pegasus to Thunderbird

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 20 Dec 2012 16:32:07 -0700

I’ve been on Pegasus Mail for ages. It’s OK, but not open source, and I’ve always had the vague fear that some day my email will be locked away due to a format change. In addition, its HTML handling is not the best, and the way it does multiple accounts is a little weird. Finally, it was getting slow on my Windows XP PC due to the file system - and migrating it from one PC to another is a pain, especially if you’re changing the drive the data lives on.

So I resolved to move to Thunderbird. I started from here: www.techspot.com/community/topics/how-to-convert-emails-from-pegasus-to-thunderbird-format.17806/

and here: fixunix.com/mozilla/420484-pegasus-thunderbird-import-problems.html

and when I did the MBox method, it seemed to work fine. Until I looked at the folder on Thunderbird and saw more messages than I’d counted on.

It appears that Thunderbird uses “\n\nFrom .*\n” to filter its messages. Ok, but Pegaus doesn’t quote the From in “From the editor:” which appears at the start of the line in some of my messages. Argh! This left me with lots of messages split in half, with weird dates and strange subjects / from / to lines.

I hacked up the following awk script, which I put in a file called peg2tbird: /^From / && ! /\?\?\?\@\?\?\?/ { printf ">%s\n", $0 } !(/^From / && ! /\?\?\?\@\?\?\?/ ) { printf "%s\n", $0 }

This takes any line that matches “From " but doesn’t match “From ???@???” and puts a > in front of the From. All other lines it leaves as-is.

Then I ran: \cygwin\bin\gawk -f peg2tbird < unx01234.mbx > tbird-mbox-file

Then I copied tbird-mbox-file to my Thunderbird Profile directory (in Mail\Local Folders).

This makes the messages look a little strange in Thunderbird - they look like “>From the editor:”. Also, some messages ended up showing with today’s date - inserted by Pegasus. (I think it was just those generated by a virus checker, so they were probably less well-formed than real messages.) Sigh. Oh well, that’s good enough for me to get my old messages migrated.

Repairing a Samsung LN32A450

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 12 Dec 2012 22:33:21 -0700

I own a Samsung LN32A450 TV set, which has been fairly good so far… until last weekend, when it didn’t turn on. Instead, the power LED flashed steadily at about one flash every 500 ms.

It seems that my TV set suffered from the capacitor plague. A bunch of the Samwha capacitors swelled up and were no longer to spec. I could order a replacement board (the board is BN44-00214A available from findparts4you.com). A little searching showed that others had successfully revived their power boards just by replacing the capacitors.

First, I had to open the TV set. This involved removing 16 screws (all the same size) from the back. I discoverd I had to be careful with the ones marked “S” - those four also hold the TV stand in place, so I wanted to remove them last. Also, there’s a screw on the back panel below the “EX-Link” connector, and another one on the back underneath the A/V 2 inputs.

Once I did that I could slide the back off (face down, since the support was unscrewed). The power board is the one in the middle. There are five connectors to disconnect from there: two at the upper left, one at the upper right, and two power connectors that go to the lower right. In my case they stayed in the right position once I removed them because there was tape holding them to the flat panel.

After that, I removed 6 small screws that held the power board in. I didn’t need to remove any of the standoffs - they’re just there to push the board away from the flat panel.

When I investigated the board, I could see the telltale swelling of capacitors that indicated problems. I saw problems with four capacitors:

CB852 in the middle right of the board: 2200 uF 10V CW856 near the top left: 470 uF 25V CW858 right below CW856: 680 uF 25V CM868 right below CW858: 680 uF 35V

Some people reported success with using Radio Shack replacement capacitors. I was a little nervous about that - these caps are all rated to 105 degrees C and have high ripple current tolerance, and I didn’t want to swap in something I’d just have to replace later. I ended up getting replacements from Digi-Key. They have a minimum $25 order (otherwise they charge you $5 for handling). Luckily I had some other stuff to buy at the same time.

I replaced them with the following:

CB852: Panasonic EEU-FC1A222L (Digi-Key part P11189-ND) CW856: Panasonic EEU-FM1E471 (Digi-Key part P12388-ND) CW858: Panasonic EEU-FM1E681 (Digi-Key part P12390-ND) CM868: Panasonic EEU-FM1V681 (Digi-Key part P12417-ND)

The replacement for CB852 was about 1 cm taller than the original part, and that made it the tallest part on the board. I was a little worried about that, but there seemed to be enough clearance that it didn’t cause a problem.

These capacitors are electrolytic and have a polarity, so I had to replace them the same way ‘round that the originals were. Luckily, on my circuit board all the negative terminals were marked with a white semicircle underneath the capacitor.

After that, I plugged the cables back into the board (not forgetting the single-pin green ground cable). Then I put the 6 screws back.

Next I put the cover back on and put the 16 screws back in. I started with the base “S” screws, then the top three, then kind of haphazardly put the rest in the right places.

Then I powered up. Success! The TV came on and was as good as it was before this happened.

A few links I found useful: forums.cnet.com/7723-13973_102-334836/samsung-ln32a450-died/ forums.cnet.com/7723-13973_102-401147/samsung-ln32a450-power-light-blinking-but-does-not-power-up/ forums.cnet.com/7723-13973_102-359389/samsung-lcd-tv-ln-t5265f-black-screen-diagnosis-help/ www.samsung.com/us/capacitorsettlement/

Maxtor Shared Storage II 320 G power supply

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 09 Dec 2012 13:29:39 -0700

Since I have recently moved, I’ve discovered how much I hate devices that don’t clearly label their power supplies. All my wall warts got detached from their devices in the move, and I’m gradually re-unifying them.

Today’s example: the Maxtor Shared Storage II 320 G external drive. It takes 12 volts DC, 3A, centre positive, and a brick I had from Goodwill with a 5.5mm outer barrel connector seemed to fit well.

Changing MAC address on OpenBSD

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 06 Dec 2012 00:49:03 -0700

A little while ago, I needed to change my MAC address on the OpenBSD firewall I’ve got running. (My ISP kept feeding me a bad IP address from an old lease and I wanted a new one.)

It’s easy to do this on OpenBSD:

ifconfig vr1 down ifconfig vr1 lladdr 00:11:22:33:44:55 ifconfig vr1 up

The question is, where’s the right place to put this to make it permanent? A few web searches revealed that a bunch of people had modified /etc/netstart by putting the ifconfig vr1 lladdr line somewhere near the beginning. I’d rather not sully my pristine /etc scripts with changes if I don’t have to.

Linux has /etc/network/interfaces, and OpenBSD has /etc/hostname.if. I just changed my /etc/hostname.vr1 to:

dhcp lladdr 00:11:22:33:44:55

and I was requesting an IP address using my new MAC address.

Repairing a Dell Inspiron N4010

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Dec 2012 01:26:32 -0700

I recently had a friend bring me a Dell Inspiron N4010. The laptop wouldn’t boot up, and the friend wanted to get the data off the hard drive.

I figured that would be a fairly easy task. Little did I know…. I started by looking at Youtube videos about taking apart the N4010. Here’s the best Inspiron N4010 video - or rather, first in a series of three for over 30 minutes total time.

Turns out, Dell in their infinite wisdom decided not to put a door on the case to allow access to the hard drive. Instead, you have to remove the keyboard and motherboard to swap it out. This proves that Dell’s engineering department is willing to hire the insane.

Luckily, the video showed disassembly as well as assembly. I knew my friend had taken the laptop to Best Buy a few weeks before it stopped working to put a new hard drive in. (And again after it stopped: that time the Geek Squad claimed “no fix was possible” because there were no BIOS beeps.) The video showed a stick-on plastic piece that wasn’t present (any more) on my friend’s laptop between the keyboard and the motherboard.

With the laptop disassembled, I said “why not” and tried to boot. It came up. I connected the laptop up to the network and backed up the hard drive.

The stick-on plastic piece appeared to keep the keyboard from shorting the motherboard. More of that Dell quality. I’m guessing the Geek Squad just tossed it. I fabricated a quick replacement from some polyester film I had hanging around. Who knows if it will last, but at least the machine boots now.

I’m really glad I did this. It made me 100% sure I would never buy a Dell laptop. Ever.

Error 1303 upgrading LibreOffice 3.5.3 to 3.5.6

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 30 Sep 2012 21:36:58 -0700

It looks like LibreOffice prompts you now when there’s an upgrade. I ran into a problem, though, when trying to upgrade on Windows 7.

When I tried the upgrade, I was told that I didn’t have enough permissions - even when I was running as administrator. I’d get an “error 1303: Installer has insufficient privileges to access C:\Program Files\…” and the install would always fail.

Even when I tried to take ownership of the files in that directory, I couldn’t. It was a puzzle. After a while messing about, I decided to nuke the whole thing from orbit. Finally that gave me a clue: when I tried to delete the files, some were left because a process was holding them open. (There were a couple of files - under share\config\soffice.cfg\modules\sglobal\toolbar) and whatever was running must have restarted at boot because it survived a reboot.)

That gave me the hints I needed. I booted into safe mode and deleted “C:\Program Files\LibreOffice 3.5” and its subdirectories. That worked, then I rebooted into normal mode and installed the 3.5.6 installer files. Now LibreOffice is upgraded and working again.

Final cleanup for the ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 06 Jul 2012 22:38:45 -0700

Finally, there are a few things that I either forgot to do or that make life easier.

Setting up localtime By defaut, /etc/localtime is set to Alberta, where OpenBSD has its home. I need to set it to somewhere closer.

rm /etc/localtime; ln -s /usr/share/zoneinfo/US/Mountain /etc/localtime

Now date shows the correct time.

Blinkenlights I wrote a script to make the LEDs move back and forth. I start this at boot. (In an earlier version of the firewall, I edited /etc/rc to turn LEDs on when certain thresholds had been passed in the boot process. But now I don’t want to muck up /etc/rc so much.)

First of all, you need to allow the ports to be written before OpenBSD gets all secure on you. Edit /etc/rc.securelevel and add:

#
# Place local actions here.
#
echo -n 'enabling LED pins'
gpioctl -q /dev/gpio0 6 set out iout
gpioctl -q /dev/gpio0 25 set out iout
gpioctl -q /dev/gpio0 27 set out iout

I got these numbers from the Status LEDs section of the ALIX manual.

Then create /usr/local/bin/cylon:

#!/bin/ksh -
led3on(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 1
}
led2on(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 1
gpioctl -q /dev/gpio0 27 0
}
led1on(){
gpioctl -q /dev/gpio0 6 1
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 0
}
ledsoff(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 0
}
while [ true ] ; do
led1on
sleep 1
led2on
sleep 1
led3on
sleep 1
led2on
sleep 1
done

Finally, start it from /etc/rc.local:

# Add your local startup actions here.
echo -n 'cylon'
sh /usr/local/bin/cylon &

On reboot, yay, blinky! That at least tells you the kernel hasn’t crashed.

Reducing the mail Because flashrd is really OpenBSD, it sends mail more suited to a server than a firewall with limited disk.

First thing I noticed:

Running security(8):
Checking special files and directories.
Output format is:
filename:
criteria (shouldbe, reallyis)
etc/rc.conf.local:
permissions (0644, 0755)

I fixed that with a chmod 0644 /etc/rc.conf.local. So now /usr/libexec/security shows no problems. Good.

Once that’s done, make things complain less:

crontab -uroot -e

and comment out:

#30 1 * * * /bin/sh /etc/daily
#30 3 * * 6 /bin/sh /etc/weekly

This prevents the daily and weekly reports, leaving just the monthly one.

Next, I noticed that sendmail gets run from root’s crontab, so it doesn’t need to run at boot:

/etc/rc.conf:

sendmail_flags=NO # "-L sm-mta -C/etc/mail/localhost.cf -bd -q30m"

That should keep the thing running a little longer without running out of disk. Actually, /var/mail is on the MFS, so it will keep it from running out of ramdisk.

(This post is part of Building an ALIX firewall)

Setting up BIND on the ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 27 Jun 2012 23:23:07 -0700

Setting up BIND is probably the part that took more thought than any other when building the firewall. This is not because of any particular technical challenges; rather, BIND is managed by a consortium and its doc is… voluminous.

In the end, I went with the default /var/named/etc/named.conf on the assumption that it would do the right thing. According to its comment, it does both “recursive and authoritative queries using one cache,” which is what I want.

There are four files that need to change:

/etc/rc.conf
/var/named/etc/named.conf
/var/named/master/mydomain.net
/var/name/master/mydomain.net.rev

The last two can be named anything, but I stuck with conventions as I saw them.

Warning Unlike everything up to now, the BIND files live on /var/. In flashrd, /var gets unpacked at boot time into a RAM disk. So you need to save any changes you make somewhere else. Do not reboot until you’ve saved your changes! Ultimately, we’ll put these changes in /flash/var.tar so they get re-created when the device reboots.

/etc/rc.conf To enable named, change: named_flags=""

/var/named/etc/named.conf I used the default named.conf, which is really just a copy of named-simple.conf.

I made one addition in the options section:

 forwarders { 8.8.8.8; };

This tells DNS to look for answers at the Google DNS server if it can’t find the answer on the local DNS server. (Actually, I put a few DNS servers that were specific to my ISP, but the Google server will work too.)

I also made a few changes near the end:

// Master zones
//
zone "mydomain.net" {
type master;
file "master/mydomain.net";
};
// Reverse mappings for mydomain.net domain
zone "150.168.192.in-addr.arpa" in {
type master;
file "master/mydomain.net.rev";
};

This tells named to look in /var/named/master/mydomain.net for mappings of mydomain.net, and to look in /var/named/master/mydomain.net.rev for mappings of 192.168.150.*.

/var/named/master/mydomain.net Here’s my mydomain.net:

mydomain.net. IN SOA firewall.mydomain.net. myemail.yahoo.com. (
1 ; Serial
10800 ; Refresh after 3 hours
3600 ; Retry after 1 hour
604800 ; Expire after 1 week
86400 ) ; Minimum TTL of 1 day
;
; Name Servers
;
mydomain.net. IN NS firewall.mydomain.net.
;
; Host addresses
;
localhost.mydomain.net. IN A 127.0.0.1
firewall.mydomain.net. IN A 192.168.150.1
firesign.mydomain.net. IN A 192.168.150.170
frantics.mydomain.net. IN A 192.168.150.171
bundolo.mydomain.net. IN A 192.168.150.172

The first bit says my domain is called mydomain.net. I’ve published my email as myemail@yahoo.com (but note the dot instead of the at sign there).

The next bit is serial number / expiration times. You’re supposed to bump up the serial number every time you edit, but I usually just kill and restart named.

After that, I say that the firewall will be the nameserver for the domain.

Next is the interesting bit: the mapping of host names to host addresses. They must all end in . because BIND requires it. It’s very easy to miss a . in your config file and be confused about why things aren’t working.

/var/name/master/mydomain.net.rev In addition to DNS doing lookup for names, it usually also does lookup for IP addresses. This is what you get when you do nslookup 192.168.150.1, for instance. The reverse domain name file holds that:


150.168.192.in-addr.arpa. IN SOA firewall.mydomain.net. myemail.yahoo.com. (
1 ; Serial
10800 ; Refresh after 3 hours
3600 ; Retry after 1 hour
604800 ; Expire after 1 week
86400 ) ; Minimum TTL of 1 day
;
; Name Servers
;
150.168.192.in-addr.arpa. IN NS firewall.mydomain.net.
;
; Addresses point to canonical name
;
1.150.168.192.in-addr.arpa. IN PTR firewall.mydomain.net.
170.150.168.192.in-addr.arpa. IN PTR firesign.mydomain.net.
171.150.168.192.in-addr.arpa. IN PTR frantics.mydomain.net.
172.150.168.192.in-addr.arpa. IN PTR bundolo.mydomain.net.

Once again, watch for . characters at the end of .arpa. and .net.

At this point, you can kill and restart named, then: nslookup server localhost frantics

You should see something like:

Server: localhost
Address: 127.0.0.1#53
Name: frantics.mydomain.net
Address: 192.168.150.171

/etc/resolv.conf.tail The DHCP client overwrites /etc/resolv.conf, but then appends whatever/s in /etc/resolv.conf.tail to that. So let’s tell OpenBSD that Change /etc/resolv.conf to point to the running nameserver:

nameserver 192.168.150.1
domain mydomain.net
search mydomain.net
lookup bind file

This sets up the firewall as the nameserver to look for, tells what my domain is, says to search foo.mydomain.net when looking for foo, and to look up via bind first and then /etc/hosts.

/etc/dhcpd.conf Now is a good time to change dhcpd.conf to point to your nameserver instead of someone else:

option domain-name-servers 192.168.150.1;

Save those changes To save the changes that are in /var, use the following command: tar cf /flash/var.tar -C /var . Might as well save a copy somewhere else too: tar cf /root/named.tar /var/named

Things are saved away as well as they’re going to be; time to reboot and hope you didn’t miss anything!

(This post is part of Building an ALIX firewall)

Setting up PF for the ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 26 Jun 2012 23:09:49 -0700

The next step on the firewall is to set up the packet filter PF. Most of what I do here comes from the OpenBSD PF FAQ.

Setting up PF itself The file to edit is /etc/pf.conf. Here’s mine:

# macros
int_if="vr0"
ext_if="vr1"
# FTP Proxy rules
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp \
divert-to 127.0.0.1 port 8021
# options
set block-policy return
set loginterface $ext_if
set skip on lo
# match rules
match out on egress inet from !(egress) to any nat-to (egress:0)
# filter rules
block in log
pass out quick
antispoof quick for { lo $int_if }
# uncomment this to respond to pings
# pass in inet proto icmp all icmp-type echoreq
pass in on $int_if

It’s basically the example config file for home or small office, with a couple of changes:

I define an int_if and ext_if for internal network and external network
I don’t have any port forwarding from outside through to the inside network except ftp-proxy
I block all incoming ICMP traffic (which is broken according to spec, but might keep me safer from denial of service attacks).
I keep port 22 closed on the firewall machine.

Basically, I present a blank wall to the Internet. Traffic I initiate can get out, but outside doesn’t get in except via ftp-proxy.

One thing to note is that if you mess up pf, you can get into a state where you can’t talk to your ALIX over the network. So make sure you have a serial port handy to talk to it. I’d recommend making changes to pf.conf over serial, and then testing with the network.

To test, run:

pfctl -F all
pfctl -f /etc/pf.conf

The first command flushes whatever existing PF config is there; the second command loads your new pf config.

Next, hook up a machine to the switch that’s connected to the LAN side of the firewall, and see if you have Internet. If you do, life is good!

Getting FTP running You might have noticed I use ftp-proxy in my pf.conf. That’s a daemon that needs to be enabled in /etc/rc.conf: ftpproxy_flags=""

According to the PF FAQ, you can run ftp-proxy to get the daemon going, but I rebooted instead after changing /etc/rc.conf. Also according to the FAQ, some (fussy) clients may need “-r” on ftpproxy_flags.

Blocking IP addresses using PF I haven’t done this before, but I wanted to try blocking ad servers by IP address using PF. Some instructions are here.

My list of IP addresses came from the excellent pgl.yoyo.org/adservers site. I picked “list ad server IP addresses” as plain HTML text, checked the “view list as plain text” button, and pressed “go”. This gave me a URL that I copied.

I wanted a semi-automatic way to download this list. Luckily, OpenBSD’s ftp is a lot more than plain FTP. You can use it instead of wget/curl/etc. Here’s the command I used:

ftp -o /etc/pf.blocked.ip.conf "http://pgl.yoyo.org\
/adservers/iplist.php?ipformat=plain&;showintro=1&\
mimetype=plaintext"

Then I updated my pf.conf to account for that:

# macros
int_if="vr0"
ext_if="vr1"
# Table of IP addresses to block
table <blockedips> persist file "/etc/pf.blocked.ip.conf"
# FTP Proxy rules
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp \
divert-to 127.0.0.1 port 8021
# options
set block-policy return
set loginterface $ext_if
set skip on lo
# match rules
match out on egress inet from !(egress) to any nat-to (egress:0)
# filter rules
# These two rules block traffic from blacklisted IP addresses
block drop in quick on $ext_if from <blockedips> to any
block return out quick from any to <blockedips>
block in log
pass out quick
antispoof quick for { lo $int_if }
# pass in inet proto icmp all icmp-type $icmp_types
pass in on $int_if

I’m not sure if this strategy will work long term. Previously I excluded ad servers in named instead. Excluding by IP address seems to take less RAM (I’ve got about 163M free of my 256M RAM with this table loaded) and has the advantage of blocking sneaky servers that use IP address URLs. The downside is that if another server uses the same IP address, I won’t get the content, and I have no real way to unblock by name if I need to.

At any rate, to update, I just need to do the ftp command again, and then: pfctl -t blockedips -T replace -f /etc/pf.blocked.ip.conf

(This post is part of Building an ALIX firewall)

Setting up networking for the ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 24 Jun 2012 17:41:36 -0700

The next step in building an ALIX firewall is to set up networking.

Setting the hostname

Edit the file /etc/myname to be the hostname you want (don’t forget to rw first if you need to).
Run: hostname `cat /etc/myname` to set the hostname in lieu of rebooting.

Figuring out which port is which On my ALIX, Ethernet port vr1 is the port nearest to the serial port and vr0 is the one nearest to the power cable. I figured this out by plugging one port into the network and running ifconfig. In my case I saw:

vr1: flags=8802 mtu 1500
lladdr 00:0d:ba:36:d9:30
priority: 0
media: Ethernet autoselect (none)
status: active

whereas vr0 had status: no carrier. That told me that vr1 was the one on the network. I labelled the ports so I wouldn’t forget. (Since my plan is to have a firewall with one port for the internal LAN and another for the world, I used labels vr0:lan and vr1:world.)

Setting up the DHCP client on vr1 My ISP assigns me an IP address using DHCP. In the older flashdist, you had to edit /etc/rc to start up dhclient to get this address. With flashrd, it’s easier once again: echo dhcp > /etc/hostname.vr1 sh /etc/netstart

At this point the ALIX will go to your local network and request an IP address via dhclient. Hopefully you have a DHCP server somewhere on your network; otherwise you’ll need to read Section 6 of the OpenBSD FAQ.

Setting up the LAN interface I decided that I wouldn’t mess around with IPv6 just yet… I want to set up a NAT firewall using IPv4. To start with, I had to pick an IP address for my internal network. I’m going to use my ALIX box for DHCP, name resolution, and as a gateway. (Yes, I know this is bad practice… but I’m on a limited budget!)

I picked address 192.168.150.* for my network. This means my firewall will be 192.168.150.1, and I’ll use that as the gateway address of other machines which are its DHCP clients.

echo inet 192.168.150.1 255.255.255.0 NONE > /etc/hostname.vr0 sh /etc/netstart

Run the dhcpd server So that the firewall can serve IP addresses, it needs to have dhcpd enabled. The right place to do this is in a section of rc.conf.local, but I got lazy and edited it in /etc/rc.conf. If I had to do this over, I’d use /etc/rc.conf.local. The code I changed was: dhcpd_flags=""

Next we need to tell it what the subnet is that it will serve DHCP addresses to. This is defined in /etc/dhcpd.conf: option domain-name "mydomain.net"; option domain-name-servers 8.8.8.8; subnet 192.168.150.0 netmask 255.255.255.0 { option routers 192.168.150.1; range 192.168.150.32 192.168.150.127; # host static-client { # hardware ethernet 22:33:44:55:66:77; # fixed-address 192.168.1.200; # } # host pxe-client { # hardware ethernet 02:03:04:05:06:07; # filename "pxeboot"; # next-server 192.168.1.1; # }

In my case for absolutely arbitrary reasons, I said to serve from 192.168.150.32 to 192.168.150.63. I left the pxe-client and static-client things in case I needed them later.

Also note that right now I’m using Google’s 8.8.8.8 as the DNS server. I could have used my ISP’s instead - either way, it’s going to change once I get BIND running on the firewall.

Add myself to hosts This is a good time to add myself to the /etc/hosts file (both under the short name and fully-qualified domain name): 192.168.150.1 myname myname.mydomain.net

Enabling port forwarding Next we need to allow the firewall to forward IPv4 traffic. To do this, edit /etc/sysctl.conf: net.inet.ip.forwarding=1

Update the time from the network Since the ALIX doesn’t have a real time clock that stores the time, we need to update it from the network every time we reboot. This is in /etc/rc.conf: ntpd_flags="-s" The -s says “update the time now to the server time and don’t try to adjust it slowly.” That’s the right thing to do when the box thinks the time is way in the past.

At this point, I figured it was time to reboot the device and see if everything came up as expected. /sbin/shutdown -r now

Now plug a switch into the vr0:lan port, a computer into the switch, and see if you can get an IP address. You’re not doing enough yet to have an Internet connection, but ipconfig /all on a Windows laptop should show a correct IPv4 address, subnet mask, gateway, dhcp server and DNS server. Groovy, you’ve got a network!

(This post is part of Building an ALIX firewall)

Getting OpenBSD 5.1 on the ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 20 Jun 2012 23:11:44 -0700

Getting OpenBSD on the ALIX used to be quite an effort. You had to figure out what your CF card looked like, enter the right drive parameters, and hope. Now it’s dead easy:

Download the flashrd binary image. I used flashimg.i386.wd0.com0-20120531.gz, which is root wd0, com0 38400 console. This matches the Alix BIOS default, which also spits out 38400 serial.
Unzip the image with gzip -d
Write the image to the CF card. I have Cygwin installed, so I was able to use dd. Since I’m running this on Windows 7, I had to open my Cygwin shell as Administrator. The command I used:
```
dd if=flashdist.i386.wd0.com0-20120531 of=/dev/sdd bs=128k
```
I was pleasantly surprised that dd worked. (I found the device by doing sfdisk -l /dev/sda, then sdb, then sdc, until I found a partition table that looked like my 4 GB flash drive.) I picked 128k as the block size because the image was evenly divisible by that. I don’t know if it makes a difference, but I figured why risk it.
Next I hooked up a DB9 F/F mini null modem to my PC serial port, connected that to the Alix serial port, ran hypertrm (which I had to get from an earlier Windows release) and was talking to OpenBSD. Root password was “root” (no quotes).
At this point I reset the password: rw passwd root ro rw is the flashrd way to say “mount the file system read/write”, and ro says “mount the file system read-only”. flashrd boots up read-only (which saves wear on the flash card) so you need to set it to read/write if you want to do pretty much anything.

That’s all there is to it!

(This post is part of Building an ALIX firewall)

Building an ALIX firewall

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 20 Jun 2012 23:02:03 -0700

It’s been a long time since I updated my firewall. Right now it’s a PC Engines ALIX 2c2 that I’ve been really happy with. I used flashdist and put OpenBSD 4.4 on it.

I think that’s a winning combination, but it’s time to upgrade. First, I want to go to OpenBSD 5.1. Next, flashdist has been replaced with flashrd, which is easier to install and use, and more appropriate for larger CF cards.

I started by getting an ALIX 2d2 (just one more IDE header than the 2c2, not much change). I bought it from mini-box.com, and I also picked up the custom enclosure for it and a power supply.

I already had a 4 GB CF card: a Kingston 4GB elite pro 133X, which was new when I built the original firewall. Make sure you have a good CF writer. I’ve had failures with cheapies, but got a Kingston FCR-HS219/1 and that worked.

There are a number of steps to get a working firewall. They are:

Solving Youtube "Cannot Play Video" on Android

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 20 Jun 2012 00:36:48 -0700

Recently, my phone entered a state where it would “sort of crash” when I tried to play Youtube links using the internal Youtube app. I could play in Flash fine, but if I opened the same link with the Youtube app, it would:

vibrate twice
vibrate again
open a dialog titled “Cannot play video” with the text “Sorry, this video cannot be played”

Lots of users have seen this, but there weren’t too many solutions. I started out by uninstalling and reinstalling the Youtube app. No luck there. Then I found this AndroidCentral thread and in particular Sumabot’s post.

That set me down the right path. I didn’t want to wipe out as much as he did, but I did do this:

Open the web browser
Menu -> More -> Settings
Clear Cache
Clear history
Clear all cookie data
Clear location access
Reset to default

I might just have needed to “Reset to default” - if it happens again that’s what I’ll try next.

Update: I’ve figured out that opening a Youtube video in another window (regardless of cache state) will cause the browser to crash. In my case, just clicking on the link (as opposed to long-pressing and saying “Open”) seems to work.

Installing new certificates on Android

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 12 May 2012 12:46:02 -0700

Recently I’ve encountered a website that is using the certificate “Verisign Class 3 Secure Server CA - G3”. Unfortunately, my Android device (Samsung Infuse running Froyo 2.2.1) doesn’t know about that certificate, so I get a warning.

Installing a certificate on this device is not hard, but there are one or two tricks.

First, download the certificate. For me it was a Verisign certificate. I did a search on the certificate title and determined it corresponded to the Verisign cert SVRSecureG3.cer, so I went to crl.verisign.com and grabbed it. (Note that .cer is the certificate and .crl is the certificate revocation list.)

Once you have the .cer, it’s unfortunately in binary mode. Use openssl (which is included as part of Cygwin for Windows users) to convert it to a .crt:

$ openssl x509 -in SVRSecureG3.cer -inform DER -out SVRSecureG3.crt -outform PEM

Install that .crt on the root of the removable SD card. For Samsung devices, this means it will have to be in /mnt/sdcard/external_sd/.

Go to the Settings app, and select “Location and security”, then “Install encrypted certificates”. You will be prompted with a dialog for the Certificate name; I just took the default. Click “OK”.

You’ll be prompted to enter a password for credential storage. Do not forget this password.

At this point, the credential has been imported. Next time you visit the website, you should not get a bad certificate.

Rooting the Samsung Infuse with SuperOneClick

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 06 May 2012 20:39:07 -0700

After spending ages trying to root my Samsung Infuse (i997) running Android 2.2 with SuperOneClick on my Windows XP box, I finally did the right thing: blew it away and installed Windows 7. With that, I was able to root the Infuse this afternoon.

I used:

SuperOneClick 2.3.1 (or get it from shortfuse.org if you don’t trust random links from a blog)
The Samsung i997 driver version 5_2_0_2 from the Samsung US website

After rooting, I rebooted the device. It worked with no problems. I shot the developer of SuperOneClick a donation ‘cause why not.

Later I installed TitaniumBackup, which gave me a warning message about the access rights to su and offered to correct it. I said to go ahead and it did:

Access rights on the “su” binary were successfully correced from “0:2000

\[6755\]

” to “0:0

\[6755\]

”. Please reboot your device for the changes to apply.

I think that changed it from root.shell to root.root.

At any rate, now I know I can root the Infuse.

I wasn’t able to root an Infuse running 2.3.5 Gingerbread. Instead I had to use this XDA post, Odin, and reflash a new ROM.

Building a quiet MythTV box - selecting a case

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 20 Apr 2012 23:34:05 -0700

I’ve started looking around for a quiet but thermally good case for a MythTV box. My first thought was to do an HTPC case - the Lian Li HTPC C60 looked good.

But then I started worrying about airflow around the case. I’ve got a fairly narrow spot to put it in - about 46 cm - so a PC that’s 44 cm wide doesn’t leave a lot of room for cooling.

I decided to look into mini towers instead. The Lian Li V600F looks like it would be nice, but it has these ugly blue fans.

I also looked into the NZXT H2 (some were saying it was too flimsy), Antec P183 (too tall, not a mini tower) and Silverstone TJ-8e (an 18 inch fan in front, but only that. How hard to get a replacement when it dies?)

Now I’m leaning towards the Lian Li B10. It’s too bad that SPCR hasn’t reviewed it - they seem to know a thing or two about quiet and heat.

Airnet AES108P power supply

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 03 Apr 2012 22:05:30 -0700

I have recently moved, which means I’ve disconnected all my wall warts and had to reconnect them.

Normally, this isn’t a problem - but for one ethernet switch, it was. The box is labelled “Fast Ethernet Switch” with no other markings on the front.

The back has 8 ethernet jacks (ok so far) and a DC tip connector labelled “AC IN”. Great. The DC connector looked like a standard 5.5 mm outside / 2.1 or 2.5mm inside connector.

Markings on the bottom of the box: ES3108CH3 and AES108P. That appears to mean it was an Airnet AES108P, also known as a Pro-Nets ES3108CH3. Airnet appears to be out of business, and Pro-Nets is a Chinese exporter who lists it as “Power: 1w” (but no voltage).

So I cracked the box. The circuit board had a marking I took to indicate centre positive (which would mean not AC in), so I attached the bench supply and worked my way up from 0.

The device needs slightly more than 5v to turn on. I was getting it booting up at around 5.6 v, drawing about 520 ma with 3 network cables attached. I suspect it came with a non-switching wall wart rated for 5v. I tried with a 6v transformer I had handy, and that was too much. (Incidentally, if it’s nominally 5v, that’s more like 2.5w than 1w.)

I fear I have let the magic smoke out now… I had it running and moving packets at a little higher than 5.5 v, but now it boots up partway and croaks. Sigh.

Perhaps this will be helpful to someone else who’s not sure what to use. Seems like a non-switching 5v 1a transformer would be about right. A 1500ma switching 5v transformer I had did not work.

I’m not taking responsibility if this smokes your switch… or burns down your house. Use this info at your own risk. Let me know in the comments if it worked or didn’t.

Building a quiet MythTV box - step 1 - thinking aloud

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 01 Apr 2012 01:32:13 -0700

Due to decreased WAF for the old MythTV box, I’m looking into building a quieter one. I’ve decided to do a couple of things differently:

Use HDHomeRun for capture cards. That way, I won’t be stuck to a particular bus architecture. It also means the capture cards won’t be generating heat in the case.
Use a pair of 5400 RPM hard drives (maybe a 2.5" one for the OS, and a 3.5" one for the recordings? Need to have fans on all of them to cool them down.
Replace all the fans with FDB or maglev bearing fans
Use an external PSU like the PicoPSU or something like that. Here’s an adapter to make it fit in a standard fan bay. (This might also be a good idea for ham radio PSUs…)
Use an HTPC case or at least a quiet PC case
Probably end up with an nVidia video card.
I think I want a core2 duo 3.1 MHz or so motherboard/ processor combo
Does the Pico PSU mean I won’t be able to drive a DVD player? Maybe another external one (eSATA?) Am I going to end up with a bunch of individual set top boxes?

The CPU cooling fans, video card and hard drives should generate most of the heat (and noise). Need to figure out how much power a video card uses.

Migrating from Palm to Android: essential apps

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 30 Nov 2011 14:43:13 -0700

I’ve been gradually moving from Palm to Android. In some ways this is a step back, because Android is a lot less polished than Palm. On the other hand, it’s a platform where people are actually writing code.

My perspective is a little different from most: I didn’t want to rely on Google to sync my calendar, contacts, etc. I wanted to do that myself. Palm makes it easy; Android makes it hard.

I’m running a Samsung Infuse with Android 2.2.1 currently. Here are the apps I’ve discovered so far to make the Android experience easier. Because I’m cheap, they’re all free unless otherwise noted:

The calendar app is the most obvious place where Android flunks. I’ve been able to get by with aCalendar for calendar display. It is a lot like the Palm app, and is actively supported. Android also sucks with alarms, so I use Calendar Event Reminder (paid app, around USD 2.50) so I get more than a single “ding” when the alarm goes off. Finally, I use iCal Import/Export to get my calendar events out to the SD card. This is no longer supported by its author unfortunately. It relies on unsupported API as well to get calendar data - but so far that’s the only one. (I heard from the author of aCalendar that he’s thinking about adding export code, though, so there may be hope there. He’s got a Pro verison due out soon, and I’m hopeful. I’ll definitely pay for it when it comes out.)
To see a percentage representation of battery life (similar to what you’d get on a Palm when you tap the battery icon) I use Battery Indicator.
I had Noah Pro on my Palm, so I wanted a good dictionary app. ColorDict Dictionary Wikipedia includes all of Noah Pro, and additional files and the ability to do web searches if you’re online. Very nice. (One hint: you need to install dictionary files separately, then run them before you can use them. Looks like a lot of Android users can’t figure that one out.)
Of course, you’ll need Graffiti for the real experience. I was happy enough with it that I went to the paid version, Graffiti Pro.
I had Yaps for password storage on the Palm. I eventually migrated to KeePassDroid. Here are more details about migrating from Yaps to KeePassDroid.
Android search is also pretty lame, especially in contacts. I use Power Search when I really want to find something.
On Palm, I loved EasyCalc. The best calculator I’ve found so far is RealCalc Scientific Calculator.
For games, I installed the Ken Magic Solitaire, since it seemed least likely to want to leak my info all over the world.
To back up applications themselves, I use ASTRO File Manager. This app is able to copy existing apps that don’t have the copy-prevent bit set onto the SD card.
Finally, to copy all the files up to a server, I use the SAMBA client AndSMB rather than messing around with USB or swapping out SD cards.
I’ve installed Memento Database as a replacement for JFile, but so far have not transferred my data over, so I can’t say how good it is.

The most surprising thing is the app I haven’t found a replacement for yet - the Notepad! All the apps I have seen so far want to sync to the cloud, rather than letting me export to SD. Bummer. I did use What’s for Dinner Premium for my notes which are recipes, and I think it’s great. (I got this free on the Amazon app store for their free app of the day; normally it’s about USD 2.00.) Right now I’m using the Samsung Memo app (installed with their Android builds) for the rest, but it can’t export so I’m not using it for much. If you know of a Notepad app that doesn’t want network access, please let me know in the comments.

Converting YAPS to KeePassDroid

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Oct 2011 01:19:56 -0700

When moving from Palm to Android, one of my big concerns was password management. I had about a hundred passwords stored in YAPS, which is a great Palm password store.

I looked around and decided that KeePassDroid would suit nicely. It’s open source, does decent encryption, and is free.

That brought up the question: how do I convert from YAPS to KeePassDroid? I didn’t want to retype everything - and I eventually did manage to get things working. It was a bit of an effort, though - here’s what I did.

First, get the required components. I used YapsView (not strictly necessary, but it makes things easier), cygwin perl, GNU emacs, and KeePass 2.16
Export the Palm database into a file called Yaps.txt. I used YapsView to do this, but in theory you could use Yaps to export it to the Palm notepad and then cut & paste that to a file on your desktop.
Once the file has been exported, convert all instances of \ to \\. I used emacs to do this.
Convert all instances of " to \" using emacs as well. (Do this after doing \ so you don’t expand the \ in \".)
Save the modified Yaps.txt.
Next, I found a perl script that converted Yaps to KeePassX here. I hacked that up to create a script I called convertcsv.perl that convertes Yaps to CSV in the KeePass 1.0 format. It is convertcsv.pl.
Run “perl convertcsv.perl” in the same directory as Yaps.txt. This will create yaps.csv.
Create a new databse in KeePass 2.0. I set it to encrypt notes (under the “Protection” tab) and used defaults for the rest.
Import yaps.csv into the database you just created. File -> Import… KeePass 1.x CSV. I said “Overwrite existing” but I don’t think it makes a difference at this point.
Now move all the passwords to the proper categories in KeePass. This is dull. If you exported only a category at a time, this might be easier.
Finally, export the 2.0 database into a KeePass 1.x file. Although KeePassDroid can read KeePass 2.x files, it can’t write them. I usually update passwords on my device, so I needed to be able to edit. I use KeePass 2.0 as the master on my desktop, but import from the 1.0 file from the device whenever I update a password.

That’s it. Your mileage may vary - especially if you have strange characters in your Yaps password file. I did have a few passwords with " marks in them, and they appeared to migrate OK. A few minor edits was way better than retyping everything!

Palm to Android - missing contacts

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 02 Sep 2011 21:06:00 -0700

I started moving from an ancient Palm handheld to Android. Moving the contacts over without putting them all in the cloud was pretty straightforward. I just used the Palm Desktop to export as VCard.

After doing that, I went through the VCard file and changed Palm-CustomN fields into NOTE;ENCODING=QUOTED-PRINTABLE: fields (or appended to an existing note). This is described in more detail at: www.deepwave.net/articles/palm/palm_ctctvcard/.

After doing all this, I noticed that some of my contacts didn’t get moved over. In fact, they didn’t show up on the Palm Desktop either!

It took me a while before I realized that the records that were missing were the hidden records. Duh! I then set the Palm Desktop to show hidden records, exported them to VCard, hacked out the custom fields, and was off and running.

After doing the imports, I realized I should have exported one category at a time - this would have saved me recategorizing the whole wad on Android.

Ubuntu number key weirdness

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 30 Jun 2011 21:54:43 -0700

My Ubuntu 10.04 install was behaving weirdly when I used the numeric keypad. The keys would never generate numbers; rather, they would move the mouse cursor.

Luckily, I found this post: eric.biven.us/2009/02/03/ubuntu-and-the-number-pad-that-wont-work/

In short, the solution to turning off this feature is to go into System->Preferences->Assistive Technologies, press “Keyboard Accessibility”, then under “Mouse Keys” uncheck “Pointer can be controlled using the keypad.”

My KVM switch often leaves the shift state down - and the keyboard shortcut for this is Shift + NumLock.

Setting up soundmodem on Ubuntu 10.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 29 Jun 2011 22:23:42 -0700

After a long delay, I finally decided to upgrade to 10.04 LTS and get soundmodem running again.

Luckily, there was help this time. I started with my config, and merged with this post: ubuntuforums.org/showthread.php?p=10864691

Here’s the config I ended up using:

Configuration: AX.25 IO: Mode: soundcard Audio Driver: /dev/dsp Half Duplex: selected PTT Driver: none

Channel Access: TxDelay: 150 Slot Time: 100 P-Persistence: 40 Full Duplex: not selected TxTail: 10

Channel 0: Modulator: Mode: afsk Bits/s: 1200 Freq 0: 1200 Freq 1: 2200 Differential: selected

Demodulator: Mode: afsk Bits/s: 1200 Freq 0: 1200 Freq 1: 2200 Differential: selected

Packet IO: Mode: MKISS Interface: sm0 Callsign: mycall IP address: 10.0.0.1 Network mask: 255.255.255.0 Broadcast addr: 10.0.0.255

I also set up /etc/ax25/axports to have:

sm0 mycall 1200 255 7 144.39 APRS (1200 bps)

Finally, I made sure Avahi was set to ignore sm0. This is easier than it was prevously - now you just add:

deny-interfaces=sm0

to /etc/avahi/avahi-daemon.conf

Once that’s done, don’t forget to chmod 4755 /usr/bin/xastir so it can open sm0 and things are good.

Intel can't do video

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 12 Jun 2011 03:35:44 -0700

I recently upgraded my Ubuntu installation from 9.10 (with the old 8.10 video drivers that didn’t crash) to 10.04. I immediately began seeing the video crash, especially when there was a lot of activity.

It turns out I have an Intel Corporation 82845G/GL

\[Brookdale-G\]

/GE Chipset Integrated Graphics Device (rev 01). This is one of the many Intel video cards that have trouble.

I applied workaround F from here: https://wiki.ubuntu.com/X/Bugs/Lucidi8xxFreezes

That led me to here: http://www.ubuntugeek.com/intel-graphics-performance-guide-for-ubuntu-904-jaunty-users.html

After applying the Method 2 fix from there, things seem to be a little more stable. Time will tell.

Brother printer disappeared

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 31 May 2011 23:21:42 -0700

After a while, my Brother MVC 9840 CDW printer (which I installed using this method) disappeared.

No idea why. So I deleted it and reinstalled it. When I went to reinstall it, the original IP-address method wasn’t available. Instead I picked: Network Printer -> Brother MFC-9840CDW and accepted the host and queue as filled in by the configuration dialog. When I did that, no luck.

Instead, I selected AppleTalk/HP Jet Direct since I knew the printer supported that protocol as well. Then I had to enter the IP address of the printer and accepted the default port (9100). Once that was done, I could again print a test page and use up all my ink.

Fixing the Firefox 4 open tab / open window nonsense

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 15 Apr 2011 22:19:17 -0700

Firefox 4 has got it into its head that tabs are better than windows, despite the fact that tabs use up more UI and look ugly, while windows are nice and clean.

In order to promote their tab agenda, they’ve changed the order of the context menu so your muscle memory for “Open Link in New Window” now brings you “Open Link in New Tab”. Ugh.

Luckily, there is an answer for this.

Create a userChrome.css file in your profile/chrome directory (on Windows, C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\somethingrandom.default\chrome\):

#contentAreaContextMenu > * { -moz-box-ordinal-group: 2; } #context-openlink { -moz-box-ordinal-group: 1 !important; }

This doesn’t change the order under the file menu, but at least when you’re using the context menu it will work right.

Upgrading the Arduino Uno 8U2 using Fli

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 14 Apr 2011 00:38:05 -0700

The instructions on the Arduino DFU update page are pretty vague when it comes to updating to the latest firmware using the Atmel Flip utility. Here’s what I did to get my Uno 8U2 firmware updated using Windows XP:

Install Flip from the Atmel webpage. If you don’t already have a JRE, you probably want the 20 megabyte package that includes one.
Download the 8U2 firmware. That’s the “Arduino-usbserial-uno.hex” file. The “UNO-dfu_and_usbserial_combined.hex” is the Arduino Uno bootloader firmware for the 328p. If you try installing the 328p firmware onto the 8U2 in Flip, you’ll get an error dialog:
```
class com.atmel.flipGui.FileMenuHandler
Address is out of range.
```
I ended up cutting & pasting the hex file contents into a text editor because I couldn’t figure out how to download a single file from github, and I didn’t want the whole 200 megabyte wad.
Hook up wires and touch them to the right spots on the Uno at the right time as described in this Arduino forum post by pluggy.

Update: Pluggy’s image has disappeared. Here it is:
I found it at www.ardumania.es/reflashear-el-8u2/.

You’ll know you did it right when Windows detects a new device. It took me a few tries to keep the first wire steady enough when touching the second wire. Make sure you’re going to the right pads - you could short out your Uno if you touch the wrong place!
After Windows detects the new device, you don’t have to hold the wires in place any more. Move them to the side so you don’t accidentally short out something.
When the Windows device installer comes up, select “have disk” and install the Atmel USB driver. By default the Atmel USB driver is installed in C:\Program Files\Atmel\Flip 3.4.2\usb\atmel_usb_dfu.inf
Notice that the driver is AT90USB82, not ATmega8U2
Although it tells you that you have to reboot XP when you install the driver, I didn’t bother.
Start Flip from the Program menu
File->Load HEX file->Arduino-usbserial-uno.hex
Device->Select->AT90USB82
Settings->Communication->USB and press Open
At this point, you should be ready to program. Press the “Run” button on the main screen.
Programming is quick, taking about 4 seconds. After it’s done, remove the two wires you put in earlier, then unplug the USB cord and reinsert it.

Once you’ve done that, your Uno should be out of DFU mode and back into normal mode.

You can go to My Computer->Manage->Device Manager->Ports (COM & LPT), right-click on “Arduino UNO” and select “Properties”. Under the Details tab, Firmware Revision should now be 00.01.

Update: Someone mentioned they couldn’t find the atmel_usb_dfu.inf file. Looks like there’s a copy here.

Testing the USBtinyISP on Arudino Uno

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 09 Apr 2011 13:29:53 -0700

After building a USBtinyISP programmer to burn new bootloaders to my Uno (and other devices) I wanted to test it before putting it in the case.

Unfortunately, the obvious place talks about programming with WinAVR and other random things that you don’t care about when you’re hot to see if the thing actually works.

Here’s what I did instead (using a Windows XP machine, since that is what’s claimed to cause the least trouble):

I downloaded the USBtinyISP drivers and unzipped them into a directory.
I plugged the USBtinyISP in (before putting the programming cables / case on yet). It was recognized as a USB device, and I installed usbtinyisp.inf from the unzipped driver.
I immediately tried to talk to the device using the Arduino 022 IDE and “Burn Bootloader -> w/USBtinyISP”. It failed with the error message “Could not find USB device 0x1781/0xc9f”.
So I unplugged the device and plugged it back in. This time I got “Initialization failed, rc=-1” which is correct.

Whew, that meant my device was talking - in other words, I’d probably put it together correctly. Next was to see if it actually could program my Uno.

I plugged the 6-connector programming cable in. The red stripe went on pin 1 of the silkscreen of the USBtinyISP, and the pin with a dot on it on the programming header of the Uno. (At first it looked wrong, but when I turned the cable around it was fine. The cable goes across the whole length of the Uno.)
Then I made sure the jumper on the USBtinyISP was off (not supplying voltage).
Next, I plugged the USBtinyISP into my USB port and verified that the green light came on.
After that, I plugged in my Uno (to a different USB port) so it was getting power and was recognized.
Finally, I went to the Arduino IDE and did Tools -> Burn Bootloader -> w/USBtinyISP.
The red light came on for about two minutes to program my chip. After it turned off, I uploaded a sketch to make sure it worked - and it did. “Done burning bootloader.” Yay!

Finally, I put the 10-pin programming cable in and the case on. I had to push the LEDs around a little (the green one was getting pretty close to the USB header). Then I was able to snap the case on and catch my finger in there as well, removing a little skin I didn’t need.

That was it - I now had a good programmer. I did another program with the case on to make sure it worked and I hadn’t broken anything.

Next I’ll look on the Arduino firmware github page to see if there’s any newer boot firmware.

Should I malloc on Arduino?

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 29 Mar 2011 21:34:48 -0700

I’ve been defining an Event class for Arduino processing so I don’t have to think quite so hard about timing loops myself. In the process of doing this, I got the following error:

undefined reference to `operator delete(void*)'

I discovered that the Arduino C++ doesn’t include new() or delete(). (Ok, I guess I shouldn’t be calling it C++….)

I did a quick web search and discovered replacement functions… but then I started thinking.

Why did these get removed from the Arduino C++ variant? On a device as limited as the ATmega328, it makes no sense to malloc() from a pool. Might as well just allocate the variables you want. (Or in my case, allocate an array of variables up front). That way, you know you don’t have a pointer leak that will hose you as you run.

So… I think the answer is no, I shouldn’t malloc on Arduino.

(Edit) Unless, of course, I’m writing a library.

Making git ignore file mode

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 24 Mar 2011 00:45:39 -0700

I have recently had to run git on Windows, and things there get all weird because by default git uses file mode as part of its comparison. Because of this, files whose mode have changed show up as different.

Luckily, git has a way around this:

git config core.filemode false

Nice!

Failed while running mythtranscode to cut commercials

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 27 Feb 2011 16:50:51 -0700

For a long time I’ve had the error message “failed while running mythtranscode to cut commercials” on my MythTV box. Today I did some searching to find out more about it.

It turns out the error is caused by the existence or permissions of .ICEauthority.

I nuked ~/.ICEauthority and was able to mythtranscode. Apparently this file is recreated occasionally, so if I see this again I’ll check permissions.

Using an Arduino Serial USB board with an Ardweeny

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 30 Jan 2011 17:47:35 -0700

This afternoon I joined the world of Arduino hacking. I put together an Ardweeny and hooked it up to an Arduino Serial USB Board. I probably should have used a newer FTDI basic breakout board which supports auto-reset, but I didn’t.

Assembly and Power Up
#

Putting the Ardweeny together was pretty simple. One word of advice: you do not want to do this without a third hand tool. Even that won’t be enough for soldering the chip onto the headers - you’ll need a friend or some good gentle alligator clips to hold the chip while you do the first tack solders.

I powered it up by connecting +5v of the Ardweeny to +5v of the Serial USB board, and then connecting Gnd on the Ardweeny to Gnd on the Serial USB board. It started blinking right away - always a good sign.

Connecting to USB Serial
#

Connecting the Ardweeny to the Serial USB board was a little trickier. I used a pair of jumper wires. In one end of each one I stuffed a little clipping of 22 awg bell wire, so I had a female connector at one end and a male connector at the other.

Next, the big (and as far as I can tell undocumented) question: does TX on the Serial USB board go to RX on the Ardweeny and vice versa, or does TX on the Serial USB board go straight to TX on the Ardweeny? The answer:

TX on the Serial USB board (the pin furthest from Gnd on the left side) goes to RXI (the pin above A4 on the Ardweeny v1.1a)

RX on the Serial USB board (the pin just above +5v on the left side) goes to TXO (the pin above A3 on the Ardweeny v1.1a)

I hooked those up backwards and my USB port stopped recognizing the Serial USB board. I had to pull the Serial USB board from the USB hub and plug it back in to continue. (I’m doing all of this through a powered USB hub just to avoid burning out my motherboard’s USB if I make a mistake.)

Downloading Code
#

Once I’d done that, I sent a program down. The first program went with no problems after I set my COM port and chose the “Arudino Duemilanove or Nano w/ATmega 328”.

Subsequent programs wouldn’t write - I got the following error:

avrdude: stk500_getsync(): not in sync: resp=0x00
avrdude: stk500_disable(): protocol error, expect=0x14, resp=0x51

It turns out the Ardweeny is pretty particular about when things get uploaded to it. (This is where the auto-reset function of the FTDI basic breakout board shines, but I didn’t know that since I’d never done Arduino programming before.) So the magic trick to upload is to wait until you see:

Binary sketch size: 1018 bytes (of a 30720 byte maximum)

in the IDE, then immediately hit the reset button on the Ardweeny. At that point, you’ll see the TX and RX LEDs flash on the USB Serial board, and your code should be uploaded.

Configuring a website on Apache2 with server-side includes

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 22 Jan 2011 14:37:23 -0700

I recently got myself involved in helping with a website for a local club. In order to maintain it, I wanted to set up an Apache instance at home as well.

Luckily, in Ubuntu 9.10, it’s almost all set up by default. The only changes I had to make were to change the DocumentRoot directory and enable server-side includes. Here’s what I did:

Changing the document root
#

First I edited /etc/apache2/sites-available/default to put my document root in DocumentRoot, and also changed the two directory references that did point to /var/www to my new document root. Then I made sure all the parents of my document root had r+x permission for the Apache user.

Turning on server-side includes
#

My hosting facility has server-side includes turned on for .html. This is not the best use of resources, but this website doesn’t get enough traffic to make a difference. So I added: AddType text/html .html AddHandler server-parsed .html Option Include (plus whatever options were there before) to the two directories that used to be /var/www and /. After that, I had to enable mod_include with: cd /etc/apache2/mods-enabled sudo ln -s ../mods-available/include.load include.load Then restart apache with sudo /etc/init.d/apache2 restart

Resolving git error: unable to create temporary sha1 filename

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 11 Jan 2011 22:59:22 -0700

I’m just starting to use git for source control. Tonight I got an error when I tried to commit:

$ git add ./foo/bar/
error: unable to create temporary sha1 filename .git/objects/95: File exists
error: foo/bar/baz: failed to insert into database

Luckily, someone else ran into this before me. The magic incantation:

git fsck
git prune
git repack
git fsck

and then I was able to add my files.

I ran into another case where this didn’t help. In that instance,

git gc

was able to get me committing again.

Inserting current date and time with EMACS

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 02 Jan 2011 00:16:06 -0700

I was recently involved in an activity that required keeping track of notes with timestamps. I decided to do it in EMACS. Here’s what I stuffed in my .emacs init file:

;; Insert the current time in the current buffer
(defun
timestamp()
(interactive)
; If you want to insert date and time, you can use:
(insert(format-time-string "%Y-%m-%d %H:%M:%S ")))
;; Bind Ctrl-T ("transpose") to the timestamp function - need a better key binding
(global-set-key (kbd "C-t") 'timestamp)

Incidentally, I also needed to save the file to DOS format instead of Unix format. To do that:

M-x set-buffer-file-coding-system

then use “dos” (or “mac” or “unix”).

Creating thumbnail images with convert

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Jan 2011 17:32:26 -0700

A little while ago, I found I had a bunch of images that needed thumbnails that were 100×75. This isn’t hard to do - I used convert and a pair of bash for loops.

The core was a call to convert, which is part of ImageMagick.

convert -thumbnail 100x75 input.jpg thumbnail.jpg

All of my images happened to be 4:3 - if they hadn’t, I might have used 100x75! or rotated/resized them.

Next, all my files had numbers of the form file01..file09 file10 file11… etc. If you’re nuts, you try to figure out how to do this in a single for-loop with a condition for the first 9 elements that start with 0.

If you’re lazy like me, you use two loops, with a cursor-up in bash so you don’t have to type as much:

export INFILEPREFIX=file
export OUTFILEPREFIX=file
for i in {1..9}; do convert -thumbnail 100x75 ${INFILEPREFIX}0${i}.jpg ${OUTFILEPREFIX}0${i}t.jpg; done
for i in {10..25}; do convert -thumbnail 100x75 ${INFILEPREFIX}${i}.jpg ${OUTFILEPREFIX}${i}t.jpg; done

For the non-thumbnails, I resized as well, using -resize 800x600.

Scale your website images

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Jan 2011 17:32:26 -0700

I just noticed that if you scale an image using width= and height= attributes of the img tag, Firefox 3.6 will (sometimes) put a thin border on the top and left of the image - something that you can’t get rid of with CSS/styling.

Weird - but a good rule seems to be scale your images to the correct size before using them in HTML.

This is different from the “border around link images” issue - which is easy enough to get around by using border-style: none in CSS.

Installing the Brother MFC 9840cdw driver on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 01 Jan 2011 17:13:51 -0700

When I had Ubuntu 8.04, I’d struggled my way through installing the official Brother driver from the Brother Linux site.

Since then I’ve upgraded a couple of times to 9.10, and had not reinstalled my printer. It turns out Ubuntu has made life much easier for us Brother printer owners - so these days there’s no reason not to install the printer driver, especially if the printer is networked.

Here’s how to do it:

Open Synaptic Package Manager

Search for 9840. You should see two packages:

brother-cups-wrapper-ac
brother-lpr-driver-ac

Select those for installation (along with their required packages).
Go to System->Administration->Printing and press the “New Printer” button.
After a “Search for new printers” message comes up and goes away, expand “Network Printers”.
If you’re lucky like me, you’ll see your printer there. I chose to use the one that was found by IP address (LPD Network Printer via DNS-SD).
Then I printed a test page, which shot a bunch of colour toner out. (If I had to do it over again, I would have just printed from Firefox to save toner.)
Finally, I did System->Preferences->Default Printer to set the new printer as the default.

That does the printer; next you’ll want the scanner. This isn’t quite as straightforward, since the scanner stuff isn’t in Synaptic. Again I’m assuming it’s set up on a network:

Make sure you’ve already installed xsane and its requirements.
Download the .deb for brscan3 from the Brother web site. If you’re like me, you want the 32-bit version.

Install the driver with:

$ sudo dpkg -i --force-all brscan3-0.2.11-2.i386.deb

Configure the scanner:
```
$ brsaneconfig3 -a name=SCANNER model=MFC-9840CDW ip=aaa.bbb.ccc.ddd
```
(where aaa.bbb.ccc.ddd is your MFC-9840’s IP address).

Verify the driver installed:

$ brsaneconfig3 -q | grep SCANNER
0 SCANNER "MFC-9840CDW" I:aaa.bbb.ccc.ddd

Run xsane and it should find the scanner.

Converting audio files under Linux

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 29 Dec 2010 23:14:27 -0700

Linux has mplayer, an excellent audio player. It’s also handy when you want to convert a sound file from one format to another. The secret is to use .wav as an intermediate conversion, since most audio converters know how to handle that.

Here is the magic incantation for mplayer:

mplayer -quiet -vo null -vc dummy -ao pcm:waveheader:file="output.wav" input.rm

This takes the input file and creates output.wav from it. Once you have that, it’s a simple matter of

oggenc output.wav

to get output.ogg (don’t forget to install vorbis-tools) or

lame output.wav

if MP3s are your bag.

Linux Review has a good article on converting using this technique

Speed up those boring meeting replays with mplayer

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 29 Dec 2010 23:14:27 -0700

It’s been a while since I looked at the man page for mplayer. Ubuntu has finally included something I’ve wanted for a long time.

Every now and then I have to listen to pre-recorded meetings. Since I usually think faster than the speakers can talk (“umm, uhh… could you go to the next slide please?”) I like to speed things up.

I used to have to use sox to change the playback speed without changing the pitch, but now it appears it’s built into mplayer, which makes it much easier.

Here’s how to do it:

mplayer -af scaletempo -speed 1.3 boringmeeting.mp3

This plays back at 1.3 times the usual speed, which is good for most speakers. Really slow ones will benefit from -speed 1.5.

When I was young, I had an LP with the song “Twilight Zone” by Golden Earring on it. I used to listen to that at 45 rpm instead of 33 rpm because it made it sound more urgent. That would be -speed 1.363 if you’re playing at home.

Creating directories under Program Files on Windows 7

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 25 Nov 2010 23:26:11 -0700

Windows 7 has locked down the “Program Files” directory so that regular users can no longer create subdirectories. This presents a problem if you have an executable but no installer, and you want that executable to live under “Program Files”.

The way around that is pretty simple:

Open the Explorer
Navigate to C:\Windows and select explorer
Right-click and select “Run as Administrator”
Give permission to make changes to your system

At this point, the new Explorer that opens has enough rights to create subdirectories under Program Files (and also to hose your system in a number of interesting ways, so be careful).

Naturally, if you’re more command-line oriented, you could navigate to cmd.exe or sh.exe (assuming you’ve got Cygwin installed). If you’ve enabled the Administrator account, it’s possible to do all this using the RUNAS command: runas /user:Administrator cmd

Enabling the Administrator account on Windows 7

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 25 Nov 2010 23:26:11 -0700

By default, the Windows 7 Administrator user is disabled. This prevents you from doing interesting things like using the RUNAS command to start shells with extra permissions.

To enable the Administrator user, do the following:

Open the Explorer
Navigate to C:\Windows\System32 and select cmd
Right-click and select “Run as Administrator”
Give permission to make changes to your system. This will open an elevated permission command prompt.
In the elevated permission command prompt, enter “net user Administrator /active:yes”
Go to Control Panel -> User Accounts and Family Safety -> User Accounts -> Manage Another Account
Select Administrator
Create a Password (or Change the Password if you’ve already set one).
Enter the password twice to set/change it

It’s probably wise to have a fairly strong password on the Administrator account.

Echo when playing back MythTV

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 26 Oct 2010 00:09:57 -0700

I recently ran into an interesting problem with my MythTV audio. When I played back a program, it would play back with varying degrees of echo in the audio. Usually the echo would be around 100 ms behind, but if I skipped forward or back I could get it up to 3 seconds behind. This problem did not happen outside of MythTV.

First I started with alsa-mixer. There I determined that there was no level I could change to affect the echo. Changing the level always changed both the first audio and the echo.

Next I tried reinstalling the AC97 sound driver, because I saw a website that noted when the driver was corrupt you could get an echo. No dice.

Finally, I happened to be running top, and I saw this:

 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
4273 myth 20 0 220m 85m 3588 S 12 8.5 11:55.43 mythfrontend.re
4257 myth 20 0 245m 85m 3700 S 12 8.5 10:20.79 mythfrontend.re

I had two copies of mythfrontend.real running! Both were getting the lirc keypresses and acting on them. This meant everything (including the player) was being run twice… hence an echo slightly behind the main audio.

Somehow the Gnome session state had been saved with a mythfrontend.real running, and when it was restored it would restore with that mythfrontend.real as well as start a new one. I made sure the session state wasn’t being saved (under Settings), killed all the running mythfrontend.real instances, and then logged out saving the session. Next I logged in and out but unchecked the button to save session on logout. That seems to have done the trick.

Disabling the Ubuntu auto update dialog

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 21 Oct 2010 01:41:03 -0700

I’ve lived with the Ubuntu auto-update dialog on my MythTV box for quite a while. Tonight I did a quick search to see how to disable it.

Thanks to this link: maketecheasier.com/remove-the-annoying-update-manager-pop-up-in-ubuntu-jaunty

… I discovered that turning off the update dialog was quick and easy. Just do:

gconftool -s --type bool /apps/update-notifier/auto_launch false

You don’t even need a sudo, since it’s just changing your user’s config.

No more popups obscuring MythTV! When something is annoying, a ten second web search can be a good thing.

Brother MFC-9840 Toner Reset

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 16 Sep 2010 23:48:30 -0700

I like the Brother MFC-9840 printer, but it’s got a really irritating problem: it gives up way to easily when it comes to toner. Often there’s still around 33% of the toner left in the cartridge when the printer comes up with the dreaded “Toner Life End” message.

It appears there are two solutions: #1 (which didn’t work for me) is to tape a bit of black tape over the window of the toner cartridge, or over the hole for the sensor in the toner tray. I left the tape on just in case it would do good in the future.

Here’s an article with a picture of the toner hole: www.kineticcomputer.com/tips/1107-excessive-low-toner-warnings-on-brother-laser-printers-and-copiers.htm

#2, which I found at www.fixyourownprinter.com/forums/laser/39806 proved to solve my problem. Here it is:

With power on, open the toner access main door. You will get a “Cover is Open” message on the LCD.
Press the “Clear/Back” button and you will be taken to the toner “Reset Menu”
You can then scroll through the reset options for the printer’s toner cartridges:
1. B.TNR-S - Black toner small cartridge (TN-110)
2. B.TNR-H - Black toner high-capacity cartridge (TN-115)
3. C.TNR-S - Cyan toner small cartridge (TN-110)
4. C.TNR-H - Cyan toner high-capacity cartridge (TN-115)
5. M.TNR-S - Magenta toner small cartridge (TN-110)
6. M.TNR-H - Magenta toner high-capacity cartridge (TN-115)
7. Y.TNR-S - Yellow toner small cartridge (TN-110)
8. Y.TNR-H - Yellow toner high-capacity cartridge (TN-115)
Select the cartridge size you have and the colour you want to reset, and press OK. Since I had small cartridges, I used the S options for all three colours.
Each cartridge must be reset individually. Press “1” to reset.
Press “Clear/Back” to get out of the menu, then close the door.

According to the link at fixyourownprinter.com, this works on the Brother MFC 9440 as well.

I wish I’d found this before I replaced my black toner cartridge!

Update: 2013-12-12 - I just learned that it’s possible to reset the values for other consumables on the printer as well. Hold down both 3 and 9 at the same time, and you’ll get a menu to reset: Drum Belt Unit PF Kit MP PF Kit 1 PF Kit 2 Fuser Laser

I haven’t had to do any of these yet, but will remember it for when the time comes!

Installing ntpd on Ubuntu

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 01 Sep 2010 02:29:28 -0700

I was surprised to see that my installs of Ubuntu 9.10 and Ubuntu 10.04 server didn’t have ntpd in them. This meant that nothing was correcting my drifting time. One machine was off by five minutes.

So I installed OpenBSD’s ntpd: sudo aptitude install openntpd

And then started it: sudo service openntpd start

The /etc/openntpd/ntpd.conf shows that I’m polling from the Debian NTP server pool. I guess that’s good enough. When I need an NTP server and can’t remember, I use time-a.timefreq.bldrdoc.gov.

Hiding a user in GDM

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 01 Sep 2010 02:14:06 -0700

A while back, I was playing with Joomla, and I created a joomla user. That was fine, but then I noticed that GDM (the login screen) was offering me the chance to select that user to log in. That was not my intent.

A quick search revealed this useful post: http://ubuntuforums.org/showthread.php?t=1321845

GDM will show you every user with a user ID of 1000 or higher. I changed my joomla user’s user ID to 987, and voilà - no more prompt.

Luckily, the user I modified didn’t own much - and everything it did own was in a group that also owned the files. If that hadn’t been the case, I would have had to change ownership of the files as well.

Reading fonts from a Mac CDROM and converting them to TrueType

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 06 Aug 2010 23:13:11 -0700

A few years back, I bought a bunch of Macintosh fonts on a CD-ROM. Recently, I decided I wanted to use them with Ubuntu. Since the Mac CD was HPFS only and very scratched, here’s what I ended up doing.

First, I installed the Ubuntu utilities for Mac HPFS: sudo aptitude install macutils hfs

Then I tried just mounting the file system: sudo mount -thfs /dev/cdrom /mnt/cdrom/

That probably would have worked, but my CD was so scratched that it kept dying. (Also, I don’t know if copying from a mounted HFS file system copies both forks of the Apple file.)

Luckily, I was able to use the mounted file system to get a ls -lR listing of the files on the disk. That made it easier to use the excellent hfs utils:

sudo aptitude install hftutils

Then I could: hmount /dev/cdrom hcd TRUETYPE hcopy -b MyFont.suit /tmp/MyFont.hqx

I wrote a script to copy the files over. Once I had the files over, I could convert them manually using fontforge (from fontforge.sourceforge.net). Basically, you do: sudo aptitude install fontforge fontforge MyFont.hqx and then File -> Generate Fonts -> Save (after making sure TTF is selected).

It turns out fontforge is overkill - and also harder to script - than fondu.

sudo aptitude install fondu fondu *.hqx

Here are some useful sources of information:

A discussion of font utilities: ubuntuforums.org/showthread.php?t=314837

The easy way: using fondu: ubuntu-tutorials.com/2006/12/13/convert-mac-based-fonts-for-use-on-ubuntu-ubuntu-6061-610/

Converting from one outline font (e.g. PostScript) to another (e.g. TrueType): fontforge.sourceforge.net/faq.html#outline-conversion

Once you have the fonts in TTF format, you can copy them to ~/.fonts/ (or use the File Browser to open the Font Viewer and then press the Install button if you’re GUI) to install on Ubuntu.

For Windows, just drag & drop the font to C:\WINNT\Fonts or C:\WINDOWS\Fonts depending on your system.

Incidentally, if you’re looking for a particular font or lookalike, you’ll probably find it here: www.fonts101.com

Roku Netflix player - secret screens

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 29 Jul 2010 21:03:05 -0700

Lately I’ve been exploring the Roku Netflix player. It’s got a number of “secret” screens - not really secret, since they seem to announce them regularly in the Roku forums, but I didn’t spot a place that had them all together. So here they are:

Installed software versions screen
#

Shows what versions of software (channels, screen savers, etc) are installed on your Roku.

To get there: Home Home Home Up Up Left Right Left Right Left (That’s Home:3x, Up:2x, Left, Right, Left, Right, Left)

Version menu:

Next/Prev

Enable developer mode
#

Turns on a web server and opens at least one port on the Roku. Allows you to upload new channels, and download logfiles if you turn them on.

To get there:

Home Home Home Up Up Right Left Right Left Right (That’s Home:3x, Up:2x, Right, Left, Right, Left, Right)

Developer mode menu:

Enable/Disable installer

This reboots the Roku. Once enabled, you can go to http://roku-ip-address and install packages. There is also some utility software. http://roku-ip-address/plugin_inspect http://roku-ip-address/plugin_install http://roku-ip-address/plugin_package Once a package is built, it gets put in: http://roku-ip-address/pkgs

Here’s a post about bash utilities for building Roku packages.

Debug options screen
#

Enables logging, lets you download beta releases, etc.

To get there: Home Home Home Home Home FF FF FF Rewind Rewind (Home:5x, FF:3x, Rewind:2x)

Debug options menu:

Factory reset
Cycle channel store server
Cycle software update server
Update software
Enable/Disable debug logging

When you enable logging, you can then go to http://roku-ip-address/pkgs and download tcpdump files (called log0, log1… etc). You need to have Developer mode turned on as well in order to get these. Developer mode enables the http server. Turn Developer mode on first, then enable debug logging.

Quality settings screen
#

Lets you set the bitrate of downloads from the Roku (this is not the bandwidth - the Roku uses full bandwidth until its buffer is full).

To get there: Home Home Home Home Home Rewind Rewind Rewind FF FF (Home:5x, Rewind:3x, FF:2x)

Quality options menu:

Automatic
3.5
2.5
2.0
1.5
1.0
0.6
0.3
Enable/Disable playback debugging

Reboot
#

(thanks to G Whizz): reboots the Roku

To get there: Home, Home, Home, Home, Home, Up, Rewind, Rewind, FF, FF (Home:5x, Up, Rewind:2x, FF:2x)

Platform Secret Screen
#

I’m not able to see this one on my Roku 2, but I found it documented at streamfree.tv/roku/roku-remote-option-commands/. It’s available on the Roku 3500R Streaming Stick. Home, Home, Home, Home, Home, FF, Play, Rewind, Play, FF (Home:5x, FF, Play, Rewind, Play, FF)

Platform menu:

System Reboot
Disable Network Pings
Wi-Fi Remote Menu
Wi-Fi Secret Screen

Antenna Secret Screen
#

I’m not able to see this one on my Roku 2, but I found it documented on Richard LLoyd’s Youtube video. It’s available on the Roku 3500R Streaming Stick. Home, Home, Home, Home, Home, FF, Down, Rewind, Down, FF (Home:5x, FF, Down, Rewind, Down, FF)

This screen just shows status, no options here.

General notes
#

That the Rewind button is the one to the left of the Pause/Play button; the FF button is the one to the right of the Pause/Play button. Start all sequences from the Home screen.

I guess someone was a Konami fan. Some people have trouble entering these codes - I didn’t, but I see on the forums that you should enter the keypresses with a regular cadence and about half a second between presses.

I don’t know if any of these will cause trouble in the long run. I think none of them survive a reset, but I’m not going to guarantee you won’t brick your Roku. Use at your own risk.

Secret channels
#

Roku also has “secret channels” - channels you need to add to your account with a code in order for them to show up. A good list seems to be available at streamfree.tv/apps/, along with directions on how to add them.

Know of any other secrets? Leave a comment.

Batch-converting images

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Tue, 29 Jun 2010 19:15:53 -0700

I had a wad of images that I needed to resize from 300dpi and high-resolution jpg to 4.5x6 (or 6x4.5) low resolution at 72 dpi.

First, I installed ImageMagick: sudo aptitude install imagemagick

Then I opened GIMP and determined the pixel width and height of one image. (Image -> Canvas Size). In my case, it was 3264x2448.

Next, I resized the image to the size I wanted. That turned out to be 432x324.

In other words, I wanted my new images to be 0.132352941 of the original image. A quick test told me I was on the right track: convert P4250049.JPG -resize 13.2352941% test.jpg

The first time I did this I forgot the % sign and got a 13x10 pixel image - not exactly what I wanted.

So, on to batch-converting everything in a directory: mkdir ./resized for i in *.JPG; do echo $i convert $i -resize 13.235941% -quality 20 ./resized/$i done

And all my resized images were in the resized directory below the image directory. (Did I mention I wanted to reduce the quality so my images would be smaller too? Yep, that’s what the -quality line does.)

Backing up a disk with SysRescCD

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 20 Jun 2010 16:51:00 -0700

The documentation for the very good SysRescCD has changed, so I can’t find the standard “here’s how to back up a disk” using sfdisk and partimage anymore.

Luckily, it got saved here: www.hackadmin.com/2009/05/31/disk-imaging-with-partimage/.

For future reference, this is a good way to back up a disk.

Boot the machine with the disk using SysRescCD.
Mount a big NFS/CIFS drive.

Copy the MBR:

dd if=/dev/sda of=/cifs/sda.mbr count=1 bs=512

Copy the partition table from the drive:
```
 sfdisk -d /dev/sda > /cifs/sda.sfdisk
```
Run partimage on each partition on the drive
Finally, for good measure,
```
dd if=/dev/sda | gzip > /cifs/sda.dd.gz
```

You can use kill -USR1 pid on the dd process id (not the gzip process id) to see progress.

Most of the restore is straightforward. sfdisk can take its output as input; partimage has restore built in. To decompress the gzip dd image, use:

gzip -dc /cifs/sda.dd.gz | dd of=/dev/sda

Incidentally, a good site for dd information is here: www.softpanorama.org/Tools/dd.shtml

Setting disk labels in Linux

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 05 Jun 2010 22:00:16 -0700

Back in December, I wrote about setting UUIDs so multiple disks could be mounted in the same place using /etc/fstab.

I’ve since decided that was dumb. Disks should have unique UUIDs - Linux may use that for more than just mounting the file system. Luckily, there is a better option: the disk label.

Mounting a disk using the disk label is very similar to mounting using UUIDs. First, you need to give the disk a label. I think you can do that when you mkfs, but it’s pretty cheap to do it after you’ve already bulit the file system using: e2label /dev/sdb1 mylabel (substituting whatever device you want for /dev/sdb1 and whatever label you want for mylabel. This will work for ext2, ext3 and ext4 - if you’re using another file system, it should have its own label utility.)

Then, rather than specifying UUID= in /etc/fstab, specify: LABEL=mylabel

Your disk will mount automatically, but still have a unique ID. Sounds better to me.

Sun has a useful tutorial at: http://wikis.sun.com/display/BigAdmin/Using+Disk+Labels+on+Linux+File+Systems

Straightening pictures with Gimp

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 15 Apr 2010 22:17:34 -0700

A while back, I discovered a very useful tool in Gimp to straighten images. This is useful if you have a bunch of scanned text (its advertised usage) or if you have what I have: a group of pictures that were scanned in on a flatbed scanner and all 2-3 degrees off of horizontal.

Since upgrading Ubuntu, I’d lost track of that plugin. I started by searching for “straighten picture” and that led me to the Straighten and Crop plugin: http://registry.gimp.org/node/18821

That’s a useful tool, but not what I wanted. (It lets you pick two points on an image–say, the leftmost and rightmost horizon lines–and rotate the image so those two points are even.)

Eventually I figured out the tool I wanted was Deskew (aka auto-straighten). It can be found here: http://registry.gimp.org/node/2958

I downloaded the .deb for 1.1 and installed it in my Ubuntu 9.10 with:

sudo dpkg -i gimp-deskew-plugin_1.1_i386.deb

Once it’s installed, it’s not immediately obvious where in Gimp it goes. (And of course the web page is no help.) The secret location is:

Filters -> Misc -> Deskew

Load an image, select that, and the image will be straightened. Then you can crop it and save it; nobody will ever know it wasn’t straight on your scanner.

A minimal xorg.conf with modeline

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 25 Mar 2010 22:18:57 -0700

Back in the Bad Old Days, the X configuration file was miles long and you had to get it all right. Nowadays, X guesses at most things pretty accurately. This means you might not have anything in your xorg.conf file. This makes changing the Monitor section trickier.

Here’s a default xorg.conf file with a modeline. (This is for a Sharp LL-172C-B monitor; your modeline will probably differ.)

Section "Device"
Identifier "Configured Video Device"
EndSection
Section "Monitor"
Identifier "Configured Monitor"
# Modeline "1280x1024" MHz HSize HTotal HSyncEnd HSyncDelay VSize VSyncStart VSyncEnd VTotal -hsync +vsync
Modeline "1280x1024" 109.00 1280 1322 1450 1700 1024 1027 1034 1066 -hsync +vsync
EndSection
Section "Screen"
Identifier "Default Screen"
Monitor "Configured Monitor"
Device "Configured Video Device"
EndSection

Exposing the Firefox Location Bar behaviour

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 19 Feb 2010 00:13:42 -0700

On several machines, I’ve got Seamonkey 2.0.2 installed. It has some very nice fine-grained preferences to control what shows up in the location bar.

I’ve also got a netbook where I put Firefox 3.6 because I didn’t need everything that’s in Seamonkey. Firefox has really limited preferences to control what shows up in the location bar.

Luckily, both browsers behave the same way using about:config. So it’s possible to get Seamonkey’s fine-grained control on Firefox, as long as you don’t care about a UI to do it.

A very useful article can be found here: http://kb.mozillazine.org/Browser.urlbar.default.behavior.

I read that article, and was about to calculate the value I wanted, when I realized the simplest way to do it is to go to the Seamonkey install, set up the preferences the way you want (“Autocomplete from your browsing history as you type”, “Match only websites you’ve typed previously”, “Only match locations, not website titles”, “Match anywhere but preferring word boundaries”, “Automatically prefill the best match”, “Show list of matching results”).

Then look at the values on Seamonkey for

browser.urlbar.default.behavior

using about:config, and enter that value (and any others you care about) in Firefox using about:config on that browser.

In my case, I set browser.urlbar.default.behavior to 49 to get what I wanted.

Monitoring hard disk health with smartmontools

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 23 Jan 2010 23:50:21 -0700

I always install smartmontools when I use SMART-enabled hard drives. It wasn’t until recently, though, that I started automating the tests.

Here’s a link that explains it: http://www.captain.at/howto-linux-smartmontools-smartctl.php.

Based on that, here’s the code I added to my /etc/smartd.conf: # Per http://www.captain.at/howto-linux-smartmontools-smartctl.php DEVICESCAN -d sat -a -o on -S on -s (S/../.././19|L/../../3/21|C/../.././20) -m root # -d sat because /dev/sdX doesn't seem to run without it # S/../.././19 = short test every day at 19:00 # C/../.././20 = conveyance test every day at 20:00 # L/../../3/21 = long test every wednesday (3) at 21:00 # -m root = root will be emailed if anything strange occurs

Note that this has to come before any other DEVICESCAN (apparently the first one takes priority). Don’t forget to kill -HUP the smartd process so the new config will take effect, and make sure /etc/default/smartmontools has uncommented: start_smartd=yes

After this, you can get useful info with: sudo smartctl -l selftest /dev/sda (or whatever drive you care about).

A very good description of the output of smartctl can be found at: www.cyberciti.biz/tips/linux-find-out-if-harddisk-failing.html

Adding fldigi from the Berlios repository

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 15 Jan 2010 00:32:30 -0700

The version of fldigi that’s built for Ubuntu 9.10 is a bit out of date. Luckily, the Berlios repository has a more recent version, and you can install that.

The instructions are here. In short form (specific to Ubuntu 9.10):

Edit /etc/apt/sources.list and add the following lines:

# Berlios repository for updated FLDigi
deb http://download2.berlios.de/pub/fldigi/binaries karmic main

Get the key for fldigi

sudo apt-key adv --recv-keys --keyserver http://fldigi.berlios.de/binaries/fldigi-pkg-key.asc 8E7306F5

Install fldigi

sudo aptitude update; sudo aptitude install fldigi

Setting disk UUIDs

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Mon, 14 Dec 2009 20:41:03 -0700

After setting up mounting by UUID as described here, I realized I had a problem.

I wanted to swap disks out (that is, have multiple versions of my backup drive). However, since the drives are being mounted by UUID, I wanted to have only one entry in /etc/fstab for all my “backup” drives.

It appears that dd would work, but that seemed inelegant, especially if future drives are different sizes. So I did a bit of searching and found the discussion here.

In short, I could use sudo tune2fs /dev/sdb1 -U new-uuid-number to set the UUID of a file system to whatever I want.

After I’d done that, I couldn’t figure out how to refresh the UUID in /dev/disk/by-uuid/ - even after ejecting and re-inserting the SATA disk, the old UUID still showed up. I ended up rebooting (sigh) and now I can swap drives out with abandon. I probably should have specified the UUID when I did the mkfs. This looks like this bug.

I haven’t tried it, but I would guess having two disks with the same UUID in the machine at the same time would be a Bad Thing.

In retrospect, it would probably have been better if I’d used disk labels instead of UUIDs.

Changing Unix/Linux filenames to handle DOS conventions

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 12 Dec 2009 15:24:20 -0700

Recently, I had a bunch of files with characters in their names that made them hard to handle under Windows. Although Unix has no problems with :, ? and others, DOS / Windows doesn’t handle them well. This made using them on my CIFS share a bit of a pain.

To rename them, I hacked up a quick Groovy script. It maps all “weird” characters to _, which is pretty much universal.

Note that this script doesn’t currently handle the case where two files map to the same name. If you have :foo and ?foo, they’ll both get mapped to _foo and you’ll lose one of them.

I called it dosname because it was late and I wasn’t feeling creative.

#!/usr/bin/groovy -
if(args.length == 0) {
printArgs()
System.exit(0);
}
dirName = args[0];
new File(dirName).eachFile() { file ->
def matcher = (file.getName() =~ /[\?\:\"\\]/)
def newName = matcher.replaceAll("_")
File newFile = new File(dirName + "/" + newName.toString())
println file.getName() + " -> " + newFile.getName()
file.renameTo(newFile)
}
System.exit(0);
def printArgs() {
println("Usage: dosname [dirname]")
println(" Note: I don't handle the case where two files map to the same filename yet!")
}

The interesting bit is in the line

def matcher = (file.getName() =~ /[\?\:\"\\]/)

That line defines the regular expression which contains a group of characters which will be replaced by _. Right now it’s

\[?:"\\\]

(all quoted with \ because that’s what you have to do in regex).

Run it with “dosname directoryname”. There’s no way to reverse its effects, so try not to use it on useful directories like /etc/.

Also, I needed to install OpenJDK6 JDK (not just the runtime) in order to run Groovy on Ubuntu 9.04. Go figure.

Since I don’t know Groovy, I stole most of this code from here.

Using rsync to back up a Windows box to Ubuntu Server 8.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 10 Dec 2009 23:49:53 -0700

After getting rsync working so well for backing up hard drive to hard drive, I naturally wanted to back up from my Windows box to my Ubuntu server. Luckily, Cygwin has an rsync for Windows - so I started by installing that. (I actually already had it installed - Cygwin is nice.)

I found some good instructions here, and used them as the basis for what I did.

The steps I went through:

First I created /etc/rsyncd.conf. I wanted to share a single directory called shared, so I had just one entry:
```
[shared]
path=/data/shared
comment=Shared directory
uid=andrew
gid=sambashare
read only=false
auth users=rsyncuser
secrets file=/etc/rsyncd.secret
```
I picked group sambashare just to be consistent with my Samba configuration. rsyncuser does not exist on the machine; it is instead mapped to andrew (uid)
Next I created /etc/rsyncd.secret:
```
rsyncuser:secretrsyncpassword
```
After that, I needed to enable rsync (both right now and after reboot). First, I edited /etc/default/rsync and changed RSYNC_ENABLE to true:
```
RSYNC_ENABLE=true
```
Next I started the rsync daemon:
```
sudo /etc/init.d/rsync restart
```
The /etc/inetd.conf of a plain Ubuntu 8.04 Server install was empty, which was a surprise to me. There appears to be a utility called “update-inetd” to update the file and then restart inetd. Because I couldn’t be bothered to find out the syntax, I just edited /etc/inetd.conf and put in:
```
rsync stream tcp nowait root /usr/local/bin/rsync rsyncd --daemon
```
Then I used update-inetd from the command line to restart inetd for me:
```
sudo update-inetd --disable rsync
sudo update-inetd --enable rsync
```
At this point, I could telnet to port 873 (the rsync port) and see a connection, but rsync itself still didn’t want to run. Instead, it failed (even when I entered the correct password) with this message:
```
@ERROR: auth failed on module shared
rsync error: error starting client-server protocol (code 5) at main.c(1383)
```
Andrew Tridgell has awesome utilities, but he really has a problem with displaying meaningful messages.

It turns out that rsync really wants the secrets file (in my case /etc/rsyncd.secret) to be readable only by the rsync user. There is a global option “strict modes” that can be set to false to allow you to get around this, but I decided why not just do the right thing:
```
sudo chown root.root /etc/rsyncd.secret
sudo chmod 400 /etc/rsyncd.secret
```
Finally, I needed a command for the rsync on my Windows box. Here was one I came up with: @echo off set RSYNC_PASSWORD=secretrsyncpassword rsync -vrtz --delete --delete-excluded --exclude "Temp/" --exclude "*.tmp" --exclude "parent.lock" --exclude "UsrClass.dat*" --exclude "NTUSER.DAT" --exclude "ntuser.dat.LOG" --exclude "Cache/" "/cygdrive/c/Documents and Settings/" "rsyncuser@myserver::shared/win2k-backup/Documents and Settings" This command preserves timestamps (t) and prints out what it’s doing (v) as it recursively (r) goes through Documents and Settings and backs up the files, using compression so it’s faster over the net (z). It excludes a bunch of things.

I should probably have used a file to specify what’s excluded (–exclude-from), but I was lazy and just kept adding to the command line. I’m excluding cache files, as well as lock/log files that are kept open by Windows 2000 (they report as errors if you try to back them up).

At some point I’ll probably add a “hosts allow” line to my /etc/rsyncd.conf, as soon as I decide which machines I want to let backup to the server.

Automatically mounting drives with UUIDs

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 06 Dec 2009 21:28:42 -0700

Until now, I’ve always mounted drives by accessing their devices. However, I ran into a situation where this wouldn’t work. Luckily, Ubuntu has the ablility to access drives by UUID - which solved my problem.

I have a drive that holds networked data, which I mount on Ubuntu 8.04 Server as /data/. I also back that drive up to a drive which is normally read-only as /databackup/.

Both of these drives are SATA - meaning they could be unplugged at any time. If both are unplugged, whichever drive gets plugged in first becomes /dev/sda1 - and the other becomes /dev/sdb1. This means I can’t rely on mounting /dev/sda1 on /data and /dev/sdb1 on /databackup.

To get around this, I mounted the drives using UUID in /etc/fstab. First, I had to figure out what the UUIDs of the drives were. To start with, I killed Samba and unmounted both - I knew /dev/sda1 was /data and /dev/sdb1 was /databackup. Then I obtained the UUIDs of both drives:

$ sudo vol_id --uuid /dev/sda1
7b932326-717b-4ba6-bef2-fedfbafcabe6
$ sudo vol_id --uuid /dev/sdb1
94efd7bd-8498-46f3-ab6d-cb706c413567

Next, I replaced the device mounts (/dev/sda1 and /dev/sdb1) in /etc/fstab with:

UUID=7b932326-717b-4ba6-bef2-fedfbafcabe6 /data ext3...
UUID=94efd7bd-8498-46f3-ab6d-cb706c413567 /databackup ext3...

Under Ubuntu 9.10, it appears that vol_id has merged into blkid - so now you would use:

$ sudo blkid /dev/sda1
/dev/sda1: UUID="f30ba2a3-9da6-48b1-8ab5-75952ef26cc4" TYPE="ext3"

to determine the UUID, and then update /etc/fstab as you’d do for 8.04.

Simple backup using rsync

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 03 Dec 2009 23:46:20 -0700

A simple way to back up your data from one drive to another is rsync. The magical incantation (assuming the data drive is /dev/sda1 mounted on /data and the backup drive is /dev/sdb1 mounted on /databackup, and you normally keep the backup drive mounted read-only):

sudo mount -o remount,rw /dev/sdb1 /databackup
sudo rsync -a --delete --progress /data/ /databackup
sudo mount -o remount,ro /dev/sdb /databackup

Setting up Samba on Ubuntu Server 8.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 27 Nov 2009 00:43:59 -0700

It’s been a few years since I last set up a Samba system, and the process is still as painful as ever. A lot of this pain comes from multiple authentication systems, which all have to be in sync for things to work.

I started out with the link here: http://ubuntuforums.org/showthread.php?t=202605 and pretty much ignored all of it. In the end, I took the default 8.04.3 /etc/samba/smb.conf, and made the following changes:

Set the workgroup in the global stanza

Added stanzas like the following:

[music]
path = /music
browseable = yes
read only = no
guest ok = no
create mask = 0644
directory mask = 0755
force user = andrew
force group = sambashare

Note that I’m using user permissions, not share permissions. So I had to add and enable the Samba user:

sudo smbpasswd -L -a andrew
sudo smbpasswd -L -e andrew

Originally, I had force group = andrew. When I tried to mount using this option, I’d see:

$ sudo mount -a
mount error(5): Input/output error
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

What lovely error messages. I found a semi-useful diagnostic tool, smbclient:

smbclient //server/music -U andrew
Enter andrew's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
tree connect failed: NT_STATUS_NO_SUCH_GROUP

I did have an andrew group, but the user andrew wasn’t in that group according to /etc/group, so I switched to sambashare (which does have andrew as a member). Then it worked. Just adding andrew as a member of the group andrew in /etc/group was not sufficient. No idea why, but probably Samba has some concept of groups that needs to be set up too.

Next, I tried to connect again:

smbclient //server/music -U andrew
Enter andrew's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.28a]
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

This let me search on NT_STATUS_BAD_NETWORK_NAME and discover that, gee, that means permissons are bad for the directory that is being shared. Nothing better than helpful error messages.

A final /etc/init.d/samba restart and I could connect.

Creating credential files for automatic Samba mounts in /etc/fstab

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 26 Nov 2009 23:55:28 -0700

It’s handy to have credentials for each Samba server so you don’t have public passwords in /etc/fstab for the Samba file systems you want to mount on boot. Here’s how I do it:

Create a directory /etc/samba/credentials
Create a file /etc/samba/credentials/myserver
In the myserver file, put the credentials for that server:
```
username=myusername
password=mypassword
```
Note: spaces are important here - don’t use “ = ”, use “=”.
chown -R root.root /etc/samba/credentials
chmod 700 /etc/samba/credentials
chmod 600 /etc/samba/credentials/myserver

Once this is done, you can add lines for each mount of that server to your /etc/fstab:

//myserver/music /music smbfs credentials=/etc/samba/credentials/myserver 0 0
//myserver/shared /shared smbfs credentials=/etc/samba/credentials/myserver 0 0

Note that the file in /etc/samba/credentials doesn’t have to be named the same thing as the server name - it just makes it easier.

This also survives the Ubuntu upgrade process, so you just have to update /etc/fstab if you upgrade to a new release, and can keep the same credentials files.

Compiling soundmodem-0.14 on Ubuntu 9.10

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 21 Nov 2009 00:00:47 -0700

The soundmodem that ships with Ubuntu 9.10 is not the latest. The latest is available here:

http://www.baycom.org/~tom/ham/soundmodem/

In order to compile it, you need to install a bunch of development packages. Here’s what I did:

sudo aptitude install libasound2-dev
sudo aptitude install libxml2-dev
sudo aptitude install libgtk2.0-dev
sudo aptitude install libaudiofile-dev

Also, if you don’t have the compiler already you’ll need:

sudo aptitude install g++

Then:

tar xzvf soundmodem-0.14.tar.gz
cd soundmodem-0.14
sh ./configure
make

To test it, go to the configapp/src directory and run

sudo ./soundmodemconfig

to set up the configuration. Finally, go to the soundcard directory and run:

sudo ./soundmodem -v5

Assuming you’ve configured everything correctly, you should see something like:

sm[10093]: mkiss: ifname sm0 mtu 256 hwaddr CALLSIGN-0 ipaddr 10.0.0.1 netmask 255.255.255.0 broadcast 10.0.0.255
sm[10093]: unknown node "text"
ALSA: Using sample rate 9600, sample format 2, significant bits 16, buffer size 4800, period size 150
ALSA: Using sample rate 9600, sample format 2, significant bits 16, buffer size 4800, period size 150
sm[10093]: audio: starting "plughw:0,0"

In a different terminal, you can then ifconfig sm0 to see that it’s there.

Tuning X video with modeline

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Fri, 30 Oct 2009 14:40:09 -0700

After setting my monitor up, I found it didn’t exactly match the other devices on my kvm switch. I could get around this by pressing the “Auto Adjust” button on the monitor, but that meant I’d have to adjust again when I switched to a different machine.

Usually, what I do in these cases is to use xvidtune to fine-tune things. Unfortunately, that didn’t work - it would always fail with “Unable to query monitor info” even when I disconnected the kvm switch and went directly into the monitor.

What that meant is that I’d have to hack the modeline manually. I found a good discussion of modelines here.

A modeline has the following format:

name dotclock hsize hsyncstart hsyncend htotal vsize vsyncstart vsyncend vtotal hsyncpol vsyncpol

I needed to move the image on my monitor to the right (I had a black bar on the right hand side, and the left hand side was clipped off). To move the monitor right, I needed to DECREASE hsyncstart and hsyncend by the same amount. (Then I logged out and logged back in to restart X so the new settings were being used.)

Once the screen was more or less centred, I DECREASED htotal to make the display wider. (And then logged out and logged in again….)

After that, the image was still a little further right than I wanted, so I DECREASED hsyncstart and hsyncend again to get the wider display centered again. One more restart of X and things were groovy.

My current modeline is: Section "Monitor" Identifier "Configured Monitor" # 1280x1024 59.89 Hz (CVT 1.31M4) hsync: 63.67 kHz; pclk: 109.00 MHz # Modeline "1280x1024_60.00" MHz HSize HTotal HSyncEnd HSyncDelay VSize VSyncStart VSyncEnd VTotal HSyncPol VSyncPol Modeline "1280x1024_60.00" 109.00 1280 1322 1450 1700 1024 1027 1034 1066 -hsync +vsync EndSection

Now things are automatically adjusted when I switch from one box to another.

Note: This won’t work if you aren’t currently displaying something in the mode you want to use. Also, keep a copy of your original values in your xorg.conf file just in case things go awry - it’s possible to put all your controls offscreen, which can make things challenging.

Modeline for Samsung LN32A450C

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 25 Oct 2009 14:28:51 -0700

When I switched my video card after the capacitors burnt out on the old one, I found I could no longer do 1366x768 video on a Samsung LN32A450C. Most frustrating was the fact that I’d see the video for about four seconds, before the TV decided it didn’t want to display it and showed “Mode not supported”.

Apparently, this is a common problem with Samsung TVs - and cvt was no help.

Luckily, I found this post - so here is the modeline for the Samsung LN32A450C

Modeline "1360x768" 85.500 1360 1440 1552 1792 768 771 777 795 +hsync +vsync

I just had to add that to my Monitor section of /etc/X11/xorg.conf and the autodetection on Ubuntu 9.04 did the rest. This is actually 1360x768, not the specified 1366x768 that Samsung is supposed to support - but I don’t miss the few pixels on either side.

Ubuntu 9.04 setup - fixing the scroll wheel

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 21 Oct 2009 23:00:41 -0700

In Ubuntu with a PS/2 mouse, the scroll wheel stops working when you switch away with a KVM switch. I found some good instructions for fixing the problem on 8.04 here.

There are a few minor changes for 9.04. Here are the steps:

Add the following to /etc/modules
```
psmouse
```
Create /etc/modprobe.d/psmouse.conf and give it the following contents:
```
 # Make my mouse work with KVM
options psmouse proto=imps
```

Finally, reload the mouse module:

 # sudo modprobe -r psmouse
# sudo modprobe -a psmouse

Setting up the Sharp LL-172C-B Monitor on Ubuntu 9.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 21 Oct 2009 22:51:36 -0700

Here’s the magic to get the video mode set right for the Sharp LL-172C-B monitor (1280x1024) on Ubuntu 9.04:

First, run CVT to get the modeline:

$ cvt 1280 1024

Copy the output from that into the Screen section of /etc/X11/xorg.conf

Section "Monitor"
Identifier      "Configured Monitor"
# 1280x1024 59.89 Hz (CVT 1.31M4) hsync: 63.67 kHz; pclk: 109.00 MHz
Modeline "1280x1024_60.00"  109.00  1280 1368 1496 1712  1024 1027 1034 1063 -hsync +vsync
EndSection

Restart X and you’re in business.

Update: I found I needed to tune the values a little bit. See the post here for more details.

Stopping the squeaks with soundmodem as ax.25

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sat, 17 Oct 2009 07:23:59 -0700

I tried to set up soundmodem as an AX.25 device in order to run xastir on my machine. Unfortunately, Ubuntu by default has a bunch of services installed that prevent this. (Not so much prevent it as try to shove 100k of data through the 1200-baud soundmodem, which kills it and drives you nutty if the audio is turned up.)

Here’s what I did to get around this:

1. Change /etc/samba/smb.conf to include only the eth0 interface.

interface = eth0

2. Go into /etc/cups/cupsd.conf and turn off broadcasting (instructions here):

# Browsing was on.
#Browsing On
Browsing Off
BrowseInterval 0
# end trying to get around sm0 problem

3. Stop the AVAHI daemon by moving /etc/rc5.d/S18avahi-daemon to /etc/rc5.d/K18avahi-daemon and running /etc/rc5.d/K18avahi-daemon stop

Note that on Ubuntu 9.10, avahi has been moved into Upstart. Stop it with

sudo stop avahi-daemon

then edit /etc/init/avahi-daemon.conf and comment out the

#start on (filesystem
# and started dbus)

and

#respawn

Blogs on Andrew's Memory Blog

Uploading to the webserver from Forgejo

Setting up variables #

Setting up secrets #

Add Hugo back to the build and really upload #

Running Hugo from the runner on Forgejo

Setting up a Forgejo runner for Hugo and others

Get the runner token #

Setting up a runner #

Getting the runner to restart on reboot #

Installing a minimal Forgejo via Docker on Ubuntu 24.04

Pull Forgejo from Docker #

Creating a Git Repo Into Forgejo #

Verifying your public key #

Connecting the old repo #

Setting Forgejo to restart after reboot #

Website automation with Forgejo

Setting up systemd resolv.conf

Migrating from Astro to Hugo

Set up Hugo #

Copy the old posts over #

Fix the posts #

Tweak code blocks to allow filenames #

Move things to match the old site #

Prettify the RSS feed #

Build the static site #

Install the static site #

Images are broken #

Fixing Van Heusen Shirt Pockets

Shrinking files on AntennaPod

Fixing OpenBSD console mode for a new HDMI monitor

Jackery Explorer 2000v2 Specifications

More on using Uniden Sentinel BCDx36HP on Ubuntu 24.04 under Wine

Downloading an APK from Android

Fixing buffer bloat on OpenBSD 7.2

Converting ePub to PDF

Removing Copilot from Windows 10 (at least today)

Adding code titles (filenames) to astro-micro-academic

Installing VNC on Ubuntu 24.04 with X

Building Emacs 29.4 on Ubuntu 22.04

Grab the GNU public keys #

Download Emacs and validate the signature #

Install dependencies #

Extract, build and install Emacs #

Clean up #

Locking weirdness between Ubuntu, CIFS and Emacs

Changing the MTA's maximum message size (postfix)

Setting up and using Uniden Sentinel BCDx36HP on Ubuntu 22.04 under Wine

Installation #

Using Sentinel #

Stop "[Application]" Is Not Responding on Ubuntu 22.04/Gnome

Block Ad Sites and Nasties on OpenBSD 7.4

Grabbing Bad Hostnames #

Grabbing Bad IPs #

Configuring unbound to use the bad hosts lists #

Configuring PF to block the bad IP addresses #

Setting up Wireguard on an OpenBSD 7.4 firewall device

Set up networking for an OpenBSD 7.4 firewall device

Configure Network Adapters #

Setting up the PF packet filter #

Configure dhcpd #

Start Unbound for DNS #

Setting up an OpenBSD 7.4 Firewall Device

Installing OpenBSD 7.4 for a Firewall

Set up doas #

Install patches and packages #

Set up mfs for /tmp #

There were some noisy beeps #

Buying new hardware for an OpenBSD firewall

Setting up DuckDNS on OpenBSD

Logging into Ubuntu 22.04 Remote Desktop

Ubuntu 22.04 logs not rotating

ssh unable to negotiate

Merging multiple PDFs

Building TQSL 2.6.4 for Ubuntu 20.04 (or TQSL 2.6.5 for Ubuntu 22.04)

Changes for TQSL 2.6.5 #

Setting up Ubuntu 20.04 LTS

Setting up NFS on Ubuntu 20.04

Mounting a partition from a raw disk image

Annealing PLA in powdered salt using sous vide

Setting up variables
#

Setting up secrets
#

Add Hugo back to the build and really upload
#

Get the runner token
#

Setting up a runner
#

Getting the runner to restart on reboot
#

Pull Forgejo from Docker
#

Creating a Git Repo Into Forgejo
#

Verifying your public key
#

Connecting the old repo
#

Setting Forgejo to restart after reboot
#

Set up Hugo
#

Copy the old posts over
#

Fix the posts
#

Tweak code blocks to allow filenames
#

Move things to match the old site
#

Prettify the RSS feed
#

Build the static site
#

Install the static site
#

Images are broken
#

Grab the GNU public keys
#

Download Emacs and validate the signature
#

Install dependencies
#

Extract, build and install Emacs
#

Clean up
#

Installation
#

Using Sentinel
#

Grabbing Bad Hostnames
#

Grabbing Bad IPs
#

Configuring unbound to use the bad hosts lists
#

Configuring PF to block the bad IP addresses
#

Configure Network Adapters
#

Setting up the PF packet filter
#

Configure dhcpd
#

Start Unbound for DNS
#

Set up doas
#

Install patches and packages
#

Set up mfs for /tmp
#

There were some noisy beeps
#

Changes for TQSL 2.6.5
#

Procedure
#

Observations
#

Results
#

Conclusion
#

The Problem
#

Things that didn’t work
#

The Solution
#

Things I wish I’d known about the upgrade
#

Grab TicketsCAD
#

Dockerfile for TicketsCAD
#

Dockerfile for MariaDB
#

docker-compose.yml
#

Building and running
#

What next?
#

Hey TicketsCAD guys!
#

A few more more useful things
#

My directory structure
#

(or how to draw an arrow with an outline)
#

Burn the image
#

Configure the Pi
#

Set up the network
#

Install an editor
#

Update the OS
#

Add my user
#

Update everything else
#

Get things I know I’ll need
#

Mounting a CIFS drive
#

Burn the image
#

Configure the Pi
#