Linux on nagg.eu

We are in the cloud

Sat, 08 Jul 2023 00:00:00 +0000

We are in the cloud, running on someone else’s computer.

Microsoft Teams on Fedora and Wayland with screenshare

Mon, 27 Apr 2020 00:00:00 +0000

Since the whole COVID19 pandemic hoax started a couple of months ago, working from home has become the new hip thing every company brags about on every social media known to humankind.
The first step to be able to call yourself a proper COVID19 ready(tm) company is the ability to bother every employees with just a few mouse clicks.
So here we are, with Microsoft Teams(tm) and a lot of other not very secure and massively bloated software elected as the center of the office life.
Coffee break? XYZ software chatroom. Kick-off meeting? XYZ software chatroom. And so on.
Because of my special snowflake syndrome and my deep hatred for all things Microsoft and especially Windows I always end up making my life a bit harder.
After having used Teams in a Windows 10 VM (after all I paid for a license when I got my latest Thinkpad) for a few weeks, I decided it was time to finally try to make it work on my main OS: Fedora 31.
The catch was also that I wanted to do that more or less without installing any third party non free software.
The OS I use is Fedora 31, which comes with pipewire and xgd-desktop-portal both installed and configured out of the box.
Since using the official closed source Electron crapware client was out of the question, the obvious choice was to make Microsoft Teams work in a regular WEB browser.
The situation is the following:

Kubernetes cluster for manufacturing engineering: tale of an epic commissioning

Wed, 23 Oct 2019 00:00:00 +0000

- Introduction

A quite big company that produces parts for some of the most important automotive industry companies was interested in a cloud-based system to monitor the overall efficiency of their production machines, analyze some key parameters and optimize the production activities scheduling.
Goal of the project was to connect eleven industrial manufacturing machines to the cloud, extract specific machine data and develop a web application for the visualization and management of such data, while guaranteeing information confidentiality and security.
Furthermore, one fundamental requirement of such system has been the bidirectional integration with the customer’s ERP system, in order to synchronize the production JOBs and manage their execution on the corresponding machines.
To fulfill such requirements, the project team has engineered and then implemented an hybrid edge-cloud solution in which the software has been packed into various containers that are orchestrated and managed, at the edge level, by a Kubernetes cluster.
This technology ensures an optimal load balancing between the available resources as well as a high availability in case of hardware or software failures.
While IT enterprises do not question the value of containerized applications anymore, the use of such kind of technologies within a manufacturing environment hasn’t been completely explored yet.
In the following paragraphs we will go into details on how we engineered and built the system despite all the difficulties we had to overcome.

Resize QCOW2 disk image

Wed, 05 Dec 2018 00:00:00 +0000

QCOW2 disk images can be easily grown using libvirt command line utils.
Unfortunately it isn’t possible to grow QCOW2 images in-place or online.
First of all, power off the virtual machine, grow the file and make a copy of it:


$ qemu-img resize image.qcow2 +200G
$ cp image.qcow2 image-new.qcow2

Identify the specific partion you intend to grow:


$ virt-filesystems -a image.qcow2 -l
Name Type VFS Label Size Parent
/dev/sda1 filesystem ext4 - 536870912 -
/dev/sda3 filesystem xfs - 45885612000 -

Expand the actual partition:

Intel CPU, Hyper-Threading and Spectre STIBP mitigation

Sat, 17 Nov 2018 00:00:00 +0000

Yesterday I was reading phoronix 0 and phoronix 1 articles on STIBP mitigation impact on CPU performance, since I run a pretty old laptop equiped with a Sandy Bridge CPU I figured that I should do my own tests to see how bad things really are or aren’t.

CPU: Intel Core i3-2310M - 2 cores / 4 threads
Motherboard: Lenovo Thinkpad
RAM: 2x4 GB DDR3 @1333 MHz
HDD: Plextor M5pro

OS: Fedora 29 x86_64 with stock kernels

My benchmark of choice is compiling the Linux kernel (version 4.19.2).
What I do is download the kernel version to /dev/shm ramdisk and compile it using the defconfig configuration while checking how many seconds it takes to complete the task.

Generate a secure GPG key

Fri, 10 Aug 2018 10:22:56 +0000

For some reason gpg gen-key still defaults to SHA1 and RSA2048, due to the known weaknesses of SHA1 it is probably a better idea to use SHA256.
First of all, we need to create a configuration file.

cat ~/.gnupg/gpg.conf"
---
personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

To generate a new key type (also specify to use RSA 4096):

gpg --gen-key
### or
gpg --full-generate-key

Other useful commands are:

AMD Ryzen on Linux

Sat, 17 Jun 2017 10:52:37 +0000

Finally we have some new hardware worth writing of and also spending money on.
I have been using an AMD Ryzen 7 1700X based build for some time now and so far I am really liking it, the CPU is marvelous considering the pricetag and felt like a worthwhile upgrade from the Xeon E3-1241v3 I was using before; it is basically twice the cores clocked at pretty much the same speed. Awesome.
There are a couple of points worth spending some words on tho.

Monitor hard disk health status with smartd on Linux

Thu, 02 Feb 2017 10:20:34 +0000

This does not really works, read this: https://nagg.eu/monitor-hard-disk-smart-status-in-python/

First of all install smartmontools, it has the same name on pretty much every distro:

$ emerge -a1 smartmontools

Proceed to edit its configuration file, at the bottom of the file there is a quick explaination of all the available parameters:

cat/etc/smartd.conf
---
DEVICESCAN -H -R 1 -R 5 -R 7 -R 10 -R 11 -R 196 -R 197 -R 199 -R 200 -m user@domain.tld -n standby,10,q

Parameter -H tells smartd to check the result of overall-health self-assesment test which is pretty much useless, -R is used to specify a single SMART attribute, if its value changes a mail is sent to user@domain.tld.
To send emails a MTA must be installed, in centos that is sendmail, in gentoo it is not strictly necessary to have a full fledget MTA installed, nullmailer will suffice.
If it is not already installed:

Copy Linux sparse files over network

Wed, 09 Nov 2016 18:19:35 +0000

Sparse files are nice to use to store virtual machine’s virtual disks but can be a real pain in the ass to backup efficiently, especially over the network.
Luckily rsync provides a way to intelligently copy sparse files both locally and over the network.
The trick is use --sparse and --inplace options.
Let’s say we have a sparse 60 GB qemu virtual disk with only around 7 GB used:

$ ls -lh fedora24.qcow2 
-rw------- 1 root root 61G Nov 8 19:11 fedora24.qcow2
$ du -h fedora24.qcow2 
7.2G	fedora24.qcow2

The first thing to note is that ls does not recognize sparse files while du does.
The first time a file is copied use the --sparse option:

pdnsd automatic startup Arch Linux

Sat, 30 Aug 2014 11:01:53 +0000

I have this Arch Linux based ODROID-U3 I use as DLNA server, local web server…etc…and also as local DNS caching server.
For some strange reason pdnsd doesn’t seem to start correctly on Arch Linux.

[root@server ~]# systemctl status pdnsd -l
● pdnsd.service - proxy name server
 Loaded: loaded (/usr/lib/systemd/system/pdnsd.service; enabled)
 Active: failed (Result: exit-code) since Sat 2000-01-01 20:02:07 CET; 14 years 7 months ago
 Process: 182 ExecStart=/usr/bin/pdnsd (code=exited, status=3)
 Main PID: 182 (code=exited, status=3)

Jan 01 20:02:06 server systemd[1]: Starting proxy name server...
Jan 01 20:02:06 server systemd[1]: Started proxy name server.
Jan 01 20:02:06 server pdnsd[182]: Error in config file (line 11): Failed to get IP address of eth0: Cannot assign requested address
Jan 01 20:02:07 server systemd[1]: pdnsd.service: main process exited, code=exited, status=3/NOTIMPLEMENTED
Jan 01 20:02:07 server systemd[1]: Unit pdnsd.service entered failed state.

Adding After=network-online.target and Wants=network-online.target in the Unit section of the startup script doesn’t seem to make any difference.
So far the only workaround which really works is adding the line After=multi-user.target in the service script.

Interesting read on Samba 4

Wed, 11 Jun 2014 16:07:25 +0000

In the last month or so despite not having much spare time I spent a few hours reading an interesting book: Implementing Samba 4
It actually is more than a simple book, it is a well written step-by-step guide on how to install (on Debian 7, not that it makes much difference, the installation is really similar on CentOS for example), configure, manage and even migrate an existing Active Directory domain controller from Windows Server to GNU/Linux.
It consists of 9 chapters each one covering the most important features of Samba 4; everything explained in the book is also integrated with code snippets, scripts and command line examples.
I am sure this book will come real handy in case I will have to setup a GNU/Linux based AD domain controller.

nginx and TLS v1.2

Sat, 10 Aug 2013 14:03:39 +0000

Given that SSL and TLS, especially v1.0, suffer from serious security issues (e.g. https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS) I thought it would be a good idea to use the latest and more secure version of it: v1.2.
On CentOS 6.4 the openssl version included is quite old and doesn’t support TLS v1.1 and 1.2.
So, first of all we have to install the latest version 1.0.1e, it can be done compiling from sources or by adding a third party repository; I chose the latter.

WordPress admin, SSL, Apache + nginx

Tue, 30 Jul 2013 15:49:37 +0000

Let’s say we have a WordPress blog and we would like to encrypt our login pages and the whole back-end of the site.
There are many ways to do it, but since I already have a nginx instance configured as reverse proxy running in front of Apache I’ll use it to protect my admin pages and logins.
In this page I’ll not cover Apache’s configuration, which, by the way, is trivial to say the least, so please refer to this other post: Apache + nginx as reverse proxy.
Using the configuration posted in the above’s link as starting point, to add SSL encryption to admin pages we should add a couple more bunch of lines of code.
First of all, we must create our own Certificate Authority and issue a SSL certificate.
Another option is buying a certificate, but I don’t trust CA (certificate forgery anyone?) and I don’t mind having a properly signed certificate for a page I am the only one accessing to.
Follows a brief explanation on how to create a CA and issue a certificate.

Linux Kernel 3.10 and VMware Workstation 9

Sat, 27 Jul 2013 14:11:04 +0000

A new Linux kernel version is released and guess what: VMware Workstation fucked up once again.
The fix posted on the Arch Linux wiki is applicable also to Fedora 19, I’ll post it here for future reference.

$ cd /tmp
$ curl -O http://pkgbuild.com/git/aur-mirror.git/plain/vmware-patch/vmblock-9.0.2-5.0.2-3.10.patch
$ curl -O http://pkgbuild.com/git/aur-mirror.git/plain/vmware-patch/vmnet-9.0.2-5.0.2-3.10.patch
$ cd /usr/lib/vmware/modules/source
# tar -xvf vmblock.tar
# tar -xvf vmnet.tar
# patch -p0 -i /tmp/vmblock-9.0.2-5.0.2-3.10.patch
# patch -p0 -i /tmp/vmnet-9.0.2-5.0.2-3.10.patch
# tar -cf vmblock.tar vmblock-only
# tar -cf vmnet.tar vmnet-only
# rm -r vmblock-only
# rm -r vmnet-only
# vmware-modconfig --console --install-all

For more information: https://wiki.archlinux.org/index.php/VMware#3.10_kernels

Logitech G500 and Linux

Wed, 01 May 2013 15:10:47 +0000

Despite not being a gamer at all I see having a decent mouse as an important thing, I spend 10 to 15 hours a day in front of my PC and probably for at least half of the time I’m using the mouse, so I don’t get why I should not have the best input peripherals on the market.
My current mouse is a Logitech G500 (NP 910-001262), of course it being the best mouse on the market is an highly debatable thing since, along side with the keyboard, mouse choice is highly subjective.
G500 is something you love or you hate, starting from the unusual scroll wheel, going to the sensor position to the strange side buttons there are a lot of uncommon things.
This small write-up is not meant to be a review nor a guide, I would like it to be just a bunch of tips from someone who is using a G500 on a Linux box.
First of all: this mouse has no angle snapping, or better, out of the box angle snapping is enabled (Logitech, why? seriously, none like angle snapping) but it can be disabled from drivers.
Obviously drivers are available only for Windows (Logitech…) and I don’t seem to be able to change mouse settings from a virtual machine (VMware Workstation 9), anyway I didn’t put much time on this so it could be doable.
So what I suggest is plug G500 in a physical Windows machine, install drivers and tune the settings, once you are done, save settings on G500 internal memory and plug it in your Linux machine.
Once in Linux, which in my case is Fedora 18 and XFCE as DE, there are still acceleration issues which can be solved quite easily using xinput.
– Someone report that G500 sensor is flawed and it has some kind of built-in acceleration, honestly I don’t see it but could be that I’m just used to it –

Samba 4, simple directory sharing

Sat, 19 Jan 2013 17:23:11 +0000

With Samba being the clusterfuck it is, every time a new version is released you have to expect something to be messed up.
This time they added a bunch of new features like MS Active Directory support, too bad that now the simple directory sharing is broken/not working like it did before.
Something like 1 year ago I wrote a small guide about how to setup a Samba share on Centos 6 and I used the same smb.conf file on more than 10 machines without any problem since yesterday, when I tried it on my fresh installed Fedora 18 (which uses Samba 4.0.0). First of all, in the “Standalone Server Options” is reported that “security” options “share and server” are deprecated; too bad I just used “share” to save me the hassle of setting up a new user and stuff even if I would like the directory to be fully accessible by everyone without any restriction.
I tried it anyway with “security = share” but there was no way to make the folder accessible, when trying to access the Samba share I always got a popup in which I had to login.
So, at the end of the story, like it or not, I had to setup a new user, create a samba user and edit the “smb.conf” file.

Thinkpad E320 and Fedora 17

Tue, 18 Dec 2012 21:05:21 +0000

First of all, forget everything about the myth: Loonix, it just werks. Close to nothing werks out of the box, tho with a good amount of patience and a bit of tinkering there are good chances to make the whole thing working in a decent manner.
First of all, the box I’ve here is a Thinkpad Edge 320 – 12983RG and I’ve installed Fedora 17 x64 with XFCE as DE.
It comes with the integrated Intel HD3000, no discrete graphic card and UMTS module (I didn’t tested if it’s working or not).