May 2020 - Talk - lists.gtalug.org

war story: power failure makes CentOS system unbootable
by D. Hugh Redelmeier 30 Sep '22

30 Sep '22

tl;dr / spoiler: change fstab so that /boot/efi is not automatically mounted. See the recommendation at the end of this message. My gateway computer is a little PC running CentOS. It does not come back after a power failure. The reason (as best I can tell) is interesting and I think that I have a fix. My system is UEFI. It boots from a UEFI system partition, known as /boot/efi to Linux. If this gets corrupted, it won't boot. It is a VFAT partition. On my gateway (a Zotac Zbox RI321, a cute little box with two ethernet ports), the UEFI firmware apparently won't boot if the dirty bit is set in the system partition. CentOS normally runs with /boot/efi mounted. So when the system isn't shut down cleanly, the dirty bit will be on. Consequence: the system is not going to boot after a power failure. Odd observation 1: if I put a live Fedora 25 USB stick in the system and try to boot in this otherwise-unbootable state, CentOS boots from the main disk. So this really looks like a firmware bug/quirk. Odd observation 2: fsck doesn't seem to automatically fix the system partition. Once CentOS 7 booted, I dismounted /boot/efi and did an fsck on it. $ sudo fsck /dev/sda1 fsck from util-linux 2.23.2 fsck.fat 3.0.20 (12 Jun 2013) 0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. 1) Remove dirty bit 2) No action ? 1 Leaving filesystem unchanged. /dev/sda1: 16 files, 2420/51145 clusters Googling got me to <https://www.centos.org/forums/viewtopic.php?t=50917> In particular, this advice seemed quite good: ==== recommendation ==== Two other changes I recommend for UEFI systems, to each OS's /etc/fstab. - For the /boot/efi mountpoint, add the mount options x-systemd.automount,noauto - Change fs_passno (last column) to a 1 or 2; the canonical fstab instructions suggest 2, but systemd treats 1 and 2 as the same. The first change means the EFI System partition will not be automatically read-write mounted at boot time; it's a bad idea this is the default because it puts the ESP at risk especially if ther are crashes, FAT has no journal and will therefore always be marked dirty in such a case; no other UEFI OS mounts the ESP by default. Second, if anything tries to access /boot/efi (read or write), systemd will automatically mount it, and because of the fs_passno 1 or 2, it will fsck it first and that fixes and clears the dirty bit in case it's set. Right now without these changes, it's just a matter of having the right number and bad timing of crashes to render the EFI System partition corrupt.

3 9

security threats of Open Source
by D. Hugh Redelmeier 25 Nov '20

25 Nov '20

<https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealin…> This article list six cases of malware contributed to npm (the repo for sharing node.js and JavaScript source). How many undetected cases exist? I've alway pretended that Linux distros vet their code. I'm not sure how true that is. Probably the greatest protection is the time delay between contribution and distribution. I wonder what can be done about this problem. I've said so at our meetings a few times too. Of course the problem is worse with closed source: it is impossible to audit the source. But closed source might have fewer contributors and more supervision. Of course much closed soure is built on top of open source and thuse all its weakness

7 12

Continuing Printer Woes
by Peter King 05 Jun '20

05 Jun '20

Eric S. Raymond was right about CUPS some fourteen years ago, in his essay "The Luxury of Ignorance" (http://www.catb.org/~esr/writings/cups-horror.html) and things really haven't gotten any better. Here's an update since I last posted about six weeks ago. I had an HP LaserJet 1100a, which worked reasonably well until its internal memory went bad. These things happen. So I got a more recent HP Pro 1102w which is no end of trouble; I could print to it a bit, irregularly, but now not at all -- everything seems to be configured properly but CUPS reports "Waiting for printer to become available" and nothing I do, from writing udev rules to rebooting, makes it available. So I bought another printer, a Lexmark MS415dn, in part for its three-penguin rating [ = "works perfectly with Linux"] on openprinting.org, but it does not work perfectly, spitting out endless pages of gibberish when I sent it PDFs or PostScript files, to the point where it prints only once out of every two or three attempts. I won't go through all the details of what I've tried, but I have tried, and tried, and tried. More or less at my wit's end -- actually, I can see my wit's end receding in the distance in the rear-view mirror -- and proving that I cannot learn from experience, I'm considering buying something that should just work, that is, of getting a monochrome single-function laser printer with embedded PostScript to handle my needs, which, you'd think, would be a sufficiently humble set of requirements. You'd think. If anyone on this list can recommend such a beast, which can run reliably under Linux (specifically arch linux), I would be almost shamefully greatful. Nearly as good would be cautions about what to avoid. Thanks. -- Peter King peter.king(a)utoronto.ca Department of Philosophy 170 St. George Street #521 The University of Toronto (416)-946-3170 ofc Toronto, ON M5R 2M8 CANADA http://individual.utoronto.ca/pking/ ========================================================================= GPG keyID 0x7587EC42 (2B14 A355 46BC 2A16 D0BC 36F5 1FE6 D32A 7587 EC42) gpg --keyserver pgp.mit.edu --recv-keys 7587EC42

12 21

I’m obviously way behind in my reading: IBM owns Redhat
by David Mason 31 May '20

31 May '20

This is not news… except to me, but I thought the article might be interesting to someone. https://www.popularmechanics.com/technology/a24397193/ibm-red-hat/ ../Dave

9 38

Raspberry Pi 4 with 8G of RAM
by D. Hugh Redelmeier 29 May '20

29 May '20

I just got an ad from Seeed Studio. It offers an 8G Raspberry Pi 4 for pre-order. I didn't know of this new RAM size before seeing the ad. Estimated availability date is June 5. <https://www.seeedstudio.com/Raspberry-Pi-4-Computer-Model-B-8GB-p-4595.html> US$75 for a computer with 8G seems quite reasonable. Being greedy, the only Pi 4's I've purchased have been 4G units. I will probably only buy 8G units in the future. I admit that 2G is enough for many purposes. 8G certainly makes a 64-bit OS more desireable. I think that Raspbian is still only 32 bits (so that all Pi's are still supported by one image, I think). Seeed is an interesting "maker" sort of vendor. I have ordered a couple of Pi 4's from them in the past. I consider them reputable. Slowish delivery (from China). They do have a warehouse in the US too. See also <https://techcrunch.com/2020/05/28/raspberry-pi-foundation-announces-raspber…> This says that the Foundation has started working on 64-bit Raspbian. 64-bit Ubuntu and other distros are already available now.

7 6

Automatic .local and .lan hostnames
by Giles Orr 27 May '20

27 May '20

I have a Raspberry Pi on my local network that acts as an MPD server. It's hostname is "pib". I have, for about a year and a half, been referencing it from other machines on the local network as "pib.local". Yesterday, one of the machines stopped being able to find "pib.local" but can now connect to "pib.lan" - which I don't think used to work. I've never set up my local machines to provide <hostname>.local or <hostname>.lan addresses, it seems to be an automatic service of both Fedora and Debian (or Raspbian). And I've always had problems with its indecisiveness about "is it .lan, or is it .local?" For some machines it's one, for some machines it's the other. But I think this is the first time it's switched. And no, I didn't make any configuration changes (or software upgrades) on the machine that switched. So now I'm really interested in how these names are made available. I don't care which of the two names it provides, but I'd really, really like it to do it consistently. Can someone point me in the right direction, and I'll go do my homework. Thanks. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

2 2

(off topic) What power bank should I avoid?
by William Park 20 May '20

20 May '20

My LG Nexus 5X died, and I'm temporarily using an old Samsung Galaxy S3 with poor battery. I may need to use a power bank, until I get a new phone. Which power bank do you recommend (or not recommend)? -- William Park <opengeometry(a)yahoo.ca>

5 6

Re: [GTALUG] CIRA officially launches free DNS firewall for consumers | IT World Canada News
by Sadiq Saif 16 May '20

16 May '20

On 2020-04-28 09:16, ac via talk wrote: > On Tue, 28 Apr 2020 08:13:11 -0400 > > How about just plain old DNSSEC? > (instead of a nanny) - yay, IT Works! - and is so mature > already...(without all the risks of having/using a nanny) DNSSEC and DNS-over-HTTPS/DNS-over-TLS are not the same thing and don't protect against the same threats. DNSSEC protects against DNS cache poisoning by verifying the digital signature and therefore integrity of the zone's contents. That is, it provides authentication not encryption. DOH/DOT provides transport level encryption of the contents of the DNS packets themselves from the host to it's resolver. This provides protection against packet snooping on the wire, for example on an unsecured WiFi connection. > and using connectivity providers (instead of third parties and dns over > https) -- for caching/recursive, like Bell (Bell CA actually does not > track/record/monetise their users DNS querries afaik) I would love if Bell.ca offered DOH/DOT service on their recursive/caching resolvers. > again, dnssec already protects users, it just needs wider adoption, > which is the issue.. .as for "shared" domains like outlook.com - abuse > management costs will increase? - which is probably why dnssec has > never caught on, it is not "sexy" (like some nannies...) DNSSEC adoption is indeed a problem. IMHO, this is because it is a pain to implement properly and provides little benefit to the user of the zone in most cases. Improperly signing a zone will result in it not resolving which is one hell of a failure mode for most people to put up with. I only recently started signing my domains again and that is only because my managed DNS provider made it very simple, as in I click a button, zone is signed and I add the ZSK digest to my domain registrar. Further reading on DOH/DOT and DNSSEC: DNS Wars by Geoff Huston https://blog.apnic.net/2019/11/04/dns-wars/ DNSSEC https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions -- Sadiq Saif https://sadiqsaif.com

3 2

Compressing an image of a microSD card
by Giles Orr 14 May '20

14 May '20

I have an Anbernic RG350, a very nice hand-held gaming console: https://retrogame300.com/products/rg350 It uses a Linux distro that was developed for an older hand-held game console. It turns out that the OS and "internal storage" are on an actual microSD card inside the case: four screws and a gentle tug to get the card out, and you can image the "main drive." It's a 16G SD card with two partitions that occupy the whole card. Between them, they have 1.4G of used space. I imaged the whole card: # time dd if=/dev/sdi bs=4M of=./RG350.SD.2020-05-14.img conv=fsync status=progress This produced a roughly 16G image as expected. Then I compressed it: # time xz --threads=5 RG350.SD.2020-05-14.img This produced a 10G image. My assumption was that compression would see the empty partition space, presumably as a bunch of zeroes, and compress the crap out of it so that the final image would be the same size or smaller than the 1.4G of used space. I'm aware that the free space may not be zeroed out ... It's not encrypted, so that's not the issue. Is there a sane way to back this up that would produce a smaller image? I prefer to image the whole card ... and I like 'dd' because I'm familiar with it, although maybe I should move on ... Is somehow zeroing the empty space on the card a possibility? Suggestions welcomed ... I can live with the 10G backup if I have to, but would prefer a "better" solution if it's available. -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

5 11

Somewhat edited copy of EtherPad
by Christopher Browne 14 May '20

14 May '20

https://linuxdatabases.info/blog/?p=233 I turned the EtherPad of notes from last night's meeting into OrgMode, and then that into HTML, and just published it on my blog. That may be a more readable form, perhaps... -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

1 0