August 2020 - Talk - lists.gtalug.org

war story: power failure makes CentOS system unbootable
by D. Hugh Redelmeier 30 Sep '22

30 Sep '22

tl;dr / spoiler: change fstab so that /boot/efi is not automatically mounted. See the recommendation at the end of this message. My gateway computer is a little PC running CentOS. It does not come back after a power failure. The reason (as best I can tell) is interesting and I think that I have a fix. My system is UEFI. It boots from a UEFI system partition, known as /boot/efi to Linux. If this gets corrupted, it won't boot. It is a VFAT partition. On my gateway (a Zotac Zbox RI321, a cute little box with two ethernet ports), the UEFI firmware apparently won't boot if the dirty bit is set in the system partition. CentOS normally runs with /boot/efi mounted. So when the system isn't shut down cleanly, the dirty bit will be on. Consequence: the system is not going to boot after a power failure. Odd observation 1: if I put a live Fedora 25 USB stick in the system and try to boot in this otherwise-unbootable state, CentOS boots from the main disk. So this really looks like a firmware bug/quirk. Odd observation 2: fsck doesn't seem to automatically fix the system partition. Once CentOS 7 booted, I dismounted /boot/efi and did an fsck on it. $ sudo fsck /dev/sda1 fsck from util-linux 2.23.2 fsck.fat 3.0.20 (12 Jun 2013) 0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. 1) Remove dirty bit 2) No action ? 1 Leaving filesystem unchanged. /dev/sda1: 16 files, 2420/51145 clusters Googling got me to <https://www.centos.org/forums/viewtopic.php?t=50917> In particular, this advice seemed quite good: ==== recommendation ==== Two other changes I recommend for UEFI systems, to each OS's /etc/fstab. - For the /boot/efi mountpoint, add the mount options x-systemd.automount,noauto - Change fs_passno (last column) to a 1 or 2; the canonical fstab instructions suggest 2, but systemd treats 1 and 2 as the same. The first change means the EFI System partition will not be automatically read-write mounted at boot time; it's a bad idea this is the default because it puts the ESP at risk especially if ther are crashes, FAT has no journal and will therefore always be marked dirty in such a case; no other UEFI OS mounts the ESP by default. Second, if anything tries to access /boot/efi (read or write), systemd will automatically mount it, and because of the fs_passno 1 or 2, it will fsck it first and that fixes and clears the dirty bit in case it's set. Right now without these changes, it's just a matter of having the right number and bad timing of crashes to render the EFI System partition corrupt.

3 9

YAD-Zenity-GTK on Pi - assistance needed
by Giles Orr 30 Jan '21

30 Jan '21

YAD ("Yet Another Dialog") is a fork of Zenity - essentially a way to display GTK+ dialogues from shell scripts. I've chosen YAD because it supports a couple things Zenity doesn't have, namely form buttons and tabs. I've created an ugly but functional interface that's meant to go on a 3.5" touch screen on a Raspberry Pi. But here's the problem: by the time it gets on a screen that small, the buttons are too small to reliably poke with a finger. So I want to increase the font size. All that was needed to fix that on my Fedora desktop was: # file: ~/.configs/gtk-3.0/settings.ini [Settings] gtk-font-name = Sans 32 And voila, 'yad' appears with a super-huge font. However - this behaviour isn't replicated on the Pi. It's an old(ish) Debian stretch install on an old Pi B (not Pi 2 B, just "Pi B"). I'm pretty sure that ~/.configs/gtk-3.0/settings.ini is the right file, because when I mis-configured it, 'yad' complained loudly. But it ignores the font setting that works fine on another host. I tried 'yad --font' which throws up what amounts to a GTK font selection dialogue, and "Sans 32" is a valid font on the Pi. Anyone got any ideas on this? -- Giles https://www.gilesorr.com/ gilesorr(a)gmail.com

4 6

security threats of Open Source
by D. Hugh Redelmeier 25 Nov '20

25 Nov '20

<https://www.zdnet.com/article/microsoft-spots-malicious-npm-package-stealin…> This article list six cases of malware contributed to npm (the repo for sharing node.js and JavaScript source). How many undetected cases exist? I've alway pretended that Linux distros vet their code. I'm not sure how true that is. Probably the greatest protection is the time delay between contribution and distribution. I wonder what can be done about this problem. I've said so at our meetings a few times too. Of course the problem is worse with closed source: it is impossible to audit the source. But closed source might have fewer contributors and more supervision. Of course much closed soure is built on top of open source and thuse all its weakness

7 12

Generic SSH question.
by Alvin Starr 31 Aug '20

31 Aug '20

Does anybody know of a software package or service that does for SSH the kind of thing that teamviewer does? I run into linux systems that are behind firewalls and trying to bounce through some windows box using teamviewer or other screen sharing app is getting real old. -- Alvin Starr || land: (647)478-6285 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

4 5

for multi-hop ssh/scp: option "ProxyJump"
by D. Hugh Redelmeier 31 Aug '20

31 Aug '20

I'm away from home, regularly accessing my computers at home. Easy: ssh into a gateway machine and ssh from there into the internal machine of my choice. Nested ssh sessions. It gets a little more annoying when I want to transfer a file. The new-to-me ssh/scp option "ProxyJump" handles this conveniently. Consider the example of transferring a file "f" from machine "home" through machine "gw" to machine "away", all done from an xterm on "away". Note: because "away" is behind NAT, "gw" cannot scp to it. Note: -A enables ssh-agent to avoid some manual authentication Note: things become more complicated if f has slashes. [away] $ ssh -A gw [gw] $ scp -p home:f . [gw] $ exit [away] $ scp -p gw:f . [away] $ ssh -A gw [gw] $ rm f [gw] $ exit This can be simplified because the ssh command allows shell commands as arguments. That's not a habit I've developed. [away] $ ssh -A gw scp -p home:f . [away] $ scp -p gw:f . [away] $ ssh -A gw rm f The ProxyJump option makes this a lot simpler: [away] $ scp -p -o 'ProxyJump gw' home:f . I have no need for more than one intermediate hop so I haven't figured out how that would work.

6 7

Dice Keys
by Christopher Browne 30 Aug '20

30 Aug '20

Here's a cool thing I saw recently... https://www.schneier.com/blog/archives/2020/08/dicekeys.html The intention of this parallels the various Bitcoin "Solid Steel Passphrase Wallet" items that were popular a year or so ago (See https://www.toughgadget.com/bitcoin-crypto-metal-recovery-seed-wallets/, https://www.buybitcoinworldwide.com/wallets/steel/ ) It's a case for a set of 25 dice that looks like a Boggle game set; it will generate and "record" what ought to be a Sooper Seekrut key as would be used for things like: - master key for password manager - U2F key for 2 Factor Authentication - Secret key for cryptocurrency wallet By being a set of dice with a nice plastic box to hold them securely, this is not vulnerable to various threats common to electronic devices: - EMP (for those highly worried about nuclear devices) - Water damage Of course, if all your disk drives get toasted, there might not be any data left to decrypt or systems to connect to. And plastic will melt away or burn when exposed to fire... But it's pretty cool, I'm tempted to grab a set. There's a web app: https://dicekeys.app/ It appears that this application, embedded in a single JavaScript file, runs locally, inside your browser, so that usual criticisms about it being a giant security vulnerability of sharing your key with their web site seems like it mightn't apply. How to confirm in an authoritative way that nothing is *actually* shared seems like the fun security question. -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

4 3

[GTALUG-Announce] GTALUG Membership In These COVID-19 Times
by Christopher Browne 28 Aug '20

28 Aug '20

In most years, membership has been handled via comparatively informal in-person processes, and those that wish to support GTALUG via membership would (broadly) follow the following steps: - Grab a membership form (that Chris passed out) - Try to pass Chris a $20 bill, whereupon Chris would say "take it back, and give it to me once you fill in the form" - Fill in the form, and hand it to Chris along with payment - Chris returns a few minutes later with a membership card As GTALUG is meeting virtually, these days, this process cannot occur as described. For those wishing to support GTALUG via membership, two routes are suggested: - The Cheque is In The Mail :: Send a payment via Canada Post. - Interac eTransfer :: Send funds from your bank to ours To ensure that membership has been addressed for voting at the 2020 AGM on October 13th, it is imperative to handle this earlier than that, as mail can take several days for delivery. Alas, either way, this imposes more bureaucracy and some more cost than we have been accustomed to. - Payment via check using Canada Post :: In this case, please send a cheque, made out to "GTALUG", in the amount of $20, along with the identification information indicated below, and please send to the following address: GTALUG 914-10 Carabob Court Toronto, ON M1T 3N5 - Interac eTransfer :: In this case, three pieces of information are critical, and must be shared both with your bank as well as with GTALUG. - Recipient :: The recipient email address is membership(a)gtalug.org - Security Question :: The content of this is not too important; "Random Value" or "Sooper Sekrut Data" are fine values. - Security Answer :: It is suggested that a random value be used. For instance, 215db45eb7f54e1e5907de3b50ac50ee is a value I got from passing 1K of data from /dev/random through md5sum, and that is a decent mechanism to get a relatively unguessable password. (Of course, since many people have seen that specific value, 215db45eb7f54e1e5907de3b50ac50ee, it would not be a good choice.) This security answer also needs to be emailed to the membership(a)gtalug.org address in order for us to receive the payment. - Common information :: Whichever of the above mechanisms is used for payment, please email the following membership information to membership(a)gtalug.org. Note that by longstanding policy, we do not pass your information on to outside organizations. - Name :: Your preferred name - Email :: Your preferred email address (if using Interac eTransfer, it's best to use the same address, so we know which email address to associate each security answer with) - Address :: If you are comfortable providing such - Security Answer :: If eTransfer is used, we need the Security Answer in order to actually receive funds *** Generating a random value, the Linux way Here is a script that repeatedly takes 1K of random data from /dev/random, and turns it into an md5 checksum to ensure that the value is human readable and not too long. #+BEGIN_EXAMPLE for i in 1 2 3 4 5; do dd if=/dev/random bs=1k count=2 status=none | md5sum; done 215db45eb7f54e1e5907de3b50ac50ee - 4f8f0e3a2944c857ebc3a7a776659134 - 1a52010a29ef3b2446d532ba389f65cb - 84e6b072e2661fc88b3a7b1ed1ce5873 - ef3f10a8b634760691e2ae53a0952707 - #+END_EXAMPLE --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

[GTALUG-Announce] AGM and Call for Candidates
by Christopher Browne 28 Aug '20

28 Aug '20

Hear ye! Hear ye! This is a Call for Candidates for the GTALUG Board. October 13th is GTALUG's Annual General Meeting, our tiny piece of "political pageantry." There are two seats opening, for 2 year terms (2020-2022). Please consider running for the board, and keep in mind the following. There are two formal qualifications that candidates need to satisfy: - Must be a GTALUG member in good standing - Must not have any undischarged bankruptcy It is also important to be able to be available most months for Board/Operations meetings where we plan GTALUG meetings and activities. These meetings normally take place on the Monday evening following the regular Tuesday meeting. These days, this takes place on-line, using Jitsi. This is not an extraordinarily huge burden, but it does mean that there are 48 meetings (counting both "second Tuesday" and "the following Monday") where we hope to see you, and we hope to see you most of the time. Board members are involved in and support the following activities. - Finding speakers for our monthly presentations - Operating our internet infrastructure (website and mailing lists) - Organizing and running our annual Linux in the Park picnic (in less pandemic-stricken times) - Our involvement as a member organization of ICANN If you are interested, we'd appreciate it very much if you can submit your intention to run to the email address: board at gtalug.org The incumbents whose previous terms are expiring are: - Chris Browne - Alex Volkov Potential Candidates are welcome to announce their intention all the way up to the day of the AGM itself. --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

top posting [was: Re: Blockchain, the solution to nothing]
by D. Hugh Redelmeier 27 Aug '20

27 Aug '20

| From: ac via talk <talk(a)gtalug.org> | I practiced with my first top post in 2006, before it became | fashionable :) It has been gauche for a lot longer than that :-) It can make sense in business correspondence where a precise record of what you are responding to is important. This was not such a case. It can make sense when you are dealing with folks who only know how to do mail on smartphones. This was not such a case. It can make sense when your time is more valuable than the readers' time. This was not such a case. It is almost never the case on a mailing list. | From: ac via talk <talk(a)gtalug.org> | It was one fine spring day, at least over 180? (it may be 280 or even | more) something full moons ago that i realized that Mutt simply sucks at | threading, so I disabled it. Since then, I also thought that some/ALL | Linux console users probably also battle and struggle with threads (and | the worth/value which the unwashed places in threads) I congratulate | you on the fine prowess of your "mail reader" but it is probably not | console based? (or maybe it could be? is it Pine? not looked at Pine | in decades...hmm, maybe?) | | As you said "almost all others" it certainly is not any? console users, | unless Pine or something else has turned me into an ignorant dino... I don't understand this. But I'll respond to a couple of things that I think I've gleaned from it. I use ALPINE (PINE is dead). It can do threading. It works on a terminal. What am I missing? I actually use procmail to sort GTALUG mail into a "folder". It turns out that all the messages in this thread are lined up appropriately by being sorted in arrival order. I don't often use thread-order. I use it often enough that I don't have to look it up. I guess I might use it more if I didn't demultiplex my incoming mail. How do you handle/avoid the deluge of email? I ask in all humility since it is a burden as well as a blessing. If Mutt is broken, fix it. It's open source. Or, more likely, you'll come to understand why it does what it does. Anecdote: The second assembly language I learned was PDP-8 PAL. I was offended by the opcode mnemonics chosen by DEC. For example, the only add instruction was "TAD" (for Two's complement ADd). Would ADD not be better? But by the time I learned enough to attempt the task, I had started to think of the operation as TAD. This is an example of starting out intending to change a tool and ending up changing me. Sub-anecdote: The PDP-8 was a single-accumulator machine. And there was no instruction to load a word from memory into the accumulator! Instead you arranged for the accumulator to be 0 and than "TAD memory" to add the content of the memory word that 0, leaving the sum in the accumulator. So TAD was a heavily used instruction. There were only eight opcodes, but two of them had modifier bits. The PDP-8 machine language was incredibly easy to learn even if it wasn't very powerful. Much simpler than any micro people use now.

1 0

Re: [GTALUG] Blockchain, the solution to nothing
by Scott Allen 27 Aug '20

27 Aug '20

On Thu, 27 Aug 2020 at 09:38, ac via talk <talk(a)gtalug.org> wrote: > As you said "almost all others" it certainly is not any? console users, So you're doing this for the benefit of a small percentage of readers that use a console based mail reader without threading or subject grouping capability? Also, there are the archives available for viewing by thread, or if you've deleted a message you wish to review. https://gtalug.org/pipermail/talk/ It works fine from a console using lynx. Anyway, you can reply if you wish, but this will be my last. -- Scott

2 1