- Talk - lists.gtalug.org

sysadmining is full of stupid details
by D. Hugh Redelmeier 03 Nov '16

03 Nov '16

Context: I had a working system that was stable for a decade (mail server, DNS, VPN, etc.). But that was insane. Regular updates are needed but old systems fall off the map. So rebasing is needed. And the longer you put it off, the worse it gets So I'm redoing everything, based on CentOS 7. What a sea of shallow lore is needed. By "shallow", I mean that each thing is easy. What makes the problem hard is that there is so much of this crud to get right. Today's example: spamassassin's log file shows a lot of messages to do with not being able to access the DNS server via 127.0.0.1. Eg: Nov 03 12:12:09 redeye spamd[1455]: dns: sendto() to [::1]:53 failed: Connection refused, failing over to [127.0.0.1]:53 Nov 03 12:12:09 redeye spamd[1455]: dns: sendto() to [127.0.0.1]:53 failed: Connection refused, failing over to [::1]:53 Nov 03 12:12:09 redeye spamd[1455]: dns: bad dns reply: Connection refused Why doesn't it use the server specified by /etc/resolv.conf? Apparently the spamassassin folk think that you'd be better off not sharing a DNS server since a lot of RBL servers limit the amount of traffic that a particular client DNS server is allowed to generate. So they force you to run a local DNS server on the same machine as spamassassin. This happens to be a lose for my system. My spamassassin host was using a DNS shared by my LAN. This was not shared with any other spamassassin, so I had no problem that that limitation solved. But it created a problem. And the diagnostic wasn't rubbed in my face, and the diagnostic does not point at the problem unless you know more than you should have to. I, of course, tried to find where this is explained and failed. I did see suggestions for running a local DNS server, but the reason did not apply. Simple fix: yum install unbound systemctl start unbound systemctl enable unbound I hope that the default settings are reasonable. What a waste of my time. Irony: once I fixed this, spamassassin spams syslog with a half dozen lines per mail message processed. And this is just one of a million trivial impediments. Notice that that systemd (and the previous init systems) needed separate commands for starting a service now (start) and starting one on boot (enable). Surely the most common case is to do both. Firewalld's GUI has this same problem. It is more confusing because you click away at tick boxes, the ones you have changed are not distinguished. You cannot see the "now" settings at the same time as the "on boot" settings. Looking at the log (to discover the original problem) is arcane in itself. The systemd command to look at logs is journalctl(1) (I'm surprised it is in section 1). The flag -b limits the output to things since the most recent boot. To look at a particular service, use _SYSTEMD_UNIT=spamassassin.service. How awful. It can be shortened to "-u spamassassin", but that's hardly mentioned in the enormous journalctl(1).

2 1

Need help with DNS Nameservers
by David Mason 03 Nov '16

03 Nov '16

I have a domain for my family email (and other things) mason-rose.ca The DNS is on a machine that is currently unstable (meaning I can't physically access it for 2 weeks, I can't ssh in, and it can't be blown away). Foolishly, both of the required DNS namesevers point to the same machine. Postfix on that machine was forwarding all our family email to various gmail accounts, and this is currently not working... mail is being dropped on the floor... partner is *NOT*HAPPY* (nor am I, but...). The Postfix was essentially forwarding dmason(a)mason-rose.ca to my gmail, my-partner(a)mason-rose.ca to her gmail, and everything-else(a)mason-rose.ca to both of us. This wasn't working perfectly, as email from gmail routed through this would take a very long time, or fail (because gmail didn't trust it coming sort-of from gmail and back to gmail). I was trying to set up mailgun.com to forward my email, which requires DNS records to be set up while continuing to use the postfix setup. So I would like to set up alternate nameservers, to get my mail flowing again. But with the postfix server dead, I don't know if mailgun will do all I want. So, first and foremost, I need DNS Servers that can host the DNS records. Any insight/help appreciated. Thanks ../Dave

5 4

Re: [GTALUG] Python and/or Video help please
by Stephen 31 Oct '16

31 Oct '16

On 2016-10-31 08:53 AM, Russell Reiter wrote: > Top posting because this link is more helpful for correcting > unrecognized modes. Right now it appears your system is working from the > display modes supplied with the distribution. > > https://gist.github.com/debloper/2793261 Thank you! That link got me to Joy, but with a hiccup and a bit of a mystery. I quickly found the solution to the hiccup. http://stackoverflow.com/questions/851704/xrandr-errors-badname-named-color… The line: xrandr --newmode "1920x1080_60.00" 172.80 1920 2040 2248 2576 1080 1081 1084 1118 -HSync +Vsync uses the name "1920x1080_60.00", and xrandr no longer likes it. I just used the name "1080p". I am guessing that the "_" is the problem, but I did not test that. I was working from the command line and did the --addmode from there. My display went crazy, and I had to do a soft boot. The system came back in 1920x1080 (!) Joy. I did not have to use the --ouput step, and fix seems permanent. Cheers! -- Stephen

1 0

Re: [GTALUG] Python and/or Video help please
by Russell Reiter 31 Oct '16

31 Oct '16

On Oct 30, 2016 10:20 PM, "Stephen via talk" <talk(a)gtalug.org> wrote: > > A month ago I had problems, after an Ubuntu upgrade, getting my screen resolution above 1024x768. > > In this forum I was given a link to the script below to fix the problem and it did! Joy. > > Now I tried to run a video and the screen went back to unknown and set to 1024x768 :( > > I ran the script again, and I get the following result: > > stephen@avalon:~/scripts$ ./get-edid.py VGA-1 > Traceback (most recent call last): > File "./get-edid.py", line 65, in <module> Ok. Don't worry about the Python script. Does xrandr see the resolutions you want to use? Which output are you using? Which video player, perhaps that has changed the fb settings? For now post this output. xrandr --verbose Among other things it provides the current edid data, which is what the script worked with. <snip helper script> Russell Sent from mobile.

2 1

looking for a secondary mx service
by Dave Cramer 30 Oct '16

30 Oct '16

I have 4 domains that I need a secondary mx service for. Suggestions? Dave Cramer

3 3

Python and/or Video help please
by Stephen 30 Oct '16

30 Oct '16

A month ago I had problems, after an Ubuntu upgrade, getting my screen resolution above 1024x768. In this forum I was given a link to the script below to fix the problem and it did! Joy. Now I tried to run a video and the screen went back to unknown and set to 1024x768 :( I ran the script again, and I get the following result: stephen@avalon:~/scripts$ ./get-edid.py VGA-1 Traceback (most recent call last): File "./get-edid.py", line 65, in <module> edid_bin = get_edid_for_connector(connector_name) File "./get-edid.py", line 51, in get_edid_for_connector edid_str = slurp_edid_string(i) File "./get-edid.py", line 39, in slurp_edid_string assert re.match(r'\tEDID:', output_lines[line_num+1]) AssertionError I do not know anything about Python. Can someone help me figure this out? Many thanks Script #!/usr/bin/env python import binascii import re import subprocess import sys from os.path import basename XRANDR_BIN = 'xrandr' # re.RegexObject: expected format of xrandr's EDID ascii representation EDID_DATA_PATTERN = re.compile(r'^\t\t[0-9a-f]{32}$') def get_edid_for_connector(connector_name): """Finds the EDID for the given connector. Args: connector_name (str): Name of a connector, i.e. HDMI-0, DP-1 Returns: Binary EDID for the connector, or None if not found. Raises: OSError: Failed to run xrandr. """ # re.RegexObject: pattern for this connector's xrandr --props section connector_pattern = re.compile('^{} connected'.format(connector_name)) try: xrandr_output = subprocess.check_output([XRANDR_BIN, '--props']) except OSError as e: sys.stderr.write('Failed to run {}\n'.format(XRANDR_BIN)) raise e output_lines = xrandr_output.decode('ascii').split('\n') def slurp_edid_string(line_num): """Helper for getting the EDID from a line match in xrandr output.""" edid = '' assert re.match(r'\tEDID:', output_lines[line_num+1]) for i in range(line_num + 2, len(output_lines)): line = output_lines[i] if EDID_DATA_PATTERN.match(line): edid += line.strip() else: break return edid if len(edid) > 0 else None for i in range(len(output_lines)): connector_match = connector_pattern.match(output_lines[i]) if connector_match: edid_str = slurp_edid_string(i) if edid_str is None: return None return binascii.unhexlify(edid_str) return None if __name__ == '__main__': if len(sys.argv) != 2: sys.exit('Usage: {} <OUTPUT>'.format(basename(sys.argv[0]))) connector_name = sys.argv[1] edid_bin = get_edid_for_connector(connector_name) if edid_bin is None: sys.exit('No EDID found for output {}'.format(connector_name)) if sys.version_info >= (3, 0): sys.stdout.buffer.write(edid_bin) else: sys.stdout.write(edid_bin) sys.exit(0) -- Stephen

1 0

ssh/terminal on Android phone
by William Park 30 Oct '16

30 Oct '16

While searching for SSH client for my Nexus 5X, I discovered 'Termux'. I was expecting another SSH app. But, what I got was Linux terminal as the first screen. Interesting! I had to generate keys (ssh-keygen), and copy them to my computer (tar -cf - id_rsa id_rsa.pub | nc 1.2.3.4 1234). Which SSH client do you use on your phone? -- William

5 4

email client with autocorrect?
by Matt Price 28 Oct '16

28 Oct '16

Does anyone use an email client that has decent autocorrect? I am a terrible typist who makes many similar mistakes over and over. In thunderbird, correcting my errors takes about 30-50% of my total message composition time. I know there are reasons to hate autocorrect, but in my case it's a big timesaver. Any suggestions? Thank you! Matt

8 10

Hardware Password Wallet - Mooltipass Mini
by Scott Sullivan 27 Oct '16

27 Oct '16

So this a size reduced version of the Mooltipass device I helped fund nearly 2 years ago. https://www.kickstarter.com/projects/limpkin/mooltipass-mini-your-passwords… I'll let the campaign video sell you on it's virtues. The advantage I find for me is that it's usable universally with any device. When I updated my google credentials, one USB-OTG cable, and I had the new passwords entered into my phone. If I need to store BIOS passwords, I can enter them with out having to read them off. Really like it for password I only use once every few years. The important habits with a device like this, is to back up encrypted credentials database, make spare access cards with different pins and have a spare mooltiplass to restore too should you loose your primary one. If folks have any questions about the device, I'd be happy to answer from my experiences. -- Scott Sullivan

2 2

little PCs for internet gateways
by D. Hugh Redelmeier 26 Oct '16

26 Oct '16

By gateway, I mean router/firewall/whatever box that sits between your LAN and the internet. Reasonable choices: - ISP-provided / sanctioned device (combo wireless router and modem) - ISP modem + user provided wireless router + possibly running custom firmware like CeroWRT or OpenWRT - ISP modem + PC acting as router + lots of possible software (pfsense, debian, whatever) For a variety of reasons I've always used PCs. But which PCs are best for this? Here's an interesting pair of articles on using little PCs as gateways: <http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-ro…> <http://arstechnica.com/gadgets/2016/09/the-router-rumble-ars-diy-build-face…> My previous gateways were SFF business PCs from a previous millenium. Built like tanks. Reliable. Running full Red Hat Linux, so quite familiar, versatile, and powerful. But they eat more electricity than they should. And they are not silent. My next generation, years in the making, is here. I've chosen to use two different Zotac Zbox tiny PCs. - the CI321 is a fanless box with two ethernet ports (two is the minimum for a pleasant router). - the RI323 has a fan and two ethernet ports. It is more fully-featured and I got it cheap. It even has two 2.5" drive bays. Both these us low power Haswell processors: The Celeron 2961Y. This means no AES-NI instructions :-( Both use Realtek chips for the ethernet ports. I understand that they have a mediocre record. There are a lot of nice-looking candidate PCs that you can order from China. Some with 4 ethernet ports. Unfortunately, the affordable one all use Baytrail or newer Atom cores (eg. J1900). This is what the newer Ars article recommends. But I would not use that processor because Intel has left a bug in the power management / clocking code of the Linux kernel for a couple of years. Who wants an unreliable gateway? <https://bugzilla.kernel.org/show_bug.cgi?id=109051> I'm prompted to write this by a current sale and rebate on the Zboxes (rebate offer ends with this month). <http://www.ncix.com/detail/zotac-zbox-ri323-barebone-mini-38-130690.htm> <http://www.directcanada.com/products/?sku=26671130690&vpn=ZBOX-RI323-U&manu…> <http://www.ncix.com/products/?sku=DH8888119815> <http://www.mirhelp.com/wp-content/uploads/2016/09/Oct-Mail-In-Rebate-Form-F…> Summary: - about $170 - $20 rebate for the RI323 - about $185 - $15 rebate for the CI321 Each needs a disk and RAM added.

5 5