- Talk - lists.gtalug.org

A few notes on SystemD
by Christopher Browne 18 Feb '16

18 Feb '16

I had prepped a few notes at the last meeting with a view to saying a wee bit about SystemD; apparently my name never got picked by the 1D20. I have been collecting notes for a couple of months, particularly with a view to the "Stupid SystemD tricks" part. There's a lot there; perhaps this "memory dump" will help others recognize things too. The other pointed interesting bit is in recognizing the differences between "political parties" on the merits/demerits. There seem to be sizable sets of people that have stopped thinking/listening, which is pretty unfortunate, and in sad keeping with shapes of political movements elsewhere. * SystemD debates [[http://uselessd.darknedgy.net/ProSystemdAntiSystemd/][Why Pro SystemD and Anti SystemD people cannot get along]] - It's actually mostly politics, just not of one of the parties that they recognize - Proponents tend to have afiliation with "modern desktop" - Want more interoperability - Sure, somewhat more "Windows like" - Seek reducing interface complexity but not implementation complexity - Computers as appliances rather than tools - Detractors often come from niche distributions - Less interested in desktop advances - Care about malleability more than user friendliness - Computers as tools - The fight is more about desktop vs minimalism - A moderate annoyance: systemd includes *journald*, which does logging - Why not use *syslog*??? - Because you /cannot/ use *syslog* to log things until *syslog* is running - And *syslog* is not running until a whole bunch of /other/ services get started, by *systemd* - Ergo, *systemd* needs a logging system /that is not syslog/ - It may be desirable to /forward/ responsibility for logging to *syslog*, /once it is running/, and *systemd* supports that * SystemD concepts :systemd: ** Units - objects that systemd can manage - standardized representation of system resources - like services, jobs in init systems - can use units to abstract services, network resources, filesystem mounts, resource pools - Various activation methods - socket based :: start unit upon accessing a socket, like xinetd - bus based :: start unit when DBus request is submitted - path based :: start unit when inotify indicates a path is available - device based :: start unit when hardware is available based on udev events - With dependency mapping/ordering - Various types - ~.service~ :: indicates how to manage a service/application, including - how to start/stop the service - when service should be automatically started - dependency and ordering information for related software - ~.socket~ :: indicates network/IPC socket or FIFO that is to be used for socket-based activation - points to ~.service~ file - ~.device~ :: indicates a device needs systemd management - often needed for ordering, mounting, accessing the device - ~.mount~ :: defines a mountpoint to be managed by systemd - named after mount path with slashes transformed to dashes - ~/etc/fstab~ entries automatically get such units (how???) - ~.automount~ :: indicates mount points to be automatically mounted - refers to a ~.mount~ file - ~.swap~ :: indicates swap space - ~.target~ :: target unit provides synchronization points for other units when changing state - seems to be a way of indicating dependencies a bit abstractly - ~.path~ :: indicates cases where, when a path reaches desired state, the service will be started - uses inotify to watch for changes - e.g. - do not start up /postgresql-database/ until the filesystem with data has been mounted - ~.timer~ :: indicates a timer for systemd to manage indicating when the service unit will be started - can be used to do things like cron jobs - ~.snapshot~ :: - ~.slice~ :: associates with Linux Control Group nodes to restrict access to resources to processes in the slice - so, security-ish??? - samples on Debian say NOTHING about this, so perhaps they're no-ops? - ~.scope~ :: help (how?) to manage system processes created externally (from systemd?) - Default unit files in ~/lib/systemd/system~ - Customize into ~/etc/systemd/system~ *** Directives - unit section :: defines metadata - Description :: what is this? - Documentation :: reference - Requires :: units required before this one (failure to have them indicate this unit fails) - Wants :: units wanted (less strict) - BindsTo :: this unit should terminate when another one terminates - Before :: units specified must not start until after the present one is started, but this is not indicating dependency - After :: this unit must not start until the specified units are started - Conflicts :: mutual exclusions of units - Condition :: things to test prior to starting the unit - failure leads to graceful skipping of the unit - PathExists - Capability - PathIsReadWrite - DirectoryNotEmpty - FileIsExecutible - KernelCommandLine - NeedsUpdate - PathIsDirectory - PathIsMountPoint - PathIsSymbolicLink - Virtualization - Assert :: failure of conditions lead to reporting failure of the unit - Various other sections specialized to various sorts of units - Transaction manager - Jobs - Job queueing - Tasks - What is journald? ** Translating former understandings to SystemD - Configuration that you mess with tends to be in ~/etc/systemd/system~ - Finding all services #+BEGIN_EXAMPLE # systemctl list-units #+END_EXAMPLE - This lists loaded units, and does so if you omit ~list-units~ - ~systemctl list-units --all~ :: list non-loaded units - ~systemctl list-unit-files~ :: list unit files - ~systemctl list-dependencies~ :: list the hierarchy of dependencies - and other things can be listed - The common start/stop/restart targets work - ~systemctl start boa~ - ~systemctl stop boa~ - ~systemctl reload boa~ - ~systemctl force-reload boa~ - More operations that should be obvious-ish - ~systemctl cat boa~ :: list the unit files - ~systemctl disable boa~ :: disable boa - ~systemctl reenable boa~ :: reenable boa - ~systemctl enable boa~ :: enable boa - ~systemctl edit boa~ :: edit boa units (copying to ~/etc/systemd/system~ if needed) - ~systemctl show boa~ :: show environment values and such * SystemD Bibliography :systemd: - [[https://n0where.net/understanding-systemd/][Understanding SystemD]] * Stupid SystemD Tricks ** Emacs as a service - Set up a unit file #+BEGIN_EXAMPLE [Unit] Description=Emacs: the extensible, self-documenting text editor [Service] Type=forking ExecStart=/usr/bin/emacs --daemon ExecStop=/usr/bin/emacsclient --eval "(kill-emacs)" Environment=SSH_AUTH_SOCK=%t/keyring/ssh Restart=always [Install] WantedBy=default.target #+END_EXAMPLE ** Use SystemD rather than crontab? It seems as though the job information needs to be integrated into the "central" systemD configuration, so this is more or less a contraindicated thing to do. There are examples in documentation of running system cleanup tasks as SystemD-controlled jobs, so that is fairly reasonable to do. But I'd kind of like it if I could use SystemD to do things like... - starting up my favorite file downloader daemon - start up user space daemons running /at user level/ - run user-oriented scheduled tasks And this seems totally unnatural to do via SystemD. -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

1 0

A few notes on SystemD
by Christopher Browne 18 Feb '16

18 Feb '16

I had prepped a few notes at the last meeting with a view to saying a wee bit about SystemD; apparently my name never got picked by the 1D20. I have been collecting notes for a couple of months, particularly with a view to the "Stupid SystemD tricks" part. There's a lot there; perhaps this "memory dump" will help others recognize things too. The other pointed interesting bit is in recognizing the differences between "political parties" on the merits/demerits. There seem to be sizable sets of people that have stopped thinking/listening, which is pretty unfortunate, and in sad keeping with shapes of political movements elsewhere. * SystemD debates [[http://uselessd.darknedgy.net/ProSystemdAntiSystemd/][Why Pro SystemD and Anti SystemD people cannot get along]] - It's actually mostly politics, just not of one of the parties that they recognize - Proponents tend to have afiliation with "modern desktop" - Want more interoperability - Sure, somewhat more "Windows like" - Seek reducing interface complexity but not implementation complexity - Computers as appliances rather than tools - Detractors often come from niche distributions - Less interested in desktop advances - Care about malleability more than user friendliness - Computers as tools - The fight is more about desktop vs minimalism - A moderate annoyance: systemd includes *journald*, which does logging - Why not use *syslog*??? - Because you /cannot/ use *syslog* to log things until *syslog* is running - And *syslog* is not running until a whole bunch of /other/ services get started, by *systemd* - Ergo, *systemd* needs a logging system /that is not syslog/ - It may be desirable to /forward/ responsibility for logging to *syslog*, /once it is running/, and *systemd* supports that * SystemD concepts :systemd: ** Units - objects that systemd can manage - standardized representation of system resources - like services, jobs in init systems - can use units to abstract services, network resources, filesystem mounts, resource pools - Various activation methods - socket based :: start unit upon accessing a socket, like xinetd - bus based :: start unit when DBus request is submitted - path based :: start unit when inotify indicates a path is available - device based :: start unit when hardware is available based on udev events - With dependency mapping/ordering - Various types - ~.service~ :: indicates how to manage a service/application, including - how to start/stop the service - when service should be automatically started - dependency and ordering information for related software - ~.socket~ :: indicates network/IPC socket or FIFO that is to be used for socket-based activation - points to ~.service~ file - ~.device~ :: indicates a device needs systemd management - often needed for ordering, mounting, accessing the device - ~.mount~ :: defines a mountpoint to be managed by systemd - named after mount path with slashes transformed to dashes - ~/etc/fstab~ entries automatically get such units (how???) - ~.automount~ :: indicates mount points to be automatically mounted - refers to a ~.mount~ file - ~.swap~ :: indicates swap space - ~.target~ :: target unit provides synchronization points for other units when changing state - seems to be a way of indicating dependencies a bit abstractly - ~.path~ :: indicates cases where, when a path reaches desired state, the service will be started - uses inotify to watch for changes - e.g. - do not start up /postgresql-database/ until the filesystem with data has been mounted - ~.timer~ :: indicates a timer for systemd to manage indicating when the service unit will be started - can be used to do things like cron jobs - ~.snapshot~ :: - ~.slice~ :: associates with Linux Control Group nodes to restrict access to resources to processes in the slice - so, security-ish??? - samples on Debian say NOTHING about this, so perhaps they're no-ops? - ~.scope~ :: help (how?) to manage system processes created externally (from systemd?) - Default unit files in ~/lib/systemd/system~ - Customize into ~/etc/systemd/system~ *** Directives - unit section :: defines metadata - Description :: what is this? - Documentation :: reference - Requires :: units required before this one (failure to have them indicate this unit fails) - Wants :: units wanted (less strict) - BindsTo :: this unit should terminate when another one terminates - Before :: units specified must not start until after the present one is started, but this is not indicating dependency - After :: this unit must not start until the specified units are started - Conflicts :: mutual exclusions of units - Condition :: things to test prior to starting the unit - failure leads to graceful skipping of the unit - PathExists - Capability - PathIsReadWrite - DirectoryNotEmpty - FileIsExecutible - KernelCommandLine - NeedsUpdate - PathIsDirectory - PathIsMountPoint - PathIsSymbolicLink - Virtualization - Assert :: failure of conditions lead to reporting failure of the unit - Various other sections specialized to various sorts of units - Transaction manager - Jobs - Job queueing - Tasks - What is journald? ** Translating former understandings to SystemD - Configuration that you mess with tends to be in ~/etc/systemd/system~ - Finding all services #+BEGIN_EXAMPLE # systemctl list-units #+END_EXAMPLE - This lists loaded units, and does so if you omit ~list-units~ - ~systemctl list-units --all~ :: list non-loaded units - ~systemctl list-unit-files~ :: list unit files - ~systemctl list-dependencies~ :: list the hierarchy of dependencies - and other things can be listed - The common start/stop/restart targets work - ~systemctl start boa~ - ~systemctl stop boa~ - ~systemctl reload boa~ - ~systemctl force-reload boa~ - More operations that should be obvious-ish - ~systemctl cat boa~ :: list the unit files - ~systemctl disable boa~ :: disable boa - ~systemctl reenable boa~ :: reenable boa - ~systemctl enable boa~ :: enable boa - ~systemctl edit boa~ :: edit boa units (copying to ~/etc/systemd/system~ if needed) - ~systemctl show boa~ :: show environment values and such * SystemD Bibliography :systemd: - [[https://n0where.net/understanding-systemd/][Understanding SystemD]] * Stupid SystemD Tricks ** Emacs as a service - Set up a unit file #+BEGIN_EXAMPLE [Unit] Description=Emacs: the extensible, self-documenting text editor [Service] Type=forking ExecStart=/usr/bin/emacs --daemon ExecStop=/usr/bin/emacsclient --eval "(kill-emacs)" Environment=SSH_AUTH_SOCK=%t/keyring/ssh Restart=always [Install] WantedBy=default.target #+END_EXAMPLE ** Use SystemD rather than crontab? It seems as though the job information needs to be integrated into the "central" systemD configuration, so this is more or less a contraindicated thing to do. There are examples in documentation of running system cleanup tasks as SystemD-controlled jobs, so that is fairly reasonable to do. But I'd kind of like it if I could use SystemD to do things like... - starting up my favorite file downloader daemon - start up user space daemons running /at user level/ - run user-oriented scheduled tasks And this seems totally unnatural to do via SystemD. -- When confronted by a difficult problem, solve it by reducing it to the question, "How would the Lone Ranger handle this?"

1 0

Windows support
by Alex Volkov 18 Feb '16

18 Feb '16

Hello everyone, Do you know any students/hobbyists doing desktop support and/or making house calls as a side business. I know a few people who need help, but I just don't have time. If anyone could give me referral that would be awesome. This is all for Windows, unfortunately. Thanks, Alex.

1 0

Anyone want to work for a nerdly non-profit? Open Media is hiring
by David Collier-Brown 17 Feb '16

17 Feb '16

-------- Forwarded Message -------- Subject: Want to be an Internet hero? Come work with us! Date: Wed, 17 Feb 2016 17:05:27 -0500 (EST) From: Soledad Vega <contact(a)openmedia.org> Reply-To: contact(a)openmedia.org To: davecb(a)spamcop.net OpenMedia Hi David, Today I’m writing to offer you an exciting opportunity. At OpenMedia, we strive to provide an increasingly powerful platform for action, collaboration, and information about digital rights issues. And as we fight against renewed threats to the open Internet, we find ourselves in need of some essential new team members to play a crucial role in our pro-Internet movement’s mission. We’re talking about some very interesting opportunities to join our team and help us engage the global Internet community in key decisions that affect our digital future. As a valued member of our Digital Action Team, *we wanted you to know about the exciting available positions here at OpenMedia*. Who knows, maybe you know of someone who’d be perfect for one of these roles, or maybe you can put your own skills to work and join the OpenMedia team! Firstly, we wanted to let you know we’re on the hunt for a new Executive Director. (You can read more about the organizational changes in this blog by our founder Steve Anderson <http://qb.salsalabs.com/dia/track.jsp?v=2&c=wVx3S2rf9mE7Q4RgvscsrxbYFumcR%2…>). We’re looking for someone who can take our work for the open Internet to the next level, while prioritizing our participatory values and culture. Do you have what it takes? Check out this position description <http://qb.salsalabs.com/dia/track.jsp?v=2&c=WL3X4C0bl1FbOdphHr7t1BbYFumcR%2…>, and let us know! We’re also hiring: Digital Rights Campaign Coordinator <http://qb.salsalabs.com/dia/track.jsp?v=2&c=dAlQmIVlQWZrhGc4pn3gEhbYFumcR%2…>(F/T) Help us fight big telecom by building active campaigns to engage the public on issues like Net Neutrality and a more open, affordable Internet! Digital Analyst <http://qb.salsalabs.com/dia/track.jsp?v=2&c=%2Br2%2BqwUJz6ZplF0J6jAOWBbYFum…>(F/T, Vancouver) We want to be more data-driven! We need a proud data nerd to design, implement and evaluate our digital strategies that turn web metrics into actionable insights. Director of Fund Development <http://qb.salsalabs.com/dia/track.jsp?v=2&c=a26T95vV%2BODmognuLZdRXRbYFumcR…>(F/T or 0.8) Help us persuade donors and prospects their investment will make a huge difference in the way we communicate, share, and collaborate in the future. Drupal Developer <http://qb.salsalabs.com/dia/track.jsp?v=2&c=keCGBqUcXIY80BSuiSCusRbYFumcR%2…> (F/T) Which web developer wouldn’t want to work in one of the biggest organizations fighting for an open Internet? Be the CSS to our HTML! Our team is growing! And *we need your help to find the right candidates to join our dynamic group of fun humans*. If you think you’re a fit, apply now! If not, please help us spread the word by sharing on Facebook <http://qb.salsalabs.com/dia/track.jsp?v=2&c=DV4M%2BM1xjZG3jWtgBn0vrRbYFumcR…> and Twitter <http://qb.salsalabs.com/dia/track.jsp?v=2&c=GiiCWNmz4D49%2BcwcN%2BGcShbYFum…>. Our offices are located in Vancouver, but we’re flexible. And if you haven’t found what you’re looking for, you can check back later for more job openings at openmedia.org/en/work <http://qb.salsalabs.com/dia/track.jsp?v=2&c=7NF2QATnJPQyY%2Fxy1eqzNhbYFumcR…>. Hope to hear from you soon. Onwards! Soledad, on behalf of your OpenMedia team. OpenMedia <http://qb.salsalabs.com/dia/track.jsp?v=2&c=DPY%2FBoCIbWGpDOTQ7DLHHhbYFumcR…> We are an award-winning network of people and organizations working to safeguard the possibilities of the open Internet. We work toward informed and participatory digital policy. You can follow us on *Twitter* <http://qb.salsalabs.com/dia/track.jsp?v=2&c=%2BtLsy0D%2FpS4i9a4HXVIsaRbYFum…>, and like us on *Facebook* <http://qb.salsalabs.com/dia/track.jsp?v=2&c=FMCyt9TTnM6U3HOo1YQmzhbYFumcR%2…>. You have received this message, because you have subscribed to OpenMedia's list with the email address davecb(a)spamcop.net. You can manage your email preferences. <http://qb.salsalabs.com/dia/track.jsp?v=2&c=MSEZKH9gKuuGt9l0jCkHFhbYFumcR%2…> If you no longer wish to receive our emails, click here <http://qb.salsalabs.com/dia/track.jsp?v=2&c=Lf9OEX6XxaxCU3c83B3kpBbYFumcR%2…> to unsubscribe.

1 0

webkit security updates vs linux
by D. Hugh Redelmeier 16 Feb '16

16 Feb '16

I found this article full of interesting information. <https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/> (I found it via a link on lwn.net, a great resource.)

1 0

Odroid C2: interesting 64-bit ARM board
by D. Hugh Redelmeier 16 Feb '16

16 Feb '16

<http://forum.odroid.com/viewtopic.php?f=135&t=18683> Kind of Raspberry Pi format. Should be out next month. On paper: US$40. Reality, in Canada, $75, without shipping, power supply, or case. <http://www.ca.diigiit.com/odroid-c2> - will run Ubuntu (but how much of it is proprietary?) - uses Amlogic S905 2GHz Quad Core A53 Mali 450 GPU - 2G RAM - HDMI 2.0! - gigabit ethernet! - 4 x USB2.0 host, 1 USB 2.0 OTG - as well as UHS-1 microSD interface, eMMC socket (The eMMC is quite a bit faster than SD but cards are more expensive) (Perhaps UHS-1 interface supports cards larger than 32G) Looks much more interesting to me than the LeMaker Hikey. But does the C2 have UEFI firmware?

2 1

IPS on the Raspberry Pi
by mike 15 Feb '16

15 Feb '16

Hello Everyone, For those who were interested in the links and slides on the Raspberry Pi IPS talk, I've posted them here: http://www.palumbus.com/publish/IPS-Pi Apologies for rushing through a lot, It's the tip of the iceberg on IPS, and I mostly wanted to show what I was doing with my device and ways in which it can be a useful application of the Pi. A note about the question on encryption. I answered that the encrypted payloads can't be inspected without proxy solutions and private trusts.... which is not entirely true, one of the slides even goes there, but I forgot to get into it: http://www.palumbus.com/publish/IPS-Pi/img32.html The rule is for 80 and 443. It works on 443 because SNI (Server Name Indication) is in the clear, although the user's message is not friendly... it reports that the SSL handshake failed. Mike Kallies mike(a)kallies.ca

1 0

unlimitel cancellation policy
by Dave Cramer 11 Feb '16

11 Feb '16

So I decided to move my voip to voip.ms unlimtel has a nice cancellation policy.. $5 tor remove a DID and they take whatever else is left in the account. Lady asks me why I am cancelling. I said this is why... she says "this is the terms of the agreement" to wit, yes I understand but now you know why I am cancellling buyer beware Dave Cramer

1 0

SCO vs. IBM legal battle over Linux may – finally – be finished | Network World
by James Knott 10 Feb '16

10 Feb '16

http://www.networkworld.com/article/3032050/open-source-tools/sco-vs-ibm-le… Someone should drive a stake through SCO's heart, just to be sure.

1 0

SCAP , compliance and you.
by David Thornton 10 Feb '16

10 Feb '16

Hey guys, Just a quick follow up on my talk last night. SCAP is Security Content Automation Protocol http://scap.nist.gov/ Various bodies make xml files that describe tests, they publish xccdf files that have all of the "things to test" Big Database of checks here: https://web.nvd.nist.gov/view/ncp/repository RedHat supports this and ships with all the required open source software ( rhel 6 and 7): - openscap - openscap-utils - openscap-scanner - scap-security-guide *For RHEL6:* The files for STIG for RHEL6 http://iasecontent.disa.mil/stigs/zip/Oct2015/U_RedHat_6_V1R9_STIG_SCAP_1-1… unzip that stuff and run: /usr/bin/oscap xccdf eval --results /var/www/html/STIG-rhsa-results-oval-before.xml --report /var/www/html/STIG-rhsa-oval-report-before.html /root/STIG/U_RedHat_6_V1R9_STIG_SCAP_1-1_Benchmark-xccdf.xml *For RHEL7* it's even easier: install all the same packages: Then: /usr/bin/oscap xccdf eval --results /var/www/html/ssg-rhel7-results-before.xml --report /var/www/html/ssg-rhel7-report-before.html --profile xccdf_org.ssgproject.content_profile_rht-ccp /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml Here is the redhat 7 documentation https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… I've attached a sample RHEL7 report ( the rhel 6 one is not as sexeh ) If you have any questions , let me know. David

1 0