neovatar.org

Using gocryptfs to encrypt cloud synced files

2016-01-22T00:00:00+01:00

install gkeyring sudo adduser tom fuse mkdir ~/Copy-gocryptfs mkdir ~/Copy/gocryptfs gocryptfs -init /home/tom/Copy/gocryptfs gkeyring –set –name gocryptfs-copy gocryptfs -q -extpass “gkeyring –name gocryptfs-copy -1” /home/tom/Copy/gocryptfs /home/tom/Copy-gocryptfs

Replace vagrant-berkshelf with berkshelf and vagrant-triggers

2014-07-07T12:39:37+02:00

If you are doing Chef cookbook developement then you are probably using Vagrant as you local dev/test environment. And most of the time you will also use Berkshelf for cookbook dependency management.

The usual way to integrate Vagrant and Berkshelf is the vagrant-berkshelf plug-in for vagrant. Basically, this is the Berkshelf functionality bundled in the form of an vagrant plug-in. If you have any experience with plugin development for vagrant you'll probably know, that development of more complex Vagrant plug-ins sucks big time: Major changes on the plugin API with every release or Vagrant not being distributed as Ruby gem anymore, making testing with multiple Vagrant versions a real pain. I really like Vagrant for local testing setups and development - it is a great tool. But to be honest, its plug-in concept has major flaws, if you plan to write complex plug-ins, which bring a few Ruby dependencies along themselves.

Basically the root of the problem: Vagrant brings its own Ruby gem dependencies. All plug-ins run in the same Ruby process - the Vagrant Ruby process. So in case your plug-in needs one Ruby gem in another version than Vagrant, stuff starts to break. Just have a look at the vagrant-berkshelf issue tracker. The developers of Berkshelf finally got tired of maintaining vagrant-berkshelf and will retire it in the future.

Since I rely heavily on Vagrant / Berkshelf integration for a customers Chef cookbook development life cycle, used an alternative approach to integrate Berkshelf into Vagrant.

The Approach

The approach I am using is simple: Use both tools, Vagrant and Berkshelf, avoid the complex plug-in trap and "glue" it all with another simple tool. You can find all of my example files on github. My example uses Berkshelf, Vagrant with VirtualBox and the simple but great Vagrant plug-in vagrant-triggers to glue it all together. I am also assuming that you are at least somewhat familiar with Vagrant and Berkshelf.

The Tools

VirtualBox and Vagrant

My examples use Vagrant with VirtualBox as virtualization environment. Please check the Vagrant and VirtualBox documentation for setup instructions.

Ruby

So, since you are doing chef cookbook developement, I assume you already have a working Ruby installation. If not, I strongly suggest you use rbenv to set it up.

Berkshelf

The next thing you need is a working Berkshelf, which easily can be installed with:

gem install berkshelf --no-ri --no-rdoc

In case you are using rbenv, make sure your shims are updated:

rbenv reshash

Now check your Berkshelf version (3.1.3 on time of writing):

berks --version

Plug-in: vagrant-triggers

Our little helper is the vagrant-triggers Vagrant plug-in. It will enable us to trigger specific code on execution of Vagrant commands. This plugin has no special gem dependencies, so it should always run without any dependency issues in the Vagrant Ruby process. Its code is also quite easy to adapt, should Vagrant change its plug-in API (...again, sigh ...).

You can easily install it with:

vagrant plugin install vagrant-triggers

Running the Example

Have a look at the Vagrantfile in the example. The following part "glues" Vagrant and Berkshelf together:

[:up, :provision].each do |cmd|
  config.trigger.before cmd, :stdout => true do
    info 'Cleaning cookbook directory'
    run "rm -rf #{cookbooks_path}"
    info 'Installing cookbook dependencies with berkshelf'
    run "berks vendor #{cookbooks_path}"
  end
end

The code simply executes the locally installed Berkshelf before vagrant up and provision events. Berkshelf is called with the vendor command, followed by a directory, e.g.:

berks vendor cookbooks

This will resolve all cookbook dependencies the Berkshelf way and install the needed cookbooks in a directory named cookbooks. If you take another look at the code snippet above, you'll see that first we actually delete the cookbooks directory. Berkshelf refuses to install cookbooks into an already existing cookbook directory, so we need to delete it before vendoring to it. The cookbooks directory is mounted into the Vagrant VM and used by chef-solo as cookbook location by default.

So basically we replaced vagrant-berkshelf with a locally installed Ruby/Berkshelf (when doing cookbook development, you normally have these tools already) and vagrant-triggers (which should be much easier to maintain than a complex plug-in). This makes it easy to use the most recent Berkshelf and Vagrant versions without having to worry about vagrant-berkshelf breakage.

Limit Spotify upstream bandwidth with trickle

2013-09-02T17:31:24+02:00

While debugging network related stuff on my router, I noticed that something in my network was using all the available DSL upstream bandwidth. The only active application at that time was Spotify and it wasn't even playing a song. After digging around in the interwebz for a time, I found quite a few reports about this behaviour. Spotify is using p2p techniques to distribute content. So, if somebody plays a song, Spotify tries to download it from another user (maybe you!) who has the song already sitting in his computers disk cache. While Spotify is saving money by using p2p, because it decreases bandwidth usage on their servers, it can lead to problems on your side. Spotify sometimes decides to use ALL of the available upstream, causing short lag spikes in games or SSH sessions. Or maybe your ISP limits traffic to a certain amount of data per month.

Since Spotify does not include an option to limit p2p upstream (Hey Spotify, I am a paying customer and I am pissed!) you have to help yourself and use the neat Linux tool "trickle" to limit the Spotify upstream maximum.

The first thing you need to do, is installing "trickle". It should be somewhere in your package repository, so in Debian/Ubuntu just type:

sudo apt-get install trickle

Trickle allows you to limit downstream and upstream of a userspace application. It does so by shaping SOCK_STREAM of connections established via the socket interface. It will not work on setuid and statically linked executables.

You can run Spotify with an upstream limit of 40KB/s (the Spotify path may differ slightly, depending on your Linux distribution):

trickle -s -d 0 -u 40 /usr/bin/spotify

The -s tells trickle to run in standalone mode (it also supports a daemon mode), -d 0 will allow unlimted downstream and -u 40 will enforce an upstream limit of 40KB/s.

Everytime you launch Spotify via trickle, you can enforce your specified limits. But maybe you want to start Spotify via your desktops volume indicator or by clicking on a Spotify link in your browser. To make your limits permanent you can use a little trick: /usr/bin/spotify is just a symlink to /opt/spotify/spotify-client/spotify. You can remove the symlink and replace it with a little wrapper shell script. You can use the following script to do it for you, save it and run it as root via sudo:

#!/bin/sh -e

# remove spotify symlink
[ -L /usr/bin/spotify ] && rm /usr/bin/spotify

# create spotify wrapper script
cat >/var/tmp/spotify << END
#!/bin/sh
exec trickle -s -d 0 -u 40 /opt/spotify/spotify-client/spotify $*
END

# move wrapper script to /usr/bin/spotify
[ -L /usr/bin/spotify ] || mv /var/tmp/spotify /usr/bin/spotify

# make wrapper script executable
chmod +x /usr/bin/spotify

Now when Spotify is started via /usr/bin/spotify, trickle will be used to enforce bandwidth limits on the Spotify process. If you are interested in a detailed description on how the Spotify content distribution works and why it is using your upstream have a look at How Spotify Works.

Using EncFS with Copy Cloud File Storage

2013-03-24T14:11:42+01:00

I have been trying out Barracuda Networks cloud file storage "Copy" for the last few day. The Linux client seems stable and syncing has been reliable up to now. Although there are claims that Copy stores files encrypted, it is also an architectural fact that Copy needs to store your encryption keys on the server side.

So, if you want to store private Data, then you'll have to setup encryption yourself - Enter EncFS.

EncFS provides an encrypted filesystem in user-space and uses the FUSE Library. The following instructions are for Ubuntu 12.04, but configuration should be similiar with other distros.

Installing EncFS

This is the easy part, just type:

sudo apt-get install encfs

Install gnome-encfs

Gnome-encfs is a nifty helper tool that makes mounting EncFS mounts automatically at login time easy. So, download and install it:

wget http://bitbucket.org/obensonne/gnome-encfs/get/tip.tar.gz
tar xvzf tip.tar.gz --wildcards --strip=1 --no-anchored 'gnome-encfs'
sudo install gnome-encfs /usr/local/bin

Setup an EncFS encrypted folder

I assume that your Copy cloud storage folder is ~/Copy. First, create a directory that will hold the encrypted file system:

mkdir ~/Copy/encfs

Now create a mountpoint to hold the decrypted File system:

mkdir ~/Copy-crypted

Now lets create the encrypted file system:

encfs ~/Copy/encfs ~/Copy-crypted

EncFS will now ask for encryption options, you can just use the preconfigured paranoia mode. Now enter the passphrase of the encrypted file system. Make sure to check whether the mount is set up correctly:

mount | grep encfs

It should give you an output similar to this:

encfs on /home/foo/Copy-crypted type fuse.encfs (rw,nosuid,nodev,default_permissions,user=foo)

Automounting on login

Using gnome-encfs, you can store your EncFS passphrase in the Gnome password manager and mount the encrypted filesystem automatically on login. Just enter:

gnome-encfs -a ~/Copy/encfs ~/Copy-crypted

Gnome-encfs will ask for the passphrase. Just make sure you enter the correct one, because it will just ask one time. Now test if gnome-encfs is configured correctly. Unmount the crypted filesystem:

fusermount -u ~/Copy-crypted

Then execute the gnome-encfs mount procedure with:

gnome-encfs -m ~/Copy-crypted

This should give you something like this:

Mounting /home/foo/Copy/encfs at /home/foo/Copy-crypted: OK

In case you got an error, becausye you did enter a wrong passphrase, remove the entry:

gnome-encfs -r ~/Copy-crypted

Now add it again, as described above. Once you have set up gnome-encfs correctly, you should see ~/Copy-crypted automounted on login.

Unmounting on logout

To make sure, that the encrypted file system is unmounted when you log out, you have to add a session cleanup script to your display manager. The following instructions are for lightdm, the standard display manager in Ubuntu 12.04.

Create a session cleanup script:

sudoedit /etc/lightdm/session-cleanup.sh

Put the following lines in the script:

mount -t fuse.encfs | grep "user=$USER" | awk '{print $3}' | while read MPOINT ; do
    sudo -u $USER fusermount -u "$MPOINT"
done

Make the script executable:

sudo chmod +x /etc/lightdm/session-cleanup.sh

Then, edit lightdm.conf to execute the script on logout:

sudoedit /etc/lightdm/lightdm.conf

Add the following line configuration:

session-cleanup-script=/etc/lightdm/session-cleanup.sh

Now restart your PC or restart lightdm. Your display manager will now unmount all mounted EncFS mounts when you logout.

copycom2deb - Create Debian packages for the Copy client agent

2013-03-23T21:35:14+01:00

Copy is a new cloud storage solution similar to Dropbox. They have a better price model, allowing you to use 250GB of storage for 99$ per year. The free account starts with 5GB and you can get a few extra GB by promoting the service. You get client agents for most operating systems, including Linux.

Barracuda only supplies Linux users with a simple tgz installer. This installer is perfectly working, but I wanted to install and update software with dpkg. So I hacked a little script to download the current version of the client agent and build a Debian package from the tgz.

You can find the script on GitHub: https://github.com/neovatar/copycom2deb

Spotify and Linux: Backing it up with dpkg-repack

2012-03-26T18:54:54+02:00

Spotify is great and it is nearly the only choice if you want a music streaming service with a native Linux client. But the client is still in a "preview" stage. So if Spotify releases a new version of the Linux client, it sometimes botches your spotify installation. So if you do your "apt-get update && apt-get upgrade" dance, it might leave you without music (eeeeeeek!). But fear not! There is an easy way to backup your working Spotify installation on an Ubuntu/Debian system.

First, install the required tools: sudo apt-get install fakeroot dpkg-repack

Then run the following line: for I in $(dpkg-query -W -f='${Package} ' spotify*); do fakeroot -u dpkg-repack $I; done

This will recreate the .deb Spotify packages from the files installed on your system and place them in the current directory (just make sure you are in a directory with write access). Its easy to roll back to an old installation by installing the .deb files with "dpkg -i".

Now you just have to remember to do this, when you got a running Spotify or you could create a cron job to backup periodically.

Caching authenticated downloads with Varnish and VCL

2012-01-02T20:02:00+01:00

Imagine the following scenario: You have an web application that delivers data, you have a huge number of requests per second, the data is identical for all users, but you want to limit access to authenticated users. Your back end application is slow and does not cache the created data. You also want to lighten the load on the authentication service. Fixing your back end application or your authentication service unfortunately is not an option. I wanted to solve this problem with Varnish and a VCL only solution, so no inline C or Varnish modules are required for my approach.

In my example the authenticated URLs have the following basic form:

/protected/file.ext?auth=5283f514f51511ca3e73f76ab7e8e96

It's also possible that there are other query string parameters, e.g.:

/protected/file.ext?id=xyz&auth=5283f514f51511ca3e73f76ab7e8e96&p=12345

The important bit is the auth query parameter, which contains an authentication token.

First I define a backend in the VCL, which hosts the authentication service:

backend auth {
  .host = "auth.neovatar.org";
  .port = "80";
}

In vcl_recv I need to extract the auth parameter value. I also need to create the URL used for retrieving the requested content. This is basically the original URL with the auth parameter removed:

sub vcl_recv {
  if (req.http.host == "blog.neovatar.org") {
    unset req.http.cookie;
    if (req.url ~ "^/protected/") {
      if (req.restarts == 0) {

        std.log("org.req.url:" + req.url);

        # get auth parameter value from query string
        set req.http.x-auth-token = regsub(req.url,
          "^.*(\?|&)auth=([A-Fa-f0-9]*)(&{0,1}.*|$)",
          "\2");

        # remove `auth` parameter from query string and
        # if there is no query string after removal, remove trailing `?`
        set req.http.x-orig-url = regsub(req.url,
          "(\?{0,1})(&{0,1})auth=[A-Fa-f0-9]*(&.*|$)",
          "\1\3");
        set req.http.x-orig-url = regsub(req.http.x-orig-url, "\?$", "");

        # set url to query auth backend
        set req.url = "/auth.php?auth=" + req.http.x-auth-token;
        set req.backend = auth;
        set req.http.host = "auth.neovatar.org";
        unset req.http.cookie;
      }
    }
  }
}

The interesting part in this VCL code are the regular expressions. This snippet extracts the value of the auth parameter and sets the HTTP header x-auth-token:

        set req.http.x-auth-token = regsub(req.url,
          "^.*(\?|&)auth=([A-Fa-f0-9]*)(&{0,1}.*|$)",
          "\2");

Similar to this the following expression stores the URL that points to the actual content in the HTTP header x-orig-url for later use:

        set req.http.x-orig-url = regsub(req.url,
          "(\?{0,1})(&{0,1})auth=[A-Fa-f0-9]*(&.*|$)",
          "\1\3");

Then I set the actual request URL to the authentication URL and append the auth token:

        set req.url = "/auth.php?auth=" + req.http.x-auth-token;
        set req.backend = auth;
        set req.http.host = "auth.neovatar.org";

Now varnish will do a backend request to the authentication service URL instead of the original requested URL. The service will return a HTTP 200 response if the auth token is valid and a HTTP 403 when the token is invalid. On positive authentication, I want to deliver the requested content and not the response of the authentication service. So I have to check for this in vcl_deliver:

sub vcl_deliver {
  if (req.backend == auth) {
    if (resp.status != 200) {
    }
    else {
      set req.url = req.http.x-orig-url;
      set req.backend = default;
      set req.http.host = "blog.neovatar.org";
      return(restart);
    }
  }
  if (obj.hits > 0) {
    set resp.http.X-Cache = "HIT:" + obj.hits;
  }
  else {
    set resp.http.X-Cache = "MISS";
  }

  unset resp.http.server;
  unset   resp.http.Age;
  unset   resp.http.X-Varnish;
  unset   resp.http.Via;

  return( deliver );
}

If the auth request returned an HTTP 200 status, then I know the authentication was successfull. So I set the URL to the content URL which I saved to http.x-orig-url earlier. Following this, I call restart, thus telling the varnish thread to start processing the request again from the beginning:

if (req.backend == auth) {
    if (resp.status != 200) {
    }
    else {
      set req.url = req.http.x-orig-url;
      set req.backend = default;
      set req.http.host = "blog.neovatar.org";
      return(restart);
    }
  }

Now, take a look again at my vcl_recv code snippet, there is one important bit I did not mention earlier:

    if (req.url ~ "^/protected/") {
      if (req.restarts == 0) {
        set req.backend = auth;

I check for the number of restarts, so the authentication request is only done on first pass. On subsequent passes the URL is fetched and since I changed the URL to the actual content URL, it is requested and delivered. And with the right code in vcl_fetch I can cache requests to content and to the auth service:

sub vcl_fetch {
  if (req.http.host == "blog.neovatar.org") {
    # remove cookies, so that blog is cacheable
    unset beresp.http.set-cookie;

    # enforce 1m cache time
    if (beresp.ttl <= 5m ) {
      set beresp.ttl = 5m;
    }
  }
  else if (req.http.host == "auth.neovatar.org") {
    set beresp.ttl = 1m;
  }
}

This will cache content for 5 minutes and authentication queries for 1 minute.

Tearing when moving windows in Ubuntu 10.10

2011-05-03T20:15:44+02:00

I just stumbled over the ability to set vsync in compiz settings manager. I had an increased screen tearing with my new Eizo 24” monitor for a while now and switching vsync on in compiz removes it! Yay!

Open compiz settings manager, then click “General Options”, go to the tab “Display Settings” and check “Sync with VBlank”. Move around a window and cheer .

Terroristen, überall!

2010-12-31T20:23:58+01:00

Terroristen habens auch nicht leicht. Das sieht man sehr schön im Video “Extra 3 macht den Terror-Test”. Und Stumpfi lässt sich erklären, woran man einen Terrorist erkennt. Das haben sich die Polizisten in Berlin dann wohl auch zu Herzen genommen.

A firefox add-on for pinboard.in

2010-12-29T16:41:15+01:00

Since Yahoo did put delicious into “sunset mode” (marketing speech for: “we will close it down”), I was searching for an alternative. Many people did switch to pinboard.in, so I gave this service a shot. And I am really liking this “antisocial bookmarking service”. If you are in search for an alternative to delicious, give pinboard.in a try. It is worth the one time signup fee!

The only thing I was missing is a little firefox integration for quick bookmarking within firefox. So I wrote my own little firefox add on. Its called simplepinboardbutton and its hosted on the simplepinboardbutton site.

Die Schwabenmafia

2010-10-11T19:06:09+02:00

Einen interessanten Artikel über Hintergründe zu S21 gibt es von Spiegelfechter

Not my president!

2010-06-02T20:39:20+02:00

openssl 1.0

2010-03-30T07:37:46+02:00

Yay, openssl 1.0 has been released!

openssl 1.0

Optimize Firefox startup times

2010-01-10T11:28:10+01:00

I did some research on my prolonged firefox startup time and alas I found something cool:

Vacuum your Firefox databases

Basically you have to do the following:

Install sqlite3:
```
sudo apt-get install sqlite3
```

Vacuum your Firefox DBs:

find ~/.mozilla/firefox -name "*.sqlite" -exec sqlite3 \{\} VACUUM \;

Reindex your Firefox DBs:

find ~/.mozilla/firefox -name "*.sqlite" -exec sqlite3 \{\} REINDEX \;

Bug in hsolinkcontrol...

2009-10-09T22:07:19+02:00

I stumbled over a bug in hsolinkcontrol, which also seems to be reported in this pharscape forum post

Bug description:

Ubuntu 9.04, with NO(!) resolvconf package installed
hsolink 1.0.118 package
HSOconnect 1.2.18 beta
/etc/resolv.conf is saved to /etc/resolv.conf.hsoc%s.tmp
the permissions of the created /etc/resolv.conf.hsoc%s.tmp file are 660 and root:root
when the saved /etc/resolv.conf.hsoc%s.tmp is moved back to /etc/resolv.conf, this file also gets the 660 permissions
after that, only root can read /etc/resolv.conf
the effect is, that DNS resolution does not work except when you are root
installing resolvconf will work around this issue

This can probably be easily fixed, by making sure that the /etc/resolv.conf.hsoc%s.tmp has the same permissions as the original /etc/resolv.conf file. Since installing the resolvconf package makes the bug go away, I did not fix the source, but just sent a notice to the author.

GNU statt CDU

2009-09-25T09:07:11+02:00

PHP...

2009-09-16T19:50:41+02:00

… just sucks.

PHP function crc32 misbehaves on 64 Bit OS

To quote the braindead php developer: “Its not broken! Nanananananaaaaaa!” plugs his ears

Polizisten prügeln auf Demonstranten ein ...

2009-09-13T11:18:01+02:00

… und zwar nicht in irgendeinem Staat auf der anderen Seite der Welt, nein hier in der Bundesrepublik, bei der Demonstration “Freiheit statt Angst”.

Ein Demonstrant auf einem Fahhrad möchte sich die Namen der Polizisten notieren, die vorher einen Mitdemonstranten rüde einkassiert haben. Na so ein Querulant! Das ist doch sicher ein Terrorist! Nix wie runter mit dem vom Fahrrad und erstmal provisorisch ein paar aufs M0wl! Ein anderer Demonstrant bekommt da auch noch gleich eins auf die Nase. Was macht der auch da, mitten im Polizeieinsatz…

Leute, bitte verbreitet diese Videos über den Vorfall, wo Ihr nur könnt. Wir müssen diesen Vorfall solange in der Öffentlichkeit halten, bis die Polizisten und Ihre Vorgesetzten zur Verantwortung gezogen worden sind.

Hat noch jemand Fragen, wie das in Zukunft sein wird, wenn die Bundeswehr im Inneren eingesetzt werden soll?

Infos über den Vorfall:

Bericht über die prügelden Polizisten bei Fefe

Artikel bei der TAZ

[update]Peter Piksas Blog mit aktualisierten Informationen zum Vorfall[/update]

Das Video gibts hier:

Video in HD beim CCC

Video in verschiedenen Größen bei basdrive.org

Using Windows is a sin...

2009-08-26T10:04:56+02:00

Check it out at: windows 7 sins

Franziska Heine vs. Ursula von der Leyen

2009-06-25T20:45:19+02:00

In der Zeit sind nun Franziska Heine (die Initiatorin der Petition gegen das Internetzensurgesetz) und Ministerin von der Leyen im Streitgespräch aufeinander getroffen.

Gute Analysen des Interviews findet Ihr hier:

Blog von Ingo Jürgensmann - Heine vs. v.D.Leyen netzpolitik.org - Wahrheit oder Pflicht?

Auch DU bist Terrorist!

2009-05-21T11:07:47+02:00

Auch DU bist Terrorrist!

http://www.dubistterrorist.de/

Geburtstag Tom mit bring-a-fleisch-und-salat

2009-04-26T18:08:52+02:00

Hallo liebe Freunde,

hier die aktuelle Liste vom bring-a-fleisch-und-salat:

Thorsten, Angie: Tiramisu
Günther, Kathrin: Quarknachspeise
Geli, Ebi: Vanillemouse
Christian, Ramona: 2 Kästen August, 1 Kasten Bier, Grillbriketts
Markus, Christina: 1 Kasten Bier, 1 Kasten nicht-alkoholisches, Nudelsalat
Andre: Salat
Claudio: Selbstgemachte Knoblauchmajo von Omi
Kathi, Sven:Kräuterbaguettes, Salat
Wolfram:Salat
Andrea, Tom:Kartoffelsalat, Paprikareis, Baguette

Noch benötigt:

Saucen

Falls jemand nochwas vermisst, bitte Bescheid geben!

Bundesverfassungsgericht vs. electronic voting machines

2009-03-03T10:36:25+01:00

Yay! The Bundesverfassungsgericht stops usage of electronic voting machines.

Read more in this sueddeutsche.de arcticle.

Microsoft lobbying at its finest

2009-02-28T13:06:53+01:00

Another example of Microsoft lobbying. They try to hijack an EU open source paper.

Read the article at linux journal
Read the lobbyfied document at wikileaks

“Gee, Mr. Ballmer what do you want to do tonight?” “The same thing we do every night. Try to take over the world!”

Yay! A new job!

2009-02-16T22:19:00+01:00

Changed my job from a security consultant to a linux system architect. So no more traveling around and working for TLC (three letter customers). I am now working for the online division of a big german newspaper.

BND threatens to sue wikileaks

2008-12-20T21:37:44+01:00

BND threatens to sue wikileaks:

http://wikileaks.org/wiki/German_spy_chief_threatens_Wikileaks

Shellscript for BND IPs

2008-12-03T15:02:29+01:00

IP address ranges have been leaked to wikileaks. I wrote a quick ‘n dirty shell script to parse my webserver access log files for these IP ranges.

#!/bin/bash

CountIpRanges ()
{
(cat <<EOF
193.159.228.32 - 193.159.228.39
193.159.238.168 - 193.159.238.175
194.25.184.16 - 194.25.184.23
194.25.42.232 - 194.25.42.239
195.145.128.56 - 195.145.128.63
195.145.163.64 - 195.145.163.127
195.145.182.96 - 195.145.182.111
195.145.31.252 - 195.145.31.255
195.145.57.176 - 195.145.57.191
195.243.157.184 - 195.243.157.191
195.243.248.224 - 195.243.248.231
212.185.184.224 - 212.185.184.231
212.185.191.128 - 212.185.191.135
217.7.155.168 - 217.7.155.175
217.89.74.208 - 217.89.74.223
62.153.59.192 - 62.153.59.223
62.153.65.32 - 62.153.65.39
62.153.80.208 - 62.153.80.215
62.153.87.0 - 62.153.87.15
62.154.211.152 - 62.154.211.159
62.154.226.64 - 62.154.226.127
62.156.187.232 - 62.156.187.239
62.157.136.64 - 62.157.136.95
62.157.144.0 - 62.157.144.63
62.157.193.128 - 62.157.193.223
62.157.194.32 - 62.157.194.39
62.159.19.208 - 62.159.19.215
62.159.104.160 - 62.159.104.175
62.159.209.144 - 62.159.209.151
62.159.209.152 - 62.159.209.159
62.159.21.152 - 62.159.21.159
62.159.60.144 - 62.159.60.151
62.159.63.72 - 62.159.63.79
62.225.139.248 - 62.225.139.255
62.225.74.128 - 62.225.74.135
80.146.198.88 - 80.146.198.95
62.159.104.160 - 62.159.104.175
EOF
) | sed 's/ //g' | awk -F- '{ split($1,IPS,".") ;  split($2,IPE,".") ; \
for (I=IPS[4];I&lt;IPE[4];I++) { print IPS[1]"."IPS[2]"."IPS[3]"."I } }'
}

CountIpRanges | grep -H -f - $1

Deviantart Profile

2008-09-15T19:39:51+02:00

I posted some of my “featured” photographies on my new deviant art profile, enjoy

http://neovatar.deviantart.com/

"HDR" experiment...

2008-06-01T18:14:41+02:00

Today I was playing around with my new Canon 450D DSLR and did a “HDR” experiment.

The original picture, a view into my garden photographed out of my window. As you can see, its a bit overexposed:

And a processed HDR made out of three pictures done in bracketing mode:

Compare the two images with a mouseover effect (needs javascript).

Failover firewalls with OpenBSD + VMware Server, part I: The network scenario

2008-05-27T19:34:00+02:00

My idea was to build/simulate a typical firewall setup with a redundant firewall, where the secondary box takes over if the primary fails. After considering a Linux based solution, I decided to try a BSD based approach, since this OS family seemed very suitable for this kind of setup.

After playing around a bit with some open source based firewall appliances like m0n0wall and pfsense, I did what real men do - and settled for OpenBSD The following draft shows the setup I am planning to implement:

So basically we have the following components:

The external network: ext, 192.168.1.0/24

The internal network: int, 192.168.2.0/24

A special network between the firewalls: pfsync, 192.168.3.0/24

The firewalls have their “own” IP addresses: fw1, x.y.z.240 and fw2, x.y.z.241, where x.y.z are the networks int,ext and pfsync

Both firewalls share “virtual” IP addresses: 192.168.1.254 on ext and 192.168.2.254 on int

In the int network, we have a workstation bsd1 with the IP 192.168.2.10

Normally fw1 operates as primary firewall and filters/forwards packets between ext and int. If a failure occurs, fw2 takes over the virtual IP addresses and operates as firewall/gateway. The pfsync network is a special network between the firewall, reserved for special firewall communication like state syncing.

And since we haven’t got that much spare hardware lying around, we will simulate this scenario with virtual machines based on a VMware server setup.

Since VMware server really has its quirks in this kind of setup, stay tuned for part II: VMware server setup

Fix for s9y 1.3.1 entry's links plugin + postgreSQL 8.1

2008-05-26T20:26:45+02:00

The s9y team did some work on the code, unfortunately some changes break the “entry’s links” plugin, if you are still using postgreSQL 8.1. I patched the serendipity_plugin_entrylinks.php file.

Download my little patch entrylinks patch.

VMware Server, host-only networking and a pinch of promiscuous mode

2008-04-20T20:46:50+02:00

Today I was playing around with VMware server and two OpenBSD virtual machines that resided on the same vmnet network. I noticed, that vmnet seemed to operate in “switch” mode. I was sending a ping from the host OS to VM1 and VM2 was not able to see the packet. After digging around the web, I found a solution:

1.) create a user group vmadm 2.) add the UID which is used tu run the VMs to this group 3.) change the group ownership of the vmnet interfaces to this group 4.) allow group members to read/write to the vmnet interfaces

e.g on Debian execute (VMs run as UID vmrun, VMs use vmnet1):

addgroup vmadm
adduser vmrun vmadm
chgrp vmnet /dev/vmnet1
chmod g+rw /dev/vmnet1

Hurray, I got myself a new AMD/ATI video card...

2008-03-13T13:50:24+01:00

… but now I am using it as expensive paperweight. So if you are thinking about buying a 2600 based AGP card, don’t do it.

Here is the story of my (k)nightly quest to get this thing running:

Last week my old x800 based ATI AGP card died and I got myself a new card (HIS IceQ Radeon HD2600XT PRO AGP). Starting with windows I was quite surprised, to notice that the installed ATI catalyst driver did not find any ATI hardware.

Ok, I thought, maybe the driver is too old. So I downloaded the most recent catalyst 8.2. Still enjoying my shiny new hardware toy, I launched up the driver installer. And again I was informed, that the driver did not find any ATI video card. Hmm. I checked the ATI logo on the box, no it said, it’s an ATI card.

I used the manufacturer supplied CD to install the drivers, actually they were working, but a bit outdated. So why did the reference driver from ATI did not? A little bit of research brought up the issue. Go to the driverheaven forum and search for ATI+AGP. But better keep some painkillers at hand, you will need them if you own a 2600 based AGP card.

Long story short: ATI does not support 2600 based AGP cards with their new driver. Yeah right, they do not have AGP support for this chipsets (with a bit little bit of finger pointing to the manufacturer). These kind of cards are advertised as the best possible AGP video upgrade, but the official driver does not support it (not entirely right, actually there is a hotfix, that works with some cards, but not mine). Well, if that is not a clear case of WTF …

Since I use Linux as primary working OS, I tried to get the card running in Ubuntu. The combination of my trusted Ubuntu 7.04 and the official catalyst 8.2 fglrx only resulted in either kernel crashes (wheeeee!) or the driver did not find any hardware (tried the last five official drivers from the ATI/AMD website and the ones in the ubuntu repository). Finally I upgraded to 7.10, was able to build+load the fglrx driver. But still, no HD 2600 AGP card supported. The x.org logs said that fglrx could not detect any hardware (doh!).

I love to play around with linux, kernel and drivers, but I really lost patience this time. The official AMD/ATI drivers simply did not work with my card, neither under Linux nor Windows (@AMD/ATI guys: you know, there is a nice little sticker on the box “certified for windows”).

The open source drivers did a much better job, as they were actually working. I got the card working with the radeonhd and the radeon drivers (both checked out via git and self compiled). Unfortunately the 2D acceleration is very new and there was no 3D acceleration or XV support (which I need in Linux). But nonetheless, big kudos to the open source community, for supplying a working driver for my card. The chip manufacturer of course was not able to do it. Interesting. I hope ATI/AMD actually pays their driver programming team. So the bottom line of all this ranting is:

I ordered an nvidia card and the AMD/ATI card has gone back into its nice little box. The only thing that will get it out of there again, is to test new versions of the radeon or radeonhd open source drivers. I am so done with AMD/ATI cards and the catalyst driver. Reading the reports about catalyst 8.3, I decided not to even try it. Did I mention already, that getting my new Nvidia 7600GT based card to work took 10 minutes for both operating systems in total (and the Linux driver has stable AIGLX support)?

The only positive about the whole mess: I discovered an excellent website concerning video hardware and Linux. Check out the Phoronix website and their Phoronix community forum. This is definitely the place to check, before you buy some video hardware.

ATI, you lost a customer here. And yes, I like some cheese with the whine.

YUCK! I did it!

2007-10-13T18:35:10+02:00

Finally installed s9y. Stay tuned, actually somethings gonna happen on this site in the next 23274368 years.