# Codeholics

Home Network Overhaul with Enterprise Techniques

2022-06-20T18:39:00-04:00

Pre-Reqs

An understanding of IP networking

Intro

Most home users have a flat network on the private range of 192.168.1.1/24. This allows for 254 devices including the router. This is alright for most users but has become more of a concern with the lacking security in IoT devices. With this said this post will not be an in depth look into the topic of home IoT devices but more of a look at how I have used what I have learned through my career in IT to plan the setup of my home network. This setup is not for most people. The concepts I learned were picked up many years ago in CCNA classes. I have also implemented and worked directly with advanced networking topologies over my 20+ year career in various positions throughout the industry. This post is in no way a flex. I did this on a small budget using what I had available to me and bought adequate hardware for things I didn't have.

Planning

All good network implementations start with a plan. It is important to understand the goals you are trying to achieve with your current networking needs and understand what your future needs might be. If you put in the up front work to design your network properly, it will grow as your needs grow saving you valuable future time.

My Goals

My environment has the standard things most houses have: laptops, phones, Roku sticks, personal assistance, cameras... but I also have a bit more than the average home. I have a file server, beefy 4U server and a Raspberry Pi cluster. I wanted to create a few VLANs and rich firewall rules to keep these devices orginized and make sure they do not get out of line.

Network Topology Diagram

Once you understand your goal, it is time to get a high level understanding of what you have and what you will need to achieve that goal. In the enterprise space, you would use expensive software like MS Visio to do a network diagram, but this can be done with other software that is freely or openly available to everyone. For this project and for projects I have helped out with in the past I use the Google Suite. For the network diagram I use Google Drawings. For the network address layout and VLAN switch port assignments I use Google Sheets. This method has served me well when I want to collaborate with people on a project or just use multiple devices to access the project's artifacts.

When it comes to network diagrams, it is nice to have official asset images. Network topology images can be downloaded from Cisco: Network Topology Icons

I unzipped the JPG icons and uploaded them into my Google Drive to have them available for my Google Drawings. Now, if you have not taken CCNA classes, read networking books or worked in this space these icons might not mean anything to you. The icons I will use in my network topology diagram are:


Modem	Firewall Router	Switch	WiFi Router

I could have used an Access Point icon instead of the WiFi Router icon since the router will only be acting as an Access Point, but this is for my home network and not an enterprise network, so I know what it is. With that said, you do not need to do icons if this is just for you. You can just do boxes or whatever makes sense to you.

Here is what the first version of my network topology diagram looked like:

The things that were known going into the first iteration of the network topology design:

I was going to re-use my current Asus router in AP mode
I needed a 24 port switch that supported VLANs
I needed a more feature rich firewall router that supports VLANs and rich firewall rules
I was going to use the 192.168.0.0/16 address space
192.168.1.0/24 was going to be my network management subnet
192.168.2.0/24 was going to be my wireless device subnet

VLAN Network Assignment

The next task is laying out all the additional VLANs and subnets that are needed.

At this point, it's time to start acquiring the hardware needed to get the job done.

Hardware

What I had:

Asus AC1900 (RT-AC68U)

The Asus RT-AC68U is a basic Wifi router with a 4 port switch. I had this for only a few months as my Asus RT-AC66U power switch gave out after its loyal service for about 5 years. The RT-AC68U has never been stable in Router Mode. I had constant connection issues and had to reboot it often. My hope in continuing to use the device was that these issues might go away in AP Mode. (Spoiler Alert!!) So far so good in using it in AP Mode.

Probably most important is the UPS. It is not depicted in the Network Topology Diagram. It would be in a Network Rack Diagram. I am not going to go over the Network Rack Diagram in this post. If you are going to drop some money on equipment you need to protect it. I have a CyberPower UPS that I have been using for a few years. It is not rack mounted, but I had this long before I had a rack.

CyberPower CP900AVR

If I were going to buy a UPS for this project I would probably go with this:

CyberPower OR700LCDRM1U Smart App LCD UPS, 700VA/400W, 6 Outlets, AVR, 1U Rackmount

The price is good and it is a 1U design

New hardware:

I included two links because the model I have is no longer available and has been updated to a newer model. Before I go on about how nice this device is, it is probably worth a reminder that I am not getting paid by Protechtli for this post.

I got my hardware from a friend who decided the device was not right for their environment so I got it for the low, low price of free. I had never heard of the company Protechtli but I was immediately impressed. First thing I noticed when I unpacked this device was the quality of the case. It is a beautifully designed, thick, all aluminum case.

The specs on the device should have plenty of power for running in my environment. These devices do not come pre-loaded with an OS. I am using PFSense CE on my device.

TP-Link TL-SG1024DE

When I was searching around for a switch I had in mind a few things I wanted and a dollar amount I wanted to stay under. I also didn't want to buy used network hardware off of ebay because you have no idea the device's history, and Cisco IOS is behind a pay wall. The TP-Link TL-SG1024DE 24 port switch is a really nice, feature rich budget switch. It is low power, and it has a fanless design.

Things this had that I neeeded:
VLAN * LAG Things it was lacking that I wanted:
POE * Trunking

In the future when needs and budget grow, I will look into a 24 port switch that offers the things I want. However, you are looking at $200+ extra for a switch with these features. At the moment this was not in the network project budget. You really cannot beat the price tag on this switch for the feature set it provides. I will also need to update my AP or see if maybe another firmware would support multiple VLANs in AP mode.

I have the 9U rack mounted to a fire rated backer board in a spot down in the basement. I had already had the spot setup as I have been wanting to do this project for sometime. The rack was very easy to mount. I was able to do it all myself without having to call anyone over to lend a hand. The 1U shelves worked out really well for keeping items that were not rack mountable in a nice location within the rack.

Finished Network Topology Diagram

Once the hardware is selected, a little more detail can be added to the final topology diagram.

Switch Port VLAN Assignment Diagram

The reason this is not included with the planning is due to the fluid nature of the document, and the port configuration can depend on the features of the switch. My configuration is not finalized as of this moment, as I have not setup any LAG groups and the additional ports for the Pi Cluster. This will all be done at a later time.

Having a document like this is handy for easy deployment and future troubleshooting.

Conclusion

The main goal of this post was to introduce some of the upfront processes and tasks that go into enterprise network planning and some of the techniques that can be utilized to keep a more complex networking project in order. The techniques for enterprise deployments can be applied on a home network as well if your needs are a little more demanding like mine.

There is one document that I should have gone over but will not for this small project: The Rack Level Diagram. This diagram displays all the equipment at the rack level so you know where everything will be placed and can make sure it all fits. I didn't do one of these because I simply had an idea in my head of how all these things would fit together, and since it was just for me I didn't need it.

The topic of computer networking is very deep. While some of the hardware has gone virtual the concepts and practices remain the same. Having a solid foundation in networking has given me an edge throughout my career working with virtulization, containerization and cloud technologies. I would like to give a special thanks to George Markwick who has been an amazing friend and mentor throughout my career, and it was he who taught me these techniques early on in my career while we were designing and building out IDFs, MDFs and Data Centers.

I am going to leave this post off with a few pictures of everything racked up:

My next steps are getting a 1U cable tray to get those cables under control and getting a rack mount for the Pi Cluster. If you enjoyed this post, please consider becoming a sponsor. The funds will be used to help keep Codeholics rolling.

Mycroft Personal Assistant Setup Part 2

2022-06-16T18:39:00-04:00

Intro

If you have followed the part 1 of this Mycroft personal assistant setup you have a standard Mycroft personal assistant with either the Hey Mycroft wake word or you tried to set it up with a custom wake word. If that customer wake word is using Pocketsphinx it is probably getting an unlivable amount of false positives. In part 2 of this series I am going to walk you through setting up a custom wake word for Mycroft using mycroft-precise. As of the time of writing this the setup was not all that straight forward and the processes of training a custom wake word is a bit more involved than one might think. Also mycroft-core defaults to an older version of Precise and the Precise Runner. A wake word you train with the newer version of Precise will not run on an older version. I also ran into an issue along the way and the requirements for the Precise project were a bit out of date. This lead me to opening up a PR and I am currently running on my fork until the PR is merged. It is nice to be able to contribute back to a great project. First I will walk through the project setup and training of the custom wake word. Then I will get into the precise configuration for the PA.

Custom Wake Word Project Setup

For recording I used two different microphones that I had within my environment to train the wake word. First I used my Blue Snowball but when I ran my model on my Picroft with the ReSpeaker hat I was not getting good results so I started training directly on the Mycroft device itself. Doing this gave me much better results.

Start off by creating the following project structure. If time permits maybe I will make a cookie cutter for this in the future.

The project structure

jarvis
├── models
├── not-wake-word
├── README.md
├── test
│   ├── not-wake-word
│   └── wake-word
└── wake-word

I wanted my custom wake word to be Jarvis not Hey Jarvis just Jarvis. Now, I was already setting myself up for trouble because most guides tell you to use a two word wake word but if Tony Stark can just say, "Jarvis, bring up the plans for the Mark 5." I should be able to as well. With that said I have been able to get good results from my single word wake word so I wont advise against trying it for yourself.

Wake word collection

Now start recording the wake word with Precise using the following command:

precise-collect

This will collect .wave files in the current directory. This cli tool has a few options but I think one major thing it is lacking is the ability to set the path of where you want to collect. If you would like to set the output file name use:

precise-collect jarvis-###

This will create jarvis-000.wave and so on as you keep recording. Think of this project as any other software project that you will need to work on over time. With that in mind you want to make unique names for each recording session. Here is a peek at my wake-word folder:

...
-rw-r--r-- 1 pi pi  64078 Sep 24  2021 jarvis-eebfbb38-db51-4a83-98dd-8a0712b32a7e.wav
-rw-r--r-- 1 pi pi  69676 Sep 24  2021 jarvis-ef72a2b2-0ea2-495c-af10-eaf12255ec9d.wav
-rw-r--r-- 1 pi pi  81964 Sep 24  2021 jarvis-fa85b5d8-5803-43f9-a6aa-9dd67034be14.wav
-rw-r--r-- 1 pi pi  81964 Sep 24  2021 jarvis-fb675e0a-1ac8-4a45-b9d8-36d454c598bc.wav
-rw-r--r-- 1 pi pi  67628 Oct 22  2021 jarvis-with-radiohead-00.wav
-rw-r--r-- 1 pi pi  75820 Oct 22  2021 jarvis-with-radiohead-01.wav
-rw-r--r-- 1 pi pi  67628 Oct 22  2021 jarvis-with-radiohead-02.wav
-rw-r--r-- 1 pi pi  67628 Oct 22  2021 jarvis-with-radiohead-03.wav
...

At one point I used a little bash-fu to give some old recordings UUIDs to make sure not to clobber them when I just had the files numbered. At one point I was listening to Radiohead and I was getting a lot of false positives so I did a recording session with Radiohead playing in the background. It is important to do a good amount of wake word recordings from different distances from the mic as you might be half way across the room and want to say a command.

One important thing to do before starting collection is stop your Mycroft services: mycroft-stop all

It is just as important to have a well populated not-wake-word folder. Record yourself saying words that might sounds like your wake word but are not. Also, the Precise-Community-Data has a good set of not-work-words recordings to include in your project.

Once you have your wake-word and not-wake-word folder populated grab a subset to include in your test sub folders. Now take the first pass at training the wake word model. Navigate to your models folder and use the following command:

precise-train -e 600 jarvis.net ../

Where -e is for number of EPOCHS to train the mode, jarvis.net is the NN model and ../ is the path to the project data to train the model. Once this is completed convert the jarvis.net file:

precise-convert jarvis.net

After all this the models folder will look something like this:

ls ./jarvis/models/
jarvis.epoch  jarvis.logs  jarvis.net  jarvis.net.params  jarvis.pb  jarvis.pb.params  jarvis.pbtxt  jarvis.trained.txt

Now that you have a wake word model it is time to test it out and see if it works. This can be done using the precise-listen command:

precise-listen jarvis.net

This command will give you a bit of visual feedback on how well your wake word is doing. This tool can also be used to find false positives within your environment.

precise-listen jarvis.net -d ../not-wake-word

This will put all the trigger words into the not-wake-word folder. I have ran this over a few days while I am in meetings and what not to help catch false positives. Doing this has really helped improve the accuracy of my wake word.

Setting up Picroft to use the latest precise-engine

Since I trained my model with a newer version of precise I needed to update the precise running binary on my Mycroft PA. The Precise Engine binary can be found in /home/pi/.mycroft/precise:

cd /home/pi/.mycroft/precise
wget https://github.com/MycroftAI/mycroft-precise/releases/download/v0.3.0/precise-engine_0.3.0_armv7l.tar.gz
tar xvf precise-engine_0.3.0_armv7l.tar.gz

Now you should have the latest version of the precise-engine installed.

Installing mycroft-precise fork

Anytime you have to start using a fork of a project you are setting yourself up for a bit of work. At this time I am setup with the dev upstream release of mycroft-core and I am installing my fork of mycroft-precise into the venv. The issue with this is when Picroft restarts it will pull down the latest dev and this can clobber the locally installed precise. I think in the end I will fork mycroft-core as well and run on both forks and manage my own upgrade process of the forks from upstream. This is not an ideal setup for people looking for a set it and forget it type PA but I am going to be creating custom skills and contributing where I can so this works for me.

# clone the fork (change url if you will be working on your own fork)
git clone https://github.com/jessecooper/mycroft-precise.git
cd mycroft-precise
# while in the mycroft venv run
pip install -r requirements/requirements.txt
pip install .

Mycroft wake word config

With all of this done it is time to configure Mycroft to use the custom listener. Edit ~/.config/mycroft/mycroft.conf to use the custom listener:

  "listener": {
    "wake_word": "jarvis",
    "phoneme_duration": 240
  },
  "hotwords": {
    "jarvis": {
      "module": "precise",
      "phonemes": "JH AA R V AH S .",
      "threshold": 1e-20,
      "lang": "en-us",
      "local_model_file": "/home/pi/jarvis/models/jarvis.pb",
      "sensitivity": 0.5,
      "trigger_level": 3
    }

Of course replace jarvis with the name of your custom wake word.

The final thing to do is restart your Mycroft services.

mycroft-stop all
mycroft-start all

Conclusion

This is how I have set up Picroft with a custom wake word. I am sure one could get more stability if they went with the master version of mycroft-core and trained the wake word on mycroft-precise 0.2. I personally do not mind working off of my own forks because I like contributing back to projects like this where I can but this is not a path for everyone. One very awesome thing about having a custom wake word that you have only trained with your voice is that I find it only response to my voice. This is different from most commercial PAs where you can walk into someones house and potentially just start messing with a persons PA. It may take a few training sessions to get it dialed in but it is fairly rare now that I get a false positive.

Part 3 of this build will take some time to come out as I am a person with way to many projects. One of those being a Codeholics theme redesign. For that post I will either go into getting the Mycroft GUI up or creating a custom skill. If you have enjoyed either of the posts on my Mycroft setup please think about becoming a sponsor.

Mycroft Personal Assistant Setup Part 1

2021-10-05T07:39:00-04:00

Intro

I have been fascinated by voice computing/electronic personal assistance for many years now but I am not a fan of inviting big tech into my home with a black box speaker. Because of this I have always looked for a open source solution. Early on, I was doing a bit of work with Jasper but I quickly ran out of time to play with that project. Over the years as electronic personal assistance become more popular I continued looking for a open alternative. In a conversation with a friend, I was pointed to the Mycroft project. I purchased a Raspberry Pi 4 for another reason and ended up not need it so it was looking for something to do with it. In another conversation a friend pointed me to the ReSpeaker 2-mic Pi Hat. So, all the pieces were falling into place all I needed was a little speaker that I was able to find fairly easy.

Hardware List

part	cost
Raspberry Pi 4 Cancan Kit	$106.24
ReSpeaker 2-mic Pi Hat	$12.74
MakerHawk 4 Ohm 3 Watt Speaker	$9.75
JST XH 2.54mm 24 AWG	$2.56
7" LCD Touch Screen	$53.00
7" Display Case	$12.99

Total: $194.72

The Build

The Raspberry Pi 4 Cancan kit comes with every you really need to get going with the Pi4 and the power cable has a on/off switch that is actually a really nice feature to have. The case the kit comes with works alright with the ReSpeaker 2-mic Pi Hat. The only drawback is you will not be able to close the top when the hat is on but that is alright because you need to attach the speaker to the JST speaker port. The MakerHawk speaker comes with a JST-PH 2.0mm connection. The ReSpeaker hat has a JST XH 2.54mm plug. I cut the JST head off the speaker and crimped on a 2-pin Dupont connection to the speaker and the JST XH lead. The ReSpeaker hat has a power connection on it. This was a bit confusing to me because I was not sure if I had to plug the power into the hat and none of the docs were very clear on this. I started out with it plug into the hat but while doing the software setup I got some odd behavior and ended up moving to the normal power port on the Pi4. I think this could be caused by the different power requirements between the older Pi models and the Pi4 but either way it is not needed to operate the hat.

*ignore Snowball and Topping MX3

Software Setup

Mycroft has a image that is ready made for the Pi called Picroft. I downloaded the image and used dd to set up the sd card for the Pi. If you need any help doing this we have a small post about creating bootable flash drives that covers the process. Once the sd card is ready and loaded into the Pi this is where the fun starts. Picroft has a setup wizard that tries to walk you through the setup of your device but with this build being fairly custom the simple path was not the road I could travel. This led me down a long road of trial and error. First thing was getting the ReSpeaker hat setup and detected. The process for installing the driver is as follows:

# first make sure your image is updated
sudo apt update
# Second grab the driver from github and install it
git clone https://github.com/respeaker/seeed-voicecard.git
cd seeed-voicecard
sudo ./install_arm64.sh
sudo reboot now

There is an install.sh file in the repo if you desire the 32 bit driver but we are working with the Pi4 so do not run that install it wont work.

After it is installed and you have rebooted you have verify the card is being detected with aplay -l and arecord -l. The output should look something like this:

(.venv) pi@picroft:~ $ aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: b1 [bcm2835 HDMI 1], device 0: bcm2835 HDMI 1 [bcm2835 HDMI 1]
  Subdevices: 4/4
  Subdevice #0: subdevice #0
  Subdevice #1: subdevice #1
  Subdevice #2: subdevice #2
  Subdevice #3: subdevice #3
card 1: Headphones [bcm2835 Headphones], device 0: bcm2835 Headphones [bcm2835 Headphones]
  Subdevices: 4/4
  Subdevice #0: subdevice #0
  Subdevice #1: subdevice #1
  Subdevice #2: subdevice #2
  Subdevice #3: subdevice #3
card 2: seeed2micvoicec [seeed-2mic-voicecard], device 0: bcm2835-i2s-wm8960-hifi wm8960-hifi-0 [bcm2835-i2s-wm8960-hifi wm8960-hifi-0]
  Subdevices: 1/1
  Subdevice #0: subdevice #0
(.venv) pi@picroft:~ $ arecord -l
**** List of CAPTURE Hardware Devices ****
card 2: seeed2micvoicec [seeed-2mic-voicecard], device 0: bcm2835-i2s-wm8960-hifi wm8960-hifi-0 [bcm2835-i2s-wm8960-hifi wm8960-hifi-0]
  Subdevices: 0/1
  Subdevice #0: subdevice #0

Now you will need to set your defaults in pulse audio. The Pulseadio Settings section of the Mycroft audio troubleshooting guide covers this well. There is another setting I had to make to the Pulse audio daemon configuration file to remove a delay in recording after the wake word was triggered. I will place this here while we are addressing pulse audio settings:
Edit /etc/pulse/daemon.conf with the following settings:

resample-method = ffmpeg
default-sample-format = s24le
default-sample-rate = 48000
alternate-sample-rate = 44100

After this restart pulseaudio:

pulseaudio -k #stop the pulse daemon
pulseaudio -D #start the pulse daemon

The last item for the base setup is setting the audio settings in the mycroft.conf file`.
Mycorft will look for configurations in 3 locations:

remote - pulled from the home.mycroft.ai
system - /etc/mycroft/mycroft.conf
user - ~/.config/mycroft/mycroft.conf

I copied the system config to the user location: cp /etc/mycroft/mycroft.conf ~/.config/mycroft/mycroft.conf and made the following change to the change:

   "play_wav_cmdline": "aplay %1",
   "play_mp3_cmdline": "mpg123 %1",

Essentially removing the hardware setting and using the system defaults we set earlier.

Once all this is done you can run a few tests:
mycroft-mic-test
If the results are good you can fire up mycroft:
mycroft-start all
Then run the mycroft cli tool:
mycroft-cli-client
From here it will run you through the setup of your mycroft device and registering it with home.mycroft.ai.

Conclusion

At this point you have a mycroft device. If you are like me and do not want the standard hey mycroft wakeword that uses precise you are getting a bunch of false positives on your wakeword because pocketsphinx is just not accurate enough. In my next post in this mycroft series I will run you through training a custom wake word with Precise to fix this issue. I hope to take this series all the way to the point where the microft devices can be 100% offline.

Using lua-openssl to view x509 attributes

2021-03-25T07:39:00-04:00

Intro

I recently found myself needing to view x509 certificate extended attributes with Lua. I had to search far and wide in posts and documentation for the lua-openssl project so, I decided to try and put it all in one place.

Install lua-openssl

luarocks install openssl

Using the openssl package

For my needs I needed to use the openssl package in the context of Nginx and using the lua-nginx-module but this can be done in any lua application.

-- read in the raw ssl client cert string
for k,v in pairs(openssl.x509.read(ngx.var.ssl_client_raw_cert):extensions()) do
    for x, j in pairs(v:info()) do
    if type(x) == 'string' then
        ngx.log(ngx.WARN, "Key: " .. x .. "type: " .. type(v))
    else
        --ngx.log(ngx.WARN, "Key not string: " .. tostring(getmetatable(x)) .. "type: " .. type(v))
        -- subject alt name
        ngx.log(ngx.WARN, "Key not string: " .. tostring(x:data()) .. " type: " .. tostring(v:info()))
        for key, value in pairs(v:info()) do
            if type(key) == 'string' then
            ngx.log(ngx.WARN, "SAN Data: " .. key .. " type: " .. type(value))
            if type(value) == 'userdata' and string.find(tostring(value), "string")then
                ngx.log(ngx.WARN, "SAN Value: " .. value:toprint())
            end
            else
            ngx.log(ngx.WARN, "SAN Data key not string: " .. tostring(key) .. " type: " .. type(value))
            end
        end
        end
        if type(j) == "table" then
        for k2, v2 in pairs(j) do
            ngx.log(ngx.WARN, "Key: " .. k2 .. "Type: " .. type(v2))
        end
        --ngx.log(ngx.WARN, "Key: " .. x)
        --if type(j) ~= 'nil' then
        --    ngx.log(ngx.WARN, "Value: " .. j:info())
        --end
        end
    end
end

Git GPG Signing Setup on OSX

2021-02-22T07:39:00-05:00

Intro

Setting up Git commit and tag signing with GnuPG on Mac OSX is not as straight forward as one would like it to be. Here are the steps I used to get it set up. Before hand I was getting the following error:

git commit -S -m "test signing"
error: gpg failed to sign the data
fatal: failed to write commit object

Steps

Getting GnuPG setup and configured properly

brew upgrade gnupg
brew link --overwrite gnupg
brew install pinentry-mac
echo "pinentry-program /usr/local/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
killall gpg-agent

Once that is set up configure git

# create a key if you already have not done so
gpg --gen-key
# configure git
git config --global gpg.program gpg 
git config --global user.signingkey <key_id>
git config --global commit.gpgsign true  # if you want to sign every commit

Add signing flag when committing or tagging

git commit -S -m 'Signed commit'
git tag -s v1.5 -m 'my signed 1.5 tag'

Viewing signatures

git show v1.5
git log --show-signature -1

Verifying signatures

# check tag signature
git tag -v <tag-name>
# verify signature before merging
git merge --verify-signatures signed-branch

I hope this is helpful for people looking to start signing their Git commits on OSX.

Kali Linux (rolling) Blank Screen Fix

2020-10-23T13:41:00-04:00

Recently I installed the latest Kali Linux on my old Asus Eee PC Netbook and was met with a blinking cursor _ after install. After hitting Alt+F1 and dropping into a terminal I ran all the updates I could and did a reboot with no change to the DE issue. I did a quick apt search intel to see what Intel packages were installable since this has Intel integrated graphics. In the list I found the xserver-xorg-video-intel package. Once this was installed sudo apt install xserver-xorg-video-intel and
the system was rebooted the DE was able to load with no issues. I seen a lot of posts on the Kali forum about this issue and instead of creating yet another forum account I decided to post the solution here and maybe this will help someone out who finds themself in the same situation. Next on this old Netbook is to try out i3 window manager and see if I can make this old netbook still usable in the modern world.

Moving a website from Wordpress to Pelican

2019-03-01T20:43:00-05:00

Codeholics has been using Wordpress for its site since its launch back somewhere around 2013. It was great for its time but over the years we have had a number of issues. Plainly put the entire site management and work flow needed to be simplified.

Intro: Pelican

Pelican is a static site generator written in Python.

First thoughts when people think static site is bringing it back to dialup days but that is not the case with HTML5 and CORS one really dose not need a overly complicated backend to share content with the world.

Pelican has a very active community with lots of plugins and themes to choose from. The theme system is very simple as it uses Jinja2 templates and the plugins are just small Python functions that register with the Pelican API. Content for Pelican can be written in REstructured text or Markdown.

Since our last issue with backups I had already started writing things in Markdown and using Pandocs to convert that into HTML. Then I would take that and put it into the an article in wpadmin. A clunky workflow for sure but I knew my content was safely tucked away in a personal git server. The most clunky thing about it was formatting after the conversion. Simply, none of this made for a good experience to publish content.

Pelican dose a really nice job of converting Markdown with syntax highlighting and table formatting.

Lets now get into using Pelican and porting over WordPress content.

Since this is Python it's always a good idea to setup a virtual environment:

mkdir codeholics
cd codeholics
python3 -m venv env
source env/bin/activate

Now that the site project directory is set up let's install Pelican and initialize the Pelican site.

pip install pelican markdown beautifulsoup4 lxml
pelican-quickstart

Next let's pull in the content from WordPress first you will need to extract the xml backup from your WordPress site by going to my site->settings->export. Once this is done run the pelican-import command.

pelican-import --wpfile site.xml --wp-attach --markdown

--wp-attach will attempt to go out and get all the article images

--markdown export files in markdown format

Now that the content is imported in to the content folder we can transpile the site.

pelican content/

This command will generate the static site in the output directory. This can now be published or we can run a local Dev server.

pelican listen

This will create a Dev server on localhost:8000

There could be some issues with posts having WordPress plugin globs that didn't convert properly but that can be cleaned up fairly easy.

At this point it's time to customize the configurations, theme and plugins.

The Pelican configuration file is in the root of the project folder named pelicanconf.py. Here is were the defualts, themes, plugins and other conf8guration variables are set.

The pelican-quickstart app pre populates a few of the defaults like AUTHOR and SITENAME.

To get started using plugins you will need to first clone the pelican-plugins repo. I set this up in the parent directory to the project.

git clone https://github.com/getpelican/pelican-plugins.git

Then add the following two variables to pelicanconf.py

# Plugins
PLUGIN_PATHS = ['../pelican-plugins']
PLUGINS = [
    'assets',
    'gzip_cache',
    ...
]

There are a lot of plugins for Pelican and if you cant find what you are looking for it is not to hard to modify or write a plugin.

Last part is picking a theme. A large list of themes can be found at http://www.pelicanthemes.com and the full repository of themes can be found on github https://github.com/getpelican/pelican-themes

Pelican provides pelican-themes a cli tool to help a user manage installed themes but it is not required to use the cli. You can also provide the path directly to the theme.

THEME="/path/to/theme"
# or
THEME="<name>"

To get a list of installed themes pelican-themes -l

More configuration variables can be found in the Pelican docs.

That completes the migration last thing to do is push The new site out to production by uploading the generated content in output or building it into a docker image. Here is a quick and easy Dockerfile to build a Pelican site into a Nginx image.

FROM nginx:alpine
RUN apk update && \                                                                   apk upgrade
COPY ./output /usr/share/nginx/html

Combine that with this docker-compose.yml and you get a quick dev deployment.

version: '3.4'
services:
    codeholics:
        container_name: codeholics_static
        build:               
          context: ..
        dockerfile: docker/Dockerfile
        image: codeholics/codeholics_static
        ports:
          - "8080:80"

To build the image:
docker-compose -f docker-compose.yml build

Run the service:
docker-compose -f docker-compose.yml up

Deploy on a swarm:
docker stack deploy -c docker-compose.yml codeholics

Hope everyone enjoys the new site and content that follow.

Happy Hacking!

Python: working with X.509

2019-02-21T07:30:00-05:00

Intro

This is a note dump of working with x509 in Python. There is not much context to it
just a dump of code snippets.

Needed Packages:

pyopenssl
cryptography

Generating a RSA Private Key:

import datetime
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID

# Generate RSA Key Pair
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)

# Get RSA Public Key
public_key = private_key.public_key()

Generate x509 Self Signed Certificate:

# Build x509 Cert
builder = x509.CertificateBuilder()
builder = builder.subject_name(x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, u'yoururl.com'),
]))
builder = builder.issuer_name(x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, u'yoururl.com'),
]))
builder = builder.not_valid_before(datetime.datetime.today() - one_day)
# Today + 30 days
builder = builder.not_valid_after(datetime.datetime.today() + (one_day * 30))
builder = builder.serial_number(x509.random_serial_number())
builder = builder.public_key(public_key)
builder = builder.add_extension(
    x509.SubjectAlternativeName(
        [x509.DNSName(u'yoururl.com')]
    ),
    critical=False
)
builder = builder.add_extension(
    x509.BasicConstraints(ca=False, path_length=None), critical=True,
)
# Export Self Signed Cert
certificate = builder.sign(
    private_key=private_key, algorithm=hashes.SHA256(),
    backend=default_backend()
)

Generate x509 CSR (Certificate Signing Request):

# Build x509 CSR
builder = x509.CertificateSigningRequestBuilder()
builder = builder.subject_name(x509.Name([
    x509.NameAttribute(NameOID.COMMON_NAME, u'yoururl.com'),
]))
builder = builder.add_extension(
    x509.BasicConstraints(ca=False, path_length=None), critical=True,
)
request = builder.sign(
    private_key, hashes.SHA256(), default_backend()
)

Write CSR to a file:

with open('yourname.csr', 'wb') as csr:
    csr.write(request)

Looking at date in PEM certs:

>>> from OpenSSL.crypto import FILETYPE_PEM, load_certificate
>>> with open('pki_ca.pem', 'rt') as cert:
...         pk = load_certificate(FILETYPE_PEM, cert.read())
>>> pk.get_notBefore()
b'20190212080550Z'
>>> pk.get_notAfter()
b'20290209080620Z’
>>> pk.get_issuer().get_components()
[(b'CN', b'auto.localhost.local')]

Load Private Key, PEM Certificate and CSR:

>>> from OpenSSL.crypto import (
FILETYPE_PEM,
load_certificate,
load_certificate_request,
load_publickey
)
# Load CSR and others with the same style just use the proper loader
>>> with open('mycsr.csr') as csr_file:
...   csr = load_certificate_request(FILETYPE_PEM, csr_file.read())

Check Signature of CSR certs:

with open('test_pub.pem') as pem_file:
...   pem = load_certificate(FILETYPE_PEM, pem_file.read())
...   bool(csr.verify(pem.get_pubkey()))
...
True

Working with CA CRL:

When working with Client SSL certificate verification one will run into the problem of creating a CRL PEM file of the
Root CA's CRL file and its Intermediate CA's CRL files. This could come in a binary DER format that will need to be
converted to PEM. Multiple PEM CRLs can be saved to a single concatenated file.

# Load DER format CRL
from cryptography import x509
from cryptography.hazmat.backends import default_backend
with open('/tmp/crl/DODSWCA_54.crl', 'br') as crl_file:
    crl = x509.load_der_x509_crl(crl_file.read(), backend=default_backend())

# Cryptography >=3.4.5 you can omit the backend arg

# Save CRL Object as PEM format file
from cryptography.hazmat.primitives import serialization
with open("/tmp/crl/test.crl", "wb") as crl_file:
    crl_file.write(crl.public_bytes(serialization.Encoding.PEM))

How to Install libcouchbase on OpenSuse to use the Couchbase Python Module

2019-02-20T16:06:00-05:00

OS: OpenSuse Tumbleweed

Here are the steps to get libcouchbase installed on OpenSuse:

Get dependences:

sudo zypper in libev-devel cmake openssl-devel

Get source:

git clone https://github.com/couchbase/libcouchbase.git

Run config and build:

cd libcouchbase
mkdir build
../cmake/configure
make

Run tests:

cmake

Install:

sudo make install

Load newly installed libcouchbase shared objects:

ldconfig -v

Install Couchbase Python Module:

pip install coucbase

Displaylink DK1522 Issue after OpenSUSE Leap 42.3 Upgrade

2017-12-20T15:19:00-05:00

It is the end of the year and the time I use to upgrade my Lenovo P50 to the latest OpenSUSE Leap version. I do it this time of year because I expect to have some issue that I will need to work through after the upgrade and since this is my work machine I pick a time of year when the office is quite and all the major projects are completed for the year.

I am not going to go over the upgrade process as this is well covered in the OpenSuse documentation and other posts. The upgrade from 42.2 to 42.3 was in fact fairly smooth. The things that I expect to have problems with are the Displaylink DK1522 dock since it was a fairly involved process to get it running in the first place since they only officially support Ubuntu and the Nvidia display driver. Once the upgrade was completed and the dust settled. I plugged in my Displaylink DK1522 and hit 'Meta+D' the shortcut I have mapped to run a shell script with the xrandr commands to setup the external displays. As I anticipated nothing happened and with that it was time to start digging. Looking over a few things I see the dlm service has errored out and there is some log errors.

First thing I did was check the Displaylink site expecting a new version of the Linux drivers. I was running the 1.2.x version and they recently released 1.4. This was exciting because I was having some screen paint issues that were fairly annoying. After downloading their package if you are using anything other than Ubuntu you will need to make so
adjustments to the displaylink-install.sh script. After unzipping the file unpack the displaylink-driver-1.4.210.run.

./displaylink-driver-1.4.210.run --noexec --keep

Then navigate to the displaylink-driver-1.4.210 file.

Copy displaylink-installer.patch into a
displaylink-installer.patch and apply the patch.

patch displaylink-installer.sh displaylink-installer.patch

Once this was done and I went to install it. I got an error when it was building the evdi module. I have filed a issue on github that also has the work around: evdi-issues-110

To apply the fix to evdi copy the text from Github into a patch file evdi_fb.patch and extract the evdi-1.4.210-src.tar.gz package.

mkdir evdi
tar xzf evdi-1.4.210-src.tar.gz -C ./evdi
patch ./evdi/evdi_fb.c ./evdi_fb.patch
tar czf ./evdi-1.4.210-src.tar.gz -C ./evdi .

Once the change is made to the evdi package it should install as intended.

After the module package was installed I hopefully plug in my displaylink and hit 'Meta+D'. Once more nothing happened. Looking at the logs I started seeing these type of errors:

...
Dec 19 11:24:02 linux-olhs.suse kernel: evdi: disagrees about version of symbol drm_framebuffer_cleanup
Dec 19 11:24:02 linux-olhs.suse kernel: evdi: Unknown symbol drm_framebuffer_cleanup (err -22)
...

I tried loading the module manually with modprobe evdi and got the following error.

modprobe: ERROR: could not insert 'evdi': Invalid argument

The 'dkms status' command showed everything was install properly

After googling for hours and trying lots of non-solutions I noticed a similar log error for my nvidia driver. The lead me to try and reinstall the nvidia driver and it was erroring out. I went back to see if things had changed on the OpenSuse / NVidia driver front and to my delight there is now a NVidia supported OpenSUSE repo for OpenSUSE leap and Tumbleweed.

NVidia drivers have been a thorn in my side for many years so I was excited to add the repo and zypp my problems away.
Reading the steps lead me to the problem with the Displaylink driver:

sudo zypper rm drm-kmp-default

After removing this package and install the new NVidia driver all my issues were resolved. With the new Displaylink driver I no longer have the screen refresh issues I had with the prior version.

I also can not wait to use this nvidia repo on my tumbleweed desktop. This should make upgrades a lot less of a hassle. I hope this post helps anyone with a similar setup to mine who might be experiencing a similar issue.

Defcon1

2017-10-09T13:41:00-04:00

If you have a backup and you never test that backup you do not have a backup. - Unknown

I do not remember where I read this quote but it always resonated with me. Especially sense disaster recovery was one of my major responsibilities for a globally used web application. Much like the mechanic with the broken car. I was a little less diligent adhering to this rule in my side projects.

Codeholics is a small side project between a few friends with a passion for technology. We like to share some of the knowledge and lessons learned (good or bad) we encounter along the way. As such, we use shared hosting because it is affordable and WordPress because its a simple platform to share information with a lot of plugins. We had constant issues with our last shared hosting provider Webhostingpad.com. With no response to our constant borage of tickets trying to get our site back online after they preformed a server migration to our account we finally decided it was time to try someone else.

We found a new home over at A2 Hosting and dumped and dropped all the databases from our Webhostingpad account. When we tried to restore the database to our new instance of Wordpress the instance would bottoming out. This lead to low level analysis of the table structure and the .sql dump file. Here is what we found:

The table structure in the backed up database and the newly created database had some major and alarming differences.

wp_posts - missing from backup
wp_users - missing from backup
assortment of extra tables created by plugs littered the old database

At this point I am grepping and scouring the .sql file for anything that might resemble post data. The thought was maybe one of these plugins moved the data into one of these random tables but it was no where to be found.

Now I am freaking out because to the fault of my own I wrote the post directly into Wordpress and lived in blissful ignorance until it was to late.

Right before passing out for the night with that pit in my stomach that all System Administrators know and hate of just getting caught with your pants down. I had a sudden idea: What if we check Archive.org to see if it has the site cached in the WayBackMachine. I grabbed my tablet that I keep next to my bed and started searching and seen they had a archive from April 30, 2016. This was older and we would lose a few posts but it was better than losing it all.

The next day I saved one of the posts and started examining it for the HTML tags that held the post content.

<h1 class="entry-title"> - has the post title
<div class="td-post-content"> - has the body of the post 
<time class="enctry-date update td-module-date" datetime=""> - had the post time stamp
<link rel=canonical ...> - this had the post permalink title

At this point I had already decided I would not mind download the files by hand to see what was available but I was not willing to do all the rebuilding of the database by hand. This part of the job I would do with Python. The packages I used would be as follows:

Python:

Beautifulsoup - parse the HTML files
SQLAlchemy - to create a object relational map (ORM) between python and the MySQL database.
mysqlclient - client used by SQLAlchemy for mysql.

System:

libmysqlclient-devel - dependency of mysqlclient python package

The wordpress wp_posts table structure is as follows:

Field Type Null Key Default Extra

ID bigint(20) unsigned post_author bigint(20) unsigned post_date datetime post_date_gmt datetime post_content longtext post_title text post_excerpt text post_status varchar(20) comment_status varchar(20) ping_status varchar(20) post_password varchar(255) post_name varchar(200) to_ping text pinged text post_modified datetime post_modified_gmt datetime post_content_filtered longtext post_parent bigint(20) unsigned guid varchar(255) menu_order int(11) post_type varchar(20) post_mime_type varchar(100) comment_count bigint(20) NO PRI NULL auto_increment NO MUL 0
NO 0000-00-00 00:00:00
NO 0000-00-00 00:00:00
NO NULL
NO NULL
NO NULL
NO publish
NO open
NO open
NO
NO MUL
NO NULL
NO NULL
NO 0000-00-00 00:00:00
NO 0000-00-00 00:00:00
NO NULL
NO MUL 0
NO
NO 0
NO MUL post
NO
NO 0

My SQLAlchemy class to wrap this table:

Base = declarative_base()
#Post Object
class Post(Base):
    '''wpcp_posts table schema object'''
    __tablename__ = 'wp_posts'

    ID = Column(BigInteger, primary_key=True)
    post_author = Column(BigInteger, default=0)
    post_date = Column(DateTime, default='0000-00-00 00:00:00')
    post_date_gmt = Column(DateTime, default='0000-00-00 00:00:00')
    post_content = Column(String, default=None)
    post_title = Column(String, default=None)
    post_excerpt = Column(String, default='')
    post_status = Column(String, default='publish')
    comment_status = Column(String, default='open')
    ping_status = Column(String, default='open')
    post_password = Column(String, default='')
    post_name = Column(String, default='')
    to_ping = Column(String, default='')
    pinged = Column(String, default='')
    post_modified = Column(DateTime, default='0000-00-00 00:00:00') 
    post_modified_gmt = Column(DateTime, default='0000-00-00 00:00:00')
    post_content_filtered = Column(String, default='')
    post_parent = Column(BigInteger, default=0)
    guid = Column(String, default='')
    menu_order = Column(Integer, default=0)
    post_type = Column(String, default='post')
    post_mime_type = Column(String, default='')
    comment_count = Column(BigInteger, default=0)

    def __repr__(self):
        return "<Post(post_author='%s', post_date='%s', post_date_gmt='%s',   
               post_content='%s', post_title='%s', post_excerpt='%s', post_status='%s',   
               comment_status='%s', ping_status='%s', post_password='%s', post_name='%s',   
               to_ping='%s', pinged='%s', post_modified='%s', post_modified_gmt='%s',   
               post_content_filtered='%s', post_parent='%s', guid='%s', menu_order='%s'   
               post_type='%s', post_mime_type='%s', comment_count='%s')>" %   
               (self.post_author, self.post_date, self.post_date_gmt, self.post_content,
                 self.post_title, self.post_excerpt, self.post_status, self.comment_status,
                 self.ping_status, self.post_password, self.post_name, self.to_ping,
                 self.pinged, self.post_modified, self.post_modified_gmt,
                 self.post_content_filtered, self.post_parent, self.guid, self.menu_order,
                 self.post_type, self.post_mime_type, self.comment_count)

Now that I had my ORM to the database. I just needed to write a little code to look at each of the .html files in a path and grab the good stuff from them with beautifulsoup

...
    # list path html files and import them
    for html_page in os.scandir(path):
        # Beautiful Soup Setup (open html page)
        with open(os.path.abspath(os.path.join(path, html_page.name))) as html:
            page = BeautifulSoup(html, 'html.parser')

        # Title
        title = page.find('h1', {'class': 'entry-title'})
        # Permalink
        post_name = page.find('link', {'rel':'canonical'})['href'].split('/')[-2]
        # post timestamp
        timestamp = datetime.strptime(page.find('time').get('datetime'),
                                     '%Y-%m-%dT%H:%M:%S+00:00')
        # build content from p tags in td-post-conent
        content = ''
        for x in page.find('div', {'class': 'td-post-content'}).find_all('p'):
            content += x.prettify()
...

Once all the content that was needed was stripped from the HTML pages. I created an post object and inserted it back into the database.

...
    post = Post(post_title=title.string,
                    post_author=1,
                    post_content=content,
                    post_name=post_name,
                    post_date=timestamp,
                    post_date_gmt=timestamp)
        # insert into database
        try:
            db_conn.add(post)
            db_conn.commit()
        except Exception:
            raise

Once I had these components I ran the script on the fold with the .html files. After it completed I took a dump of the local mysql Wordpress database and uploaded it into devel to check the results.

The full Python script can be viewed here on our github.

I have always said I have learned more from the things that have broke than the things that worked and this was no exception. I had been wanting to use these Python packages for sometime and this gave me the need to use them. I also want to give a shout out to Internet Archive at archive.org. Without their amazing work all would have been lost. I encurage people to donate to archive.org as I will be as a 'thank you for saving my ass'.

Codeholics is currently undergoing redevelopment

2017-04-29T04:04:00-04:00

Devel - We had to leave our old hosting provider "Webhostingpad" due to their system stability and service quality. Our new host has better hardware, bandwidth, security, and a stronger commitment to taking care of their customers.

We initially went offline due to a technical issue on webhostingpads side after they moved our domain to another server. We tried to work with their support staff for weeks which they kept telling us it was something that was not part of the problem. After weeks of downtime and lack of the support staff responding or following up was so nerve racking to the point we closed our account with them after being a customer for well over 10 years.

We then tried to restore the site but was unsuccessful due to plugins messing up our database tables to the point of no recovery. We're currently exercising our very last DR plan, however, this process will take a while. Please make sure to stop by and check in time to time or follow us on facebook for the new site launch. While we're working on the rebuild you're welcome to look around, just know your experience may not be optimal.

Thank you,
TheBleak

The Poor Mans DynamicDNS

2016-04-14T19:57:00-04:00

A few years ago I had an issue where I needed a DynamicDNS service or some sort. I didnt want to pay for it and got the thought in my head to just write my own script that suited my need. The things it needed to do was check if public IP had changed and send that change to me in some way so I could update my host file on my laptop. Fairly simple but effective to make sure I always knew how to phone home. I wrote a quick hacky python script to get the job done and it has been working for me for a few years now flawlessly.

Click here
to go to the Github repo

Install:

first figure out where you would like script to live and run:

git clone https://github.com/Codeholics/ipchecker

Then edit ipchecker.py with your favorite text editor and add your info to the vars:

#
#IP File
#

FILE = /path/to/ip.dat #File where it stores your IP to compare to

#
#SMTP Options
#

EMAIL = your@email.com
SMTPHOST = localhost
SENDER = name@email.com

Once this is done create a cron job in /etc/cron.d/ with the following schedule it however you would like:

# Check current IP and send an email if it has changed

20 4 * * * [user] python /usr/local/bin/ipcheck.py

The only issue with this is it will get filtered by any spam filter when it is sent from a residential dynamic IP address. You will need to mark it as not being spam or if you notice you cant get into your system check your spam folder.

The script queries a site with curl that returns your public IP address then it checks that IP with the one inside the ip.dat file. If it is different than it emails out the new IP address and writes the new address to the ip.dat file.

Enjoy

Book Review: The Phoenix Project

2016-04-07T22:25:00-04:00

Note I:
So this is finally the beginning of this review, and in the interest of full disclosure Ive been sitting on this review for a long time, longer than I really should have, but writing a review of this book actually seems a little daunting.

Note II:
As this book is a narrative, the review will have some spoilers

The Phoenix Project is a book that anyone who works in Software Development should read. And when I say anyone, I mean ANYONE. Product Owners, Project Managers, IT, Developers, QA all levels of development. The book tries to do the impossible, and bring to light the answer to the quote ITs work for deployment is invisible p.253

***SPOILER filled review starts HERE***

Book starts with a company which has got a major, over-budgeted, overdue, full of bugs, project that needs to go out the door and save the company. And the main, Bill Palmer, just got promoted to VP of IT Operations, and inherited the crap-shoot of a project.

As the book progresses, problems are brought to light that leads the main character to develop processes and rigors to overcome the problems. And along with these new processes and rigors, the reader is brought along the thought process of course correcting and fixing not just your product but actually also your process.

I will digress here and say as the reviewer, I feel obligated to reveal to you, the reader, that I have a long background with Software QA, and during my career as a QA person, the one thing that guided how I approached any of my positions was this one goal, QA the product, QA the process. No process is perfect for the team or the work at the time, so constant review of the process is definitely necessary. Now back to the book.

Throughout the book, key knowledge drops were abound. Fun quotes like the following:

Your problem right now is that you obviously dont actually know what work is

Eliyahu M. Goldratt, . any improvements made anywhere besides the bottleneck are an illusion.

Preventative work supports the company

Until code is in production, no value is generated.

Anyone whos worked in the software industry already knows a lot of this stuff, and have probably already implemented some of the solutions to the common problems. However, the book is rife with as many different challenges as possible, which is why I believe this book is worth reading, even if youve been in the industry for 50 years.

But theres an answer that I was looking for, that this book doesnt provide. And that is the only place where I feel the book is lacking.

The people in the book, all its characters, are supposed to be the avatars for their respective departments (QA, Internal Audit, Dev, Product Owner, CEO, etc etc) At the beginning of the book, even through the first 70 pages, conflict exists across all teams, with finger pointing and blaming everywhere. Even the CEO was throwing fingers and blaming in a ready, SHOOT, aim fashion.

It is because of these conflicts that I read through the book. The other knowledge pearls were a plus, but I was looking for an answer; something to help me and my team get better at interacting with each other. You see, the left overs from the Waterfall process, are the items where people point fingers based on responsibilities. And there has to be a way to help with that transition process from Waterfall to Agile, without just first getting rid of people who were still mentally Waterfall.

It can be said that, without teamwork, none of these solutions and knowledge pearls can be achieved and the book never answers how the teams can get in alignment its here where the book waves the proverbial Hand of God.

Is the book worth reading? DEFINITELY.

Is it the ONLY book worth reading? definitely NOT.

So please do yourselves the favor, buy the book, read the book, and gain all the knowledge pearls the book offers, because at the end of the day, this book really does provide a whole crap ton of them.

Buy on Amazon:

http://www.amazon.com/Phoenix-Project-DevOps-Helping-Business/dp/0988262509

Understanding Linux Basic Disk Partition Setup

2016-03-25T11:30:00-04:00

Recently I was asked the question what are the needed Linux partitions and what are they for? With that I thought it would be a good post because this is something that is very overlooked since distro installs have become so simple most people just go with the defaults, but as always it is important to know what is going on under the hood. I will go over a minimal disk configuration and with a minimal disk configuration you only need three partitions.

The first and most important partition on any Linux disk layout is the /boot partition.

The /boot partition holds your boot loader and boot loader configurations and Linux kernel images. This partition only needs to be about 300 to 400MB.

The next partition would be your swap partition. This is disk space the system will use under heavy memory usage. The swap partition should very in size based upon your systems memory configuration. Here are some rules of thumb when configuring your swap partition:

The last partition in the list of minimum need partitions in a Linux system is the / root partition. The root partition should be the remained of your hard disk under a basic setup. This partition will have all your user and application files.

This is by far this most simplistic setup of a disk on a Linux system and most automated configurations will do a more complicated setup of the disk using LVM (Logical Volume Manager) to manage the / root and swap partitions. In any configuration though under any file system type, manager or raid configuration the /boot, / and swap partitions are still the minimum partitions needed for a Linux system.

Thirty years of Mac ads (1984-2014)

2016-03-05T11:00:00-05:00

How to make a motherboard a GIGABYTE Factory Tour

2016-03-04T13:02:00-05:00

How to make a motherboard a GIGABYTE Factory Tour

How a CPU Works

2016-03-03T13:00:00-05:00

How a CPU Works:

How Lexar Makes SD cards

2016-03-03T07:46:00-05:00

Get the exit code of a bash command

2016-02-25T16:00:00-05:00

If you want to see the exit status of a Linux shell command in bash use the variable
$?
This will return the exit status of the last command.

Now this will only give you the right most exit code if you are piping a command.

~> ls | sort

the last command sort would be the exit code in
$?

How To Reveal The Password Hidden Behind Asterisks

2016-02-19T11:00:00-05:00

How To Reveal The Password Hidden Behind Asterisks: Google Chrome, Firefox and other browsers hide passwords behind asterisks but I will show you How to See your Passwords Hidden Under Asterisks field from password to text and hence the password is revealed as the text input.

Book Review: Ready Player One

2016-02-18T19:14:00-05:00

Book Series: Ready Player One

Author: Ernest Cline

Once having heard this book being described as Willie Wonka meets World of Warcraft, the description seemed very attractive. And in no way does the description not ring true. Ernest Cline had a lot of fun writing this novel as he did marketing it.

Beyond the book, he even tied a three month Easter egg hunt to enhance the experience of reading the book. Readers of the first edition hard cover were treated with having to find a riddle in the book, answering it led to a website. At this website theyd have to beat a video game , then repeat all steps tree times. Ultimately at the end , the winning reader won a DeLorean with a built in flux capacitor.

All of this ties to a novel that has the joys of an online video game adventure combined with a fun childish mystery. At the beginning , readers will be introduced to a world where the eighties are everything and the people with the most knowledge will have the greatest advantage.

And although the protagonist seems to be a character that might not seem worthy of the readers cheers at first, as the story picks up, theyll suddenly find themselves rooting for him out loud.

This isnt meant to be the most believable book. Its requirement of disbelief extends as far as any Harry Potter and Lord of the Rings or Percy Jackson. But beyond that disbelief, there are some references to the eighties that might be too obscure for some younger readers. Those readers should be prepared to read along side the Internet, just in case the occasional Google search is required.

To know if this book is for you, ask yourself the following. Are you a person who likes rooting for people? Have you watched shows like The Amazing Race, and liked it? Do you like geeky nerdy 80s pop culture references? Do you like video games? Do you root for the underdog?

If youve said yes to any of those questions, this book is for you.

BUY IT ON AMAZON!

Ready Player One!

Book Series: Zero Day + Trojan Horse

2016-02-10T17:13:00-05:00

Book Series: Jeff Aiken series

Author: Mark Russinovich

Mark Russinovich has provided an immeasurable difference in the computing world. As a co-founder of Windows Internals and now Microsoft Azure CTO, its hard to imagine that Mark has more to give. However with these two books, he once again has given another positive to the people of this industry.

It goes without saying that media and entertainment avenues struggle sometimes to compromise technological realism with entertainment, but Mark has provided a series that seems to be tailored specifically for the geek in all of us.

Just like most thrillers both books get you with a hook, but Marks style follows up the flash with a slow burn. The story simmers and gives the readers time to breathe and take in the technology. Part of this pace is due to Marks none forgiving attention to detail. Traditional thriller readers might get turned away, but techies will enjoy the extra information.

The series follows a character named Jeff Aiken, who isnt your normal spy thriller character. However, just like other information thrillers, such as the Dan Brown series Da Vinci Code and Angels and Demons, the lead character is intelligent on his feet, and makes nerds look good.

Though, as a forewarning, the content in both books are definitely reliant on the technology at the time. With Zero Day in 2011 and Trojan Horse published at 2012, the technology mentioned is definitely outdated by todays standards. So if youre a super techie, youll have to keep that in mind. However, this shouldnt ruin the books for you, as the books definitely live up to the thriller in techno-thriller.

These books are a great pickup and a great pair of books as part of any techies library.

Buy the books!

Zero Day

Trojan Horse

7 Gamers, 1 CPU Ultimate Virtualized Gaming Build Log

2016-02-03T19:41:00-05:00

Book Review: Influx

2016-02-03T05:33:00-05:00

Book Series: Influx

Author: Daniel Suarez

Daniel Suarez has always had my interest with the technological thrillers that hes written. When I first was introduced to Daemon, it was an adventure that caused me to read the book in a very short period of time.

In all his books, theres always been a hint of bleeding edge technology driving the story line, with humanity as a topic in tow. And this book is no exception, however Arthur C. Clarkes third law seems to apply here.

As a person reads this book, the first couple of chapters really sets up a situation where someone would have to take the information as a leap of faith. The real story doesnt really occur until maybe 30% into the book. This has deterred some people in the reviews, and I dont fully disagree with them. But now that Ive read the whole book, I wouldnt really change a word.

The use of magical science dictates the need for an explanation of the science, which means. a dry first 1/3 of the book. The beginning really sets the book up to be more of a sci-fi novel than a thriller, but the key to this book is the turn and the finish.

Unlike the beginning, the middle and end of the book is the rest of the roller coaster ride. The book can, in no way, be described as anything other than a thriller. And a fun one to boot.

So my advice to anyone who starts to read Influx, start and push through. And youll eventually feel drawn in, like gravity.

Enjoy the ride.

Buy the book on
Amazon!

LVM: Move a logical volume into a new volume group.

2016-01-22T08:23:00-05:00

OS: nix
Require: LVM, the power of root
Skill Level:* Intermediate

Here is how to move a logical volume into a new volume group in LVM using vgsplit

Lets say you want to change the volume group settings for some of your logical volumes or you just want the logical volumes better organized.

Use vgsplit to move your logical volume to its new volume group.
Check out your new volume group with the logical volume you moved:
Activate your logical volume and re mount it. Make sure to update the mapping in your fstab to the new volume group name that your logical volume resides under now.
Go get coffee

Getting Started with Metasploit in Kali Linux

2015-07-24T16:51:00-04:00

OS: Kali Linux
Skill Level: Intermediate
Prerequisites: Linux CLI, Basic Networking Concepts, PostgresSQL

Metasploit is the closet thing to push button security and penetration testing one can find. It is by far the most popular security testing framework. Metasploit has thousands of modules and is growing daily with a very active community getting modules for exploits out not long after they have been reported. The framwork is written in Ruby so, if that is your language of choice you might want to join in on the action. No InfoSec teams tool kit should be without this tool when trying to keep the castle walls strong against would be attackers. Since it is open source and widely available in most Linux distros you can bet someone might try or be trying some of these modules against your network and systems as you read this.

Real life use case:
I was able to identify and finger print a DOS (Denial of Service) attack and find a module in Metasploit to replicate the attack and help an InfoSec and Network Team strengthen the configuration of the IPS (Intrusion Prevention System) and block out attacks of this type. Later on I will come back with a post about (D)DOS attacks and preventative measures. Lets get started with setting up Metasploit with a PostrgesSQL database in Kali Linux.

First of install kali linux we assume you got that covered.
Open a command prompt and type (as root or with sudo): # service postgressql start
this will bring up the postgres database
Bring up the metaspoit service

Since this is your first time running it. It will detect that postgres is running and set up the Metaspoit database.

Now its time to play and run the Metasploit console

Now lets get started with understanding workspaces. Workspaces help separate testing information.

to see all the options for the workspace command:

Lets add a workspace:

now if you type workspace you can see you are using the test1 workspace instead of default.

the first step of security tests is reconnaissance to gather information about a system or environment. We can do this using nmap. Nmap is a port scanning tool that can identify services running on a system and try to figure out the operating system running on that system. Metasploit has nmap built in and can add the results straight to the workspaces database so the results can be easily filter through to find systems with services that you want to test with a specific module. The nmap module is call
db_nmap and you can pass it all the same commands you would when using nmap outside of the metasploit framework.

Nmap will do its thing and now you will have that information in your database.

to look at the information we have gathered use the hosts and services commands.

hosts: Shows all host information like DNS name and OS type.

services: Shows all running services the port scan picked up and what service they might be.

As with all commands you can pass them the -h and get help information. The most helpful I found was filtering services out by port number and adding them to the RHOST global variable.

This will add all hosts that have a service running on port 80 to the RHOST global variable. This is most likely a web server because port 80 is the standard HTTP port. We can check the variable values by using the set commands this is also used as you might have guessed to set a variables value:

This is important for setting up variables for modules to run.

To select a module to use we type use [module]. Module are broken up in categories such as auxilary then broken down further from there. I guess I can not leave this hanging without running a module against our RHOST that we set, so lets run the module that helped ID the attack in the beginning of this post.

check the variables with set but we should be good to run at this point since we have a host running a web server. If you go to run it and get and error it is probably do to the interface not being set correctly. If you are on wireless use:

now exploit:

It should start sending a synflood to the host you have selected. Since you are doing this to a lab system or a system you own (disclaimer :-)). Log on and check the activity with netstat -t you should see a bunch of this:

Now if this was behind a properly configured IPS or IDS it would get blocked, alert the interested parties and service would continue with normal users not noticing anything. Now go have some fun with the other module and make sure the walls are strong and systems are secure. I will try to cover some more modules later as I go deeper into web application security.

Links:
https://www.kali.org/Kali Linux

https://www.metasploit.com/Metasploit

C4android Programming on your Android devices in C/C++

2015-07-20T05:28:00-04:00

I love mobile computing, and I love coding. It is only natural that I would want to do some coding on the go. C4android lets you do just that if you enjoy coding in C/C++ and want to do it easily on your Android device. C4android is a nice lightweight IDE that interfaces nicely with the GCC compiler and GDB debugger making it easy to work on any size C/C++ project while on the go. It is also great if your going over an eBook. You can flip back and forth between the book and C4android to test out code examples. This was by far the best \$3 I ever spent on an app and would have spent more if asked to.

Check out C4android on the Google Play Store:

https://play.google.com/store/apps/details?id=com.n0n3m4.droidc

Make a Bootable Flash Drive from an ISO file in Linux

2015-07-17T19:59:00-04:00

Make a Bootable Flash Drive from an ISO file in Linux

OS: nix based systems
Skill Level: Beginner
Prerequisites:* Terminal, The Power of Root

There are a few ways of creating a bootable USB drive. This is my preference. Using dd is quick, easy and available on all *nix systems. In fact, most GUI tools are just dd wrappers, so lets cut out the fluff and get down to it.

Figure out the device path to your usb drive:

sudo fdisk -l

This will list all your drives:

Now using dd use the following command of course replacing the path with the path to the ISO image you want to use on the removable device.

sudo dd if=/path/to/a.iso of=/dev/sd(x) && sync

This might take a few minutes, but once it is done boot from the removable device.

Google Chrome Development Tools for Web Apps

2015-07-08T15:30:00-04:00

Google Chrome Development Tools for Web Apps

I have been doing some web app coding recently and thought I would share some of the helpful development tools that are available in Google Chrome. Especially when coding for multiple devices. I will skip over the basic things that have been in all browsers for a long time like viewing source and get to the goods.

Hit Ctrl+Shift+I if your a Hot Key Ninja or got to options in the upper right hand corner and navigate to More Tools -> Development Tools and you should see this appear on the right hand side of your page.

Now lets go from my favorite feature on down first view on mobile device just click the phone icon

and it will nicely display your web app as it would be viewed on a mobile device

Now lets dive deeper into the mobile options:

Device: Select from a long list of Apple and Android devices to test your mobile application on.

Network: Select different bandwidth simulations to test your app against to see load times

Clicking this will rotate the screen 180 degrees.

Now lets say some items or not lining up correctly and its time to trouble shoot it. The development tools allows you to inspect elements of the page and edit attributes so you can see what effects changes will have on your application user interface in real time.

These development tools should be helpful to anyone developing web apps for todays multi-device world.

Microsoft Visual Studio and SQL Management Studio error Exception has been thrown by the target of an invocation

2015-06-18T14:56:00-04:00

I recently ran into an error one day trying to open my SQL Management Studio application. I have been using this application for years now but one day it just would not launch and just displayed an error message Exception has been thrown by the target of an invocation.

I found this error is more common with Visual Studio but I can see how this might also affect more than just Microsoft applications.

In order to fix this you will have to manually edit your registry. This error is caused because the PATH value is more than 2078 characters long. You can remove the lines for applications you no longer use or shorten the path to resolve this issue.

This is how to fix it:

More Docker: Dockerfile to build a MongoDB Image

2015-02-26T03:43:00-05:00

Last post (Getting Started With Docker) I ended off with saying I would come back and show how to set up a mongodb docker image. If you go to https://registry.hub.docker.com/ on the first page you can find the official mongodb docker image. This is not that point of this post though. This is about getting to know and understand Docker, so we are going to do it from a base image and create a Dockerfile to do all the work for use. I like CentOS so that is what I am going to use but you can go ahead and pick your poison.

A Dockerfile is a image build script. Before creating one of these it is good to think about what steps you would take to build an image manually.

Mongodb repo
Install the packages yum -y install mongodb-org-server.x86_64 mongodb-org-shell.x86_64 mongodb-org-tools.x86_64

Easy enough lets build the file:

Using your favorite text editor crate Dockerfile:

Lets break it down a bit:

FROM [image]

COPY [file] [destination]

Copy a file into the image.

RUN [command]

Run a command

EXPOSE [port]

Expose a network port

Now that we have our DockerFile run:

docker build -t [image name] .

docker build -t mongodb.centos .

It will build the image and now you have your very own Mongodb Docker image.

Now to run it:

docker run -d -p 27017:27017 mongodb.centos /usr/bin/mongod --port 27017

-d Run as a daemon

-p 27017:27017 Expose port 27017 on local port 27017

/usr/bin/mongod port 27017 Start the mongodb server and run it on port 27017

Now I hope you see the power already. I could run 100 of these just by setting up a bash script with a loop.

Now to connect to this server from the local machine run the mongo command and there you have it.

Hopefully this has displayed Docker in a way that makes you as excited about it as it did me when I really started digging in. If you want to collaborate with a friend or coworker on a project you could send him over your Dockerfile and know that both of you have the same environment. If you have a ready image you can just push it over to them the way you would with git. Even better you can easily push to Dev, QA, Stage and Prod without long build times and outage windows. If your not excited you should check your pulse! This does not mean docker is 100% production ready, but I am sure it will be shortly with all the attention it is getting.

VMware not enough physical memory windows 8.1

2015-02-05T16:06:00-05:00

I have been using VMware for a long time now and this is the first I have ever seen an error with physical memory when trying to run my VMs. My VMs were running fine until my Windows 8.1 rebooted after automatic updates. After the reboot my VM wouldnt start and would displayed a messages as if my system had 4gb of ram but I was trying to allocate 8gb of ram.

During my troubleshooting I did exactly what the message said by lowering the memory I have assigned to that machine to 1gb. Rebooted my VM and another message came up but this time it said to allocate less than 600kb!

Long story short, there was no issue with the my system memory but Windows update
KB2995388
broke my VMware Workstation 10.

++This is how you fix this.++

ClamAV (ClamTK) Anti-Virus For Ubuntu

2015-01-26T07:09:00-05:00

I reviewed and tested every Ubuntu anti-virus I was able to get my hands on, ClamTK is by far the best.

Simple Instructions on what is needed to install a fully updated anti-virus for Ubuntu.

* Viruss are not common in Linux, however, this is not a bad idea if you have users submitting data to your server. *

You can watch a video on how to install this
https://www.youtube.com/watch?v=REqitWT1Wu0

ClamTKs application icon

ClamTKs newest GUI

Your application GUI might appear different if you didnt grab the update form the website.

Linux Backup Restore with tar (part 1 of 2)

2015-01-04T02:40:00-05:00

OS: Linux
Skill Level: Intermediate
Prerequisites: Linux CLI and Bash Scripting
Language: Bash Shell Scripting

Intro:
There are a lot of great open source and commercial backup solutions and what you will find if you look under the hood of these software packages is that most of them are just interfacing or wrapping over tar. For my home needs I decided it would be simple and fun to just write my own basic backup software using tar and a script.

Software Requirements:
1. Backup: Script must backup all important files on my system and exclude files that are not needed. The backup tar.gz file must contain the name of the host the it backed up and the date of the backup.

hostname-backup-0000-00-00.tar.gz

Retire old backups: Script must be able to remove old backups after a specified time period.

This are simple backup requirements for my own home use, and they might not apply to everyones individual needs.

Part 1:
First things we need to backup the data we want and exclude what we do not need. Lets break down the tar arguments we will need to get this accomplished.

Backup archive to tar.gz file:

tar cpzf [tar.bz file] -X [exclude list] [directory]

czf create file.tar.bz

p preserve file permissions.

X exclude files listed in this file

These tar arguments should cover all we need for our basic backup script. Time to start building the script.

vim backup.sh (call it whatever you want)

For the sake of simplicity and organization I am going to break this down into two functions. The first will be the backup function. We will also need a few global variables (I might change these to local vars depending on the needs of the script as I move forward).

having our global variables up top makes it very easy to edit our settings if needed later on. The one we need to look at is our exclude_list. I put this list in the same directory as the backup script. Here is what mine looks like:

Now set this as a cron job to run at your desired backup intervals. I have mine set to run once a week as my data does not change all that often and the world would not stop spinning if I lost something between that week. Create a cron file call backup in /etc/cron.d/ with the following (adjust to meet your needs).

This sets the script to run at 12am every Saturday.

Part 2:

This part gets a little more tricky. We will need to write a function to look at the backup tar file and check if it is beyond a date we specify to retire that backup. Since I am going to have it set to retire older backups before it takes the new backup I will test the files creation date against the current date and see if it is beyond our retention policy. I am going to call this function retire.

First lets get the last modified time. We can do this with the stat command:

stat -c%y [tar archive] | cut -c1-10

-c or format=: this lets us modify the output of the stat command

%y gives us the date the file was last modified

Output of stat command:

2014-11-22 05:41:56.045547078 -0800

At this point in time we only care about the date so we can pipe this to cut command to snip off what we need.

cut -c1-10

-c characters to cut

This give us just what we need:

2014-11-22

for this I am also going to need one more global var called retire_after. This will be our retention policy set in how many days we would like to keep the backups. I am going to set mine for 14 days (two weeks). The easiest way to explain this function will be to show it first and go over what it is doing after.

First we get a list of all the files in the backup location, then we get the retire date. Once we have those things we check to see if the list is empty.
$valid
hold a regex expression that we use to check if
$files[0]
contains a \* at the end of its string. If it does contain a \* it means the folder was empty. Now loop through the backup files and figure out if they match the retire date. If they do then we remove them. Then we add the retire function under the main section of our script:

This completes our requirements for a backup script. Here is the script in it entirety.

If you have been following along you probably noticed a few issues with the script.

Known Issues:

Since the script is set to run weekly we can only retire on weekly increments. While this works just fine for me it might not work for every situation.
If the script gets skipped one week it might strand a older backup. This can be cured with more tests on the tar files for age in the retire function.

Conclusion:

I am sure there are other issue with this script but for my basic needs at home this does the trick. I will post the full script to the Codeholics github page. Part two of this post will be writing the wrapper script for restoring files.

File count from the command line on a Linux system

2014-10-21T05:34:00-04:00

OS: Linux
Skill Level: Beginner
Prerequisites: Basic Linux CLI and regular expression understanding

Intro:

When a folder only has a few items in it this trick is not that important, but let say the folder you are looking at has 754,586 files in it? Here is a quick trick to get an accurate count of the items in a folder.

Example Folder Listing:

-rwxr-xr-x. 1 vesc vesc 1465 Apr 14 2014 backup.py  
drwxrwxr-x. 7 vesc vesc 4096 May 1 23:13 Code  
drwxrwxr-x. 2 vesc vesc 4096 Apr 12 2014 Downloads
-rwxrwxr. 1 vesc vesc 1279 Aug 17 07:19 ipcheck.py  
-rw-rw-r. 1 vesc vesc 16 Oct 10 04:20 ip.dat  
-rw-rw-r. 1 vesc vesc 6045 Aug 16 08:51 movielist.txt  
-rw-. 1 root root 294944 Apr 26 18:31 text.out  
-rwxr-xr-x. 1 vesc vesc 529276 Apr 8 2014 slowhttptest  
drwxrwxr-x. 2 vesc vesc 4096 Jan 2 2014 somefile

Total items in folder:

ls -1 | wc -l

[vesc@indigofs ~\]$ ls -1 | wc -l  
9

Number of files in the folder:

ls -l | grep ^- | wc -l

[vesc@indigofs ~\]$ ls -l | grep ^- | wc -l    
6

Number of sub-folders in the folder:

ls -l | grep ^d | wc -l

[vesc\@indigofs ~\]$ ls -l | grep ^d | wc -l  
3

Managing BTRFS Snapshots

2014-10-14T23:12:00-04:00

Skill: Advanced
OS: Linux (OpenSUSE 13.1)
Prerequisites: A drive with btrfs

Intro:
When I first installed OpenSUSE 13.1 it gave me the option of using btrfs for my file system. It warned me it was experimental but after reading up about the benefits I decided to live on the wild side and use it on my laptop. The drive is a fairly small 120gb SSD so giving up the chunk to btrfs was a bit of a sacrifice. I figured if push came to crash it would add some value and it is a new file system to play with. One day I was running my updates and the install crapped out in the middle saying I had no space available and at this point my X locked up and crapped out. I did a Ctrl+Alt+F1 to get to a command line and figure out just what the hell is happening. I do a df -h and can see no issues with my space. After a while I figure out it was my btrfs snapshots that were eating up all my space. Here is what I did to correct this issue, and set the configuration file to keep from having this issue in the future.

Snapper:
Snapper is the snapshot manager tool for btrfs. Doing a snapper help should give you all the information you need to know about the basic usage and to get your system back up and running if your running btrfs and notice programs are complaining about space when you can not see why.

snapper list
List all snapshots
Do this as root and you should see something similar to this:

Type    |  #      |  Pre #  | Date                               | User  | Cleanup  | Description    | Userdata    
-++-+++-++
single   | 0       |           |                                          | root  |                | current          |  
single   | 1990 |           | Sun Oct 5 00:45:02 2014 | root | timeline   | timeline         |   
single   | 2011 |           | Mon Oct 6 07:00:01 2014 | root | timeline  | timeline         |     
pre       | 2015 |            | Mon Oct 6 10:10:41 2014 | root | number  | zypp(zypper)  |    
post     | 2016 | 2015   | Mon Oct 6 10:10:45 2014 | root | number  |

Things to notice:

Type Single: A single timeline snapshot taken as part of btrfs operation

pre/post: These are snapshots taken before and after a zypper update

# This is the number to reference a snapshot

Date Date the snapshot was taken by default btrfs keeps a lot of snapshots. I will show you how to adjust this at the end.

2. Delete some old snapshot to free up some space

snapper delete

snapper delete 1990 #this will delete single

Roll Back: If this happened to you like it did to me while in the middle of a update you will need this step

snapper

snapper -v undochange [newer]..[older]

snapper -v undochange 2041..2040 #This will undo the update changes made by zypper

Configure snapper retention:
vim /etc/snapper/configs/root
Find and edit this section of the file to meet your needs and space limitations:

# limits for timeline cleanup 
TIMELINE_MIN_AGE=1800   
TIMELINE_LIMIT_HOURLY=10 
TIMELINE_LIMIT_DAILY=10 
TIMMELINE_LIMIT_MONTHLY=10  
TIMELINE_LIMIT_YEARLY=10

By default it keeps the 10 last snapshots of each hourly, daily, monthly and yearly.

Conclusion:

I hear they have worked on fixing this issue in the newer releases, but if you find yourself in my predicament I hope this helps. The thing I found ironic was the snapshot is what did me in and is what saved me after the fact.

SSH Login Banner

2014-10-14T01:27:00-04:00

Want a custom banner or warning message when a user connects via SSH on your server?

Skill level: Beginner
OS: Linux
Prerequisites: Understand how to edit a file with vim or other text editor in Linux.
Dependencies: Config files:
/etc/ssh/sshd_config /etc/issue.net

Open /etc/ssh/sshd_config and look for the line with Banner in it and point it to your /etc/issue.net file:

Banner /etc/issue.net

Generate a banner:
figlet -f banner [string]
Copy and paste your banner into /etc/issue.net to add your message.
Restart sshd:
sudo -i service sshd restart

Now connect to your box:

# Codeholics

Home Network Overhaul with Enterprise Techniques

Pre-Reqs

Intro

Planning

My Goals

Network Topology Diagram

VLAN Network Assignment

Hardware

Finished Network Topology Diagram

Switch Port VLAN Assignment Diagram

Conclusion

Links:

Mycroft Personal Assistant Setup Part 2

Intro

Custom Wake Word Project Setup

The project structure

Wake word collection

Setting up Picroft to use the latest precise-engine

Installing mycroft-precise fork

Mycroft wake word config

Conclusion

Links

Mycroft Personal Assistant Setup Part 1

Intro

Hardware List

The Build

Software Setup

Conclusion

Links:

Hardware

Software

Guides

General

Using lua-openssl to view x509 attributes

Intro

Install lua-openssl

Using the openssl package

Links:

Git GPG Signing Setup on OSX

Intro

Steps

Links:

Kali Linux (rolling) Blank Screen Fix

Moving a website from Wordpress to Pelican

Python: working with X.509

Intro

Needed Packages:

Generating a RSA Private Key:

Generate x509 Self Signed Certificate:

Generate x509 CSR (Certificate Signing Request):

Write CSR to a file:

Looking at date in PEM certs:

Load Private Key, PEM Certificate and CSR:

Check Signature of CSR certs:

Working with CA CRL:

How to Install libcouchbase on OpenSuse to use the Couchbase Python Module

Get dependences:

Get source:

Run config and build:

Run tests:

Install:

Load newly installed libcouchbase shared objects:

Install Couchbase Python Module:

Displaylink DK1522 Issue after OpenSUSE Leap 42.3 Upgrade

Defcon1

Links:

Codeholics is currently undergoing redevelopment

The Poor Mans DynamicDNS

Book Review: The Phoenix Project

Understanding Linux Basic Disk Partition Setup

Thirty years of Mac ads (1984-2014)

How to make a motherboard a GIGABYTE Factory Tour

How a CPU Works

How Lexar Makes SD cards

Get the exit code of a bash command

How To Reveal The Password Hidden Behind Asterisks

Book Review: Ready Player One

Book Series: Zero Day + Trojan Horse

7 Gamers, 1 CPU Ultimate Virtualized Gaming Build Log