Linux – A changelog by Daniel Mettler

August 15, 2024August 16, 2024

Nomad Network – Communicate Freely

Off-grid, resilient mesh communication with strong encryption, forward secrecy and extreme privacy.

Nomad Network allows you to build private and resilient communications platforms that are in complete control and ownership of the people that use them. No signups, no agreements, no handover of any data, no permissions and gatekeepers.

https://github.com/markqvist/NomadNet

Information is the basis of society in the digital world.
Freedom of expression/speech and free access to information are indispensable prerequisites for democracy.

Sadly, there are misleading and dubious organisations, lobbyists, parties, secret services, legislative and executive bodies that work against these liberal, enlightened and humanitarian values and demand or advocate censorship, online and offline.
This is a big threat for civil society – you and me, all of us.

And this is what makes projects like NomadNet important and valuable.

Stand up for freedom of expression/free speech and fight censorship!

(And as always, please note the disclaimer: All software and hardware can have security bugs).

August 14, 2024August 14, 2024

Unofficial Bitwarden compatible server written in Rust

An interesting project if you want to self-host your own Bitwarden compatible server, written in Rust instead of in C#:

Unofficial Bitwarden compatible server written in Rust

(/ht https://news.ycombinator.com/item?id=41243147)

(Disclaimer: Keep in mind that every software, also formally verified one, can contain bugs, also security bugs.)

July 10, 2024

Zimbra ZCS: How to export and import e-mail messages using the CLI

I verified the tips on the page below. The only mistake I’ve noticed is that the date format is wrongly indicated, i.e. instead of in MM/DD/YYYY format, the dates have to be specified in DD/MM/YYYY format.

So, the 1) command should be:

$ zmmailbox -z -m alice@example.com gru "//?fmt=tgz&query=after:"20/07/2022"&before:"26/07/2022"" >> /tmp/alice.tgz

https://wiki.zimbra.com/wiki/How_to_export_import_emails_for_a_specific_date

March 4, 2019March 4, 2019

TCP BBR

TCP BBR looks promising and somehow managed to escape my radar so far.. need to take a look at how to improve my IT infrastructure with it:

Increase your Linux server Internet speed with TCP BBR congestion control

March 3, 2019March 3, 2019

IPMI Serial over LAN (SOL)

A nice summary by Werner Fischer (Thomas-Krenn) about how to enable and use Serial over LAN, particularly for Linux boxes:

IPMI Serial over LAN (SOL)

(In German, but you can easily translate it using your favourite online translation tool, e.g. deepl.com or Google Translate)

February 12, 2019February 12, 2019

CLIP OS Linux Distro

It might be worth taking a closer look at Clip OS, a relatively new, security focused Linux distribution by the ANSSI, based on Hardened Gentoo and with some similarities to Qubes OS.

June 16, 2018June 16, 2018

GitLab 10.5 and later: Solution for error “Validation failed for domain” with Let’s Encrypt

GitLab 10.5 introduced built-in support for Let’s Encrypt.

Unfortunately, if you follow the official GitLab instructions how to enable Let’s Encrypt support, you may encounter the following error when rebuilding GitLab:

Running handlers:
There was an error running gitlab-ctl reconfigure:

letsencrypt_certificate[yourhost.yourdomain.com] (letsencrypt::http_authorization line 3) had an error: RuntimeError: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 20) had an error: RuntimeError: [yourhost.yourdomain.com] Validation failed for domain yourhost.yourdomain.com

Running handlers complete
Chef Client failed. 11 resources updated in 11 seconds

Warnings:

Let’s Encrypt is enabled, but external_url is using http

The last line is rather misleading, as the domain validation can apparently also fail if one sets external_url = “https://yourhost.yourdomain.com”

As a workaround, add the following two additional lines to /etc/gitlab/gitlab.rb (hat tip to Kai Mindermann and Thomas Jost for the hints):

nginx['redirect_http_to_https_port'] = 80
nginx['redirect_http_to_https'] = true

So, all in all, you need to set in /etc/gitlab/gitlab.rb:

external_url 'https://yourhost.yourdomain.com'

and add the following lines (adjust the notification e-mail address):

letsencrypt['enable'] = true
letsencrypt['contact_emails'] = ['gitlab-notifications@yourdomain.com'] # optional
nginx['redirect_http_to_https_port'] = 80
nginx['redirect_http_to_https'] = true

Make sure that your firewall doesn’t block access to ports 22 (SSH), 80 (HTTP), 443 (HTTPS).

After that, reconfigure GitLab (in a shell):

# gitlab-ctl reconfigure

That’s it! You can now register/login at https://yourhost.yourdomain.com.

September 11, 2017September 11, 2017

The ‘All-in-One WP Migration’ plugin is all you need to migrate your WordPress blog

This blog has just been migrated to a newer and (much) faster host node running Proxmox 5 with ZFS.

Therefore, I was looking for the best method to migrate a WordPress blog to another server (and/or database and/or directory and/or URL).

Do you remember the times when migrating a WordPress blog was rather tedious, involving many manual steps, despite (other) handy tools like WP-CLI? Apparently, this is no longer needed, as all you need is the following plugin:

All-in-One WP Migration

This plugin’s export and import functionality takes care of all the required configuration and path adjustments, allowing you to easily migrate a blog with up to 512 MB data. The steps are thus:

Install the All-in-One WP Migration plugin on your current WordPress site
Use the plugin to export all your data, plugins, themes, configuration etc., e.g. as a downloadable file.
Note: In particularly tricky cases you can also manually replace certain strings in the db or exclude specific data and files.
Setup a new vanilla WordPress installation at another location (server, directory). You’ll need a database and the WP installation files for this.
Install the All-in-One WP Migration plugin on your new WordPress site
Use the plugin on your new site to import the previously exported data from your old site

It’s hard to believe, but that’s really it!

September 10, 2017September 13, 2017

How to upgrade Zimbra/ZCS 8.8 GA from Ubuntu 14.04 LTS to 16.04 LTS

When upgrading Ubuntu 14.04 LTS to 16.04 LTS the usual way, ‘do-release-upgrade’ will by default remove 3rd party packages. For a Zimbra/ZCS server this means that Zimbra/ZCS packages would be automatically removed when upgrading to Ubuntu 16.04 LTS.

Luckily, there’s a neat little trick to prevent ‘do-release-upgrade’ from removing Zimbra/ZCS packages during the upgrade. Here’s how to do it:

Open two screen sessions (or two terminal sessions) on your Zimbra/ZCS server
```
 $ screen -R
```
Block at least the SMTP and SMTPS ports (to prevent clients from accessing the server, consider blocking the IMAP and IMAPS ports too, or all ports but SSH and port 1022) for your Zimbra/ZCS server on your firewall (to stop the delivery of messages).
Backup the server or make a snapshot, just in case anything goes wrong
Stop Zimbra/ZCS:
```
 $ sudo /etc/init.d/zimbra stop
```

Make sure the system is current:

 $ sudo apt-get update && sudo apt-get upgrade

Start the Ubuntu distro upgrade process:
```
 $ sudo do-release-upgrade
```
(if you don’t have do-release-upgrade, you have to execute ‘sudo apt-get install update-manager-core’ first)
When prompted by ‘do-release-upgrade’ that the third party sources have been disabled, re-enable those third party sources. To do this, open ‘/etc/apt/sources.list.d/zimbra.list’ with an editor (e.g. nano, vim) in another terminal/screen session and change its content from:
```
# deb [arch=amd64] https://repo.zimbra.com/apt/87 xenial zimbra # disabled on upgrade to xenial
# deb-src [arch=amd64] https://repo.zimbra.com/apt/87 xenial zimbra # disabled on upgrade to xenial
```
to
```
deb [arch=amd64] https://repo.zimbra.com/apt/87 xenial zimbra
deb-src [arch=amd64] https://repo.zimbra.com/apt/87 xenial zimbra
```
Then return to the first terminal/screen session and let ‘do-release-upgrade’ continue with the upgrade process (i.e. hit ‘enter’).
When you get informed about the packages that will be removed (BTW, in the detail view you can see that the Zimbra packages will now be upgraded, not removed) and upgraded and asked whether you want to start the upgrade, confirm this.
Note: Don’t worry about minor error messages like:E: changelog for this version is not (yet) available; try https://launchpad.net/ubuntu/+source/zimbra-perl-socket/+changelogYou can safely ignore them.
Agree to all suggestions by ‘do-release-upgrade’ (e.g. the removal of files in /var/log/sysstat/ and whether you allow ssh to be restarted). In my case, it was also fine to go with the maintainer versions of the config files.
When the upgrade process is finished, let ‘do-release-upgrade’ reboot the system.

After this, Zimbra/ZCS should work nicely again, on Ubuntu 16.04 LTS.

Note: It can take Zimbra/ZCS quite some time to properly start all its services (it’s Java, after all). Sometimes, the output of ‘$ sudo /etc/init.d/zimbra status’ and what’s listed in the service monitoring section of the Zimbra/ZCS admin webUI can thus be inconsistent. Sometimes, it’s even necessary to stop and start Zimbra/ZCS a couple of times (with ‘/etc/init.d/zimbra’) after an upgrade until all services run nicely.
Also note that Zimbra’s new dedicated ‘imapd’ service won’t run properly, unless it’s configured manually, as shown in the Zimbra Collaboration Administrator Guide version 8.8.3. If it doesn’t run properly, this service will simply be ignored in a single server setup, your Zimbra/ZCS will thus likely work as usual.

If there are any problems or if you want to be extra cautious, you can also additionally download Zimbra/ZCS 8.8 for 16.04 LTS manually and run its installer again:

$ sudo ./install.sh

If everything is fine, unblock the SMTP and SMTPS (and IMAP and IMAPS) ports again.

If things aren’t fine, simply roll-back from the snapshot or restore the whole server from the backup.

You might then want to try a fresh install according to the official Zimbra/ZCS migration manual: How to move ZCS to another server.

(Source: Kudos to vchong68 for his valuable hint in his forum post)

September 9, 2017September 13, 2017

Solution for: Proxmox backup error due to iothread=1

If you see the following error when trying to backup a KVM VM image on Proxmox:

ERROR: Backup of VM 100 failed – disk ‘scsi0’ ‘zfsvols:vm-100-disk-1’ (iothread=on) can’t use backup feature currently. Please set backup=no for this drive at /usr/share/perl5/PVE/VZDump/QemuServer.pm line 77. INFO: Backup job finished with errors TASK ERROR: job errors

edit /etc/pve/qemu-server/100.conf, look for a line similar to

scsi0: zfsvols:vm-100-disk-1,iothread=1,size=70G

and change it to

scsi0: zfsvols:vm-100-disk-1,iothread=0,size=70G

Afterwards, it’s possible to backup the VM.