April 8, 2020
Sudoed podman cannot listen to privileged ports
Edit: This issue is possibly a known one: see "Podman can not create containers that bind to ports < 1024"
It's impossible to reach any exposed privileged port from external net when running podman
sudo podman run -p 80:80 -it nginxSetup: dedicated Centos 8, clean install + docker, no firewalld, iptables at "allow-all" default ruleset. With docker however it works without problem.
What I was trying to run which needed to listen to privileged ports is a certbot inside docker. Motivation is to avoid installing python dependencies or else downloading and running unknown binary.
Labels: centos, centos8, certbot, docker, letsencrypt, linux, opensource, podman
August 2, 2019
Debian Buster (10) no Java 8 support
I installed Debian 10 onto X220 laptop and discovered that it's no official support for Java 8 according to debian mailing list. Also an installation of recommended PPA containing Java 8 which requires adding gpg keys via apt-key fails. Little disappointed by the keys shit. I'm looking for some other options, as Java 8 is critical for me and I really don't wanna mess up with unofficial openjdk builds.
This resembles me a lot this almost comedian video on how hard to describe the life of sysadmin to non-it people. Palm, palm, palm.
Video link
So no Debian 10 for my X220. Thinking about arch (used it for some years, with some luck of failing video drivers - I don't have a good feeling about it being on laptop) or centos (happy with it on server, not sure about client). Also maybe a Debian 9 is a logical choice as seems like it has Java 8 supported by default.
This resembles me a lot this almost comedian video on how hard to describe the life of sysadmin to non-it people. Palm, palm, palm.
Video link
So no Debian 10 for my X220. Thinking about arch (used it for some years, with some luck of failing video drivers - I don't have a good feeling about it being on laptop) or centos (happy with it on server, not sure about client). Also maybe a Debian 9 is a logical choice as seems like it has Java 8 supported by default.
Labels: arch, centos, debian, java, java 8, laptop, linux, openjdk, opensource, x220
April 14, 2019
Blueprint reverse-engineer server configuration
This post is more a bookmark for myself. Recently I've stumbled upon the server config reverse-engineering solution: Blueprint. I was reading about Slicehost, the hosting company that was bought by Rackspace in 2008.
Labels: business, configuration, hosting, linux, management, server
December 9, 2018
Why FAR manager is better than Midnight Commander?
Far manager is so much better than mc because mc has inconveniences like this https://midnight-commander.org/ticket/3664: unable to type `-` key (among other keys) in command line (at least when used on macbook). This makes any serious usage of mc almost impossible (because cannot type any command line argument as it always starts with `-`).
November 23, 2018
Jira manual update process is ugly and does not have any alternative
I've recently bought a Jira license in order to have my own bugtracker for projects I do. For my projects I personally like to use classical bugtracking, which cannot be fully replaced by something like Trello.
When the time came to update Jira version, the quick check shown that there's no way to update Jira in any automatic way. Administrator must each time go to web site, choose OS version, start download, abort it, copy link from Downloads and wget- or curl- it on server. Then manually unpack it and play with symlinks (or some other way to gracefully abort upgrade if one prefers).
Seems like in this case Atlassian has some business requirements that override product usability. This is first sign that the product design is drawn by primarily interests of non-tech people in Atlassian. As long as Jira product is sold to support the technical process and make it cheaper, this decision to make update process unstable (as it needs special attention), this ruins my trust in product and company in general. To understand the scale of this decision just imagine that for example 10 different products on your servers need manual update process. This is at least annoying and bug-prone because involves human factor. So from my point of view this is a clear sign that (1) either company generates enough money to let marketing people make shitty decisions and override technical ones and not to think about competitors or (2) company's left hand does not know (and care) about right one. Any of which is very bad from the client point of view. Any good alternatives for a bugtracker?
When the time came to update Jira version, the quick check shown that there's no way to update Jira in any automatic way. Administrator must each time go to web site, choose OS version, start download, abort it, copy link from Downloads and wget- or curl- it on server. Then manually unpack it and play with symlinks (or some other way to gracefully abort upgrade if one prefers).
Seems like in this case Atlassian has some business requirements that override product usability. This is first sign that the product design is drawn by primarily interests of non-tech people in Atlassian. As long as Jira product is sold to support the technical process and make it cheaper, this decision to make update process unstable (as it needs special attention), this ruins my trust in product and company in general. To understand the scale of this decision just imagine that for example 10 different products on your servers need manual update process. This is at least annoying and bug-prone because involves human factor. So from my point of view this is a clear sign that (1) either company generates enough money to let marketing people make shitty decisions and override technical ones and not to think about competitors or (2) company's left hand does not know (and care) about right one. Any of which is very bad from the client point of view. Any good alternatives for a bugtracker?
Labels: autoupdate, bugtracker, bugtracking, jira, linux, manual, no-autoupdate, shit, upgrade
August 28, 2018
On SSH security
In case of need to temporary log in into SSH box from non-secure location (i.e. assuming keyboard wiretapping on Intel ME-enabled system) it's possible to use google auth as second-factor auth. It's also worth considering the worst scenario of man-in-the-middle and enable 2FA for a separate non-sudoer account.
Android emulator window @xfce does not gain keyboard focus
In order to fix it open Settings -> Window Manager Tweaks -> Focus tab -> select the Do nothing (When a window raises itself)
June 13, 2018
Docker build unicode filenames issue
When including any non-ASCII filenames into image one need to double-check filenames at char level! The reason is that docker can be creative on how to encode char (for example Й, 1081 (single char) vs И, 1080 + 774 (upper part) (two chars!) - docker makes 2 chars from single one). Thanks docker, you gave me 2 days of uking with this trash!
Labels: docker, docker build, file, linux, osx
May 4, 2017
How to type in Unicode (for linux)
To insert unicode char with known code press Shift+Ctrl-U-[code], for example for this シ Japanese Katakana letter 'si' press ctrl+shift (hold it), then press u-3-0-b-7. Release ctrl-shift and you will have unicode char.
April 14, 2017
Patch to stop video autoplay in Chrome
I don't like an annoying videos crying out loud on me from respectful web sites (mostly ads). Also I don't want to setup another one Chrome extension (230000 users using that). I already have too much of them. And yes, uBlock Origin cannot stop them all.
So I've patched Chrome (chromium actually) source code and compiled it for myself from source. Voila, it works! Patch is below just to know how simple the change (that is being discussed for 2 years with no effect, while the problem itself exists for much more than 5 years) is.
And yes, I don't mind pressing manually for video to start every time. Also I don't mind stop wasting my data plan and draining laptop battery. Thanks Google for being unfriendly and not having any user settings for this ;-)
Disclaimer: published under MIT License. That is, simply: "as-is", no guarantees, by downloading this patch you know what are you doing.
So I've patched Chrome (chromium actually) source code and compiled it for myself from source. Voila, it works! Patch is below just to know how simple the change (that is being discussed for 2 years with no effect, while the problem itself exists for much more than 5 years) is.
And yes, I don't mind pressing manually for video to start every time. Also I don't mind stop wasting my data plan and draining laptop battery. Thanks Google for being unfriendly and not having any user settings for this ;-)
Disclaimer: published under MIT License. That is, simply: "as-is", no guarantees, by downloading this patch you know what are you doing.
PS. How for Google is that possible to build such an unrelevant ads platform on a base of such modern data analysis techniques and so many context-related ads? I just don't see any relevant video or text ads for the last few years.
Labels: ads, autoplay, chrome, chromium, linux, opensource, patch, video, webkit
April 13, 2017
Notes on Brave browser
Just a few notes for myself. Took a minute to look through Brave(.com) browser and stuck upon mention that it uses NaCl in Crypto. Why the hell to use NaCl? I get used to disable NaCl in Chrome when I could - until chrome:plugins control was removed. I just believe that crypto must be as close to CPU as possible, as native as possible (no JavaScript crypto code) and HW accelerated on CPU level. The lesser layers the safer it is, cause so no secret keys could be left in memory to be read by some other process.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
Second thing (which could be not relevant, but looks strange anyways), is that it used npm as package manager in previous days.
April 12, 2017
Arch with mate: cannot lock screen with mate-screensaver, had to move to xscreensaver
I rarely pay much attention to opensource software bugs, but this regression is kind of severe as it touches security of desktop system.
I use Arch as desktop OS, with mate. After latest update pacman -Syu I noticed that I can lock screen only once after restart or so. It works like this: when selecting "Lock screen" from menu it just does nothing, and it's nothing also in .xsession-errors. So screen remains unlocked.
When I (maybe mistakenly) try to manually execute mate-screensaver it says like "screensaver is already running for this session".
So I took way of getting rid of mate-screensaver and installing and using xscreensaver instead (pacman -S xscreensaver). It works just fine.
I use Arch as desktop OS, with mate. After latest update pacman -Syu I noticed that I can lock screen only once after restart or so. It works like this: when selecting "Lock screen" from menu it just does nothing, and it's nothing also in .xsession-errors. So screen remains unlocked.
When I (maybe mistakenly) try to manually execute mate-screensaver it says like "screensaver is already running for this session".
So I took way of getting rid of mate-screensaver and installing and using xscreensaver instead (pacman -S xscreensaver). It works just fine.
Labels: arch, linux, mate, mate-scresnsaver, opensource, screensaver, xscreensaver
April 5, 2017
ag regex syntax
Here's how to find the regexp syntax for 'ag' - the silver searcher:
man pcrepattern
Labels: ag, linux, man, opensource
August 6, 2016
Compiling i686 kernel v2.6.34.1 on x86_64 centos v3.10.0
Want to compile small kernel.
As a first step, as I cannot yet compose the working initrd, I will use the existing pmagic iso which is 2.6.34 for i686 and replace kernel image.
As for package dependencies/toolchain - too many, search for error or ask me in comments.
$ git clone -v git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git $ git branch v2.6.34.1 Then patch something: $ cd linux-stable ; patch -p0 < patch.diff
Patch is below:
Read more »August 5, 2016
tmux experience
Recently I found tmux. This is a best thing if you manage to work with your server in ssh console on a bad connection or from time to time and would like to save the entire context of what you are doing. For example, you compile kernel and went take a coffee, then back and connection dropped. If you used tmux simply attach to session:
$ tmux aNeed (like me) several consoles? (It's for sure more verbose than to have nohup or Ctrl-z; bg)
<Ctrl-b> , enter "new" <Enter>For a list of sessions:
<Ctrl-b> , s(then select from stable list - meaning you remember that for example your unprivileged session is always third one, and first two is sudoed root ones). Example (selected 2nd):
(0) + 0: 1 windows (1) + 2: 1 windows (2) + 3: 1 windows (attached)The only not a good (yet) thing is scroll up as it needs 2 more keys:
<Ctrl-b>, [, then <PgUp/Down> or ArrowsHave fun!
Labels: administering, linux, ssh, tmux
January 18, 2013
teamcity migration details
On a way of migration of teamcity installation from one server and configuration to another I've bumped into https->http redirection in case of apache reverse-proxy setting under ssl.conf. Teamcity really has this bug not fixed yet (now v.7, bug reported for 5).
Summary of places to edit in migration:
1. build-data-dir/config/main-config.xml (rootURL attr)
2. config/server.xml (add to connector:
proxyName="xxxxxx.com" proxyPort="443" scheme="https" secure="true"Httpd config is of no interest, just as manual says:
<VirtualHost [...]> LoadModule proxy_module bin/mod_proxy.so LoadModule proxy_http_module bin/mod_proxy_http.so ProxyRequests Off ProxyPreserveHost On ProxyPass / http://127.0.0.1:8111/ ProxyPassReverse / http://127.0.0.1:8111/
Labels: apache, http, httpd, https, java, linux, teamcity, tomcat
April 13, 2012
solution: if linux (ubuntU?) freezes in boot (splash or log)
edit /etc/default/grub:
and possibly disable acpi 2.0 (not all acpi, 2.0 only) in BIOS
This problem seems to be frequent on AMD (I have AMD Phenom X6 1090T).
Bug exists at least in Ubuntu since 2008: bug on launchpad. Problem started to appear in 10.04, but exists even in Ubuntu 11.11. The bug on launchpad had been discussed in MANY comments from 2008 to May 2011, until in July 2011 it was AUTO CLOSED with resulution Confirmed->WON'T FIX. IDIOTS?
GRUB_CMDLINE_LINUX_DEFAULT="acpi_skip_timer_override"
and possibly disable acpi 2.0 (not all acpi, 2.0 only) in BIOS
This problem seems to be frequent on AMD (I have AMD Phenom X6 1090T).
Bug exists at least in Ubuntu since 2008: bug on launchpad. Problem started to appear in 10.04, but exists even in Ubuntu 11.11. The bug on launchpad had been discussed in MANY comments from 2008 to May 2011, until in July 2011 it was AUTO CLOSED with resulution Confirmed->WON'T FIX. IDIOTS?
April 10, 2012
binary logs?! go to hell!
read that systemd will soon use binary log (in russian), which of course does not yet support search. f%ck, people, this is late >10 years, because disk space is CHEAP today, we don't need to use smaller binary formats anymore! XML had such success because of human readability without any tools, in any editor, with grep, awk or something else. notepad :-)
Go to hell with that binary logs bullshit and code something really useful.
Go to hell with that binary logs bullshit and code something really useful.
Labels: binary logs, linux, logs, opensource, shit, systemd
April 1, 2011
Java 5/6: Java thread priority problem and workaround
Endre Stølsvik has very detailed research and explanation along with workaround to a problem of broken thread priorities in linux in his blog:
Linux Java Thread Priorities workaround
The kind of situation when you'd like to have priority changed is accepting socket thread under high load (or, of course, a DoS attack ;-) ), or GUI dispatch thread.
BTW, my opinion for running java server-side is strictly solaris-based server, if you can afford it. At least you won't have OS LWP creation overhead for each java thread you start.
I had never tried opensolaris for java deployment, but it seems like just a different build of same beast. Did you?
Linux Java Thread Priorities workaround
The kind of situation when you'd like to have priority changed is accepting socket thread under high load (or, of course, a DoS attack ;-) ), or GUI dispatch thread.
BTW, my opinion for running java server-side is strictly solaris-based server, if you can afford it. At least you won't have OS LWP creation overhead for each java thread you start.
I had never tried opensolaris for java deployment, but it seems like just a different build of same beast. Did you?
January 28, 2011
android dev: '?????? no permissions' trying to deploy to samsung galaxy tab
--
Update: this works until device disconnect only. After reconnect IDE could hang up :-)
Update: added string for HTC Desire Z
--
Ubuntu 10.04/android sdk 7(9? where the f%%k is sdk version? no version in readme! opensource sometimes is such an opensource.)
When you see such f%%% sh%%%:
To be able to deploy to samsung galaxy tab do the following:
1) create new file (51 is just some number below 99):
sudo vi /etc/udev/rules.d/51-android.rules
and put there:
04e8 is samsung id
18d1 is for HTC Desire Z
2) restart adb daemon:
sudo ./adb kill-server
sudo ./adb devices
you now should see this:
If above still doesn't help add more detailed description for usb device in 51-android.rules like this
here 0c91 is the HTC Desire Z product id. You can watch these details using 'lsusb' command:
Update: this works until device disconnect only. After reconnect IDE could hang up :-)
Update: added string for HTC Desire Z
--
Ubuntu 10.04/android sdk 7(9? where the f%%k is sdk version? no version in readme! opensource sometimes is such an opensource.)
When you see such f%%% sh%%%:
./adb devices
List of devices attached
???????????? no permissions
To be able to deploy to samsung galaxy tab do the following:
1) create new file (51 is just some number below 99):
sudo vi /etc/udev/rules.d/51-android.rules
and put there:
SUBSYSTEM=="usb", SYSFS{idVendor}=="04e8", MODE="0666"
SUBSYSTEM=="usb", SYSFS{idVendor}=="18d1", MODE="0666"
04e8 is samsung id
18d1 is for HTC Desire Z
2) restart adb daemon:
sudo ./adb kill-server
sudo ./adb devices
you now should see this:
* daemon not running. starting it now on port NNNN *
* daemon started successfully *
List of devices attached
10001c18352d device
If above still doesn't help add more detailed description for usb device in 51-android.rules like this
SUBSYSTEMS=="usb", ATTRS{idVendor}=="0bb4", ATTRS{idProduct}=="0c91", MODE="0666"
here 0c91 is the HTC Desire Z product id. You can watch these details using 'lsusb' command:
Bus 002 Device 011: ID 0bb4:0c91 High Tech Computer Corp.
Labels: android, desire, desire z, galaxy tab, htc, linux, opensource, samsung, shit, ubuntu, уебунту
