Search Results: "fh"

1 November 2009

Axel Beckert: /var/cache/apt/ on tmpfs

My ASUS EeePC 701 (4G) nemo running Debian Sid has a 4 GB SSD as main disk, which is on the one hand quite full (mostly with software I use, but also local working copies of software I work on) and on the other hand an SSD, so I always try to reduce the amount of write to disk without losing convenience. Similar issues have systems which run off a CF or SD card or maybe even an USB stick. Since I ordered a 2 GB RAM bar together with the EeePC, I not bound to the 512 MB which it had originally. But on the other hand I seldom needed more than 1 GB of RAM. Usually I needed between 400 MB and 1 GB of RAM. So it s quite obvious to use tmpfs on as many places as possible. Making /tmp, /var/run and /var/lock tmpfs were the most obvious directories to mount as tmpfs. Especially /var/run on tmpfs brought up a few bugs a while ago (mostly init.d scripts relying on /var/run/$PACKAGENAME/ s existence), but it s no hassles to use nowadays. Even in Debian Stable such bugs got fixed. Next target to explore for was /var/cache. According to the FHS, /var/cache is intended for cached data from applications. [ ] The application must be able to regenerate or restore the data. So it should be safe to put anything under /var/cache on tmpfs. One directory in there which gets written quite often and with a lot of data on Debian Unstable is /var/cache/apt and its subdirectories, especially /var/cache/apt/archives. If you update your Sid installation daily, all new or updated .debs will be downloaded to /var/cache/apt first. So I put /var/cache/apt on tmpfs by putting the following line into /etc/fstab:
tmpfs /var/cache/apt tmpfs defaults,noexec,nosuid,nodev,mode=0755 0 0
But despite FHS stating that anything under /var/cache must be reproducible by the application, apt is puking and refusing to work:
!447 Z31 ?0 L1 root@nemo:pts/0 (-zsh) 16:13:10 [~] # apt-get update
E: Archive directory /var/cache/apt/archives/partial is missing.
!448 Z32 ?100 L1 root@nemo:pts/0 (-zsh) 16:13:17 [~] # 
If you create /var/cache/apt/archives/partial, it will also argue about /var/cache/apt/partial. Of course the workaround is simple: Just put mkdir -p /var/cache/apt/partial /var/cache/apt/archives/partial in /etc/rc.local. But nevertheless, this is a bug in apt which already has been reported by madduck earlier this year (#523920). Unfortunately the APT maintainers have not yet even commented on this FHS violation and therefore also a Debian Policy (Section 9.1.1) violation. One more thought about /var/cache/apt vs only /var/cache/apt/archives: apt-file also caches its data under /var/cache/apt. So if you want to use apt-file after a reboot and have /var/cache/apt mounted as tmpfs, you have to run apt-file update first and it will download all Contents files (can be dozens of megabytes) and not only the differences to previously downloaded Contents files. So if you use apt-file a lot, you probably go better with making only /var/cache/apt/archives tmpfs and not whole /var/cache/apt.

25 October 2009

Marco d'Itri: My first Perl package is on CPAN!

After one year of development, today I uploaded my first package to CPAN: version 4.0 of Bryar.pm, a modular and extensible blog engine powered (by default) by Template Toolkit and originally written by Simon Cozens. I am officially a Perl developer! This is the software which I use for my own blog. Among the many changes in this release: caching, support for FastCGI, improved support for HTTP validators and a sitemaps generator.

Marco d'Itri: Debian packages for the Tivoli Storage Manager client

My employer uses the IBM Tivoli Storage Manager for backups and since we use Debian everywhere possible we needed packages of its client program, which is only distributed as RPMs. The initial conversion made with alien was unsatisfactory for many reasons, and the ugly original packaging did not help either. For this reason I spent a few hours to create an high quality Debian package for the Tivoli Storage Manager client. The client binaries cannot be redistributed, so when it is built from source it unpacks the RPMs and copies from there the files it needs to build the binary package. This work has been sponsored by Seeweb, a provider of web hosting, dedicated hosting and colocation services.

1 October 2009

Gunnar Wolf: Strange scanning on my server?

Humm... Has anybody else seen a pattern like this? I am getting a flurry of root login attempts at my main server at the University since yesterday 7:30AM (GMT-5). Now, from the machines I run in the 132.248.0.0/16 network (UNAM), only two listen to the world with ssh at port 22 And yes, it is a very large network, but I am only getting this pattern on one of them (they are on different subnets, quite far apart). They are all attempting to log in as root, with a frequency that varies wildly, but is consistently over three times a minute right now. This is a sample of what I get in my logs: [update] Logs omitted from blog post, as it is too wide and breaks displays for most users. You can download the log file instead. Anyway This comes from all over the world, and all the attempts are made as root (no attempts from unprivileged users). Of course, I have PermitRootLogin to no in /etc/ssh/sshd_config, but I want to understand this as much as possible. Initially it struck me that most of the attempts appeared to come from Europe (quite atypical for the usual botnet distribution), so I passed my logs through:
  1. #!/usr/bin/perl
  2. use Geo::IP;
  3. use IO::File;
  4. use strict;
  5. my ($geoip, $fh, %by_ip, %by_ctry);
  6. $fh = IO::File->new('/tmp/sshd_log');
  7. $geoip=Geo::IP->new(GEOIP_STANDARD);
  8. while (my $lin = <$fh>) next unless $lin =~ /rhost=(\S+)/; $by_ip $1 ++ ;
  9. print " Incidence by IP:\n", "Num Ctry IP\n", ('='x60),"\n";
  10. for my $ip ( sort $by_ip $a <=> $by_ip $b keys %by_ip)
  11. my $ctry = ($ip =~ /^[\d\.]+$/) ?
  12. $geoip->country_code_by_addr($ip) :
  13. $geoip->country_code_by_name($ip);
  14. $by_ctry $ctry ++;
  15. printf "%3d %3s %s\n", $by_ip $ip , $ctry, $ip;
  16. print " Incidence by country:\n", "Num Country\n", "============\n";
  17. map printf "%3d %s\n", $by_ctry $_ , $_
  18. sort $by_ctry $b <=> $by_ctry $a
  19. keys(%by_ctry);
The top countries (where the number of attempts 5) are:
  1. 104 CN
  2. 78 US
  3. 58 BR
  4. 49 DE
  5. 43 PL
  6. 20 ES
  7. 20 IN
  8. 19 RU
  9. 17 CO
  10. 17 UA
  11. 16 IT
  12. 13 AR
  13. 12 ZA
  14. 10 CA
  15. 10 CH
  16. 8 GB
  17. 8 AT
  18. 8 JP
  19. 8 FR
  20. 7 KR
  21. 7 HK
  22. 7 PE
  23. 7 ID
  24. 6 PT
  25. 5 CZ
  26. 5 AU
  27. 5 BE
  28. 5 SE
  29. 5 RO
  30. 5 MX
I am attaching to this post the relevant log (filtering out all the information I could regarding legitimate users) as well as the full output. In case somebody has seen this kind of wormish botnetish behaviour lately please comment. [Update] I have tried getting some data regarding the attacking machines, running a simple nmap -O -vv against a random sample (five machines, I hope I am not being too agressive in anybody's eyes). They all seem to be running some flavor of Linux (according to the OS fingerprinting), but the list of open ports varies wildly I have seen the following:
  1. Not shown: 979 closed ports
  2. PORT STATE SERVICE
  3. 21/tcp open ftp
  4. 22/tcp open ssh
  5. 23/tcp open telnet
  6. 111/tcp open rpcbind
  7. 135/tcp filtered msrpc
  8. 139/tcp filtered netbios-ssn
  9. 445/tcp filtered microsoft-ds
  10. 593/tcp filtered http-rpc-epmap
  11. 992/tcp open telnets
  12. 1025/tcp filtered NFS-or-IIS
  13. 1080/tcp filtered socks
  14. 1433/tcp filtered ms-sql-s
  15. 1434/tcp filtered ms-sql-m
  16. 2049/tcp open nfs
  17. 4242/tcp filtered unknown
  18. 4444/tcp filtered krb524
  19. 6346/tcp filtered gnutella
  20. 6881/tcp filtered bittorrent-tracker
  21. 8888/tcp filtered sun-answerbook
  22. 10000/tcp open snet-sensor-mgmt
  23. 45100/tcp filtered unknown
  24. Device type: general purpose WAP PBX
  25. Running (JUST GUESSING) : Linux 2.6.X 2.4.X (96%), ( )
  26. Not shown: 993 filtered ports
  27. PORT STATE SERVICE
  28. 22/tcp open ssh
  29. 25/tcp open smtp
  30. 80/tcp open http
  31. 443/tcp open https
  32. 444/tcp open snpp
  33. 3389/tcp open ms-term-serv
  34. 4125/tcp closed rww
  35. Device type: general purpose phone WAP router
  36. Running (JUST GUESSING) : Linux 2.6.X (91%), ( )
  37. Not shown: 994 filtered ports
  38. PORT STATE SERVICE
  39. 22/tcp open ssh
  40. 25/tcp closed smtp
  41. 53/tcp closed domain
  42. 80/tcp open http
  43. 113/tcp closed auth
  44. 443/tcp closed https
  45. Device type: general purpose
  46. Running (JUST GUESSING) : Linux 2.6.X (90%)
  47. OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
  48. Aggressive OS guesses: Linux 2.6.15 - 2.6.26 (90%), Linux 2.6.23 (89%), ( )
  49. Not shown: 982 closed ports
  50. PORT STATE SERVICE
  51. 21/tcp open ftp
  52. 22/tcp open ssh
  53. 37/tcp open time
  54. 80/tcp open http
  55. 113/tcp open auth
  56. 135/tcp filtered msrpc
  57. 139/tcp filtered netbios-ssn
  58. 445/tcp filtered microsoft-ds
  59. 1025/tcp filtered NFS-or-IIS
  60. 1080/tcp filtered socks
  61. 1433/tcp filtered ms-sql-s
  62. 1434/tcp filtered ms-sql-m
  63. 4242/tcp filtered unknown
  64. 4444/tcp filtered krb524
  65. 6346/tcp filtered gnutella
  66. 6881/tcp filtered bittorrent-tracker
  67. 8888/tcp filtered sun-answerbook
  68. 45100/tcp filtered unknown
  69. Device type: general purpose WAP broadband router
  70. Running (JUST GUESSING) : Linux 2.6.X 2.4.X (95%), ( )
  71. Not shown: 994 filtered ports
  72. PORT STATE SERVICE
  73. 22/tcp open ssh
  74. 25/tcp open smtp
  75. 53/tcp open domain
  76. 80/tcp open http
  77. 110/tcp open pop3
  78. 3389/tcp open ms-term-serv
  79. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  80. Device type: firewall general purpose
  81. Running: Linux 2.6.X
  82. OS details: Smoothwall firewall (Linux 2.6.16.53), Linux 2.6.13 - 2.6.24, Linux 2.6.16
Of course, it strikes me that several among said machines seem to be Linuxes, but (appear to) run Microsoft services. Oh, and they also have P2P clients.
AttachmentSize
Results of parsing the logs21.58 KB
Relevant portion of the logs1.05 MB

16 September 2009

Pete Nuttall: How Random is xkcd?

I was reading xkcd by clicking on the random link when I noticed that the same cartoons were coming up again and again. I was wondering if this was Confirmation bias on my part or a duff random number generator on the server's part. Randall Munroe is a science geek, and I figured what he would do is test this idea... One python script and 12,000 (approx) requests later, I had a file full of numbers and started trying to remember some statisics. I threw together a quick bit of python to work out the mean and standard deviation (its here). The mean value is 97.4155602788 and the standard deviation is 171.040683155. If they are uniformly distributed from 1 to 361, the expected mean would be 104.211323761 and the standard deviation would be 181.0. So I was lost in thought for a while. However, the following quick check threw some light on the difference.
>>> data = [int(x) for x in open('numbers.data')]
>>> for x in xrange(0, 361):
...   if x not in data:
...     print x
... 
0
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
So comics numbered about 338 don't appear. And recomputing the mean and standard deviation for 1 to 337 gives a mean of 97.2830920561 and a standard deviation of 169.0, which is about the mean and standard deviation the data gives. I'm now waiting for someone who actually knows stats correcting me in where I went wrong. The conclusion? I suffer from confirmation bias :-(. For those who like pretty pictures, here is one, courtesy of the Google charts API and pygooglechart: chart of freq against comic number code here

6 September 2009

Frans Pop: debtree 0.7.3 - Oh what tangled webs we weave

It's been quite some time (almost two years) since my previous "release" of debtree, but now version 0.7.3 is available. And it still generates very nice graphs :-) The changes are relatively minor: a few nice fixes for corner cases that were not handled correctly, and an update of the default lists of "skip" and "end" packages which help to limit the size of graphs for a fair number of packages I tried (including konqueror and openoffice.org).
Reason to revisit debtree was a recent nice mail from a debtree user, but also the current discussions about udev and the FHS. I'm on the side of "let's please keep /usr mountable separately". Mostly because I like a (small) encrypted root with a separate (large) unencrypted /usr'. I'm also increasingly unhappy with the default size of Debian's desktop installs, especially now that it looks as if Squeeze will see installation of Recommends by default by tasksel (and thus Debian Installer). For comparison, the size of a default Gnome desktop install for Etch was 1360MB; for Lenny it is 1830MB; for Squeeze it looks like it will be well over 3000MB! Remember that for Sarge we installed both Gnome and KDE from CD1 with both together taking 1390MB? Sure, some of that is real functionality, but a lot is also (IMO) redundant visual effects that only serve to slow the desktop down and junk needed to do stuff automagically. And a heck of a lot is duplicated functionality. One of the main reasons I switched to Linux was because it gave me back control over my systems, but with KDE4 and pervasive stuff like hal and all the various "kits" Linux is on a fast track that's giving priority to flashiness over real functionality and eroding that control. Here's a fairly default dependency graph for hal (click for full image). Looks reasonable, right? hal dependency graph But that's only because most major dependencies, such as dbus, policykit and pm-utils have been pruned. Here's a complete graph, with only libc6 omitted (full image is 1.5MB). Truly a tangled web. Scary. full hal dependency graph One can also look at it from the other side. Today I upgraded my sid chroot and found I suddenly needed to install libavahi-client3, libavahi-common3, libavahi-common-data and libdbus-1-3. Why? Reason turned out to be libcups2, so I checked if I really needed that. And here's why I do. libgtk2.0-0 dependency graph Most of these dependencies of libgtk2.0-0 I can understand, but isn't gtk supposed to be a graphical toolkit library? Couldn't printing support be implemented in some more specialized Gnome printing toolkit library? But I'm probably missing something. Anyway, now that I have a bit more perl experience through my recent work on debmirror, maybe I should finally port debtree from shell script to perl...
See the debtree home page for a full overview of how to read the graphs, but here's a quick intro. Purple arrows are Pre-Depends, blue are Depends and black are Recommends; green connections show Provides. The green packages are currently installed in my sid chroot, while the white ones are not. The diamonds show where the graph has been pruned: dependencies for these packages are not shown.

24 May 2009

Christian Perrier: News from the samba packaging team

Some (not so) short news from the samba packaging team... Recent package uploads: Other things are coming, such as the work on having samba3 and samba4 packages coexist. Jelmer Vernooij prepared everything after our discussions at the SambaXP conference and it should be uploaded "soon". A few patches we have should be integrated upstream as well, therefore making the Debian diff smaller and smaller. Also, Luk Claes joined the maintenance team and helped setting up the unofficial repository for backports. The bug count is going up again these days as I don't spend much time triaging the bugs and some are very tricky to reproduce. As usual, help would be welcomed. I'm fairly sure that several of these are user errors but I often lack time to prove this enough for closing the bug. We should go to to 50-60 bugs or so.

18 May 2009

Sven Mueller: Link collection 2009/05/18

That s it for now, will update the post if I find more interesting links in the next few days.

Marco d'Itri: Supporting unsupported USB devices

Some common classes of USB devices are supported by the same drivers because they share an identical or almost identical hardware design, but since each manufacturer uses its own Vendor and Product IDs the drivers need to be updated for each one. Some popular examples are 3G modems and devices which present a serial interface. As an interim solution until the kernel can be updated, the Linux device model provides a sysfs parameter called new_id which can be used to notify a driver that it should recognize a VID/PID pair as supported. The following example uses udev to add support for the Sheevaplug to ftdi_sio, the driver for the widely used USB to UART chips manufactured by FTDI. First we need a rule to automatically load the driver when the device is plugged in: udev cannot load it by itself since it does not know about the Sheevaplug VID and PID:
# if no driver has claimed the interface yet, load ftdi_sio
ACTION=="add", SUBSYSTEM=="usb", ENV DEVTYPE =="usb_interface", \
        ATTRS idVendor =="9e88", ATTRS idProduct =="9e8f", \
        DRIVER=="", \
        RUN+="/sbin/modprobe -b ftdi_sio"
And then we instruct udev to add the new VID and PID after the driver has been loaded:
# add the sheevaplug VID and PID to the list of devices supported by ftdi_sio
ACTION=="add", SUBSYSTEM=="drivers", \
        ENV DEVPATH =="/bus/usb-serial/drivers/ftdi_sio", \
        ATTR new_id ="9e88 9e8f"
While we are configuring udev we can also make it create a symlink for the console interface, since the FTDI chip in the Sheevaplug provides two serial interfaces: interface 0 is connected the JTAG lines and interface 1 to the serial console:
# create a convenience symlink for the console device
ACTION=="add", KERNEL=="ttyUSB*", \
        ATTRS interface =="SheevaPlug JTAGKey FT2232D B", \
        ATTRS bInterfaceNumber =="01", \
        SYMLINK+="sheevaplug"
This last rule shows an important misfeature of udev: while the keys ending in "S" can match nodes at any level of the devices chain, the matched nodes must be all at the same level. In this case this means that a single rule cannot have keys matching both the interface number and the VID and PID: this would require multiple rules and GOTO directives, so my rule matches the interface node which is available at the same level.

16 May 2009

Marco d'Itri: Installing Debian on the Sheevaplug

This document explains how to use deboostrap --foreign to build from scratch and install a minimal Debian system on the Sheevaplug (but it is equally applicable to many other embedded systems). The only piece missing to be able to install from bare metal is a working kernel and initramfs pair, so this document assumes that you already have a kernel which can mount the root file system from a USB key. For the Sheevaplug, the factory kernel in the internal NAND flash will work fine. The Debian kernel package puts us in a chicken and egg situation: it cannot mount the root without an initramfs (because all drivers are modular), but we cannot build one until we can boot the system. I suppose that, as an exercise of style, somebody could create a minimal initramfs with busybox and the kernel modules needed to mount the root and then mount it manually, but if you really lack a working kernel then it's probably faster to boot the file system image for the first time using qemu and the "versatile" debian-installer target. The first step is to run the first stage of debootstrap on another system (which does not need to be ARM), to build a temporary root file system. I use the --variant and --include options to build the smallest possible system with network support, but they can be omitted.
debootstrap \
         --foreign --arch=armel \
         --variant=minbase \
         --include=linux-image-2.6-kirkwood,module-init-tools,udev,netbase,
                   net-tools,ifupdown,iproute,whiptail,vim-tiny \
         sid ./target/ http://ftp.it.debian.org/debian/
As usual when using debootstrap, some manual configuration is needed:
cd target/
echo bokassa.mi.bofh.it > etc/hostname
vi etc/network/interfaces
vi etc/resolv.conf
echo LANG=C > etc/default/locale
echo '127.0.0.1 localhost' > etc/hosts
cat <<END > etc/fstab
/dev/root / ext3 noatime 0 1
tmpfs /tmp tmpfs defaults 0 0
#/tmp /var/tmp none bind 0 0
END
I took some hints from http://wiki.debian.org/ReadonlyRoot to reduce writes to the flash file system:
# the blkid cache is evil anyway
ln -s /dev/null etc/blkid.tab
# this link will be created anyway by the package
ln -s /var/lib/initscripts/nologin etc/nologin
# it's better to not use a static mtab with modern kernels
ln -s /proc/mounts etc/mtab
# unless you plan to use multiple removable network interfaces, persistent
# interface names are not needed
: > etc/udev/rules.d/75-persistent-net-generator.rules
Two small workarounds are needed:
# if this is not set then the preinst of linux-image-* will die trying
# to ask a debconf question in the debootstrap second stage
echo 'do_initrd = yes' > etc/kernel-img.conf
# a workaround for bug #520742
: > etc/udev/disabled
Now you can format a USB pen drive and copy the root file system on it:
mke2fs /dev/sdb1
tune2fs -i 0 -c 0 /dev/sdb1
mount /dev/sdb1 /mnt/
rsync -aH target/ /mnt/
umount /mnt/
After powering the plug press a key to get to the U-Boot prompt and use the factory kernel to boot from USB:
setenv bootargs console=ttyS0,115200 root=/dev/sda1 rootdelay=10 panic=10 init=/bin/bash
run bootcmd
Then you can run the second stage of debootstrap, finish the bare minimal configuration and start init:
./debootstrap/debootstrap --second-stage
# disable the gettys for /dev/tty[1-6], which do not exist
vi /etc/inittab
# and add one for the serial console
echo 'T0:2345:respawn:/sbin/getty -L ttyS0 115200 linux' >> /etc/inittab
# do not forget to set the root password or you will not be able to login...
vi /etc/shadow
rm /etc/udev/disabled
exec /bin/bash
mount / -o ro,remount
exec /sbin/init
Congratulations, now you can login on the system and start to install the packages you like:
echo 'deb http://ftp.it.debian.org/debian/ unstable main' > /etc/apt/sources.list
echo 'APT   Install-Recommends "false";  ;' > /etc/apt/apt.conf.d/no-recommends
apt-get update
# dash is much faster
apt-get install dash
dpkg-divert --add /bin/sh
ln -sf dash /bin/sh
# I do not like these, YMMV
rm /vmlinuz /initrd.img
rmdir /selinux /srv
# the kernel is able to read the time from the RTC by itself, and this
# will allow using a read only root
echo HWCLOCKACCESS=no >> /etc/default/rcS
# faster boot
echo CONCURRENCY=shell >> /etc/default/rcS
# useless on this platform
mv /etc/rcS.d/S01glibc.sh /etc/rcS.d/K01glibc.sh
dpkg-reconfigure tzdata
apt-get install openssh-server screen iptables wget less
U-Boot requires that the kernel and initramfs have a special header:
apt-get uboot-mkimage
cd /boot/
mkimage -A arm -O linux -T kernel  -C none -a 0x00008000 -e 0x00008000 \
  -n Linux-2.6.29-2 -d vmlinuz-2.6.29-2-kirkwood uImage
mkimage -A arm -O linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 \
  -n initramfs -d initrd.img-2.6.29-2-kirkwood uInitrd
Now you can reboot and configure u-boot to boot from the USB device. This is the variables scheme I like and it is not mandatory in any way, so I recommend that you read and understand the existing configuration before modifying it (some lines have been broken for readability):
setenv bootargs_nand $(bootargs)
setenv bootcmd_nand $(bootcmd)
setenv bootargs_root root=/dev/sda1
setenv bootargs_misc 'ro panic=10
  mtdparts=nand_mtd:0x400000@0x100000(uImage),0x1fb00000@0x500000(rootfs)'
setenv bootcmd_usb 'usb start; ext2load usb 0:1 0x00200000 /boot/uImage;
  ext2load usb 0:1 0x01100000 /boot/uInitrd'
setenv bootcmd 'setenv bootargs $(console) $(bootargs_root) $(bootargs_misc)
  $(bootargs_more); run bootcmd_usb; bootm 0x00200000 0x01100000'
Since now you are not using anymore the Marvell kernel tree it is mandatory to set these two variables and reboot:
setenv mainlineLinux yes
setenv arcNumber 2097
saveenv
reset
Installation to SD is identical, but requires an updated version of U-Boot with SD support. Due to a kernel bug which prevents autoloading the driver you will need to add mvsdio and mmc_block to /etc/initramfs-tools/modules and rebuild the initramfs. (Yes, the naming theme I use at home is "african dictators"...)

15 May 2009

Neil Williams: svn-buildpackage

I'm adopting svn-buildpackage and I've made a few commits via collab-maint already. So #528733 is now mine.

I expect to be working with Jan and anyone else who wants to work on the svn-inject and svn-upgrade functionality that I don't use personally. For this reason, I've re-opened #377467 as an RFH.

I use svn-bp for a lot of my own packages and I'm not going to use git if I can possibly avoid it (quite possibly, ever). The current collab-maint changelog is already long enough so I won't be making many changes prior to the first upload to close the ITA. However, once that is done, I'll be looking at Jan's 0.7 branch code and gradually working through the rest of the bugs.

It's not as if I have a huge amount of time available for svn-bp, so things will take time, but it can't stay orphaned.

Eddy Petri&#537;or: svn-buildpackage is now orphaned

I have decided that is high time to declare svn-buildpackage orphaned since many people are replying on it to be useful, but nobody cared enough to answer to the RFH Eduard Bloch made some 3 years ago.

I know it would have been better if I would have asked a request for adoption, but, honestly, the package didn't had a maintainer in the last year and that would have been lying to everybody.

The package is quite important and I would hate to see it leave the official archive since many people do need it and use it regularly (I know for sure the GNOME, Perl and the Debian Games Team use it) and I have enjoyed working on the package while I was motivated.

The code is maintained in SVN and the trunk can be viewed at:

http://svn.debian.org/wsvn/collab-maint/deb-maint/svn-buildpackage/trunk/

and can be checked out with any of these commands:

# read-only copy
svn co svn://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk svn-buildpackage

# read write, if you have an account on alioth.debian.org:

svn co svn+ssh://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk


Also, note that the package has several features which the new maintainer(s) should be aware of and must make sure they all work when changing the code. Also, there are some things to remember:

These being said, I am really hoping svn-buildpackage will find a new maintainer since it deserves a lot more attention than I am providing. Don't forget, 0.6.24 is wating for an upload already.



Update: Neil Williams answered and agreed to take over maintenance, but he doesn't usually use svn-inject and svn-upgrade, so somebody taking care of those would be needed. Ironically, those two scripts are the ones in the worst shape of the three main scripts.

14 May 2009

Marco d'Itri: sarge domUs in a lenny dom0

In a service provider environment it is often required by customers to support old server installations for much longer than it is recommended by vendors. Recently I had to move some Xen VPSes running Debian 3.1 to a modern Xen host running lenny and the 2.6.26 kernel. Since Xen is a FPOS and has been unable for years to maintain a stable ABI, I always use in the domUs the same kernel version of the dom0. The Debian Xen kernels require using an initramfs to load the paravirtualized block device driver and mount the root, at least. This would usually not be a big deal, but in this case breaks the VPS because the lenny version of udev is started in the initramfs and the system has either no udev or the old sarge version. The most immediately visible effect is that /dev/pts does not exist, which makes ssh less than useful. This is my solution:
dpkg --purge hotplug udev
printf '#!/bin/sh\nmkdir /dev/pts\n' > /etc/rcS.d/S02mkdir
chmod +x /etc/rcS.d/S02mkdir

8 May 2009

Jaldhar Vyas: New GnuPG Key

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256 Recently there has been some brouhaha about migrating away from SHA-1 digests as used in GnuPG and to this end I followed the procedure described by Daniel Kahn Gillmor and created a new key which I will get signed at the Debian NYC meetup tonight and use to replace my existing key for signing packages. The old key (which is still valid btw) is: pre. pub 1024D/EE6DC66A 1999-12-16
Key fingerprint = 48DF D000 3BE7 1FF8 D9C1 5832 DA46 0E47 EE6D C66A And the new key is: pre. pub 2048R/C4794DAF 2009-05-08
Key fingerprint = 37EF 5B02 19C3 0C6E 47B2 51D0 EAA6 38FA C479 4DAF You can fetch the new key from http://people.debian.org/~jaldhar/gpg.txt or from the public keyservers (I don't know if there is a lag in how quickly new keys are made available.) This message has been signed with both the old and new keys.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBCAAGBQJKBLrsAAoJEOqmOPrEeU2vfzIH/A99fMg6fC30GEm6SavJY4lt
hNS7N95dAn8iSGWfWgRv7t3ePAwmiIAZrcsFsjFgpS5IlZOTj9cFjTTz9Tgj030V
s55BSiM8yVrwnsgmZOHoVcQitS7i3b/I4AD/7Nrgx711GEIKesi1/O7eY1h0NaBM
kKlgIxg4GW1BFWd6P6XGtquO5ERYKUAkWRuPpxwUThlLbkXt0AOkWD13pmVD6adw
ZZwTPbFHQ/xvdYLwwSCZWXoPsrmuYcxlTcCzGkWISBPof6wmOkVshUAO6flVqKJ/
lm6rhpDKVgC/M1dOyDR9yh+Na3rgBFP0lOrJZpjW93Wld19v/yY6DSyZdJZoIOE=
=mDg8
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoEuwsACgkQ2kYOR+5txmp31gCgjoG/Y5W0QMkVY9fafZPb5SUb
MzEAn253UwCq+8UbdyD+ls7ZAcSvSt4h
=/lhN
-----END PGP SIGNATURE-----

21 April 2009

Russell Coker: Amusing Thanks.txt Entry

My SE Linux Play Machine [1] has a file named thanks.txt for users to send messages to me [2]. On a number of occasions people have offered to give me things in exchange for the password for the bofh account (the one with sysadm_r privileges). I ve been offered stolen credit cards, a ponzi scheme of root access to servers on the net, and various other stuff. Today I received an amusing joke entry: Hello Kind Sir, I am Dr. Adamu Salaam, the the bank manager of bank of africa (BOA) Burkina Faso West I am sending you this message about the $3.14159 million dollars in bank account number 2718281828450945. I will give you this money in exchange for the password to the bofh account. The amount of money is based on the value of Pi. The account number is based on the mathematical constant e [3]. It s a pity that the author of that one didn t sign their real name. Whoever created that should have claimed credit for their work.

20 April 2009

Biella Coleman: Penguin uprising

Linux?

16 April 2009

David Welton: Computer People Don't Click on Ads

Ok, so everyone knows that, but I was particularly surprised. LangPop.com got on the front page of Hacker News the other day and I got a ton of hits. But virtually no one clicked on the advertisements - just a few clicks for many thousands of page views. Some of my other sites, which are of a more general-interest nature, do way better with far fewer visitors. Not that I'm really complaining, I did langpop.com for fun, but it's a good reminder that it's a lot better to produce and sell things to a more general audience. Programmers expect, and largely get, most everything for free - me included.

15 April 2009

Marco d'Itri: privilege escalation to root in udev

All releases of udev older than 141 allow a local user to instantly get root privileges (CVE-2009-1185). I am not aware of a publically available exploit. Workaround: kill udevd(8).

30 March 2009

John Goerzen: Kindle 2: How s It Going?

It s now been almost a month since I got my Kindle 2 and wrote about my first impressions of it. In that amount of time, I figure I have read, on the Kindle, the equivalent of 1500 to 2000 printed pages. I ll start with my personal reactions to the device, and then move on into some less subjective observations about it. What I ve Used It For To give you a quick idea of what I m reading: The Gut Reaction I want everything to be available on the Kindle, and I want to read everything on it. Whether that s just some excitement at a new device (still possible after a month, I guess), or something more lasting, I m still a little unclear about but I suspect it s something more lasting. I have read far, far more since I have had the Kindle than I had for quite some time prior, excepting a certain Hitchhiker s Guide to the Galaxy marathon one Christmas vacation. This leads me to think that the Kindle s main competitor isn t the Sony PRS-505, but rather the XBox, Wii, Netflix, and Hulu. Not that I watched that much TV to start with, but I haven t even been keeping up with the Daily Show since I got the Kindle. Not only that, but it prompted me to go to the local used bookstore (all proceeds go to charity) and buy a paper copy of David Copperfield for $10, so Terah could read it with me while I reread it on the Kindle. So it seems that Amazon s stats which show that people tend to read more once they get the Kindle, and don t cut down on paper book buying are about right in my case. Plus there s the fact that I ve loaded up the Kindle with over a hundred free books of all sorts of descriptions, some from Amazon s own free book catalog (extensive in itself), and others from Feedbooks, Gutenberg, or other places. That s taken up some time itself, and I now have achieved what I tend to achieve with all devices like this (iPod, MythTV, etc): more material than I can ever possibly get through. Why I Like It So, what exactly IS it about this thing that I like? Part of it has to be the size of the device. Granted, I wish the screen were larger, but even with the leather case, the device is a pretty nice size. I find that I keep two or three books that I m reading at the top of my list, and it s great to be able to carry around a single device and be able to select from a book as the mood strikes. Part of it is the built-in dictionary and search tools, which I ve already discussed. In the end, Amazon s execution of the concept is just done really, really well. It doesn t require some sort of proprietary Windows app like Sony s reader does. It doesn t even require a PC at all. It acts as reliable as a book, and that s something. The highlight/clippings feature is also pretty nice. You can highlight a section of text, which then causes it to be rendered with an underline on-screen just like you can underline something in a book. Better yet, when you re reading the book, you can call up a list of all such passages (as well as your bookmarks, etc), see them with an excerpt of text, and jump directly to them. No more need for millions of tiny pieces of paper marking a page that contains a marking. Even better than that, the Kindle creates a .txt (yes, plain text) file in the documents/ directory for you. Each time you bookmark or highlight a passage, it adds a little summary of the passage to that file, as well as information about the location of it. For highlights, the summary is the content of the highlight itself. So if you re going to go blog about the book later, there are a bunch of ready-made quotes you can cut-and-paste later. You can read that file both on the Kindle and on a PC. Sweet. So, I guess I would say that the Kindle makes it easier to read complex texts, and fun to read lighter ones. Availability of Content There are several ways you can get content onto the Kindle. The first, of course, is Amazon s own Kindle Store. Quite the clever bit of engineering there. You hit buy , and generally by the time you can walk over to the Kindle and pick it up, the book s on it, thanks to the integrated cell-network wireless modem. Subscriptions to newspapers and magazines work similarly each issue is automatically delivered in the middle of the night. However, it seems that the magazines such as New Yorker and Atlantic aren t exactly complete replicas of the print editions for some reason. The pricing of Kindle content is generally cheaper than paperback editions of books, but not by much. I think it should be more heavily discounted than it is, and part of that may be due to the large commission Amazon takes on things. Ironically, Amazon also has a tremendous array of free public domain and copyrighted books, and an equally staggering number of books available for under $1. For the classics, and other things out of copyright, my favorite place to turn is Feedbooks. They ve got ebooks available for download for just about any format, including Kindle, and generally do a good job of providing a real linked Table of Contents and the like. Kindle can read DRM-free content in .txt or .mobi format. I ve also built my own ebooks for the Kindle using Mobiperl. It takes an ePub source directory and makes a MobiPocket file out of it, which can be installed on the Kindle directly. For things I find on Project Gutenberg, GutenMark is a nice tool to create a good-looking HTML representation. I also use quote-fixer to help with my other pet peeve: straight quotes and lack of em-dashes on a device that can, and should, display both. Screen I m still of two minds about the screen. On the one hand, it doesn t give me eyestrain like reading on a PC, laptop, or cellphone screen does. Also, it looks remarkably book-like. A well-prepared Kindle etext feels so professional on the screen, so real, so lovingly-prepared, that it s fun to read. The Feedbooks David Copperfield is an excellent example of this, as is Houston Smith s Why Religion Matters. There are several things I don t like about the screen. One is that, while reading a book, it leaves a margin around the edge of the text. I can t figure out why it doesn t use all the available screen real-estate, especially since its built-in web browser does. Another is that, while not terribly reflective, it is still somewhat reflective, and glare from the sun or a light at a bad angle can make the screen unreadable unless you turn it a bit to a different angle. But my biggest gripe about the screen is that it s not as high-contrast as I d like. Still, I very much enjoy the Kindle, so I guess it s not as huge a problem as I think it could be sometimes. Pet Peeve I get really annoyed when I download content for the Kindle and discover that it doesn t have a linked Table of Contents (meaning I can click on a chapter and go directly to it). I m even more annoyed when it uses straight typewriter quotes instead of the angled typesetter s quotes or smart quotes . The Kindle is capable of beautifully rendering them, as well as things such as em dashes, and when I see what is obviously some cheap attempt at a conversion of some ancient ASCII document, rather than a proper attempt to make a good-looking book, I get annoyed. And so it was that I requested, and got, a $0.80 refund for my purchase of Sherlock Holmes: The Complete Collection and instead paid $3.60 for The Complete Sherlock Holmes. Yes, I could have spent a few hours converting all these from Gutenberg, but $3.60 is so cheap that it wasn t worth it. Customer Service Amazingly, Amazon s customer service for the Kindle is not their usual Asian form letter service. It s Americans, who seem to read, understand, and care about problems. I was pleasantly surprised. Too bad the rest of Amazon doesn t learn a thing or two from it. Conclusion I think the Kindle is worth it. It will pay for itself exceptionally quickly for people like me that don t live anywhere near a large library, and enjoy reading out-of-copyright material. Even if it doesn t pay for itself that quickly, the convenience of being able to carry several actively reading books with you on a single small device is pretty nice. No more pile of books in my suitcase for travel.

25 March 2009

Marco d'Itri: Running kvm without root privileges

This is my recipe for easily running kvm as an unprivileged user without using sudo and custom network configuration scripts. /etc/network/interfaces:
iface kvmnet inet static
        address         10.5.0.1
        netmask         255.255.255.0
        broadcast       10.5.0.255
        pre-up          vde_tunctl -u md -t $IFACE
        post-down       vde_tunctl -d $IFACE
        up              echo 1 > /proc/sys/net/ipv4/ip_forward
        up              iptables --table nat --append POSTROUTING --jump MASQUERADE --source $IF_ADDRESS/$IF_NETMASK
        down            iptables --table nat --delete POSTROUTING --jump MASQUERADE --source $IF_ADDRESS/$IF_NETMASK
~/bin/kvm:
#!/bin/sh -e
iface='kvmnet'
macaddr='DE:AD:42:00:00:01'
model='virtio'
exec kvm \
    -net nic,vlan=0,macaddr=$macaddr,model=$model \
    -net tap,vlan=0,ifname=$iface,script=no,downscript=no \
    "$@"
Configuring a PV network interface is optional, but it is more efficient and if the guest uses udev and a modern kernel it will just work. Bonus tip: use "-vnc :0 -usbdevice tablet -serial telnet:127.0.0.1:4444,server,nowait" for a headless guest which if needed will still have proper consoles.

Next.

Previous.