tech.neveragain.de

DISCLAIMER: If you expect to find something interesting here, better come back in yet another few months. This is work in progress and still not very far yet.


Contents


Java

Java command line options

List of most (all?) JVM options (Solaris, Linux).

Keep in mind:

  • Options that begin with -X are non-standard (not guaranteed to be supported on all VM implementations), and are subject to change without notice in subsequent releases of the JDK.
  • Options that are specified with -XX are not stable and are not recommended for casual use. These options are subject to change without notice.

Apple

OS X

It's spelled "Mac O-S-Ten", not with a literal "X". Its predecessor was Mac OS 9.

OS X Keyboard Shortcuts

On the homepage of Dan Frake's Book "Mac OS X Power Tools" is a very useful list of keyboard shortcuts.

Open Firmware Keyboard options

Hold down these keys immediately after poweron to enjoy their magic:

Key Function
C Boot from CD
N Boot from Network
T FireWire Target Disk Mode
Cmd-V Verbose startup
Cmd-S Boot Single User
Cmd-Opt-P-R Reset Parameter RAM (PRAM)
Opt Startup Manager
Cmd-Opt-O-F Enter commands after starting up in Open Firmware

From http://docs.info.apple.com/article.html?artnum=106482

iPod

Problems? Go Troubleshooting Your iPod!

Be warned, though: The Key Combinations mentioned there apparently refer to the iPods 1G, 2G and 3G.

The iPodLinux Wiki has a more complete list of Key Combinations.

By the way: According to the HDD S.M.A.R.T. data, after using my Photo for about half a year, the poor little fella counted 226 hard disk starts/stops.


Network Operations

Not-A-NOC, really, but anyway.

Cricket to come, Smokeping is now ready for use.


Quality Software from the NeverAgain project

cliTunes 1.0

Simple command line interface to control iTunes. May be useful if you want to control iTunes from SSH sessions or shell scripts.

Currently support the operations next, prev, play, stop.

Mac OS X only -- Objective-C code using Cocoa's NSAppleScript.

Download source and binary (disk image)


Administrativa

High Availability and SLAs

SLAs (Service Level Agreements) usually give a guaranteed availability in percent per year.

99% sounds nice, doesn't it? Well, there is a HA-Calculator available to make you aware of how much this really is.


LAN / WAN, Wiring

Routing

IPsec

There's what seems to be a pretty nice guide at unixwiz.net explaining all the words and headers and ...


Crypto

Hard disk encryption: GBDE (paper)

GBDE is FreeBSD's (GEOM-based) implementation for encrypting whole disks / partitions. There is an interesting paper that discusses human and administrative issues as well as the cryptography used. It provides an analysis of possible attack scenarios.

vsftpd

vsftpd supports SSL; here is an example configuration file that provides SSL support and allows login based on system accounts and doing appropriate setuid()ing and chroot()ing.

lftp

lftp supports SSL but unfortunately completely ignores the server's certificate by default. Setting ftp:ssl-force, ssl:verify-certificate and an appropriate ssl:ca-file should make you feel much safer. If necessary, you can also point to a CRL file.


DNS

Classless reverse delegation

As IPv4 reverse DNS delegation is technically limited to octet boundaries (/8, /16, /24), you cannot really delegate for smaller networks (such as a /27). The trick is to use CNAMEs and delegate single labels; this is defined in RFC 2317.

The DNS Place

Questions? - Men & Mice provide an extensive glossary, a FAQ and some other interesting things at The DNS Place.


E-Mail and sendmail

Testing SMTP AUTHentication

Generating Base64 string for use with AUTH PLAIN:

perl -MMIME::Base64 -e 'print encode_base64("\000username\000password")'

That is your username and your password together with a leading zero-byte and a zero-byte as separator. Thanks to this site.

UUCP setup for a satellite system

Why?

Using UUCP for systems that aren't connected 24/7 to the internet has a number of advantages over the "classic" fetchmail + local MTA setup, including:

  • The sending MTA won't have problems because of it's dialup IP address (some moron DNS blacklist services and other broken MTA configs will reject this)
  • The envelope-To: is retained, which makes distribution on the receiving MTA possible without the braindead fetchmail hack of checking the body's To: header.
  • The MX which gates to UUCP (the MTA "in front of" the final MTA) just queues mail, it won't send warnings or return mail because of timeouts if the destination MTA doesn't poll its mail for a while.

Example configuration: sendmail

Using sendmail as base, the following configuration can be taken as an example. hobbit.neveragain.de is the internet-connected MTA and dottie.neveragain.de is the laptop that polls and sends its mail via UUCP.

On hobbit.neveragain.de, we need in sendmail:

/etc/mail/mailertable: dottie.neveragain.de uucp-dom:dottie
/etc/mail/relay-domains: dottie.neveragain.de

On dottie.neveragain.de, we need:

/etc/mail/sendmail.mc: define(`SMART_HOST', `uucp-dom:hobbit')

Both machines obviously need MAILER(uucp) in their mc file. Depending on defaults and file locations, it may be necessary to define(`UUCP_MAILER_PATH', `/usr/local/bin/uux').

Example configuration: uucp

Configuration usually lives in /etc/uucp (or in FreeBSD 5.X, for example, in /usr/local/etc/uucp [1]).

The interesting files here are merely call (only needed on dottie), config, passwd (only needed on hobbit), port and sys. There are example files available here.

Please note that the username (on hobbit) needs to be there as a UNIX user as well. Typically with /var/spool/uucp as default (dummy) home directory and /path/to/uucico as shell.

Now you should be ready: running /path/to/uucico -Shobbit on dottie will connect to hobbit and send/receive any queued mail on both sides. Run this from cron as needed.

UUCP log files may have been changed by your system to go to /var/log/uucp/ or you might find them in their default location in /var/spool/uucp/.

[1]UUCP was removed from the base system in 5.X; install the net/freebsd-uucp port and expect everything in /usr/local.

Problems with inline PGP

Inline PGP is outdated and should not be used anymore. PGP/MIME is the Way of doing things.

There are procmail recipes that transform incoming inline PGP messages to PGP/MIME so your MUA won't have any trouble with it:

For mutt:

  • ESC-P (capital P) decodes inline PGP from the message viewer
  • The option pgp_create_traditional controls creation of inline PGP

FTP

Active vs. Passive FTP

See here: "Active FTP vs. Passive FTP, a Definitive Explanation".

It also summarizes the needed firewalling rules for each type.


Editing

vi reference card

The world's text editor for real men. If you're not a guru yet, there a pretty handy quick reference out there.

reStructuredText

Hate HTML? Love plain text? Want to produce nice HTML from well readable (and writable) text files? Try reStructuredText! See links at the footer of this page - it's made with reST.

FreeBSD specific experimental stuff

iPod-Patch

The Apple iPod (most models, as far as is known), when connected via USB to a FreeBSD since at least the 5.x series, will be recognized as umass(4) device but the kernel won't create the corresponding da(4) device so it can be accessed. Attempts to camcontrol(8) the device will hang. Eventually the system will freeze.

(NAME HERE) has located the problem on NetBSD and sent a patch that seems to work well on FreeBSD, too.

You can get the patch here. It optionally disables a short code block in src/sys/dev/usb/usb_subr.c that itself is a hack for other USB devices. Apply it and add to your kernel configuration:

options         USB_IPOD_HACK

Then recompile and hope that it works.


Trivia

Misc

Power consumption measurements

Some more or probably rather less interesting measurements I have taken recently - at home - can be found here.

Notepad for random junk

shell: List each path element

function lsd() {
        local IFS="/"
        local LSD
        LSDIN="`pwd`"

        for f in $LSDIN; do
                if test -z "$f"; then
                        ls -ld /
                else
                        LSD="$LSD/$f"
                        ls -ldF "$LSD"
                fi
        done
}

$NeverAgain: www/tech.neveragain.de/index.rst,v 1.49 2007/10/19 09:16:44 amf Exp $