I recently came across a need to remove every trace a package makes in CentOS 7. Yum erase didn’t entirely do the trick, so I had to get a bit more creative. My solution was to combine the repoquery and xargs commands:
repoquery -l <package_name> | xargs rm -rf
Success! Every file in the yum package was removed entirely. Complete obliteration.
I had a peculiar issue today where I suddenly lost the ability to see any bluetooth devices on my Linux Mint 18.2 desktop utilizing a Plugable USB Bluetooth adapter.
The fix involved checking kernel messages for anything insightful. In my case this is what led me to the solution:
[ 608.988353] Bluetooth: hci0: BCM: Patch brcm/BCM20702A1-0a5c-21e8.hcd not found [ 609.156320] Bluetooth: hci0: BCM: chip id 63 [ 609.172330] Bluetooth: hci0: LPP-3389-WIN [ 609.173313] Bluetooth: hci0: BCM20702A1 (001.002.014) build 1764 [ 609.173347] bluetooth hci0: Direct firmware load for brcm/BCM20702A1-0a5c-21e8.hcd failed with error -2
After some googling I finally came across the solution here. The fix is to download the firmware for your bluetooth adapter and place it in the place the bluetooth kernel module expects it to be in, then to reload the bluetooth kernel module.
sudo mkdir -p /lib/firmware/brcm sudo wget https://s3.amazonaws.com/plugable/bin/fw-0a5c_21e8.hcd -O /lib/firmware/brcm/BCM20702A1-0a5c-21e8.hcd sudo rmmod btusb bnep bluetooth btrtl btintel bnep btbcm sudo modprobe btusb bnep bluetooth btrtl btintel bnep btbcm
That did the trick! You can also reboot your machine instead of removing / re-loading the kernel modules and it will accomplish the same thing.
I recently came across an issue with my WordPress installation. It’s situated behind a load balancer where SSL is terminated. The load balancer takes HTTPS traffic, then forwards it as HTTP on port 80 to the wordpress server.
I was running issues with a redirect loop after installing wordpress. The solution was to add this bit of code to wp-config.php:
define('FORCE_SSL_ADMIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on';
This solves the redirect loop issue but then I ran into a different problem. When I tried to sign into wp-admin I would get this message:
Sorry, you are not allowed to access this page.
After much digging I found this post which emphasizes that you must place that code BEFORE anything else in wp-config.php (except for the beginning PHP tag.) Success!
Lately I’ve been doing 100% of my gaming in Linux. The latest versions of wine in Arch Linux have been fantastic (for the most part.) I recently installed a game called Gauntlet (a windows-only steam game.) For some reason I had no sound. Sound worked fine in other Wine games, just not this one.
After much digging I found this post on the Arch Linux forums which fixed my issue. The issue was not having the proper 32bit sound libraries installed. The fix was as simple as:
sudo pacman -Sy lib32-alsa-plugins lib32-libpulse lib32-openal
Success!
In addition to my ZFS snapshots I decided to implement a secondary backup system. I decided to land on urbackup for ease of use and, more importantly, it was easier to set up.
Assuming a Cent-based system:
cd /etc/yum.repos.d/ sudo wget http://download.opensuse.org/repositories/home:uroni/CentOS_7/home:uroni.repo sudo yum -y install urbackup-server sudo systemctl enable urbackup-server sudo systemctl start urbackup-server
Open up necessary ports for the server:
sudo firewall-cmd --add-port=55413-55415/tcp --permanent sudo systemctl reload firewalld
By default urbackup listens on port 55414 for connections. You can change this to port 80 and/or 443 for HTTPS by installing nginx and having it proxy the connections for you.
sudo yum -y install nginx sudo systemctl enable nginx sudo setsebool -P httpd_can_network_connect 1 #if you're using selinux
Copy the following into /etc/nginx/conf.d/urbackup.conf (make sure to change server_name to suit your needs)
server {
server_name backup;
location / {
proxy_pass http://localhost:55414/;
}
}Then start nginx:
sudo systemctl start nginx
You should then be able to access the urbackup console by navigating to the IP / hostname of your backup server in a browser.
Urbackup can use a snapshot system known as dattobd. You should use it if you can in order to get more consistent backups, otherwise urbackup will simply copy files from the host which isn’t always desirable (databases, for example)
Install dattobd (optional):
sudo yum -y update
# reboot if your kernel ends up being updated
sudo yum -y localinstall https://cpkg.datto.com/datto-rpm/repoconfig/datto-el-rpm-release-$(rpm -E %rhel)-latest.noarch.rpm
sudo yum -y install dkms-dattobd dattobd-utils
Install urbackup client:
TF=`mktemp` && wget "https://hndl.urbackup.org/Client/2.1.15/UrBackup%20Client%20Linux%202.1.15.sh" -O $TF && sudo sh $TF; rm $TF
#Select dattobd when prompted if desiredConfigure Firewall:
sudo firewall-cmd --add-port=35621-35623/tcp --permanent sudo systemctl reload firewalld
Once a client is installed, assuming they’re on the same network as the backup server, they will automatically add themselves and begin backing up. If they don’t show up it’s usually a firewall issue.
Restoration of individual files is easily done through the web console. If you have a windows system, restoring from an image backup is also easy.
Recovery is trickier if you want to restore a Linux system. Install an empty system of same distribution. Give it the same hostname. Install the client as outlined above, then run:
sudo /usr/local/bin/urbackupclientctl restore-start -b last
If for some reason the client not showing up after removing it from the GUI: Uninstall & re-install client software
sudo /usr/local/sbin/uninstall_urbackupclient
TF=`mktemp` && wget "https://hndl.urbackup.org/Client/2.1.15/UrBackup%20Client%20Linux%202.1.15.sh" -O $TF && sudo sh $TF; rm $TFWhen working with hard drives it is always a good idea to back the entire thing up before proceeding. I wanted to write down the procedure so I don’t keep forgetting it.
dd does the trick here.
sudo dd if=/dev/<drive device file> of=image.img bs=64M
If you wish to see the progress of the above dd command you can open up a separte window and issue the kill command
kill -USR1 `pidof dd`
You can now disconnect the drive and work with its image instead (great for forensics or dealing with a dying drive.)
In later versions of Linux you can do this with losetup and partprobe.
sudo losetup -Pr -f <path to image file>
sudo losetup #find which loop device file corresponds with your image here
sudo mount -o ro /dev/<loopdevice>p<partition number> <mountpoint>
For example, this is what I did on my system for my aunt’s laptop (I was interested in the 2nd partition on her drive, the one containing Windows files)
Note: remove the r from the above command if you want to mount read/write (required for LVM partitions)
sudo losetup -Pr -f susan-ssd.img
sudo losetup
NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE DIO
/dev/loop0 0 0 0 1 /home/partimag/susan-ssd.img 0
sudo mount -o ro /dev/loop0p2 mount/
When you’re done, unmount the image and delete the image mapping:
umount <path to mount directory> sudo losetup -d <loop file obtained earlier>
I’ve been trying to establish a site-to-site VPN connection between my house and my parents’ for a couple years now. Each time I try I become frustrated and eventually give up. No longer! I’ve finally gotten a site to site VPN working between my pfSense router and my parents’ Netgear Nighthawk R8000 running DD-WRT v3.
It was quite the undertaking for me to get these two systems talking. I drew a lot of inspiration from here. In order to get this to work you need to keep these things in consideration:
I used the following settings to get things working between these two devices:
If you haven’t already, generate a certificate authority and server certificate. Do this in System / Cert Manager and click Add. When generating the certificate make sure the Certificate Type is Server Certificate.
Optional? I found that for some reason the routing table wasn’t properly populated with the remote network on my pfSense server. I added a custom option to take care of that:
route <remote network> <remote subnet mask> <remote VPN IP>
In my example it ended up being “route 192.168.98.0 255.255.255.0 10.54.98.2”
You will need to export the Certificate Authority certificate as well as the client certificate & private key files for use with dd-wrt. Do this by going to System / Cert Manager. There are little icons to the right of the certificates where you can click to download them.
Export the CA certificate as well as both the certificate and key from whatever was specified in the Server Certificate section from the above OpenVPN configuration.
Go to Services / VPN and look for the OpenVPN Client section
IN THEORY this should be all that you have to do. The tunnel should establish and traffic should flow between both networks. Sadly it wasn’t that simple for my setup.
After setting up the tunnel I saw everything was connected but the traffic was unidirectional (remote could ping local network but not visa versa.)
On the pfsense router, I ran
netstat -r | grep 192.168
(change the grep to whatever your remote network is)
I noticed that there were no routes to the remote network. To fix this I appended a server option in the OpenVPN server config (adjust this to match your networks)
route 192.168.98.0 255.255.255.0 10.54.98.2
Adding the route on the server helped but things still weren’t getting through. I enabled logging on the DD-WRT side, consoled into the router, and ran the following:
watch -n 1 "dmesg | grep 192.168.98"
This revealed a lot of dropped packets from my OpenVPN server’s network. After a lot of digging I found this forum post that suggested a couple custom iptables rules to allow traffic between the bridged network and the OpenVPN network (adjust interface names as necessary)
iptables -I FORWARD -i br0 -o tap1 -j ACCEPT iptables -I FORWARD -i tap1 -o br0 -j ACCEPT
This doesn’t survive a reboot, so you’ll want to enter those two commands in the Administration / Commands section of the dd-wrt web configuration and click “Save Firewall”
Finally, after a custom routing rule on the pfsense side and a custom iptables rule on the dd-wrt side, two way VPN has been established!
With the loss of trust of Startcom certs I found myself needing a new way to obtain free SSL certificates. Let’s Encrypt is perfect for this. Unfortunately SophosUTM does not support Let’s Encrypt. It became time to replace Sophos as my reverse proxy. Enter nginx.
The majority of the information I used to get this up and running came from digitalocean with help from howtoforge. My solution involves CentOS7, nginx, and the let’s encrypt software.
sudo yum install nginx letsencrypt sudo firewall-cmd --add-service=http --permanent sudo firewall-cmd --add-service=https --permanent sudo systemctl enable nginx
Inform selinux to allow nginx to make http network connections:
sudo setsebool -P httpd_can_network_connect 1
Generate your SSL certificates with the letsencrypt command. This command relies on being able to reach your site over the internet using port 80 and public DNS. Replace arguments below to reflect your setup
sudo letsencrypt certonly -a webroot --webroot-path=/usr/share/nginx/html -d example.com -d www.example.com
The above command places the certs in /etc/letsencrypt/live/<domain_name>
In my case I had a few paid SSL certificates I wanted to copy over from Sophos UTM to nginx. In order to do this I had to massage them a little bit as outlined here.
Download p12 from Sophos, also download certificate authority file, then use openssl to convert the p12 to a key bundle nginx will take.
openssl pkcs12 -nokeys -in server-cert-key-bundle.p12 -out server.pem openssl pkcs12 -nocerts -nodes -in server-cert-key-bundle.p12 -out server.key cat server.pem Downloaded_CA_file.pem > server-ca-bundle.pem
Once you have your keyfiles you can copy them wherever you like and use them in your site-specific SSL configuration file.
First make sure that the renew command works successfully:
sudo letsencrypt renew
If the output is a success (a message saying not up for renewal) then add this to a cron job to check monthly for renewal:
sudo crontab -e
30 2 1 * * /usr/bin/letsencrypt renew >> /var/log/le-renew.log
35 2 1 * * /bin/systemctl reload nginxUncomment the https settings block in /etc/nginx/nginx.conf to allow for HTTPS connections.
Generate a strong DH group:
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
Create SSL conf snippets in /etc/nginx/conf.d/ssl-<sitename>.conf. Make sure to include the proper location of your SSL certificate files as generated with the letsencrypt command.
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_dhparam /etc/ssl/certs/dhparam.pem;Here is a sample ssl.conf file:
server {
listen 443;
ssl_certificate /etc/letsencrypt/live/<HOSTNAME>/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/<HOSTNAME>/privkey.pem;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
access_log /var/log/<HOSTNAME.log>;
server_name <HOSTNAME>;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://<BACKEND_HOSTNAME>/;
}
}
Redirect http to https by creating a redirect configuration file (optional)
sudo vim /etc/nginx/conf.d/redirect.conf
server {
server_name
<DOMAIN_1>
...
<DOMAIN_N>;
location /.well-known {
alias /usr/share/nginx/html/.well-known;
allow all;
}
location / {
return 301 https://$host$request_uri;
}
}
Restart nginx:
sudo systemctl restart nginx
Solution found here: use the $host variable instead of the $server_name variable in your configuration.
Websockets require a bit more massaging in the configuration file as outlined here. Modify your site-specific configuration to add these lines:
# we're in the http context here map $http_upgrade $connection_upgrade { default upgrade; '' close; }server {proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade;}
I have a Mediasonic 4 bay USB drive enclosure plugged into a FreeNAS system as a backup. This enclosure randomizes hardware ID information which confuses FreeNAS. The main symptom of this is the error message about multipath not being optimal.
The way to fix this is to drop to a command line and destroy the mistaken multipath configuration (thanks to this site for the information)
For Freenas 9.x:
gmultipath destroy disk1 disk2 disk3 reboot
For FreeNAS Corral it’s a bit different. You have to brute force remove the kernel module for multipath (thanks to this site for the explanation)
mv /boot/kernel/geom_multipath.ko/boot/kernel/geom_multipath.ko.old
Keep in mind that you may have to do this after each update.
An additional problem is that for some reason GUI doesn’t see the drives but the OS does. If you want smart checking on those other drives you have to do a bit of hackery by creating a SMART job for the visible drives, then manually dropping into a shell to add the invisible ones. Below are my notes for when I did this (I’m not sure these changes survive a reboot)
sudo vi /etc/local/smartd.conf
/dev/da2 -a -n never -W 0,0,0 -m root -M exec /usr/local/www/freenasUI/tools/sma rt_alert.py -s S/(01|02|03|04|05|06|07|08|09|10|11|12)/../(1|2|3|4|5|6|7)/(00) ps aux|grep smartd kill -9 (pidof smartd)
sudo /usr/local/sbin/smartd -i 1800 -c /usr/local/etc/smartd.conf -p /var/run/smartd.pid
I’ve run crouton on my Chromebook Pixel 2 (2015, codename Samus) for some time now but I’ve found myself wanting more. Virtualbox, kernel access, graphics, and more don’t perform well in a chroot. Thankfully it’s actually pretty easy to dual boot Chrome OS and Linux on your chromebook thanks to chrx (pronounced “marshmallow”?)
The first part of installation is identical to setting up crouton:
Open up a shell (CTRL + ALT + T, shell, enter) and enter the following
sudo crossystem dev_boot_usb=1 dev_boot_legacy=1
and reboot.
Next, download and run the chrx script twice. The first run will partition and powerwash your system; the second run will actually install GalliumOS (or Ubuntu or Fedora) alongside ChromeOS.
cd ; curl -Os https://chrx.org/go && sudo sh go
reboot after partition, run shell again. You can specify a number of arguments to the go script; I wanted to use Cinnamon on Fedora so these are the ones I used:
cd ; curl -Os https://chrx.org/go && sudo sh go -d fedora -e cinnamon -r latest -H <hostname> -U <username> -Z <timezone>
Fedora took quite a long time to install (1 hour in my case.) Just let the script do its thing. Once complete you can reboot and press CTRL + D for chromeOS or CTRL + L for Linux.
After that, reboot into your new linux environment!
There were a few samus-specific things I needed to do.
For some reason my locale was set to an African country. Correct by doing this: (thanks to here) I added SELinux commands because for some reason I was getting permission denied errors.
sudo setenforce 0 localectlset-localeLANG=en_US.utf8 sudo setenforce 1
This issue stems from the fact that the sound card is not presented as the first available card. The system defaults to HDMI sound instead. Fortunately this page has instructions on how to fix this. If you’re running GalliumOS default you can follow the instructions from the link above. In my case I had to get a bit creative.
cp -r /etc/skel/.config $HOME sudo samus-alsaenable-speakers sudo samus-touch-reset
Success! You can now dual boot between Full blown Linux and ChromeOS on your Chromebook Pixel.
Occasionally my touchpad and touchscreen stop responding after resuming from sleep. The galliumOS-samus fix mentioned above has a handy reset script that fixes this. Simply run:
sudo samus-touch-reset
and your touch functionality is restored. I bound this command to a key shortcut to make things easier.
After installing virtualbox I got a strange error message when trying to start VMs:
Failed to load VMMR0.r0 (VERR_SUPLIB_OWNER_NOT_ROOT)
I found this mention saying that /usr has to be owned by root. Easy enough of a fix:
sudo chown root:root /usr/