- Roundtable - muug.ca

shell quoting inside $( )?
by Adam Thompson 28 Feb '23

28 Feb '23

I’m trying to figure out if there’s a way to do this more compactly (for reasons…): T=$(openssl x509 -noout -text -in "$1") EXPD=$(date -d"$(echo "$T" | sed -n 's/^.*Not After : //p')" +%Y%b%d) SUBJ=$(echo "$T" | sed -n 's/^.*Subject: .*CN = //p') I am having two issues: 1. Bash doesn’t happily let me embed double quotes inside a subshell inside a subshell inside double-quotes. All of the double-quotes are required, AFAICT. So doing X=$(…”$(…”xxx”)”) just doesn’t work because bash doesn’t parse nested double-quotes. But both the inner var and the result can and will have spaces in them. 2. I can’t remember how in shell (bash, in this case) how to bifurcate stdout and have it run to two pipelines. I figure echo is a builtin, so should at least be lighter than re-running the monstrosity that is openssl over and over. I have a vague recollection that this is harder than it sounds, and may not be worth it… Any suggestions on how to solve either issue? I’m sure I’ve just forgotten some obvious technique, hopefully someone can jog my mind. -Adam

4 8

DOCTYPE holy smokes
by Trevor Cordes 25 Feb '23

25 Feb '23

File this under wacky !#%* bug that takes 1 hour to solve and you're #*%@# lucky you solved it... I have some javascript that takes a textarea and turns it into arrays of GSM-7 chars for SMS texting purposes. Based on the nice (FLOSS) online SMS calculator: https://twiliodeved.github.io/message-segment-calculator/ If I input a space (unicode hex code 0x20, same as ascii) in the above page, it'd show up as one GSM-7 codepoint 0x0020. But if I input it in my version of a similar calculator it would always come out as 2 spaces! 0x0020 0x0020 Was I inputting a NBS by accident (which "smart" encoding changes to 2 spaces)? No. Was the js library at fault? Debugging an hour later, probably not. While watching the js debug box in FF I noticed it moaning every page load about the page being loaded in "quirks mode" because of my DOCTYPE first line of all my HTML. With nothing else left to blame it on, I went and changed my DOCTYPE (which is from the first days of my program: 2010ish) to what FF suggests when you click on the quirk (basically eliminating the "transitional" stuff). Boom. Bug goes away. One space is now one space. Doh. Now my curiosity is wondering why a quirk mode needs to double all the spaces to maintain compatibility with something somewhere... That's probably a long story by itself. I'm lucky I even solved this one, as that seemed an unlikely culprit as I've literally never had any issue using my ancient DOCTYPE and IIABDFI. On the downside, I probably just broke my program for all ancient-browser users. Oh well. P.S. GSM-7 char encoding is really really @#*%&ed up. Whoever came up with that travesty should be flogged.

1 1

Fw: [SECURITY] Fedora 36 Update: openssl-3.0.8-1.fc36
by Trevor Cordes 23 Feb '23

23 Feb '23

Oh joy, "password timing" attacks come to SSL. e.g. CVE-2022-4304 Published 2023-02-08T20:15:00 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. Begin forwarded message: Date: Wed, 22 Feb 2023 11:09:09 +0000 (GMT) From: updates(a)fedoraproject.org To: package-announce(a)lists.fedoraproject.org Subject: [SECURITY] Fedora 36 Update: openssl-3.0.8-1.fc36 -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-a5564c0a3f 2023-02-22 11:06:32.699863 -------------------------------------------------------------------------------- Name : openssl Product : Fedora 36 Version : 3.0.8 Release : 1.fc36 * Thu Feb 9 2023 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.0.8-1 - Rebase to upstream version 3.0.8 Resolves: CVE-2022-4203 Resolves: CVE-2022-4304 Resolves: CVE-2022-4450 Resolves: CVE-2023-0215 Resolves: CVE-2023-0216 Resolves: CVE-2023-0217 Resolves: CVE-2023-0286 Resolves: CVE-2023-0401

4 5

USB3 to Ethernet, to make NAS
by Hartmut W Sager 13 Feb '23

13 Feb '23

Can someone here recommend some specific USB3 to Ethernet hardware adapters, to make a reliable NAS drive. I want this architecture because the external USB3 drive will frequently need to be disconnected from NAS usage and connected locally to another computer via USB (for certain data updates). Hartmut - +1-204-339-8331

8 25

Reminder: MUUG Online Meeting, Tonight, Feb 7, 7:30pm (Date Change) -- CheckMK
by Gilbert Detillieux 07 Feb '23

07 Feb '23

A reminder that the MUUG online meeting will be on BBB this evening... The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting online, on Tuesday, February 7th, at 7:30pm. Yes, that's a week early, i.e. the FIRST Tuesday of the month... CheckMK Alberto Abrao will present CheckMK, a great platform for monitoring various IT infrastructure components. It has powerful tools to monitor all different kinds of devices that comprises a regular Enterprise IT environment. Agents are available for Linux, *nix (AIX, Solaris), *BSD, Windows, VMware, AWS, Azure, Kubernetes, Docker, among others. These can be easily enhanced with plug-ins for custom functionality. It also allows for the monitoring of devices that support SNMP. Easy to get started with, but packed with features and infinitely customizable, CheckMK is an excellent choice for the monitoring of any IT environment. *Date Change* Please note the change in meeting date for this month, and for the rest of the current year (at least until the July/August break). We are now meeting on the first Tuesday of each month. This will once again be an online meeting. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

mysql update delays when no rows match, when backup running
by Trevor Cordes 07 Feb '23

07 Feb '23

Question: Mysql (MariaDB actually, fairly recent version) issue. Innodb. Full db backup (table by table) runs each night 5am. There's a massive (few GB) table that takes a couple of mins to backup. When this table is getting backed-up, updates to the table pause until the backup is done. Selects don't seem to pause(?). However, even updates that will match zero rows seem to pause! Shouldn't the engine be doing a select (within a transaction internally) and then quitting the query? It seems like it's wanting to get some sort of lock before doing anything for the update, even the select step. Maybe this makes sense? I suppose if I was doing the locking with transactions in my code (I'm not), I would do a select FOR UPDATE and then update if I had to? Would the "select for update" also pause on the select step? I was thinking change my db library to make all update calls a select-for-update then the update only if needed, but if my hunch is correct, it won't fix anything, and slow things down a touch because I'm doing the internal work myself? And I can't blanket replace all updates with select/update without a "for update" because there could be race conditions between the select/update? Maybe the correct approach is on an instance-by-instance basis where I know I don't care at all about races (like this case) I could replace the update with select (no "for update") plus an update. If I make that an option in my db library, and use it liberally, will I be slowing down (much) the common case of updates running outside of backup time, because then both I and the engine are doing a select? There's no way I'm going to change it to "if backup running, do select first, if not do update by itself" :-) At least, I hope I'm not going to do that!! It's really only 1 table of mine that is multi-GB and has a long backup time, otherwise this would be a non-issue. I was kind of hoping inno took care of all this stuff for me...

4 6

Best ways to find where disk space is being used?
by Chris Audet 07 Feb '23

07 Feb '23

I've got a fairly long lived CentOS server that stubbornly stopped installing updates because the HDD is full. Can someone share their favourite way to determine where disk space is being used up on a system? For example, on Windows I'd use Wiztree/Treesize/Windirstat. On Linux desktop I've been using Gnome Disk Usage Analyzer (aka Baobab) <https://wiki.gnome.org/Apps/DiskUsageAnalyzer>. But I'm not sure what the best solutions are in cases where there's no GUI available. I could always mount / over SSH and use Baobab to crawl the remote filesystem, but that seems less than optimal 🤔 [root@dogmeat ~]# yum update Loaded plugins: fastestmirror, versionlock Loading mirror speeds from cached hostfile * base: mirror.csclub.uwaterloo.ca * epel: ftp.cse.buffalo.edu * extras: mirror.xenyth.net * updates: mirror.csclub.uwaterloo.ca Excluding 5 updates due to versionlock (use "yum versionlock status" to show them) Resolving Dependencies --> Running transaction check ---> Package bind-export-libs.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-export-libs.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-libs.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-libs.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-libs-lite.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-libs-lite.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-license.noarch 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-license.noarch 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-utils.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-utils.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package dkms.noarch 0:3.0.9-2.el7 will be updated ---> Package dkms.noarch 0:3.0.10-1.el7 will be an update ---> Package httpd.x86_64 0:2.4.6-97.el7.centos.5 will be updated ---> Package httpd.x86_64 0:2.4.6-98.el7.centos.6 will be an update ---> Package httpd-tools.x86_64 0:2.4.6-97.el7.centos.5 will be updated ---> Package httpd-tools.x86_64 0:2.4.6-98.el7.centos.6 will be an update ---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.352.b08-2.el7_9 will be updated ---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.362.b08-1.el7_9 will be an update ---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.352.b08-2.el7_9 will be updated ---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.362.b08-1.el7_9 will be an update ---> Package kernel.x86_64 0:3.10.0-1160.83.1.el7 will be installed ---> Package kernel-devel.x86_64 0:3.10.0-1160.83.1.el7 will be installed ---> Package kernel-headers.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-headers.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package kernel-tools.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-tools.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package kernel-tools-libs.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-tools-libs.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package python-perf.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package python-perf.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package sudo.x86_64 0:1.8.23-10.el7_9.2 will be updated ---> Package sudo.x86_64 0:1.8.23-10.el7_9.3 will be an update ---> Package xorg-x11-server-Xvfb.x86_64 0:1.20.4-19.el7_9 will be updated ---> Package xorg-x11-server-Xvfb.x86_64 0:1.20.4-21.el7_9 will be an update ---> Package xorg-x11-server-common.x86_64 0:1.20.4-19.el7_9 will be updated ---> Package xorg-x11-server-common.x86_64 0:1.20.4-21.el7_9 will be an update --> Finished Dependency Resolution --> Running transaction check ---> Package kernel.x86_64 0:3.10.0-1160.45.1.el7 will be erased ---> Package kernel-devel.x86_64 0:3.10.0-1160.45.1.el7 will be erased --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: kernel x86_64 3.10.0-1160.83.1.el7 updates 52 M kernel-devel x86_64 3.10.0-1160.83.1.el7 updates 18 M Updating: bind-export-libs x86_64 32:9.11.4-26.P2.el7_9.13 updates 1.1 M bind-libs x86_64 32:9.11.4-26.P2.el7_9.13 updates 158 k bind-libs-lite x86_64 32:9.11.4-26.P2.el7_9.13 updates 1.1 M bind-license noarch 32:9.11.4-26.P2.el7_9.13 updates 92 k bind-utils x86_64 32:9.11.4-26.P2.el7_9.13 updates 262 k dkms noarch 3.0.10-1.el7 epel 85 k httpd x86_64 2.4.6-98.el7.centos.6 updates 2.7 M httpd-tools x86_64 2.4.6-98.el7.centos.6 updates 94 k java-1.8.0-openjdk x86_64 1:1.8.0.362.b08-1.el7_9 updates 317 k java-1.8.0-openjdk-headless x86_64 1:1.8.0.362.b08-1.el7_9 updates 33 M kernel-headers x86_64 3.10.0-1160.83.1.el7 updates 9.1 M kernel-tools x86_64 3.10.0-1160.83.1.el7 updates 8.2 M kernel-tools-libs x86_64 3.10.0-1160.83.1.el7 updates 8.1 M python-perf x86_64 3.10.0-1160.83.1.el7 updates 8.2 M sudo x86_64 1.8.23-10.el7_9.3 updates 844 k xorg-x11-server-Xvfb x86_64 1.20.4-21.el7_9 updates 857 k xorg-x11-server-common x86_64 1.20.4-21.el7_9 updates 57 k Removing: kernel x86_64 3.10.0-1160.45.1.el7 @updates 64 M kernel-devel x86_64 3.10.0-1160.45.1.el7 @updates 38 M Transaction Summary ================================================================================ Install 2 Packages Upgrade 17 Packages Remove 2 Packages Total size: 144 M Is this ok [y/d/N]: y Downloading packages: Running transaction check Running transaction test Transaction check error: installing package python-perf-3.10.0-1160.83.1.el7.x86_64 needs 23MB on the / filesystem installing package sudo-1.8.23-10.el7_9.3.x86_64 needs 26MB on the / filesystem installing package kernel-3.10.0-1160.83.1.el7.x86_64 needs 106MB on the / filesystem installing package bind-export-libs-32:9.11.4-26.P2.el7_9.13.x86_64 needs 109MB on the / filesystem *Error Summary-------------Disk Requirements: At least 109MB more space needed on the / filesystem.* [root@dogmeat ~]# df -h Filesystem Size Used Avail Use% Mounted on devtmpfs 3.8G 0 3.8G 0% /dev tmpfs 3.9G 148K 3.9G 1% /dev/shm tmpfs 3.9G 11M 3.8G 1% /run tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup */dev/mapper/centos_ba--bog--v-root 41G 40G 355M 100% /* /dev/sda1 497M 346M 151M 70% /boot /dev/mapper/centos_ba--bog--v-home 20G 99M 20G 1% /home tmpfs 779M 0 779M 0% /run/user/0

5 5

Uh oh, Spectre redux
by Trevor Cordes 07 Feb '23

07 Feb '23

https://gruss.cc/files/prefetch.pdf CVE-2023-0597 The CVE's are empty (reserved) until people install the fixes. Fedora already has a fix, as I'm sure many other distros do. This looks like a bad one. Spectre-like in its scope. Another fundamental flaw in the design of modern CPUs in terms of side-channel attacks. But this one is on address-space knowledge, allowing the defeat of ASLR/SMAP. So in that sense it is not a direct attack vector, but one that could be leveraged by other attacks that can benefit from address space knowledge. (I think? Thoughts?) Yet another fix that is going to slow down our systems. The authors claim "only" up to 5% slowdown. All of these 5% slowdowns from the last 3 years are starting to add up... It's like the atomic bomb: at times one might wish no one had discovered it... :-/

1 0

libvirt, vmware, and Windows 2000
by Scott Toderash 05 Feb '23

05 Feb '23

If the subject line doesn't scare you then maybe you can help me out with this one. Windows 2000 is its own punishment at this point, but it's part of the mission in this case. I have a working Windows 2000 server running on VMWare esxi. I downloaded the image as a vmdk file and attempted to import it into my Linux system as a KVM image. It mostly works. I did this successfully with 2 other machines that were Windows 2012R2 from the same source and same destination. Those work. W2k is having issues because it has C: E: and F: but only C: is recognized when I boot it up in the new environment. It shows that E: exists but it believes that it is corrupted. There are probably some parameters that I don't know about that I need to pass in order to make this work. The general process was download the vmdk image, use "qemu-img convert" to make a raw file and then try to boot that. I tried using virt-install and I tried some other manual config methods but this is as far as I have been able to get. Does anyone here have experience with this sort of scenario?

3 6

How can one execute a script just before shutdown on Ubuntu
by vsankar＠foretell.ca 04 Feb '23

04 Feb '23

Sorry to bother you all with this question — can you please point me to a helpful document or give me some instructions on how to execute a script just before shutting down an Ubuntu system (Linux vijay-iMac 5.15.0-58-generic #64-Ubuntu SMP Thu Jan 5 11:43:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux)? I created a simple script -rwxr-xr-x 1 root root 51 Jan 30 11:46 /etc/init.d/before-shutdown Then did a link so that I had lrwxrwxrwx 1 root root 25 Jan 30 11:47 K04before-shutdown -> ../init.d/before-shutdown Nothing happened!! So I wasted a lot of time reading up on systemd etc., and set up unit files to execute before shutdown.target, network.target, power off.target, as well as halt.target. Since these did not work either and life is too short, I went back to what I thought was the old way of doing things and did a lrwxrwxrwx 1 root root 25 Feb 4 11:58 /etc/rc6.d/K99before-shutdown -> ../init.d/before-shutdown This was a complete fail as well. Would really appreciate any suggestions on how to make this work. Thanks very much, Vijay Vijay Sankar ForeTell Technologies Limited vsankar(a)foretell.ca

3 2