- Roundtable - muug.ca

intel-media-driver with Intel 1165G7 and Rocky 9
by Chris Audet 04 Mar '23

04 Mar '23

@Alberto just a quick follow up from last meeting, you had suggested installing the official Intel driver to get the most out of this CPU. I installed as per this kb <https://rpmfusion.org/Howto/Multimedia>, everything seems OK (it shows up installed because I ran it again as an example, forgot to copy the output first time): [root@what ~]# dnf install intel-media-driver Last metadata expiration check: 2:11:34 ago on Wed 15 Feb 2023 03:49:21 PM. Package intel-media-driver-21.1.3-1.el9.x86_64 is already installed. Dependencies resolved. Nothing to do. Complete! Only thing I was wondering was how to verify that the OS is actually using the newly installed driver. After reboot, the Gnome settings app is reporting "Mesa Intel® Xe Graphics (TGL GT2)", I'm not 100% sure but I think that's what it was displaying before the install as well. In any case I'll keep using it and will report back if anything exciting happens. Thanks for the tip 🙂

3 7

MUUG Meeting, Tuesday, Mar 7, 7:30pm (Date Change, In-person Meeting) -- KVM without a GUI
by Gilbert Detillieux 28 Feb '23

28 Feb '23

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting IN PERSON, on Tuesday, March 7th, at 7:30pm. Yes, that's a week early, i.e. the FIRST Tuesday of the month... KVM without a GUI - Have you lost your head? Linux KVM (Kernel-Based Virtual Machine) is a full virtualization solution for Linux, using hardware accelerated virtualization extensions to provide near physical performance. New users of KVM may find the command line interface daunting and difficult to understand. Even the majority of KVM tutorials online rely on the GUI to do the initial installation and setup of your virtual machines, but what if we don't have a GUI? As Linux admins, we are accustomed to doing most of our work in a remote terminal, most of our servers don't even have a keyboard or monitor plugged in, and are located in remote data centers. In this presentation, Wyatt Zacharias will present the basics of how to use the KVM command line tools to create and setup a new virtual machine from scratch. Where to find the Meeting: Fortress Software Inc., 350 Keewatin St -- Unit #2 We have a new in-person meeting location now! Brad Vokey has graciously let us use his work office for our next in-person meeting. The meeting room will be open by 7:00 pm, with the actual meeting starting at 7:30 pm. If driving, enter the lot using the most north east entrance and drive around to the south west corner of the building (see route in map detail on poster linked below). You can use any of the free, amble, and safe parking spots that say "reserved" in front of units #1 through #4 before entering unit #2. Bus stops #30814 and #30880 (route 77) are only 150 meters away. The last bus leaves for Polo Park at 10:15 pm and for Garden City at 10:31 pm. Logan Ave. bus routes #19, #26, and #27 are a 600 meter (8 minute) walk to the south. For those unable or preferring not to attend in person, the meeting will also be available online, using BBB as usual. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) *Date Change* Please note the change in meeting date for this month, and for the rest of the current year (at least until the July/August break). We are now meeting on the first Tuesday of each month. The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

shell quoting inside $( )?
by Adam Thompson 28 Feb '23

28 Feb '23

I’m trying to figure out if there’s a way to do this more compactly (for reasons…): T=$(openssl x509 -noout -text -in "$1") EXPD=$(date -d"$(echo "$T" | sed -n 's/^.*Not After : //p')" +%Y%b%d) SUBJ=$(echo "$T" | sed -n 's/^.*Subject: .*CN = //p') I am having two issues: 1. Bash doesn’t happily let me embed double quotes inside a subshell inside a subshell inside double-quotes. All of the double-quotes are required, AFAICT. So doing X=$(…”$(…”xxx”)”) just doesn’t work because bash doesn’t parse nested double-quotes. But both the inner var and the result can and will have spaces in them. 2. I can’t remember how in shell (bash, in this case) how to bifurcate stdout and have it run to two pipelines. I figure echo is a builtin, so should at least be lighter than re-running the monstrosity that is openssl over and over. I have a vague recollection that this is harder than it sounds, and may not be worth it… Any suggestions on how to solve either issue? I’m sure I’ve just forgotten some obvious technique, hopefully someone can jog my mind. -Adam

4 8

DOCTYPE holy smokes
by Trevor Cordes 25 Feb '23

25 Feb '23

File this under wacky !#%* bug that takes 1 hour to solve and you're #*%@# lucky you solved it... I have some javascript that takes a textarea and turns it into arrays of GSM-7 chars for SMS texting purposes. Based on the nice (FLOSS) online SMS calculator: https://twiliodeved.github.io/message-segment-calculator/ If I input a space (unicode hex code 0x20, same as ascii) in the above page, it'd show up as one GSM-7 codepoint 0x0020. But if I input it in my version of a similar calculator it would always come out as 2 spaces! 0x0020 0x0020 Was I inputting a NBS by accident (which "smart" encoding changes to 2 spaces)? No. Was the js library at fault? Debugging an hour later, probably not. While watching the js debug box in FF I noticed it moaning every page load about the page being loaded in "quirks mode" because of my DOCTYPE first line of all my HTML. With nothing else left to blame it on, I went and changed my DOCTYPE (which is from the first days of my program: 2010ish) to what FF suggests when you click on the quirk (basically eliminating the "transitional" stuff). Boom. Bug goes away. One space is now one space. Doh. Now my curiosity is wondering why a quirk mode needs to double all the spaces to maintain compatibility with something somewhere... That's probably a long story by itself. I'm lucky I even solved this one, as that seemed an unlikely culprit as I've literally never had any issue using my ancient DOCTYPE and IIABDFI. On the downside, I probably just broke my program for all ancient-browser users. Oh well. P.S. GSM-7 char encoding is really really @#*%&ed up. Whoever came up with that travesty should be flogged.

1 1

Fw: [SECURITY] Fedora 36 Update: openssl-3.0.8-1.fc36
by Trevor Cordes 23 Feb '23

23 Feb '23

Oh joy, "password timing" attacks come to SSL. e.g. CVE-2022-4304 Published 2023-02-08T20:15:00 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. Begin forwarded message: Date: Wed, 22 Feb 2023 11:09:09 +0000 (GMT) From: updates(a)fedoraproject.org To: package-announce(a)lists.fedoraproject.org Subject: [SECURITY] Fedora 36 Update: openssl-3.0.8-1.fc36 -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-a5564c0a3f 2023-02-22 11:06:32.699863 -------------------------------------------------------------------------------- Name : openssl Product : Fedora 36 Version : 3.0.8 Release : 1.fc36 * Thu Feb 9 2023 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.0.8-1 - Rebase to upstream version 3.0.8 Resolves: CVE-2022-4203 Resolves: CVE-2022-4304 Resolves: CVE-2022-4450 Resolves: CVE-2023-0215 Resolves: CVE-2023-0216 Resolves: CVE-2023-0217 Resolves: CVE-2023-0286 Resolves: CVE-2023-0401

4 5

USB3 to Ethernet, to make NAS
by Hartmut W Sager 13 Feb '23

13 Feb '23

Can someone here recommend some specific USB3 to Ethernet hardware adapters, to make a reliable NAS drive. I want this architecture because the external USB3 drive will frequently need to be disconnected from NAS usage and connected locally to another computer via USB (for certain data updates). Hartmut - +1-204-339-8331

8 25

Reminder: MUUG Online Meeting, Tonight, Feb 7, 7:30pm (Date Change) -- CheckMK
by Gilbert Detillieux 07 Feb '23

07 Feb '23

A reminder that the MUUG online meeting will be on BBB this evening... The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting online, on Tuesday, February 7th, at 7:30pm. Yes, that's a week early, i.e. the FIRST Tuesday of the month... CheckMK Alberto Abrao will present CheckMK, a great platform for monitoring various IT infrastructure components. It has powerful tools to monitor all different kinds of devices that comprises a regular Enterprise IT environment. Agents are available for Linux, *nix (AIX, Solaris), *BSD, Windows, VMware, AWS, Azure, Kubernetes, Docker, among others. These can be easily enhanced with plug-ins for custom functionality. It also allows for the monitoring of devices that support SNMP. Easy to get started with, but packed with features and infinitely customizable, CheckMK is an excellent choice for the monitoring of any IT environment. *Date Change* Please note the change in meeting date for this month, and for the rest of the current year (at least until the July/August break). We are now meeting on the first Tuesday of each month. This will once again be an online meeting. Stay tuned to our muug.ca home page for the official URL, which will be made available about a half hour before the meeting starts. (Reload the page if you don't see the link, or if there are issues with connecting.) The group now holds its meetings at 7:30pm on the *first* Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

mysql update delays when no rows match, when backup running
by Trevor Cordes 07 Feb '23

07 Feb '23

Question: Mysql (MariaDB actually, fairly recent version) issue. Innodb. Full db backup (table by table) runs each night 5am. There's a massive (few GB) table that takes a couple of mins to backup. When this table is getting backed-up, updates to the table pause until the backup is done. Selects don't seem to pause(?). However, even updates that will match zero rows seem to pause! Shouldn't the engine be doing a select (within a transaction internally) and then quitting the query? It seems like it's wanting to get some sort of lock before doing anything for the update, even the select step. Maybe this makes sense? I suppose if I was doing the locking with transactions in my code (I'm not), I would do a select FOR UPDATE and then update if I had to? Would the "select for update" also pause on the select step? I was thinking change my db library to make all update calls a select-for-update then the update only if needed, but if my hunch is correct, it won't fix anything, and slow things down a touch because I'm doing the internal work myself? And I can't blanket replace all updates with select/update without a "for update" because there could be race conditions between the select/update? Maybe the correct approach is on an instance-by-instance basis where I know I don't care at all about races (like this case) I could replace the update with select (no "for update") plus an update. If I make that an option in my db library, and use it liberally, will I be slowing down (much) the common case of updates running outside of backup time, because then both I and the engine are doing a select? There's no way I'm going to change it to "if backup running, do select first, if not do update by itself" :-) At least, I hope I'm not going to do that!! It's really only 1 table of mine that is multi-GB and has a long backup time, otherwise this would be a non-issue. I was kind of hoping inno took care of all this stuff for me...

4 6

Best ways to find where disk space is being used?
by Chris Audet 07 Feb '23

07 Feb '23

I've got a fairly long lived CentOS server that stubbornly stopped installing updates because the HDD is full. Can someone share their favourite way to determine where disk space is being used up on a system? For example, on Windows I'd use Wiztree/Treesize/Windirstat. On Linux desktop I've been using Gnome Disk Usage Analyzer (aka Baobab) <https://wiki.gnome.org/Apps/DiskUsageAnalyzer>. But I'm not sure what the best solutions are in cases where there's no GUI available. I could always mount / over SSH and use Baobab to crawl the remote filesystem, but that seems less than optimal 🤔 [root@dogmeat ~]# yum update Loaded plugins: fastestmirror, versionlock Loading mirror speeds from cached hostfile * base: mirror.csclub.uwaterloo.ca * epel: ftp.cse.buffalo.edu * extras: mirror.xenyth.net * updates: mirror.csclub.uwaterloo.ca Excluding 5 updates due to versionlock (use "yum versionlock status" to show them) Resolving Dependencies --> Running transaction check ---> Package bind-export-libs.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-export-libs.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-libs.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-libs.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-libs-lite.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-libs-lite.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-license.noarch 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-license.noarch 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package bind-utils.x86_64 32:9.11.4-26.P2.el7_9.10 will be updated ---> Package bind-utils.x86_64 32:9.11.4-26.P2.el7_9.13 will be an update ---> Package dkms.noarch 0:3.0.9-2.el7 will be updated ---> Package dkms.noarch 0:3.0.10-1.el7 will be an update ---> Package httpd.x86_64 0:2.4.6-97.el7.centos.5 will be updated ---> Package httpd.x86_64 0:2.4.6-98.el7.centos.6 will be an update ---> Package httpd-tools.x86_64 0:2.4.6-97.el7.centos.5 will be updated ---> Package httpd-tools.x86_64 0:2.4.6-98.el7.centos.6 will be an update ---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.352.b08-2.el7_9 will be updated ---> Package java-1.8.0-openjdk.x86_64 1:1.8.0.362.b08-1.el7_9 will be an update ---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.352.b08-2.el7_9 will be updated ---> Package java-1.8.0-openjdk-headless.x86_64 1:1.8.0.362.b08-1.el7_9 will be an update ---> Package kernel.x86_64 0:3.10.0-1160.83.1.el7 will be installed ---> Package kernel-devel.x86_64 0:3.10.0-1160.83.1.el7 will be installed ---> Package kernel-headers.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-headers.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package kernel-tools.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-tools.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package kernel-tools-libs.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package kernel-tools-libs.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package python-perf.x86_64 0:3.10.0-1160.81.1.el7 will be updated ---> Package python-perf.x86_64 0:3.10.0-1160.83.1.el7 will be an update ---> Package sudo.x86_64 0:1.8.23-10.el7_9.2 will be updated ---> Package sudo.x86_64 0:1.8.23-10.el7_9.3 will be an update ---> Package xorg-x11-server-Xvfb.x86_64 0:1.20.4-19.el7_9 will be updated ---> Package xorg-x11-server-Xvfb.x86_64 0:1.20.4-21.el7_9 will be an update ---> Package xorg-x11-server-common.x86_64 0:1.20.4-19.el7_9 will be updated ---> Package xorg-x11-server-common.x86_64 0:1.20.4-21.el7_9 will be an update --> Finished Dependency Resolution --> Running transaction check ---> Package kernel.x86_64 0:3.10.0-1160.45.1.el7 will be erased ---> Package kernel-devel.x86_64 0:3.10.0-1160.45.1.el7 will be erased --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: kernel x86_64 3.10.0-1160.83.1.el7 updates 52 M kernel-devel x86_64 3.10.0-1160.83.1.el7 updates 18 M Updating: bind-export-libs x86_64 32:9.11.4-26.P2.el7_9.13 updates 1.1 M bind-libs x86_64 32:9.11.4-26.P2.el7_9.13 updates 158 k bind-libs-lite x86_64 32:9.11.4-26.P2.el7_9.13 updates 1.1 M bind-license noarch 32:9.11.4-26.P2.el7_9.13 updates 92 k bind-utils x86_64 32:9.11.4-26.P2.el7_9.13 updates 262 k dkms noarch 3.0.10-1.el7 epel 85 k httpd x86_64 2.4.6-98.el7.centos.6 updates 2.7 M httpd-tools x86_64 2.4.6-98.el7.centos.6 updates 94 k java-1.8.0-openjdk x86_64 1:1.8.0.362.b08-1.el7_9 updates 317 k java-1.8.0-openjdk-headless x86_64 1:1.8.0.362.b08-1.el7_9 updates 33 M kernel-headers x86_64 3.10.0-1160.83.1.el7 updates 9.1 M kernel-tools x86_64 3.10.0-1160.83.1.el7 updates 8.2 M kernel-tools-libs x86_64 3.10.0-1160.83.1.el7 updates 8.1 M python-perf x86_64 3.10.0-1160.83.1.el7 updates 8.2 M sudo x86_64 1.8.23-10.el7_9.3 updates 844 k xorg-x11-server-Xvfb x86_64 1.20.4-21.el7_9 updates 857 k xorg-x11-server-common x86_64 1.20.4-21.el7_9 updates 57 k Removing: kernel x86_64 3.10.0-1160.45.1.el7 @updates 64 M kernel-devel x86_64 3.10.0-1160.45.1.el7 @updates 38 M Transaction Summary ================================================================================ Install 2 Packages Upgrade 17 Packages Remove 2 Packages Total size: 144 M Is this ok [y/d/N]: y Downloading packages: Running transaction check Running transaction test Transaction check error: installing package python-perf-3.10.0-1160.83.1.el7.x86_64 needs 23MB on the / filesystem installing package sudo-1.8.23-10.el7_9.3.x86_64 needs 26MB on the / filesystem installing package kernel-3.10.0-1160.83.1.el7.x86_64 needs 106MB on the / filesystem installing package bind-export-libs-32:9.11.4-26.P2.el7_9.13.x86_64 needs 109MB on the / filesystem *Error Summary-------------Disk Requirements: At least 109MB more space needed on the / filesystem.* [root@dogmeat ~]# df -h Filesystem Size Used Avail Use% Mounted on devtmpfs 3.8G 0 3.8G 0% /dev tmpfs 3.9G 148K 3.9G 1% /dev/shm tmpfs 3.9G 11M 3.8G 1% /run tmpfs 3.9G 0 3.9G 0% /sys/fs/cgroup */dev/mapper/centos_ba--bog--v-root 41G 40G 355M 100% /* /dev/sda1 497M 346M 151M 70% /boot /dev/mapper/centos_ba--bog--v-home 20G 99M 20G 1% /home tmpfs 779M 0 779M 0% /run/user/0

5 5

Uh oh, Spectre redux
by Trevor Cordes 07 Feb '23

07 Feb '23

https://gruss.cc/files/prefetch.pdf CVE-2023-0597 The CVE's are empty (reserved) until people install the fixes. Fedora already has a fix, as I'm sure many other distros do. This looks like a bad one. Spectre-like in its scope. Another fundamental flaw in the design of modern CPUs in terms of side-channel attacks. But this one is on address-space knowledge, allowing the defeat of ASLR/SMAP. So in that sense it is not a direct attack vector, but one that could be leveraged by other attacks that can benefit from address space knowledge. (I think? Thoughts?) Yet another fix that is going to slow down our systems. The authors claim "only" up to 5% slowdown. All of these 5% slowdowns from the last 3 years are starting to add up... It's like the atomic bomb: at times one might wish no one had discovered it... :-/

1 0