Setting the environment variable is done… Read more To open EPS files on GIMP for Windows, you'll need to install GhostScript. You can download GhostScript here. After installing, you'll also need to configure a system environment variable: GS_PROG. This variable must point to the executable, in my case C:\Program Files\gs\gs9.05\bin\gswin32.exe.

Setting the environment variable is done in the advanced settings of "my computer".

Linux
KDE
A Windows server to connect to.

Step 1: Install required software

yum install kde-plasma-networkmanagement-pptp NetworkManager-pptp

Step 2: Configure the network

In the KDE Network Manager plasma module, go to the tab VPN, click add and choose PPTP.
Read more Requirements

Linux
KDE
A Windows server to connect to.

Step 1: Install required software

yum install kde-plasma-networkmanagement-pptp NetworkManager-pptp

Step 2: Configure the network

In the KDE Network Manager plasma module, go to the tab VPN, click add and choose PPTP.

Enter and connection name you like. In the field "gateway" type the hostname or IP number of the Windows server you're connecting to. Under Login, Password and NT Domain, fill in your authentication data. Then click advanced.

In the advanced window, disable EAP and enable MPPE. Then click OK.

Go to the tab IPv4. Under method, I chose Automatic (VPN). But Automatic (VPN) addresses only is also a nice option: it sets the IPs but no DNS settings.

Go to the routes sub-tab. Switch on Ignore automatically obtained routes and Use only for resources on this connection to make sure the connection doesn't steal your traffic. Then I entered a manual route: 192.168.178.0/255.255.255.0 to gateway 0.0.0.0 (it is a ppp device after all).

You may want to configure IPv6 as well, but I don't at this moment, so I'm not documenting this.

Step 3: Connect

Click on the icon in the tray and connect.

Step 1. Network configuration

First, install system-config-network or manually configure the network. I prefer system-config-network for easy configurations and vim for more complex configurations.
yum… Read more In this post, I'll be writing down all steps required to build a Squid proxy server on a clean "minimal" installation of CentOS 6.0

Step 1. Network configuration

First, install system-config-network or manually configure the network. I prefer system-config-network for easy configurations and vim for more complex configurations.
yum -y install system-config-network-tui

Step 2. Install some tools for convenience

yum -y install vim-minimal vim-enhanced openssh-clients mc telnet policycoreutils policycoreutils-python bind-utils

Step 3. Install ntp and synchronize clocks

If one of the clocks it out of sync, NTLM authentication will not work. Therefore, we synchronize the clocks. Using pool.ntp.org as a source would be good, but if the AD server isn't synchronized with that source, we'd have the same problem. So I'm synchonizing the proxy to the AD server (Win2003SBS actually) instead:

rpm -q ntp || yum -y install ntp

sed -i "s/^server /#server /g" /etc/ntp.conf

echo "server AD-SERVERNAME" >> /etc/ntp.conf

ntpdate AD-SERVERNAME #synchronize right now

service ntpd start #and keep in sync

chkconfig ntpd on

Step 4. Install squid and other required software

yum -y install krb5-workstation samba-common samba-winbind authconfig squid

chkconfig squid on

Step 5. Connect to active directory

Please note that MYCOMPANY.local and mycompany.local may be different domains due to the upper/lowercase.

ADSERVER=sbs.MYCOMPANY.local

DOMAIN=MYCOMPANY.local

WORKGROUP=MYCOMPANY

authconfig --enableshadow --enablemd5 --passalgo=md5 --krb5kdc=$ADSERVER \

--krb5realm=$DOMAIN --smbservers=$ADSERVER --smbworkgroup=$WORKGROUP \

--enablewinbind --enablewinbindauth --smbsecurity=ads --smbrealm=$DOMAIN \

--smbidmapuid="16777216-33554431" --smbidmapgid="16777216-33554431" --winbindseparator="+" \

--winbindtemplateshell="/bin/false" --enablewinbindusedefaultdomain --disablewinbindoffline \

--winbindjoin=Administrator --disablewins --disablecache --enablelocauthorize --updateall

service winbind restart

chkconfig winbind on

Give squid permissions to use winbind info:
usermod -G wbpriv squid

Now check your winbind connection using the following commands:

wbinfo -u

wbinfo -g

Step 6. Firewall

iptables -I INPUT -m tcp -p tcp --dport 3128 -j ACCEPT

/sbin/service iptables save

Step 7. Configure squid

I commented out this line from /etc/squid/squid.conf:
http_access allow localnet
That line would have allowed users from 10.0.0.0/8+172.16.0.0/12+192.168.0.0/16 and others to use the proxy without authentication. Then I added the following right below that line:

acl whitelist dstdom_regex -i "/etc/squid/whitelist"

http_access allow whitelist

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp

auth_param ntlm children 5

auth_param ntlm keep_alive on

acl our_networks src 192.168.0.0/16

acl ntlm proxy_auth REQUIRED

http_access allow our_networks ntlm

authenticate_ip_ttl 900 seconds

This will allow all valid, logged in users to surf the web. You could also limit which users can surf by adding --require-membership-of=ADGROUPNAME to the ntlm_auth command

The first two lines of above configuration point to a file /etc/squid/whitelist. This file contains domains that should never be denied. My whitelist file contains:

\.trendmicro\.com

^trendmicro\.com

\.microsoft\.com

^microsoft\.com

Start Squid using /sbin/service squid restart and the proxy is ready.

Step 8. Optional: IPv6 issues

I've been experimenting with IPv6 for a while now, but I don't have IPv6 available on all systems. That caused me some trouble with the next step. I had to give preference to IPv4 above IPv6 by editting /etc/gai.conf:

label ::1/128       0

label ::/0          1

label 2002::/16     2

label ::/96         3

label ::ffff:0:0/96 4

label fec0::/10     5

label fc00::/7      6

precedence ::ffff:0:0/96  100

precedence ::1/128       50

precedence ::/0          40

precedence 2002::/16     30

precedence ::/96          20

Step 9. Optional: Some white- and blacklisting

We may not want to allow all sites to be visited. For instance, porn sites are often blocked in office situations. I've got a manual on blacklisting using SquidGuard as well.

How the hell are you… Read more Today I upgraded my Fedora 15 installation to Fedora 16 with KDE 4.7.4. Although it was a pretty smooth transition this time, there were a few problems. One of them was that Konsole 4.7.4-2.fc16 was hiding underscores, which is pretty annoying when you're programming.

How the hell are you supposed to code when half of the characters is invisible?

I'm more than happy to report that I fixed it. On the profile's page "advanced" you find the option "Enable Bi-Directional text rendering". Enabling this option fixed the problem immediately.

Google'ing, I found a few pages that say this is specific to a combination of intel or nouveau driver + specific fonts + Qt 4.8.

Update: RedHat acknowledged the issue and released a fix: konsole 4.7.4-2.fc16. Update using yum update konsole

Onvoldoende geheugen of bronnen om de bewerking te voltooien. Sluit enkele programma's af en probeer het opnieuw.

Which means:

Insufficient memory to complete operation. Close some programs and try again

Other resources suggested that the file opened… Read more One of my users got an annoying message when starting MS Paint (mspaint.exe):

Onvoldoende geheugen of bronnen om de bewerking te voltooien. Sluit enkele programma's af en probeer het opnieuw.

Which means:

Insufficient memory to complete operation. Close some programs and try again

Other resources suggested that the file opened was too big or that we're doing something with a .tiff file. But he was just starting paint, no images involved at that point. The solution was to open regedit and remove the following key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint
That reset all MS Paint settings and we could start paint again.

I installed the following packages:

https://market.android.com/details?id=de.schaeuffelhut.android.openvpn.installer

https://market.android.com/details?id=de.schaeuffelhut.android.openvpn

Then I discovered that the openvpn binary was not completely okay, especially the ifconfig parameter gave some unexpected errors on correct configurations. So I downloaded this file (mirror), unzipped it, and put it… Read more I'm currently running CF-Root kernel version CF-Root-SGS2_XW_XEN_KK2-v5.0-CWM5.

I installed the following packages:

https://market.android.com/details?id=de.schaeuffelhut.android.openvpn.installer

https://market.android.com/details?id=de.schaeuffelhut.android.openvpn

Then I discovered that the openvpn binary was not completely okay, especially the ifconfig parameter gave some unexpected errors on correct configurations. So I downloaded this file (mirror), unzipped it, and put it on the location of the original openvpn binary.

mount /system -o remount,rw
cd /system/xbin
ln -s /system/bin/toolbox  ifconfig
ln -s /system/bin/toolbox  route
mv openvpn openvpn-original
mv /path/to/new/openvpn openvpn
mount /system -o remount,ro

And it works great!

To make… Read more On my Fedora 15 laptop, I'm almost always connected to several VPNs simultaneously. One VPN to my office or to my home (depending on where I am), one to the data center, one to a customer. These connections all have their own DNS server with their own suffix.

To make all dns suffixes working, I created a script that redirects all outgoing DNS traffic to dnsmasq running on localhost, which in turn forwards all requests for .lan to 192.168.15.254 and all requests for .gl to 192.168.1.254.

The script was put in /etc/NetworkManager/dispatcher.d/10-DNS:

if [ -e /var/run/dnsmasq.localhost ]; then
        cat /proc/`cat /var/run/dnsmasq.localhost`/cmdline |grep dnsmasq >/dev/null 2>/dev/null && \
        kill `cat /var/run/dnsmasq.localhost`
fi
 
if [ "$2" == "up" ]; then
        cp /etc/resolv.conf /etc/resolv.conf.dhcp
        echo nameserver 127.0.0.1 >  /etc/resolv.conf
        echo domain $DHCP4_DOMAIN_NAME >> /etc/resolv.conf 
        echo search $DHCP4_DOMAIN_NAME >> /etc/resolv.conf 
        /usr/sbin/dnsmasq -C /dev/null -r /etc/resolv.conf.dhcp --server=/gl/192.168.1.254 \
            --server=/lan/192.168.15.254 --bind-interfaces --listen-address 127.0.0.1 \ 
            --pid-file=/var/run/dnsmasq.localhost
fi

Once I had to fix resolv.conf manually when I connected my laptop to my Samsung Galaxy SII as well. This may mean I need to improve the script some day, but for the time being, it works good enough.

mkfifo backpipe
nc localhost 55545 0<backpipe | nc localhost 55546 1>backpipe

Telnet with readline and a history:

socat -d -d READLINE,history=$HOME/.http_history \
TCP4:www.domain.org:www,crnl

Talk… Read more Connect two netcats to each other

mkfifo backpipe
nc localhost 55545 0<backpipe | nc localhost 55546 1>backpipe

Telnet with readline and a history:

socat -d -d READLINE,history=$HOME/.http_history \
TCP4:www.domain.org:www,crnl

Talk to your modem in raw mode:

socat - /dev/ttyS0,raw,echo=0,crnl

Simulate tail -f:

socat -u /var/log/messages,seek-end=0,ignoreeof -

Give a random interactive program, such as nslookup, a history:

socat readline,history=.nslookup_hist exec:"nslookup",pty,ctty,setsid,echo=0

Use your modem with a non-persistent history:

socat readline /dev/ttyS0,raw,echo=0,crlf,nonblock

Use your modem with a persistent history:

socat READLINE,history:/tmp/serial.cmds \
  OPEN:/dev/ttyS0,ispeed=9600,ospeed=9600,crnl,raw,sane,echo=false

To dos (as in tofrodos):

socat -u - -,crlf

From dos (as in tofrodos):

socat -u -,cr -

Run sendmail daemon with your favorite network options

socat TCP-LISTEN:25,fork,ip-ttl=4,ip-tos=7,tcp-maxseg=576 EXEC:"/usr/sbin/sendmail -bs",nofork

Send a mail using chat (from ppp package):

socat -d -d system:'/usr/sbin/chat "220 " "HELO loopback" "250 " "MAIL FROM: <root@localhost>" "250 " "RCPT TO: root" "250 " "DATA" "354 " "test'$(echo -e "\r.")'" "250 " "QUIT"',pty,echo=0,cr tcp:localhost:25,crlf,nodelay

Connect remote X :1 to local X :0

socat exec:'ssh root@troas socat unix-l\:/tmp/.X11-unix/X1 -' unix:/tmp/.X11-unix/X0

Note the escaping of the colon in the remote command.

Sending a file - Server sending the file

server$ socat -u FILE:test.dat TCP-LISTEN:9876,reuseaddr
client$ socat -u TCP:127.0.0.1:9876 OPEN:out.dat,creat

Sending a file - Server receiving the file

server$ socat -u TCP-LISTEN:9876,reuseaddr OPEN:out.txt,creat
client$ socat -u FILE:test.txt TCP:127.0.0.1:9876

Be a syslog server:

socat -u UDP4-LISTEN:5140,reuseaddr,fork OPEN:/tmp/syslog.msg,creat,append

I can't figure out how to put a newline after each message...

Send syslog messages to screen:

socat -t0 -T0 -u UDP4-LISTEN:514,reuseaddr,fork -

To get time from time server:

socat TCP:time.nist.gov:13 -

Really sick - use socat as a VPN solution:

socat -d -d  \
    TUN:192.168.99.2/24,up \
    SYSTEM:"ssh root@remote-server socat -d -d  - 'TUN:192.168.99.1/24,up'"

This must be run as a user that can modify tap/tun devices on both sides of the tunnel.

Use a remote modem
On the side with the modem

socat /dev/ttyS0,raw,echo=0 tcp4-listen:3334<pre>
On the side where you want the modem transferred
<pre lang="bash">socat PTY,link=$HOME/vmodem0,raw,echo=0 TCP:servername:3334

You can now access remote /dev/ttyS0 through local $HOME/vmodem0

Use a remote modem over SSH

socat PTY,link=$HOME/vmodem0,waitslave \
 EXEC:"ssh root@remote-server socat - /dev/ttyS0"

You can now access remote /dev/ttyS0 through local $HOME/vmodem0. Remove waitslave to keep alive after local client disconnect.

More information:
1 2

Unfortunately, this mail system… Read more As I may have mentioned before VMWare Data Recovery is not my favorite backup solution. I'm pleased to report that VDR2.0 is a LOT better than 1.x ever was. Since upgrading, my backups haven't failed once. And it even has a built-in email reporting system.

Unfortunately, this mail system isn't too customizable. Since I'd like my subjects to be clear they need extra attention, I made a little fix. This script is started by socat.

Install socat

Socat handles incoming connections on port 25 for me.
rpm -i http://download.fedora.redhat.com/pub/epel/5/x86_64/socat-1.7.1.3-1.el5.x86_64.rpm

Get my script

cd /usr/local/bin ; wget http://www.geeklab.info/wp-content/uploads/2011/12/smtp-filter.sh
You should put your own mailserver in the script on line 7.

Start it automatically

echo "socat TCP4-LISTEN:25,fork EXEC:/usr/local/bin/smtp-filter.sh &" >> /etc/rc.d/rc.local

Now change your settings

Change the outgoing mailserver to localhost and test it. If everything's ok, you'll get a mail with 1 warning and 2 error-message, as the test-mail doesn't contain the fields that indicate no backups failed.

Security

The iptables firewall does not allow incoming connections to port 25, so you will not become an open relay using this script.

To print labels on my… Read more This page contains raw notes and/or untested notes. They may be incorrect, parts may be missing or the article may contain parts that are not needed and more. An update will probably follow some day.

To print labels on my Dymo, I'm running a custom built webapp that allows users in the entire network to print. It has a memory, prints KIX-codes (that make it easier for the postal service to process letters) and prints a logo.

In my setup, the server generating the logo and the server printing it are two different machines. But even if they weren't, this method keeps the webserver in its SELinux confinement.

Requirements

We need some tools, install the packages with the following command:
yum install ripmime

Add the printer to CUPS

Add the printer to CUPS, so you can spool jobs to it. I'm not explaining this part.

Generate a label

Using PHP's GD extensions I generate a new image with width=1010 and height=540. Using this high resolution results in good quality prints.

The image is exported as a .png file, named [something-random].dymo.png and transported to the printserver through a special email-address.

Prepare the mailserver

I'm running a Postfix mailserver. This mailserver has a special address that accepts print jobs, extracts the files and prints them.

In /etc/postfix/master.cf, add the following lines:

printer unix  -       n       n       -       -       pipe
  flags=F  user=nobody argv=/etc/postfix/bin/printserver $sender $recipient

Then in /etc/postfix/transport, we put:

printer.geeklab.info    printer:

The domain printer.geeklab.info doesn't necessarily need to exist, as long as you smtp right to this mailserver.

Finally in /etc/postfix/main.cf we enable the transport maps, if that hasn't been done before:

transport_maps = hash:/etc/postfix/transport

Write a script

In master.cf we start the script /etc/postfix/bin/printserver. Add this content to said script:

#!/bin/bash
TMPDIR=/var/spool/mailprinter/$$_${RANDOM}_${RANDOM}
MESSAGE_FILE=${TMPDIR}_the_message
mkdir -p $TMPDIR
cat > $MESSAGE_FILE
ripmime -i $MESSAGE_FILE -d $TMPDIR
for i in ${METAMAIL_TMPDIR}/*.dymo.png; do
lpr -PDymo -o PageSize=w167h288 -o landscape -o page-left=0 -o page-top=0 -o page-right=0 -o page-bottom=26 -o orientation-requested=5 -o scaling=100
done
rm -rf $MESSAGE_FILE $TMPDIR

Manage SELinux settings

The script we just write uses ripmime and lpr and runs as the Postfix pipe user. To allow the Postfix pipe program to use these tools, run postfix_pipe_t in a permissive state:
semanage permissive -a postfix_pipe_t
Always remember to manage SELinux, not disable it.