PFX to PEM for Linux Azure CLI

In order to use a service principal for the Azure CLI on Linux via a certificate instead of password, the file must be a "certificate" (not private key or public key). Given a .PFX file, to convert it to the proper certificate file use:

openssl pkcs12 -in $CertName.pfx -clcerts -nodes -out $CertName.pem

If you try to feed it something else you're likely to get the very unhelpful error:

Traceback (most recent call last):
  File "/usr/lib64/az/lib/python2.7/site-packages/knack/cli.py", line 206, in invoke
    cmd_result = self.invocation.execute(args)
  File "/usr/lib64/az/lib/python2.7/site-packages/azure/cli/core/commands/__init__.py", line 560, in execute
    raise ex
Error: [('PEM routines', 'get_name', 'no start line')]

No GCM Push on Wifi

I ran into a problem where one day I noticed that I was no longer receiving GCM push notifications when on wifi on my Android Nexus 5x.  If I disabled wifi and used cellular data, notifications would work fine.  Using the dial code *#*#426#*#* I was able to locate the Google Play Services log console and I saw a bunch of messages like this:

02-04 08:32:35.939 net=1: Failed connection err:24
02-04 08:33:31.329 net=1: Failed connection err:24
02-04 08:33:31.595 net=1: Failed connection err:19
02-04 08:34:22.032 net=1: Failed connection err:24

I thought the problem was my phone but it turns out it was actually my DNS settings for my local network.  After a lot of painstaking work, I found that mtalk.google.com was resolving to 216.239.38.120.  This was because I was using DNS to force Google searches into "safe search" mode.  After adding a DNS entry for mtalk.google.com as 108.177.98.188, all of the sudden my GCM notifications started working again.  Yeah!

Freeing Space at Beginning of LVM Partition

I ran into a situation on an old computer where I had two partitions:

• /sda1 = /boot
• /sda2 = lvm

Unfortunately, the size of /boot was less than 200 MB, so it wasn't big enough for newer kernels and extras.  What I wanted to do was slightly shrink my lvm and give the space to /boot.  Unfortunately, after using pvmove to free some physical extents at the beginning of the partition, I found that pvresize was unable to free space at the beginning of a partition.  I tried using gparted to do the job, but it gave me error messages. 

So I decided to do the job manually.  It turns out that you can absolutely resize an LVM partition without pvresize; you just need to use vgcfgbackup and vgcfgrestore.

Obviously you should backup your data before doing anything.  From there:

1. Make a backup of the current configuration.
   

   vgcfgbackup --file /tmp/my_vg_cfg VolumeGroupName

2. Disable the logical volumes by unmounting everything and running
   

   vgchange -an VolumeGroupName

3. Edit /tmp/my_vg_cfg (maybe make a backup) and do the following:
   
   • Know how many Physical Extents (PEs) you are going to reduce by. In my case, one PE was 16 MB (32768 x 512 byte sectors).
   • Increment seqno for good housekeeping
   • Reduce dev_size by the number of PEs 
   • Reduce pe_count by the number of PEs
   • Under each of the logical_volumes, under each segment, reduce the number inside stripes by the number of PEs.  Note that you shouldn't need to touch the start_extent number, even if it's non-zero.
4. Use parted to delete the partition and recreate it to the right, keeping the same ending location.  I used sectors as the units to make it easy, since one PE is 32768 sectors in my case. 
5. Now recreate the physical volume.  You can find the physical volume UUID inside the /tmp/my_vg_cfg.  Replace sda2 with whatever your partition is.

   pvcreate --uuid PV_UUID --restorefile /tmp/my_vg_cfg /dev/sda2

6. Now we need to "restore" the lvm using our modified file:

   vgcfgrestore --file /tmp/my_vg_cfg VolumeGroupName

7. That's it.  You should be able to use vgchange -ay to re-enable the logical volumes and then run fsck to make sure everything took.

I'm kind of surprised I couldn't find this solution with a quick Google search.
 

XBMC 12.2 RPM for Centos 6

I built an XBMC 12.2 RPM for Centos 6. I'm sharing it here in hopes that someone else won't have to go through the work I did. The RPM doesn't have pulseaudio support because pulseaudio has issues with XBMC and HDMI passthrough.


 xbmc-12.2-3.el6.x86_64.rpm
 taglib-devel-1.8-3.20121215git.el6.x86_64.rpm
 taglib-1.8-3.20121215git.el6.x86_64.rpm
 python-setproctitle-1.1.6-1.el6.x86_64.rpm
 cmake-gui-2.8.11-1.el6.x86_64.rpm
 cmake-2.8.11-1.el6.x86_64.rpm


Enjoy!

Perfect Forward Secrecy

Perfect Forward Secrecy

The NetworkManager client on Linux supports VPNs with PFS, however, the GUI wizard doesn't allow it to be specified. The workaround for this is to open the gconf editor and go to:

/system/networking/connections/n/vpn

where "n" is the connection number for the VPN. Add a key titled "Perfect@32@Forward@32@Secrecy" of type "String". Then just specify the pfs: "nopfs" or "dh0" or such.

SSH Login without Password

It's nice to log into frequently used servers without a password:

Generate an ssh rsa key with an empty paraphraze:

ssh-keygen -t rsa

Make sure user directory is private

chmod 700 .ssh

Create the .ssh in the user directory of the server (mode is important or server won't authenticate)

ssh user@server mkdir -m 700 .ssh

Append the new public key to the athorized_keys file (mode is important)

cat ~/.ssh/id_rsa.pub | ssh user@server 'cat >> ~/.ssh/authorized_keys'

On the server, add the following to /etc/ssh/sshd_config

PubkeyAuthentication yes

Automount USB Drive in Runlevel 3

On a server at runlevel 3 (i.e. no monitor and X isn't running), it's sometimes nice to have usb drives automatically mounted.

A rule needs to be added to run a script whenever udev detects that a new drive has been inserted. Create the file /etc/udev/rules.d/99-usb-automount.rules containing:

KERNEL=="sd[a-z]?", RUN+="/usr/local/bin/usb_mount",
ENV{REMOVE_CMD}="/usr/local/bin/usb_mount"

Then add the script file /usr/local/bin/usb_mount containing:

#!/bin/bash
# $Id$
#
# Script to automaticlly mount usb devices.  This script is designed to work
# with udev
#

#commands used in the script
MOUNT="/bin/mount"
UMOUNT="/bin/umount -l"
MKDIR="/bin/mkdir -p"
RMDIR="/bin/rmdir"

#the root of where all auto mouted devices will be mounted to.
MOUNT_ROOT=/media
MNT_POINT=$MOUNT_ROOT/${DEVNAME##/dev/}

if [ -z "$ID_FS_TYPE" ]
then
logger "unidentified fs type: '$ID_FS_TYPE'"
exit 0
fi

logger "running $0"
logger "ACTION=$ACTION ID_BUS=$ID_BUS DEVNAME=$DEVNAME ID_FS_TYPE=$ID_FS_TYPE"

# check we are adding a usb device
if [ "$ID_BUS" != "usb" ]
then
logger "ignoring non usb device"
exit 0
fi

# check the action to process

case "$ACTION" in

add )

    logger "mounting new device"

    #create the directory we will mount to
    $MKDIR "$MNT_POINT"

    #
    #mount the usb device with the following options
    #
    #  ro           - read only
    #  noexec       - Do not allow direct execution of any binaries on the mounted file system
    #  nodev        - Do not interpret character or block special devices on the file system
    #
    #$MOUNT -t $ID_FS_TYPE $DEVNAME $MNT_POINT -o ro,noexec,nodev
    $MOUNT -t $ID_FS_TYPE $DEVNAME $MNT_POINT -o noexec,nodev

    #check if mount suceeded
    if [ $? -eq 0 ]
    then
    # sucess, we mounted ok.
      logger "mounted $DEVNAME at $MNT_POINT"
    else
    # we failed to mount so remove the mount point
      logger "failed to mount $DEVNAME at $MNT_POINT"
      $RMDIR "$MNT_POINT"
    fi
    ;;

remove )

    logger "unmounting existing device"

    # check if the device is really mounted
    #if [ (grep -q "^$DEVNAME" /proc/mounts || grep -q "^$DEVNAME" /etc/mtab) ]
    #then
    # logger "$DEVNAME not mouted"
    #endif

    #unmount the device.  We will refer using the mount point not the device name
    #becase there is a posibility the device could be removed before we
    #do the umount.
    $UMOUNT "$MNT_POINT"

    #remove the mount point
    $RMDIR "$MNT_POINT"

    logger "unmounted $DEVNAME and removed $MNT_POINT"
    ;;

* )
    logger "ignoring unkown action"
    ;;

esac