Authenticating to MongoDB using a keyfile

Sometimes, it might be useful to authenticate to MongoDB using a keyfile. (This requires it to be configured to use a keyfile, mostly for replicaset / sharding internal authentication)

Use cases for this include:

• Password resets
• Authenticating on shards from a config server with the same credentials for all shards (e.g. for keyhole, which assumes that that is an option, which results in errors if shards use different passwords)
• Auto-detected credentials for scripts that need to run (as root) on multiple nodes
• Automation of operations on the database (e.g. Creating a user using Ansible, without knowing if a user already exists)

Keyfile authentication uses SCRAM (the exact variant depends on the MongoDB version), in the same way that user authentication uses it. (After stripping all whitespace)

Knowing this, I decided to search around for references of "SCRAM-SHA-1" and "keyfile" and then came across info indicating that the username used is "__system". I found hints at this in the last diff on this change in the MongoDB source code.

In order to log in to the local mongodb instance using the keyfile /etc/mongo.keygile (as root that it can be read), the following command can be used:
mongo -u __system -p "$(tr -d '[:space:]' < /etc/mongo.keyfile)" --authenticationDatabase admin

If the connection string is used instead, the password needs the be URL encoded: (This version uses Perl for URL encoding, which might not be available everywhere)
mongo "mongodb://__system:$(tr -d '[:space:]' < /etc/mongo.keyfile | perl -ple 's/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg')@localhost:27017/?authSource=admin"

Note: This will not work on a YAML keyfile, as supported in MongoDB 4.2 or later. (The password for the system user should still be possible to extract using other methods though)

A Percona blog post that also mentions this method

Euro cylinder lock fixing screw sizes

Euro profile cylinder locks use M5x70mm countersunk machine screws.

(The size is hard to find, the M5 is in the relevant standard, DIN 18252, the length needs to be dug out of forums)

Managing FirewallD ipsets and services using Ansible

Ansible's FirewallD module (2.4, 2.5 and at least up to 1.4.0 of the ansible.posix collection) supports managing a subset of FirewallD functionality.

Currently, the creation and management of services and ipsets are not supported.

The module is being refactored to allow for support of additional functionality.

However, since FirewallD's permanent config is stored in XML files, it is possible to deploy services and ipsets using Ansible's template module instead.

For the functionality that I need (services consisting of just ports) and ipsets containing networks or IPs, I use these templates:

firewalld-ipset.xml.j2

<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:{{ item.type }}">
  <description>{{ item.description }}</description>
{% if item.options is defined %}
{% for option in item.options %}
  <option name="{{ option.name }}" value="{{ option.value }}"/>
{% endfor %}
{%endif %}
{% for entry in item.entries if entry != "" %}
  <entry>{{ entry }}</entry>
{% endfor %}
</ipset>

firewalld-service.xml.j2

<?xml version="1.0" encoding="utf-8"?>
<service>
  <description>{{ item.description }}</description>
{% if item.ports is defined %}
{% for port in item.ports %}
<port protocol="{{ port.type }}" port="{{ port.port }}"/>
{% endfor %}
{%endif %}
{% if item.protocols is defined %}
{% for proto in item.protocols %}
<protocol value="{{ proto }}"/>
{% endfor %}
{%endif %}
</service>

Variables need to be set up to configure something using these tasks. Additional entries can be added to deploy multiple services / ipsets with a single task.

sample_ipsets:
- filename: private-ips.xml
  description: Private IPs IPset
  type: net
  entries:
  - 10.0.0.0/8
  - 192.168.0.0/16
  - 172.16.0.0/12
- filename: monitoring-servers.xml
  description: Monitoring server IPs
  type: ip
  entries:
  - 192.168.0.1
  - 10.2.3.4
- filename: monitoring-servers-ipv6.xml
  description: Monitoring server IPv6s
  type: ip
  options:
  - name: family
    value: inet6
  entries:
  - 2001:0db8:85a3:0000:0000:8a2e:0370:7334
  - 2001:db8::2:1

sample_services:
- filename: nrpe.xml
  description: Nagios NRPE service
  ports:
    - type: tcp
      port: 5666
- filename: ip-in-ip.xml
  description: IP-in-IP encapsulation
  protocols:
    - ipencap
- filename: dns-and-ntp.xml
  description: Service for easily opening NTP and DNS
  ports:
    - type: udp
      port: 53
    - type: udp
      port: 123

Sample tasks used to deploy the configs based on these templates:

- name: FirewallD services
  ansible.builtin.template:
     src: firewalld-service.xml.j2
     dest: /etc/firewalld/services/{{ item.filename }}
     owner: root
     group: root
     mode: 0644
  with_items: "{{ sample_services }}"

- name: FirewallD IPsets
  ansible.builtin.template:
     src: firewalld-ipset.xml.j2
     dest: /etc/firewalld/ipsets/{{ item.filename }}
     owner: root
     group: root
     mode: 0644
  with_items: "{{ sample_ipsets }}"

# You might want to use a handler for this instead
# It might be possible to do with the systemd module as well instead
# The will cause any non-permanent changes to be lost
- name: Reload FirewallD
  ansible.builtin.command: firewall-cmd --reload

Solaris 10 - fiocompress (UFS file compression) settings

Bernd Schemmer has an interesting post about using fiocompress for file-system level compression of individual files on UFS file systems...

I did some experimentation and found a few more things:

• Increasing the blocksize from the default of 8192 increases the compression ratio
• The compression ratio seems to be somewhere between gzip and compress (on a text file)
• Setting the blocksize to 65536 (64KiB) results in an unreadable and undeletable file (at least with normal tools on test system. This is fixed in the latest recommended patch bundle)
• Using blocksizes below 8192 also results in unusable files. (I only tested multiples of 2)(This is fixed in the latest recommended patch bundle)
• fiocompress uses an ioctl call to mark a file as compressed if -m is passed. No method to unmark a marked file exists, even in the filesystem driver. (It is possible to modify the OpenSolaris fiocompress to add an option to just mark (a previously compressed) file as compressed) (Look at ufs_vnops.c for the _FIO_COMPRESSED ioctl implementation)

Test compression code:
ls -lah testfile.txt; du testfile.txt; du -h testfile.txt; for b in 256 512 1024 2048 4096 8192 16384 32768 65536; do fiocompress -b $b -c -m testfile.txt testfile.txt$b; done

Results: (including other common formats)
$ls -lah testfile.txt*
testfile.txt1024: Operation not applicable
testfile.txt2048: Operation not applicable
testfile.txt256: Operation not applicable
testfile.txt4096: Operation not applicable
testfile.txt512: Operation not applicable
testfile.txt65536: Operation not applicable
-rw-r--r--   1 user   group      101M Mar 11 10:26 testfile.txt
-rw-------   1 user   group      4.4M Mar 11 10:29 testfile.txt.7z
-rw-r--r--   1 user   group      5.2M Mar 11 10:26 testfile.txt.bz2
-rw-r--r--   1 user   group      7.2M Mar 11 10:28 testfile.txt.gzip
-rw-r--r--   1 user   group      8.9M Mar 11 10:28 testfile.txt.gzip-1
-rw-r--r--   1 user   group      6.7M Mar 11 10:28 testfile.txt.gzip-9
-rw-r--r--   1 user   group       13M Mar 11 10:27 testfile.txt.Z
-rw-r--r--   1 user   group      7.2M Mar 11 10:32 testfile.txt.zip
-rw-r--r--   1 user   group      101M Mar 11 10:55 testfile.txt16384
-rw-r--r--   1 user   group      101M Mar 11 10:55 testfile.txt32768
-rw-r--r--   1 user   group      101M Mar 11 10:55 testfile.txt8192

$du testfile.txt*
206544  testfile.txt
9040    testfile.txt.7z
10624   testfile.txt.bz2
14848   testfile.txt.gzip
18240   testfile.txt.gzip-1
13840   testfile.txt.gzip-9
27632   testfile.txt.Z
14848   testfile.txt.zip
18784   testfile.txt16384
16480   testfile.txt32768
22656   testfile.txt8192
$du -h testfile.txt*
 101M   testfile.txt
 4.4M   testfile.txt.7z
 5.2M   testfile.txt.bz2
 7.2M   testfile.txt.gzip
 8.9M   testfile.txt.gzip-1
 6.8M   testfile.txt.gzip-9
  13M   testfile.txt.Z
 7.2M   testfile.txt.zip
 9.2M   testfile.txt16384
 8.0M   testfile.txt32768
  11M   testfile.txt8192

eFiling and eHomeAffairs in Chrome

Google bundles Flash with Chorme (making it the only option for some things on GNU/Linux), however they have recently started phasing out Flash. As part of that, Chrome hides the presence of Flash to websites, but gives users an option to enable Flash on the site if the page attempts to use Flash. eHomeAffairs and SARS eFiling gives an error when Flash is not detected and doesn't attempt to load the content anyway, which means that the "Click to run" option does not work.

Recommeneded method: MyBroadband documented one method to get eFiling working.. For eHomeAffairs, the address to add to the list is "https://ehome.dha.gov.za".

Alternative, works on many more sites: Another option is to configure Chrome not to hide Flash from websites. This can be done by visiting "chrome://flags" in the address bar and setting the "Prefer HTML5 over Flash" setting to "Disabled" ("chrome://flags/#prefer-html-over-flash" will take you directly to the setting). You need to restart Chrome for the setting to take effect. The content will then load. (Tested on Chrome 60). On some sites, the Flash content may still be click-to-run, however Chrome seems to currently run it automatically on both eHomeAffairs and SARS eFiling when this flag is set. (Chrome will attempt to detect important Flash content and enable that automatically)

Update: The chrome://flags method stopped working in Chrome 61. Adding the site to content settings as being allowed to run Flash as per the MyBroadband article still works.

OpenSSL cipher suite without forward secrecy

Firstly, you should not use this in normal use.

Sometimes, you might need to debug a problem that occurs behind TLS.

Wireshark can decode TLS traffic, given the session keys, or if forward secrecy ciphers was not used, the private key.

In the case of web traffic, SSLKEYLOGFILE can tell NSS, used by some browsers to log the keys. This is a better method than the one described here, but it is not an option if other clients are used, say in the case of SMTP.

An (OpenSSL) ciphersuite setting that excludes ciphers providing forward secrecy, while keeping strong ciphers is:
HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!DHE:!ECDHE:!EDH:!EECDH

This should be avoided in production and should only be used for debugging.

Handling messages forwarded as attachment by Outlook with MIME::Parser in Perl

Outlook sends emails that are forwarded as attachment with an .eml extension and the content-type set to application/octet-stream. According to RFC 1341, message/rfc822 should be used. The Perl module, MIME::Parser will automatically parse message/rfc822 attachments, which is useful if you want to do automated processing on an email and its attachments. Outlook's use of application/octet-stream breaks this.

It is possible to fix this. I initially attempted to change the contetn-type and rerun the parser on the file, but that resulted in an empty part. The problem is that according to RFC1341, the Content-Transfer-Encoding field must be 7bit, 8bit or binary for message/rfc822 (Outlook uses base64). Once this is corrected, it works.

A Perl sample: (in this case, the email forwarded as attachment is the second attachment)
#!/usr/bin/perl

use warnings qw(all);
use MIME::Parser;
use strict;

my $fn = '/tmp/input_file.eml';

my $parser = new MIME::Parser;

$parser->output_to_core(1); # Disable the creation of temporary files

my $entity = $parser->parse_open($fn);
$entity->dump_skeleton;   # View initial structure

# Fix the fields
$entity->parts(1)->head->replace('Content-Type','message/rfc822');
$entity->parts(1)->head->replace('Content-Transfer-Encoding','7bit');

# Get encoded message
my $message = $entity->as_string;
#Re-parse
$entity = $parser->parse_data($message);

$entity->dump_skeleton;          # show final structure

\

Here is a general function to handle these. It uses undocumented interfaces, since there does not seem to be a documented method to replace a part with another one.
sub handle_forwarded_messages
{
   my($parser,$entity, undef) = @_;
   return undef unless ($entity && $parser);

   my($part);

   # Recursively process multipart entities, based on number of parts
   if (scalar $entity->parts) # If we have sub-parts
   {
      # Warning, next line uses undocumented interfaces..
      for (my $i = 0; $i <= $#{$entity->{ME_Parts}}; $i++) {
         $part = $entity->{ME_Parts}[$i];
         # Warning, next code line uses undocumented interfaces..
         # Replace part with its expanded version... This seems to be the only way
         $entity->{ME_Parts}[$i] = &handle_forwarded_messages($parser,$part);
      }
   } else { # Once we are at a level that does not have sub-parts...
      # Replace forwarded messages with properly expanded versions...
      if ($entity->effective_type eq 'application/octet-stream' &&
              $entity->head->recommended_filename =~ /\.eml$/) {
          $entity->head->replace('Content-Type','message/rfc822');
          $entity->head->replace('Content-Transfer-Encoding','8bit');
          my $entity_tmp = eval { $parser->parse_data($entity->as_string) };
          $entity = $entity_tmp unless ($@ || $parser->results->errors);
          # And see if they have more levels...
          $entity = &handle_forwarded_messages($parser,$entity);
      }
   }
   # Return the processed result
   return $entity;
}

Marking files on UFS as compressed on Solaris

Bernd Schemmer has an interesting post about using fiocompress for file-system level compression of individual files on UFS file systems...

However, it might be useful to mark files as compressed after compressing the file, such as when you forgot the "-m" option when compressing a large file.

The fiocompress utility does this by calling the _FIO_COMPRESSED ioctl on the file.

There seems to be no way to unmark a file that is marked as compressed. (The ioctl sets a cflag on the file called ICOMPRESS, but no operation to clear the cflag seems to exist)

I stripped down fiocompress to a minimal tool to just mark a file as compressed. It is important to ensure that it is a valid file (outfile in the example) generated by "fiocompress -c infile outfile" before running this command. Bad things may happen if this is not the case.

To mark output as compressed, compile the code (compile.sh should do that for you) and run "./markcompressed -m /path/to/outfile" if you are running it from the directory where it was compiled.

Source code can be downloaded from here. (A quick ugly hack, based on fiocompress from OpenSolaris, with some likely bugs)

As always, you should ensure that you have the latest recommended patchset installed.

Older OpenSSH versions - using a different authorized_keys file for a single user

Sometimes, multiple users share a home directory or there are other reasons why a user's authorized_keys file won't pass OpenSSH's permission checks. While those can be disabled, it is generally a bad idea.

In recent OpenSSH versions, using a different authorized_keys file for a single user is easy:

Match User username
AuthorizedKeysFile /etc/ssh/authorized_keys/%u

In older versions however,AuthorizedKeysFile is not supported under a Match block.

In order to get around that, at least on some version, you can use AuthorizedKeysCommand instead, which is supported under a Match block (at least on an up-to-date RHEL5): (It can also be used outside a Match block to enable the option for all users)

Match User username
AuthorizedKeysCommand /etc/ssh/etc_ssh_authorized_keys

You can then create the following script to use as the command and put keys into /etc/ssh/authorized_keys/username #!/bin/sh
/bin/cat "/etc/ssh/authorized_keys/${1}"

To prepare the script and directory: (Users can view each other's public keys in this example, but that for a small number of users is a smaller risk than disabling the permission checks, which might allow other users to edit the user's authorized_keys file)

echo -e '#!/bin/sh\n/bin/cat "/etc/ssh/authorized_keys/${1}"' > /etc/ssh/etc_ssh_authorized_keys
mkdir -m 755 /etc/ssh/authorized_keys
chmod 755 /etc/ssh/etc_ssh_authorized_keys
chmod 644 /etc/ssh/authorized_keys/* # there is probably nothing there yet
chown -R root:root /etc/ssh/etc_ssh_authorized_keys /etc/ssh/authorized_keys

Comparing FreeBSD pkgng package options between repositories

When switching FreeBSD repositories, it can be tricky to find which options changed in the package configuration.
This set of bash functions might be useful:

# This will list the options for the package matching the first parameter in the repo given by the second parameter
options ()
{
    sqlite3 /var/db/pkg/repo-$2.sqlite "SELECT p.name,o.option,po.value FROM option o, packages p, pkg_option po WHERE po.package_id = p.id and po.option_id = o.option_id and p.name like '$1' ORDER BY name,option"
}

# This will show the difference between the myrepo repo and the FreeBSD repo for the package fiven as a parameter. This can be changed for any repos or repos from parameters
options_diff ()
{
    diff -u <(options "$1" myrepo) <(options "$1" FreeBSD) | grep '^[+-]'
}

Configure more secure SSH algorithms on Cisco IOS

Security checkers, like Nessus, often report issues like these on Cisco IOS devices:

• SSH CBC Mode Ciphers Enabled 
• SSH Insecure HMAC Algorithms Enabled 

There have been a feature request to add the functionality to IOS, that seems to have been resolved in January 2016.

In the versions where it has been resolved, you should be able to:
> enable
# configure terminal
(config)# ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
(config)# ip ssh server algorithm mac hmac-sha1
You might want to check with "?" if better options have since become available, especially from the MACs (SHA-1 is not ideal, SHA-2/SHA-3 based algorithms might be added in the future) before using my list as-is...

Source of config syntax: Cisco IOS SSH configuration guide

Working around Corrupted MAC on input. with Cygwin SSH

When connecting to some servers from Cygwin using ssh, the connection fails and I get this error:
Received disconnect from 1.2.3.4: 2: Corrupted MAC on input.

Looking at debug output, it seems like it is using "umac-64@openssh.com" as MAC algorithm. Forcing it to use something else works around the problem.

When using ssh directly, you can use this: (Other options should work as well, this one worked for me)
ssh -o 'MACs hmac-sha1-96' user@host
or
ssh -m hmac-sha1-96 user@host

When using rsync, you need to put one of the strings above in the --rsh parameter:
rsync --rsh="ssh -m hmac-sha1-96 user@host" :/remote-source /local-dest

A more permanent option is to add the setting to the ssh_config file. This is either /etc/ssh_config (affecting all users) or ~/.ssh/config.

A line using a modified set based on the defaults for my SSH version is:
MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96

You can find the problematic MAC by running 

ssh -v user@host-that-disconnects-you 2>&1 | grep mac

Adding that as a line to ~/.ssh/config seems to be the easiest solution.

A set of wideband antennas for the FunCube Dongle Pro(+), hackRF, bladeRF and RTL-SDR

When I got my Funcube Dongle Pro, I was looking for a suitable set of antennas.

Since it covers such a wide bandwidth, finding a single antenna that covers the entire bandwidth is hard.

Log-periodic antennas seem to be the most suitable wideband antennas. (They are however directional, which can be good or bad, depending on the application) However, they get impractically large, and as a result unobtainable for frequencies below about 400MHz. For these frequencies, the only practical options seem to be telescopic antennas (which can be tuned for a frequency by differing the length that is expanded) or scanner antennas.

I ended up ordering this set:

• Ramsey Telescopic with BNC / Alternative: Scanner antenna with SMA
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic

I have since acquired a RTL-SDR dongle. The dongle that I have has a TV-style 75-ohm input connector, as opposed to the 50-ohm SMA connector on the Funcube dongle. Ideally, a balun would be used to match the impedance, but as a minimum, some cables can be made up with the relevant connectors at the ends. I found this video with information on building your own, if you need the increased sensitivity that a properly matched antenna provides. Some other dongles, like the one from hakshop, a random one from Amazon and the NooElec one has MCX connectors, which seem to mostly be 50-ohm.

I have also ordered a hackRF, which has a higher maximum frequency, which requires another antenna. I'm planning to acquire this one. (The ANT500 antenna that is available for it seems like a suitable replacement for the telescopic antenna). My planned antenna set for it:

• ANT500 (buy from wherever you buy your hackRF, I used NooElec (they ship to where I live for $5...)) / Alternative: Scanner antenna with SMA / Alternative: Ramsey Telescopic with BNC
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic
• Ramsey 2.1 Ghz - 11GHz log-periodic

Another transceiver that is available is the bladeRF. It covers 300MHz - 3.8GHz, but it has a higher sampling rate than the hackRF (and a FPGA). An upconverter that allows for lower frequencies are also available. A nice antenna set for it is:

• Ramsey Telescopic with BNC (If you want to go below 400MHz) / Alternative: Scanner antenna with SMA
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic
• Ramsey 2.1 Ghz - 11GHz log-periodic

For the low end of the range, if you have the space, also look at the scantenna. It covers 30MHz - 1.3GHz (with several gaps). (It might not be safe for transmitting (bladeRF and hackRF)). (Full specs)

This discone also seems like a great antenna if you can install an outdoor antenna. It can handle transmitting up to 200W on the 6m, 2m, 70cm, ~1.3GHz ham bands. Reception is listed as 25MHz - 1.3GHz


I would also recommend a full set of converters, covering different types of antennas. Some examples:

• SMA > MCX (For MCX RTL-DR dongles to most antennas listed above)
• BNC > MCX (For BNC telescopic on MCX RTL-SDR dongles)
• RP-SMA > MCX (for WiFi antennas on MCX RTL-SDR dongle) (Cable that would terminate on the router, now terminates on this)
• RP-SMA > SMA (for WiFi antennas on Funcube / hackRF / bladeRF) (Use on dongle to give it a RP-SMA interface)
• SMA > SMA (right-angle version) (Longer version) (SMA antenna to SMA dongle)
• BNC > SMA cable (direct version) (For BNC antennas, like the Ramsey Telescopic)
• TNC > SMA (A relatively common antenna connector) (Use with SMA-SMA cable)
• N-type > SMA (A relatively common antenna connector) (Linked product allows use with SMA > SMA cable)
• RP-TNC > SMA (different gender version) (For some WiFi antennas (Linksys) to SMA radios)
• TV antenna > SMA (For RTL-SDR dongles with TV-antenna connector)
• TV antenna > BNC (For RTL-SDR dongles with TV-antenna connector)

KiCAD schematic for the Arduino Leonardo

I wanted to design a compatible board in KiCAD. The orgiinal design is in EAGLE format.

I redrew it in KiCAD.

Uses symbols from http://smisioto.no-ip.org/elettronica/kicad/kicad-en.htm

Completely fails ERC. Blame my rough ATMEGA32U4 component.

Original design by Arduino. Errors are probably mostly mine....

Download (Use "Save" from the file menu)

Alternative link

Sourcing RepRap extruder springs in South Africa

Several RepRap extruders use compression coil springs to provide tension on the idler. While some companies exist that manufacture springs locally, they are not really conveniently located and might charge a lot if you are only interested in small quantities.

After search the internet and fastener / hardware stores unsuccessfully, I happened to notice that certain clothes-pegs have springs that seem perfect for the job.

Sourcing the clothes-pegs turned out to be relatively easy....

The ones that I found are:

Barcode: 6009695720525

Branded as: "You Save"

Pack size: 48 pegs (with one spring each) (Can't find it on their online shopping page)

Sources: Pick 'n Pay (~R26 per pack of 48)

Free length: 16mm

Wire thickness: 0.9mm

Turns: 9 (first and last one flattened)

Outside diameter: ~6.4mm (Fits M4 / M3 screws)

Turn "pitch" (relaxed): ~ 1.9mm (including 1 wire thickness)

Spring coefficient: Unknown

Material: Unknown ("rust free", looks like it might be zinc coated steel)

Image:

The pegs themselves seem to be made from PE and might be recyclable into filament with a filament extruder.

This thread on the RepRap forums seem to mention the same springs.

BitBurner - Download HTTP links using BitTorrent

BurnBit has a handy service that allows you to generate torrents for any directly accessible HTTP link.

They have some nice instructions to integrate it into your site. However, almost no big sites use these.

In order to easily use it for downloading Linux distributions (which are well mirrored, making BurnBit useful, even if just easily download from multiple mirrors simultaneously and to check that the file is not corrupted) I wrote a small GreaseMonkey script that injects their download buttons in some of the more obvious mirror sites / HTTP accessible FTP sites.

It is somewhat crude currently, but works well on sites that just contain directory listing.

Compiling CMake 2.8.7 on Solaris 10

Building CMake might fail due to incorrect environment variables.

If you already attempted to compile CMake, delete the directory and start again. It caches its variables for its own build all over the place.

A full Solaris 10 install has everything you need to compile CMake.

I bootstrapped it using as much system libraries as possible and assumed 4 CPUs / cores and set it to install to /usr.

Set up envirnment:
$ PATH=/usr/sfw/bin:/usr/ccs/bin:/usr/bin; export PATH
$ CC=gcc;export CC

Bootstrap:
$ ./bootstrap --parallel=4 --system-libs --no-system-curl --no-system-libarchive --no-system-expat --prefix=/usr

Compile according to Readme.txt:
$ gmake -j4
To install:
Change to root
# gmake install

To package:
$ bin/cpack
The generated package can the be installed as per the instructions on the download page.
The package will only work on other Solaris 10 (and possible newer) system running the same CPU architecture. Solaris 9 misses some of the libraries that it expects to find.

These instructions do not work on Solaris 9, due to the lack of a compiler in the default install. Installing Solaris Studio might work, but was not tested.

Update: I have a prebuilt version available here.

Disabling Caps lock in Ubuntu 9.10

Mac OS has a nice and easy option under "Modifier keys" where you can easily disable the Caps Lock key. (I never use it and it just gets in the way) Disabling Caps Lock under Ubuntu (and possibly other distributions using recent Gnome versions?) is possible, but not as obvious. If you go to System > Preferences > Keyboard > Layouts, Caps Lock's behaviour can be modified from the "Layout Options" (The button to open it is name just "Options" under Ubuntu 10.04) window

To open Layout option, click the button near the bottom left

The layout Options window has some related settings:

Default options for Caps Lock behaviour doesn't allow it to be disabled (before Ubuntu 10.04)

Unfortunately, all of the options just change an accidental press's side-effects. (The options for Ubuntu 10.04 includes an otion to disable Caps lock) Luckily, another option exist.... The Compose key has no side-effects when accidentally pressed and might actually be useful at times... Ubuntu allows you to set the Caps Lack key to act as a Compose key. To find this option, open the "Compose key position" option and select Caps Lock. Caps Lock can be configured to function as a compose key

Caps lock should now function as a Compose key (which need to be held with multiple other keys to have an effect) and stop interfering with your typing if you accidentally hit it. (I actually find this better than completely disabling it)

Update: This works under Ubuntu 10.04 as well. In addition, Ubuntu 10.04 has a "Caps Lock is disabled" option in the second dialog.

Facebook chat on your phone with Lampiro 10.4.1

Lampiro 10.4.1 has been released. It specifically improves support for Facebook chat.

This post describes how to set up Facebook chat on your phone.

Requirements:

• A phone supporting MIDP 2.0 Java applications (If it runs Opera Mini 5 and is not an iPhone / Android phone, you should be fine)
  
• Working internet on your phone
• About 500KB of free space for Java applications
• A Facebook username. Set it up here: http://www.facebook.com/username/
  

How to set up Lampiro for Facebook chat on your phone:

• Download and install Lampiro on your phone. You can go here: http://lampiro.bluendo.com/get on your phone and get the base or TLS version (Don't bother with the non-TLS unless you have space issues on your phone)
• Follow the instructions when you open Lampiro
• Choose "Yes" when asked if you have an existing Jabber/XMPP account
• Login with your Facebook username and password. Use johndoe@chat.facebook.com as username and your normal Facebook password if your Facebook username is "johndoe".
• Wait for the list of online friends to load
• Expand a group, choose a friend and start chatting. Left and right switches tabs (between chats / friend list)

About Lampiro
Lampiro is a free software / open-source Jabber/XMPP client for phones supporting Java ME. Its Google code page can be found at http://code.google.com/p/lampiro/ and its website can be found at http://lampiro.bluendo.com/ In addition to Facebook chat, its TLS version also support Google Talk's non-voice chat and other XMPP/Jabber servers.

Share this with your friends:

• Digg this
• Share on Facebook
• TinyURL: http://tinyurl.com/fbphone

m-im Facebook chat support - why it doesn't work

I figured out why Facebook chat won't work in m-im.

Facebook chat requires DIGEST-MD5 authentication that is not supported by m-im. (Implementation would have been easier if Java ME included a MD5 library...)

I logged an issue asking for support if anyone is interested. (My patch only adds support for detecting whether the server supports DIGEST-MD5 authentication)

I like m-im, mostly since it is based on MGtalk, but has a better user interface, and because it supports multiple accounts (although not at the same time, which would have been ideal).