Friday, November 27, 2020

CONVERTING A PFX PKCS12 CERTIFICATE STORE TO PEM FORMAT:

Extracting the domain certificate:

$ openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out example.com.crt

Extracting the private key:

$ openssl pkcs12 -in certificate.pfx -nocerts -nodes -out example.com.key

Extracting the chain:

# openssl pkcs12 -in certificate.pfx -out example.com-ca.crt -nodes -nokeys -cacerts

--


NOTE: This post is a re-hash of an excellent article at: How to Convert and Use PKCS#12/PFX Certificate on Apache (linoxide.com)

This is part of my personal 'cheat sheet'.

Friday, July 31, 2020

KDE breaks GTK theme (Fedora 32)

I needed to install KDE temporarily in order to test something.  Once I was done, I removed the KDE desktop environment package group and went back to using Gnome.  Unfortunately, once I did that, Nautilus and several other Gnome applications had broken colour themes.


Which I will summarize here by simply saying the following:  

$ vi ~/.config/gtk-3.0/gtk.css

Comment out the @import 'colors.css'; line.

# @import 'colors.css';

And save it.



Restart Gnome and all should be back to normal:

alt+f2

r<enter>




Bluetooth stuck in airplane mode

It bluetooth on linux gets stuck in airplane mode it may disappear even from the hardware list, if this happens on a desktop computer that lacks an airplane mode switch, it can be confusing even seemingly impossible to bring back.

Here is a quick and simple solution:

Reboot and add the following argument to your kernel boot options at startup:

acpi_osi=! acpi_osi="Windows 2009"

Once your system boots up bluetooth will reappear in the Gnome Settings as being available.

Note that this solution also works with WIFI devices.

Monday, May 13, 2019

Reset Gnome settings to default

I had some trouble with my touchpad not working, which I suspect was caused by an extension that broke during an upgrade.  I tried removing the extension but the problem persisted.

The touchpad worked in the GDM menu, but stopped working on login so I attributed the problem to a Gnome configuration.  Since I don't have too many custom gnome settings I decided to reset them:

dconf reset -f /org/gnome/

This did the trick.  On login the touchpad was working just fine (except for the fact that tap clicking is disabled by default in gnome.)

Thursday, January 10, 2019

Enable or disable IPv6

This is a reminder on how to either disable or enable IPv6 for troubleshooting purposes.

Disabling:

$ sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1

$ sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

$ sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1


Also, in order to make the change permanent add the following lines to /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

net.ipv6.conf.lo.disable_ipv6 = 1


----

To Re-Enable, simply replace 1 with 0:

$ sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0

$ sudo sysctl -w net.ipv6.conf.default.disable_ipv6=0

$ sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=0


 And make the changes to /etc/sysctl.conf as well or simply remove those lines.

Monday, July 16, 2018

Visual Studio Code over SFTP/SSH SOLUTION: sshfs

So, here I am trying to use Visual Studio Code to do some real work, when it's ability to connect to my remote sftp server through gnome's gvfs connection randomly fails.  How dissapointing... Not having hours to figure out why its failing all of a sudden (although a reboot fixes the issue), I decided to look for another option.

Let me give you a quick background of what I'm doing:

OS: Fedora 28

I write Drupal (PHP) code with MS Visual Studio Code IDE which is lightweight and fast.

I use Gnome's nautilus remote folder location integration to mount the folders, which can then 'normally' be accessed by other applications, like vscode.  

Option #1: vscode extensions... I looked at these briefly but I was never really interested in using such an extension when I may need to connect to remote servers securely.  I am simply a bit paranoid that the extension code could be either malicious or buggy and render my connections insecure... So I discarded this option.  If I had more time, I might be inclined to double check the extension's code and functionality.

I'm hoping for a solution that's more or less standard, well supported, well documented, and included in the official Fedora packages.... granted vscode itself isn't part of the official packages, but my paranoia has limits.

Option #2: Looking for a tool to create a local mount of a remote SFTP server.  This would be the closest thing to a real filesystem, and it would take Gnome, Nautilus and vscode right out of the equation... leaving the OS to take care of providing me the remote files.

... And I found sshfs...

It's part of the official Fedora repo.

It's easy to use.

It's available for other OS'es  (Mac and Windows - seriously!).

Some will ask why not use vagrant's own sync folder... because, once again I don't want to be tied down to a particular technology.  If the remote server is not vagrant, then what?

Ok, here's how it works:

Step 1: Create a mount folder for the instance I would like to work on:

$ sudo mkdir /mnt/d8-vagrant

Mount the remote sftp folder:

$ sudo sshfs -p 2222 -o allow_other vagrant@127.0.0.1:/var/www/html/drupal /mnt/d8-vagrant/

That's it.  Now I can open /mnt/d8-vagrant whichever way I like... Brilliant!

Thanks for DigitalOcean's excellent docs for pointing me in that direction: https://www.digitalocean.com/community/tutorials/how-to-use-sshfs-to-mount-remote-file-systems-over-ssh

By the way, the DO docs/tutorials are nothing short of GREAT!  They are not always perfect, and they tend to have a lot of Ubuntu based articles, but for the most part it ports nicely to Fedora or RPM based systems.  They have very neat and creative ideas too.


Thursday, July 5, 2018

Fedora 28 on the Dell XPS 9570

Here are a few short comments about my experiences using Fedora 28 on the new Dell XPS 9570.

See my previous post for instructions on the NVIDIA card setup.

This system is spec'ed with a 1TB SSD, 16Gbs of RAM and the 1920x1080p 15" 400 nits screen.

PRE-INSTALL:
  1. Before installing, I had to modify the BIOS SATA configuration from RAID to AHCI, otherwise the SSD was not recognized.
  2. I disabled Secure Boot.
GRAPHICS:

The first thing to note, is that the nouveau drivers do not play well with the NVIDIA GeForce GTX 1050 TI which comes with this system.  This means that GDM crashes when it attempts to startup and you are left with a black screen and zero control.  One way to solve this temporarily is to add the following line to your kernel boot parameters:

nouveau.modeset=0

To do this, when you are prompted to choose a kernel during any boot, press the 'e' key to edit its parameters:



Next, move your cursor down to the kernel line and add nouveau.modeset=0 at the end of the line:


Boot the kernel using ctrl+x.

This will allow GDM and Gnome to run without crashing everytime.

You can then install the NVIDIA drivers as per the instructions in my previous post.

SUSPEND:

Until I updated the kernel from version 4.16.3-301 to 4.17.2-200, suspend was working perfectly well with the NVIDIA drivers.  However, as soon as I upgraded, resuming from suspend no longer works correctly and instead shows a black screen with a cursor in the top left corner of the screen.  If my wifi is still connected, I can ssh into the machine and see that XORG is using 100% of one CPU; very few helpful errors are in dmesg.

As a temporary solution I've switched the power button's function from 'suspend' to 'hibernate' - which appears to work well enough.  So far hibernate has failed to resume only once, out of about 30 times or so.

THOUGHTS ON OTHER ASPECTS OF THE LAPTOP:

WIFI: Great reception, Fedora 28 support out-of-the-box.

Camera: Excellent, clear, wide image - Fedora 28 support out-of-the-box.  However, I have the same complaint as everyone else - Put the camera at the top of the screen.  As it is now, its not too bad, but people mostly see my face from slightly below and a lot of my fingers on the keyboard. 

Screen: Excellent.  Great colours, great brightness and brightness control; 'the hobbit' has never looked this good.

Keyboard: Excellent.  There were a lot of negative reviews regarding the XPS 15 series' keyboards.  For my part I find that the keys feel good: You don't have to press them too much, but you do feel them and they respond well and appropriately. 

Heat dissipation: So far I've not experienced the issues that other users have complained about.  However, I don't use this machine to do any kind of serious gaming.  Probably the most graphic intensive game I've run was FlightGear, which hardly gets close to other engines.  I was worried about this point as I run several VMs at once, and they can get fairly heavy loads at times.

GAMING:

I use Linux exclusively on this machine and I don't use steam, so all games I play are stock Fedora or from flathub.  Here's what I've tried:

Minetest - Excellent: I'm a big fan of minetest and run my own server called "Aurelium's mine" at m.impactcore.com.  You can get the list of servers at https://www.minetest.net/servers/
Very smooth on full graphics.  I haven't tried running a server on it, but I would be curious to see how my "LUA script generated lag" would do with this new Intel Hexacore.  Unfortunately the Mod engine in Minetest isn't multi-threaded so I'd still be running mostly on a single core.  Note that Minetest is multi-threaded but the LUA mods are not.

0AD - Great: but chugs a bit when 6 players start to have up to 300~500 workers/soldiers.  But this has nothing to do with the GPU and everything to do with the fact the most of the game runs on a single thread.

FlightGear - Insane! I don't know about multi-threading or how flightgear does it, it might have to do with the fact that the GPU is doing most of the heavy lifting in this game.  The graphics are on max and its smooth as can be.  I never knew flightgear could look so good.  The terrain could be a bit better, but some of the airplanes just look great.  The dynamically generated trees are pretty good, and they fill the gaps nicely to add a touch of reality.

Here are the ones I would like to try soon:

Doom 3 - The doom 3 engine (id tech 4) was released as open source.  A proper doom 3 port was then made by dhewm and seems to work really well.  I've tried it on my other PC with the wad files that I had from the original game.  I will try it on the laptop and update this post.

Battle for Wesnoth - I've never played this much, nor have much time to do so, but I'd like to give it a go and what better chance than to try it on this shiny new machine.

Torcs - I've played this a bit in the past but found it nearly impossible to use with a mouse and keyboard.  Yeah, I don't have a lot of time for gaming these days so I don't have a stick or steering control.

Red Alert - This game brings back memories and for Fedora its available as one of the flathub packages.  I can't wait to try it again.

OVERALL:

Apart from the problem with suspend, everything else works relatively well and I have no complaints.  Other than the few items noted above, there wasn't much else that needed to be done.

The machine itself is solid, much more so than it appeared in pictures and videos I had seen before purchasing it: I was afraid that it might end up being rather flimsy, but was pleasantly surprised by its robustness.

Saturday, June 16, 2018

Dell XPS 9570 with NVIDIA GTX 1050 TI mobile on Fedora 28

This is a note on how to install the drivers for the NVIDIA GeForce GTX 1050 TI mobile on Fedora 28 running on a Dell XPS 9570.

To my dismay, it seems I was unsuccessful in installing these drivers from a variety of sources (rpmfusion or Nvidia) on the UEFI enabled boot system.  I did attempt to sign them as I have signed other drivers in the past, such as vboxdrv and others... I could not get this to work.  So I gave up on UEFI and disabled it in the BIOS - which I don't really enjoy doing.

So, once UEFI was disabled, this is how I installed the drivers on my Fedora 28 installation.  Note that I followed the instructions from: https://ask.fedoraproject.org/en/question/119588/nvidia-driver-doesnt-work-for-dell-inspiron-15-7000-gaming-ee-no-devices-detected-ee-no-screens-foundee/

First I installed the third party repositories from the Gnome Software center:



I enabled the "RPM Fusion for Fedora 28 - Nonfree - NVIDIA Driver" repo.  The next step is important because rather than installing it simply from the Gnome Software app, I preferred having the DNF history so I installed it using these commands:

$ sudo dnf install xorg-x11-drv-nvidia akmod-nvidia xorg-x11-drv-nvidia-cuda
$ sudo dnf update -y


Note that the 2nd command was superfluous in my case as my system was already updated with the latest drivers, kernel-devel libraries and dkms.

Fortunately this worked like a charm.  Kudos to the Fedora team, RPM Fusion, and the community members as well as the OP on the above link for ensuring this all works, and figuring out the 'issues' with the driver installation.

Too bad I couldn't get this to work on UEFI.

Friday, June 15, 2018

Moving a VirtualBox vagrant machine from one PC to Another.

This document outlines steps for moving a single VirtualBox based Vagrant VM from one PC to another.

1) Use the virtualbox manager to export the vagrant machine you are looking at moving.

2) Copy the exported OVF file to the other PC.

3) Tar your vagrant machine's folder:

$ tar -czvf ./VagrantMachine.tar.gz ./VagrantMachine

4) Copy this file to the new PC and to its final destination.

5) Import the OVF file into the VirtualBox manager on the new PC.

6) Extract the tar gzip'ed achive:

$ tar -xzvf ./VagrantMachine.tar.gz

7) Open the new PC's VirtualBox.xml file and find the UUID for the newly imported VM:

$ less ~/.config/VirtualBox/VirtualBox.xml

    <MachineRegistry>
      <MachineEntry uuid="{6ba80e35-75b9-4356-a575-eafc26199534}" src="/home/user/VirtualBox VMs/drupal8_default_1528979867528_60017/sdrupal8_default_1528979867528_60017.vbox"/>
      <MachineEntry uuid="{2a77b436-41c8-47e0-b4e6-1a2ebca0fb83}" src="/home/user/VirtualBox VMs/drupal7_default_1529028747318_87440/sdrupal7_default_1529028747318_87440.vbox"/>
      <MachineEntry uuid="{88bcf6b5-480c-4d37-bc2a-aa48b0e422d0}" src="/home/user/VirtualBox VMs/newVM_default_1527647210758_42083/electorhood_default_1527647210758_42083.vbox"/>
    </MachineRegistry>


8) Replace the UUID in the vagrant machine's ID file:

$ vim ./VagrantMachine/.vagrant/machines/default/virtualbox/id

9) Start the vagrant machine.

Thursday, May 24, 2018

Renewing a reverse proxy cert with certbot

Renewing a cert on a loadbalancer with certbot is fairly easy, but there is a minor trick to it.  Since your reverse proxy is not hosting any website, and instead proxying all requests, certbot is unable to post the verification key file on the server.

To get around this, shutdown the reverse proxy server temporarily and have certbot run as a standalone server in order to facilitate the authentication:

# certbot renew --standalone

This allows certbot to run its own server on port 80,443 while it authenticates and shuts down immediately once its done.  You can then restart your own reverse proxy server.

Sunday, November 5, 2017

Running virt-manager on wayland

Fedora 26 introduces Wayland as the new display server protocol, and this introduces new challenges.

The wayland developers have chosen not to support running a GUI application as root: which breaks virt-manager and virt-viewer.  Both applications need to run as root, in order for them to execute commands such as mount and etc...

There seems to be very little way around this, except to temporarily allow root execution using:

$ xhost +si:localuser:root

Permission can later be revoked using:

$ xhost -si:localuser:root

I hope that a more elegant solution will be forthcoming from either the wayland or libvirt developers.




Thursday, November 2, 2017

Recording Audio in CentOS

Today, I needed a tool to quickly and effectively record audio from a microphone connected to my computer, in order to test it.  I didn't have time to start playing around with Audacity settings to figure out how to get it to work properly, so I decided to look around for something else.  As it turns out, there is a nice little command line tool which allows for quick and dirty recording: sox.

All I had to do was:

$ sox -t alsa default out.wav

Bingo, instant recording for very basic purposes.  I'm sure the manual page will yield much more interesting features.

Thursday, September 28, 2017

Kerberos User Principal not found. Do you have a valid Credential Cache?

NOTE "Kerberos User Principal not found. Do you have a valid Credential Cache?"

Reading through Sander Van Vugt's book (RHCSA/RHCE 7), I came across an issue while setting up Kerberos for NFS.  It is detailed in Appendix D on the CD that came with the book: Appendix D, "Preparing Your IPA Server for Kerberized NFS".

Step 8 of the book states:

"On server1, type ipa-getkeytab -s ipa.example.com -p nfs/server1.
example.com -k /etc/krb5.keytab."

Following these instructions only yielded the error below:

Kerberos User Principal not found. Do you have a valid Credential Cache?

According to the Kerberos documentation it is necessary to request a ticket before proceeding, therefore running the following command prior to Step 8 should resolve the issue:

[root@server1 ~]# kinit admin
Password for admin@EXAMPLE.COM:
(enter the password)

You can then retry the command from Step 8.

[root@server1 ~]# ipa-getkeytab -s ipa.example.com -p nfs/server1.example.com -k /etc/krb5.keytab

Failed to parse result: Failed to decode GetKeytab Control.
Retrying with pre-4.0 keytab retrieval method...
Keytab successfully retrieved and stored in: /etc/krb5.keytab


The command was successful... this is another reminder for me that books can and will contain mistakes - and that the online documentation (manual pages) are an excellent resource.

Saturday, September 16, 2017

Updating system time using chrony on CentOS 7

HOW TO: If the current system time is completely off by several months or years, using chrony to update the time can be a bit tricky.  The online documentation does not clearly explain how to handle this type of scenario, and probably with good reason.  Why would you use an NTP system to update a device that has gone off the correct time by more than several minutes to hours?  Any further wider time drift means that something could be seriously wrong hardware-wise, and whats worse data and security could have been affected.  That's not what ntpd or chronyd are designed for; rather they are designed to prevent time-drift by seconds, perhaps minutes.

The correct way to update the time on a RHEL/CentOS 7 that is completely off, is to set it manually and then use an NTP daemon to maintain it.

Setting the time and date manually to the current time:

# timedatectl set-time "2017-09-16 11:51:58"

Next, simply make sure chronyd or ntpd is running - not both:

# systemctl status chronyd

---

Ok, suppose we really want to update a system clock that has gone off by a ridiculous amount of time, lets say a year or more... there is a way:

Note: It is tricky to correct such a gap using chrony because it works by increasing the clock speed or reducing the clock speed to catch up.  Obviously this is not efficient, hence why you should set it manually as demonstrated above.

However, ignoring all of the above, the first step is to restart the chronyd service:

# systemctl restart chronyd

In most cases this will not immediately update the system time, the service will be aware of the correct time internally.  Using timedatectl will show that the system time has not been changed yet.

Next you will need to force update the time by "making the step":

# chronyc -a makestep

At this point the system time should be fully updated and you can verify this with:

# timedatectl

Finally you can update the hardware clock with:

# hwclock --systohc

I've asked myself more than once while writing this post, why would this even matter... Realistically, one can find herself/himself in a position where this type of knowledge can sometimes be useful and its nearly impossible to know when.

Wednesday, September 13, 2017

Rescue a CentOS 7 system with a deleted /boot directory

HOW TO: Your /boot directory is missing or deleted on CentOS 7, you can't boot!  Imagine this type of situation happening on a real production system.  It is unlikely to happen, but it is always good to know how to recover from such a disastrous failure.  Even the most resilient systems can have storage failures.  Here's an article on silent corruption: http://perspectives.mvdirona.com/2012/02/observations-on-errors-corrections-trust-of-dependent-systems/

This scenario is based on several tests I've performed on KVM based virtual machines.

Boot the system with a rescue DVD (or ISO for a VM).

At the CentOS 7 boot CD prompt, choose "Troubleshooting" and "Rescue a CentOS system".  Next choose "Continue" to allow the rescue environment to mount the machine's file systems under "/mnt/sysimage". 

At the prompt you will be in a shell loaded by the boot CD.

sh-4.2# ...

Since we want to work directly with the broken system we will chroot to the mounted FS.

# chroot /mnt/sysimage

Check the state of the boot directory:

# ls -la /boot

At this point if the boot partition was corrupted you could run either parted, gdisk or fdisk to recreate the partition.  You could also run fsck to run a filesystem check.

In my case /boot was fine, but empty.

HOW TO FIX A MISSING KERNEL:

Now we need to re-install the kernel... However, the kernel version installed is later than the one on the installation CD.  There are several things we can do at this point, but I will outline two:
  1. Install the old kernel from the CD or,
  2. Start the network and install the latest kernel from yum.
NOTE: Once the kernel is reinstalled through RPM or YUM, the installation triggers dracut which re-generates the necessary initramfs files.

RE-INSTALL THE KERNEL FROM THE BOOT CD: (skip if you want to use yum and the network)

Mount the boot CD to the /run/install/repo directory:

# mount /dev/sr0 /run/install/repo

# rpm -ivh --force /run/install/repo/Packages/kernel-<...version and arch...>

RE-INSTALL THE KERNEL FROM THE NETWORK: (skip if you re-installed the kernel from the CD already)


Luckily the network configuration is sound so we can simply start the network device and use yum to reinstall the kernel:

# service network start

Run a yum clean all just in case.

# yum clean all

Reinstall the kernel.

# yum reinstall kernel

RE-INSTALL GRUB:

Run ls -la /boot to verify the /boot directory and you should see the new kernel and associated files listed.  Most of the /boot directory's missing files and directories will be created.  One key portion that will be missing is Grub2.

# ls -la /boot

So we now need to reinstall grub2 and to recreate the configuration.  This process is fairly simple.

Install grub2 on /dev/  -- in my case on a KVM it's /dev/vda

# grub2-install /dev/vda

If no errors were reported, you are ready to reconfigure grub (otherwise you'll need to troubleshoot why you can't write to your device.):

# grub2-mkconfig -o /etc/grub2.cfg

(While the real grub2.cfg file is actually in the /boot/ partition, /etc/grub2.cfg is a symlink and easier to reference - especially if you are using UEFI.  If you are using UEFI the grub2.cfg filename is actually /etc/grub2-efi.cfg -> ../boot/efi/EFI/centos/grub.cfg)

 Next since you are in a chroot shell you need to exit before you can reboot:

# exit

# reboot

In theory your system should now be able to boot just fine, but the SeLinux relabeling will have been triggered and may take some time to complete.  Once done your system will reboot automatically one more time.

If you had multiple kernels installed, but chose to fix this system by installing the base one from the CD, you can install your version again by running:

# yum reinstall kernel-

If you don't know which kernels you had previously installed, you can get the version from the rpm query command:

# rpm -q kernel

There you are...

-----

There are other steps we could have taken to restore / install a kernel, however in general they are quite similar.  Mainly, the differences would be where to get the Kernel RPM from.  Since the version originally installed on the system can be different from the ones available on media or through  yum, it may sometimes be necessary to download a specific kernel and install it manually.

One could even re-compile the kernel but its probably not such a great idea if we are working on a production server.  The main problem is that it would require downloading all the sources and headers required, as well as compilation tools.  Due to security concerns, it would be best not to install compilation tools on a production server as they could be used to gain elevated privileges in the event of a limited intrusion.

Tuesday, September 12, 2017

CVE-2017-1000251 - bluetooth vulnerability

Given the scope of this vulnerability, its probably a good idea to disable bluetooth until all devices are patched.

https://access.redhat.com/security/vulnerabilities/blueborne

On RH based systems:

Mask the service, just in case, this will prevent another systemd unit from attempting to load it.

# systemctl mask bluetooth.service

Stop the service if it is running:

# systemctl stop bluetooth.service

Monday, September 11, 2017

ssh-chat - irc-like chat client over SSH

How to securely chat over SSH?  In this post I discuss one of the latest solutions I've discovered - A very nice piece of software: ssh-chat.

For a long time I've been using and maintaining an active "talk" client/server on one of my systems in order to be able to communicate and collaborate securely over SSH with whoever I needed to.

Unfortunately this is not a perfect solution for many reasons.  I've been thinking of setting up a local IRC server but there are weaknesses with that as well.

Recently I found an interesting project on github, created by a very ingenious programmer who goes by the alias of shazow.  His project, written in Go: ssh-chat.

https://github.com/shazow/ssh-chat

It uses the go libraries for most of the SSH client/server code, but it adds a custom terminal which has a similar look and feel as IRC.

It's very well written and requires very little work to get it up and running.  The only thing I did was install it on a small KVM server and got it to start up automatically.

Here is the systemd file I created for it, located at:

/etc/systemd/system/ssh-chat.service

Content:

[Unit]
Description=SSH-CHAT service

[Service]
Type=simple
ExecStart=//ssh-chat/ssh-chat -i //.ssh/id_rsa

[Install]
WantedBy=multi-user.target


A couple of issues with this solution:

1) While it is an interesting idea, I need to keep an eye out on the golang SSH client/server libraries to make sure security vulnerabilities are kept at bay.

2) Keep in mind that like 'talk,' the conversations on the local server are not necessarily encrypted and could potentially be captured if the server is compromised.

Apart from these reservations, I really like this client and will look into it further as a potential solution.  

Wednesday, September 6, 2017

Compiling minetest on CentOS 7

HOW TO: The default gcc version of CentOS 7.3.1611 is gcc 4.8.5.  Minetest 0.4.16 requires a minimum of gcc 4.9 to compile.

--

Minetest is probably one of the best Open Source games of all times.  The project website is https://www.minetest.net/

While minetest can be compiled on many different OS'es, its easier on some than on others...  I found it easiest to compile on Fedora - all the libraries are readily available and the compilers are cutting edge.

This post doesn't go into resolving dependencies, rather it is a step-by-step document describing compiling minetest with an appropriate compiler.  The default gcc version of CentOS 7.3.1611 is gcc 4.8.5.  Minetest 0.4.16 requires a minimum of gcc 4.9 to compile:

Regarding dependencies, I think there are enough articles on the net that describe how to get what you need.  I will say this however: The third party repos that I normally use on CentOS are: Epel and RPMFusion.  Once these two are installed, getting the required dependencies is as easy as running either: yum search or yum provides */

COMPILING MINETEST:


Attempting to run cmake on the minetest project, renders:

"Insufficient gcc version, found 4.8.5.  Version 4.9 or higher is required. "

So, here is what we do in CentOS 7:

- Install the Software Collections "devtoolset-6"
- Provide CMAKE with the devtoolset compiler locations

Installing the "software collections" repositories,

# yum install centos-release-scl*

Enable the collection repository that we need:

# yum-config-manager --enable rhel-server-rhscl-7-rpms

Install SCL devtoolset-6 to get a newer version of GCC and G++.  

# yum install devtoolset-6

Go into your minetest build folder and enable the toolset's version of bash:

# scl enable devtoolset-6 bash

Unfortunately, since cmake is not included in the toolsets, we need to tell the base one where to find the right compilers, otherwise it tries to use the system's default.

The only method that I found which worked, was:

$ CXX=/opt/rh/devtoolset-6/root/usr/bin/g++ CC=/opt/rh/devtoolset-6/root/usr/bin/gcc cmake . -DRUN_IN_PLACE=TRUE ...

Now, you can exit the devtoolset-6 bash shell and compile normally.  Cmake generated all the necessary information to use the correct compilers regardless of your environment:

$ exit

$ make -j <# cpus>

Happy compiling!

P.S. Remember that when you run scl enable devtoolset-6 bash, you are in a new bash session with

Thursday, August 31, 2017

Upgraded from Fedora 25 to 26

I've just upgraded my Fedora 25 workstation to Fedora 26.  I had previously upgraded from 23 to 24, then 24 to 25... So far things are working out fairly well and I have not noticed any issues directly related to the upgrade.

Kudos to the Fedora team.

Tuesday, August 29, 2017

Choosing a safe encryption algorithm for SSH on CentOS

How to choose the best possible encryption algorithm for SSH on Centos?

Choosing a stronger encryption algorithm for SSH, than the default:

Regenerate a new host key using the ed25519 algorithm (ed25519 uses Curve25519 which has a high safety rating)
https://safecurves.cr.yp.to/
http://blog.cr.yp.to/20140323-ecdsa.html 

ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519

# vim /etc/ssh/sshd_config

Comment all HostKey lines, except for the key using ed25519:

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key

Restart the sshd service:

systemctl restart sshd