florianjacob.de_

Switching to letsencrypt: Experiences with the closed beta program

2015-11-22T21:00:00+01:00

On 2015-11-04, I was very happy to find a Let’s Encrypt closed beta invitation in my inbox - only to find out that you had to add in every subdomain separately, and I only registered my top-level domains and www. >.< It only took a week to get my subdomains whitelisted, too, though.

Experiences

So then I could finally get all my certificates! Which is, in theory, as simple as downloading the Let’s Encrypt script and executing:

./letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory auth

which generates your certificates in /etc/letsencrypt. You need to shortly disable your web server though, as the script binds to the http port for the domain verification.

Also, the script depends on python packages in versions from Debian Jessie. As my main server is still running Wheezy for reasons™, I had to upgrade many python related packages to Jessie for the script to work. Not very nice, I should really do the full upgrade to Jessie soon. Then, I was on to changing each and every config file of all the services to use the letsencrypt certificates instead of my old CAcert ones.

The next problem I ran into was that the certificates are only root-accessible by default, but prosody and mumble try to get user-level acces. I fixed that by changing the group of /etc/letsencrypt to ssl-certs, intended by Debian for that, and made it sticky so this hopefully will survive certificate renewals. Maybe the installer will do that by default in the future.

After a few days of testing, I activated nginx forwards to https:// for all sites hosted here, and enabled HSTS, because I’m quite sure now Let’s Encrypt will work out for me. If you can read this, everything is still fine. ;)

The future?

I decided against HPKP, because I’m not sure what would be the right thing here as the certificates are only valid for 90 days, and I don’t think one can get spare ones for the future currently. I’ll wait until there’s a recommended way of doing that with Let’s Encrypt. Maybe the only thing that really makes sense is to pin it to the main and backup Let’s Encrypt CAs and not my actual keys?

Also, DANE (combined with DNSSEC) would more or less eliminate the need for HPKP and also work for other protocolls than http. The problem here is similar, but not as hard: How to automatically update the keys of my DNS zone? This will probably be much easier when I host my own authoritative DNS server, or maybe Let’s Encrypt will come up with a standard way to automate that, too. But in any case, I’ll have wait for my DNS registrar to fully support DNSSEC - which will happen soon, hopefully.

Conclusion

Get your Let’s Encrypt certificates today! \o/ (By which I mean, wait until the end of next week, when the public beta starts on 2015-12-03.) It’s really simple if you don’t still run Wheezy, it’s much less hassle than having your own CA or copy&pasting certificate signing requests like with ”regular CAs“ as CAcert, and the certificates are accepted by each and every device in the world or so (and it also makes the GoogleBot happy – even more ;) ).

How to rewrite and forward ./index.html to ./ with nginx and Apache

2015-09-27T16:00:00+02:00

Recently, I decided to clean up my index urls. I had .*/index.html files, directory listings at .*/, indirect serving of index.html to .*/, many times with the index being reachable via two urls without forwards. It’s good practice to have only one URL for a specific page (and it also makes the GoogleBot happy), so I looked into forwards and redirects with Apache and nginx.

First, you need to decide whether you prefer .*/ or .*/index.html. I’m in for the former, because I wanted to have a coherent scheme with directory listings, too, and it doesn’t make sense to have a webserver-generated directory listing at the location of a file. Also, it seems to me like it’s the more semantically correct url. My requirement was to have the forward for all directories and index.html files, not only for the top level /index.html. The usual examples don’t cover that and / or use two regexes, but I found an easy way to do it with a single one.

nginx

For nginx, you need the rewrite directive and a small workaround:

# forward all index.html files to their parent directories for having unique urls
rewrite ^(.*/)index.html$ $1 permanent;

# The default index directive, "index index.html;", reacts on .*/
# with an internal redirect to .*/index.html, which is then affected
# by the rewrite, resulting in an infinite redirect loop.
# This location directive breaks the loop by bypassing the index directive
# and directly trying to serve index.html.
location ~ ^(.*)/$ {
    try_files $1/index.html =404;
}

The index index.html directive works with an internal redirect, which seems to get caught in the rewrite rule again, endlessly. try_files also does an internal redirect like the index directive, but as it’s enclosed in a location block, it doesn’t reach the rewrite above anymore (At least I think that’s the reason… drop me an email if you know more about or a better way to do this).

Apache

For Apache, you need the RewriteRule directive:

RewriteEngine on
# forward all index.html files to their parent directories for having unique urls
RewriteRule ^(.*/)index\.html$ $1 [redirect=301,last]

No workaround needed for apache, the rule just works as expected. But don’t forget a

sudo a2enmod rewrite

if you don’t have mod_rewrite already enabled.

Have fun!

SSH Tips & Tricks: On killing & multiplexing Sessions, and checking Host Keys

2015-08-07T16:20:00+02:00

Recently, I found out that none of my friends with own servers knew about these three ssh configuration options, so I decided to collect them and share them with everyone. :)

Kill a hung SSH Sessions without closing the Terminal

I used to close hung up ssh sessions by closing the full terminal or terminal tab, too, but a few years ago, I found out there’s a much better alternative. The ssh command line client actually has an escape sequence and then a few commands to control it! The magic key presses to close a session are: “⏎~.” (enter-tilde-dot). “⏎~” is the escape sequence, “.” is the command to terminate the session, and “⏎~?” shows all other available commands.

Check your SSH Fingerprints with ease using VisualHostKeys

One should compare one’s SSH host key fingerprints, but most of the time, one just assume it’s probably all right or checks the first and the last few characters, as comparing the fingerprint character by character is just too much work. Humans are much better at comparing visual patterns, though. Ever wondered what those „This is the key’s random art“ with a strange ASCII art image when you generate a key are all about? Only recently I found out that they are a visual representation of the fingerprint intended for easy comparison by humans.

# Show random art of the host key on every login
VisualHostKey yes

If you add this option globally to your .ssh/config, ssh will show you the SSH host key fingerprint as random art every time you log in to a server. This will train you to the pattern, and after a few weeks, you’d notice that the pattern is different immediately.

Multiplex SSH Sessions for more Performance

You can easily boost the performance of transfers of many small files by adding this as a global options to your .ssh/config. (Of course you could apply them to a few hosts only, too, but why should you?) This builds up only a single SSH connection to the target host and multiplexes all other ssh sessions to the same host over it. This also means that opening a second ssh session is almost instant.

# multiplex the connection when possible
Controlmaster auto
# location of the socket files
Controlpath ~/.ssh/ssh-%r@%h:%p.sock
# persist multiplex socket for 60 seconds when idle
Controlpersist 60

In case the full session hung up, you need to delete ~/.ssh/ssh-<username>@<hostname>:<port>.sock though, or wait 60 seconds for the idle timer to time out.

CAcert certificates everywhere!

2014-09-24T22:59:00+02:00

All my servers (including this site) are reachable via TLS and show certificates issued by CAcert since a few months ago, instead of the self-signed certificates of a custom CA I had before.

CAcert.org is a community-driven Certificate Authority that issues free class 3 certificates after a first-hand verification through the community.

For others running servers: I am a CAcert assurer now, so I can assure you in case we meet in person, but you’ll need other assures as well.

To contact this site or my servers via https without warnings, you can either store the certificate as before or import the CAcert certificates:

Bonus: If everything worked out, you now can visit e.g. the Chaos Computer Club via https without a warning, too.

DNSSEC / DANE

I’d love to enable DNSSEC and DANE, but my domain registrar only supports DNSSEC in case you run your own authoritative DNS server instead of theirs. :/ (See the knowledge base of inwx, Can I use DNSSEC?). But I’ll try to set one up when I find the time.

How to tunnel IPv4 internet through tinc

2014-04-14T16:50:00+02:00

For a description of the setup I use to connect all my computers via tinc in the first place, see How to set up a small tinc VPN using IPv6 payloads over IPv4 and iproute2.

After I had my tinc network up and running, I wondered how I could tunnel my internet traffic from the peer nodes to the entry node through tinc to replace my old OpenVPN setup.

As the internet is more or less still based on IPv4 connectivity, the easiest way I found was to make tinc dual stack on the affected nodes and route the traffic outwards through a standard IPv4 NAT on the entry node.

Choosing an IPv4 Subnet

I’d recommend using a random IPv4 private subnet instead of 10.0.0.X or the like, see the Choosing an IPv6 Subnet section of my first tinc post for my reasons.

So let’s get started by rolling the dice for our IPv4 subnet. This time we only need 16bit of random information instead of 40, or a 2-digit hexadecimal number insdead of the 10-digit we needed for IPv6. Shows quite drastically how short IPv4 addresses are.

And as one usually writes IPv4 in decimal notation, you can enter this in your shell to generate your address range in python:

python
import random
print("10.{}.{}.X".format(random.randint(0,255), random.randint(0,255)))

Rolling the dice by hand is a valid approach, too. ;) For me, this resulted in 10.88.24.X.

Configuration

Entry Node Configuration

I’ll list the whole, but modified, versions of the config files from my first tinc article in this guide to put everything into context.

As a reminder, $STATIC_IP is the public static (presumably IPv4) IP of your entry node, and $INTERFACE will be replaced by tinc itself, so no need for yourself to do it. The remaining variables should be self-explanatory, but you can read about them in the first tinc article, too.

Let’s get started with /etc/tinc/$VPN_NAME/hosts/$ENTRY_NODE_NAME, you have to add another Subnet line with the tinc-internal IPv4 address of the entry node:

Address = $STATIC_IP
Subnet = fde3:b35d:dadf::1/128
Subnet = 10.88.24.1/32
# make this node the default gateway for the network
Subnet = 0.0.0.0/0

Thanks to Bernhard for pointing out the missing Subnet = 0.0.0.0/0 part.

And then, assign the new address to the tinc interface brought up by /etc/tinc/$VPN_NAME/tinc-up:

#!/bin/sh
ip link set $INTERFACE up
ip addr add fde3:b35d:dadf::1/64 dev $INTERFACE
ip addr add 10.88.24.1/24 dev $INTERFACE

Peer Node Configuration

The same needs to be done to each peer node that needs to access the internet through tinc - with an individual IPv4 address per node, of course.

First, in /etc/tinc/$VPN_NAME/hosts/$NODE_NAME:

Subnet = fde3:b35d:dadf::X/128
Subnet = 10.88.24.X/32

And then, in /etc/tinc/$VPN_NAME/tinc-up:

#!/bin/sh
ip link set $INTERFACE up
ip addr add fde3:b35d:dadf::X/64 dev $INTERFACE
ip addr add 10.88.24.X/24 dev $INTERFACE

NAT on the entry node

If you haven’t done it already, you need to enable IPv4 forwarding in /etc/sysctl.conf:

net.ipv4.ip_forward=1

I use shorewall on all my servers as a frontend to iptables. Everything is in a few config files and actually nice and easy to use, in contrast to iptables. Shorewall can be used as a simple one-interface firewall, but also supports more complex setups, like the one we need here.

In case you prefer to use raw iptables, I expect you to know what to do anyway. ;)

The situation for our tinc setup is exactly like the two-interfaces example that comes with shorewall, in Debian it’s located at /usr/share/doc/shorewall/examples/two-interfaces. The only thing you need to adjust is that the tinc network is interface $VPNNAME and not eth1 - the change of the zone name from loc to tinc is purely cosmetic.

Change the example eth1 interface to your tinc interface in /etc/shorewall/interfaces:

...
# replaced
# loc     eth1            tcpflags,nosmurfs,routefilter,logmartians
# with
tinc     $VPNNAME         tcpflags,nosmurfs,routefilter,logmartians

And then change the name in /etc/shorewall/zones:

# replaced
# loc ipv4
# with
tinc ipv4

Then adjust the rest of shorewall to your needs. ;) The documentation is excellent in my opinion, so I won’t repeat it here.

Switching from ufw to shorewall was a great relief for me - even for simple one-interface firewalling, I’d recommend to use shorewall.

Tunnel in Operation

Enabling the Tunnel

This is a bit cumbersome, I have to admit. One could automate this with a script, or maybe even a convenient netctl unit on Arch Linux, but as I need the tunneling not all to often, I didn’t take the time for it. In case you hack something together, I’d be happy to hear from you.

First, you need to find out the IP of your router and the name of the interface the router is on, let’s call them $ROUTER_IP and $ROUTER_INTERFACE. Both will be needed to disable the tunnel again, so keep a note!

ip route show to 0/0
# output: default via 192.168.178.1 dev enp0s25
# of the form: default via $ROUTER_IP dev $ROUTER_INTERFACE

Aditionally, you’ll need your $STATIC_IP.

# Add a static route to the entry node via the router
# so that the entry node can still be reached when you change your default route
sudo ip route add $STATIC_IP via $ROUTER_IP dev enp0s25
# route all internet trafic through the tinc interface
sudo ip route change default via 10.84.82.X dev $VPN_NAME

If you resolve DNS against your local $ROUTER_IP, you probably want to change that as long as the tunnel is up to prevent your DNS queries leaking. If you don’t do this, the router you are connected to (and the internet provider behind it) will see your DNS queries as plaintext.

You need an alternative DNS server, e.g. from the Open Root Server Network or CCC and the like. You can use 8.8.8.8 - in case you want to report every site you visit to Google instead of the other options.

In /etc/resolv.conf:

# Comment out this line:
# nameserver $ROUTER_IP
# add this line with the DNS server of your choice,
# here: dnscache.berlin.ccc.de
nameserver 213.73.91.35

Disabling the Tunnel

To disable the tunnel, we need to reverse the steps from above:

# change the default route back to route traffic to the router
sudo ip route change default via $ROUTER_IP dev $ROUTER_INTERFACE
# delete the explicit route to your entry node's $STATIC_IP - this is optional
# as it doesn't do anything anymore, and will vanish on next reboot.
sudo ip route del $STATIC_IP

In /etc/resolv.conf:

# comment out this line again
# nameserver 213.73.91.35

Next Steps

This setup still lacks IPv6 connectivity, which would be nice especially when you’re behind an IPv4 only internet connection.

One could provide that by more shorewall and public static IPv6 addresses for each tinc, or by radvd handing out the /64 prefix you probably got with your server and enable the IPv6 Privacy Extension on the clients, which would be the IPv6 equivalent of a NAT to make connections indistinguishable.

But as most hosts I need to reach via IPv6 are actually my own, and therefore, they already are inside my tinc network, so I skipped this step for now.

Other Options

4in6

Another option is to use 4in6 tunnels which can be created with ip -6 tunnel add mode ipip6 ... in tinc-up and tinc-down, but this is functionally the same as making tinc dual stack, but much more hassle to configure as you end up with a separate interface for each peer node.

NAT64

A third option would be NAT64 combined with DNS64 to translate all A records to simulated AAAA records and then establish IPv6 only connections to the NAT which then translates the requests transparently to IPv4.

This would allow to have all tinc nodes IPv6 only, at the cost of running a full DNS server, an advanced NAT setup and a servere interference in the client’s traffic - but well, you need a NAT anyway..

I might try it someday following this guide, but I don’t think it’s worth the effort compared to the above IPv4 setup if you don’t care whether your network is IPv6-only or not: How to setup an IPv6-only network with NAT64, DNS64 and Shorewall

Brace your bonsai, winter is there!

2014-01-11T17:30:00+01:00

Let me introduce you to my bonsai! I’m sure he’d be pleased to meet you.

He’s a Japanese white pine (Mädchenkiefer in German), and I adopted him in March 2012 when he was just a sapling from a tree nursery.

The photo is from the beginning of December, just after I wrapped his pot in bast fiber in order to protect him from the cold (he needs to stay outside all year).

If you take a closer look, you can see that his branches are freshly wired and brought in shape from the last time we were at our bonsai school in mid-November. Everything prepared for a good development next year!

Oh, and don’t tell him, but he might get a companion next spring. ;)

How to set up a small tinc VPN using IPv6 payloads over IPv4 and iproute2

2013-12-01T20:30:00+01:00

Follow-Up: How to tunnel IPv4 internet through tinc

Correction: In the first version, I had the tinc host configuration Subnet variables have a /64 network prefix. This was a copy mistake from the tinc-up scripts, it needs to be /128. Thanks to Miguel for the hint.

This describes the setup I use to connect my computers at home, on the road, my home server and virtual server with tinc, „a Virtual Private Network (VPN) daemon that uses tunnelling and encryption to create a secure private network between hosts on the Internet”.

Additionally, I explain the setup for interconnecting mutliple tinc VPNs at the end of this article.

I used an IPv6 ULA subnet (Unique Local Address, RFC4193) and iproute2 for this. A single always-on machine with a static IPv4 address and which is not behind a NAT is handy as a central entry and discovery node for all other machines, but not required (I use my virtual server for this). Port forwarding (per default port 665, needed for both TCP and UDP) and dynamic DNS should work, too.

All other nodes can be behind a NAT, tinc will use UDP hole punching. If it’s possible, two peer nodes behind a NAT can communicate directly after an initial discovery using the entry node. This means the entry node relays the traffic between two peer nodes only when it’s needed.

If you prefer IPv4 and ifconfig, check out Marex’ at least equally good howto over at execfoo.de. His article was a great help for me (and he was first).

This ifconfig / iproute2 comparison helped me a lot with converting ifconfig to iproute2 commands.

Choosing an IPv6 Subnet

With IPv6, there’s nothing like 192.168.X.X, as everything is intended to have a globally unique address. Not all addresses need to be routed globally though - for that purpose, there are ULAs. If you have a spare global /64-Subnet, even better, then you could even route your internet traffic through your VPN leaving for the rest of the internet e.g. at your entry node.

But I’ll explain how to get a ULA net here. First, you need to get 40bit of random information (a random 10-digit hexadecimal number) for your global ID.

If you don’t want to roll the dice by hand (which is a recommended exercise :P ), you can get a prefix generated at unique-local-ipv6.com.

Let’s say you rolled a e3b35ddadf (I’d count that as 4 ones in a row if you manage to roll that in my DSA round) and you want to use that as your global ID. You then need to add “fd” as prefix for ULAs, resulting in the IPv6 net

fde3:b35d:dadf::/48

under your control.

From this, we take „zero”st /64-Subnet from this for our VPN:

fde3:b35d:dadf::/64

If you’re one of the „IPv6 addresses are soo long! I can memorize 192.168.0.0/32 much better!“ people - well, that’s because you and everyone else uses those few subnets in 192.168.X.X and 10.X.X.X.

Imagine you use 192.168.178.0/32 at your home LAN, and you take 192.168.0.0/32 for your tinc VPN. Then you are at your friend’s house, want to connect to your VPN, but nothing works, because they already use 192.168.0.0/32 for their LAN.

Or let’s say you and your friend think tinc is so cool that want to interconnect your VPNs, and you both chose 192.168.0.0/32 when you created your tinc VPNs some time ago? Baaamm, address clashes, one of you two has to reconfigure all their machines.

All this won’t happen with IPv6 and proper random global IDs. And if you don’t want to memorize them, just put some entries in your /etc/hosts file. I find plain host names much more convenient than typing any numerical address.

But now, onward to the actual configuration. This assumes you already installed tinc.

Entry Node Configuration

Chose a $VPN_NAME to identify your VPN.

sudo mkdir -p /etc/tinc/$VPN_NAME/hosts

Then, write into /etc/tinc/$VPN_NAME/tinc.conf:

Name = $ENTRY_NODE_NAME

$ENTRY_NODE_NAME can be any name to identify the entry node. Using your hostname (entering hostname in a terminal returns it) is a good idea. The name may only consist of alphanumeric and underscore characters.

Next file is /etc/tinc/$VPN_NAME/hosts/$ENTRY_NODE_NAME:

Address = $STATIC_IP
Subnet = fde3:b35d:dadf::1/128

The Subnet variable specifies which subnet is assigned to that tinc node. We only assign a single IPv6 address to every node, so we set it to the address we want to assign and /128 prefix length.

$STATIC_IP is the static IPv4 address I mentioned earlier. You can specify multiple address statements, e.g. the first one for IPv6 and, if that can’t be reached, the second one for IPv4.

I don’t do that, because only then tinc can make direct connections between all node pairs when they’re needed even in case one sits behind an IPv4 only internet access. (It would still work, but then all traffic will be relayed over you entry node).

Read the docs if you want to use a DNS name.

After that you generate the public/private key pair for your entry node:

sudo tincd -n $VPN_NAME -K4096

Leave everything at the defaults. This conveniently appends the public key to your host configuration file, we’ll need that on the other hosts later.

To finish the entry node configuration, we need two scripts for setting up and tearing down the VPN connection:

/etc/tinc/$VPN_NAME/tinc-up:

1
2
3

#!/bin/sh
ip link set $INTERFACE up
ip addr add fde3:b35d:dadf::1/64 dev $INTERFACE

/etc/tinc/$VPN_NAME/tinc-down:

1 2	#!/bin/sh ip link set $INTERFACE down

No need to replace $INTERFACE here, it will be replaced by tinc with the virtual network device it uses for your VPN.

The IPv6 address above needs to be the one you configured in the Subnet variable in your host configuration and is the address used for the virtual tinc network interface. But in contrast to the Subnet variable, the /64 subnet prefix length here specifies which subnet you are connected to via tinc, so this should be the /64 subnet you take your IPv6 addresses from for your tinc VPN.

Think of the subnet prefix length here as “which addresses can be reached directly in one hop, without going through a router?”.

It’s an IPv6 best practice to use only subnets of /64 size, with the exception of /128 for a single address and /127 for a point to point connection. See Section 3 of RFC5375 for more explanation why.

Many features like Router Advertisement, Stateless Link Addres Autoconfiguration and more rely on /64 subnets, but you can use prefixes longer than /64 e.g. when assigning addresses manually. But you need to avoid some special addresses, see Appendix B2 of RFC5375, „Considerations for Subnet Prefixes Longer than /64“ for more details.

Make the scripts executable:

sudo chmod +x tinc-up tinc-down

And you’re done configuring your entry node!

Peer Node Configuration

The peer node configuration is very similar. You need to pick a $NODE_NAME (again your hostname makes sense) and a different X for each node for the IP addresses.

sudo mkdir -p /etc/tinc/$VPN_NAME/hosts

/etc/tinc/$VPN_NAME/tinc.conf:

Name = $NODE_NAME
ConnectTo = $ENTRY_NODE_NAME

/etc/tinc/$VPN_NAME/hosts/$NODE_NAME:

Subnet = fde3:b35d:dadf::X/128

Generate the public/private key pair for your this node:

sudo tincd -n $VPN_NAME -K4096

The setup/teardown scripts are exactly the same, except the IP address in the tinc-up script:

/etc/tinc/$VPN_NAME/tinc-up:

1
2
3

#!/bin/sh
ip link set $INTERFACE up
ip addr add fde3:b35d:dadf::X/64 dev $INTERFACE

/etc/tinc/$VPN_NAME/tinc-down:

1 2	#!/bin/sh ip link set $INTERFACE down

Don’t forget to make them executable:

sudo chmod +x tinc-up tinc-down

As already mentioned, then transfer /etc/tinc/$VPN_NAME/hosts/$ENTRY_NODE to your local /etc/tinc/$VPN_NAME/hosts/ folder, and the /etc/tinc/$VPN_NAME/hosts/$NODE_NAME to your entry node’s /etc/tinc/$VPN_NAME/hosts/ folder.

No need to copy peer node host configuration files around between each other, they’ll find each other over the entry node without any additional configuration. Yay, tinc magic! \o/

Enable your tinc VPN on system startup

Start your tinc engines on your entry node and all peer nodes, and test your VPN!

For systems using systemd:

sudo systemctl enable tincd@$VPN_NAME
sudo systemctl start tincd@$VPN_NAME

For systems using SystemV-style init (=> Debian, because it’s still the only one ancient enough for them) or upstart (=> Ubuntu, because they’re Ubuntu), that is:

cat $VPN_NAME >> /etc/tinc/nets.boot
service tinc start

Your connection will need some time after startup until it’s established. Test it with

ping6 fde3:b35d:dadf::1

and have fun!

Interconnecting tinc networks

If you want to connect you tinc network to the tinc network of that friend mentioned earlier, not much work is left.

Let’s say they rolled a

fde3:b35d:dadf::/48

and use the subnet

fde3:b35d:dadf::/64

for their tinc network.

Then, to everey tinc-up script on your nodes, you have to add a line saying:

ip route add fde3:b35d:dadf::/64 dev $INTERFACE

Again, $INTERFACE is replaced by tinc, no need to do it yourself.

Next, you need to copy their entry node host configuration file to your /etc/tinc/$VPN_NAME/hosts/ on your entry node.

Now the entry node knows the details about the friend’s entry node. You then need to add another line to the /etc/tinc/$VPN_NAME/tinc.conf on your entry node:

ConnectTo = $ENTRY_NODE_NAME_OF_FRIEND

and you’re done! (Don’t forget to restart tinc, though. ;) )

New Language Feeds

2013-11-09T22:59:00+01:00

As you might have noticed, my last two posts were in German.

In the future, I think I’ll have more topics on which I want to write in my first language, or which are only relevant to a German audience. So besides the “All Articles” feed you’re used to, I now generate additional “All English Articles” and “Alle deutschen Artikel” feeds.

You can find them on the right, watch out for my new shiny feed icons. ;)

lavabit.com has shut down, wolkenplanet.de has started up

2013-10-03T19:11:00+02:00

TL;DR

Edward Snowden was using lavabit, so the only choices left for the owner were to give all of the user’s data to the NSA or to shut down the service. He chose the latter, but isn’t allow to say anything about what has actually happened. And let me say that I am quite happy he did so.

This means that the privacy of 400 000 lavabit customers who didn’t do anything wrong would have been compromised if Ladar hadn’t shut down lavabit in beforehand. This also means that no cloud provider located in the US can keep their promises concerning the security of the data you hand over to them.

As a consequence, I now run my own mail server for a month, and you can reach me at briefe {ÄT} florianjacob [Punkt] de or my private address that I gave you in case I know you in person. ;)

posteo is a good german mail provider.

How I found lavabit

Many years ago, I was in search of a new email provider, as my first one provided me with no more than 12MB of space for years and didn’t offer IMAP acces.

I didn’t want to use Google Mail, because even at that time they were somewhat suspicious to me. So I searched for alternatives, and found lavabit, a provider with the defined goal to be better than Google Mail, but with privacy and even encrypted mail boxes - at that time, I didn’t even know what that meant.

What has happened

On the 8th of August, I noticed that I couldn’t connect to my post boxes anymore - at first I thought my mail client had problems, or that it was just a temporary outage, but the problem persisted for a day, and on lavabit.com, I found this explanation:

My Fellow Users,

I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations. I wish that I could legally share with you the events that led to my decision. I cannot. I feel you deserve to know what’s going on--the first amendment is supposed to guarantee me the freedom to speak out in situations like this. Unfortunately, Congress has passed laws that say otherwise. As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests.

What’s going to happen now? We’ve already started preparing the paperwork needed to continue to fight for the Constitution in the Fourth Circuit Court of Appeals. A favorable decision would allow me resurrect Lavabit as an American company.

This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.

Sincerely,
Ladar Levison
Owner and Operator, Lavabit LLC

At this point, I was very glad that I did a few months ago what I wanted to do for a long time, but always thought I could delay until I had my own mail server: I created an unattended backup system for my mail boxes. So remember: Don’t delay your backup system, it might get important sooner than you think.

Additionally, now I know for sure that my mail provider, even if located in the USA, would even go as far as to shut down everything they worked on in the last decade when it’s their only option left for protecting their users.

It was indeed quite shocking how, suddenly, I was directly affected by the impact of what Snowden’s publications have shown the world.

Research

As he stated above, Levison isn’t allow to say anything about what has happened, even to his lawyer he can’t say everything. So Levison has to rely on the public and the media to find out what happened by themselves.

I found out that the mail address used by Edward Snowden for entering the Moscow Airport and sending the invitations to the human rights activits for the meeting he had there was edsnowden@lavabit.com. Well, that explains a lot.

With that in mind, „the last six weeks” in the announcement have a meaning: This was exactly the time since the Snowden Leaks. So I came to the conclusion that I was using Edward Snowden’s email provider of choice for the last years without even knowing that until six weeks after the world knows his name, and now, the NSA wanted to have everything lavabit had stored about anybody.

The following video is an interview with Lewison and his lawyer, which shows very impressively in what absurd consequences those gag orders actually result in. He has to describe everything hypothetically and indirectly, he can’t say what they actually wanted from him, he has to say things like “I always said, the only way someone could do eavesdropping on lavabit is to force me to give them my private SSL keys or to modify the software I’m running on the servers, and I thought that this was something that’ll never gonna happen.” - or he is committing a crime he could and would be convicted for.

Today, court documents were unsealed which showed what really happened and how Ladar Levison was fighting by all available means: You can read the full articles at wired or golem (german). After he was forced to give out the keys, he even did so when he had no legal choice left - in the form of 11 printed pages in 4 point font size, which a person would have to type in manually, character by character, with even a single incorrect keystroke rendering the key completely useless. Hats off for such epic trolling!

But as those printed keys were indeed useless, at the 6th of August, he was forced to hand out an electronic copy, with a 5000$ fine for every day until he hands over the keys. At the 8th of August, lavabit closed its doors.

This court decision means that the privacy of 400 000 lavabit customers who didn’t do anything wrong would have been compromised if Ladar hadn’t shut down lavabit in beforehand. This also means that no cloud provider located in the US can keep their promises concerning the security of the data you hand over to them.

Ladar was even willing to provide the authorities, which could show a judicial order, with the mails of Snowden, as he is legally obliged to. But the agents wanted access to all the data and all the mails of every customer, and Ladar didn’t betray his promises.

One upside

I now have my own mail server running at wolkenplanet.de

While I have planned it for about two years, but didn’t do it because lavabit was so convenient, I was finally forced now to set up my own mail server. But just after the day that I heard that lavabit is no more, I went on vacation and had no time to set it up.

This resulted in a whole month without checking mail, with the knowledge that no pile of mail wil be waiting for me after that. Quite an interesting and liberating experience, but nothing that could stay this way for a longer time.

Now I have postfix + dovecot running for a month, and so far, no problems did arise. :) Maybe I’ll write about my setup in a separate blog post later.

It’s a really tedious work to go to every webservice you ever registered an account with, and change your mail addresses. Actually I feel a little sad when I have to delete my old addresses, as I got quite used to them in the last years.

But as as I have my mail addresses on my own domains, I can be sure I’ll never have to change them in the future, even if I switch servers or go back to a provider.

Recommending posteo

By the way, I still have a backup mail address for emergencies from a provider I found in a recent edition of c’t, probably the most influental german computer magazine: It’s called posteo and was the one of the few providers that had perfect forward secrecy enabled for everything - this means that even if someone steals their private key, they can’t decrypt recordings of your communication with posteo - So no “intercept now, decrypt later” here, thanks to the Diffie-Hellman key exchange.

The one feature I miss is the usage of own domains, but if they would allow that, they would need to store your name and post address in their inventory data which they then would need to forward to security agencies - so they don’t want to have that data in the first place. But that beside, they have everything you want.

Final thoughts

Of course one could call me a hipster for being the only one on the usual course mailing lists whose provider isn’t one of the usual: Google Mail, gmx, web.de and maybe Hotmail and t-online (which make up >95% of german email addresses), but for me, it was a sign of resistance, showing that there are decent alternatives out there.

Somehow that feeling is very similar to the feeling of showing, explaining or defending the usage of Linux. Somehow the fact that Edward Snowden used lavabit makes me feel justified in front of others for using such a “strange mail provider” in their eyes.

Now, there’s only one step left to complete independence in the mail area - moving the mailserver from my rented vServer to my server at home under my desk.

Learning Japanese: Second Semester

2013-08-12T16:42:00+02:00

Another semester has passed, and again we watched Japanese animes with subtitles in the last lesson, we watched the short film The Garden of Words and the first episode of Psycho-Pass series. The Garden of Words has a very sentimental ending, and Psycho-Pass is quite turned in, but still I liked both.

At home I watched My Neighbour Totoro again, like I intended to do half a year ago. The most notable progress was that in the meantime, we learned the most basic adjectives, which made quite a difference - I actually understood a few short sentences. \(^_^)/

Let me give you two example sentences as a showcase of what I learned this semester:

たんじょうび は かのじょう に あおい トトロ を あげましあ。
トトロ は とても かわいい そして いちご が いちばん すき です。

Tanjoubi wa kanojou ni aoi totoro wo agemashita.
Totoro wa totemo kawaii soshite ichigo ga ichiban suki desu.

For my girlfriend's birthday, I gave her a blue Totoro.
Totoro is very cute and his favourite dish is strawberries.

Interestingly, to like and to disklike are adjectives in the Japanese language.

What else happened? In a c’t article from this semester on online ressources for learning Japanese, titled „Monkey Apple Carbeurator“ - which is, as I then remembered, a quotation from a very humoristic article about learning Japanese that I read years and years ago. And now after actually having learned a year of Japanese, that article is even more funny than it was when I first read it - you can find it here: So You Want To Learn Japanese (or read the german translation: Soso, du willst also Japanisch lernen..).

Additionally, in this semester, I had the opportunity to try sashimi, sushi and some wakame salad for the first time, which were quite good, but still something you have to get used to. Before that, I fortunately learned how to eat with chopsticks, this was the youtube video which finally made me understand: The Answer Book: Guide to mastering the chopsticks within 5 minutes (How to hold chopsticks)

After several views and several urges to throw them against the next wall, but then, it finally sunk in. (^_^) I can recommend tortellini as test objects. Have fun trying!

Until next month, またらいげつ。

mezamashi - めざまし

2013-06-17T19:15:00+02:00

A Terminal Alarm Clock written in Python

No, this is not the “learning japanese - 2nd semester” post, despite one could think that at first glance. But that will be coming soon, too. ;)

This is the result of some of the few times where I had time to code a little during the last semester, and as some friends showed interest, I’ve decided to publish what started as my apprentice piece with scriptine.

Instead of repeating what I wrote in my readme, let me just quote it:

Regular alarm clocks have the disadvantage of not turning off your computer when it’s time to sleep, they just beep when it’s time to get up.

To prevent you from finishing “just this little thing” and getting to bed too late, you can set up mezamashi to shut down your computer at a specific time beforehand, e.g. in 2 hours, and to wake you up with a nice song in your media player or anything else you can steer from the command line.

But the crucial point is that it turns on your computer when it’s time to get up and lets you know that - so it uses the force that keeps you at your computer and out of bed at bedtime to get you out of bed (and, unfortunately, at the computer again) when it’s time to get up.

The only thing left for you is to get out of the house in time, but at least your early-morning sleapyness shouldn’t make you stay in bed anymore. ;)

The code can be found on github and is licensed under GPLv3.

Let me show you some example calls:

# set a wakeup alarm to 8 o'clock
>./mezamashi.py set 8:00
# show the current alarm
>./mezamashi.py show
# disable the current alarm
>./mezamashi.py unset
# set a wakeup alarm in 7 hours and a half
>./mezamashi.py set 7h30
# go to sleep in 20 minutes. you need to use this command to suspend to run your alarm_shcommand at next startup.
>./mezamashi.py sleep 0h20
# there's an alias if you want to suspend immediatly
>./mezamashi.py sleep now

Most of the work was done with scriptine, it’s a nice library providing a simple interface for all the shell scripting stuff like exececuting commands and doing file system operations. On top of that, it has a really nice way of defining commands and options in your shellscript, which saves you from repeating more or less the same OptionParser stuff for every shell script you write.

Scriptine really is a great help for shell scripting in python, and from now on, whenever I’m writing a shell script that consists of more than just some rows of commands to be executed, I think I’ll save myself from writing bash if statements (I think I’ve never managed to write one without copying the syntax from somewhere and slightly modifying it) by converting everything to Python + scriptine. :)

The Name

mezamashi is, as you might have guessed, the japanese word for alarm clock. ‘wecker’, the german word, was already taken, so I chose mezamashi to make me remember a vocable without doing anything for it. ;)

End of Semester - alaCarte released

2013-04-10T23:46:00+02:00

As last official act of the last semester, we finally could publish our map renderer as AGPL-licensed open source software. Yay!

What is alaCarte?

Let me just quote the release announcement we sent to the OpenStreetMap talk-de mailing list:

alaCarte is a tile renderer for OpenStreetMap data written in C++11, using Cairo for rendering and Boost-Spirit for MapCSS parsing.

The rendered tiles are served over HTTP using the Slippy map tilename convention. (As you can see on the right.)

To compute which data is needed for rendering a tile, alaCarte uses a variant of a kd-Tree.

alaCarte was designed with medium dataset size in mind. On a typical machine with at leat 8GB RAM, alaCarte can handle a unfiltered export from the federal state of Baden-Wuerttemberg (Germany).

alaCarte was developed as part of a student software project at KIT.

We have a live demo, you can check out the code at github and if you speak German you can view the slides of the finishing presentation of the project I held together with Simon.

I must say I’m glad that we had this specific project. Not only that I learned much about C++ (and why to value Qt), as most other projects were written in Java, this is also one of the very few projects which ended in a result that I can explain or just show to non-technical people.

And finally, the project is, in a way, something that’s actually useful.

Just now after the release, most of us take their time to work on another project of theirs as there was barely time to do that during the last semester, but I’m sure some of us will return to alaCarte and continue to work on it.

Additionally, there’s a similar student lab course module in a few semesters, when we go four our master degree.

Chances are that we take it again and do alaCarte right with all the lessons from the first implementation and all new algorithms and data structures we will have learned by then, reduce the memory footprint and speed it up by an order of magnitude, like our supervisors said. Let’s see! :)

Learning Japanese: First Semester

2013-02-12T16:42:00+01:00

Tired of University lectures? Want to feel like you’re in 5th grade again, or whenever it was when you started to learn your second language? In that case, I can warmly recommend attending the courses for a completely new one, it feels exactly the same as back then. (^-~)

Well, at least I was very reminded of the first english classes I had ten years ago. Classes of 20-30 people, the teacher brings a CD player to class, from which some people speak incredibly fast gibberish, and you start with learning the „Hello World” equivalent of actual languages:

こんにちは。わたしはフロリアンです。カールスルーエのだいがくのがくせいです。
Konnichiwa. Watashi wa Furorian desu. Kaarusuruue no daigaku no gakusei desu.
Hello, I'm Florian. I'm a student from the University of Karlsruhe.

Well, but at that point, one can spot the differences. Ten years ago, I hadn’t to learn two whole new syllabaries to write that down in English. (@_@) This has the interesting effect that understanding spoken Japanese is actually easier than reading and understanding the subtitles.

Ok, „understanding” spoken Japanese is exaggerated. Last friday, I watched „My Neighbour Totoro” in Japanese with German subtitles (it’s an old Studio Ghibli movie for children, actually), and while the language of it is relatively simple, I sat there and every minute or so I was happy to hear, somewhere in a sentence, a word I actally knew: ‘yesterday’, ‘thank you’, ‘hospital’, ‘university’ and similar.

I’ll watch that movie after every semester from now on, hoping to see some progress!

Another strange fact: Not only my friend and myself, but about half of the other attendees seemed to be informatics students. (^_^;) Coincidence? I think not.

And what would informatics students try when they learn a new writing system? They try to type it on their beloved keyboard! So did I. But switching to Japanese input methods turned out to be much harder than expected (read „I didn’t get it to work at all ”).

I found a viable alternative (which also serves as a nice segueway to get a tech topic in this post after all): A nice vim snippet you can put in your .vimrc to enable toggling your usual keymap with the kana keymap by pressing F3:

" switch between kana and normal keymap
let b:keymap_kana_switcher=0
function! ToggleKeymap()
    if b:keymap_kana_switcher==0
        set keymap=kana
        let b:keymap_kana_switcher=1
    else
        set keymap=
        let b:keymap_kana_switcher=0
    endif
endfunction

nnoremap <F3> :call ToggleKeymap()<CR>

As you might see, this is self-written, and I have no idea how to properly write vim scripts, but hey, it works! \(^_^)/ With the kana keymap, you just write the phonetical transformation of the kanas, and depending on your shift key, it’ll make hiragana or katakana out of what you typed.

Of course, this only works inside vim, but text input of any kind without vim? Who uses that? (ô_ó)

And here, I present you my closing word as a final unicode test for your browser: さようなら。

tmux - a terminal multiplexer

2013-01-16T18:17:00+01:00

Desktop terminal emulators usually have the feature of tabbed terminals. tmux does something similar on the server side, it’s a terminal “window manager” where you can create and close new windows, and especially leave them open and running when you disconnect from the server.

You should try to work inside a tmux window on the server, so when you get interrupted, you can always just detach the window and log off while e.g. upgrades, compiles, backups or other long-lasting operations still keep running.

More than once I damned myself for not starting something inside tmux, so I needed to leave my laptop online for the whole night doing nothing, just to keep the ssh session running. xD

But when you just run tmux without configuring it, you can’t scroll up with your terminal emulator’s scrollbar, which I find really annoying. The following fixes this:

# Create or edit the tmux configuration file at ~/.tmux.conf
vim ~/.tmux.conf
# and enter:

# Sane scrolling
# alternatively scroll inside tmux with CTRL+B [
set -g terminal-overrides 'xterm*:smcup@:rmcup@'

Psst! In case you’re a fan of solarized, there’s a tmux color scheme for it: https://github.com/seebi/tmux-colors-solarized/ But beware of problems with colors in tmux over ssh, I never managed to really convince tmux to use 16 colors for true solarized instead of 8 or 256.

Now to the minimum tmux commands one needs to know to work inside tmux:

# start a new tmux session with a single window
tmux
# tmux is controled via single key commands entered after you pressed CTRL+B
# create a new window
CTRL+B C
# switch to next window
CTRL+B N
# switch to previous window
CTRL+B P
# close a window (no CTRL+B in front, just like you'd close a virtual terminal)
# By closing the last window, you'll close the tmux session, too.
CTRL+D

# If you want to keep your windows open and running, "detach" your session with
CTRL+B D
# You can now savely disconnect from your server.
# Reattach your last tmux session with
tmux attach
# just entering "tmux" without "attach" will create a new session.
# Closing it with CTRL+D and then entering "tmux attach"
# will bring back your old session

tmux also supports named sessions and windows. I used named sessions for a while to have the irssi irc client always running on my server and then attached the specific irssi session from my laptop, but I’m much happier now with ZNC.

The above commands should be enough to use tmux for administration tasks, but tmux is much more powerfull than that - some of that power might come in handy for whatever you want to have running on your server.

How to set up ZNC, an advanced IRC Bouncer

2012-12-18T23:31:00+01:00

Well, an IRC bouncer is similar to a web proxy - all your requests and answers are transmitted via your server in the middle. For IRC, that means that the bouncer is connected to your IRC networks all day instead of you.

It opens a port for your IRC clients to connect (the bouncer just acts like a real IRC server) but it’ll replay all the queries and messages from your channels.

I used to have irssi (a popular terminal-based IRC client) running on my server in bouncer mode and another irssi on my computers, but a week ago I couldn’t bear with this setup any more. (ok, actually, it broke because of perl updates in Chakra).

All that old perl plugins you had to have to extend irssi in a way to make it usable as a bouncer.. all that old perl plugins you had to have to make irssi usable at _all_.. Well, I liked the full keyboard interface, but you even need a plugin to show named channel windows. Really? Come on!

So I looked through the wikipedia list of IRC bouncers, and the only one that was actually packaged for debian squeeze was ZNC, which turned out to be great. (of course, after all that perl in irssi, python support convinced me ;) ).

Here’s my setup:

su
aptitude install znc
^D
# do this as your personal user
# this will start a configuration wizard
# you'll need to create a separate user for each irc network you're on
# hint for generating random passwords:
# genpw <length>
# activate usefull modules like chansaver, nickserv and simple_away
znc --makeconf
# starts znc as a backgound job of your private user.
znc
# znc doesn't get restarted on boot or after crashes, one way around this is a cronjob trying to start znc every 10 minutes.
# Nothing harmfull will be done if it's already running. If you don't like that, consider running znc as system daemon: http://wiki.znc.in/Running_ZNC_as_a_system_daemon
crontab -e
# add the line
# */10 * * * *   /usr/bin/znc >/dev/null 2>&1

Short and sweet, huh?

Then it’s time to connect your local IRC client: The server’s password is the “username:password” combination you created with the makeconf script.

After that, the only thing left to do is to tell the nickserv plugin about your password for auto-identify with your IRC network’s nickserv, and to set your away message. Per default, you’ll be away one minute after every client disconnected, as well as you’ll be back again if a client is connected for a minute.

/msg *nickserv set <passwort>
/msg *simple_away Reason Hi there, raignarok's server speaking. He's disconnected, but I'm recording for him what you're saying.

As you can see, you’re controlling ZNC over special users prefixed with a ‘*’, the general user for ZNC is “*status” and additionally, every module has it’s own user. “/msg *<user> help” prints the lists of available options and commands.

That’s it for this month, but at least it’s something at all after I skipped November. Happy idling, and see you on freenode!

tent.io, a new hope for open & federated social networking?

2012-10-14T19:11:00+02:00

Last week, Jan Wildeboer posted something that caught my attention:

Let’s try to connect tent.is to my G+ stream. Do you know tent.is? It’s decentralized. Open. Check it out. I am jwildeboer.tent.is for the moment and will run it on my own server soon.

Huh, what? tent.is? At that time, I never heard of it, despite the project existed for a few months already. As I then found out, tent.is is only the first microblogging app for tent.io, the part which is actually important.

Well, the facts are that tent.io is a decentralized, federated and open protocol for social networking and tent.is is a tent.io app providing a microblogging service over the tent.io protocol. But didn’t we heard that many times in the past? All those federated social networks, status.net, Diaspora*, friendica, and what else might be lurking somewhere on the internet, don’t they already do this?

That’s right to some degree, but tent.io is something else. Actually, it’s the only federated social network out there which has the potential to really fulfill what I expect from a social network. To make it clear why tent.io has this potential to be great, I’ll first point out the flaws of Diaspora and status.net, the biggest federated social networks existing and the networks I’m still using today.

Diaspora*

In April 2010, Diaspora*, of great kickstarter fame, actually was the new hope for many to be “the new facebook”, at least the facebook for tech people. In August 2012, the founders abandoned, ahem, handed over the project to the community, to create something like a bad meme generator called makr.io to unleash the creativity of their users. Or something similar.

On the one hand, this could be the death of the project in case there’s no one in the community who will step up, write code and make decisions.

On the other hand, as mean as it sounds, but when you look at makr.io, couldn’t it be good that they’re gone?

As great as Diaspora* looked in the beginning, there are three main problems it currently faces.

The first is that they never managed to create a working native client for any platform at all. Many people say a web interface is enough, but at least I still insist on a real native app for my phone and my computer.

But it’s not only that they never finished a documented protocol on how a client could connect to Diaspora. The second problem is that they never managed to document and to finalize the protocol Diaspora pods use for server to server communication either. Therefore, in theory, nobody could write something like a gateway between Diaspora and for example status.net. Right? But wasn’t that the promise of federated networking? That I could talk to status.net users from Diaspora?

Well, friendica actually implemented the protocol in php, despite it could have changed at any given time, wasn’t documented at all and a complete redesign of the protocol was actually announced. But so far, that never happened and the friendica implementation works astonishingly well.

That’s the third problem: From an external (->my) point of view, the development of Diaspora has stalled. The last noticeable change was in February 2012, they added an “artistic view” of your posts, with one single central post per page, the posted image in the background, and comments and likes somewhere at the bottom. To unleash creativity and give the users artistic expression in their posts. From the current viewpoint, after makr.io was released, this has to be seen as the first sign of them leaving.

Maybe the community will actually take up the development of Diaspora. But creating and specifying protocols for server to server and and client to server communication is a huge task and much more challenging than sending in patches for bugs and cleaning up code. That needs a vision, and the courage and time to implement them. Now after the complete core team does something else, I don’t expect that to happen anymore. I was a big fan of Diaspora from the start, but today, I’m disillusioned and disappointed with the development.

Status.net

Status.net stepped up to be a drop-in replacement for twitter, to be fully api-compatible. “A twitter client only needs to change the url from twitter.com to identi.ca or whatever status.net provider the user has an account for”, that’s the promise of status.net. And that’s exactly what they fulfilled. I fail to understand how people complaining over twitter can deny that.

You can argue about the quality of the web interface, but because of the api-compability, most open source twitter clients can be used for status.net, too - no need for the web interface. Maybe that’s the reason why status.net seems to be the most widely used federated network in the open source community.

Because it’s written in php it’s not that hard to setup your own server, there’s a twitter gateway plugin to enable you to send and receive messages from twitter, and the protocols are documented. What else could one demand, except more users?

From the development side, status.net has reached it’s goals. The last fundamental change in status.net was the redesign of the web interface, which went along with the introduction of polls and bookmarks. Nothing left to do than this, as fundemantally new features would break the twiter compatibility. (üAThis was the time when I needed to leave the !linux group, because the “Which distro do you use?”-Pollspam was unbearable.) Status.net is essentially finished.

The problem of status.net isn’t something the code can handle. For many, it’s about the community, it’s just that it has to few users. And even large parts of the open source community are moving to Google+ lately, it seems like Fabian Scherschel set a trend in that regard. For me, microblogging feels limiting, too, 140characters are usualy about the half of the shortest posts I want to made, and I end up crippling words and punctuation to make it fit in. In that regard, Diaspora (and Google+, as in the past, they were not that different) are a lot easier for me.

tent.io

In my opinion, tent.io has the potential to be the open source, open and federated pendant to the recenctly hyped app.net. tent.io is nothing more than a protocol for client to server and server to server communication for decentralized and federated social data. In the protocol, a post can currently be of the type status message (256characters, finally enough for me yay), essay (the equivalent to a diaspora/g+ post), image or image album. Groups and moving between servers is already specified.

That’s the complete opposite of Diaspora - they first implemented their network and then wanted to specify the protocol later. tent.io does it the way it should be, design a protocol and have a reference implementation for each part. The server reference implementation is called tentd, and the client reference implementation is the web-based tent.is, essentially a twitter clone supporting only status posts at the moment. Noticed something? The server and the web interface are decoupled, instead of being meld together in one big thing like with Diaspora or status.net.

The default web interface for tent.io is just an application. The client to server protocol is in there and used from the beginning. Even the account settings and oauth approval page is just an app called tent-admin and in no way bundled with the tentd server. Now isn’t that great a great design?

Conclusion

The beauty of tent.io is that it’s really just a general protocol that can be used to build social networks in which all users can communicate with each other. After a few months of development, tent.io managed to be more in this regard than Diaspora ever was. It’s what I hoped to happen with Diaspora, but what I don’t believe that will happen anymore.

I hope that one day, I can use tent.io to send and receive posts from and to status.net and Google+, the networks that matter to me most. I hope that there’ll be gateways between tent.io and these networks, similar to jabber-icq gateways. I hope that there’ll be tent.io clients for every platform that I use. I hope that I can provide tent.io accounts on my server for my close friends, like I do with jabber.

That’s why I’ll invest time & energy in tent.io.

To come to an end (by the way, thanks for actually reading this huge post ;) ): As long as I don’t have my own tentd running, I’m https://florianjacob.tent.is. Freetards, unite!

How to sync your N9 with your ownCloud calendars and adress books

2012-09-14T13:37:00+02:00

Update: Wassili tried this in May 2014 with SyncEvolution 1.3 against ownCloud 6.0 and found out that the shell commands changed a little since I wrote this guide back in 2012. With his hints, I tried it myself again and updated the article accordingly. Thanks alot for sharing your results!

This post reformats and enhances the knowledge that N770-Freak shared at talk.maemo.org, and is mostly some documentation for myself what I actually did to get the synchronization to work. Thanks for making me able to sync my phone again! ;)

(For N900 users: Thomas Tanghus wrote a guide on how to sync the N900 with your ownCloud and SyncEvolution.)

Syncing the N9 with ownCloud wasn’t possible until Ovek managed to package syncevolution with CalDAV / CardDAV support at http://people.debian.org/~ovek/harmattan/. Great to see that people are still working on stuff for the N9, but again it shows that a Maemo-Extras equivalent for the N9 is really missing. :/ (Update: Two years later, we got https://openrepos.net/ for exactly this, a great place to revive your N9 with some new or updated apps!)

This guide is written for the syncevolution_1.3-1_armel.deb package from that page and ownCloud 6.0.3, but reported to still work with ownCloud 8.1.1 (thanks to Sean).

If you don’t feel very lucky, you should create a backup of your calendar and addressbook data, both of your ownCloud and your N9. For me, it was a struggle to get both databases really in sync, I had both doubled contacts and corrupted data.

Update: Wassili found out that with syncevolution 1.3, if your ownCloud calendar already contains events, there are problems with the initial sync (with —sync slow). The calendar entries that already existed in ownCloud will be transfered to the N9, but for some reason, they won’t be displayed in the calendar app.

Creating a new, empty calendar to sync in ownCloud in beforehand and import your data after the intial sync works, though, so to be safe, set up the sync with empty calendars first and import the data after the initial sync worked.

fundament

All of these commands are a single line, the line wraps are not on purpose. If you have developer mode activated on your N9, you can enter all of this conveniently over ssh.

Hint: Michael pointed out that all paths and names are case-sensitive, like it’s usually the case on Linux. Additionally, the syncevolution —print-databases command can come in handy for troubleshooting.

# For some reason, downloading the package with the N9 browser and installing it
# from the downloads menu didn't work for me.
# So I installed the package on the terminal, too:
# (default password is rootme)
devel-su
wget http://people.debian.org/~ovek/harmattan/syncevolution_1.3-1_armel.deb
dpkg -i syncevolution_1.3-1_armel.deb
exit

# Fill in your ownCloud logindata and ownCloud url here.
# It should be of the form http[s]://sub.domain.tld
# or http[s]://domain.tdl/owncloud if you have ownCloud installed in a subdirectory.
# @owncloud is the local configuration identifier for SyncEvolution.
# You can name the configuration anyway you like.
syncevolution --configure --template WebDAV username=<username> password=<password> target-config@owncloud

CalDAV sync:

# mycalendar is the identifier for this caldav sync.
# Again, name it anyway you like or just stay with mycalendar.
syncevolution --configure database=<owncloudurl>/remote.php/caldav/calendars/<username>/<calendarname>/ backend=caldav target-config@owncloud mycalendar
# If you are using ssl access with a selfsigned certificate, you'll have to add the SSLVerifyServer=0 option to deactivate certificate checks:
syncevolution --configure database=<owncloudurl>/remote.php/caldav/calendars/<username>/<calendarname>/ backend=caldav SSLVerifyServer=0 target-config@owncloud mycalendar

# Don't enter any credentials here! username/password must be empty.
# owncloud is the SyncEvolution configuration identifier again.
syncevolution --configure --template SyncEvolution_Client sync=none syncURL=local://@owncloud username= password= owncloud

# N9calendar should be replaced with the calendarname of your local N9 calendar,
# leave it empty to use the default calendar.
syncevolution --configure sync=two-way backend=calendar database=N9calendar owncloud mycalendar

# For the first sync, sync with:
syncevolution --sync slow owncloud mycalendar
# If you run into problems with inconsistent databases, you can try
# other (more destructive! you made that backup, right?) sync methods:
# --sync [refresh-from-local, refresh-from-remote, one-way-from-local, one-way-from-remote]

# Later on this is enough to start the synchronization:
syncevolution owncloud mycalendar

CardDAV sync:

# myaddressbook is the identifier for this carddav sync.
# Again, name it anyway you like or just stay with myaddressbook.
syncevolution --configure database=<owncloudurl>/remote.php/carddav/addressbooks/<username>/<addressbookname>/ backend=carddav target-config@owncloud myaddressbook
# Again, if you are using ssl access with a selfsigned certificate, you'll have to add the SSLVerifyServer=0 option to deactivate certificate checks:
syncevolution --configure database=<owncloudurl>/remote.php/carddav/addressbooks/<username>/<addressbookname>/ backend=carddav SSLVerifyServer=0 target-config@owncloud myaddressbook

# This one command can be skipped if done already for caldav sync:
# Don't enter any credentials here! username/password must be empty.
# owncloud is the SyncEvolution configuration identifier again.
syncevolution --configure --template SyncEvolution_Client sync=none syncURL=local://@owncloud username= password= owncloud

syncevolution --configure sync=two-way backend=addressbook database= owncloud myaddressbook

# For the first sync, sync with:
syncevolution --sync slow owncloud myaddressbook
# If you run into problems with inconsistent databases, you can try
# other (more destructive! you made that backup, right?) sync methods:
# --sync [refresh-from-local, refresh-from-remote, one-way-from-local, one-way-from-remote]

# Later on this is enough to start the synchronization:
syncevolution owncloud myaddressbook

Making synchronization more easy

I set up any GUI stuff for syncevolution. There’s a GUI for starting syncs floating around in the web, but the configuration part has to be done on the command line anyway. As I don’t sync that often, I only made a script name sync.sh in the MyDocs-directory containing

syncevolution owncloud mycalendar
syncevolution owncloud myaddressbook

and then I fire up finger term, enter “./sync.sh” and watch for progress and problems. ;) Good luck!

First things first: Setting up your working environment

2012-08-14T18:17:00+02:00

This is the first post of my emerging server guide. The guide will show you how to reproduce my server setup, what decisions I made and why I made them (in case it’s not just based on personal taste, or, well, maybe even then ;) ). This should serve as a reference for you, just because it seemed right for me doesn’t mean it’s right for you, too. Don’t shut down your brain when following this. Read my comments, and the comments in the config files. Still, this guide is written for, well, maybe not Linux beginners but for beginners starting to be intermediates on the command line, who see themselves confronted with managing a system solely by the command line. If you don’t understand something, read about it on the web! For basic stuff, I’ll only tell you what to do, but in case commands or terms I use are new to you, stop reading and learn about them. Try to understand what you actually do there, if you don’t you’ll end up wit a system you can’t handle. Chances are you’ll get hacked and held accountable for all that spam sent out from your server. You’re warned.

Before you get any service running, you need a solid foundation to work with. This entry covers the basics of how to set up your working environment on the server, and some tricks & hints to ease your future work.

Let’s assume you just installed Debian Squeeze on your server machine or just got the root password from your provider and logged in.. Do you feel the power? ;) First thing is to make sure the door you just entered through gets closed, so no one can follow you.

# Change your root password! And make sure you remember it,
# resetting the root password is unnecessary work. You've better things to do!
passwd

# Change the sources.list at the bottom to include squeeze-backports (for a newer tmux version)
vi /etc/apt/sources.list
=>
# backports for tmux
deb http://backports.debian.org/debian-backports squeeze-backports main
=>
# Debian Squeeze is quite old now. (Maybe not in Debian scales..)
# A lot of security holes in the shipped software got fixed by then,
# so upgrading will take time, but still, as always, get all upgrades immediately.
aptitude update
aptitude upgrade

Well, so far it was trivial. Next step is to install the tools you need.

vim: Well, my favourite editor. If you never used any editor on the terminal, you might want to give nano or pico a try, and read http://www.rudism.com/s/vimcreep .
zsh (seperate post): My favourite shell. If you just used bash (the standard shell) so far, just follow what I write here and you’ll end up with a shell with amazing autocompletion features.
git: Last point in the favourites line-up, git is the distributed version control system I use most. etckeeper works with mercurial and bazaar, too, so you can install whatever you like.
htop: This is the terminal equivalent of your graphical process monitor on your desktop. Start it up, and you’ll see the cpu and memory usage of the machine and all running processes sorted by their cpu usage.
tmux (seperate post): Desktop terminal emulators usually have the feature of tabbed terminals. tmux does something similar on the server side, it’s a terminal window manager where you can create, switch and close windows, and especially leave them open and running when you disconnect from the server. You should try to work inside a tmux window on the server, so when you get interrupted, you can always just detach the window and log off while e.g. upgrades, compiles, backups or other long-lasting operations still keep running.
etckeeper (seperate post): etckeeper is a tool to get all of your config files beneath /etc under a version control repository. If you use it from the beginning, you can always get back to any revision of your config files in case something goes wrong, and it even creates an automatic revision if you install something with aptitude.

Oh, and by the way, I like to make notes on paper or in a text file to record what and how I configure a server (actually I do that for desktop / laptop installations, too) to keep track of the problems I ran into and how one can solve them. Very handy if you have to reproduce your setup after a fresh install, and as you might have guessed now, this guide is actually based on the notes I made for the latest server. ;)

From now on, when I put something in <pointy brackets>, that’s the stuff you have to replace with your own parameters.

# Install your favourite tools to work  with the server
aptitude install vim zsh git htop etckeeper
aptitude -t squeeze-backports install tmux
# One shouldn't be logged in and work as root if one doesn't need to. Create a normal user for yourself, later we'll even forbid root logins.
adduser <username>
logout

# reconnect as the newly-created user
ssh <username>@<host>
# Now we start to secure the ssh daemon. Open the sshd config file:
su
vim /etc/ssh/sshd_config
# Find the line saying PermitRootLogin Yes, and change it to
PermitRootLogin No
# For now, you should use your own random port for ssh, choose a number between 10000 and 65000
# You can leave it at 22 though, in case you want to use ss(l)h later on. (will be a separate post again. ;) )
Port <port>
# Close your editor again, and restart the ssh server. Hope that everything you entered was right.
service ssh restart

# You installed etckeeper already. We just made the first change to a config file in etc, so we
# commit the changes and create a new revision.
# There'll be a seperate post on that, too.
git add /etc/ssh
git commit -m "Changed ssh port and prohibited root login."
logout


# On your local machine again, you can create a config file for ssh.
# This will enable auto completion for ssh hosts on zsh,
# and ssh <hostname> will be enough to connect in the future.
vim ~/.ssh/config
# Add these lines
Host <host>
    User <username>
    Port <port>
# and close the editor again

ssh public private key authentication

Especially when using Port 22 as the ssh port for your machine, you’ll notice automatic bots hammering against your ssh login soon.

This should make you aware that everybody who can guess your username and your password owns your machine. There’s a much more secure alternative to logging in with passwords, ssh supports logging in with public private key pairs, the very same concept used with PGP etc.

Combined with an ssh-agent, this has the advantage of not needing to type a password anymore for logging in to your remote machines, so go for it! ;)

# Generate a new rsa key pair in ~/.ssh/
# id_rsa is your private key. If you don't enter a passphrase while generating the key,
# everybody who has this key file can login to every server you allowed it to. No passphrase
# makes sense for automatic login in scripts, but for your personal use, you should enter one.
# id_rsa.pub is your public key file, this can be safely shared with anybody.
ssh-keygen -t rsa

# This copies your public key file as an authorized key to the specified machine. Afterwards,
# you can log in using the private key.
ssh-copy-id -i ~/.ssh/id_rsa.pub <username>@<host>

# Try to log in, you should be asked to enter the passphrase for your key instead of the password.
ssh <username>@<host>
logout

Now to the ssh-agent. If you are a KDE user like me, you can install ksshaskpass to get that integrated into KWallet. Create the file ~/.kde4/Autostart/ksshaskpass and enter the following in there:

#!/bin/sh

export SSH_ASKPASS=/usr/bin/ksshaskpass
ssh-add </dev/null

And you’re done! Next time you log in to your local machine, the usualy KWallet authorization dialogue should pop up, and after you entered your passphrase next time you log in to your remote server, it’ll never ask again. :)

# console tip:
# You can find out the absolute path of any binary, e.g. ksshaskpass, with
which ksshaskpass

Concerning other desktop environments or the usage of ssh-agent without any additional program - I know it does work, (e.g. there’s gnome-ssh-askpass, I guess this does the same as ksshaskpass but for the gnome keyring) but I have no idea how.

The places your search engine of least distrust will take you will have much better explanations to this than everything I can provide. Good luck!

Why I chose Debian

The biggest advantage of Debian for personal servers is that nearly everyone uses Debian for their servers, so most documentation and tutorials are written for Debian / Ubuntu Server in mind, especially if you want to set up a service on a single, small server with very moderate usage. (For a high-traffic failover server cluster, CentOS or whatever might be better suited.)

But while I appreciate Canonical’s plans to get out on phones and TVs, I’m not a big fan of Ubuntu, so I chose Debian. ;)

One year ago I was tired of the old software you get with debian stable and updated to testing, but then I learned why you actually want to have a stable distribution for your server: Your setup doesn’t break with updates. No new features being added to the installed software, no new versions but only security fixes in the repositories means that your setup which works now will almost definitely work after the update, too, and you only have the hassle of updating once in about two years, when a new Debian gets to stable.

And in case you need newer software than provided with Debian stable, there might be an official backport and many projects have their own repository for debian where they ship the latest stable version.

Why I use aptitude and not apt-get & apt-cache

Mainly because I prefer to have one command for searching, installing and managing packages. :D But as far as I know, aptitude has its own database for dependencies between your installed packages and is able to purge a dependency when there’s no program installed anymore that pulled in the dependency. That database is the reason why you should choose betwen apt-get and aptitude and then stay with your choice, too.

Debian mailing lists

As soon as you running a Debian server, you should subscribe to the debian-announce and debian-security-announce mailing list to get announcement mails for new debian releases and security fixes.

http://lists.debian.org/debian-announce/

http://lists.debian.org/debian-security-announce/

Next post will be a shorter one about tmux. I hope to get this out, soon. :) :wq

Hallo Welt

2012-07-14T23:46:00+02:00

Well, I’m Florian Jacob, an avid Linux user and free software enthusiast in general. Let’s see what I’ll actually end up posting about - I won’t promise to write about any (tech?) topics in specific, but as I’m up to reconfigure my virtual private server from scratch, so I guess the next posts will be on how to self-host your own website, jabber & mail server, ownCloud instance and similar kind of stuff.

I strive to get a replacement for all that services one usually gets from whatever service provider or “the cloud” these days running on my own server. Later on my own hardware, if I can afford it. I’ll report the troubles I run in, and write guides on how to set up those services. So if in the end no one will actually read this blog, at least I sat down and documented why and how I did everything, as I’m sure I won’t remember anything when the server setup needs to be fixed in the future. ;)

Other topics I hope to write about include the great ownCloud project (maybe writing that sentence makes me contributing to the project more often again, I didn’t do anything in the last months I have to admit. :/ ), (game-) programming, and maybe even some gardening or tales from the newly-created pen&paper role playing group I set up with my fellow students a few days ago. Let’s see. :)

Florian Jacob :wq

florianjacob.de_

Switching to letsencrypt: Experiences with the closed beta program

Experiences

The future?

Conclusion

How to rewrite and forward .*/index.html to .*/ with nginx and Apache

nginx

Apache

SSH Tips & Tricks: On killing & multiplexing Sessions, and checking Host Keys

Kill a hung SSH Sessions without closing the Terminal

Check your SSH Fingerprints with ease using VisualHostKeys

Multiplex SSH Sessions for more Performance

CAcert certificates everywhere!

DNSSEC / DANE

How to tunnel IPv4 internet through tinc

Choosing an IPv4 Subnet

Configuration

Entry Node Configuration

Peer Node Configuration

NAT on the entry node

Tunnel in Operation

Enabling the Tunnel

Disabling the Tunnel

Next Steps

Other Options

4in6

NAT64

Brace your bonsai, winter is there!

How to set up a small tinc VPN using IPv6 payloads over IPv4 and iproute2

Choosing an IPv6 Subnet

Entry Node Configuration

Peer Node Configuration

Enable your tinc VPN on system startup

Interconnecting tinc networks

New Language Feeds

lavabit.com has shut down, wolkenplanet.de has started up

TL;DR

How I found lavabit

What has happened

Research

One upside

I now have my own mail server running at wolkenplanet.de

Recommending posteo

Final thoughts

Learning Japanese: Second Semester

mezamashi - めざまし

A Terminal Alarm Clock written in Python

The Name

End of Semester - alaCarte released

What is alaCarte?

Learning Japanese: First Semester

tmux - a terminal multiplexer

How to set up ZNC, an advanced IRC Bouncer

tent.io, a new hope for open & federated social networking?

Diaspora*

Status.net

tent.io

Conclusion

How to sync your N9 with your ownCloud calendars and adress books

fundament

CalDAV sync:

CardDAV sync:

Making synchronization more easy

First things first: Setting up your working environment

ssh public private key authentication

Why I chose Debian

Why I use aptitude and not apt-get & apt-cache

Debian mailing lists

Hallo Welt

How to rewrite and forward ./index.html to ./ with nginx and Apache