# LinuxPizza

Personal notes and occasional posts

## Run a Tor-Relay on Tribblix – an Illumos retro distribution

### This fall, has been busy for me, and when I am busy I like to experiment and play with stuff – especially IT and nerdy stuff.

This brings me back to the days when I started with Linux, for me it was new, cool and different. Nowadays I feel likeit is not so different.

So, being the hipster that I am, I set out to find something new. I've already tried and played with OmniOS a couple of years back and I liked it. And during my quest to get it on a iPXE server – I found out about Tribblix.

Tribblix is a Illumos distribution with a retro feel. And that I liked. The iPXE setup was easy since Peter Tribble – the creator and maintainer of Tribblix – already have an iPXE server up and running. So I just used the already ready target at (http://pkgs.tribblix.org/m24/ipxe.txt) and got it up and running according to the installation instructions provided by Tribblix here: http://www.tribblix.org/install.html

Enter Tor – and the recent news that Russia has decided to block Tor nationwide. I must say that I do understand why they did it from a IT-security perspective – alot of crap is originating from Russia. That is an undisputed fact. However, from a freedom perspective – this is making an already bad situation even worse. So what a perfect opporunity to run a Tor-relay on a SunOS machine! Currently, there is only 5 relays that is running on a Solaris/SunOS based kernel (including one of mine). Lets change that – more diversity in the Tor-network is a good thing.

So, assuming that you have installed Tribblix. Lets pull down the Tribblix overlay called “develop”

zap install develop


This takes a couple of minutes, and what it does is that it download and installs all the nessecary packages you need to build Tor.

We also need LibEvent, since Tor requires it. And the TRIBlibev is like libevent – but not really – we need to manually compile it.

Download the latest stable version from github, and extract it like shown below:

wget https://github.com/libevent/libevent/releases/download/release-2.1.12-stable/libevent-2.1.12-stable.tar.gz
tar -xvf libevent-2.1.12-stable.tar.gz


Lets also pull down the Tor-source code and extract:

wget https://dist.torproject.org/tor-0.4.6.9.tar.gz
tar -xvf tor-0.4.6.9.tar.gz


Great, now you should have everything you need in order to get started.

Navigate to the libevent catalogue you just extracted, and run the following:

./configure --prefix=/tmp/mc --enable-static --disable-shared
gmake
gmake install


This will create a static and temporary copy of LibEvent in the /tmp/mc catalogue. we will use that in the compilation of Tor.

When the compilation of LibEvent is done, nagivate to the Tor-catalogue and run the following:

./configure --with-libevent-dir=/tmp/mc MAKE="gmake"
gmake
gmake install


The proceedure is quite similar to the LibEvent compilation.

When the gmake install procedure is done, you can find the tor-config files in /usr/local/etc/tor/ and the binaries in /usr/local/bin/.

Configure the torrc file according to your needs, read the Tor Projects Post Install Guide and follow the recommendations.

You can now run tor by just typing /usr/local/bin/tor in your terminal – and you now have a relay running.

For now, you can use tmux in order to run it in the background.

Thanks to Peter Tribble, who told me how to get LibEvent into the system.

## Creating a PV and PVC on NFS for K8s

Took myself ages to figure this out, so I am noting this down for my future self.

#### First, we need to add NFS as a storage class:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: managed-nfs-storage
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner # or choose another name, must match deployment's env PROVISIONER_NAME'
parameters:
archiveOnDelete: "false"


#### Then, we can add the actual storage:

kind: PersistentVolume
apiVersion: v1
metadata:
name: nfs-persistentvolume
spec:
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
storageClassName: "nfs" # Empty string must be explicitly set otherwise default StorageClass will be set / or custom storageClassName name
nfs:
path: "/path/to/share"
server: "xxx.xxx.xxx.xxx"
readOnly: false
claimRef:
name: nfs-persistentvolumeclaim
namespace: default
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nfs-persistentvolumeclaim
namespace: default
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: "nfs" # Empty string must be explicitly set otherwise default StorageClass will be set / or custom storageClassName name
volumeName: nfs-persistentvolume



Hope this helps

## Bonus – run a Minecraft Bedrock inside K8S using your newly created PVC as storage

apiVersion: apps/v1
kind: Deployment
metadata:
name: mc-bedrock
labels:
app: mc-bedrock
spec:
replicas: 1
template:
metadata:
name: mc-bedrock
labels:
app: mc-bedrock
spec:
containers:
- name: mc-bedrock
image: itzg/minecraft-bedrock-server
imagePullPolicy: Always
resources:
requests:
cpu: 500m
memory: 4Gi
env:
- name: EULA
value: "TRUE"
- name: GAMEMODE
value: survival
- name: DIFFICULTY
value: normal
- name: WHITE_LIST
value: "false"
- name: ONLINE_MODE
value: "true"
- name: ALLOW_CHEATS
value: "true"
volumeMounts:
- mountPath: /data
name: data
volumes:
- name: data
persistentVolumeClaim:
claimName: nfs-persistentvolumeclaim
selector:
matchLabels:
app: mc-bedrock
---
apiVersion: v1
kind: Service
metadata:
name: mc-bedrock
labels:
app: mc-bedrock
spec:
selector:
app: mc-bedrock
ports:
- port: 19132
protocol: UDP
type: LoadBalancer


#### Get the IP assigned for the service

kubectl get service mc-bedrock -o jsonpath='{.status.loadBalancer.ingress[0].ip}'


#### Restart the pods in the deployment

kubectl logs -f deployment/mc-bedrock


## Changing bus-type on a Nutanix AHV Virtual Machine

In some cases – especielly with older systems – you might not be able to run your VM with a SCSI-drive since the drivers is missing from the system.

This was the case for me when I wanted to move a older VM (Debian 5) into Nutanix AHV from ESXi.

In order to mitigate this, you have to change the bus-type of the drive from SCSI to IDE or PCI:

Login to you CVM via SSH, and execute the following

acli vm.get NameOfTheVM


You will see some output similar to the following:

NameOfTheVM {
can_clear_removed_from_host_uuid: True
config {
affinity {
...

host_uuid: "d17a25a0-6a8a-4b30-993d-323f824eb383"
logical_timestamp: 83
state: "kOn"
uuid: "5ea5288b-d3fb-40d9-83ce-9356db75129b"


Look for disk list and vmdisk_uuid: similar to the following:

    disk_list {
addr {
bus: "scsi"
index: 0
}
container_id: 1416
container_uuid: "f20a220c-f237-43eb-9465-200f17a3306e"
device_uuid: "53d01e6b-43bf-41dd-a8c5-c82cd3f673cb"
naa_id: "naa.6506b8d135b478f0803c4c2944a37187"
source_nfs_path: "/ntnx01-container01/xtract-vm//349a1ace-f328-40df-867e-6                                                                c7f0d46ac7f/500a3a5a-741b-6de2-7ca3-4927a3c621e1/2000_NameOfTheVM.vmdk"
vmdisk_size: 107374182400
vmdisk_uuid: "315bb83c-7629-401a-a522-b350a3387dca"
}


The procedure here is simple, we will just create a new disk as a clone of an existing disk, using the vmdisk_uuid:

acli vm.disk_create NameOFTheVM clone_from_vmdisk=01f68633-06ab-4fe7-b819-90fec3e8d08a bus=pci


This create and attaches a disk to the VM NameOfTheVM, change the UUID to the one you have. To create a disk with the bus ide, change pci to ide.

Done!

## Change password of an existing SASL user

First, list the users that you have in your system:

sasldblistusers2
selea@mailserver.linux.pizza: userPassword
pizza@localhost: userPassword


Next, change the password of the specific user you want to change:

saslpasswd2 pizza@localhost
Password:
Again (for verification):


That's it!

#### If you want to create a new user

saslpasswd2 -c -u domain.tld smtprelay


You can also test a SASL-user with the following:

testsaslauthd -u smtprelay -r domain.tld -p PASSWORD


## Opting out of Google's New tracking Method – FLoC

Luckily, this is quite easy – for now.

Just add the “Permissions-Policy: interest-cohort=()” header in your webserver. This can be done as following:

In Apache (including .htaccess):

   Header always set Permissions-Policy: interest-cohort=()


In Nginx

   add_header Permissions-Policy: interest-cohort=()


That's it!

## Pickled Jalapenos

### What you will need

• Garlic (couple of smashed cloves or powder is fine)
• 0.45 dl Sugar
• 15 ml Salt
• 3dl White Vinegar
• 3dl Water
• ~400grams of fresh Jalapeños (or other chilies)

### The procedure

I decided to slice the jalapeños together with three quite big cloves of garlic:

Then, mix water, vinegar, salt and sugar into a pot. Let the sugar and salt dissolve and wait until the mix starts to boil a little.

Then, just add the jalapeños and garlic. Let it putter for 5 minutes.

Lastly, put it into your glass-container of choice!

This should last a couple of month, and serves well with taco, pizza or if you are like me – on EVERYTHING!

Done and easy! Everyone can do this, and it works with almost anything. I also did this with unriped tomatoes, and it tasted very good too!

## Enable mod-security2 on your Apache webserver

### Installation of the Modsecurity module

The installation is very simple:

root@debian:~# apt install libapache2-mod-security2 -y


Great, now we just have to activate the module. It is currently running in “Detection Mode” which means that is will only log attempts and not perform any blocking. This can be useful for testing.

cd /etc/modsecurity/
mv modsecurity.conf-recommended modsecurity.conf
sed -i -e s/"SecRuleEngine DetectionOnly"/"SecRuleEngine On"/g modsecurity.conf


That's about it! If you want to run mod_security2 with the recommended ruleset including the ones from OWASP top 10 – you are now done! You only need to restart apache:

systemctl apache2 restart


Done! Simple and easy!

## SFTP and multiple users

Copy the sshd_config file to a separate file:

cp /etc/ssh/sshd_config /etc/ssh/sshd_vhost_config


Append the following to the file:

AllowTCPForwarding no
ChrootDirectory /path/to catalogue
ForceCommand internal-sftp

Match User user1
ChrootDirectory /path/to catalogue/user1

Match User user2
ChrootDirectory /path/to catalogue/user2
USER # ssh


Also, you can have to change the port because we will run the SFTP-server separately from the SSH service. So edit the following line:

Port 2222


Create a systemD service in /etc/systemd/system/sshvirtual.system

[Unit]
Description=OpenBSD Secure Shell server for lue
After=network.target auditd.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run

[Service]
ExecStartPre=/usr/sbin/sshd -f /etc/ssh/sshd_vhost_config -t
ExecStart=/usr/sbin/sshd -D -f /etc/ssh/sshd_vhost_config
ExecReload=/usr/sbin/sshd -f /etc/ssh/sshd_vhost_config -t

## Day 2, Bye Manjaro – Hi Debian

I am not a fan of Manjaro, and trust me – I have really tried to like it! My personal feeling is that Manjaro is messy – but that is probably because I do not like Arch Linux at all. Anyway, I was thinking about switching over to Debian instead since I am more used to it and the image has come a long way since the first version. I flashed a MicroSD card with this Debian image, booted it and downloaded this scripts that installs Debian for you on the eMMC card. The installation took 15-20 minutes for me since I am blessed with a fast and stable internet connection. I did have trouble getting into the Desktop Environment on Bullseye (Testing), so I installed Debian Buster instead and that seems to have solved it. And I am want to use it as a daily driver so a stable system is not wrong :)

## Day 3, why the (“%¤ does it take a day to charge the Pinebook?

One thing that has started to bother me, is the battery take several hours to fully charge from zero. I have given that alot of thoughts and I think the reason is that I have become used to fast-charging that exist in most modern smartphones today. The VERY BIG PLUS, is that you can charge it several way's. You can use the official ROCKPRO PSU (the one that is stuck in my outlet), you can use a USB to “power” adapter, and you can also charge it with USB-C. The latter one is a HUGE advantage and one of the biggest “cool factor” in the Pinebook. That means that I can charge the Pinebook on the go. With an ordinary Powerbank, in my car or at someone elses house even if I forgot my own PSU.

# What do I like/dislike?

### The keyboard

After a few days of typing on the machine, I have come to like the keyboard of it. It does not feel bad at all. Since it is a ISO keyboard with a physical UK layout, I can use it with a Swedish layout in Debian. Luckily, I am very used to typing so I am not noticing that the physical layout is different since I dont look at the keyboard when I type. Writing this blogpost feels great too!

### Headphone jack?

I started to watch a movie on the Pinebook with my headphones that I just plugged into the headphone jack, and suddenly all my kids came up to me and wondered what I was looking at so I took my headphones of and realized that the sounds was playing on the speakers and my headphone at the same time. I do realize that this is probably something that Debian Buster has issues with. I connected my Bluetooth headset instead and could watch in peace.

### Charging takes many hours

I wrote about that earlier, but it is worth mentioning here too. Charging the PineBook Pro does take a very long time. I have tested the charger that arrives with the machine and other supposedly “stronger” USB-chargers aswell. I think that the reason is that I have gotten used to Fast-Charging my phone and the ability to wait is something that we have lost the last few years. Anyway, the battery last 7-9 hours with normal use on Debian Buster with maximum screen brightness and “tilda” running in fullscreen with tmux with a couple of ssh-sessions – perfectly fine! Remember that you can charge it practically anywhere with almost any USB-charger whether it is a wall-plugged one, solar-driven or other powerbanks. That fact makes this machine very portable and flexible. Perfect for the trip!

# Closing words

I can compress my experience to this sentence: The more I use the PineBook Pro – The more I realize that THIS is the laptop I always wanted!

Wow, that's is pretty big words! I will try to explain why. First of all – The Pinebook Pro is the result of the hard work of the team over at Pine64. The machine have been made “as a community service” to provide a cheap, hackable and fun laptop to hackers, advanced users and pioneers on the AARCH64 platform. I really get the feeling that there is no greed for revenue unlike other companies – that is worth supporting!

The machine is not made for with planned obsolesce – the scary and sad trend that is going on with Tech-companies nowadays. You can buy every single part of this machine from the Pine64 shop so you can repair it if you need to.

The community is great! I have been hanging out in the Pinebook Pro chat on Matrix and the folks over there is very helpful and exited over the product that Pine64 has released.

Atlast, I think most of the Pinebook Pro users would love to use Manjaro ARM that is by default shipped with the machine. Manjaro has done a great job on increasing performance and stability of the builds and it does not seems to stop! I will cover more aspects of the Pinebook Pro in the future, like Multimedia performance such as video-playback, simple gaming, USB-C docking capabilites and Installation of the M2 drive.