Relative root issues with gitlab

StackOverflow sure seems to get a lot of good answers. This entry addresses an issue I've been struggling with for some time related to setting relative roots in ruby on rails applications.

I'm using some Turnkey Linux templates with ProxMox and one is gitlab, but changing the relative root I was still missing some icons when loading the gitlab pages.

According the the post above after updating the config files I needed to go into the gitlab home folder and run:

bundle exec rake assets:precompile RAILS_ENV=production RAILS_RELATIVE_URL_ROOT=/gitlab

This took several minutes to complete (that's how you know its working?) but fixed my problem.

Pacman and "exists in filesystem" errors

Every now and then I try to update and am rebuffed because some file already exists and would be overwritten.

To find out what package owns the file: pacman -Qo /path/to/file

To install anyway and overwrite the existing file(s): pacman -S --force $package

Each installed package has a folder under /var/lib/pacman/local/ with metadata about the package.

Some ProxMox commands.

I've figured out how to bulk clone VMs in Proxmox which is very useful.

qm clone $VM_ID $CLONEID -name "$NAME" -pool "$POOL"

There are several other things that are useful dealing with clusters at http://wmunguiam.blogspot.com/2013/02/remove-node-cluster-forever-on-proxmox.html

List nodes:

pvecm nodes

Remove cluster node:

pvecm delnode node_name

But this may fail if you don't have a "quorum", in which case you change the number of nodes voting:

pvecm expected 1

Then delete the node.

Reverse DNS Lookup Zone File and Whitespace

I have been struggling to get my reverse look up working on my DNS (bind) server for a LONG time... The problem I finally figured out:

$TTL 3D
@       IN      SOA     ns.linux.bogus. hostmaster.linux.bogus. (
                        199802151 ; Serial, todays date + todays serial
                        8H      ; Refresh
                        2H      ; Retry
                        4W      ; Expire
                        1D)     ; Minimum TTL
                NS      ns.linux.bogus.

; NO WHITESPACE!!!!
    1               PTR     gw.linux.bogus.
    2               PTR     ns.linux.bogus.
    3               PTR     donald.linux.bogus.
    4               PTR     mail.linux.bogus.
    5               PTR     ftp.linux.bogus.

See the spaces in front of the 1, 2, etc...? Those cannot be there for whatever reason.

Is Prism a reverse hoax?

I always figure things out before everyone else, but I never tell anyone about it. This time is going to be different.

Which is more likely:

1. Our government actually thinks they could keep a monstrous scam like Prism a secret from the masses?


2. Or the possibility that our government is willing to take a black eye PR wise in order to make bad guys *think* that they are being monitored therefore making their lives more difficult with relatively little effort?

I would actually be pretty impressed if the latter were to be the case. I'm way too cynical to believe it, but wouldn't that be great to find out that our government is actually doing all this to scam the terrorist?

This is similar to what I have heard said that Ronald Regan did to the Soviets with the Star Wars project. Made them think we were dumping tons of research into this project to the point they couldn't compete and they tore down that wall.

Here's hoping.

Restore previous version of a file from GIT repository

From the surprisingly helpful stackoverflow.com, regarding how to restore a file from GIT:

Find the last commit that affected the given path. As the file isn't in the HEAD commit, this commit must have deleted it.
git rev-list -n 1 HEAD -- <file_path>

Then checkout the version at the commit before.
git checkout <deleting_commit>^ -- <file_path>

Or in one command, if $file is the file in question.
git checkout $(git rev-list -n 1 HEAD -- "$file")^ -- "$file"

VLC Fine Speed Control shortcut keys

I'm always forgetting this. In VLC if you want to increase/decrease playback speed use + or -, but that only works in big chunks. For smaller increments use [ and ].

Generating entropy quickly

I wrote a script to generate passwords for users, but it runs very slow at times. The solution was to install rng-tools.

From http://www.101tech.net/2011/11/01/apg-automated-password-generator-runs-slow-on-centos/

# apt-get install rng-tools
# echo "rngd -r /dev/urandom -o /dev/random -t 3" >> /etc/rc.local
# rngd -r /dev/urandom -o /dev/random -t 3

EDIT:
After reading this posting by Theodore Ts'o maybe using this isn't such a great idea as it is basically a bridge to the possibly compromised RNG instruction in the Intel processor.

Bash one liner

I can't believe it took me this long to figure this out but an easy way to do one liners in bash for multiple files:

~$ for name in *.pdf; do pdftotext "$name"; done

Password considerations

A student forwarded me this article: http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/

I have long wondered why there is so much confusion over choosing strong passwords. I mean, I don't always do it, but its not that difficult to figure out. First of all I never use ridiculous garbage passwords such as "aJKEA43%@#5289sl2" that people like to use. This just means there is a book somewhere full of passwords that has to be accessible to various people.

Passwords are made of tokens. These tokens are usually thought of as characters from the alphabet, numbers, etc... The strength of passwords is usually thought of in terms of length and number of tokens possible at each position. The length makes a lot more difference, so if your passwords consist of between 6 and 10 tokens and each token can be one of 100 characters (a-z, A-Z, 0-9, !@#$^&*()_+ etc....) then the number of possible passwords in that range is 100^10 - 100^5.

However if you use dictionary words such as "wooden" this will count as only a single token and not the 6 you intend. This is because smart cracking programs will not try everything such as "..., woodel, woodem, wooden" but will use dictionaries instead. By using dictionaries, attackers increase the token count significantly, but reduce the effective length of the password. So if your password is two words long (woodenhorse for instance), and there are 50,000 common words in the English language, it will take at most 50,000^2 guesses. That is not many for a computer.

Good passphrases

If you simply pin together words, each word becomes a token and as this practice becomes more common, its no safer than short random passwords. But this can be beefed up significantly by simply throwing in some entropy. For instance, if you have a space between two words, now your two words have to be tested both with and without a space. If you have two spaces, that has to be tested as well. Instead of spaces if you use percent signs, again things get less likely.

So basically you can make simple passphrases that are not simple to crack if you understand how password crackers think.

Instead of "magiccarpetride" (3 tokens) use intentional misspellings, channel your inner dyslexia, add extra characters, etc...

"magiccarpetride" -> "jamic. .KRPT. .ride"

Magic becomes jamic, words end with a period and begin with a period except on the ends, KRPT is carpet with no vowels and in upper case. This is still using tricks that could be tried by a computer, but there are so many possible variations of these types of tricks, that it quickly becomes untenable to crack passwords by trying all possible combinations of these types of things. For instance:

"magiccarpetride" -> "maAgi ccaArpe triIde  "

In this one, double the first vowel in a word, lower then upper, alternate spacing 2 spaces then one space and move the space from the end of the previous word to the beginning of the next.

The variations are infinite, replace the first letter of each word with xz, remove the last letter, use no spaces but add them all at the end, or the beginning, and yes even using numbers for letters or vice versa these things all add to the complexity but simply exchanging letters/numbers or putting 1 at the end is not enough.

Making Thunderbird use Chrome for opening URLs

I've had to look this up twice now, so time to post it here.

Thunderbird will use Firefox to open email links, even if Chrome is your default. The solution is to go into Preferences->Attachments and change the browser used for links, however this option may or may not be present. If not, you have to go into ~/.thunderbird/<whatever profile name>/ and replace the mimeTypes.rdf with the one from the link above.

After this start firefox, and the options should now exist in Preferences->Attachments.

Stashing code with GIT

Pretty cool, I didn't know what stash was, but "git help stash" showed this example:

You can use git stash to simplify the above, like this:

# ... hack hack hack ...
$ git stash
$ edit emergency fix
$ git commit -a -m "Fix in a hurry"
$ git stash pop
# ... continue hacking ...

(note: This example is plagiarized)

Managing SSH keys

I found a GREAT post on dealing with multiple SSH keys. This makes it much easier to securely use mulitple keys so a compromised systems doesn't compromise multiple servers.
In essence, you create a "config" file in .ssh and tell SSH what private key to use based on the name of the host you are SSHing to. You can also specify user and port. I also found you can specify multiple hosts as "Host abc or xyz"

~/.ssh/config

Host *.home.lan
  IdentityFile ~/.ssh/id_dsa.home
  User kbsingh

Host *.vpn
  IdentityFile ~/.ssh/id_rsa.work
  User karanbir
  Port 44787

Host *.d0.karan.org
  IdentityFile ~/.ssh/id_rsa.d0
  User admin
  Port 21871

I added aliases to my /etc/hosts file so I could differentiate between SSH running on mulitple ports at the same server (VM Server). Now I can SSH by the alias name from the hosts file and I don't have to specify the port number or user.