edelblog tag:edelblog.ch,2009-05-25://1 2010-05-29T09:51:08Z Movable Type 4.23-en encrypted usb sticks and hard drives step by step tag:edelblog.ch,2010://1.7 2010-05-22T21:22:08Z 2010-05-29T09:51:08Z How to create an encrypted partition on an usb stick or usb harddrive in 6 steps: Partition the stick/hard drive (we assume it is located under /dev/sdb) fdisk /dev/sdb Setup the encrypted partition with cryptsetup cryptsetup -c aes-cbc-essiv:sha256 -s 256... hp http://edelblog.ch How to create an encrypted partition on an usb stick or usb harddrive in 6 steps:

  1. Partition the stick/hard drive (we assume it is located under /dev/sdb)

    fdisk /dev/sdb

  2. Setup the encrypted partition with cryptsetup

    cryptsetup -c aes-cbc-essiv:sha256 -s 256 luksFormat /dev/sdb1

  3. Optionally add aditional keys

    cryptsetup luksAddKey /dev/sdb1

  4. Open the container

    cryptsetup luksOpen /dev/sdb1 some_name

  5. Create the file system

    mkfs.ext3 -L label -m 0 /dev/mapper/some_name

  6. Close the container

    cryptsetup luksClose some_name

]]> Solaris 10 authentication against openldap tag:edelblog.ch,2009://1.6 2009-12-22T14:32:15Z 2010-01-05T15:24:33Z Here is a simple recipe, to authenticate users against an LDAP directory, using the native ldap client of Solaris 10.... hp http://edelblog.ch Here is a simple recipe, to authenticate users against an LDAP directory, using the native ldap client of Solaris 10.

]]> Stop ldapclient and nscd

/etc/init.d/ldap.client stop
/etc/init.d/nscd stop

Add “ldap” to “passwd” and “groups” in /etc/nsswitch.conf, modify /etc/pam.conf and install /var/ldap/ldapclientfile. Create /var/ldap/ldapclientcred of the form

NS_LDAP_BINDDN= cn=admin,dc=ifi,dc=uzh,dc=ch
NS_LDAP_BINDPASSWD= {NS1}*****************

After restarting nscd and ldapclient

/etc/init.d/ldap.client start
/etc/init.d/nscd start

ldaplist should already yield a list of users defined in LDAP and “id” should be able to identify them.

All is left is to create the certificate database for ldapclient. Use the certutil to create it and add the RootCA of your LDAP server certificate

certutil -A -n certname.pem -t CT -d /var/ldap -i certname.pem

Now also login should work.

]]> working with kvm images tag:edelblog.ch,2009://1.5 2009-10-09T20:12:23Z 2009-10-11T20:09:15Z A collection of short recipies on how to enlarge mount kvm images.... hp http://edelblog.ch A collection of short recipies on how to

  • enlarge
  • mount

kvm images.

]]> How to enlarge a kvm image

  1. Stop the kvm maschine.

  2. Convert the kvm image to raw format if necessary.

    qemu-img convert -O raw original.img raw.img

  3. Make a backup copy of the image.

  4. Enlarge the raw image.

    dd if=/dev/zero of=raw.img bs=1 count=0 seek=[size in]GB

  5. Attach the enlarged image to a loop device.

    losetup /dev/loop0 raw.img

  6. Use

    fdisk /dev/loop0

    to create a new partition or enlarge an existing one to accomodate the additional disk capacity.

  7. Boot the machine using the new image.

  8. Log in to the machine and start up lvm. Either add the new partition as a new physical volume (pvcreate) and add it to a volume group (vgextend) or in case an existing partition was enlarges use

    lvm> pvresize /dev/vda2

    and add the newly available space to logical volumes

    lvm> lvresize -L +511.02G /dev/philipp/home

  9. Enlarge the filesystem (ext2/3).

    resize2fs /dev/philipp/home

]]> git step by step tag:edelblog.ch,2009://1.4 2009-06-10T12:00:10Z 2009-10-09T20:12:09Z This article is a collection of notes on how I use git. It is mainly intended for my personal use. If you want to learn more about git, you should better read the tutorial, the manual or gitmagic.... hp http://edelblog.ch This article is a collection of notes on how I use git. It is mainly intended for my personal use. If you want to learn more about git, you should better read the tutorial, the manual or gitmagic.

]]> Global configuration These settings have to be done once per machine.

git config --global user.name 'Hanspeter Kunz'
git config --global user.email 'hp@edelkunz.ch'

More to follow…

]]> logcheck step by step tag:edelblog.ch,2009://1.3 2009-06-10T11:31:01Z 2009-07-28T12:40:02Z This step by step recipe is probably only interesting to myself. It tells me the procedure how to get logcheck from git, develop and test its rules, upload the modifications back to the repository, and build an updated debian package... hp http://edelblog.ch This step by step recipe is probably only interesting to myself. It tells me the procedure how to

  • get logcheck from git,
  • develop and test its rules,
  • upload the modifications back to the repository, and
  • build an updated debian package

If you’re you want to help developing logcheck yourself, you probably better read this.

]]> Get or update logcheck from git

Before starting, get logcheck from git

git clone git://git.debian.org/git/logcheck/logcheck.git

or bring it to current state

git pull --rebase

N.B. Browse the the git repository online.

Develop and test rules

Let’s say we want to filter out message like

Sep 16 23:26:30 seamus deliver(vmail): msgid=3ee0701c9180f$a9da4580$0201a8c0@D9MCN291: saved mail to INBOX

As deliver is part of dovecot, the file were rule has to be added or modified is

rulefiles/linux/ignore.d.server/dovecot

Check README.logcheck-database in case it is not clear where to look for or put the rule. To test if the message is not already filtered (because somebody else wrote a rule) do

egrep -v -f rulefiles/linux/ignore.d.server/dovecot

and paste the message or, alternatively, use 

egrep -v "[rule]"

to test the rule directly. If the pasted message is echoed, it is not filtered. Thus, add or modify a rule, until the rule fits.

Add an entry to debian/changelog with

dch -a

(leave out the -a to bump the version number) and commit both the rulefile and the changelog with

git add rulefiles/linux/ignore.d.server/dovecot debian/changelog
debcommit -e

Upload the modifications back to the repository

When satisfied, push the changes to the remote repository

git push

Build an updated debian package

]]>