Bahut

Importing root certificates into Firefox and Thunderbird

2011-07-26T19:11:00.006+02:00

This is ridiculously complicated and makes me wonder whether I should just drop Firefox in Windows and go back to IE.

The problem:

How to automatically pre-import your self-signed certification authority into all user profiles for Firefox and Thunderbird.

The solution:

You need the Mozilla certutil utility (not the Microsoft certutil.exe).

In Windows, you would need to compile nss tools or use some ancient hard to find Windows binary to get it. But all my user profiles are on a Samba server, so it was much easier to do it on the server, with the added benefit of having Bash and not needing to struggle with the horrible cmd.exe.

First install the tools. In Debian, it would be:

apt-get install libnss3-tools

Then adapt this long command to your paths:

find /path/to/users-profiles -name cert8.db -printf "%h\n" | \
while read dir; do \
  certutil -A -n "My Own CA" -t "C,C,C" -d "$dir" -i "/path/to/my_own_cacert.cer"; \
done

(-printf "%h\n" prints just the directory, without the file name, one per line. That is fed to the $dir variable needed in the certutil command. The -n option is a required nickname for the certificate. -t "C,C,C" is what will make you accept any certificate signed by this CA you are importing).

See also: the certutil documentation, and a better explanation of the trust arguments (-t option).

Postgresql 8.4 LDAP unknown authentication

2011-07-19T14:31:00.003+02:00

The syntax to specify LDAP authentication in pg_hba.conf seems to have changed between version 8.3 and 8.4. At least in Debian Squeeze, where I have both installed.

For 8.3, I had a line like this in pg_hba.conf:

host  all  all  192.168.44.0/24  ldap "ldap://localhost/dc=mydomain,dc=lan;uid=;,ou=People,dc=mydomain,dc=lan"

When trying to start 8.4 with the same line, I was getting

# /etc/init.d/postgresql restart 8.4
Restarting PostgreSQL 8.4 database server: main
The PostgreSQL server failed to start. Please check the log output: [...]
invalid authentication method ":ldap" [...]
FATAL: could not load pg_hba.conf ... failed!

The new syntax which works in 8.4 is

host  all  all  192.168.44.0/24  ldap ldapserver=localhost ldapprefix="uid=" ldapsuffix=", ou=People, dc=mydomain, dc=lan"

Etch to Lenny trouble with libxml2

2011-07-03T12:21:00.003+02:00

While upgrading a few Debian Etch systems to Lenny, I had a lot of trouble which showed up like this:

symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64

The real cause seems to have been that I had 2 libz libraries installed:

 # /sbin/ldconfig -pNX | grep libz
 libz.so.1 (libc6) => /lib/libz.so.1
 libz.so.1 (libc6) => /usr/lib/libz.so.1

So the solution was quite simple:

 # rm /lib/libz.so.1*

That's all that was needed to get rid of the mountain of dpkg errors, and continue the upgrades following the Debian guide. The next upgrade to Squeeze went smoothly.

For the benefit of Google searchers, here is a full error listing:

 Unpacking replacement shared-mime-info ...
update-mime-database: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: warning - old post-removal script returned error exit status 127
dpkg - trying script from the new package instead ...
update-mime-database: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error processing /var/cache/apt/archives/shared-mime-info_0.30-2_i386.deb (--unpack):
 subprocess new post-removal script returned error exit status 127
update-mime-database: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error while cleaning up:
 subprocess post-removal script returned error exit status 127
Preparing to replace libgnomevfs2-common 1:2.14.2-7 (using .../libgnomevfs2-common_1%3a2.22.0-5_all.deb) ...
Unpacking replacement libgnomevfs2-common ...
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: warning - old post-removal script returned error exit status 127
dpkg - trying script from the new package instead ...
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error processing /var/cache/apt/archives/libgnomevfs2-common_1%3a2.22.0-5_all.deb (--unpack):
 subprocess new post-removal script returned error exit status 127
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error while cleaning up:
 subprocess post-removal script returned error exit status 127
Preparing to replace libgnome2-common 2.16.0-2 (using .../libgnome2-common_2.20.1.1-1_all.deb) ...
Unpacking replacement libgnome2-common ...
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: warning - old post-removal script returned error exit status 127
dpkg - trying script from the new package instead ...
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error processing /var/cache/apt/archives/libgnome2-common_2.20.1.1-1_all.deb (--unpack):
 subprocess new post-removal script returned error exit status 127
gconftool-2: symbol lookup error: /usr/lib/libxml2.so.2: undefined symbol: gzopen64
dpkg: error while cleaning up:
 subprocess post-removal script returned error exit status 127
Errors were encountered while processing:
 /var/cache/apt/archives/shared-mime-info_0.30-2_i386.deb
 /var/cache/apt/archives/libgnomevfs2-common_1%3a2.22.0-5_all.deb
 /var/cache/apt/archives/libgnome2-common_2.20.1.1-1_all.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install.  Trying to recover:
dpkg: dependency problems prevent configuration of libbonoboui2-0:
 libbonoboui2-0 depends on libglade2-0 (>= 1:2.6.1); however:
  Version of libglade2-0 on system is 1:2.6.0-4.
 libbonoboui2-0 depends on libgtk2.0-0 (>= 2.12.0); however:
  Version of libgtk2.0-0 on system is 2.8.20-7.
dpkg: error processing libbonoboui2-0 (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libgnomecanvas2-0:
 libgnomecanvas2-0 depends on libglade2-0 (>= 1:2.6.1); however:
  Version of libglade2-0 on system is 1:2.6.0-4.
 libgnomecanvas2-0 depends on libgtk2.0-0 (>= 2.12.0); however:
  Version of libgtk2.0-0 on system is 2.8.20-7.
dpkg: error processing libgnomecanvas2-0 (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libgail18:
 libgail18 depends on libgtk2.0-0 (>= 2.12.0); however:
  Version of libgtk2.0-0 on system is 2.8.20-7.
dpkg: error processing libgail18 (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libgail-common:
 libgail-common depends on libgail18 (>= 1.9.1); however:
  Package libgail18 is not configured yet.
 libgail-common depends on libgtk2.0-0 (>= 2.12.0); however:
  Version of libgtk2.0-0 on system is 2.8.20-7.
dpkg: error processing libgail-common (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libgnomevfs2-extra:
 libgnomevfs2-extra depends on libgnomevfs2-common (>= 1:2.22); however:
  Package libgnomevfs2-common is not installed.
 libgnomevfs2-extra depends on libgnomevfs2-common (<< 1:2.23); however:
  Package libgnomevfs2-common is not installed.
dpkg: error processing libgnomevfs2-extra (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libgnomevfs2-0:
 libgnomevfs2-0 depends on libgnomevfs2-common (>= 1:2.22); however:
  Package libgnomevfs2-common is not installed.
 libgnomevfs2-0 depends on libgnomevfs2-common (<< 1:2.23); however:
  Package libgnomevfs2-common is not installed.
dpkg: error processing libgnomevfs2-0 (--configure):
 dependency problems - leaving unconfigured
Setting up libgnome-keyring0 (2.22.3-2) ...
dpkg: dependency problems prevent configuration of libgnome2-0:
 libgnome2-0 depends on libgnomevfs2-0 (>= 1:2.17.90); however:
  Package libgnomevfs2-0 is not configured yet.
 libgnome2-0 depends on libgnome2-common (>= 2.20); however:
  Package libgnome2-common is not installed.
 libgnome2-0 depends on libgnome2-common (<< 2.21); however:
  Package libgnome2-common is not installed.
dpkg: error processing libgnome2-0 (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of xserver-xorg-input-mouse:
 xserver-xorg-input-mouse depends on xserver-xorg-core (>= 2:1.4); however:
  Version of xserver-xorg-core on system is 2:1.1.1-21etch5.
dpkg: error processing xserver-xorg-input-mouse (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of xserver-xorg-input-kbd:
 xserver-xorg-input-kbd depends on xserver-xorg-core (>= 2:1.4); however:
  Version of xserver-xorg-core on system is 2:1.1.1-21etch5.
dpkg: error processing xserver-xorg-input-kbd (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 libbonoboui2-0
 libgnomecanvas2-0
 libgail18
 libgail-common
 libgnomevfs2-extra
 libgnomevfs2-0
 libgnome2-0
 xserver-xorg-input-mouse
 xserver-xorg-input-kbd

Command-line partitioning and formatting

2011-06-21T13:45:00.006+02:00

Automatic non-interactive formatting in Linux is possible with parted.

The following creates 1 single ext3 partition on an entire disk. Of course, if you assign the wrong disk to the $disk variable, it will be a bad day...

# Select the disk device and chose a label for the partition
disk=/dev/sdx; label=my_part_label

I have added sleep commands, so I can just copy/paste the whole thing and still have a chance to Ctrl-C if I change my mind at the last second.

# print the current partition(s) state
parted $disk print ; sleep 10

# create a standard ("msdos") partition table
parted -a optimal $disk mklabel msdos ; sleep 5

# create the partition, starting at 2048 sectors which may be better
# with newer disks
parted -a optimal -- $disk unit s mkpart primary ext3 "2048" "-1" ; sleep 5

# format it
mke2fs -j -v -L "$label" ${disk}1 && echo "OK. That's it"

Windows installers options for silent installs

2011-06-07T13:53:00.007+02:00

Different installers use different command-line options for silent or unattended installs. Since I had started these notes, I have found a good overview on unattended.sourceforge.net.

Inno Setup

can be identified with the "Inno Setup" string appearing in various places in the installer's .exe. The options are described here. The most useful ones are:

/SAVEINF="filename"
Save installation settings to the specified file.
/LOADINF="filename"
Load the settings from the specified file after having checked the command line.
/SP-
Disables the This will install... Do you wish to continue? prompt at the beginning of Setup.
/SILENT, /VERYSILENT
When Setup is silent the wizard and the background window are not displayed but the installation progress window is. When a setup is very silent this installation progress window is not displayed. Everything else is normal so for example error messages during installation are displayed.
/DIR="x:\dirname"
/LANG=language
Specifies the language to use. language specifies the internal name of the language as specified in a [Languages] section entry.

Nullsoft's NSIS

can be identified with the "NSIS" string appearing in various places in the installer's .exe. The options are described here, but there seem to be only 2 useful ones:

/S
Silent installation
/D=C:\Bla
Set output folder

Mac and OpenLDAP: Local homes for network users

2011-05-29T11:30:00.003+02:00

I wanted a Mac to authenticate users against our Debian OpenLDAP server, but to create a local home directory on the Mac (see here for more details). The usual configuration for network users on the Mac is to mount their homes from the server over NFS. There are many excellent instructions on the net on how to do that. But finding help on how to have them use a local home instead was much more difficult.

It turns out it can be done very simply, by disabling one line in /etc/auto_master on the Mac. By default, it contains +auto_master, which tells the Mac's automounter to look for an automount map in LDAP. If this line is disabled, the Mac will create a local home for network users the first time they log in. Since our userHomes in LDAP are defined as /home/username, the Mac home is created under /home instead of /Users, which is fine.

So for such a setup, you do NOT need to import an Apple schema into your LDAP directory. (That was quite a hassle because you need to tweak the original schema which is not quite kosher; but it was unnecessary).

All you need to do is comment out this single line in /etc/auto_master to make it

#+auto_master  # Use directory service

Or copy/paste this:

sudo perl -i.orig -pe 's/^(\+auto_master.*)/## $1/' /etc/auto_master

Kill the Final Cut registration screen

2011-05-28T23:01:00.003+02:00

I came across this nicely detailed post explaining how to get rid of the forced registration screen of Final Cut Pro/Studio, which always pops up when you really don't want to be bothered with this idiocy.

But I felt the solution was worse than the problem. It involved far too much clicking around for my taste. And you need the Property List Editor. You only have that once you have installed over 1 GB (!!) of developer tools. If you can remember where you put your OS X disk, that is.

Surely, there must be a better way to do it, by just copying a command from some web page and pasting it into Terminal?

It turned out to be 3 commands. And getting them right was much worse than the solution I din't like. You need your machine ID, which is in an XML file that defaults read doesn't want to read. And in that file it is encoded in Base64. You need to put this ID into a property list file as data. That can be done with defaults write, but the data needs to be in hex. I should just have registered, I guess...

Anyway, the detailed explanations are in the link of the first sentence, and the 3 ridiculous commands to paste into Terminal are here:

id=$(perl -MMIME::Base64 -ne '/^\s+(\S{64})\s*$/ && print unpack("H*",decode_base64($1));' "/Library/Application Support/ProApps/Final Cut Studio System ID"|tail -1)
sudo defaults write /Library/Preferences/com.apple.RegFinalCutStudio "{ AECoreTechRegister=1; AECoreTechRegSent=1; }"
sudo defaults write /Library/Preferences/com.apple.RegFinalCutStudio AECoreTechRegInfo -data "$id"

Moving IMAP Maildir to another user

2010-11-20T18:56:00.001+01:00

A little recipe to move a user's IMAP mails to another user. (Tested on the Courier IMAP server on Debian).

Useful in situations like John leaving the company and Bob needing to have access to John's old emails.

olduser=john; newuser=bob
maildirmake -f $olduser /home/$newuser/Maildir/
cd /home/$olduser/Maildir/
for d in * ; do \
    cp -pr "$d" "/home/$newuser/Maildir/.$olduser/"; \
done
echo "INBOX.$olduser"  >>/home/$newuser/Maildir/courierimapsubscribed
for d in .??*; do \
    cp -pr "$d" "/home/$newuser/Maildir/.$olduser$d"; \
    echo "INBOX.$olduser$d" >>/home/$newuser/Maildir/courierimapsubscribed; \
done
chown -R $newuser /home/$newuser/Maildir

(Beware that if John had a folder with a one-letter name, that one will not be copied. It's because "for d in .*" would do a mess trying to copy "." and "..". So line 6 uses "for d in .??*" instead.)

Quicktime Error 2041 an invalid sample description was found in the movie

2010-02-27T16:53:00.000+01:00

After converting an MPEG-TS file to mp4, I had trouble with some players. Particularly, the latest Quicktime (7.6.5) wouldn't play it, saying "Error -2041: an invalid sample description was found in the movie".

Searching Google on this error turned up thousands of results, but nothing I read was directly useful. The main "solution" proposed was "rename the .mp4 file to .3gp". That seems to work in some cases for .3gp phone files which the phone happens to name .mp4.

The only solution which worked for me was to use mp4creator with the " -aac-profile=4" option.

In case anybody wants to know all the details, they are below. If you happen to know the real source of the problem and/or a version of MP4Box or ffmpeg which fixes the problem, please leave a comment.

The source file was an MPEG-TS containing h264 video and aac audio. ffmpeg reported this:

$ ffmpeg -i INPUT_FILE.mpg
FFmpeg version 0.5-svn17737+3:0.svn20090303-1ubuntu6, Copyright (c) 2000-2009 Fabrice Bellard, et al.
  configuration: --enable-gpl --enable-postproc --enable-swscale --enable-x11grab
 --extra-version=svn17737+3:0.svn20090303-1ubuntu6 --prefix=/usr --enable-avfilter
 --enable-avfilter-lavf --enable-libgsm --enable-libschroedinger --enable-libspeex
 --enable-libtheora --enable-libvorbis --enable-pthreads --disable-stripping --disable-vhook
 --enable-libdc1394 --disable-armv5te --disable-armv6 --disable-armv6t2 --disable-armvfp
 --disable-neon --disable-altivec --disable-vis --enable-shared --disable-static
  libavutil     49.15. 0 / 49.15. 0
  libavcodec    52.20. 0 / 52.20. 0
  libavformat   52.31. 0 / 52.31. 0
  libavdevice   52. 1. 0 / 52. 1. 0
  libavfilter    0. 4. 0 /  0. 4. 0
  libswscale     0. 7. 1 /  0. 7. 1
  libpostproc   51. 2. 0 / 51. 2. 0
  built on Apr 10 2009 23:18:41, gcc: 4.3.3

Seems stream 0 codec frame rate differs from container frame rate: 50.00 (50/1) -> 25.00 (25/1)
Input #0, mpegts, from 'INPUT_FILE.mpg':
  Duration: 00:00:36.05, start: 2.050022, bitrate: 9188 kb/s
  Program 1
    Stream #0.0[0x810]: Video: h264, yuv420p, 1280x688 [PAR 1:1 DAR 80:43], 25 tbr, 90k tbn, 50 tbc
    Stream #0.1[0x814](eng): Audio: aac, 48000 Hz, stereo, s16, 184 kb/s

The simple thing I did first and which gave a bad file was

$ ffmpeg -i INPUT_FILE.mpg -vcodec copy -acodec copy -f mp4 ffmpeg.mp4

Looking at that file with various tools gives this:

$ mp4info ffmpeg.mp4
mp4info version 1.6
ffmpeg.mp4:
Track   Type    Info
1       video   H264 High@4.1, 36.000 secs, 7889 kbps, 1280x688 @ 25.000000 fps
2       audio   MPEG-4 Unknown Profile(0), 36.032 secs, 0 kbps, 48000 Hz
 Tool: Lavf52.31.0

$ MP4Box -info ffmpeg.mp4
* Movie Info *
        Timescale 1000 - Duration 00:00:36.032
        Fragmented File no - 2 track(s)
        File Brand isom - version 512
        Created: GMT Fri Jan  2 00:00:00 1970

File has no MPEG4 IOD/OD

iTunes Info:
        Encoder Software: Lavf52.31.0

Track # 1 Info - TrackID 1 - TimeScale 50 - Duration 00:00:36.000
Media Info: Language "Undetermined" - Type "vide:avc1" - 900 samples
MPEG-4 Config: Visual Stream - ObjectTypeIndication 0x21
AVC/H264 Video - Visual Size 1280 x 688 - Profile High @ Level 4.1
NAL Unit length bits: 32
Pixel Aspect Ratio 1:1 - Indicated track size 1280 x 688
Self-synchronized

Track # 2 Info - TrackID 2 - TimeScale 48000 - Duration 00:00:36.032
Media Info: Language "English" - Type "soun:mp4a" - 1689 samples
MPEG-4 Config: Audio Stream - ObjectTypeIndication 0x40
Segmentation fault

Next, I tried to extract them separately:

ffmpeg -i INPUT_FILE.mpg -an -vcodec copy -f h264 video.h264
ffmpeg -i INPUT_FILE.mpg -vn -acodec copy -f aac audio.aac

and re-mux them using MP4Box (version 0.4.4):

$ MP4Box -add video.h264#video -add audio.aac#audio mp4box.mp4

That didn't work any better, even though mp4box didn't report a segmentation fault anymore:

$ MP4Box -info mp4box.mp4
* Movie Info *
 ⁞       Timescale 600 - Duration 00:00:36.031
        Fragmented File no - 2 track(s)
        File Brand isom - version 1
        Created: GMT Sat Feb 27 15:33:40 2010

File has root IOD
Scene PL 0xff - Graphics PL 0xff - OD PL 0xff
Visual PL: AVC/H264 Profile (0x15)
Audio PL: AAC Profile @ Level 2 (0x29)
No streams included in root OD

Track # 1 Info - TrackID 1 - TimeScale 25000 - Duration 00:00:36.000
Media Info: Language "Undetermined" - Type "vide:avc1" - 900 samples
MPEG-4 Config: Visual Stream - ObjectTypeIndication 0x21
AVC/H264 Video - Visual Size 1280 x 688 - Profile High @ Level 4.1
NAL Unit length bits: 32
Pixel Aspect Ratio 1:1 - Indicated track size 1280 x 688
Self-synchronized

Track # 2 Info - TrackID 2 - TimeScale 48000 - Duration 00:00:36.032
Media Info: Language "Undetermined" - Type "soun:mp4a" - 1689 samples
MPEG-4 Config: Audio Stream - ObjectTypeIndication 0x67
MPEG-2 Audio AAC LC - 2 Channel(s) - SampleRate 48000
Synchronized on stream 1

and mp4info also seemed to like the file better:

$ mp4info mp4box.mp4
mp4info version 1.6
mp4box.mp4:
Track   Type    Info
1       video   H264 High@4.1, 36.000 secs, 7717 kbps, 1280x688 @ 25.000000 fps
2       audio   MPEG-2 AAC LC, 36.032 secs, 150 kbps, 48000 Hz

Note that re-wrapping this into a Quicktime .mov file ($ ffmpeg -i mp4box.mp4 -acodec copy -vcodec copy -f mov mp4box.mov) worked and gave a file Quicktime played without trouble.

But to get a working .mp4, I had to use yet another tool for the audio: mp4creator. With the -aac-profile=4 option:

$ mp4creator -aac-profile=4 audio.aac mp4creator-audio.mp4
Warning - you have changed the AAC profile level. ⁞ This is not recommended
If you have problems with the resultant file, it is your own fault
Do not contact project creators

Despite the warning, this worked after re-muxing with mp4box:

$ MP4Box -add video.h264#video -add mp4creator-audio.mp4#audio mp4box.mp4

$ mp4info mp4box-2.mp4
mp4info version 1.6
mp4box-2.mp4:
Track ⁞⁞⁞  Type    Info
1       video   H264 High@4.1, 36.000 secs, 7717 kbps, 1280x688 @ 25.000000 fps
2       audio   MPEG-4 AAC LC, 36.032 secs, 150 kbps, 48000 Hz

Examining the difference, it seems that both ffmpeg and MP4Box were making an MPEG-2 AAC track, and Quicktime wanted an MPEG-4 track instead.

PDF to Word conversion notes

2010-02-10T13:48:00.006+01:00

Had a complex PDF to convert to something editable like .doc, so I had another look at what was available.

This comparative test from 2008 was very helpful, as were some readers' comments. It concluded by recommending the koolwire.com service, which was indeed quite good, and also very convenient because it can be used through email. It produced an RTF with mostly actual tables. Visually, however, the tables in this particular case would have needed quite some re-formatting to look like the original ones.

Several readers suggested the PDF-to-Word service at pdftoword.com. For me, this gave me the best looking results. It converted the complex tables into columnized sections instead, but that was fine. (As an aside, it is not very clear which engine this service is using. It is related to Nitro PDF, a commercial Windows application which is promoted from the pdtftoword.com page. Also, the Nitro PDF pages link to the free pdftoword.com service as their free version. However, the produced Word document mentions Solid Converter PDF, another commercial Windows application, in it's properties. Weird...)

I also tried the convertpdftoword.net service which others suggested. It also gave a good looking Word document, but built it with tons of independent text boxes which was quite unconvenient in my case. A closer look, showed that this service was actually using VeryPDF's PDF2Word, which produced an RTF file (but with a .doc extension). PDF2Word turns out to actually be a re-packaging of xpdf, and is free (GPL) software. The source is available, but VeryPDF sells the Windows executable.

The funny thing from theses tests: the only completely useless conversions happened to be the one from Adobe itself.

Conclusion: I had the best results with pdftoword.com. But it all depends on your source document and what you want to do with it.

Open mbox file in Thunderbird

2010-01-01T15:12:00.003+01:00

Unfortunately, there seems to be no straightforward way to ask Thunderbird to open or import an Mbox mail file directly.

Say you have an mbox file, and would like to view it in Thunderbird. For this example, we will view the file in a "temp-mbox" folder under Thunderbird's "Local Folders". The convoluted way which seems to work goes like this:

In Thunderbird, under Local Folders, create the new "temp-mbox" folder.
Exit Thunderbird.
Find your "Local Folders" directory in your profile. It may be something like "~/.thunderbird/random-string.default/Mail/Local Folders/". In there, you will find a temp-mbox and a temp-mbox.msf file.
Overwrite temp-mbox with your mbox file,
and delete the temp-mbox.msf index file.
Re-open Thunderbird

I needed to do this, because of another limitation of Thunderbird: it's poor search capabilities. Since the mails I wanted to group are on my own IMAP server, I did the search there, and put all the mails into a single file. What I wanted is all the last year's emails received from or sent to somedomain. The following got me a suitable mbox file:

mbox=somedomain-2009.mbox; search=@somedomain; \
find ~/Maildir/cur ~/Maildir/.Sent/cur -mtime -365 | \
while read f ; do \
if egrep "^(From|To|Cc):.*$search" "$f"; then \
  echo "From - " >>$mbox; \
  cat "$f" >>$mbox; \
fi; \
done

To achieve this using the TB search, I would have needed to:

Search Inbox without subfolders for "From contains @somedomain" or "To contains @somedomain" or "Cc contains @somedomain". This also searches previous years, and takes quite a while on my IMAP folder.
Save the search
Search Sent for "To contains @somedomain" or "Cc contains @somedomain".
Save the search
Create a folder for results
Open the first saved search folders, sort by date, and copy the 2009 mails to the new results folder
Repeat with the second saved search.

OpenVPN client on Ubuntu 9.04 Jaunty

2009-12-30T12:42:00.004+01:00

A few notes on setting up the openvpn client on Ubuntu, after my move from Windows. Configuration through the Network Manager VPN tab didn't work for me. As far as I could see, there was no way to directly import or copy my existing .ovpn files from Windows because NM doesn't use them. Instead, it uses it's own config files, which do not provide all the options of the standard openvpn client. The solution was to

install openvpn and resolvconf so that the name servers can be updated: sudo apt-get install openvpn resolvocnf
copy my .ovpn and key files to /etc/openvpn,
install gopenvpn to have a handy GUI launcher in the Gnome Panel. (the .deb package needs to be downloaded from the site)
Edit my .ovpn files to add up /etc/openvpn/update-resolv-conf and down /etc/openvpn/update-resolv-conf

It seems to work fine now. One example client .ovpn file looks like this:

client
dev tun
proto udp

remote hostname.example.com 1194

resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings

ca example-cacert.pem
cert clientname.example.lan.pem
key clientname.example.lan.key

comp-lzo
verb 3

up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

2 little things are annoying: I need to enter my password, because changing the network requires root privileges. I'm sure there must be a solution, but the annoyance is probably not worth the time needed to find and apply it. And the other glitch is that window asking for my key's password sometimes opens behind the others.

Boot an iso file on your hard disk using grub

2009-09-18T01:08:00.007+02:00

I needed to update the firmware on several of the infamous Seagate Barracuda 7002.11 drives with the buggy "SD15" firmware.

Seagate offers a Windows executable or an ISO file to create a bootable CD. However, I had only a Mac, a Linux notebook without a CD drive, and a Windows notebook with neither a CD nor any possibility to attach SATA drives.

After some googling, it looked like the Intel Mac could be booted from such a DOS CD, and that might have worked ... but I didn't even have a blank CD.

But wouldn't it be possible to boot from an .iso file on the hard disk?

As it turns out, it is. And this will probably prove quite handy to boot various Live CDs.

My notebook has Ubuntu, with the standard Grub boot loader. Grub cannot boot from an iso file, but another boot loader called grub4dos can. And Grub can boot that smart cousin of his... Yes, it's a sort of weird setup, but it worked for me.

There are also ways to do that on a Windows system. But here is the Linux version:

Get grub4dos from sourceforge or gna.org
Extract grub.exe from the zip file and copy it to your /boot directory.
Also put the .iso you want to boot into your /boot directory.
Edit your /boot/grub/menu.lst file and add these lines:

title == Use grub4dos for the following entries: ==

title 1: Reload this menu using grub4dos to enable booting the next entries
kernel /boot/grub.exe

title 2: boot the Seagate firmware ISO file
map --mem /boot/MooseDT-SD1A-3D4D-16-32MB.ISO (hd32)
map --hook
chainloader (hd32)

(Adapt the "title 2: ..." line, and of course the "map --mem /boot/name-of-your.iso" line with the right file name. Note that it is case-sensitive)

When booting, you will first be in your standard grub, where you select the "1: ..." entry to load grub4dos. It will do just like grub, find the same menu.lst file, and display it again. Now you can select the .iso entry, which grub4dos will understand.

It is probably also possible to store the iso files on other partitions, but that is "left as an exercise to the reader" ...

Pirater la musique, c'est mal

2009-06-22T00:02:00.006+02:00

...

Il faut l'acheter pour que les multinationales du disque ne finissent pas comme les constructeurs de voitures américains artistes gagnent quelque chose. Alors j'essaye...

J'étais allé voir iTunes il y a des années, mais c'était réservé aux américains, et ne proposait que des fichiers cryptés que je ne pouvais pas écouter sur l'appareil de mon choix.

Puis sont venus les .mp3 de Amazon.com. Je m'y suis précipité, mais ils sont réservés aux américains.

Depuis, iTunes est disponible en Suisse, et il paraît qu'ils ont enfin renoncé au DRM dans leurs fichiers. Alors j'essaye itunes.ch. Pour découvrir que je ne peux télécharger de la musique que si j'installe le programme iTunes sur un ordinateur Mac ou Windows. Non merci.

Après de longues recherches par Google qui me propose des dizaines de sites et de manières de télécharger immédiatement la musique que je souhaite par divers moyens illégaux, je découvre Qobuz.com qui semble très intéressant. Hélas, c'était durant un week-end où leurs serveurs souffraient de pannes, et je n'arrive à rien.

Quelques semaines plus tard je retourne sur Qobuz.com, et j'y fais mon choix. Au moment de "passer à la caisse", je suis envoyé chez ClickandBuy qui semble être leur seul moyen de payement. ClickandBuy prend note de toutes mes données de carte de crédit, adresse, téléphone, etc. puis doit absolument m'envoyer un SMS avec un code de confirmation. Hélas, le code n'arrive jamais, malgré 2 tentatives, et mes vérifications minutieuses du numéro de téléphone portable que je leur donne.

Mais j'ai entendu dire que Amazon France offrait enfin aussi des .mp3. J'y trouve ce que je veux, mais au moment de mettre la musique à télécharger dans mon "panier", je reçois ce message: "Message important Nous sommes désolés. Nous n'avons pas pu traiter votre commande en raison de restrictions géographiques appliquées au produit que vous avez essayé d'acheter. Veuillez consulter les conditions d'utilisation de ce produit pour déterminer les restrictions géographiques applicables. Nous nous excusons pour la gêne occasionnée."

Heureusement, je peux écouter toutes ces musiques chez mon voisin, qui semble connaître de meilleurs moyens pour se procurer de la musique rapidement et sans complications...

Hard drive partitions and file system essentials

2009-05-23T11:49:00.020+02:00

What most normal users need to know about hard disk partitions and filesystems to be able to move hard disks between various operating systems like Mac or Windows.

Hard disks contain 1 or more partitions. To the user, each partition appears as if it were a separate hard disk.

(In Windows, each partition receives a separate drive letter like C:, D:, etc.; on a Mac, you see a separate icon on the desktop for each partition; in Linux, each is a device like /dev/sdb1, /dev/sdb2, etc.)

Every partition needs to be formatted with a file system to let the operating system store and retrieve files. (On Mac, this formatting process is called "erasing")

There are many different types of file systems. Your system needs to understand these file systems to be able to use them. Unfortunately, various operating systems use different file systems. The problem is to find which one will be understood by all the systems you intend to connect your drive to. Also, some systems only support reading some file systems, not writing to them.

Summary

Below is a table trying to summarize the compatibility between the 3 main operating systems and the 4 main file system types. There are many others, but if you know about them, you probably don't need this page.

	Windows	Mac OS X	Linux
FAT32 or DOS	Native support Max. 4GB. file size	Read/Write Max. 4GB. file size	Read/Write Max. 4GB. file size
NTFS	Native support	Read only. Write support through external drivers. ¹	Read/Write on recent distributions. ²
HFS+ or "Mac OS extended"	Requires third party programs for reading and writing. ³	Native support	Read only. Write if the journaling feature has been turned off in Mac OS X. ⁴
Ext2 or Ext3	Free drivers allow Read/Write access.⁵	Requires commercial driver. ⁶	Native support

FAT or FAT32 (named "MS-DOS" in Macs)

This the oldest of the file systems commonly used today. As such, it has the greatest compatibility and the least functionality. It is a sort of lowest common denominator.

All operating systems can read and write to it. It is the file system generally used on USB flash drives, memory cards for photo cameras, etc.

It cannot store files greater than 4 Gigabytes. It is also the least reliable of the current file systems, and has many other drawbacks (fragmentation, no support for permission, time stamps in local time and with only 2 seconds resolution, etc.)

The Windows disk manager refuses to format a FAT32 partition greater than 32 GB. But it can be formatted in Windows with the free fat32format.exe utility, or can be formatted to the wanted size on Mac or Linux.

NTFS

Is the native file system of Windows.

Macs can read it, but cannot write to it.

However, there is a Mac version of the open source NTFS-3G driver which can write to NTFS. ¹

Recent Linux versions can both read it and write to it (thes usually have this NTFS-3G driver installed by default). ²

HFS aka. "Mac OS X" HFS+ aka. "Mac OS X Extended (journaled)"

Is the native file system on Macs.The Mac default is the HFS+ journaled variant.

Windows needs special programs installed to be able to read or write it. ³

Linux can read it when it has the hfsutils package installed. It can also write to it if journaling has been disabled. ⁴

Ext2 or Ext3

is the most common file system on Linux.

(If you wonder why you would need to know anything about Linux: while it is not very common as a desktop operating system, it is the system used in almost all your non-computer devices which contain a hard disk, like your NAS backup disk, your media player, etc. If that device breaks, you may be able to recover the files from it's hard disk by connecting it to your main computer and installing the driver for the ext2 file system)

Windows can read and write to it using free drivers. ⁵

There is a Mac driver, but it may be problematic. ⁶

Footnotes:

1. Mac -> NTFS : The free and open source ntfs-3g driver for Mac is available on http://sourceforge.net/projects/catacombae/files/. The commercial version is based on the same code, but improves speed. You may also want to have a look at the user guide and the macntfs-3g blog.

2. Linux -> NTFS : In case you have an older distribution which doesn't have it pre-installed, you can normally install "ntfs-3g" using your distribution's package manager. Or have a look at their availability page.

3. Windows -> HFS : If you only need to copy files from a Mac disk to your Windows machine, you can use the free HFSExplorer, which will open your drive in a Windows Explorer-like window and let you copy files from there.

For full support, you may need commercial software like MacDrive or similar.

4. Linux -> HFS : If it isn't already on your system, you will need to install the "hfsutils" package.

If you need to write to the HFS disk, journaling must be disabled. You need to do this on a Mac. Afterwards, you can re-enable journaling (again on a Mac). To disable journaling on a Mac, open Disk Utility, select the volume, hold the Option (or Alt) key while opening the File menu, which will make the "Disable Journal" menu entry appear in the menu. Alternatively, you can enter diskutil disableJournal "/Volumes/YOUR_VOLUME_NAME" in Terminal

5. Windows -> ext2/3 : There are 2 free drivers. The open source one is at http://www.ext2fsd.com/ and the closed source one is at http://www.fs-driver.org/.

6. Mac -> Ext2/3 : You can try the commercial ExtFS for Mac OS X. Or the open source fuse-ext2 which I have never tried. (There is also another free open source driver (http://sourceforge.net/projects/ext2fsx), but that project doesn't seem to be actively maintained. It may have worked well on older Mac OS versions, but when I tried a simple folder move with the current version 1.4d4 on a Mac OS X 10.5 system, it made the system crash hard, and left a badly corrupted drive, which I had to repair using e2fsck on Linux.)

The Is Your New Bicycle Meme Revisited

2009-04-24T10:05:00.006+02:00

Even though the '... Is Your New Bicycle' meme is already over a year old, I couldn't resist adding to it. So here is a new meta-meme-site for your amusement:

allyournewbicylces.com fetches new 'Is Your New Bicycle' quotes for you

It has a list of the best sites which are still alive, selects one, gets you a fresh quote from it, and displays it using the obligatory layout, with a helpful link to the original source site in the corner.

And in case you find it easier to remember, it even has an alternative name: thisisyournewbicycle.com.

If you had not heard about this American election year meme, this is the original site (which even became a book), and here is an article about it.

Installing latest FFMPEG on Debian Etch

2009-03-18T10:33:00.006+01:00

How to install the latest FFMPEG on a Debian 4 ("Etch") server? This post encouraged me to try it, despite the fact that it needs compiling from source, and that Etch isn't even the current "stable" Debian anymore. PhillC's post helped a lot, but it still didn't work for me exactly as described there. So here is how it eventually did work for me.

# echo "deb http://www.debian-multimedia.org etch main" >>/etc/apt/sources.list

# echo "deb http://www.debian-multimedia.org stable main" >>/etc/apt/sources.list

(I used both, and fiddled with enabling and disabling that repository, so I'm not sure anymore which one ended up being useful).

aptitude update gave me a GPG error, so I had to add the key it mentioned:

# gpg --keyserver hkp://wwwkeys.eu.pgp.net --recv-keys 07DC563D1F41B907
# gpg --armor --export 07DC563D1F41B907 | apt-key add -
# aptitude update

The following didn't work, or only worked partially:

# apt-get build-dep ffmpeg

Reading package lists... Done
Building dependency tree... Done
E: Unable to find a source package for ffmpegcvs

I continued anyway with the long install line of various libraries. I had to remove some of these libraries from the suggested install line. Particularly, since I had to recompile libx264 anyway, I should have removed libx264-dev at this point. It is removed in the line below:

# aptitude install liblame-dev libfaad-dev libfaac-dev libxvidcore4-dev liba52-0.7.4 liba52-0.7.4-dev build-essential subversion

# cd /usr/src
# svn checkout svn://svn.mplayerhq.hu/ffmpeg/trunk ffmpeg

And so I got the current version as of March 17:

Checked out external at revision 28979.

Checked out revision 18021.

And I tried configure:

# cd /usr/src/ffmpeg
# ./configure --enable-gpl --enable-pp --enable-libvorbis --enable-liba52 --enable-libdc1394 --enable-libgsm --enable-libmp3lame --enable-libfaad --enable-libfaac --enable-pthreads --enable-libx264 -enable-libxvid

After various errors, and removing options, I ended up with this error:

ERROR: libx264 version must be >= 0.65.

And trying to install that from the debian-multimedia.org repository didn't work either:

# aptitude install libx264-65

The following packages have unmet dependencies:
libx264-65: Depends: libc6 (>= 2.7-1) but 2.3.6.ds1-13etch8 is installed and it is kept back.

So this thread came to rescue, and I embarked on getting x264 and compiling that from source too:

# aptitude install git git-core

Trying to use Git at this point gives an error, but suggests the solution:

# update-alternatives --config git

There are 2 alternatives which provide `git'.
Selection    Alternative
-----------------------------------------------
*+        1    /usr/bin/git.transition
        2    /usr/bin/git-scm

Press enter to keep the default[*], or type selection number: 2

Next steps:

# cd /usr/src/
# git clone git://git.videolan.org/x264.git
# cd x264
# ./configure --enable-shared

This gave an error about yasm, which was not the right version. I could have tried to compile that too, as shown on the Ubuntu forum, but impatiently decided to try the suggested disable option instead. So the x264 part which worked:

# ./configure --enable-shared --disable-asm
# make
# make install
# ldconfig

And finally, ffmpeg:

# cd /usr/src/ffmpeg/
# ./configure --enable-gpl --enable-postproc --enable-pthreads --enable-libfaac --enable-libfaad --enable-libmp3lame --enable-libx264 --enable-libxvid
# make
# make install

I also had to remove the old ffmpeg version (aptitude purge ffmpeg) which I had installed some time before this, and finally did this:

# echo /usr/local/lib >> /etc/ld.so.conf.d/local.conf
# ldconfig

Since I had a leftover libx264 installed with aptitude and which was too old, that caused a segmentation fault when I tried to encode with ffmpeg. After searching (aptitude search x264), I found i had to aptitude purge libx264-54 libx264-dev . Then, just to be sure, I re-did the ./configure, make clean, make, make install incantations for both x264 and ffmpeg.

In the end, ffmpeg is working. I suppose the --disable-asm option on x264 will make encoding slower, so it may be worth compiling yasm, and re-compiling x264 again.

Now that ffmpeg is working, the main problem is trying to understand it's myriad of incomprehensible and cryptically documented options.

Encoding video sizes

2009-01-23T08:39:00.005+01:00

Video compression usually works on square blocks of pixels. These can have sizes of 8x8 or 16x16 or other powers of 2. H264 (AVC) for example, uses macroblocks of 16x16.

So when compressing video, it helps if the frame size is such that both width and height are evenly divisible by 16 or at least by 8. This is why videos encoded for the web or for portable video players are often not exactly in a 16/9 aspect ratio. The PSP's screen, for example, is 480 x 272 even though true 16/9 would require 480 x 270. But 270 is not divisible by 16 whereas 272 is. Youtube uses 640x360, which is true 16/9 and divisible by 8. If you use other sizes, FFmpeg will print a message like

width or height not divisible by 16 (480x270), compression will suffer.

So what are the sizes which are both the right aspect ratio and nicely divisible by 16 or by 8? This little Perl script will let us know:

#!/usr/bin/perl

my $aspect_width  = 16;
my $aspect_height = 9;
my $max_height = 1200;
my @dividers = (16, 8);

for my $divider (@dividers) {

print "$aspect_width/$aspect_height with both ",
     "width and height divisible by $divider :\n\n";

# try sizes up to Full HD
for my $i (1..$max_height/$aspect_height) {
   my $h = $aspect_height * $i;
   unless ($h % $divider) {
       my $w = $aspect_width * $i;
       printf "$aspect_width/$aspect_height divisible by %2d : %4d x %4d\n",
              $divider, $w, $h;
   }
}

print "\n";
}

For 16/9, this gives, among others, numbers like

16/9 divisible by 16 :  256 x  144
16/9 divisible by 16 :  512 x  288
16/9 divisible by 16 :  768 x  432
16/9 divisible by 16 : 1024 x  576
16/9 divisible by 16 : 1280 x  720

For sizes divisible by 8, you obviously have all of the above, plus (among others):

16/9 divisible by  8 :  384 x  216
16/9 divisible by  8 :  640 x  360
16/9 divisible by  8 :  896 x  504
16/9 divisible by  8 : 1920 x 1080
16/9 divisible by  8 : 2048 x 1152

try windows 7 beta

2009-01-11T16:31:00.005+01:00

So we can try this Windows 7 beta now, which is said to be better than Vista, and which we'll have to get used to anyway. Here a few tips which I may need when I find a machine to try it on, and which may help you too.

The official download seems to only work with IE 7, but if you get the direct link it does work normally. So with wget, that would be:

For the 32 bit version:

wget -c http://download.microsoft.com/download/6/3/3/633118BD-6C3D-45A4-B985-F0FDFFE1B021/EN/7000.0.081212-1400_client_en-us_Ultimate-GB1CULFRE_EN_DVD.ISO

And for the 64 bit version:

wget -c http://download.microsoft.com/download/6/3/3/633118BD-6C3D-45A4-B985-F0FDFFE1B021/EN/7000.0.081212-1400_client_en-us_Ultimate-GB1CULXFRE_EN_DVD.ISO

To have the beta working until August, you need a key. Apparently, there are only a few keys used:

7XRCQ-RPY28-YY9P8-R6HD8-84GH3

RFFTV-J6K7W-MHBQJ-XYMMJ-Q8DCH

482XP-6J9WR-4JXT3-VBPP6-FQF4M

D9RHV-JG8XC-C77H2-3YF6D-RYRJ9

JYDV8-H8VXG-74RPT-6BJPB-X42V4

4HJRK-X6Q28-HWRFY-WDYHJ-K8HDH

QXV7B-K78W2-QGPR6-9FWH9-KGMM7

6JKV2-QPB8H-RQ893-FW7TM-PBJ73

GG4MQ-MGK72-HVXFW-KHCRF-KW6KY

TQ32R-WFBDM-GFHD2-QGVMH-3P9GC

Possibly also useful:

Synology NAS tips

2008-12-19T15:22:00.012+01:00

I recently had to setup 2 Synology 107+ NAS devices. Here a few tips that others may find useful. I didn't want to hack the devices with a different firmware, so I had to deal with Synology's own hacks and quirks. (the firmware I got on the boxes is DSM 2.0-0728)

Quick start for the impatient:

The DiskStation is probably accessible at http://192.168.1.1:5000. Change the IP address manually to a fixed IP working on your network.
Set a password for the admin user. The same password will be used for root SSH.

IP address trouble

As detailed in this forum post, the 107+ grabbed my router's IP 192.168.1.1 instead of getting one through DHCP. Once I had found out (which took me a while), it was easy to fix by connecting directly my machine without the rest of the network, and giving it a good fixed IP. (at this stage, it was not possible to set it up for DHCP. The device doesn't take the setting if it can't get an address straight away).

SSH access

You can login as root through SSH, but you must first define a password for the admin user through the web interface. root uses the same password. (and obviously, you have to also enable SSH in the web interface).

Ergonomy

Like most small Linux devices, this one doesn't have Midnight Commander installed, so you don't have a file manager to make things easier. Worst of all, it doesn't even have a decent text editor (no, vi does not count as "decent"; that's just a nightmare left over from someone's bad trip during the sixties.) Instead of replacing the firmware so that one can install additional software, the quickest solution is to use NFS.

Login through SSH as root (the password is the same as for user "admin").
Configure /etc/exports: echo "/ 192.168.1.0/24(rw,no_root_squash)" >>/etc/exports
Run touch /var/lib/nfs/rmtab
(Update: this doesn't seem to be needed anymore with the latest firmware) Start the NFS server: /usr/syno/etc/rc.d/S83nfsd.sh start (and on the client, you need to start portmap and nfs-common)
Run exportfs -ra
Now you can use any Linux machine to go around the file system, edit files etc. mkdir /mnt/mynas; mount -t nfs 192.168.1.xxx:/ /mnt/mynas

(BTW, many people seem to not know that the simplest and easiest console text editor is the one built into Midnight Commander; it can also be used directly by starting mcedit [filename])

File locations

Many files are not in /etc but in /usr/syno/etc. That's where you can find smb.conf for example.

Samba

It may be necessary to add unix charset = ISO-8859-1 to the global section of /usr/syno/etc/smb.conf, depending on your setup.

Bugs

The worst bug I came across so far is that Synology hacked the ext3 filesystem to be case-insensitive. As of firmware DSM 2.0-0728 (December 2008), this makes it unusable for backups of Unix machines. Hopefully, though, it will be fixed soon. Search their forums for updates (one forum post about the problem here; another here; there are many others). Update: This seems to be fixed in the latest beta version as of January 2009: DSM 2.0-0803.

Update: Not sure yet, but there may be a problem related to HTREE (dir_index). One of the disk stations didn't boot, so I took the disk out and ran e2fsck on it. It returned many errors like "Inode 114689 has INDEX_FL flag set on filesystem without htree support". This old message makes me think that might be the reason it wouldn't boot.

A propos d'antivirus

2008-12-13T17:05:00.006+01:00

Hier soir, en passant sur un site web, j'ai attrapé un ou des virus/malware ou autre, et j'ai stupidement perdu des heures pour m'en débarrasser au lieu d'aller me coucher et de résoudre le problème en 10 minutes le lendemain.

Résumé des enseignements de la mésaventure:

Ne pas oublier que Linux permet de facilement effacer/renommer des fichiers que Windows ne peut pas. J'ai bêtement commencé par des recherches web qui menaient tous à des forums suggérant l'nstallation d'utilitaires comme MoveOnReboot ou autres. Outre que le programme a lamentablement échoué dans sa tâche, il y a l'absurdité d'installer un nouveau programme pour juste effacer quelques fichiers. De plus, comment savoir que celui-là est OK, parmi l'avalanche de pop-ups causés par l'infection (qui me proposent tous d'installer des pseudo-antivirus gratuits depuis leurs généreux sites web infestés de malware).
Ne pas oublier la recherche de fichiers par date et heure. Une fois qu'on a l'un des fichiers coupables, ça permet facilement de retrouver tous les autres. Total Commander a ça dans la page "Advanced" de sa fenêtre de recherche (Alt-F7).
Actuellement, parmi les antivirus gratuits que j'avais, Avira Antivir est celui qui a le mieux reconnu le problème (sans pouvoir le résoudre). Il est le plus énervant avec son pop-up géant et quotidien, mais au moins, il voit les virus. (Ceux qui ont été inutiles étaient Moon Antivirus qui ne voyait rien, ClamWin qui ne voyait pas grand chose et qui est d'une lenteur incroyable, et Avast qui ne voyait rien, peut-être parce qu'il ne met plus à jour ses définitions depuis 2-3 mois, parce que je n'ai pas renouvelé la clé d'enregistrement)
Au lieu de l'habituel Run (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\), les virus actuels tendent à se cacher dans le mécanisme de Winlogon de Windows (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\).
StartupMonitor est vraiment indispensable. C'est lui qui m'a immédiatement fait réaliser qu'il y avait un problème. (Dommage que ni lui ni son compagnon StartupCPL n'incluent Notify dans les parties de "registry" qu'ils gèrent)

Bref, la procédure rapide et efficace est:

Examiner Run et Notify pour identifier les suspects.
Examiner les dates et heure de création des fichiers suspects pour identifier les vrais coupables, puis rechercher d'autres fichiers avec ces dates et heures.
Démarrer Linux pour effacer ou renommer les coupables
De retour dans Windows, nettoyer le registry.

Hélas, dans 6 mois ça ne suffira sans doute plus. Il y aura des virus plus malins...

Mise à jour: un ami me fait remarquer que les vendeurs d'antivirus proposent des CD bootables dont il y a un rapport de test ici (le meilleur semble être celui de Kaspersky pour le moment). Si on n'a pas déjà un LiveCD Linux comme Knoppix ou Ubuntu, ou si on ne sait pas exactement quels fichiers il faut effacer, c'est sûrement la solution la plus simple.

Mac install

2008-11-17T12:40:00.027+01:00

Software:

A few links to (free) software I want on the Mac when doing a fresh install:

Firefox (the standard web browser)
Smultron (text editor. After install, in Smultron's help menu, also do: "install command-line utility")
Fink (essential open source shell tools like wget, etc.)
NeoOffice or OpenOffice.org (Office documents like Word, Excel, etc.)
Videolan VLC player (plays most audio/video formats which QT or iTunes don't)
Lingon (launchd configuration editor)
muCommander (File manager (and FTP client). Not as great as Total Commander, but better than nothing) (or the shareware Disk Order?)
MediInfo (displays all the gory details about audio/video files)

A few other things that may be needed or wanted:

ExpressCard SATA driver (OS X 10.5 driver for Silicon Image SiI3132 chipset, Vendor ID 0x1095, Device ID 0x3132. For 10.6 or other systems look here)
Carbon Copy Cloner (disk cloning)
Cyberduck (another FTP client for people who don't like muCommander or need more FTP features)
DiffMerge (visually compare and merge files)
Timecode Calculator Widget (a dashboard widget)

And some configuration notes:

File locations:

On the Mac, many standard Unix files are in different locations than expected:

/var/db/smb.conf for the Samba configuration
/private/etc/sshd_config for the SSH server config.
/private/var/at/tabs/$USER for the user's crontab
/private/var/mail/$USER for system mail (like cron output)

Configuration:

To change the silly default computer name: System Preferences -> Sharing. If it is not enough, try

$ sudo hostname my-permanent-name
$ sudo scutil -set LocalHostName $(hostname)
$ sudo scutil -set HostName $(hostname)

Configure Terminal

$ mkdir ~/bin
$ echo "export PATH=\$PATH:~/bin" >>~/.profile
$ echo "export EDITOR=nano" >>~/.profile
$ echo "export PS1='\[\e]2; \$PWD \a\e[32;1m\]\$PWD/\$\[\e[0m\] '" >>~/.profile

These preferences use the "Grass" look with a 12pt Andale Mono font. To use them:

cp Downloads/com.apple.Terminal.plist Library/Preferences/

Then "Force Quit" Terminal. (otherwise, Terminal will overwrite them on exit with it's current settings)

I also like a longer history:

$ echo "export HISTSIZE=2000" >>~/.profile

I use many external disks and Time Machine constantly asking me if I want to use that disk for backups annoys me. To disable it:

$ defaults write com.apple.TimeMachine DoNotOfferNewDisksForBackup -bool YES

The Firefox 3 SSL scam

2008-07-07T11:43:00.001+02:00

I wonder how much money the Mozilla foundation received from Verisign, Thawte and/or other certification authorities to design their new SSL warning.

This is obviously designed so as to completely kill the use of self-signed certificates, forcing anyone who wants to use encrypted communications to pay money to some huge private (usually foreign) corporation for the privilege of simple stuff like encrypting login passwords for webmail.

One more step in the over-taking of the Internet by big money. And this time thanks to an "open source" organization.

This is supposed to be to improve security. Well, let's see how the security is improved.

To access the site, you need to click a "Or you can add an exception…" link. This expands to an additional warning, with a helpful "Get me out of here" button. That button helpfully sends you to Google (which happens to be the corporation paying the Mozilla developers).

The other button is "Add Exception...". In Firefox 2 (or Opera or others), you came immediately to this stage, where you could examine the certificate's content (including it's fingerprint to verify it), and could accept the certificate for this one time only.

The "improved security" in Firefox 3 will only let you add the certificate permanently! And doesn't let you know anything about this certificate you are about to accept forever. No way to display it's fingerprint, let alone the full content and who claims to have signed it. All you can do is blindly accept some unknown "thing" forever without any possible verification. Or go back to your Big Brother Google to search for another site.

There is a View button and a "Permanently add" check box, but both are greyed out! To enable them, you need to change some obscure about:config setting(s).

When I set up my webmail with a self-signed certificate, I also sent the users the certificate's fingerprint so that they could check it when accepting the certificate. Now, with Firefox 3, they have no (easy) way to check it. They will get used to yet more clicking through endless incomprehesible security dialogs (as with Vista's ridiculous UAC), or I could disable encryption, making my users feel comfortable when accessing their webmail, even though they would broadcast their password to anyone who cares to listen on the (often wireless) LAN.

Firefox is otherwise a very good web browser, and has been my preferred browser since version 0.9 or something, when it was called Phoenix (that was before it was called Firebird). Too bad it now bends so low before big business.

(See also The new SSL error pages in Firefox 3 suck.)

Remote support through NAT firewalls

2008-07-06T17:49:00.010+02:00

Remote support with tools like Remote Desktop, (Tight|Real|Ultra)VNC servers and clients etc. normally requires forwarding ports through NAT routers/firewalls on one side or the other.

In practice, this doesn't quite work: guiding the remote user over the phone to configure his router is unrealistic. He probably doesn't even know his router's password.

An alternative is to use reverse connections, so you deal with the port forwarding on your own router. But this doesn't work either if you are away from home and connect through someone else's router.

There are services which allow you to use someone else's server in the middle of the connection. But these services are usually expensive, charging a monthly fee, and besides you may not want the data to go through some third party's server for security reasons.

One nice solution I found for Windows is to use UltraVNC Single Click, and to run an UltraVNC repeater on my own server. The principle is shown here.

(I'm still looking for an equivalent solution to connect to remote Macs, so if you have suggestions, please post a comment).

So if you have a server with a public IP address you can do this to support Windows users.

Install a repeater on your server:

For my Debian Linux server, I installed the Linux version of the UltraVNC repeater from here:
http://koti.mbnet.fi/jtko/uvncrepeater/repeater014.zip.

After unzipping and moving into the directory, compilation was trouble free with a simple make.

The rest consisted of the following steps (which were quickly adapted from this post, and could probably be improved):

Create a new user: adduser uvncrep (with the shell set to /bin/false)

Edit the .ini file to produce a /etc/uvncrepeater.ini resembling this (use your server's IP for the "ownipaddress" value, and any numbers you like for the "idlistx" values).

[general]
viewerport = 5900
serverport = 5500
ownipaddress = aaa.bbb.ccc.ddd
maxsessions = 10
runasuser = uvncrep
allowedmodes = 2
logginglevel = 3

[mode2]
requirelistedid = 0
idlist0 = 1800
idlist1 = 1801
idlist2 = 1803

[eventinterface]
useeventinterface = false

Copy the repeater executable to /usr/local/sbin/uvncrepeaterd

Create /etc/init.d/uvncrepeater:

#!/bin/sh

PATH=/sbin:/bin
UVNCREPPID=/var/run/uvncrepeater.pid
UVNCREPLOG=/var/log/uvncrepeater.log
UVNCREPRUN=/usr/local/sbin/uvncrepeater-log
UVNCREPSVC=/usr/local/sbin/uvncrepeaterd
UVNCREPINI=/etc/uvncrepeater.ini

#if service file does not exist then exit the script

if test ! -x $UVNCREPSVC ; then
echo $UVNCREPSVC file was not found.
echo Exiting...
exit 2
fi

#Create the file to start the service if it does not exist

if test ! -x $UVNCREPRUN ; then
echo '#!/bin/sh' > $UVNCREPRUN
echo 'exec' $UVNCREPSVC $UVNCREPINI '2>>' $UVNCREPLOG  >> $UVNCREPRUN
chmod +x $UVNCREPRUN
fi

case "$1" in
start)
echo -n "Running UltraVNC Repeater..."
start-stop-daemon --start -b -m -p $UVNCREPPID --exec $UVNCREPRUN -- $UVNCREPLOG
echo "."
;;
stop)
echo  "Stopping UltraVNC Repeater..."
start-stop-daemon --stop -p $UVNCREPPID
rm $UVNCREPPID
;;
*)
echo "Usage: $0 {start|stop}"
exit 1
esac
exit 0

Start the daemon with /etc/init.d/uvncrepeater start

Configure the Single Click executable

This is the small executable which your clients will download and run so that you can access their computer.

You can follow the instructions here.

For the helpdesk.txt file, you can use the one provided in custom.zip. However, it is a bit messy, and has a few typos/spelling mistakes. If you prefer, you can try this alternative template or this sample file instead. Both will need editing, particularly to set your server's hostname and one of the IDs you configured on the server .

Then set up a page from which your clients can download the SC executable.

Set up the UltraVNC viewer

After installing UltraVNC on your machine, start the viewer, and configure it like this:

VNC Server: ID:xxxx (where xxxx is the id number used in your repeater .ini file and when creating the SC executable). "ID" must be in uppercase, and there must be no space in the whole field.

Check Proxy/Repeater and enter your repeater's name or IP and port. For example:
repeater.example.com:5900

Notes:

As far as I can tell, VNC Reflector looks like it would provide the same functionality as the repeater. I haven't tried it.

To support Vista users, there are some difficulties. Apparently there may be solutions in this lengthy thread, but I haven't tried them yet. (Fortunately, I have been able to mostly avoid Vista until now.)

And, as mentioned at the beginning, I would be glad to find a solution to support Mac users from my Windows box through my repeater.

Windows ip config with batch scripts

2008-05-16T18:47:00.010+02:00

It is possible to configure TCP/IP with simple batch scripts in Windows XP, even though the information is well hidden. There are a few typical Windows annoyances attached, but for a notebook user who needs to change settings often, double-clicking a batch file is definitely much better than the network configuration GUI.

The almost secret - even though it is included in the default XP install - tool is called netsh.

Below are a few examples. The main idiosyncrasy is that you need the name of the interface to configure, and that name is somewhat unpredictable. In particular, it is localized. For the normal Ethernet interface, in an English system, it starts with "Local Area Connection". But it is different in other language versions of Windows. There is no simple standard name like "eth0" or "en0".

Look up your interface names in "Network Connections", or by typing ipconfig or

netsh interface show interface

at the command prompt.

A simple batch file which will set your LAN interface to DHCP:

SET LAN=Local Area Connection

netsh interface ip set address name="%LAN%" source=dhcp
netsh interface ip set dns name="%LAN%" source=dhcp register=NONE
netsh interface ip set wins name="%LAN%" source=dhcp

This one will set it to a fixed IP address:

SET LAN=Local Area Connection

SET IP=192.168.1.56
SET MASK=255.255.255.0

SET GW=192.168.1.1
SET DNS=%GW%

netsh interface ip set address name="%LAN%" source=static addr=%IP% mask=%MASK%
netsh interface ip set address name="%LAN%" gateway=%GW% gwmetric=0
netsh interface ip set dns name="%LAN%" source=static addr=%DNS% register=NONE

Finally, a more complete example, which sets both the LAN and WIFI interfaces can take an optional second DNS server, and set the WINS server:

SET LAN=Local Area Connection 5
SET WIFI=Wireless

SET IPLAN=192.168.1.56
SET MASKLAN=255.255.255.0

SET IPWIFI=192.168.1.57
SET MASKWIFI=255.255.255.0

SET GW=192.168.1.1
SET DNS=192.168.1.1
SET DNS2=
SET WINS=none

netsh interface ip set address name="%LAN%" source=static addr=%IPLAN% mask=%MASKLAN%
netsh interface ip set address name="%LAN%" gateway=%GW% gwmetric=0
netsh interface ip set dns name="%LAN%" source=static addr=%DNS% register=NONE
IF NOT "%DNS2%" == "" netsh interface ip add dns name="%LAN%" addr=%DNS2% index=2
netsh interface ip set wins name="%LAN%" source=static addr=%WINS%

netsh interface ip set address name="%WIFI%" source=static addr=%IPWIFI% mask=%MASKWIFI%
netsh interface ip set address name="%WIFI%" gateway=%GW% gwmetric=0
netsh interface ip set dns name="%WIFI%" source=static addr=%DNS% register=NONE
IF NOT "%DNS2%" == "" netsh interface ip add dns name="%WIFI%" addr=%DNS2% index=2
netsh interface ip set wins name="%WIFI%" source=static addr=none
netsh interface ip set wins name="%WIFI%" source=static addr=%WINS%

You can also use netsh to configure the Windows firewall, check network connectivity, etc.

As a ping replacement, try this:

netsh diag ping adapter 1

(replace "1" with your network adapter's index number, which you can find with netsh diag show adapter). It will automatically ping your gateway, your DNS server(s) and your own IP address.

For more information, try these links:
How can I configure TCP/IP settings from the Command Prompt?
or
10 things you should know about the NETSH tool
or just do a web search on "netsh".