Adobe Reader oops

If you have received an update on your Linux machine for the latest Adobe Reader plugin for Firefox, then you may see a stray file of this name in one of your directories: C:\nppdf32Log\debuglog.txt (yes, with the backslashes, because backslash is legal in Unix/Linux filenames). In my case it was in ~/Documents/


From a web search this appears to be a boo-boo by Adobe programmers, releasing a package with a debug feature enabled. It doesn't seem to hurt anything, just makes people suspicious that their system has been rooted. I'm sure another Reader release will be imminent.


Sigh, I always thought they were cowboys, to observe the constant stream of security patches to Reader and Flash Player. For Reader there are alternatives like okular or evince, but Flash Player is harder to replace.

Modifying synbak to use lzop or xz for compression

For backing up a server I installed the synbak program on CentOS, partly because it was a standard package from rpmforge, and partly because it is uncomplicated to use, basically just shell scripts. I noticed that when I used gzip as the compression method, it tied up a whole CPU doing the compression. So I decided to add lzop support. It's very easy, just add these two lines to /usr/share/synbak/method/tar/tar.sh:

--- /usr/share/synbak/method/tar/tar.sh.orig    2010-06-10 05:18:14.000000000 +1000
+++ /usr/share/synbak/method/tar/tar.sh 2012-04-12 09:46:36.000000000 +1000
@@ -30,6 +30,8 @@
        tar)    backup_method_opts_default="--totals -cpf"  ; backup_name_extension="tar" ;;
        gz)     backup_method_opts_default="--totals -zcpf" ; backup_name_extension="tar.gz" ;;
        bz2)    backup_method_opts_default="--totals -jcpf" ; backup_name_extension="tar.bz2" ;;
+       lzo)    backup_method_opts_default="--use-compress-program=lzop --totals -cpf" ; backup_name_extension="tar.lzo" ;;
+       xz)     backup_method_opts_default="--use-compress-program=xz --totals -cpf" ; backup_name_extension="tar.xz" ;;
        *)      report_text extra_option_wrong && exit 1 ;;
   esac


You run it like this: synbak -s serverconfig -m tar -M lzo

I added xz support for good measure, but this is untested. Make sure that backup_method_opts in your config file doesn't have -z or the tar command will throw an error.


Naturally you must have the lzop and/or xz packages installed.


Using lzop, tar and lzop take about equal amounts of CPU time, most of the time tar was I/O bound, and backups finished faster. I also see that the memory footprint of lzop is small. The downside that is the compressed output is larger, about 31% more in my case. Decompression is supposed to be very fast, which is useful when restoring. I haven't used decompression and I hope I won't ever have to.

File AI for instant filesharing

While doing a search for cloud services to share files to a small number of recipients, I came across the interesting File AI service, which deserves to be better known, even though it's been running for a few years. It works by running a peer-to-peer Java applet in a browser on both sides. No software needs to be installed, as long as your browser supports Java.


It's very simple to use, to send a file, just go to fileai.com, click on Send and follow the instructions. You will need to click Run or Trust when the Java applet wants to run because it's unsigned. (Your recipients will also.) Then you drag and drop files you want to share into the "folder". You get a URL that you send to your recipients by email, etc. You can optionally specify a password for recipients before adding any files. You must keep the browser open until all the recipients have the file.


At the recipient end, they just click on your link, or paste it into a browser, click Run or Trust for the Java applet and the file is on the way.


Here is an blog post describing it and here is a YouTube video.


And in case you were wondering, yes it works behind firewalls.

Old netbook as a tethered Internet gateway

I had an ancient Asus EEE700 useless even as a netbook for the road. I wondered if I could turn it into an emergency gateway to my Android smartphone for when my ADSL connection goes down. It has Crunchbang Linux installed which is basically Debian. Here's what I did, for the learning experience:


First you need to disable NetworkManager. Easiest way to do this is to first install the sysv-rc-conf package, and then use its ncurses interface to shut NetworkManager down. Next you need to configure usb0 (the tethered interface) and eth0, the gateway interface by editing /etc/network/interfaces. You might want to preserve an old version of this file to restore to the default setup. Here are the stanzas used:


allow-hotplug usb0
iface usb0 inet dhcp


auto eth0
iface eth0 inet static
        address GW
        netmask 255.255.255.0

GW should be replaced by whatever gateway address is suitable for your LAN. If your ADSL router is 10.0.1.254, perhaps 10.0.1.253 is suitable.

Here are the rules to make it a NATting gateway, taken from Masquerading Made Simple. I have replaced ppp0 with usb0 everywhere:


iptables -F; iptables -t nat -F; iptables -t mangle -F
iptables -t nat -A POSTROUTING -o usb0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward


And to secure it:


iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW ! -i usb0 -j ACCEPT
iptables -P INPUT DROP   #only if the first two are succesful
iptables -A FORWARD -i usb0 -o usb0 -j REJECT


You could save the setup using iptables-save, like this:


iptables-save > /etc/gateway.iptables


Then make a shell script to start the gateway for convenience:


#!/bin/sh
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables-restore < /etc/gateway.iptables


Now tether the netbook to the Android smartphone. When you do ip addr, you should see that it has obtained a private address from your smartphone, and your eth0 address should be static.


Next, on your workstation change the default gateway. From a Linux command line it's


route add default gw 10.0.1.253


When you access the Internet, you should see the traffic icons on your smartphone flash. In addition if you go to a website that tells you your IP address, like whatismyipaddress.com, you should see the external address of your smartphone.


When your ADSL service comes back, delete the route with:


route del default gw


Oh yes, this setup does double NAT, since your smartphone does one NAT.

Open Source to the rescue (of Windows)

I needed to set up an XP workstation with wireless access using an old SMC USB wireless G dongle. This device is based on the Prism chipset.


The SMC drivers installed fine and detected the device. XP with all the latest updates supports WPA2. Unfortunately the ancient (2005) SMC management utility doesn't support WPA2, only WPA at best. The native wireless management service on XP, WZC was unstable and caused a crash as soon as it was started. I didn't want to weaken the AP security to WPA.


Happily I found an open source utility called wpa_supplicant, which runs on Linux, BSD, OS/X and Windows. I installed the Windows version of this, and after filling in the credentials, the wireless connection just worked over WPA2. The GUI version of the utility requires clicking on a button to launch the service. I could install the service version of the utility to start automatically at boot, but the user interaction is not onerous for this temporary setup.


Open Source rocks, again.

Tethering a Linux machine inside VirtualBox

Yes you can.


Today I needed to test an openconnect VPN connection while inside a LAN. At this site my desktop is Windows but I needed to check connectivity from outside for Linux users, using the openconnect and NetworkManager-openconnect packages.


Let's see, I could plug my smartphone into the USB port of the desktop, forward the USB connection to Fedora 16 inside VirtualBox and I should be able to connect to usb0 and I would have a WAN connection from outside. Right?


To cut to the chase, it just works.


In the VirtualBox, make sure USB forwarding is enabled in the VM settings. Plug in the smartphone and turn on USB tethering. Ignore Windows suggestions to install hardware drivers for your smartphone. When the VM is running, there will be a USB icon on the bottom bar. Choose the USB device that is your smartphone. Windows will suggest installing a VirtualBox USB driver. Do that. On Linux a usb0 device should appear in the network manager and after disabling the eth0 device which forwards to Windows, you can connect to it. You should then get a DHCP lease from your smartphone and be connected to the outside world.


It seems you have to install the VirtualBox USB driver every time the VM is started, not sure why.


This should work on other distros. For example I know openconnect works on Debian and Ubuntu. It should also work for other VPN technologies, such as openvpn. The USB network driver is called cdc-ether, by the way.

Two gotchas with Postfix, Dovecot, Amavis and Clamav on Debian Squeeze

1. The first problem was when this error appeared in /var/log/mail.log:


Mar 10 16:56:39 mailhost amavis[2877]: (02877-01) (!)ClamAV-clamd av-scanner FAILED: CODE(0x358cef8) unexpected , output="/var/lib/amavis/tmp/amavis-20120310T165639-02877/parts: lstat() failed: Permission denied. ERROR\n" at (eval 103) line 594.


The problem is that clamav requires access to files created by amavis. We fix this by putting amavis and clamav in each other's group.



usermod -a -G clamav amavis

usermod -a -G amavis clamav

Then restart amavis and clamav-daemon.

2. The second problem was when postfix could not authenticate incoming SMTP connections by chaining to dovecot's auth process, resulting in this message in /var/log/mail.log:

Mar 10 18:28:14 mailhost postfix/smtpd[7217]: warning: SASL: Connect to /var/run/dovecot/auth-client failed: No such file or directory

The problem is that postfix runs chrooted by default in Squeeze and this named pipe is outside of the chroot tree. To fix it we tell dovecot to use this path instead:

/var/spool/postfix/private/auth-client


Then in /etc/postfix/main.cf we specify the path to the named pipe with:



smtpd_sasl_path = private/auth-client


It's a path relative to $queue_directory which is /var/spool/postfix.