<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Linux on Joel Beckmeyer&#39;s Blog</title>
    <link>https://beckmeyer.us/tags/linux/</link>
    <description>Recent content in Linux on Joel Beckmeyer&#39;s Blog</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en-us</language>
    <managingEditor>joel@beckmeyer.us (Joel Beckmeyer)</managingEditor>
    <webMaster>joel@beckmeyer.us (Joel Beckmeyer)</webMaster>
    <lastBuildDate>Mon, 22 Mar 2021 11:00:00 -0400</lastBuildDate><atom:link href="https://beckmeyer.us/tags/linux/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>Moving Back To OpenSSL</title>
      <link>https://beckmeyer.us/posts/moving_back_to_openssl/</link>
      <pubDate>Mon, 22 Mar 2021 11:00:00 -0400</pubDate>
      <author>joel@beckmeyer.us (Joel Beckmeyer)</author>
      <guid>https://beckmeyer.us/posts/moving_back_to_openssl/</guid>
      <description>&lt;p&gt;Void Linux &lt;a href=&#34;https://voidlinux.org/news/2021/02/OpenSSL.html&#34;&gt;recently announced&lt;/a&gt;
that they were going to move back to OpenSSL after originally &lt;a href=&#34;https://voidlinux.org/news/2014/08/LibreSSL-by-default.html&#34;&gt;switching to
LibreSSL in 2014&lt;/a&gt;.
It seems that there are a lot of things at play here.&lt;/p&gt;
&lt;p&gt;It seems that the main focus of the recent announcement is on the maintainability
and other difficulties of not using the &lt;em&gt;one true SSL/TLS library&lt;/em&gt;. To me,
this pragmatically makes sense. However, every time something like this happens
I get this lingering feeling of worry&amp;hellip;&lt;/p&gt;
&lt;p&gt;Microsoft moving their default browser from their own implementation to
Chromium, and other browsers following suit.&lt;/p&gt;
&lt;p&gt;Linux distributions moving &lt;em&gt;en masse&lt;/em&gt; to &lt;strong&gt;systemd&lt;/strong&gt;.&lt;/p&gt;
&lt;p&gt;Distributed email being slowly crushed and killed by Google with GMail.&lt;/p&gt;
&lt;p&gt;And many other examples that aren&amp;rsquo;t immediately coming to mind.&lt;/p&gt;
&lt;p&gt;I think it&amp;rsquo;s great that OpenSSL as a project has made a comeback from the
Heartbleed fiasco, and that it is apparently more actively developed nowadays,
but the fact that we are even at the point of moving back to OpenSSL due to
difficulties with building software is worrying. To me, it looks like a
symptom of software becoming too entrenched and dependent on a single piece
of software.&lt;/p&gt;
&lt;p&gt;This kind of accusation coming from anyone is going to be hypocritical, since
we all depend on Linux, X11, Wayland, systemd, or some common piece of software
that we take for granted and don&amp;rsquo;t lose sleep over. However, I think what&amp;rsquo;s
categorically different about this one is that an alternative was adopted,
worked on, but eventually &amp;ldquo;failed&amp;rdquo; (at least for Void, but also possibly for
Linux as well).&lt;/p&gt;
&lt;p&gt;I don&amp;rsquo;t know what the fix for this specific issue would be. I&amp;rsquo;m not nearly
familiar enough with SSL/TLS or how you would develop software to be agnostic
of dependencies like this. But I think in order to honor principles like
the Unix philosophy, the KISS principle, and countless others, we need to
figure out a way to be more modular for dependency issues like this.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>OpenWRT &#43; Unbound &#43; adblock</title>
      <link>https://beckmeyer.us/posts/openwrt_plus_unbound/</link>
      <pubDate>Fri, 05 Feb 2021 19:03:15 -0500</pubDate>
      <author>joel@beckmeyer.us (Joel Beckmeyer)</author>
      <guid>https://beckmeyer.us/posts/openwrt_plus_unbound/</guid>
      <description>&lt;p&gt;I decided to do some work on my Linksys WRT32X running OpenWRT to make it a
little more useful.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://nlnetlabs.nl/projects/unbound/about/&#34;&gt;Unbound&lt;/a&gt; is a DNS
resolver which I like because it&amp;rsquo;s recursive, meaning it directly queries the
root servers instead of relying on existing DNS servers run by Google,
Cloudflare, your ISP, or the like. I already have it running on several of my
servers and computers, but I figured it would be great if everything on my
network can use Unbound and be, well, &lt;em&gt;unbound&lt;/em&gt; from all of those intermediary
DNS servers.&lt;/p&gt;
&lt;p&gt;Luckily, OpenWRT already has Unbound packaged, and also has a useful LuCI app
that goes with it (LuCI is the graphical web interface that comes with OpenWRT).
All I had to do was install &lt;code&gt;luci-app-unbound&lt;/code&gt;, which pulls in all of the
necessary dependencies to run unbound.&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/luci_software.png&#34; alt=&#34;LuCI: Software&#34;&gt;&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/luci_install.png&#34; alt=&#34;LuCI: Install&#34;&gt;&lt;/p&gt;
&lt;p&gt;After that finished installing, I
refreshed LuCI/OpenWRT and went to &amp;ldquo;Services&amp;rdquo; on the top, and there it is!&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/luci_services.png&#34; alt=&#34;LuCI: Services -&amp;gt; Recursive DNS&#34;&gt;&lt;/p&gt;
&lt;p&gt;At this point, you&amp;rsquo;ll have to get your hands dirty. You can either dig through
some LuCI menus or SSH in and make some edits. For reference, I&amp;rsquo;m using
&lt;a href=&#34;https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md#parallel-dnsmasq&#34;&gt;&amp;ldquo;Parallel dnsmasq&amp;rdquo;&lt;/a&gt; section from the README for unbound in the OpenWRT packages (which
has a lot of other useful information as well!). Essentially, I made the edits
to &lt;code&gt;/etc/config/unbound&lt;/code&gt; and &lt;code&gt;/etc/config/dhcp&lt;/code&gt; after SSH&amp;rsquo;ing in. However, you
can make the same edits through LuCI.&lt;/p&gt;
&lt;p&gt;For the &lt;code&gt;/etc/config/unbound&lt;/code&gt; edits, you can make the edits to the file in
LuCI directly at &amp;ldquo;Services -&amp;gt; Recursive DNS -&amp;gt; Files -&amp;gt; Edit: UCI&amp;rdquo;:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/unbound_config.png&#34; alt=&#34;LuCI: Edit /etc/config/unbound&#34;&gt;&lt;/p&gt;
&lt;p&gt;For the &lt;code&gt;/etc/config/dhcp&lt;/code&gt; edits, you can make the edits by finding the same
fields under &amp;ldquo;Network -&amp;gt; DHCP and DNS&amp;rdquo;:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/dhcp_config.png&#34; alt=&#34;LuCI: Edit DHCP and DNS Settings&#34;&gt;&lt;/p&gt;
&lt;p&gt;However, the field names are different from the lines in the config, so they
would need to be researched to determine which fields in LuCI map to which
lines in &lt;code&gt;/etc/config/dhcp&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;At this point (or maybe after restarting unbound and dnsmasq, which is a lot
easier using SSH and &lt;code&gt;/etc/init.d ... restart&lt;/code&gt; as well), OpenWRT should now
be using unbound for resolving all DNS lookups, while dnsmasq is only used for
DHCP-DNS.&lt;/p&gt;
&lt;p&gt;Bonus: you can also enable a nice status dashboard in LuCI under
&amp;ldquo;Services -&amp;gt; Recursive DNS -&amp;gt; Status&amp;rdquo;, but this requires installing several more
software packages: &lt;code&gt;unbound-control&lt;/code&gt; and &lt;code&gt;unbound-control-setup&lt;/code&gt;. You will also
need to change a line in &lt;code&gt;/etc/config/unbound&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;...
option unbound_control &amp;#39;0&amp;#39;
...
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;becomes&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;...
option unbound_control &amp;#39;1&amp;#39;
...
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;A word of warning: there is another section on &amp;ldquo;Unbound and odhcpd&amp;rdquo; which
tries to cut out dnsmasq completely. However, when I tried to set this up,
I got myself into a lot of trouble (had to reset OpenWRT, re-install any extra
software packages, and restore configuration from backup). It is also possible that if you mess up
the configuration for the &amp;ldquo;Parallel dnsmasq&amp;rdquo; method, you could end up in a
similar error state and have to start over. Please be careful when doing this
and don&amp;rsquo;t change anything you&amp;rsquo;re not supposed to.&lt;/p&gt;
&lt;p&gt;Now, moving on to adblock, which should be &lt;strong&gt;much&lt;/strong&gt; simpler to setup. First,
install &lt;code&gt;luci-app-adblock&lt;/code&gt; and refresh. Navigate to &amp;ldquo;Services -&amp;gt; Adblock&amp;rdquo;:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/adblock.png&#34; alt=&#34;Services -&amp;gt; Adblock&#34;&gt;&lt;/p&gt;
&lt;p&gt;Check the settings at the bottom. The only thing you need to get going is
to go to the &amp;ldquo;Blocklist Sources&amp;rdquo; tab and choose your blocklists.&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/adblock_blocklist.png&#34; alt=&#34;Adblock: Blacklist sources&#34;&gt;&lt;/p&gt;
&lt;p&gt;The
&lt;a href=&#34;https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md&#34;&gt;adblock readme&lt;/a&gt;
has some more info on what each list is. After that,
make sure &amp;ldquo;Enabled&amp;rdquo; is checked under the &amp;ldquo;General Settings&amp;rdquo; tab:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/adblock_enable.png&#34; alt=&#34;Adblock: enable&#34;&gt;&lt;/p&gt;
&lt;p&gt;and click the &amp;ldquo;Refresh&amp;rdquo; button above:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;https://beckmeyer.us/adblock_refresh.png&#34; alt=&#34;Adblock: refresh&#34;&gt;&lt;/p&gt;
&lt;p&gt;Then you&amp;rsquo;re good to go; adblock should work out of the box with unbound; cheers!&lt;/p&gt;
&lt;p&gt;ADDENDUM: Another word of warning: once you&amp;rsquo;ve setup adblock, it will download
the blocklists, merge them into a single file at &lt;code&gt;/var/lib/unbound/adb_list.overall&lt;/code&gt;,
and try to restart unbound. I recommend not trying to view/interact with adblock
or unbound during this restart, which can take anywhere from 30 seconds - 2 minutes.
Just leave them alone in LuCI for a little bit&amp;hellip;&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Hello doas</title>
      <link>https://beckmeyer.us/posts/hello_doas/</link>
      <pubDate>Sat, 30 Jan 2021 15:15:55 -0500</pubDate>
      <author>joel@beckmeyer.us (Joel Beckmeyer)</author>
      <guid>https://beckmeyer.us/posts/hello_doas/</guid>
      <description>&lt;p&gt;Today, I switched my workstation from &lt;code&gt;sudo&lt;/code&gt; to &lt;code&gt;doas&lt;/code&gt;. I&amp;rsquo;m running Void Linux,
and the process was fairly easy.&lt;/p&gt;
&lt;p&gt;First, I needed to figure out how to remove &lt;code&gt;sudo&lt;/code&gt; (yes, I realize I could have
installed &lt;code&gt;doas&lt;/code&gt; first, then removed &lt;code&gt;sudo&lt;/code&gt;, but I decided to do it the hard way.)
As it turns out, the &lt;a href=&#34;https://docs.voidlinux.org/xbps/advanced-usage.html#ignoring-packages&#34;&gt;advanced usage section of the XBPS manual&lt;/a&gt; details how to use the &lt;code&gt;ignorepkg&lt;/code&gt; entry in xbps.d with nothing
other than this exact use case! I created the file &lt;code&gt;/etc/xbps.d/20-ignorepkg-sudo.conf&lt;/code&gt; with contents&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ignorepkg=sudo
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;and then ran &lt;code&gt;sudo xbps-remove sudo&lt;/code&gt; (an ironic command).&lt;/p&gt;
&lt;p&gt;After that, because I was stupid and removed &lt;code&gt;sudo&lt;/code&gt; before I had set up &lt;code&gt;doas&lt;/code&gt;,
I had to use plain-old &lt;code&gt;su&lt;/code&gt; to change to the root user and run &lt;code&gt;xi opendoas&lt;/code&gt;. I also
configured &lt;code&gt;doas&lt;/code&gt; in &lt;code&gt;/etc/doas.conf&lt;/code&gt; with the following:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# see doas.conf(5) for configuration details
permit nopass keepenv :admin
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I ran &lt;code&gt;groupadd admin&lt;/code&gt;, &lt;code&gt;usermod -aG admin joel&lt;/code&gt;, and then logged out so that my
user account would see the new group perms.&lt;/p&gt;
&lt;p&gt;And just like that, I can now run &lt;code&gt;doas xbps-install ...&lt;/code&gt; and all of my other commands,
just substituting &lt;code&gt;doas&lt;/code&gt; for &lt;code&gt;sudo&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;The one thing I immediately missed was &lt;code&gt;sudoedit&lt;/code&gt;. Before I accidentally tried
to use &lt;code&gt;sudo&lt;/code&gt; for the first time, I had already accidentally tried to run &lt;code&gt;sudoedit&lt;/code&gt;
&lt;em&gt;at least&lt;/em&gt; 5 times. I had to fix this. I saw a discussion on Reddit where &lt;a href=&#34;https://www.reddit.com/r/linux/comments/l6y7nv/is_doas_a_good_alternative_to_sudo/gl4hs42?utm_source=share&amp;amp;utm_medium=web2x&amp;amp;context=3&#34;&gt;one user
suggested&lt;/a&gt; writing a script to replace the &lt;code&gt;sudoedit&lt;/code&gt; functionality.
I quickly starting hacking together something like that. I started with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
mkdir -p /tmp/doasedit
doas cp $1 /tmp/doasedit/tmp_file
$EDITOR /tmp/doasedit/tmp_file
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;And quickly ran into my first road-block. The script is going to have to change
the permissions of that file before the user can edit it. But if the script changes
the permissions, how can I restore it to the original location with the right
permissions? &lt;code&gt;cp /tmp/doasedit/tmp_file $1&lt;/code&gt; won&amp;rsquo;t work. I thought about just using
cat to overwrite the file contents in-place (&lt;code&gt;cat /tmp/doasedit/tmp_file &amp;gt; $1&lt;/code&gt;).
That &lt;em&gt;could&lt;/em&gt; create some issues if a program has the file open. Instead, a better option
is to create two copies of the file&amp;ndash;one for editing, and one for preserving file
attributes:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
mkdir -p /tmp/doasedit
doas cp $1 /tmp/doasedit/edit
doas chown -R $USER:$USER /tmp/doasedit/edit
doas cp $1 /tmp/doasedit/file
$EDITOR /tmp/doasedit/edit
cat /tmp/doasedit/edit | doas tee /tmp/doasedit/file 1&amp;gt;/dev/null
doas mv -f /tmp/doasedit/file $1
rm -rf /tmp/doasedit
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Of course, the issue with this is that it only works with absolute paths.
I want to make it work for relative paths as well. I&amp;rsquo;m going to take advantage
of &lt;code&gt;realpath&lt;/code&gt;, which is part of the &lt;code&gt;coreutils&lt;/code&gt; package from Void. As a bonus, this
will also take care of the edge case where the given file is a symlink (IIRC,
&lt;code&gt;sudoedit&lt;/code&gt; didn&amp;rsquo;t follow symlinks, so I may be diverging here):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
mkdir -p /tmp/doasedit
srcfile=&amp;#34;$(realpath $1)&amp;#34;

doas cp $srcfile /tmp/doasedit/edit
doas chown -R $USER:$USER /tmp/doasedit/edit
doas cp $srcfile /tmp/doasedit/file

$EDITOR /tmp/doasedit/edit

cat /tmp/doasedit/edit | doas tee /tmp/doasedit/file 1&amp;gt;/dev/null
doas mv -f /tmp/doasedit/file $srcfile

rm -rf /tmp/doasedit
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;At this point, it works&amp;hellip;okay-ish. It can only be used in one instance currently
since I hard-coded &lt;code&gt;/tmp/doasedit/file&lt;/code&gt; and &lt;code&gt;/tmp/doasedit/edit&lt;/code&gt;, but that&amp;rsquo;s easily fixed:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh

destfile_pfx=&amp;#34;$(cat /dev/urandom | tr -cd &amp;#39;a-f0-9&amp;#39; | head -c 32)&amp;#34;

while [ -d &amp;#34;/tmp/doasedit/$destfile_pfx&amp;#34; ]; do
	destfile_pfx=&amp;#34;$(cat /dev/urandom | tr -cd &amp;#39;a-f0-9&amp;#39; | head -c 32)&amp;#34;
done

mkdir -p /tmp/doasedit/$destfile_pfx
srcfile=&amp;#34;$(realpath $1)&amp;#34;

doas cp $srcfile /tmp/doasedit/$destfile_pfx/edit
doas chown -R $USER:$USER /tmp/doasedit/$destfile_pfx/edit
doas cp $srcfile /tmp/doasedit/$destfile_pfx/file

$EDITOR /tmp/doasedit/$destfile_pfx/edit

cat /tmp/doasedit/$destfile_pfx/edit | doas tee /tmp/doasedit/$destfile_pfx/file 1&amp;gt;/dev/null
doas mv -f /tmp/doasedit/$destfile_pfx/file $srcfile

rm -rf /tmp/doasedit/$destfile_pfx
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;At this point, the only thing missing is the check to see if the file was actually
edited:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;...
cat /tmp/doasedit/$destfile_pfx/edit | doas tee /tmp/doasedit/$destfile_pfx/file 1&amp;gt;/dev/null

if cmp -s &amp;#34;/tmp/doasedit/$destfile_pfx/file&amp;#34; &amp;#34;$srcfile&amp;#34;; then
	echo &amp;#34;Skipping write; no changes.&amp;#34;
else
	doas mv -f /tmp/doasedit/$destfile_pfx/file $srcfile
fi
...
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I put this in a &lt;a href=&#34;https://github.com/AluminumTank/doasedit&#34;&gt;repo on GitHub&lt;/a&gt; if
anyone is interested. I know that a major
weakness of this script is the number of times it calls &lt;code&gt;doas&lt;/code&gt;, which could
break flows where password is required every time &lt;code&gt;doas&lt;/code&gt; is run.&lt;/p&gt;
</description>
    </item>
    
  </channel>
</rss>
