Category: Someday you will need this

New kernel and new target

You should perform a full world and kernel install if on master.

Several people (including me) have been getting bit by a problem: when performing an installworld with a changed kernel, the vn kernel module is loaded, but it was built by the previous kernel and may cause problems when it doesn’t match up.

To fix that, vn is now built in, instead of being a separate module.  The rescue initrd (which is what is being mounted when it has this problem) is now installed via a ‘make rescue‘ command that can wait until a successful installworld and reboot.

iwn trick: ifconfig wlan0 -ht

If you have a DragonFly system with an iwn wireless chipset, and you are having trouble connecting and running in the 5Ghz part of the spectrum only, here’s a tip: the -ht switch may fix it.

Improvements for qemu

While Matthew Dillon was testing the new up-to-256-processor support for DragonFly, he added a few sysctls, one of which helps qemu performance when emulating a lot of processors.  I note it here in case it’s helpful to someone else.

How to keep Hammer empty

A note for everyone: use Hammer default on a very busy filesystem, and you will eat a lot of disk space since all file changes are recorded.  (I’ve done this to myself a few times.)  Francois Tigeot has a list of tips on how to keep that from happening.

Hammer and buffers

Are you running a Hammer filesystem on a low-memory system?  You may get some warnings.  It’s possible to tweak some settings to accommodate it, or just deal.

Books discounted at O’Reilly

O’Reilly is running a 50% off special on a variety of books on electronics, with coupon code WKECTRC.  I’m posting it now because it only lasts for this week.

Update: another offer just popped up in my email – 50% off various “web performance and operations” books with the code CFVLTY4.

Posted by     Categories: Books, Someday you will need this     0 Comments

Building with the system OpenSSL

If you’re building ports, it will treat OpenSSL as a dependency and bring in whatever version is available.  If perhaps you want to use the version of OpenSSL installed as part of your base system, Robin Hahling has the answer for how.  (This probably works on FreeBSD too.)

locking(9) man page added

Thanks to Markus Pfeiffer, there is now a locking(9) man page for use the next time you say, “Which is the right lock to use?”   Something I see almost monthly.

In Other BSDs for 2014/05/10

Short week, cause I’m on the road…

Posted by     Categories: BSD, Someday you will need this     2 Comments

LibreSSL gets started

Remember the joke I and probably a zillion others made about OpenOpenSSL?  It’s happening, except it’s called LibreSSL. (thanks, Tomáš Bodžár)

Posted by     Categories: BSD, Someday you will need this     3 Comments

GUI images for DragonFly 3.6 sort of

If you noticed the lack of a GUI DVD image for the 3.6 release of DragonFly, I posted a followup note on the users@ list that talks about the steps to get X installed.  It’s not much work, with pkg set up.

Backing up Hammer to non-Hammer volumes

Hammer’s ability to stream to remote disks is great, but what if you have storage that uses some other file system?  Antonio Huete Jimenez put together a shell script that will dump out the contents of a Hammer PFS, for upload to whatever.  Read the README for the details.

pfi and authorized_keys support

pfi, the automated installer that nobody knows about, now supports installing an authorized_keys file as part of an install.  Credit goes to Alex Hornung for adding the functionality.

Did I mention new USB?

There’s been periodic commits updating the USB4BSD support in DragonFly; I haven’t been linking to them because they are generally incremental. However, it’s good to (re?)mention just how you can build DragonFly with that new USB support.

Time zone changes

Recent updates to tzcode apparently fixed a long-standing time zone bug in DragonFly.  POSIX says the America/New_York timezone is picked as default if nothing else has been selected.  That didn’t happen in DragonFly – until recently.  If your timezone seemed to suddenly jump to U.S. Eastern time, that’s because you never picked before.

32-bit DragonFly 3.7 and dports

There are no binary packages built for dports, on DragonFly 3.7, for 32-bit machines, at this time.  Pierre Abbat found this out.  You can build from source, of course, or just use 3.6 packages.  Don’t forget -DBATCH to avoid getting asked for build options when building from source.

Trackpad support summary

I didn’t post this before, and should have: Matthew Dillon posted a summary of all the trackpad improvements he added, and how to make use of the various features.

Hal, dbus, and VMWare tip. Also pkg locking

Warren Postma found that hal and dbus caused a crash in VMWare for DragonFly.  The answer is to use moused, not dbus.

Also, if you want to keep a custom or just older package from dports on your system, as karu.pruun did, ‘pkg lock’ is the answer.

Lazy Reading for 2014/01/12

There’s a lot this week, so let’s get started:

Git Reference.  Not that there isn’t a lot of other documentation out there, but much of what you find is people asking specific questions rather than explanations of procedure.  (via)

Movie Code.  At least most of these are using legit code, even if it’s often the wrong application.  It’s been worse.  (See ‘state of the art video’ item)  (via)

Unix: 14 things to do or stop doing in 2014.  These tips are actually useful and contain no buzzwords.

TrewGrip, another item in my quest for interesting keyboards I don’t use.

4043 bytes to recreate a mid-80s IBM PC.  There are less bytes of data in the program than there were transistors in the CPU that it emulates.  It can run MS Flight Simulator.  It was for the International Obfuscated C Code Contest, which should surprise you not at all.  (via)

The World’s Most Pimped-Out ZX81.  I don’t think it can run Doom, though.

The Unix Shell’s Humble If.  For once, an article that doesn’t just pretend bash is the only shell that exists.  (via)

Unix Shell RPG Tutorial.  It’s exactly what that combination of words means.  (via)

Scientists tell their favorite jokes.

Best programmer jokes, found here where there’s more.

I find these animations slightly hypnotizing.  (via)

Technology used to suck even when it was cutting-edge, and we’ll still feel that way in the future.  (via)

How did we end up with a centralized Internet?

Software in 2014.  The summary is: server side is great, client is not.  (via)

Able to be turn on, and that is it.  Sci-fi movies ignore where technology comes from.

True Nuke Puke Story.  My mine coworkers once did something similar to a copier repairman; got him so worried about going underground that he had a panic attack when he had to step on the hoist.  We had to get a new repairman.

Your unrelated link of the week: BIG ENDING FACES!  (via)

RTL8191SE support

‘M M’ had trouble with his “Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC” on DragonFly some time ago.  He was able to get it working, and he documented the somewhat convoluted procedure here.

Tracking the bleeding edge of DragonFly

If you want to track the bleeding edge of DragonFly, which is currently version 3.7, I happened to describe it in a reply to Filippo Moretti, on users@.  Long-time users will know this/do this already, but it’s worth repeating just because new users may not realize how easy it is.

Posted by     Categories: DragonFly, Someday you will need this     0 Comments

My DragonFly 3.6 upgrade adventure

Here’s how my upgrade from DragonFly 3.4 to 3.6 for this server went.

The system install went normally.  I rebooted before performing ‘make upgrade’, as noted in UPGRADING and elsewhere.

I already have dports installed, so a binary upgrade should be possible.  I had heard of people with older version of pkg, having trouble getting it to notice upgrades.  I rebuilt pkg, and ran ‘pkg upgrade’.  A number of the updates coredumped.  Here’s one example:

[156/160] Upgrading gtk2 from 2.24.19 to 2.24.19_2...Segmentation fault 
(core dumped)

After the upgrade, I had two problems: PHP wasn’t working for the website, and some programs would segfault.

The random segfault was fixable by forcing a binary upgrade of all packages.  Since there were some programs on the system that were still new enough that the version number was the same as on the remote repository, pkg didn’t upgrade them.  Those packages were linked against old versions of system libraries that predated the locale changes in DragonFly 3.6, so they’d crash.  Forcing the update for all packages fixed the issue.

The other problem, PHP on the web server, is not new to me.  The binary package for PHP does not include the module for Apache.  The solution is to build from source with that option selected.  I understand that pkg is destined to support (some?) port options in the future.  There’s also an immediate workaround for locking it.

However, the port would not build because of a security issue.  The binary package installed without any warning.  This, I am told, will change to pkg giving you the option to install if you are aware of the security problem, and whether it really affects you.  (which is just what I want, yay!)

Anyway, other than the system changes biting me because I didn’t realize some packages weren’t updated, it went very quickly.  That is the reason for binary updates through pkg, or at least a major one.

Lazy Reading for 2013/12/22

Still quiet out there, but I found some good reading.

PHP functions originally named for string length and sorting.  Yeesh.  (via)

A great old-timey game programming hack.  There’s an initial speed hack in this story, and then there’s another clever trick to fix memory corruption.  (via)

My hardest bug.  This was a pretty fiendish problem.  (via)

Gitdown: don’t commit when drunk.  I’ve done that.  Actually will use an Arduino-based breathalyzer.  (via)

Another Perl One-Liners review.

Zeno of Elea, a game.  It’s based on a classic… (via)

Vim plugins you should know about.  From that One-Liners author.

Speaking of Perl, here’s a Larry Wall interview.  An old-school hacker – he wrote patch, too.

Moonpig: a billing system that doesn’t suck.  An in-depth review of system design.  More Perl, too.

Three Books You Should Read…  Mostly BSD content.

How to use Tor wrong, in multiple ways.  It’s not for petty crimes, and it’s not any use when you’re using it from a monitored network.  (via)

Your unrelated comics link of the week: Cookie Puss.

Who’s for an OpenPF?

Things are very quiet this week; I’ve had nothing to post for some days – DragonFly or even for other BSDs.  The end of the year has most people distracted, I think.  This makes it a good time to bring up something that’s been bothering me: the state of software firewalls in BSD.  The pf utility is a BSD advantage; I’ve heard people say “I used iptables on Linux and pf is a much better alternative.”  I know that’s anecdotal, but there it is.  Here’s the question, and the reason I’m writing this: which pf?

DragonFly has a version of pf equivalent to what was shipped in OpenBSD 4.4.  FreeBSD has a version equivalent, I think, to OpenBSD 3.8 4.5′s pf, and it has been further modified.  NetBSD has a similar, older pf, but there’s people working on a NetBSD-specific version called npf, which isn’t yet ready.  And of course, OpenBSD has its version of pf.  If you feel good about these different alternatives, you call it divergence.  If you don’t feel good about it, you call it fragmentation.

Compare this to OpenSSH – it works the same on each platform.  There’s no confusion on how to configure it, or interoperability problems.  It would be wonderful to have the equivalent for pf, where other BSD platforms would import a portable version.  This software firewall is a strength, and it’s much easier to tout it when there’s only one.

I doubt there’s a way to bring it all back to one source tree.  There’s a lot vested in the different forks out there.  You know what would take a lot less effort: a compatibility test suite.  Agreeing on a common syntax and set of functions would make life easier for every end user.  It would incidentally make vendors a lot happier, too.  Even if a user or vendor wasn’t hoping to move between BSD flavors, a test suite would still guarantee a certain known level of functionality for any BSD release.

How likely is this?  I don’t know.  But I want to bring up the notion before it gets missed.  Now is a good time, with each pf version still being relatively close to one another.

Update/note: Henning Brauer is willing to help.

Posted by     Categories: BSD, Someday you will need this     10 Comments

Holiday shopping guide 2013

For those of you doing last-minute holiday shopping – like me: see previous years of gift links.  There’s also a number of comics lists, book lists, and game guides.  And of course, donations.

Posted by     Categories: Off-Topic, Someday you will need this     0 Comments

A pkg fix for 3.4 upgraders

If you have a DragonFly 3.4 system that has already been switched over to dports, and you upgrade it to DragonFly 3.6, you might see an odd problem.  Rebuild pkg, and it will work.

I’ve only seen a few reports, so I don’t know if this is even likely to happen to most upgraders.

In Other BSDs for 2013/12/07

Happy birthday to me!

Remember: manually clean up offline Hammer volumes

If you have a Hammer volume that is offline, meaning that you don’t have the pseudo-file-systems null-mounted anywhere, it won’t get cleaned up in overnight processing.  You just have to manually specify it.

Minimal installation notes

This post from Konrad Neuwirth asking how to do a minimal installation of DragonFly led to this list of all the ‘knobs’ you can set to make your installation smaller, from John Marino.  (And your buildworld faster, if that’s appealing to you.)  I also pointed at rconfig and PFI, which are criminally underdocumented.

DragonFly in KVM

If you’re planning to run DragonFly in KVM, remember this post from Matthew Dillon, giving the settings he uses.  This will save you a bit of time.

Lazy Reading for 2013/11/17

It’s been snowing this week in the northeast US, which makes me happy.

  • Unix: sending signals to processes.  Signals have always struck me as a somewhat byzantine messaging system that everyone uses for the equivalent of Ctrl-C.
  • Unix: Debugging your scripts.  This will be useful if it’s not already familiar to you.
  • Compatibility is Hard.  Contrary to popular belief, Microsoft Word documents are not backward or forward compatible, from release to release.
  • From that previous link: Why Microsoft Word Must Die.  The worst problems to troubleshoot are when someone says “Word/Excel is acting funny”.  There’s so many intermediate layers of software in those programs that it’s difficult to find the actual data and the actions being performed on it, much less troubleshoot any process.
  • moved from MySQL/MariaDB to Postgres.  I agree with the sentiments in the article, but I want to know the technical reasons that made Postgres the choice for scaling.  (via)
  • Apple ][ DOS source code.  I don’t have anything I can actually do with the source, but there’s a 1977 price list pictured in the the article that shows some interesting numbers: A 4Kb RAM system costs about $1300, and the prices just go up from there.

Your unrelated comics link of the week: the first four pages of Necropolis.  This comic looks to be fun.

Posted by     Categories: Someday you will need this, UNIXish     2 Comments

Book review: Sudo Mastery

If you’ve seen my previous two reviews of Michael W. Lucas’s ‘Mastery’ books – DNSSEC Mastery and SSH Mastery - then you can guess what this will be: his newest book, focusing on a single software topic.  This time it’s sudo.


The one downside of reading this book: I now am aware I’m using sudo wrong.  Perhaps not wrong, but not anywhere near its potential.  Sudo – and I’m not the only person who has experienced this – is used as a “Let’s install sudo so we don’t have to tell anyone the root password”.  Sudo works for that sort of thing, but there’s a lot more possibilities.

Sudo is designed to be deployable across multiple systems, as part of a security policy.  It’s an easy way to create purpose-shaped roles with different users, especially with users that have specialized skills and tasks, like database maintenance.

Obviously I think better of sudo after reading the book; there’s a lot of program capabilities of which I was unaware, but it’s the book that sells them.  Michael W. Lucas’s humor is on display again, to break up some very technical material.  Here’s some bits, pulled out.

Remember that “syntactically valid” is not the same as “does what you want.”

Pressing Q tells visudo to break sudo until you log in as root and fix it. Do not press this button. You won’t like it.

Here I create the TAPEMONKEYS alias for the people who manage backups.

And if Carl tries to configure Oracle on the PostgreSQL server, senior sysadmin Thea needs to have sharp words with him. Probably involving a tire iron.

The book is in-depth enough to cover more complex topics like using sudo and Active Directory, and sudo as an intrusion detection tool, of all things.

The usual reasons to buy a Mastery book are all still there: it specifically mentions working on BSD systems instead of pretending Linux is the only system out there.  It’s available through a DRM-free seller (Smashwords) in addition to Amazon.  It’s a self-published effort, not shovelware.  It’s available now as an ebook, and in physical form soon.  Lucas talks about it on BSDNow 010, too.

I have one last nontechnical note.  Since these Mastery books are working into a series, I’d like to see a whole printed run of visually matching books.  Something with the equivalent of the O’Reilly animals or the Pelican or even Little Blue Books common look and feel.

You know the look even if you don't know the publisher

The takeaway: You should be reading this book if you plan to use sudo in any sort of multiuser environment.  It’s available as an e-book direct from the author, via Amazon, via Smashwords, and possibly Barnes & Noble at some point in the near future.  Physical books are available, and you can buy both forms together, apparently.

And of course this sudo joke.

Posted by     Categories: Books, BSD, Someday you will need this     0 Comments

Lazy Reading for 2013/11/10

I spent this entire week saying things like “Wait, today’s Tuesday?” and “I thought this was Wednesday, not Thursday.”

  • Welcome to my GUI Gallery, a whole lot of different GUI screenshots.  This mention of the “Salto” Alto emulator brought me there, and there’s some material I’ve never seen before.  Also, there’s Bob.  Not “Bob” the prophet, but Bob, the computer mistake.  Speaking of problematic designs, see the Windows 8 page.
  • 5 Cool UNIX Hacks.  Sounds linkbaity, but it’s useful.  I didn’t realize that CTRL-a is the non-destructive version of CTRL-u.  (via)
  • This seems strange, but I never heard of PLATO, even though it seems to be the precursor to so much.  (via)
  • Goodbye Google“, in terms of switching to your own platform, seems to be a new trend.
  • arkOS, a similar idea.
  • Finding Files Your Way.  I can never remember all the arguments to ‘find’.
  • Google has a Shell Style Guide.  Which equates to a Bash Style Guide, but that’s OK.  Shell scripts are sometimes considered the most disposable form of programming, so it’s good to see a full guide.  (via)

Your unrelated animation of the week: late for meeting.  A followup to going to the store, which I think I posted here years ago.

In Other BSDs for 2013/11/02

There’s a surprisingly large list this week.

Lazy Reading for 2013/09/15

I think I’m finally catching up on the backlog.

Your unrelated link of the week: The Alan Lomax recordings.

Lazy Reading for 2013/09/01

Another week of links completed early.  And there’s a lot, so get clicking!

Your unrelated link of the week: The remix of this 1997 Kid’s Guide to the Internet - somewhat NSFW, and has all the best moments.  More from EVERYTHING IS TERRIBLE.

Lazy Reading for 2013/08/11

Again, lots of links.  Some of these are overflow from previous weeks where I just said “That’s enough; let’s work on the next Lazy Reading.”

Your unrelated link of the week: Mighty Taco radio ads.  Mighty Taco is a Mexican fast food place from Buffalo, New York, USA.  It’s about as authentically Mexican as fast food from a city on the edge of Canada can be, which is ‘not much’.  I’ve always loved the food, though, and the commercials are just the right mix of amateur joke and commercial advertising.

Bonus unrelated: If you enjoy imgur/fukung but it’s not youtubey enough, hit ‘Random’ on a few times.  You may want to turn down your volume.

Just kill everything

killall -T will now kill all processes associated with the current tty, except parents of the killall process itself.  It’s a shortcut to “kill all these runaway items I started by accident”.

Lazy Reading for 2013/07/21

Last week was relatively light, but somehow this week I read a zillion interesting things.  It’s been too dang hot to do much else, other than flop in a chair and point a fan at my head.

Your unrelated link of the week: Bones Don’t Lie.  An anthropologist who blogs about various discoveries of human remains.  I really enjoy blogs where someone is talking about a subject they care about – not to sell a product, not to be paid (directly), but just because they like the topic and they want to share it with others.  Of course I would think that, wouldn’t I?

Avoiding non-routeable IPs

It’s possible your Internet service provider uses a non-routeable IP range (like 10.*) and occasionally your border device picks that up via DHCP by accident instead of an Internet address.  If that happens to you, and you’re using DragonFly as your border gateway, it’s possible to prevent it with PF dhclient.

Posted by     Categories: DragonFly, pf, Someday you will need this     2 Comments

Another tip: cleaning up a really, really full Hammer drive

If you get your Hammer drive really full, a normal cleanup won’t make enough space.  When that happen, use ‘hammer reblock’ in increasing increments.  That works because it does cleanup in much smaller steps.

Posted by     Categories: DragonFly, Someday you will need this     0 Comments

An X tip on terminal switching

Switching terminals in X with ctrl-alt-Fx requires a not-on-by-default option.  This could catch anyone used to the old behavior, so I might be doing you a favor by mentioning it.

Posted by     Categories: Someday you will need this, UNIXish     2 Comments

PRISM, privacy, and what you make yourself

If you’ve been reading the Digest for a while, you’ve seen me talk about the value of hosting or running your own services.  It’s not too much of a surprise in my case; if you are working on an open-source operating system, you want to run it.  It’s good to get the experience, and you can run programs the way you want, instead of picking from whatever vendors happen to sell you.

The PRISM disclosure, which I am going to assume everyone is familiar with at this point, is another facet.  Every time you use another company for your email, your entertainment, your software, and so on, their information on you can be accessed.    This isn’t a problem that can be fixed by going from one webmail provider to another.  You can shop around, but notice that the author in that link effectively throws his or her hands in the air and says, “there’s no way out” by the end of the article.  This is because corporations work as collecting agents for the government, even if they don’t plan to do so.

That sounds drastic, but there’s legal frameworks in every country for governments to require companies to give up data on any person, on request.  It happens.  I’ve seen it myself; I worked for Time Warner for several years, tracking down cable modem user information and handing it over as compelled by law.  I know the lawyers at TW Corporate didn’t like doing it, but they didn’t have a choice.  (I have some horrifying stories about what people would do to themselves and each other.)

Companies are increasingly working to create services to sell, not products to buy.  A service never stops being consumed, so it forms an ongoing revenue stream.  I’m not saying this is bad; I firmly believe that a financial incentive to be paid improves services.  However, as only a consumer, you can end up not owning what you use.  Other people have pointed this out, and I don’t want to sound like a frothing crazy person… but it is relevant, though not necessarily as catastrophic as some people pronounce.

What I’m working towards here is a reminder that you should run your own software, and running it on DragonFly is the best way.  (Or some other operating system, I guess.  If you have to.)  Instead of trying to figure out what the least-bad commercial option can be, run it yourself.  Good for privacy, good for learning.  I know that’s not an option for everyone; fighting with Sendmail (for instance) is not an activity that many people pick voluntarily.  But, if you’ve been thinking of setting up a replacement for Google Reader, or hosting your own mail, or own blog, etc… there’s never a better time than now.

(Follow all those links for some good information; consider it an early Lazy Reading post)


Old amd64 removed and extra upgrade step added

The ‘amd64′ specific parts of kernel architecture have been removed, since x86_64 covers all that.  As a side effect of other changes, John Marino warns that upgrading DragonFly from a version older than 3.4, to a version newer than 3.4, will require an intermediate step of going to 3.4 first.  e.g. If your machine is a DragonFly 3.0 system, you will need to upgrade to 3.4 before moving to, say, 3.6 once it is out.  This won’t matter for some months, since the next release is months off.

Lazy Reading for 2013/06/09

Not as wordy this week, but still wordy.  And linky!

  • Max Headroom and the Strange World of Pseudo-CGI. A discussion of how old fake CGI can look better than modern, real CGI. This is an opinion I’ve had for quite a while, and my children pretty much ignore it every time I bring it up.  (via)
  • The Colby Walkmac, which predates the Mac Luggable.  Linked to because it includes good pictures of what the (external) hardware was like.  I find all the old ports interesting, since it’s all USB and the occasional eSATA these days… not that I’m complaining!  I’ve never had a good experience with a 9-pin serial port.  (via)
  • A brief education on escaping characters.
  • I get worried when remotely rebooting a server in a different town or even state.  In Praise of Celestial Mechanics covers much more stressful circumstances: interplanetary reboots.  Does Voyager 1 or 2 have an ‘uptime’ function?
  • The equivalent of what you are doing right now, 20 years ago.  I personally never got to see this; my experience was MUDs.  Speaking of which…
  • The Birth of MMOs: World of Warcraft’s debt to MUD.  MUD == MMO, Roguelike == Diablo/Torchlight, Doom == almost everything else.  There’s a number of game archetypes that haven’t changed in some time.  (via)
  • Playing with powerlines.  I used to work at a company that used these lines for data transfer.  It was neat technology, but it sure wasn’t easy to set up.  Imagine wiring a city but only being able to use Ethernet hubs.  Not switches, hubs.  That, combined with undersized ARP caches/MAC tables, made it really difficult.
  • OpenVPN on FreeBSD, which will come in handy for at least several readers, I’m sure, as the directions should apply to any BSD.
  • Is there anything DNS can’t be used for?  Cause now it’s domain-based mail policy publishing.  (via ferz on EFNet #dragonflybsd)
  • Have you tried DragonFly?” posts on various forums seem to pop up with some regularity.
  • Uses of tmux, explained.  A slide show talking about how tmux works.  (via)

Unrelated link of the week: I’ve had several deadlines and a mail server with issues this week at work, so this is all I got.

Adding to dports

Since dports uses FreeBSD ports as a base, adding something to FreeBSD ports means it will show in dports, too.  However, it doesn’t have to go that way.  It’s possible to have dports packages that exist only in dports.  If you have changes to a port that make it compile on DragonFly, that can be added too.  For all of that, go to the dports issues page on GitHub.

Creating new pkgsrc packages, a lesson

Johnathan Perkin has a nice tutorial up about creating pkgsrc packages.  It’s done on SmartOS, but I imagine it’ll generally apply to anything pkgsrc supports.

Posted by     Categories: pkgsrc, Someday you will need this     0 Comments

Book review: DNSSEC Mastery

Michael W. Lucas recently wrote and self-published a new book, DNSSEC Mastery.  He asked me to review it, and I’ve been reading it in bits and starts over the past few very busy weeks.

First, the background: If you’re not familiar with the acronym, it’s a method of securing DNS information so that you can trust that domain name information is actually from the machine that’s supposed to provide it.  DNS information is basic to Internet operation, but it traditionally has been provided without any mechanisms to deal with misinformation or malicious use.  This seems to happen with protocols that have been around for many years, as any mail administrator can tell you…

In any case, ‘DNS poisoning’ (or as Wikipedia calls it, ‘DNS Spoofing‘) attacks such a basic part of how the Internet works that it will completely bypass any security methods that assume name information is correct.  DNSSEC is a way to deal with that.  It introduces public-key encryption into the process of sharing and updating DNS information.  The idea has been around for a while, but it’s only been completely implemented recently.

DNSSEC Mastery goes over this history, and through the setup required to get (recent) BIND working with DNSSEC.  Lucas seems to be starting a series of ‘Mastery’ books, where he covers all the territory around a specific topic.  This one, like his previous title, is exactly what it says.  As long as you have some existing clue around zone files and DNS, the book will take you from no DNSSEC at all to fully implemented in less than 100 pages.  (well, at least in the PDF version, but that gives you an idea of the size.)

Use it to learn, or use it as a quick reference – either way will work.  If you have any DNS server(s) to manage, you’re the target audience.  I expect DNS without these security extensions will go the way of telnet vs. ssh.

A book covering things like new encrypted hash zone record types is going to be a bit dry, but there’s an appropriate sprinkling of humor through the book.  I’ve reviewed other Lucas books before, and I’ve got another on my plate right now, but this is the same: there’s plenty of funny to make the lessons go down easier.

DNSSEC Mastery: Securing the Domain Name System with BIND is available on AmazonBarnes & NobleSmashwords, and his self-publishing site.  Also see Peter N. M. Hansteen’s review of the book.


Posted by     Categories: Books, Someday you will need this     1 Comment

How about Ansible?

Ansible seems to be a configuration management system that’s lighter than puppet or salt.  I had a student talking about it in my class tonight.  BSD users Hubert Feyrer and Michael W. Lucas have both posted about it recently.  Anyone want to repeat their experiences?

Posted by     Categories: BSD, DPorts, pkgsrc, Someday you will need this     3 Comments

Transmission server directions

If you were perhaps thinking of setting up transmission-daemon, a BitTorrent server, this post on will help you out.

Posted by     Categories: pkgsrc, Someday you will need this     0 Comments

HAMMER file system resizing

If you’ve ever wondered about how you can resize/move a HAMMER filesystem, follow this thread for a variety of answers.

Are you using hotplugd?

Are you using hotplugd?  If you are, this post from ‘william opensource4you’ about a small patch he made may be useful to you.

Posted by     Categories: DragonFly, Someday you will need this     0 Comments for everyone else

For those of us still on IPv4 networks, the BSD-specific OpenGrok site should now be available in general, not just on IPv6.

Posted by     Categories: BSD, Someday you will need this     0 Comments

DragonFly 3.3/3.5 users and dports

If you’re running DragonFly-current, which right now means version 3.3 and very soon 3.5, you are probably running pkgsrc.  If you want to transition to dports, this pair of posts from John Marino will tell you how.

DPorts and DragonFly 3.5 cheatsheet

John Marino published a ‘cheatsheet‘ (also, typo fix)for DragonFly 3.5 users who want to try dports, using DragonFly 3.4 packages.

Running a spam blacklist

Peter Hansteen has an extensive writeup of how he has managed the spam blacklists.  Normally I’d stick this article in the Lazy Reading links, but the article is good enough to call out separately.   It’s excellent not just for the mechanical aspects of how the blacklists were maintained, but for his strict description on how the process is simple, verifiable, and transparent.  That last item, transparency, is how many anti-spam groups fall down.

Summer of Code reminder for students: talk now

For anyone who is a student considering Google Summer of Code this year: this timeframe we’re in right now is listed by Google as time for “students discuss project ideas with mentoring organizations”.  This is the perfect time to find out what the people in an organization are like, and get early feedback on your project ideas.

Chances are, if you’re submitting a proposal for an idea from an org’s project list, you’re one of a number of students all trying for the same thing.  The best way to get accepted instead of any other applicant is to be the person they already know.

Lazy Reading for 2013/03/31

I hope you like reading; there’s some very meaty links this week.  Go get a cup of tea and settle in.  You drink tea, don’t you?  You ought to.

  • Reading about KDE’s repository near-meltdown makes me think we need more checks for DragonFly.  We have the advantage of Hammer, of course, which would help in the same way that the linked article names ZFS as a ‘fix’.  (via multiple places)
  • We know that Apple will reject apps it disagrees with.  Google also will do so.  Has there ever been a program rejected from pkgsrc or (FreeBSD/OpenBSD) ports on content grounds?  Not that I know of – anyone remember differently?  I’d argue that’s a favorable point for the BSD packaging systems, though it may just be that no application has tested those boundaries yet.
  • Portscanning all IPv4 addresses on the planet.  Possibly the largest distributed effort ever?  The detail in the maps and returned services is especially interesting.  (via)
  • Scale Fail, a Youtube video of a 2011 talk about screwing up your services.  Mostly about the humor, but the underlying points are valid.   (via #dragonflybsd IRC)
  • There’s still improvement possible to fsck, apparently based on this.  That’s UFS2 fsck.
  • What is your most productive shortcut with Vim?  A very thorough explanation of verbs, marks, and registers.  Holy cow, I wish I had known about ‘: … v’ before.  It’s long, but worth it.  (via)
  • Matthew Garret’s description of Secure Boot vs. Restricted Boot with UEFI, (via a coworker who went to Libreplanet 2013).  I’m still not sure what DragonFly will need to do about this.
  • I missed mentioning this earlier: 20 years of NetBSD.  We’re coming up on 10 soon.
  • Dragonfly drones.  Unrelated except for name.
  • That guy who starts to froth madly every time BSD is mentioned on Phoronix is still there (see comments).
  • Mainframe computer supercut.  (via)

Your unrelated comics link of the week: Tom Spurgeon of the Comics Reporter asked people for their lists of webcomics that could go in a ‘Hall of Fame’.  The resulting list is a lot of really, really good material.  Go use up a few hours reading.

DragonFlyBSD on OpenGrok

OpenGrok is a source browser that I have not used extensively, but many people say is a great tool.  The same people say it’s difficult to run.  Zafer Aydogan just posted that DragonFly’s source is available now from his perfectly-functional OpenGrok installation.

(I’ll put it in the links sidebar here, too.)

Posted by     Categories: BSD, DragonFly, Someday you will need this     0 Comments

Lazy Reading for 2013/03/24

It’s still snowing in my area, which is unusual.  And great!

Your unrelated comics link of the week: French cartoonist Boulet knocks it out of the park again.

Lazy Reading for 2013/03/10

I managed to come up with a lot of links this week, somehow, despite the start of the class I’m teaching in addition to normal work.  And Summer of Code’s coming up!  And we’re due for a release relatively soon!  I may appear somewhat… stretched over the next few weeks.

Your unrelated link of the week: I’m the Computer Man.  I always thought the mid-1990s were sort of a Internet/computer teenager phase.  Everything had potential but everything was also awkward.  (via I forget, sorry!)

Lazy Reading for 2013/03/03

I am all over the place with links this week – some of them pretty far off the path.  There’s a lot, too, so enjoy!

Your unrelated link of the week: I’ve already been offbeat enough in this Lazy Reading; I don’t have anything else.

New man page source, abbreviated

Constantine A. Murenin has put together a new man page resource for all the BSDS:  The options for shortened URLs are entertainingly diverse.

Posted by     Categories: BSD, Someday you will need this     0 Comments

Lazy Reading for 2013/02/17

This week I will both post this on the correct day AND get the date in the title correct.

Your unrelated tea link of the week: Epic Tea House Server.  Interesting just because of what he does and because I’ve never encountered tea from a samovar, though I’ve read of it.  (via)

Wait, this is better!  That previous link led to this film from an English chemistry professor about tea chemistry.  At first I was just entertained by his hair and his accent, but when he put tea in a NMR spectrometer, I decided this was the best tea thing ever.  Even better than Elemental!

Pulling authorized_keys from LDAP

Michael W. Lucas has put together a script for pulling a user’s authorized_keys file for SSH out of LDAP.  It’s a very good idea, though he hints pretty clearly that he could use feedback/feedback – there’s already some in the comments.

Updates: from discussion in IRC about this sort of distributed authentication (maybe ‘authentication distribution’ is a better phrase): Tools like puppet or FreeIPA may also be useful.  From seeing other conversations about this, it looks like there’s a lot of solutions to pick from, of varying difficulty, and none canonical.  That’s both good and bad.

Posted by     Categories: Someday you will need this     0 Comments

Python and rebuilding pkgsrc

Pierre Abbat noticed that when using pkg_rolling-replace, his Python packages would fail to be built/replaced.  This is because pkgsrc puts the version number into the name of the package, and he was moving from Python 2.6 to 2.7.  OBATA Akio and Greg Troxel had suggestions/explanations.

Posted by     Categories: pkgsrc, Someday you will need this     0 Comments

Dealing with problematic git upgrades

If you have git installed, and you are trying to upgrade it, you may have problems.  The scmgit-docs package dependency requires some DocBook files that aren’t always accessible.  If you do run into this problem, there’s 3 separate options:


Extra rebuilding step for 3.3 users

Based on this bug report on the recently updated m4, you may need to perform some extra steps to update m4 as part of a normal upgrade:

# cd /usr/src/usr.bin/m4
# make
# make install clean


Posted by     Categories: DragonFly, Someday you will need this     0 Comments

Git and DragonFly on IPv6

If you are a brave soul and have an IPv6-only DragonFly installation, there’s now a git mirror of DragonFly that is available on IPv6.

Posted by     Categories: DragonFly, Someday you will need this     0 Comments

Linux and cpdup, plus a note

I could have sworn I noted it before, but as Venkatesh Srinivas points out, there’s a port of cpdup to Linux.  Also, if you’re using cpdup to copy material out of a Hammer volume’s history, use the -VV switch.

New book forthcoming on DNSSec

Michael W. Lucas announced his next book will be about DNSSec, which is good.  It’s also self-published, which I like to see.  I don’t know if it necessarily makes him more money, but I like to see more exploration of this new way of publishing.

If you look at his announcement, there’s a link to something else: vendor-free SSL certificates.  These are possible?  That’s one of those things I didn’t even realize I wanted; having to deal with a certification authority is annoying.

Posted by     Categories: Books, Someday you will need this     1 Comment

Crypto card possibilities

This discussion of cryptographic hardware for FreeBSD may include hardware that would work for DragonFly too.  Can someone verify?

Holiday Buying Guide

Shopping!  This is the big holiday shopping weekend in the US, and I usually put together something here.

If you have suggestions, please comment!

Posted by     Categories: Goings-on, Someday you will need this     1 Comment

SMBIOS access now possible

Sascha Wildner has added system management BIOS (SMBIOS) support, visible with kenv, from FreeBSD.  Use it for getting things like the BIOS revision, system manufacturer, and so on.  For example:

smbios.bios.vendor="Dell Inc. "
smbios.bios.version="2.1.0 "

This may seem minor, but this can be very helpful when dealing with hardware you aren’t physically able to access.

Lazy Reading for 2012/11/11

The 3.2 release seems to have gone well.  Who has tried the new USB support?  I’m curious to see how it’s going.

Your unrelated link of the week: This roundup of ultrarealist human sculpture.  You’ve probably seen Ron Mueck‘s art before, at least.

Remember: bin-install

A thread on pkgsrc-users@ reminds me: adding a specific line for bin-install will save time when rebuilding packages; pkgsrc will use existing binary packages instead of rebuilding from source when possible, when this is set.  At least, I’m pretty sure that’s what it does.

Lazy Reading for 2012/09/09


  • deadweight, “Find unused CSS selectors by scraping your HTML”.  I’ve needed something like this for years.  (via)
  • The same sort of thing for pkgsrc: pkg_leaves.  Worth running at least yearly, or at least before any significant pkgsrc upgrade.  There’s no point in updating a package you don’t use or need.
  • GNU Coreutils cheat sheet, plus the instructions to make it.  There’s other cheatsheets linked in the article that may be useful.
  • Compiler benchmarks, comparing gcc and clang versions.  For a complete benchmark, I’d want to compare what number of programs build with each, too.  (via ftigeot on #dragonflybsd)
  • When ‘your mom’ and Unix jokes collide.
  • Distraction-free writing with Vim.  (via)
  • Also, there’s a “Modern Vim” book on the way.  Will it be good?  I have no idea; I don’t know of any prior books by the author or who the publisher is.  Those facts might help.
  • For a known author and publisher, here’s a status report on Absolute OpenBSD, 2nd Edition.  If you don’t know what a BOFH is from his last sentence, read the original stories.
  • Quadrilateral Cowboy, a cyberpunk hacking game that actually involves non-boring programming and not just a pipe-matching game under the guise of hacking.
  • While I’m linking to games, GUTS, sorta like Diablo but more… roguey?  It’s turn-based.  Also, an excuse to use the roguelike tag.
  • 4 UNIX commands I abuse every day.  Having done a fair amount of Perl programming, I am entertained by having side effects being the intended goal.  Also, the author pays attention to what runs on BSD.  (via)
  • Disks lie. And the controllers that run them are partners in crime.”  Marshall Kirk McKusick describes just how hard it is to know when your data has really made it from memory to disk.  (via)

Your unrelated link of the week.  Dubgif.  Random animated gifs and dubstep clips.  Sometimes it doesn’t work, and sometimes it’s perfect.  (via)  If that’s too random, there’s also this .

Lazy Reading for 2012/06/17

I have such a surplus of links these days that I started this Lazy Reading two weeks ago.

Your unrelated comics link of the week: Elfquest, every issue ever.  The dialogue is cheesy but the original art is fun, in a way that grabbed me when I read it at 10 years of age.

Secure your MySQL setup

This was going to go into a Lazy Reading post, but then I realized it shouldn’t.  Here’s the source: “A Tragically Comedic Security Flaw in MySQL” (via)

The short version: MySQL, compiled a certain way, will allow 1 out of 256 root login attempts to work no matter what.  I was going to link to this for the startlingly large number of MySQL installations found allowing connections from the public Internet, which means breaking into any affected servers would be easy.  Then I thought about it…  I don’t see a my.cnf installed by pkgsrc for at least MySQL 5.1 by default.

To fix this for your own installation, put


in /usr/pkg/etc/my.cnf to disallow remote connections.  I don’t know if MySQL on DragonFly from pkgsrc is vulnerable to the issue, but it’s a good idea to not allow remote connections to the database, and ought to be on by default.

Or just use Postgres, if possible.


Lazy Reading for 2012/06/10

I got to use the ‘roguelike’ tag again this week, which always makes me happy.  Surprisingly, it’s not about… that roguelike.

Your unrelated link of the week: I happen to work at a salt mining operation, which leads to some unique problems (more).  Mining in the US is regulated by MSHA, which has been cracking down since the Upper Big Branch incident. MSHA issues  ‘fatalgrams‘ every time a miner dies.  MSHA also shows up on site as soon as possible, which means they are there taking pictures within a few minutes, with equipment still running.  It’s essentially crime scene photos, and a little worrying; many of the deaths are of people around my age with similar experience.