Fedora 17 - Mobility Radeon HD5430 HDMI And Audio

Having recently upgraded to a nice new shiny HDMI TV/Monitor for my Fedora 17 server (soon to be 19) I needed to get the HDMI audio working since the TV I purchased claimed to have VGA (even though I wanted to eventually use HDMI) but did not.  So had to get the HDMI audio working since there was no other way of getting the audio out of the TV, and I definitely didn't want extra speakers cluttering up the office space.

Realising that the system had already identified the necessary hardware through the System Settings --> Sound it was obvious that no other drivers were required to install the system.  Many sites tell you to download the Nvidia drivers, but you don't need to if your monitor is working correctly and if your device is identified in the sound settings.

A simple configuration change is required to GRUB to make the HDMI audio respond.

The only real change required is to add the following to the linux line.

radeon.audio=1

Making your line look as follows;

linux   /vmlinuz-3.9.10-100.fc17.x86_64 root=UUID=ff744af5-abdf-4696-a87
b-3e3a5e5e055e ro rd.md=0 rd.lvm=0 rd.dm=0 KEYTABLE=uk rd.luks=0 LANG=en_US.UTF-
8 quiet nouveau.modeset=0 radeon.audio=1

Bio-metrics, why are we still chasing a dead end?

The following article on the BBC caught my eye today;
http://www.bbc.co.uk/news/business-24898367

It amazes me that there is still research into an area that has more security flaws than any other system already presented.  Currently the trusted third party Kerberos and 2 Factor auth are in most cases still the strongest method we have to date, until a human leaks the most essential part of the system.  Which at this point we should note that any weakness in any security system is the users and the people responsible for them.  We only need look at certain government agencies around the world to know this, and they have their own tests that claim these people are "trustworthy". Again another topic for another day.

Although in most circumstances bio-metrics seem like a great idea, they are at the end of the day something that Hollywood has created to make films look good, but in reality unless they have a backup system (which is essential) you could be wiped off the face of the earth and unrecognised in the space of seconds.

The saying "make sure you've got clean underpants on as you might be hit by a bus" springs to mind here.

Bio-metrics assumes that everyone is a healthy human being, that they don't grow or change and that they will never develop an illness that will disfigure them in anyway or form.  At this point I could stop as you now already understand why this as a security mechanism is not safe, but I won't I'll add some more weight behind this to let those in the Bio industry understand why they should only develop these systems with an immediate backup, which in reality should be what is the primary system as it would be better (as yet to be discovered).

So the flaws in Bio-metrics;
1. Fingerprints have been used on laptops, phones and many other devices.  Although I joke earlier about Hollywood they have proven the point that it is easy to obtain someones finger print, and the police have been doing it for years. Ah, but ... I hear you say.  No, no but.  Even with a heat detector to make sure that the person is alive can be fooled with a warm heat source at the right temperature.  Further buts.  Well OK, lets check for a pulse, ok next point.
2. The heart beat was one of the interesting ones recently announced, to state that the heart has a unique signature. True it does, but have we really done exhaustive tests?  Pacemakers have a similar signature, so already we've failed our security test.  Have we checked a persons heart after a heart attack or stroke to see if the rhythm remains the same?  Still this is not secure enough, and we only need a recording device to generate the relevant beat.
3. As for the voice and the BBC link saying that there is no recording equipment that does uncompressed recording, well I'm sorry I don't need to record you over the phone I can do it face to face and get full uncompressed audio direct from you, so no voice is not a safe mechanism and can easily be recorded and used to fool these systems.
4. Retinal scans.  Eyes can change too, even the unique pattern at the back.  Blood clots, cataracts, and more, not to mention losing them.

So I beg you stop trying to link humans up to machines, or trying to find parts of the body to use as a security mechanisms as the body is a fragile thing and fragile things can be broken and broken things won't allow users back into a system.

At the end of the day and as was done in the old days, if someone wants something bad they will get it and they will always find a way.  The safest way to deal with things in today's hi-tech world is to do it face to face.  I believe that too many places have tried to make things too convenient, and it appears with convenience comes higher risk.

Fedora 19 Custom Bootable DVD

I'm a stickler for the scripted installs. They're quick to produce provided you have a package list, and just as quick at installation as a LiveDVD.
The majority of web sites these days talk about create a Live distribution, which is close to performing a ghost of your system as you have to build it first and then use tools to create the DVD image for burning.

Even before PXE I was an avid fan of network installations (Solaris Jumpstart and IBM NIM on AIX).  When PXE arrived and Linux was able to perform the same thing I was over the moon.  The fact that you could take an equivalent (some mods) PXE style install and apply it to a DVD image with modifications to the isolinux.cfg file this made making automated DVD builds really easy, especially for one company that asked me to partly help modify their ability to build custom DVD images to build Fedora boxes.  This was easy on FC14 and matched closely the values in a pxelinux.cfg file.

Fedora 19 on the other hand needed some extra work since GRUB2 and a complete change to the attributes requires in the isolinux.cfg file.  However, having set down and hacked about with the isolinux.cfg file I can safely say that you can still build a scripted install of Fedora without having to use all those excess tools and without having to install an OS first.

The kickstart files remain unchanged in their answers (or so I've found so far).

To make the isolinux.cfg file recognise your script file you need to do the following;

1. Copy the DVD contents to a folder
2. Create your kickstart at the top level of the DVD rom directory structure
3. In the isolinux directory edit the isolinux.cfg file

The file I created had the following content;
default install

label install
  kernel vmlinuz
  append load_ramdisk=1 ramdisk_size=9216 initrd=initrd.img network ks=cdrom::/myInstall.ks inst.repo=cdrom inst.text

This will perform a text based installation rather than a GUI one.  The key change really to all this is that the ks argument requrires the device containing the kickstart file and between the : : either blank as above (no spaces) for the system to find the cdrom device, or the full path of the device, e.g. /dev/sr0.  The next change is the inst.repo which in this case is telling the boot loader that the install packages are on the cdrom and that it should be mounted.  Finally instead of just typing text we now have to type inst.text to perform a non-GUI installation.

Once isolinux is changed you can create an iso image of the directory structure and then burn to disk.

All the relevant arguments to the append line can be found at http://wwoods.fedorapeople.org/doc/boot-options.html#_inst_stage2

Linux Automatic Login At Command Line

Since I'm about to build a tiny little media player with the Raspberry PI, I thought I'd write myself some notes to remind me of some set up features that I might require.  Creating an automated log on for the GUI is fairly straight forward as the generally relies on messing around with the GDM files.

It turns out it is also easy for the command line too.

/etc/init/tty.conf is used to control what happens with console log on.

The line;
exec /sbin/mingetty $TTY
Is the default line that tells the getty process to perform the log on prompt. You can change this to suit your needs, so if you wanted root to log on you could do;

exec /sbin/mingetty --autologin root $TTY

This will log the system in as root at a command prompt.

Other options to mingetty;
--loginprog=/sbin/someprogram
--chdir=/somedirectory
--chroot=/jaildirectory

man mingetty will tell you the rest

For systemd based versions you need to do the following;
Change to the /etc/systemd/system folder.
If you need more terminals then do the following;
cp /lib/systemd/system/getty@.service /etc/systemd/system/autologin@.service
ln -sf /etc/systemd/system/autologin@.service  /etc/systemd/system/getty.target.wants/getty@tty1.service

In the file getty.target.wants/getty@tty1.service change the following;
ExecStart=-/sbin/agetty --autologin root %I

Obviously substitute root for your specific user.

Unlocking Blackberry For Free

Unlock Your Blackberry For Free
Whilst playing with an old Blackberry, I finally discovered some free software that calculates the unlock code for some devices.
Now I cannot guarantee, in the same way that others do, that this might not work for your device.
You can download the tool from;
http://www.filecrop.com/bb-calculator-free.html
Or alternatively search for "BB Calculator Free".

For this tool you'll need only your IMEI number (normally printed inside your phone under the battery) and the MEP number which you can obtain on most Blackberry devices by holding down alt + shift + H.
The IMEI number can also be obtained from the same screen as the MEP number, so saves you taking out the battery.

Once you have the IMEI number and the MEP just enter them into the BB Calculator tool in the "Code Calculator" tab.  Note that the IMEI is entered as one long number, so ignore any dots, etc.  Hit the "Calculate Codes" button and an MEP2 line will appear with a number.  This is the number that you will need to enter into your Blackberry.

http://crackberry.com/unlocking-blackberry should be able to help you find out how to enter your new MEP2 code.  For most Curve models you can do the following (but check the URL first);

1. Have the original SIM card in the phone (even if it is no longer valid on the network)
2. Go to Settings - Advanced Options - SIM Card
3. On that screen type in the following mepd    nothing will appear on the screen whilst typing
4. Then immediately type mep2   again nothing will show whilst typing, but a pop up screen will appear to type in your code if you have typed the 2 words in correct
5. Type in the MEP2 code that you obtained from the BB Caculator Free tool and press either enter or the trackball
6. If the code worked you will see Code Accepted

Thunderbird and copying between IMAP accounts

The Issue
If you have multiple IMAP accounts and wish to copy messages with attachments between the 2 accounts you may find that when you come to open the attachment on the other account that Thunderbird generates the following error message:

This attachment appears to be empty.
Please check with the person who sent this.
Often company firewalls or antivirus programs will destroy attachments.

This blogget will tell you how to overcome this issue and not to panic when it occurs as the attachment did copy across without any issues.

Copying The Message
In Thunderbird messages can be copied between accounts using the following steps.

1. Select [multiple|the] message(s) that you wish to copy to the same folder in another account
2. Right click one of the sselected message(s)
3. Select the Copy To option
4. Then select the Email account you want to copy to
5. Then select further to drill down to the folder you wish to copy the messages to
6. Once at the lowest level of selection the messages will start to copy
7. Your original messages will still remain on the original server

Moving The Message

In Thunderbird messages can be moved between accounts using the following steps.

1. Select [multiple|the] message(s) that you wish to move to the same folder in another account
2. Right click one of the sselected message(s)
3. Select the Move To option
4. Then select the Email account you want to move to
5. Then select further to drill down to the folder you wish to move the messages to
6. Once at the lowest level of selection the messages will start to move
7. Your original messages will be removed from the original server

Shorter Method

1. Select [multiple|the] message(s) that you wish to move to the same folder in another account
2. Click and hold one of the selected messages
3. Drag to the folder on the other account
4. Messages will start to be moved between the accounts
5. Your original messages will be removed from the original server

Looking At The Messages In The New Account

Now select the folder of the account you have just copied the Email messages to, and find one of the Emails that contains an attachment.  When you attempt to view the attachment you will receive the message described at the beginning of this document:

This attachment appears to be empty.
Please check with the person who sent this.
Often company firewalls or antivirus programs will destroy attachments.

Rectifying The Error
Use the following steps to resolve the issue:

1. Right click on the folder
2. Select Properties
3. Click the Repair Folder button
4. Now select a different message and then the one with the attachment
5. Select the attachment and it will now open

Do this for any folder where you receive this error with attacments and you will be able to view them again.  Most of the issues revolve around the MIME boundary being set incorrectly and the repair folder sorts these out so that the attachment can be found again.

Useful SSH fingerprint check

http://blog.binarymist.net/2013/02/16/establishing-your-ssh-servers-key-fingerprint/

To save you going there, here is the info;

Establishing your SSH Server’s Key Fingerprint

When you connect to a remote host via SSH that you haven’t established a trust relationship with before,
you’re going to be told that the authenticity of the host your attempting to connect to can’t be established.

me@mybox ~ $ ssh me@10.1.1.40

The authenticity of host '10.1.1.40 (10.1.1.40)' can't be established.

RSA key fingerprint is 23:d9:43:34:9c:b3:23:da:94:cb:39:f8:6a:95:c6:bc.

Are you sure you want to continue connecting (yes/no)? y

Please type 'yes' or 'no':

Do you type yes to continue without actually knowing that it is the host you think it is? Well, if you do, you should be more careful. The fingerprint that’s being put in front of you could be a Man In The Middle (MITM). You can query the target (from “it’s” shell of course) for the fingerprint of it’s key easily. On Debian you’ll find the keys in /etc/ssh/

On

ls /etc/ssh/

you should get a listing that reveals the private and public keys. Run the following command on the appropriate key to reveal it’s fingerprint. For example if SSH is using rsa:

ssh-keygen -lf ssh_host_rsa_key.pub

For example if SSH is using dsa:

ssh-keygen -lf ssh_host_dsa_key.pub

If you try the command on either the private or publick key you’ll be given the public key’s fingerprint, which is exactly what you need for verifying the authenticity from the client side.

Do not connect remotely and then run the above command, as the machine you’re connected to is still untrusted. The command could be dishing you up any string replacement if it’s an attackers machine. You need to run the command on the physical box or get someone you trust (your network admin) to do this and hand you the fingerprint.

Now when you try to establish your SSH connection for the first time, you can check that the remote host is actually the host you think it is by comparing the output of one of the previous commands with what SSH on your client is telling you the remote hosts fingerprint is. If it’s different it’s time to start tracking down the origin of the host masquerading as the address your trying to hook up with.

Now, when you get the following message when attempting to SSH to your server, due to something or somebody changing the hosts key fingerprint:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)!

It is also possible that a host key has just been changed.

The fingerprint for the RSA key sent by the remote host is

23:d9:43:34:9c:b3:23:da:94:cb:39:f8:6a:95:c6:bc.

Please contact your system administrator.

Add correct host key in /home/me/.ssh/known_hosts to get rid of this message.

Offending RSA key in /home/me/.ssh/known_hosts:6

remove with: ssh-keygen -f "/home/me/.ssh/known_hosts" -R 10.1.1.40

RSA host key for 10.1.1.40 has changed and you have requested strict checking.

Host key verification failed.

The same applies. Check that the fingerprint is indeed the intended target hosts key fingerprint. If it is, run the specified command.

Application Support Analyst Generic Steps

For those new to or about to start their carrier as an application support person, here are some guidelines for investigating an application issue.

User Side Checks

1. Make sure they have the correct connections for the application, hostname, IP address, port number, etc.
2. Check that the users environment to ensure any application environment variables are set correctly.
3. Check the routing tables on the users system. Make sure their default gateway is correct.
4. Ensure that their firewall (especially Windows) isn't blocking the application connectivity. Desktop applications may sometimes be blocked.

Network Checks

1. Can you access the application?
   Use a web browser or the application (you may want to check network traffic with something like wireshark or fiddler)
2. Are you able to access the application from different locations? E.g Web browser or from a different host using something like ncat or Telnet.

• telnet hostOrIP appPortNo
• ncat hostOrIP appPortNo

1. Are you able to connect to another service running on that host, e.g. ping, or an Email service?
2. Check that the load balancers are able to connect to the application and that the load balancers are configured correctly.
3. Check with nmap to identify what ports are available on the host.  You will need a more intrusive view rather than just the basic check as it may well miss your applications port.  Or you can tell nmap which port to check.

The use of ncat would allow you to see if you can connect to the specific ports for an application response. Also these steps should allow you to see if connection is possible, or whether a firewall or switch is causing issues, so you should try from different networked hosts.
However, connection to an application port may not be enough to confirm it is working, so you should be able to send it a message to check that it responds since this will tell us if the process has hung.

Checks on the application host

1. Log on to the host and check that the process is still running. You'd be surprised how often its not if the connection is down.
   ps -ef
2. Check the log files for any application warnings or errors. If you have a Java stack trace ask a developer to get involved and perhaps send a copy of the stack trace to them if it's not obvious what the issue might be.
   egrep -ir 'ERR|WARN' /var/log/*
3. Check that the firewall is allowing the application port through. This will vary depending on the operating system. You can also use nmap here on the host to see what ports are available or if the application port is open.  For Red Hat systems and those using iptables then iptables -L should help.
4. Check that the host can connect to any load balancers that it may be attached to, especially for return information.
5. Check that the network interfaces are responding, especially if there is more than one.
6. Check the routing tables of this host just in case there is one route in and another out. Sometimes routing loops or mis-configuration of the network makes traffic take a different route back causing the users application to refuse or not see the return data.
7. Ensure that the host can connect to the database server port. There could be a connectivity issue here. Again, similar checks to connecting to this host from a remote location should be used to ensure connectivity to the database is available.  The key thing here is that in the production environment you will only have a limited set of hosts to use to check that connectivity to the DB server is there as they may be on different VLANs.

Final Steps

1. Check the support documentation for similar symptoms
2. Never be afraid to ask someone for help. Someone may have already seen this issue before.
3. Gather as much information as possible before speaking to the next level support making sure you have;

• Network connectivity information from all sides (user, application server, other hosts in different networks, load balancers and firewalls)
• Log information if you are able to access the logs
• Users configuration information (gateway, variables, firewall)

Disclaimer

This is a starting point, and I'm sure there are other techniques and pieces missing, but in most cases the generics here will provide a good basis for acquiring the relevant information to diagnose issues with an application. Other methods and ideas to build this to a useful learning platform for people coming in to the application support arena would be welcome.