Author: Bian Xi

Escape Percent-signs(%) in crontab

Posted on by Bian Xi Leave a Comment on Escape Percent-signs(%) in crontab

Escape Percent-signs (%) in crontab

In order to input % character as command parameter in cron task, it needs to be escaped using backslash ().

man (5) crontab:

Percent-signs (%) in the command, unless escaped with backslash (\), 
will be changed into newline characters, and all data after the 
first % will be sent to the command as standard input.

Run script after interface up when using NetworkManager

Posted on by Bian Xi Leave a Comment on Run script after interface up when using NetworkManager

Run script after interface up when using NetworkManager

Create a script as below in folder /etc/NetworkManager/dispatcher.d called 10-openvpn-tun0-up, change the permission to executable

#!/usr/bin/env bash

interface=$1
event=$2

if [[ $interface != "eth0" ]] || [[ $event != "up" ]]
then
  return 0
fi

# place your commands bellow this line

References

Network Manager script when interface up?

Fix Spice Certificate Issue in Proxmox

Posted on by Bian Xi Leave a Comment on Fix Spice Certificate Issue in Proxmox

Fix Spice Certificate Issue in Proxmox

After changed the display to Spice and added Spice USB device, following error appeared.

swtpm_setup: Not overwriting existing state file.
kvm: warning: Spice: reds.c:2893:reds_init_ssl: Could not load certificates from /etc/pve/local/pve-ssl.pem
kvm: warning: Spice: error:0909006C:PEM routines:get_name:no start line
kvm: warning: Spice: error:140DC009:SSL routines:use_certificate_chain_file:PEM lib
kvm: failed to initialize spice server
stopping swtpm instance (pid 55260) due to QEMU startup error
TASK ERROR: start failed: QEMU exited with code 1

Update certificate also got following errors

root@pve01:~# pvecm updatecerts --force
(re)generate node files
generate new node certificate
Signature ok
subject=OU = PVE Cluster Node, O = Proxmox Virtual Environment, CN = pve01.xxx.net
Getting CA Private Key
CA certificate and CA private key do not match
139954545105792:error:06067099:digital envelope routines:EVP_PKEY_copy_parameters:different parameters:../crypto/evp/p_lib.c:93:
139954545105792:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:../crypto/x509/x509_cmp.c:303:
unable to generate pve ssl certificate:
command 'faketime yesterday openssl x509 -req -in /tmp/pvecertreq-56235.tmp -days 161 -out /etc/pve/nodes/pve01/pve-ssl.pem -CAkey /etc/pve/priv/pve-root-ca.key -CA /etc/pve/pve-root-ca.pem -CAserial /etc/pve/priv/pve-root-ca.srl -extfile /tmp/pvesslconf-56235.tmp' failed: exit code 1

In this case, remove keys and regenerate.

root@pve01:~# rm -f /etc/pve/pve-root-ca.pem /etc/pve/priv/pve-root-ca.* /etc/pve/local/pve-ssl.*
root@pve01:~# pvecm updatecerts -f
(re)generate node files
generate new node certificate
merge authorized SSH keys and known hosts
root@pve01:~# pvecm updatecerts -f
(re)generate node files
generate new node certificate
merge authorized SSH keys and known hosts
root@pve01:~#

Now, problem fixed.

References

pveproxy fails to load local certificate chain after upgrade to pve 6

Apply filter to STDERR in Linux

Posted on by Bian Xi Leave a Comment on Apply filter to STDERR in Linux

Apply filter to STDERR in Linux

STDOUT ────────────────┐
                       ├─────> terminal/file/whatever
STDERR ── [ filter ] ──┘

Method

If ./a.out outputs as below

In STDERR:

stderr output

In STDOUT:

more regular

Then the following command will output as below.

# ./a.out 3>&1 1>&2 2>&3 3>&- | sed 's/e/E/g'
more regular
stdErr output

Explanation

    First save stdout as &3 (&1 is duped into 3)
    Next send stdout to stderr (&2 is duped into 1)
    Send stderr to &3 (stdout) (&3 is duped into 2)
    close &3 (&- is duped into 3)

References

Pipe only STDERR through a filter

Error encountered during `apt install` indicated that the file couldn’t be accessed by user `_apt`

Posted on by Bian Xi Leave a Comment on Error encountered during `apt install` indicated that the file couldn’t be accessed by user `_apt`

Error encountered during apt install indicated that the file couldn't be accessed by user _apt

When installing package from local file (.deb file), following error might be occurred.

Processing triggers for dbus (1.14.0-2ubuntu3) ...
N: Download is performed unsandboxed as root as file 'full_path_of_deb_file_name' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)

Usually apt tries to run the process that fetches packages as a different user called _apt to increase security. That's no problem if it has to download packages from the internet. But if you tell it to install a .deb file that's already on your system, it needs to have permission to access that file by _apt user. Otherwise, above error will be shown.

References

Download performed unsandboxed

Only pipe STDERR output in `bash` with timestamp

Posted on by Bian Xi Leave a Comment on Only pipe STDERR output in `bash` with timestamp

Only pipe STDERR output in bash with timestamp

bash

In order to discard standard output and only log the standard error, following command can be used. The second part of command is to prefix the current timestamp in the output

sh monitor 2>&1>/dev/null | ts '[%Y-%m-%d %H:%M:%S]'

dash

If need to run in dash, such as running in crontab, above syntax is wrong, use following command instead

sh monitor 3>&1 1>/dev/null 2>&3 3>&- | ts '[%Y-%m-%d %H:%M:%S]'

Note: This command can be run in bash too

References

Prepending a timestamp to each line of output from a command
Pipe only STDERR through a filter

WordPress Error – bypass `reCaptcha v3 test failed`

Posted on by Bian Xi Leave a Comment on WordPress Error – bypass `reCaptcha v3 test failed`

WordPress Error - bypass reCaptcha v3 test failed

When encounter error when login to WordPress, can temporarily bypass reCaptcha verification

reCaptcha v3 test failed

Solution

Rename folder wp-content/plugins/google-captcha to wp-content/plugins/google-captcha.old, then try to login again.

To enable back, rename back the folder.

References

Enable HTTPS for NextCloud Docker using `docker-compose`

Posted on by Bian Xi Leave a Comment on Enable HTTPS for NextCloud Docker using `docker-compose`

Enable HTTPS for NextCloud Docker using docker-compose

By default, NextCloud Docker doesn't enable HTTPS.

Steps

Create

  • Create folders
    • /app/nextcloud/data/db: for MySQL database
    • /app/nextcloud/data/db_conf: for MySQL database configuration (don't see anything in it)
    • /app/nextcloud/data/cert: for nextcloud certificates
    • /app/nextcloud/data/html: for nextcloud data and packages
  • Create docker-compose.yml
  • Create Dockerfile.nextcloud
  • Run docker-compose build
  • Run docker-compose up -d

Destroy

  • Run docker-compose down

Docker Compose

docker-compose.yml:

version: '3'

services:
  db:
    image: mariadb:latest
    restart: always
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    volumes:
      - /app/nextcloud/data/db:/var/lib/mysql
      - /app/nextcloud/data/db_conf:/etc/mysql/conf.d
    environment:
      - MYSQL_ROOT_PASSWORD=<mysql_root_password>
      - MYSQL_PASSWORD=<mysql_user_password>
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud

  app:
    build:
      context: .
      dockerfile: Dockerfile.nextcloud
    restart: always
    ports:
      - 80:80
      - 443:443
    links:
      - db
    volumes:
      - /app/nextcloud/data/html:/var/www/html
      - /app/nextcloud/data/cert/fullchain.pem:/etc/ssl/certs/ssl-cert-snakeoil.pem
      - /app/nextcloud/data/cert/privkey.pem:/etc/ssl/private/ssl-cert-snakeoil.key
    environment:
      - MYSQL_PASSWORD=<mysql_user_password>
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db

Dockerfile.nextcloud

  • Define base docker image as nextcloud:latest
  • Enable ssl module
  • Enable default-ssl site
FROM nextcloud:latest

RUN a2enmod ssl
RUN a2ensite default-ssl

References