<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
<?xml-stylesheet type="text/css" href="http://www.theoldmonk.net/blog/"?>
<title type="html">Filed under: tricks | The Old Monk</title>
<subtitle type="html">high wisdom</subtitle>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog" />
<link rel="self" type="application/atom+xml" href="http://www.theoldmonk.net/blog/archives/tricks/index-atom.xml" />
<updated>2010-05-25T17:35:50+05:30</updated>
<author>
<name>gera</name>
<uri>http://www.theoldmonk.net/blog</uri>
</author>
<id>http://www.theoldmonk.net/blog/</id>
<generator uri="http://nanoblogger.sourceforge.net" version="3.4.1">NanoBlogger</generator>
<entry>
<title type="html">Debugging python Windows services</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2010/02/11/debugging_python_windows_services/" />
<id>http://www.theoldmonk.net/blog/archives/2010/02/11/debugging_python_windows_services/</id>
<published>2010-02-11T13:08:49+05:30</published>
<updated>2010-02-11T13:08:49+05:30</updated>
<category term="tricks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">
<p>Python makes it easy to write Windows services (via pywin32 extensions). That part is easy. The problems sometimes happen when you try to run them, with a commonly reported error - "The service did not respond to the control...", which is error 1503.</p>
<p>If one runs the service compiled as an exe (via py2exe for example), there are a bunch of issues like the module import paths changing. I haven't had the time to dig really deep into that. But this might strike even if the service is being run uncompiled (from a .py file).</p>
<p>One of the first things to check is whether pythonservice.exe (from the win32 module) executes cleanly - this is the binary responsible for actually loading your service script/module. If pywin32 was installed in the usual way, it should be located at C:\Python26\Lib\site-packages\win32\pythonservice.exe</p>
<p>Running this should give an immediate idea of what's going wrong. It usually turns out to be a "msvcr90.dll" or a "python26.dll" error. (Of course, all this is Python 2.6). When that is running alright, then it's time for some debug fun.</p>
<p>To debug the python service, just run pythonservice.exe with the '-debug' option and the service name as the argument. This attaches the stdout/stderr to the terminal. For example, if the service uses BaseHTTPServer, all the request/response logs will show up.</p>
</div>
</content>
</entry>
<entry>
<title type="html">Windows XP file ownership</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2009/08/17/windows_xp_file_ownership/" />
<id>http://www.theoldmonk.net/blog/archives/2009/08/17/windows_xp_file_ownership/</id>
<published>2009-08-17T17:01:16+05:30</published>
<updated>2009-08-17T17:01:16+05:30</updated>
<category term="tricks" />
<category term="hacks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">
<p>As part of a cleanup of someone's notebook, I created a non-admin account and copied the docs/shortcuts. Thankfully, the data was already in a separate drive. Trouble is, the non-admin user would see all of it as read-only.</p>
<p>I tried changing the perms on the content (via the gui as well as via attrib.exe), but the non-admin user still wasn't able to write.</p>
<p>It turned out that the issue was file ownership. I'm not too sure what the patchlevel of the XP system was, but a right click -&gt; properties menu didn't bring up any tab where I could see or change file ownership.</p>
<p>The solution: download and install 
<a href="http://www.cygwin.com">Cygwin</a>, and then a simple "chown -R &lt;NonAdminUser&gt; /cygdrive/&lt;driveletter&gt;/*".</p>
<p>Reinforces my opinion that one really *needs* cygwin to make Windows usable!</p>
</div>
</content>
</entry>
<entry>
<title type="html">ssh authentication via mysql (pam_mysql)</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2009/02/24/ssh_authentication_via_mysql_pam_mysql/" />
<id>http://www.theoldmonk.net/blog/archives/2009/02/24/ssh_authentication_via_mysql_pam_mysql/</id>
<published>2009-02-24T13:39:30+05:30</published>
<updated>2009-02-24T13:39:30+05:30</updated>
<category term="tricks" />
<category term="technology" />
<category term="hacks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">
<p>There's not much info on the interwebs on why ssh authentication via pam_mysql fails, and there are definitely some misleading answers like 
<pre>
when logging in via ssh, the ssh daemon checks some files in ~/,
so it can be done if the user already have a valid home directory.
</pre>from 
<a href="https://www.linuxquestions.org/questions/linux-security-4/authentication-to-ssh-via-mysql-169733/">this thread</a>.</p>
<p>The real reason why it doesn't successfully authenticate is because ssh does a getpwent() call to check if the user exists on the system. If you're using just a PAM solution (which doesn't provide accounts), that call fails if there isn't any such local user. sshd then sets the password to '^H ^M INCORRECT' before passing it to PAM, which obviously thinks it's the wrong password. The simple (and probably unscalable - but then you should be using something like nss_mysql) solution is to add local accounts to the machines for these users. That will make the getpwent() call succeed, and sshd will authenticate successfully via PAM.</p>
<p>I've mentioned this 
<a href="http://www.theoldmonk.net/blog/archives/2008/09/27/trac_mysql_and_authentication/">earlier</a>.</p>
</div>
</content>
</entry>
<entry>
<title type="html">Graphviz awesomeness</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2009/02/23/graphviz_awesomeness/" />
<id>http://www.theoldmonk.net/blog/archives/2009/02/23/graphviz_awesomeness/</id>
<published>2009-02-23T12:17:12+05:30</published>
<updated>2009-02-23T12:17:12+05:30</updated>
<category term="tricks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">
<p>
<a href="http://www.graphviz.org/">Graphviz</a>is my newest discovery. I used to meddle with 
<a href="http://live.gnome.org/Dia">Dia</a>and 
<a href="http://www.xfig.org/">xfig</a>whenever I needed to publish any diagrams (network diagrams for example), but they have their problems - one has to worry about the layout and spacing among other things. The content becomes secondary to the layout. That's exactly the reason why I don't use word processors. Systems like 
<a href="http://textile.thresholdstate.com/">Textile</a>, 
<a href="http://daringfireball.net/projects/markdown/">Markdown</a>, 
<a href="http://docutils.sourceforge.net/rst.html">reStructured Text</a>and the king of them all, 
<a href="http://en.wikipedia.org/wiki/TeX">TeX</a>let you focus on the content and figure out an appropriate layout (some of them with a little help - but the focus still remains on the content).</p>
<p>Graphviz does that for graphs and it's just awesome! Examples speak louder than words, so here they are: 
<pre>
graph g {
        foo -- bar;
        bar -- baz;
        baz -- spam;
        eggs -- spam;
        spam -- bar;
        foo -- spam;

        label="The foo bar graph"
}
</pre>
<img src="/blog/images/foobar.png" />
<br />
<pre>
graph g {
        foo;
        {rank=same; bar; baz; spam; eggs;}

        foo -- bar;
        bar -- baz;
        baz -- spam;
        eggs -- spam;
        spam -- bar;
        foo -- spam;

        label="The flatter foo bar graph"
}
</pre>
<img src="/blog/images/flat_foobar.png" />
<br />
<pre>
digraph G {
        foo;
        {rank=same; bar; baz;}
        {rank=same; spam; eggs;}

        foo -&gt; bar;
        bar -&gt; baz [arrowhead=vee];
        baz -&gt; spam [arrowhead=diamond];
        spam -&gt; eggs [label=" an edge " arrowtail=diamond arrowhead=vee color=red];
}
</pre>
<img src="/blog/images/dir_foobar.png" /></p>
</div>
</content>
</entry>
<entry>
<title type="html">Trac, MySQL and authentication</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/09/27/trac_mysql_and_authentication/" />
<id>http://www.theoldmonk.net/blog/archives/2008/09/27/trac_mysql_and_authentication/</id>
<published>2008-09-27T19:06:10+05:30</published>
<updated>2008-09-27T19:06:10+05:30</updated>
<category term="tricks" />
<category term="technology" />
<category term="hacks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">What we needed at 
<a href="http://www.chaupaati.in">work</a>: 
<ul>
<li>A wiki</li>
<li>VPN</li>
<li>A bug/issue tracker</li>
</ul>
<a href="http://trac.edgewall.org/">Trac</a>gave us the first and the last, and 
<a href="http://openvpn.net/">OpenVPN</a>gave us the middle. The newer versions of Trac can use MySQL as a database instead of SQLite and have a nice 
<a href="http://trac-hacks.org/wiki/AccountManagerPlugin">AccountManager</a>plugin. 
<br />
<br />And it all comes together with 
<a href="http://pam-mysql.sourceforge.net/">pam_mysql</a>. The only problem was that Trac likes to store passwords hashed as HTTP-Digest style hashes (not the most secure, I know) with an empty realm, and pam_mysql doesn't work for that. The solution was a simple patch to pam_mysql which adds support for such hashes. I'll publish that soon - I'm making it more general by adding support for realms rather than assuming that realm would be empty. 
<br />
<br />OpenVPN (and apache - via mod_auth_pam) etc. can authenticate via 
<a href="http://www.kernel.org/pub/linux/libs/pam/">PAM</a>and adding authentication to anything is a simple matter of placing the right .htaccess file. And this is a *common* password across all services, which users can change on the wiki, in their browsers, with a nice polished interface. No unix shells for people who can't deal with them. 
<br />
<br />This is no 
<a href="http://en.wikipedia.org/wiki/Kerberos_(protocol)">Kerberos</a>, but is infinitely simpler - which means a lot for a small startup. 
<br />
<br />There are a few gotchas though : 
<ul>
<li>Apache doesn't like empty realms. This can be worked around by switching to Basic authentication where passwords are passed on to PAM and we ignore realm. Yes, Basic is worse, but there's always SSL. Thus, one can supply _any_ value of realm (the AuthName in .htaccess). The situation might improve if my pam_sql patch accepts realms and we manage to modify the Trac AuthManager plugin to use the same realm.</li>
<li>SSH doesn't like to authenticate users which don't have an account on the machine. It does a getpwent() call, and if it fails, it sets the password to '^H ^M INCORRECT' (the ^H and ^M represent the control chars here, but this is what you see in your logs if you debug PAM). One (ugly, in my opinion) way out is to LD_PRELOAD your own getpwent() method for sshd. The other is to grant ssh access to people on a machine by machine basis. This doesn't scale beyond a point but is good enough for small setups and the most secure. We use this. The cleaner solution of course, is to use something like 
<a href="http://savannah.nongnu.org/projects/nss-mysql">nss_mysql</a>. This might be our next step, but not in the immediate future.</li>
</ul>Patch to come Real Soon Now.</div>
</content>
</entry>
<entry>
<title type="html">SPG - Simple Password Generator</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/07/22/spg_-_simple_password_generator/" />
<id>http://www.theoldmonk.net/blog/archives/2008/07/22/spg_-_simple_password_generator/</id>
<published>2008-07-22T21:40:42+05:30</published>
<updated>2008-07-22T21:40:42+05:30</updated>
<category term="tricks" />
<category term="perl" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">I have been using unique passwords for (almost) all the websites I have accounts on, and have a handy script to do the task for me. The idea is simple and came from a 
<a href="http://www.schneier.com/blog/archives/2007/11/how_to_harvest.html#c220047">comment on a blog post</a>. You just need to remember one secret passphrase. Every time you need a unique password, append that secret to a unique string identifying the use (the website URL, or the domain name), hash the result and use the first n characters of it as the password. Unique, and there's only one thing to remember. 
<br />
<br />The script is useful enough, and I'm finally getting around to releasing it. There are other password generators (like 
<a href="http://search.cpan.org/~jdporter/Crypt-RandPasswd-0.02/lib/Crypt/RandPasswd.pm">Crypt::RandPasswd</a>, 
<a href="http://search.cpan.org/~ryochin/Data-SimplePassword-0.04/lib/Data/SimplePassword.pm">Data::SimplePassword</a>, 
<a href="http://search.cpan.org/~cgrau/String-MkPasswd-0.02/lib/String/MkPasswd.pm">String::MkPasswd</a>, 
<a href="http://search.cpan.org/~clkao/Text-Password-Pronounceable-0.28/lib/Text/Password/Pronounceable.pm">Text::Password::Pronounceable</a>, 
<a href="http://search.cpan.org/~tjenness/Crypt-PassGen-0.05/PassGen.pm">Crypt::PassGen</a>etc.), but they focus on creating random passwords - leaving it upon the user to manage and remember them. 
<br />
<br />This might be useful as a firefox extension as well. I eventually plan to convert it to one, but if someone else wants to do it, or has already done so - even better. It's a very simple idea, and I'm sure it can be implemented purely in chrome/javascript. 
<br />
<br />I need a place to announce it and I will let this be that place.</div>
</content>
</entry>
<entry>
<title type="html">Gutsy to Hardy - upgrade hiccups</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/07/12/gutsy_to_hardy_-_upgrade_hiccups/" />
<id>http://www.theoldmonk.net/blog/archives/2008/07/12/gutsy_to_hardy_-_upgrade_hiccups/</id>
<published>2008-07-12T12:52:53+05:30</published>
<updated>2008-07-12T12:52:53+05:30</updated>
<category term="tricks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">
<br />
<br />So I decided to upgrade to Hardy after doing a 
<a href="http://en.wikipedia.org/wiki/Wubi_(Ubuntu)">Wubi</a>install on a couple of machines. With some gotchas of course. 
<br />
<br />I couldn't login. Not even as root. It wouldn't even ask for a password, but straightaway said "login failed" (on the console) and "authentication failed" (gdm). 
<br />
<br />That seemed like a PAM problem and it was. My 
<a href="http://www.theoldmonk.net/blog/archives/2007/12/01/encrypted_home_setup/">encrypted HOME setup</a>uses 
<a href="http://code.google.com/p/pam-encfs/">pam_encfs</a>which had a problem loading into PAM. 
<br />
<br />The fix : a recompile, but after the patch mentioned in 
<a href="https://bugs.launchpad.net/ubuntu/+source/libpam-encfs/+bug/205783">this bug</a>. 
<br />
<br />Also, my 
<a href="http://www.theoldmonk.net/blog/archives/2008/03/04/network_profiles_in_ubuntu/">network profiles</a>stopped working - which turned out to be because of sudo. Adding a 'env_keep=NETSCHEME' to the Defaults in sudoers fix that too.</div>
</content>
</entry>
<entry>
<title type="html">Location aware GTD trick</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/07/05/location_aware_gtd_trick/" />
<id>http://www.theoldmonk.net/blog/archives/2008/07/05/location_aware_gtd_trick/</id>
<published>2008-07-05T12:20:17+05:30</published>
<updated>2008-07-05T12:20:17+05:30</updated>
<category term="tricks" />
<category term="hacks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">I have my 
<a href="http://www.theoldmonk.net/blog/archives/2008/01/28/commandline_gtd_with_gtdo/">gtdo</a>to manage the TODOs, and it shows me the list every time I open a terminal (via a 't ls' in my .bashrc). But what to do when my '@work' TODO list grows long and is shown to me on every terminal spawn, even at home? 
<br />
<br />what I also have is my 
<a href="http://www.theoldmonk.net/blog/archives/2008/03/04/network_profiles_in_ubuntu/">network profiles setup</a>. Till today, my office profile was called "office" - which I changed to "work". This makes my profile name the same as my context name ('work' and '@work' - we can manage the @ in the context). Do I need to say more? :) 
<br />
<br />Every time I do a 'NETSCHEME="work" sudo ifup ath0' and the network comes up, the '/var/run/network/ifstate' contains a line like 'ath0=ath0-home'. Which means, I can get the profile I'm using. Which means, if I name my profiles carefully, I can get the location I'm at. Which then means, if I name my contexts carefully, I can get the relevant context. 
<br />
<br />Adding this: 
<pre>
LOCATION=`grep -m 1 '-' /var/run/network/ifstate | awk -F '-' '{ print $2 }'`
t ls @$LOCATION
</pre>to my .bashrc works like magic. 
<br />
<br />By the way, I *could* scan for known SSIDs and select a network (and hence a location and a context) automagically, but I don't do that yet - one of the reasons being that I *think* there might be an information leak hidden somewhere. But I haven't thought it through. But I might, and then I might get around to doing it.</div>
</content>
</entry>
<entry>
<title type="html">Being too smart is annoying</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/06/25/being_too_smart_is_annoying/" />
<id>http://www.theoldmonk.net/blog/archives/2008/06/25/being_too_smart_is_annoying/</id>
<published>2008-06-25T19:19:20+05:30</published>
<updated>2008-06-25T19:19:20+05:30</updated>
<category term="tricks" />
<category term="web" />
<category term="hacks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">Some people have been saying that Firefox tries to emulate other browsers and be Windows-like in general. Some people have been saying that about Linux/Ubuntu as well. I don't know how correct they are and what they're based on, but there's one thing that comes in the category of being too smart and too user friendly which ends up annoying the regulars. 
<br />
<br />I was on my machine and wanted to run a remote instance on Firefox, with the display forwarded back to my machine. I had X forwarding over SSH and my DISPLAY enviroment variable all set up. But when I started 'firefox' on the remote commandline, it opened up an instance of firefox *locally*. WTF!!? 
<br />
<br />The 
<a href="http://linux.derkeiler.com/Mailing-Lists/Fedora/2007-10/msg04000.html">fix</a>to this is a 'MOZ_NO_REMOTE' env variable. Duh.</div>
</content>
</entry>
<entry>
<title type="html">Widescreen monitors and modelines</title>
<author>
<name>gera</name>
</author>
<link rel="alternate" type="text/html" href="http://www.theoldmonk.net/blog/archives/2008/03/19/widescreen_monitors_and_modelines/" />
<id>http://www.theoldmonk.net/blog/archives/2008/03/19/widescreen_monitors_and_modelines/</id>
<published>2008-03-19T20:28:26+05:30</published>
<updated>2008-03-19T20:28:26+05:30</updated>
<category term="tricks" />
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml">I got a new widescreen LCD for using with my Eee. Everything went on fine, but the default resolution of 1024x768 kinda sucked. The monitor (Acer AL1516W) supports a max of 1280x800, so I tried that, but I needed a custom modeline to get it working. The monitor specs say that it supports "1280x800@60Hz", but a lot of modeline generation tools don't support that odd widescreen resolution. 
<a href="http://xtiming.sourceforge.net/cgi-bin/xtiming.pl">This one</a>does. The catch is the 60Hz - which is more like 59.91, which goes in as 59.73 in the textbox on that page. It does tell you the different values ("actually 59.91"), but you have to keep an eye. Another important thing is the monitor's 'Dot Clock' frequency. If you're exceeding that (and the tool will warn you if you are), it's most probably a mistake. Go re-read the specs of the monitor again. 
<br />
<br />FWIW, here's the modeline for the Acer AL1516W that I generated for the Eee : 
<pre>
"1280x800@59" 83.44 1280 1312 1624 1656 800 816 824 841
</pre></div>
</content>
</entry>
</feed>
