Archives

Over time I've encountered some great pieces of Free and Open Source Software. I just wanted to list a few noteworthy products in a single place I can refe

All our remote users are using LDAP cached credentials using SSSD. This works really well for users that transition online to offline, with one failing. Wh

Searching for IP addresses in a file or files: grep -oE '((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])' file

I recently had to do an ldapsearch / ldbsearch that returned some base64 encoded results. $ sudo ldbsearch -H /var/lib/sss/db/cache_LDAP.ldb '(&(objectClas

The Grafana dashboards are a really nice interactive display of metrics. What we want to do is take those graphs from a dashboard and share them on a stati

https://docs.arbitrary.ch/security/systemd.html

I regularly end up writing a bootable USB to start a different version of Linux or different distro. Then I came across Ventoy . Once a USB stick is instal

The behaviour of my browser seemed to have changed, and no longer lets me share a screen. I end up with a presentation of three black screens to share, and

Hosting a customer's web service for ERP systems means the hosted system has limited options of sending printable material to the end user. Usually it invo

The usual tar cvzf ... uses box standard gzip. A parallel implementation of gzip for modern multi-processor, multi-core machines https://zlib.net/pigz/ Swi

I noticed a bot had decided to target our Gitea service, so thought of putting it into fail2ban to lock it down. Turned out this wasn't as straight forward

I wanted to ensure I wasn't pushing unencrypted data onto our Git repo. It's set as private anyhow, but the repo I'm using is for our Ansible library. It c

Shortcuts to getting meaningful data from journalctrl Specific time frame journalctrl --since "18:00" --until "18:03" More descriptive times journalctrl --

Apache Guacamole - not the answer I was looking for, but impressive. I wanted to get a remote desktop session to a client machine to support them in the se

I mainly use two Linux distros - Manjaro and Debian (or Debian based distro Mint). For most remote workers, I rolled out Manjaro with caching authenticatio

How to get an elevated privileged shell the easy way. https://github.com/carlospolop/PEASS-ng

The dev team wanted a version of Nginx that included some custom modules. I've previously built custom Nginx on bare metal, but this time it wanted to be i

It surprised me today that all of my Manjaro builds are using DHCP. I needed to make one of the devices a static IP, as it delivers DHCP, and would be a cy

This gives the users a very convenient means of enabling and disabling WireGuard tunnels. Install the Extension from: https://extensions.gnome.org/extensio

When synchronising files and folders with lsyncd I wanted to maintain the original owner and permissions. To do this I added the rsync stanza to my /etc/ls

Out of the box, WireGuard is a simple tool that solves a simple issue. Securely connect this system to that system. But what if that's not quite enough? If

We don't often have the need to expose PostgreSQL to a network, let alone the internet. Mostly the instances are enclosed within a Docker container set and

iptables isn't essential for WireGuard. It really depends on your requirements. In my previous post , I used iptables for a point-to-multi-point set up. Th

Many times I find myself wanting to spin up a simple test service for a firewall rule. You can bring up a simple web server in Python3 from the command lin

WireGuard is a very simple and efficient firewall. It has only one authentication mechanism and that is using public key cryptography, either public/privat

If you're looking for the answer to how to get Gnome to connect to your OpenVPN using OTP, then you're going to come to a dead end. There's been an outstan

With 2FA/MFA and OpenVPN on Linux you need to use the terminal to start up the session. sudo openvpn user.name.ovpn You then get to see all the prompts for

So far I've seen 2FA/MFA with OpenVPN using a 3rd Party plugin openvpn-otp.so from evgeny-gridasov/openvpn-otp , but after I got it working I didn't like t

Setting up restic as per the instructions on Backblaze didn't work exactly as planned. The environment variables needed to be changed from B2_ACCOUNT_ID an

Talk about driving me crazy. We had error messages in our logs claiming that the vacation transport - or out of office auto replies didn't work because of

Code quality and code security https://www.sonarqube.org I found this very useful in scanning my code and pointing out some basic quality and security impr

One of the things that trips me up is writing Vue components and passing in parameters and returning results. It's a one way process in the main. You can p

Despite using the --no-color switch for docker logs, I still get colour output. This is frustrating as I just want to throw the output into a file for anal

Following on from Python Motion Sensor I put together a 2004 LCD display, DHT11 humidity and temperature sensor and the AM312 PIR and came up with a displa

I wanted to add a motion sensor into a Python project that would activate a display to show the temperature only when someone was nearby. The AM312/HC-SR31

Yep, whilst applying some updates to Manjaro, my screen goes blank and the system dies. This time the updates are with 5.17, and it forced me to reboot and

I tried to pick up where I left off with my Laravel skills. I began with some vuejs pages and wrote the api to feed the data to them using axios. It took m

I feel like the past few days have been quite a battle. Mostly in terms of my memory and trying to remember what I did with Laravel and how I can re-establ

It's been a very long time since I did anything with Laravel. I found another job around the time of Laravel 6, and today they are up to Laravel 9 - much h

Terminal Multiplexer, it's like screen ++ I generally use screen when running detached processes, been doing so for a long time and switching to tmux is go

Building a resilient set of web services (or microservices) means setting up a proxy that is able to dynamically set up "upstream" services when they are a

Working on a customer's AWS database instance, I found they didn't have all the passwords. I could get onto administer to AWS RDS database and instance, bu

This is stupid. I'm trying to use telegraf to collect stats from postgresql. I want to use the input plugin postgresql_extensible and output the data to In

Previously, we used InfluxDB v1 - now we're rolling out InfluxDB v2.1. Building the Container Set We're going to use glances, influxdb and grafana. version

Whilst doing some experimentation with OpenLDAP I found that if I hashed my passwords using SSHA-512 in Apache Directory Studio I would not be able to auth

I caused myself a few hours of frustration today. I installed a new instance of Manjaro today, and it applied some Lynis security suggestions that I didn't

This cost me a few hours today. I thought my ssh config was messed up as nothing i did would allow me to get onto my remote workstation, but it worked fine

Using crontab or the like, I always find myself in nano , which is my least favourite editor. To make a choice of what editor to use, there are a couple of

Following on from Spam Assassin and Bayesian Learning To give our users the ability to forward mail to the spam learning feature, we need to ensure the for

Spam Assassin is the good old go to for filtering emails, but I wanted to upgrade our existing system and add into it the ability for users to send their r

This was a cause for smashing my head against the wall today. I configured Exim4 with LDAP auth and tested it with Thunderbird and a couple of Mac clients

Having setup postfix and LDAP auth , setting up an Exim server should be within our capabilities. The trouble is I find the exim config a bit scruffy and c

How difficult can this be? Same server config, just want to enable TLS so it finally has STARTTLS support. Well it looks easy enough as you just need to dr

For users of our LAN and Guest networks, I want to grab all their DNS calls and service them using our own resolver. This means that any call to an externa

A Little Fun

https://www.coderstool.com A raft of useful generators for various things like hmac, base64, json, time difference, etc.

zipimport.ZipImportError: can't decompress data; zlib not available Requires zlib1g-dev sudo apt install zlib1g-dev

We wanted a way of delivering passive status updates from our dockers to the Icinga2 API. I've used bash scripts for this in the past with curl, but figure

After an upgrade on Manjaro, I got no graphical environment. Looking in the logs it tells me something is going on with nvidia: $ sudo journalctl -b ... Ja

As my download station operates headless, Cockpit is a nice way to manage it using a browser. https://www.redhat.com/sysadmin/intro-cockpit

Well, Couchpotato is no longer being updated, and the project had been archived as read only. That's not good, I've used Couchpotato for years. I did some

Package manager said I needed some updates, including nzbget. Usually this is pretty straight forward, but this time it just fails and goes into a state wh

Having a new LilyGO TTGO ESP32 arrive, I got to work on flashing it with Tasmota straight away. A bit fiddly as you need to connect the download board, whi

With the Gatekeeper project , it was decided to look at wired Ethernet connectivity rather than WiFi. I guess there's some added security to that, but it d

As resilient as our docker build is I'd like to extend it to a clustered instance of Keycloak. This way, I can load balance a pair of docker containers and

This section focusses on the optional configuration of a custom schema for LDAP. It's completely optional, as you can use ready-made LDAP attributes to sto

This article covers the python programming used to control the gates. At this stage I'll post some snippets and ideas on why and how I do things this way,

Following on from ESP8266 Real-World Project where I explained the electronics side of the project, this article continues to cover the other aspects of th

Gatekeeper, Part 1 This week, I've been working on an Open-Source electronics project. I've never really been successful with electronics, my soldering is

Wow, what an incredible find this was! I'd been writing Arduino code for the esp8226/32 to match an electronics exercise I have been set. I was grabbing li

https://www.circuito.io/app I was looking for something to draw circuit diagrams and this is a step further! Pick your components, and it will even show yo

I just soldered some headers onto my Wemos Lolin ESP8266, and my soldering skills aren't what they should be. Then I hooked it up to my Linux PC and tried

Using either the ESP32 or ESP8266 there are a few things I've learned that I should make note of: GPIO n != D n When looking for the pin numbers to wire to

I've been tasked with an electronics project to scan NFC/RFID devices. Electronics is very new to me. I can handle the bit where I know what I want to buil

Made Me Chuckle

I wanted to trigger a cron that ran a task between a certain window, but wanted it to run at a random time to minimize clashes with other systems. This is

I needed to pull a lot of text from some images, and that called for OCR - Optical Character Recognition. It looks like the goto package for this is tesser

When I browse to open a file, I'm always frustrated about the order in which things appear. I don't like the whole lowercase before uppercase, and having t

After setting up a new fully encrypted system, I found that I couldn't unlock the disk encryption with the password I know I set correctly. I added a new p

I've not had to do this before, but today I needed to replace my SSD with a bigger SSD and would really like not to have to reinstall from scratch. GParted

Setting up an encrypted boot volume is pretty straight forward at the time of installation. But what we wanted to do was add additional encrypted volumes e

Considering I've been a long term user of Windows - far longer than Linux, I really find myself detesting the platform with a vengeance. All I wanted to do

I've got a few Kindles that the wife an I use. The one I use primarily is a PaperWhite 1 - it's been used almost every day for many years. The one thing I

I've inherited a couple of OpenWrt firewalls that need some upgrades. They're not hugely outdated, only a major version behind. I need to figure out the up

Most of the equipment we use is in house wired workstations with a few remote users on a BYOD type setup. What I wanted to try to bring in was a cached aut

When running an Ansible playbook on a Linux Mint host I found that the variable distribution_release returned the Mint code name of ulyssa . This isn't ver

Whilst locking down some workstation with usbguard I wanted to gain more of an insight into what devices I wanted to block or allow. For simple data leakag

I found this very useful. Not just scanning QR codes, but I can use Vivaldi to scan any barcode and copy the output to the clipboard. Keep an eye on the ad

Today I took the rolling updates and as it was updating I got an error message that I didn't understand. Warning: installing nvidia-utils (460.80-1) breaks

It’s really simple and after googling I couldn’t find a straight answer. Login via SSH sudo /var/packages/DNSServer/target/script/flushcache.sh References

It's been a long time since Wayland became a default in many distros Gnome environment. The trouble with this has been the lack of remote desktop functiona

https://www.howtogeek.com/499623/how-to-use-journalctl-to-read-linux-system-logs/ journalctl -F _COMM journalctl -f _COMM=nslcd journalctl -S -1h journalct

YouTube music now has a PWA (progressive web app). In Chrome you may get asked to install this when you visit https://music.youtube.com . As I'm a Vivaldi

I've seen a few user complain that Thunderbird isn't exactly pretty as a mail client, especially those coming from Outlook. There's a few addons you can us

My office PC is setup to authenticate against our LDAP server and is configured using the Arch guidance here: https://wiki.archlinux.org/title/LDAP_authent

I need my office PC to be permanently available so I can access it remotely. This was working just fine after I disabled all the sleep mode settings when I

As a follower of Open Source it's time to look at a storage platform that offers an S3 service like Amazon. Minio offers us a storage platform that we can

After a reboot I found I was being presented with an authentication dialog after login stating: setting rfkill state requires authentication It turns out t

With the plus version of Nginx you get access to the compiled version of geoip2 plugin. This means you can use it out of the box just add it into the confi

We've been using certbot and Let's Encrypt for years. But we have some legacy systems hidden in the bowels and darkest corners or our data centre that are

When it comes to pulling code from some of our private repositories we've configured a couple of systems with deploy keys. This allows them to pull the cod

A simple task of installing Manjaro on my office PC turned into a running battle that burned away the day. When connecting to the NFS share for my home dri

Using AutoFS you can automatically mount network shares onto your system. Installing it from your repository is easy enough, but some distros have slightly

Maybe not so much forgotten, but an undocumented password. It's an easy process. Boot into grub, press e on your usual boot line and then change the /boot/

I just installed Manjaro on my laptop and found a quirk problem where the terminal won't fire up. I resorted to installing xfce-terminal to see what was do

When building a python container, I ended up with a huge 450MB image just because I needed it to have psycopg2 . Time to chop it down using a multistage bu

One of the most helpful pointers I found was to spin up an alpine container on the virtual network you're struggling to get connectivity over. Then you can

Traefik is a reverse proxy that is configured directly from your docker configuration.

It's time to look at building replicated services using Docker swarm. Mostly I build lots of docker compose configs, but not had the need to create an auto

For the past few week I've had a really frustrating time dealing with a customer system. Initially I put it down to me moving to Manjaro and the VMWare Hor

Here I'm building a library of health checks used for various docker-compose containers. MySQL / MariaDB healthcheck: test: [ 'CMD', 'mysqladmin', 'ping',

Manage zsh the intelligent way. Install curl -L git.io/antigen > ~/antigen.zsh Configure ~/.zshrc source ~/antigen.zsh # Load the oh-my-zsh's library. anti

What a frustrating exercise to get to do something so simple! I'm running Ansible AWX 14.1.0 as a local docker install. The installation did all the hard w

I had some of my bash code commented on publicly and the one comment was "You should run your scripts through shellcheck ." This was probably the most usef

After building an ejabberd container set I'm continuing my foray into the world of xmpp by looking at prosody . I've run into a few man traps along the way

We use a simple method of putting an Nginx site into maintenance mode. Just set a geo default variable on on and have it generate a HTTP 503 status respons

This has been a very tough few days. I was asked to build some load testing scripts for use with Locust. I was told "How hard can it be? Just a few scripts

In a previous article Apache Directory Studio – JNDI I explained how to keep the JNDI connection to use LDAP over a socks proxy. It looks like this has gon

I've a few programs that require Java and some need older version that others. I currently have openjdk 8 and 11 installed and needed to switch the default

Keycloak is a great tool for authentication and I'm bundling it into a package that includes LDAP. What I want to do is automate the deployment of Keycloak

Quite often I find myself creating files using a template that populates content using the projects .env file. Mostly I find myself using good old bash to

When running the ejabberd docker image in my container set I ran into a problem where I hit the rate limiter on Let's Encrypt. This meant I could switch to

Putting together a container set with movim and ejabberd I ran into CORS (Cross Origin Resource Sharing). I'm using the default upload url https://@HOST@/u

Getting this shared roster from LDAP into my ejabberd config has been an absolute nightmare. Everything I find seems to be people asking the same question

When using Gnome Nautilus I'm not seeing any support for nfs shares. This means I can't use it to browse my NAS. I trawled the net for some time, being lea

I've been playing with Manjaro and the package management is way different to Debian. I needed to get some work tools installed and the VMWare Horizon Clie

This uses a completely different scheme than Debian. Let's say I have two .crt files (pem format) for intermediate and root certs use the trust program to

I rarely use pictures on my background wallpapers and like to use simple colors. There doesn't appear to be an option in gnome-tweaks to allow me to attain

We have a couple of hundred certs with Let's Encrypt and it is a great service. Right now though we need to issue certs to internal systems and thought it

We're looking for a way to get our remote users authenticating with the office systems whilst they are on the road, or in these troubled times working from

When trying to install Ansible on Debian following the install guide here: https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.ht

I wanted to automatically trigger downtime when we ran maintenance tasks on our client systems. For this I wanted to add in a bash script to make the call

As I find myself writing a few scripts these days I thought I'd sate the template I use to build with. It includes parameter collection. https://gist.githu

When you visit a site requiring a client certificate you'll be presented with a dialog to select a certificate to use. This is awkward in a kiosk scenario

On the OpenLDAP server I see a lot of entries in the log file about uidNumber not being indexed. If this is the case I should add an index to try to help w

We're using client side certificates on an Nginx host to ensure the credentials of the connecting users and haven't used the site for a while. I tried to l

To use LVM as a backing store you need to install a locking mechanism and build the volume groups with the --shared option. sudo apt install drbd-utils lvm

If you've installed the open-iscsi and multipath-tools you might still find that you multipaths aren't working. sudo apt install open-iscsi multipath-tools

ERROR: could not find an available, non-overlapping IPv4 address pool among the defaults to assign to the network We have a staging environment that runs a

Starting to look at a nice front end for Ansible and found a few quirks with the process that need to be taken care of. The actual installation of AWX need

As we host lots of sites we have lot's of DNS. Currently it's a database driven old version of ISC BIND. There are certain tasks we need to do manually to

With glances on Linux we are able to get a good overview of performance, including the dockers that are running. Rather than simply watch this on screen we

With the temperature the past few weeks I thought I'd setup a means of monitoring it to trigger alerts in Grafana or Incinga2 by using a Raspberry Pi to co

This morning was pretty much written off by some nasty occurrence I didn't pay attention to yesterday. Whilst trying to fix gimp with lots of apt manipulat

STOP READING NOW IF YOU CAN'T HANDLE DISAPPOINTMENT. It's been a while since I originally wrote about the Raspbian & Realtek 8192eu WiFi USB Wifi adapter a

I'm not great at remembering what I did so I can include it on my time logger. I found I could trawl through my zsh history file to get an idea of what I'd

I've never had a comfortable relationship with Java. Every time something goes a bit wrong in something that uses Java, I spend hours and even days trying

After getting Keycloak up and running, it's a breeze to connect it to LDAP and use the users from there, but there were a few things I missed about group m

Single Sign On from a simple docker container set. The container might be simple but the complexities of OAuth2, SAML and identity services are far from st

With a move to a more joined up authentication using Single Sign On (SSO) I deployed a Keycloak service in a docker container - that should probably form p

What ciphers are used by your smtp server? Well that's a question I got asked today. Take a look at this testssl.sh - it spawned a whole report about my SM

We want a little more control over some of our reverse proxies and wanted to place a little extra burden on the users as possible. To do this we chose to u

Today I built a FreeRADIUS server within a Docker container set using docker-compose. As we only have a small number of users on the WiFi system it was set

Upgrading MySQL 5.5 to 5.7 in a docker container set caused me some trouble. Setting the tag to 5.7.30 was all well and good but when I fired up the contai

Life got easier after I found this in Apache Directory Studio - edit your connection go to the "Browser Options" tab and tick the Features option at the bo

Having had some experience with Nagios and writing Nagios plug-ins and using nagiosql3 to manage the configuration, the new job uses Icinga. I've had no ex

System logging should not remain a local activity. If you find your system has been compromised often the first thing in the attackers mind is to stop it f

In the days of corporate lore I faced system hardening challenges driven by Nessus. Now because Nessus isn't FOSS (Free Open Source Software) it's not some

Back when I built the Nginx failovers using Nginx and Keepalived I also required that should the config change on the master then the config would automati

After upgrading the LDAP server so we could make use of some new features like olc and in particular memberOf I ran into a major issue. Where many programs

Typically SSH creates a new tcp session for every time you connect to a remote host. But there is a feature of ssh that allows connections to reuse an exis

Working from home means making use of different technologies to connect to systems in the office. Not all of our file system are available over webdav, and

Here's my handy script for bringing a socks proxy up and down. Saves the hassle of finding the PID of the ssh proxy process to kill it when you're done. so

I got myself into a bit of a knot with this one. We wanted multi-factor authentication setup on the main SSH gateway and that meant private key, password A

Traditionally we store public keys in ~/.ssh/authorized_keys , but this means pushing them around all the servers we want to connect to. Instead of doing t

I had to go through an exercise of accessing a number of a clients servers and reset the root password. They didn't have it documented anywhere and couldn'

Using Nextcloud with LDAP is straight forward enough, you just add in the "LDAP user and group backend". We wanted to use Nextcloud to enable our LDAP user

I made a bit of a fool of myself suggesting that we add a free means of securing our external SSH gateway by using Google Authenticator. My boss simply tur

Enable WebRTC so you can use a plain old HTML5 browser to make calls. I had already configured Asterisk's http server to use my Let's Encrypt certificates.

As I'm working on Asterisk right now the actual challenge is to get Jitsi configured so we can conference in audio users to our video chats. To do this you

I just spent the best part of the morning trying to setup Inter Asterisk eXchange between two hosts on the same network. This was described to me as "an ea

Given that the SIP credentials passed by Asterisks real-time backends are stored as either MD5 or plain-text It's best that we think about securing the com

I started out wanting a real-time database connection to our existing LDAP server. This went well, but involved importing a schema into the LDAP cn=config

https://engineerworkshop.com/2020/02/20/how-to-set-up-wireguard-on-a-raspberry-pi/

My understanding of iptables is rudimentary, and I thought it's time to improve on it. I have an understanding of firewalls, NAT and packet filtering, but

In light of the possibility of many people needing to work from home the boss wanted to upgrade the phone system to bring in some fixes and new features fo

We do a lot of postgres replication in our environment. Just about every docker postgres instance replicates its data over to a remote site for failover, s

Now we know how to inject client certificates into Firefox and Chrome it's time to automate that process with Ansible. The goal is to take a client and CA

Continuing the automated delivery saga Linux Mint is the thing that's giving me difficulties. There are a few quirks installing Linux Mint 19.3 Tricia that

Continuing with the theme of deploying systems automatically this chapter deals with using an NFS share to hold your iso images. The problem I faced was th

I wanted to build on the automated deployments for Debian and Mint, etc. and the next logical step is to use a PXE boot server and DHCP. Thankfully someone

I'm using a vpn based on OpenVPN and when I try to fire up a docker-compose set of containers it fails with: ERROR: could not find an available, non-overla

Not sure if a 'LAMP container set' is the right name, but I have a docker-compose container set that includes Nginx, PHP and MySQL. I seem to build them re

The installation on eoan fails with a missing dependency for containerd.io not having an install candidate. Fix Edit your /etc/apt/sources.list file and ch

Well that was a really tough day. Turns out we have a kinda favouritism for Linux Mint on Desktops. Preseeding for Linux Mint kinda works the same was as D

The boss walked in today with a new desktop PC for a new staff member and handed it off saying: "I hope we aren't going to be using some antiquated process

The LDAP instance in our environment is pretty ancient and has served well for many, many years. But there's one key feature we'd like to see added to our

After working with Saltstack I thought I'd do some investigation with Ansible. I'm in the market for automation and want a simple means of delivering confi

Now with added Chromium! Fun and games with Nginx and client authentication certificates means we need to deploy certificates to the user for them to trust

After a day of battling with a very laggy and Windows bound Logmein we decided it was time to get to the customers Windows machines via a conveniently plac

EFI, Windows 10 and Ubuntu make for a bumpy road. After installing Ubuntu onto the partition I made available in Windows 10, Ubuntu configured grub and whe

We've all been through lots of window managers from Gnome, LXDE, Cinnamon etc. but I think I've finally come up with a pretty desktop environment that I'm

Never done dual boot partitioned a Windows and Linux system before and to be fair never really ever want to again. The idea is good in principle but if you

Maintaining a secure connection to a remote host using SSH to securely tunnel traffic for underlying services like MSQL, PostgreSQL or just for remote supp

Following on from Filesystem Synchronisation where a Docker container was setup to handle receiving files over rsync+ssh this handles the sending client si

Every time I fire up a zsh shell terminal in gnome-shell I can't add my ssh key to an existing ssh-agent instance. $ ssh-add Could not open a connection to

I need a repeatable process for handling synchronising files between systems. Something modular and stable. A couple of Docker containers using lsyncd and

As I've been working on Docker containers I've been having to use local containerised versions of ssh key pairs and known_hosts . I need to be able to carr

When wanting to monitor the condition of your containers using Nagios there are some really nice features you can enable to check that your containers are

You can get Saltstack to manipulate package deployments using debconf. What you'll need is to know the questions that debconf has about a package so you ca

Following the installation guide caused a few quirks and failures on my Debian 10 install. There are a few missing packages and the bootstrap version of th

Up until now all of my Linux authentication has been local file based auth. I've added LDAP to services and applications, but logging into a Linux box has

https://ceph.io/ Ceph uniquely delivers object, block, and file storage in one unified system .

When setting up a new Debian Gnome it's nice to make things look the way you want. Here's a few changes I make to sort out my desktop. Hide a User from the

After setting up LDAP authentication on my machine, things went as expected, and I was able to authenticate at the GDM login and sudo from the command line

I've been using vi for ages and about my limit is search and replace. Here's a place for some magic I've been picking up more recently. When you've forgott

Today a chunk of the network CNAME resolutions failed. We looked at the config file /etc/dsmasq.d/dns-cname.conf and everything looked in order. A test of

Setting up an open source virtualization solution is pretty straight forward. You just need to ensure you include all the components. This should drag in a

New job, new challenges. I've come across docker in the past, but have pretty much been on the follow these commands to fire up a docker and then use it. N

Sometimes I'm surprised at why I've never come across things before. This is a big one for me. For the longest time I was pondering how to resolve some SSO

A tool box for low cost virtualisation with replication, management and high availability without the need of expensive SAN's and shared storage devices. h

Whilst experimenting with Nuxt.js (A Vue.js framework) as a front end client for Laravel I discovered I was going to face some issues with CORS, certificat

Today I've been working on an idea I've had for a while now. Sometimes you want your internal data exposed to the outside world, but don't really want to o

Surely not! Whoever would want to develop software using Windows? Well over the past week or so I've been taking a look at how things would look if I were

An open source log file viewer for Windows https://github.com/RolandPheasant/TailBlazer

Using git to push commits up to the remote is all in a days work. The change happens when you switch to a new remote and use a new account. My first action

I'm a Linux guy. I like my line feeds a simple LF. but when developing cross platform and you hit Windows and face CRLF. It can be a real linting challenge

Our app currently uses LDAP authentication but as our environment is rapidly moving onto the cloud and Microsoft Office 365 it's time to investigate authen

Today's challenge caused me to burn a lot of time before resolving the issue, which turned out to be an obvious mistake. When I run a unit test I need to a

Related to my previous post about Laravel. Guzzle and Nginx I ran into an issue with our proxy. The proxy is always a source of fun and games. Because the

I was tidying up another PC today and came across an annoying issue that I couldn't resolve. It took me a while, reinstalling, uninstalling choco etc. and

http://overapi.com/

After deploying a working test into our pre-production environment the Guzzle API calls we were making to fetch bank holiday data from the .gov.uk site sta

Looking at my virtual dev system I noticed the time is off. I checked the timesyncd.conf and restarted timesyncd and saw lots of similar errors to this in

A very handy grep that you can use to cat your files without the hash (#) comments: $ grep '^[^#]' /etc/systemd/timesyncd.conf Produces only the lines that

We've all got SQL that needs tidying up. https://poorsql.com/ or https://sqlformat.org/ or http://sqlformat.darold.net/ It wont fix your syntax but it will

Today is not a lot of fun. I've been seeing some issues with apt not being able to upgrade Gitlab due to a proxy error. This morning I fixed it and the upg

A little while ago I wrote a php routine to import CSV files that contain a lot of data into a MySQL table. It works, but it takes it's time doing so. I wa

Now Postman is awesome, but I came across this really good rest-client plugin for VSCode. What makes it so good is that I can save the .rest or .http files

I was trying to add the Postman app to my Gnome favourite bar, but right clicking it doesn't give me the option to add it as a favourite. Apparently if you

I have no idea how we came up against this issue on one of the development images. I'd prepared it all up to the point of delivering php. After following m

For a while I've been meaning to fix my workstation. When it comes to remote accessing it from home I find I can't because I've followed the green guidance

When trying to get PHP v7.1 running on a Debian Buster development box I ran into an issue where pecl would compile the sqlsrv.so and pdo_sqlsrv.so files f

Working behind a non-transparent corporate proxy and firewall is enough to make you psychotic! You'll find enough post on here about setting up environment variables and handling proxies, but there's always room for one more.

After building a development environment in Linux as per a previous article - https://warlord0blog.wordpress.com/2018/07/13/building-a-debian-development-s

I recently attended the Laravel UK conference and learned a lot of very useful things. One of them related to a caching methodology being used for data tha

https://stackoverflow.com/questions/13059744/where-can-i-get-a-complete-list-of-laravel-events-fired-by-the-core-libraries

This gave me cause for tears today. The VCSA (vCenter Server Appliance) management Web UI ( https://vcsa:5480 ) decided not to let me in as root. I'm guess

Following on from Windows, Apache 2.4 and OpenSSL our vulnerability scanner has picked up that although the version of Apache httpd 2.4.39 has not vulnerab

I'm an Atom fan and have used it on Linux for ages. I probably still will, but our other developers tend to use VS Code because of their use of MS Windows.

My recent troubles spawned from connecting my Laravel application to a Microsoft SQL Server database. My username and password are correct but the connecti

My automated apt updates failed to update the Microsoft SQL components because they don't accept the terms and condition in the EULA. To resolve this I add

Updates on my Stretch servers were failing due to an expired key. I tried the usual retrievals for keys using: $ sudo apt-key adv --keyserver keys.gnupg.ne

Following my previous article - Ubiquiti Amplifi . My brother decided he needed to improve his wireless LAN. He'd been using some Netgear range extenders f

This is a great ESP8266 component that greatly simplifies the deployment of a web server. It's very capable and can handle websockets, compressed files and

Looks like my friend likes to try to go one better. When he saw how I'd taken his original Wake-On-Wi-Fi idea and turned it into project Scorpion he moved

Bye, bye Asus RT66U you served me well. Until all of a sudden the connection speeds on my 802.11ac would fluctuate wildly between 3Mbps and 150Mbps when pr

The corporate app just got made a bit smarter. In order to alert users that something has happened that they should be aware of we've added real time notif

For some time we've suffered a problem with our Windows 7 VDI systems that has prevented us from applying Windows Updates. If we applied any of the rollups

The more development time we spend on the corporate Laravel app the more mature the code becomes and the more our development practices evolve. One of the

I started to do some work on how efficient the spacial SQL queries I was using are. That meant looking at the indexing that is used on the geometry column

Today saw me upgrading our Sophos Mobile Control v8 server. Mandatory Upgrade Notice: Sophos Mobile 9.0 Dear Customer, Please be advised that, effective Ap

Using package managers is second nature in Linux, but in Windows you get free reign to go download and install anything you like from anywhere. Not a bad t

On with this current theme of spacial systems and mapping, one of the interesting challenges I faced was querying spacial data. My particular problem was t

Over the past few weeks I've entered into the world of spacial systems and mapping. We have a couple of members of staff who look after our GIS (Geographic

Today after running some apt upgrades my Laravel development environment failed to compile because of a newer version of nodejs than I currently require. M

As our codebase matures we return to develop unit tests to ensure our QA process captures any code changes that may have altered the functionality of the p

The elegant git gui for dev teams http://gitahead.scitools.com/

EDC All Packed Every Day Carry is an up and coming buzz, but we've all probably been doing it for years. I've always had a few essentials in the car that i

I'm still not sure why I'm getting this problem occur again. But when running apt-get upgrade the upgrades fail with a message like this: Get:8 http://secu

Using HMR in Chrome on Linux is faultless, but on Windows HMR fails to start in the browser. Looking at the entries in the bowsers script tags they seem a

I fall over this every so often. I have the private key file but would either have to trawl servers for authorized_keys files to get the public password or

Actually this is more about any version of php (5.6, 7.0, 7.1, 7.2) on buster. Php source has taken on a bit of a split and the standard repositories only deal with the one supported version for the current release of Debian you are using.

In Windows when you run into an application that doesn't use proxy settings and doesn't look at the environmental variable, IE or netsh settings, then you'

Got to love having a vendor carrying out half a job... again. Having installed a new VMWare Horizon environment for Windows 10, I thought we'd at least hav

We're in the process of installing a new Horizon 7 infrastructure and as part of the process the vendor added load balancers all over the place. I asked wi

Having setup a pair of load balancers I wanted to ensure the Nginx configuration from one system was replicated to the secondary where changes were made on

That was a frustrating few hours. I added a route into my api.php route and every time I visited it it triggered a redirect. I saw nothing in the browser and it was like my controller function wasn't even being called.

Kind of an unusual situation, but I have a Debian jessie box that has a terrible <2MB Internet connection, no CD/DVD and the USB stick I have I don't want

Today I've been working on a problem where properties being loaded into our CRM system from a GIS DTF file are doing some strange updates. It appears that

I've used a few SQL GUI's over the years, SQuirreL, DBVisualizer, HeidiSQL, MySQL Workbench, but the one that stands out recently is DBeaver . It's got a c

We have a need to authenticate a couple of devices via our Wifi access points with a RADIUS server. Right now I wanted to test things out using a MAC addre

This weekend has turned out to be a challenge. Upgrading our VMware Horizon 7 estate to the latest release involved upgrading all the components from conne

Today Jira fell over. Not sure why, but the result was a token error which refused to let my user or admin accounts ability to login properly. I managed to

I seem to spend most of may day trying to sort out issues regarding getting different applications through the corporate proxy server. I'm really hoping on

Having entered the world of Electron and mashing it together with Vue.js using electron-vue I needed to figure out how to open another window from Electron

When working on a project at home I don't necessarily want to host my Git repo online and don't feel the need for installing a Gitlab server on my home network, but I do want to backup my projects to my cloud backup.

I recently tried to assist a colleague with an issue in JavaScript involving an undefined variable within a Vue.js app. Now I have encountered this issue s

https://github.com/SimulatedGREG/electron-vue

Continuing the Jira and Confluence journey into Crucible I faced a challenge of adding it beneath the same reverse proxy setup. My aim was to end up with a

I've begun looking at building a project using React and followed some online sources to begin with. But then I fell into outdated material that related to

With Atlassian Jira Software and Confluence installed onto the same server I thought I'd investigate setting things up so we don't have to use the default

Installing Atlassian Jira Software onto an in-house or self-hosted server is as simple as following the Jira installation guide . The only thing missing is

All of our SOAP interactions with the Lagan CRM send and return SOAP and by association, XML. The normal practice of handling the sent or returned XML is b

Following on from Verint Online Forms using H2 seems pretty straight forward locally. It fires up a web server and you can manage the H2 database straight

We're new to this and trying to integrate a form solution with our Lagan CRM system. We have a corporately installed test and production system for forms,

That's a morning of smashing my face on the desk again. I deployed my dev program onto a production system and then started crying as it stopped working as

I'm in the process of testing and documenting my API's and up until yesterday I'd only used postman to test my responses gave me something back. But it's capable of so much more!

Back in the day it seems our CRM developers advised us to use Soap UI for testing out the API calls needed. But I thought I'd give postman a try as we've a

SOAP is a dirty word to me. But I have a need to interact with our CRM system to import / extract data. My go to platform for most of my PHP work is Larave

When you run a program using sudo what tends to happen is the sudo/root account fails to do anything useful on the internet. It times out trying to connect

This caused me some grief today. I spent the day adding validation rules into my Laravel resource controller and rather foolishly set HTML5 validation para

No, this isn't about taking the fluff from your belly button - but you're close. https://eslint.org/ Linting your written code is a method of ensuring that

It's a good job my job title doesn't include development. Some things I find out seem a long time after I need then and would be useful in the world of dev

I just can't seem to get it to die! Probably something to do with all those users out there spoiling my day and continuing to use it in Windows 7 - sadly i

When using Laravel it adds in some helpful headers to handle axios requests internally. But when it comes to sending requests externally you end up sending

I'm kinda new to this hosting software externally. I've been happy using Gitlab for internal private projects, but recently I've been forking and reworking

Laravel 5.5 ships with Bootstrap 3. To make it use Bootstrap 4 you need to make a few changes. resources/assets/js/bootstrap.js Change require('bootstrap-s

I rarely need to do this and it's always something I Google when I do. But when I forget the admin users password on my dev app I need to reset it. Easiest

Previously I've used Datatables.net to build my tables on the Laravel blade templates for user interface. Now I've been migrating over to Vue.js I thought

The past few days have been rather eventful trying to get JavaScript Web Tokens (JWT) to authenticate my Laravel, Vue.js environment. As per my previous po

You can see a theme here. Lot's of action on the Laravel and Vue.js front as I'm focusing on migrating our blades over to vue's The process ran into a prob

I ran into a problem where I've started to deploy Vue components using the Vue Router from within Laravel. As soon as I enabled the Vue route for /{any} I

Using Hot Module Reload (HMR) with Laravel

A regular issue for me is failing the initial deployment of a git clone Laravel server using Nginx. It's almost always because I forget to create and give

Using vue.js 3 with Hot Module Reload from a different server than the development environment runs on.

When I setup a development system there are a few steps I follow to get everything working together. The aim is to get everything installed to provide php

A friend setup his home systems to turn on his PC using Amazon Alexa and tasker to trigger a Raspberry Pi to operate a relay and effectively activate the p

With Raspbian on my Zero I only get Node v4 in the repository. So How do I get a newer version of Node.js? If I follow the standard Node instruction for in

You can configure the Raspberry Pi raspbian image to have the details of your Wifi network at boot time - so no more hunting for keyboards and HDMI cables

Configuring EXOS for MLAG and VRRP (active/active) http://www.extremenetworks.guru/exos-mlag-vrrp/

Nuclide is built as a single package on top of Atom to provide hackability and the support of an active community. It provides a first-class development en

Emmet — the essential toolkit for web-developers

I'm trying to test out a version of a SAML project that doesn't include the now defunct php extension for mcrypt. Using composer require kept on grabbing t

Using the Exchange Control Panel showed that the certificate being used whilst not expired and valid could not pass a revocation check. I figured this woul

Since trying out Headphones a few years ago I got frustrated with it in the first hour and ditched it and went back to manually downloading music. That was

No more messing about with installing ntp. Just a simple edit of what ntp servers to use. Internally my ntp fails and reports regularly in syslog: May 16 1

I have a need to deploy a High Availability Load Balanced reverse proxy solution. We have a back end web service that requires resilience. To achieve this

We've had a vsftpd server for a while and it's performed very well for us. But it would appear that it's not actively maintained. This may not be a problem

On a Wheezy box I saw this but was able to continue by answering yes to ignore the authentication warning. WARNING: The following packages cannot be authen

After upgrading Directory Studio - which is a simple case of extracting the tar.gz file into the location you want the executable eg. $ cd /usr/bin $ sudo

We've been using Azure for a few months now so it's about time our certificates would expire right? Well according to the email notification we've just rec

Whilst trying to deploy a Node.js script to one of our windows servers I realised that NPM wasn't downloading the necessary components because it wasn't ev

Frameworks For rapid application development there's a lot of pre-written code out there that is mature and highly capable. There's no need to build from t

When you have a Vue.js powered app authentication using traditional logon pages isn't going to work.

I've kicked this around a few times and resigned myself to just using the non-DFS path to attach to. But we've recently changed some of the servers around

https://github.com/euvl/vue-notification - Notifications. https://github.com/PygmySlowLoris/vue-full-loading - Please wait message.

I started recoding a project that I'd only just built using Vue.js as an exercise in learning Vue. The project had only just been deployed using Laravel 5.

Using Vue.js and building Bootstrap style pages just got easier. https://bootstrap-vue.js.org/

Today I have been mostly smashing my head on the desk trying to figure out Laravel and Vue.js. I thought I'd try to template an existing Laravel 5.5 projec

Ok, so I know Microsoft have been making some big steps in the world of Open Source - I confess to giving them little ear time, mainly because EVERYTHING w

Undefined function: 7 ERROR: function st_makepoint(numeric, numeric) does not exist

Laravel have bundled Axios in with their framework. I didn't know what this was at first and didn't use it. But once I figured out what it was for I tried

I needed a mechanism to upload CSV files to my Laravel instance and then process them into a table. The first part was working out how I wanted to upload t

As I've been messing around with Sphinx I discovered that MariaDB actually includes the SphinxSE plugin out of the box. So I figured I'd ditch my MySQL ins

I've only really used Sphinx as part of a home project with MySQL. But today found that searching for text in 28 million rows in a PostgreSQL table needs s

This should have been easier, but I must have misunderstood how this works. After upgrading to Bootstrap 4, for some reason my node_modules didn't contain

Our GIS team use a PostgreSQL server with PostGIS. They recently asked if there was any way we could display some data in a simple web form for our users.

The newer versions of Laravel support OAuth for token auth, but I wanted to carry on using something simple. Just a token stored in the user table and some

I'm sure when using a mouse in a text terminal the visual mode of vi/vim is useful, but I can never figure it out. In fact it prevents me from copying from

I've got a work project that fills in a database field with multiple comma separated values and thought using the bootstrap-tagsinput script would fit very

Both of these add-ons I forget what they are called. So when I go looking for something that does a multiple select type option in a HTML form I struggle t

Following this upgrade I accepted to install I spent the evening cursing. The system started up and services were accessible as usual, but I couldn't login

I upgraded to PHP v7.2 on my Debian Buster/Sid today. Not a problem until I realised I'd broken my Microsoft SQL Drivers.

This could have saved me some time today! http://hoolihan.net/blog-tim/2008/10/02/utf-8-encoding-with-xmlwriter-and-a-stringbuilder/ I'm new to PowerShell

Been a long while since I used VBScript - I guess I should get more familiar with PowerShell, but there's a simple project that requires a script change th

Following our IPSec connection setup for Azure and the Juniper SRX we were seeing regular disconnections and a failure to re-establish a tunnel for extende

So today's been the first day following the consultants departure. They configured our Exchange 2013 estate to act as a hybrid solution to allow us to migr

Up until this week we've been able to get away with a very simple SMC installation that proxies Exchange ActiveSync (EAS) from the one server with the base Sophos Mobile Control program without using a Standalone EAS Proxy.

My local install of mysql-community-server decided to fail today after applying some updates. I'm running Debian buster/sid so these kind of things are to be expected. But this was a totally new one to me.

We're getting on the Microsoft Office 366 and band wagon. I'm not a Microsoft fan, and think it's overpriced for the functionality we'll actually use. This means we need to setup an IPSec VPN between the Juniper SRX and Azure.

Access Denied - obviously some kind of permission issue, but try as we might comparing ACL's between systems we couldn't see where the issue was.

oday I have been mostly fumbling around in DNS trying to get untrusted devices on our Guest network to print to our PaperCut Pull Printing system using NAT.

This wound me up this week. Every time I tried to open an Explorer instance to view some files I'd have to wait what seemed like an eternity before the win

To get the MS SQL ODBC driver working even in Jessie appears to be a challenge. I Stretch I almost surrendered. It is working, but I do think it's a bit of a hack as I've had to install an older libssl1.0.0 and enable the locale en_US.UTF-8.

Make sure you've installed php and the necessary modules before trying to create a new Laravel project.

I thought I'd take the opportunity to add a Google Home to my gadget collection. After all it's on a £50 off same this week, so comes in at £79 delivered.

This has frustrated me for as long as I can remember. How do I manage our VMware vSphere estate when the tools provided don't work reliably on Linux? First

Time to replace the PaperCut web server certificate. So pleased I ran into Keystore Explorer previously as this made changing the web server certificate a breeze.

When trying to apply patches to one of our ESXi 6.0 hosts I found I couldn't connect to it using ssh. Stopping and starting SSH from vCenter didn't work. Neither did disabling/enabling from the DCUI.

We stream the Juniper SRX logs out to our syslog server and that seems to work quite well. It is reliant upon us having the relevant log setting in the rul

I decided to upgrade my VMware Horizon View client today. It still has the same kind of issues as detailed here: https://warlord0blog.wordpress.com/2016/10

In the process of getting a new queue management system installed I discovered they're using HTTP and not HTTPS. As part of out security process I had to r

I know it's not all that new, but not something I've spent much time working with. Previously using init.d to enable/disable systems services. Today I remo

I'm still relatively new to this JunOS, even though it's been installed for several months now. Today's problem was not passing traffic through a new stati

We have a distinct lack of version control in the relatively small development team that manages one of our business applications. One of the main challeng

log4j:WARN The content of element type "log4j:configuration" must match "(renderer*,throwableRenderer?,appender*,plugin*,(category|logger)*,root?,(categoryFactory|loggerFactory)?)".

One of our Debian servers had a large time discrepancy. Turned out NTP wasn't installed or working. After I installed ntp I still wasn't seeing a time upda

As our environment needs change more and more of our internal services are being forced to change to HTTPS. Tomcat supports the deployment of services usin

On my Linux VMWare Horizon client (v4.5.0 5650368) it doesn't seem to matter what choice I make about NOT Connecting USB Devices at Startup it still continued to take over my Logitech USB Receiver.

In order to make Apache 2.4.27 compliant it needs the later version of OpenSSL v1.1.0. To get this you need to install the VC15 version. The VC11 etc. do not include the later OpenSSL and fail because they are compiled with v1.0.2

If you're using Apache 2.4 then there is a config TraceEnable directive that you should use to simply turn off the TRACE method.

We have been tested by some of our Android Lollipop tablets. Adding a trusted CA certificate used to be as easy as visiting the proxy portal and clicking t

When checking out the setup for our OwnCloud system it came up with a few cautionary problems that needed to be resolved. The problems related to environme

For the first time today I ran into Nessus plugin ID 44676. It highlighted an "insecurely configured Windows service". This related to a Service Discretion

Two of our Windows 2012R2 servers constantly failed to apply Windows Updates. They'd start deploying the updates but every time a reboot was required the u

We don't have to do this so often. So when we do I always forget the syntax. Login as root on the host of the guest OS. Find the numeric VMID of the guest

So far this upgrade seems to frustrating straight out of the box! We already run a VCSA (vCenter Server Appliance) and the process should be to automatical

After downloading the PCoIP firmware update to deploy to our terminals I uploaded it to a test station using the "Admin Web Interface" (AWI) - the built in

Four hours of swearing at servers, kicking switches and rebooting printers and terminals and all because of a Windows Update. Our entire network uses 802.1

Calculating the FTP data port from the passive response.

Whilst trying to mount a Windows (cifs) volume onto my Linux workstation I encountered the following error: $ sudo mount -t cifs -o user=mylogon //myserver

When doing a Nessus scan for the first time on the new SRX320 cluster it highlighted some weaknesses in the SSH protocol. This was due to arcfour, cbc and hmac being enabled by default.

We're currently working at putting in a new SIP based phone system that is externally hosted. As we already have a disaster recovery (DR) site with a netwo

Today the planned migration from a Juniper ScreenOS SSG to a JunOS SRX didn't quite go as smoothly as I'd have liked. We spent many hours last night and th

Now that Google chrome has started bitching about certificates not having Subject Alternative Names because the practice of using Common Names in certifica

What a terrible sequence of events we suffered today. Took quite a bit of head scratching, log reading and plenty of Google fu to resolve. We use Squid wit

This should have been easier, but I guess I missed a few things I shouldn't have. I took the opportunity to upgrade Owncloud to v10.0 and also upgraded fro

When using Remmina to connect to some of our older Windows systems we're seeing a certificate problem that prevents it from connecting. Remmina pretty much

I upgraded our Squid3 proxy server to Debian Jessie today. The process as usual was pretty painless until the Squid3 service tried to restart. Then I saw w

I've run across this a few times now. It seems every time I do a big Linux upgrade I lose the ability to connect to an internal server using its FQDN. I ca

List your jails: $ sudo fail2ban-client status Show a particular jails status: $ sudo fail2ban-client status [JAILNAME] Unban an IP Address from the jail:

Trying to logon to some older network switch management interfaces I came across a failure due to them using older SHA1 key exchanges and key types. Thankf

In order to install the client on Debian 9 (stretch) I've had to get libpng12-0 installed from Jessie here: https://packages.debian.org/en/jessie/amd64/lib

I updated my workstation to Debian 9 (stretch) today and immediately after could no longer connect to any of my Windows fileshares. Guessing this was proba

I spent quite some time messing around with a pair of Juniper SRX320's trying to get the HA clustering setup. The documentation seems pretty straight forwa

Using OpenDNS on a Linux system that uses resolv.conf requires that the OpenVPN script is able to update the DNS servers sent by the remote dhcp options. T

I tried to run some updates on my workstation today and it failed with a Hash Sum mismatch. $ sudo apt-get update W: Failed to fetch http://www.deb-multime

"Your connection is not private!" This was a game over message that was the result of installing the wrong type of certificate onto our new printers. We're

I managed to bork one of our test switches today. I was in the process of enabling "netlogin" using RADIUS as the authentication method, when I must have i

For quite a few years we'd been running Percona on our Nagios server with no issues. So no reason to change, until sometime over the past few days the repo

$ cd /var/www/html/owncloud $ sudo -u www-data php occ upgrade $ sudo -u www-data php occ maintenance:mode --off

Yes, it is illegal so don’t press the transmit button 1. Reset the radio to factory defaults Goto Menu 40 (Press Menu followed by 40 or use up down to scro

After making some changes to the way our network was setup I ran into a problem with RIP. We started out with a VLAN spanning a pair of switches and using

Not a fun morning. We spent an hour or two trying to figure out why our GUEST networks was unable to route any packets to the Internet. For many a GUEST ne

We encountered a few problems with licensing when we looked at moving from the UTM525's to UTM430's so we had to delay the project until yesterday. On the

I love this Synology NAS. It's so versatile and immensely capable. I use it for streaming my TV, movies and music. It also acts as my Couchpotato, Sonarr a

After buying some replacement UTM430's to replace the UTM525's the new 430's came in with some ancient firmware. As I've not got them plugged into the netw

In the process of changing firewalls and routers around we encountered the Juniper detecting what it suspected were malicious MAC address changes that no longer match the IP address it last used. Which is understandable as we're giving the same IP address to new hardware.

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2 https://msdn.microsoft.com/en-us/library/dd878504(v=ws

Rather than tagging uplink ports with a load of VLAN's and spanning those VLAN's out to every switch you need them spanned out to. Create a separate VLAN a

https://www.cvedetails.com/index.php https://www.cvedetails.com/top-50-products.php

We're not talking Top Gear. STIG = System Technical Implementation Guide References http://iase.disa.mil/stigs/Pages/index.aspx https://www.stigviewer.com/

Having had to get an Oracle DB expert in to update our Oracle database server a rescan with Nessus still shows some vulnerabilities. c:\> cd \Oracle\produc

Category 5 Plug Wiring

VMware vSphere 6.x Certificate Manager https://kb.vmware.com/selfservice/search.do?cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=2097936 Replacin

A wider vulnerability scan picked up that we had self signed certificates on our Dell iDRAC's (Dell Remote Access Controller). But also highlighted that th

Server Name Indication. How to present multiple certificates over the same port based on what the client is asking for. References: https://en.wikipedia.or

This article provides links to a subset of articles that provide guidelines and support status for running various Microsoft clustering solutions and confi

https://www.feistyduck.com/library/openssl-cookbook/online/apA-ssl-tls-deployment-best-practices.html From ssllabs.com

Adding a killbit for a control that Nessus says requires one. https://support.microsoft.com/en-gb/help/240797/how-to-stop-an-activex-control-from-running-i

In house we use Nessus to scan for vulnerabilities, but that's a commercial subscription based product. It's not expensive, but it's not something I want t

As I'd forgotten how to create a new OpenVPN user, it's not something I do every day, I thought I put here a reminder of the process used. To get a private

This response to a question raised some interest and I found it very interesting. I then went to investigate the keys and values on my own machine. This ca

I had the need to view the actual SMTP server conversation to confirm TLS and authentication were being used. I could have done this from server logs, but as we transmit thousands of SMTP messages a day it was easier to look to the client for logs, rather than for the needle in a stack of other needles.

In the process of deploying an IIS web server we'd like to ensure that browsers that visit the http unencrypted page, get redirected to the https encrypted

OpenSSL is a very handy tool. Both on Linux and Windows. On both you can do all kinds of conversions and creations, but equally of use you can view cipher

There are a number of ways to configure authentication in Linux, you can even use Windows credentials. But generally, for SSH, I find it easier to just use

We've got webmin installed on a number of our Debian Linux boxes. In our environment many of these servers don't have full and open access to the internet

Following the upgrade of the Management Console I noticed that none of the terminals were actually connecting to the Management Console.

I don't trust you just because we can encrypt data together. I need to trust you based on a 3rd party we both trust telling me that you are who you say you are.

This wasn't as easy as I thought it was going to be. I expected just to import the new certificate into the mmc certificate snap in and then set ADFS to use it in the ADFS Management console by choosing "Set Service Communication Certificate...". Why would it need to be more difficult than that?

After running an SSL scan on our external facing Horizon Security Server, using Qualys' SSLTest and receiving an A- rating, I wanted to fix that by getting

Response to CVE-2015-4000 (a.k.a., Logjam) for Horizon View and Horizon 6 products (2121183) https://kb.vmware.com/selfservice/microsites/search.do?languag

Updating certificates on the Windows hosts for Connection and Security Servers. Import the signed SSL server certificate into the Windows local computer ce

When it comes to upgrading the pcoip-mc it's a case of deploying a new OVA file into the VMware estate. This means you have to grab all the settings from y

Today’s a MySQL day. After the shocker that is Microsoft Licensing I decided to seriously look at what MySQL has to offer the enterprise. I read their white paper and thought somethings sounds too good to be true. So I spent half an hour on the phone with someone in their enterprise team.

Apt-get update fails because the PGP keys for the repository have expired. $ sudo apt-get update W: An error occurred during the signature verification. Th

When the Amazon Echo first came out I was looking at them in earnest, but decided I couldn't justify the expense for something that I may lose interest in

Probably the best way to get Raspbian up and running over Wifi is to use an out of the box supported Wifi adapter. But as things move on faster Wifi become

In order to get your Nessus server to pass a vulnerability scan you'll need to replace the original self-signed cert it uses for its web server. It's easy

Strong Ciphers for Apache, nginx and Lighttpd https://cipherli.st/ Mozilla SSL Configuration Generator https://mozilla.github.io/server-side-tls/ssl-config

OpenSSH_6.0p1 Edit /etc/ssh/sshd_config add or amend the following: Ciphers aes128-ctr,aes192-ctr,aes256-ctr MACs hmac-sha1,hmac-ripemd160

For penetration testing https://www.kali.org/

When it comes to Microsoft Windows straight out of the box it's full of security weaknesses. These are a number of ways to harden it so that your vulnerabi

I've noticed that occasionally my OpenVPN connection fails to resolve host names for systems at the other end of the tunnel. If I check the DHCP settings I can see I am being pushed the DNS servers for the remote end, but nslookup fails to use them.

Looks like NPS only supports TLS1.0 by default. So if you go restricting your ciphers too much you'll find none of your NPS clients able to connect using E

Start Powershell as an administrator and run the following to disable SMB Version 1. PS C:\> Get-SmbServerConfiguration | select enablesmb1protocol enables

Create and set the following registry key value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffi

Disable the ciphers that use Diffie-Hellman by adding !DHE into your ciphers list ciphers="HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA:!3DES:!DHE" Now

Following on from the Windows vulnerability for SWEET32, Here's how to resolve the same issue with Tomcat 8. This use the OpenSSL format string for ciphers

I've tasked myself with getting one of our most used vendor apps up to compliance with our security audits. It's not as easy as I'd hoped. Especially seein

I confess, I'm a complete Java noob. In fact slightly worse than that, I'm a Java hater. In principle it's a great idea, cross platform and all that jazz,

/storage/log directory is full in vCenter Server Appliance 6.0 https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&external

By default Tomcat gets installed with HTTP only and a number of default applications. Previously I linked documents on how to secure Tomcat . But put simpl

NEVER trust a vendor installation to be secure. Carry out a vulnerability scan whilst they're still onsite and don't sign off any installation until all security concerns have been resolved.

You can specify what cipher suites Java uses by editing the file: %JAVA_HOME%\lib\security\java.security This file must also be used by the Java applicatio

Certificates are the bane of my existence! After applying some updated certificates to Windows servers some of the systems are now failing to connect to da

Create file c:\Program Files\VMware\VMware View\Server\sslgateway\conf\locked.properties with the content: checkOrigin=false References: https://kb.vmware.

c:\> cd "c:\Program Files\VMware\VMware View Composer" c:\> sviconfig.exe -operation=replacecertificate -delete=false Restart the View Composer service "VM

When we setup some virtual machines from a template and used temporary names for them because we needed to replace existing machines that were currently ru

Who has left their account logged onto a server using RDP and has diconnected it leaving it open to session hijacking?

Disabling weak cipher suites in Sophos Mobile Control

Had this showing up regularly in the event log of one of our Exchange servers. A quick delete of the following keys and a reboot all sorted: HKLM\SOFTWARE\

When upgrading from v6.1.4 to v7.0.8 I ran aground as it came up with a very bland error message: "Error! Database update error. Please contact support." N

Before performing any type of software or hardware maintenance on a DAG member, you should first place the DAG member into maintenance mode. This involves

Nessus reports a vulnerability because of 64-bit cipher suites and SSL Medium Strength Cipher Suites Supported (even though it shows up as strong ). Window

NMAP is a great too for port monitoring but it also has some scripting features that are really handy to find weaknesses in your SSL/TLS deployments. You c

We replaced one of our old 2008 domain controllers with 2012 a few weeks ago. Today we found some odd behaviour in trying to access the internet from the n

This has caused me a lot of frustration this morning. The new version of PacketFence doesn't like the externally configured domain configuration that I was forced to use when I first set things up.

Running the upgrade for packetfence from version 6.21 to 6.40 caused an issue during the process as freeradius failed to update.

I'm trying to gather some inventory data from our Windows Servers and thought I'd try to do this from a Linux environment. There is a wmi client for Linux

Upgrading VMware Horizon is going to be a fun task for the weekend. It means upgrading 3 connection servers, a security server, the vcenter server and the composer server. This is all so we can disable SSLv3 on the ESXi hosts they all run on.

Sequelize is a promise-based ORM for Node.js and io.js. It supports the dialects PostgreSQL, MySQL, MariaDB, SQLite and MSSQL and features solid transactio

As I don't actually run it that often, because it's not everyday I'm looking for a book. Updating it periodically is something I often forget how to do properly.

https://jonsuh.com/blog/integrating-react-with-gulp/ Nails it. Getting ReactJS and Gulp together with Babel. One thing I like about this is that I'm findin

Interesting article on getting everything working together. https://www.jonathan-petitcolas.com/2015/05/15/howto-setup-webpack-on-es6-react-application-wit

If you want to write consistent JavaScript then you can use ESLint to validate your coding style against rules. Add the Airbnb style guide to that and you'

So I came across React and thought it looked pretty cool. But it made my head hurt trying to figure it out. Everything seems so difficult to start with. I

https://facebook.github.io/react/ A JavaScript library for building user interfaces http://wix.github.io/react-templates/ https://react.rocks/

ECMAScript is the underlying standard that JavaScript is built to. My main exposure has been with ES5 as supported by "corporate" modern browsers. However,

https://developer.mozilla.org/en-US/docs/Web/JavaScript JavaScript ( JS ) is a lightweight, interpreted, programming language with first-class functions .

https://maxtaco.github.io/coffee-script/ IcedCoffeeScript (ICS) adds two new keywords: await and defer . These additions simply and powerfully streamline a

I've been using Atom for a little while now and have to say I find it a lot quicker than Brackets. It has the occasional moment when loading a large script

I've had a few little dealings with Github in the past as a contributor, but thought as I'm working on a project that borrows from a lot of code that is "s

It's like JavaScript, but less of a grind... well maybe. I've been on a mission of discovery and uncovered all kinds of new stuff recently. From Electron,

What an excursion this turned out to be. I figured using 7-zip would be the panacea for compressed files. How wrong could I be? Turns out that the node-7z

So far I'm really impressed with how the development is going with Electron. I've been able to sort out some frustrating situations to the extent where I'm

I'm still a little new to this Node.js stuff and it took me a which for how it is installed to come together in my head. After carrying out the install I w

The app I'm working on currently requires two browser windows. An initial user interface that then leads into another window once the user makes a choice.

How to package and deliver an Electron Windows app. http://www.christianengvall.se/electron-windows-installer/

Using jQuery in Node.js gave me something to think about. Especially as there seems to be so many ways to do it. If you're using it in a renderer you can p

Seems like a fully featured carousel. https://kenwheeler.github.io/slick/

Many years ago in a galaxy far, far away I developed an application to manage and read my comic books. I developed it in a Windows environment and used C#

http://owlcarousel.owlgraphic.com/ An excellent Javascript image carousel. When added with the jquery-mousewheel plug-in this makes for a great carousel wi

The app I'm trying to create reads image files from a compressed file. either a zip, a rar or 7-zip format. The aim is to then extract the first image from

Windows always gives me a bit of grief when trying anything a little out of the ordinary. I always find doing the same thing on Linux way simpler. This time it was relating to a DNS TXT entry for DKIM that is longer than 255 characters.

After setting up a DKIM DNS entry and then sending email we were seeing one of authorised 3rd parties failing to pass the DKIM checks. The DNS record looked OK but the mail systems like Google and Yahoo were saying it was failing. So how do I go about testing a message I received so I can see for myself what's going on?

Well this was fun. Trying to get a project started up using Electron that includes jQuery & Bootstrap. Mashing things together so they all work required a

I'm not sure I've ever felt more out of my depth than getting involved with Electron and Node.js. It's just opened up a can of worms! Just trying to get my

I figured this was pretty cool. An editor created using Electron, that you can use to create Electron apps. https://atom.io/ What's fun about this is that

http://vamsoft.com/support/tools/spf-policy-tester

I've run into Node.js a few times and kinda struggled with just what it's all about. I've decided to have a bit of a poke at trying to develop an applicati

https://www.datatables.net/ Very useful plugin to show data in a table that can be paginated and use server side json to keep the updates small and fast.

For several ears now we've run a fairly tight ship on our email server. It consumes an awful lot of resources mainly because of how many businesses out the

http://xsd2xml.com/ When you have an XSD but need to see how the XML is expected to be structured. Also generate a graphical representation of your XSD htt

http://kool-swap.joschaschmidt.de/demo/ HTML5 partial page loads

Ok so what's that all about? I ran into an application deployment that is giving me some grief on deploying it through our security systems. The vendor cam

Somehow I managed to bork my Laravel development app. I'm not entirely sure what I did as I only changed one of my config files, but I was getting a blank

Nginx is capable of more than serving web pages. It can load balance, cache and act as a reverse proxy. We recently had need to access two web services on

https://www.gov.uk/guidance/set-up-government-email-services-securely

As part of our patching process we applied security patches to one of the vSphere ESXi servers. All seemed to go well until we tried to compose systems ont

That was an interesting challenge. A colleague was trying to install the VMWare Horizon Client into Linux without any real Linux experience. I know that in

Some time ago I setup an OpenVPN server so we could securely logon to IT systems from outside the network. This worked really well until I rebooted it the

The online manual suggests that all you need do is mount (attach) the ISO onto the VCSA and then from the command line stage and install the patches: # sof

As we're running the VSCA appliance we can't use the GUI Update Manager plug-in as that only works with Windows, despite VMWare being very Linux based. So,

With Windows Server 2012 it seems they've decided to do away with the GUI for managing the RDP admin connection unless you install the full RDS product. So

Following on from the previous post Exim4 & DKIM I ran into a problem with no DKIM signature being added to outgoing mail. As I had this working when sendi

After buying a cheap SSL certificate I found I'd missed something important during the install. Usually it's just a case of copy the certificate and key fi

https://cheapsslsecurity.co.uk/ I needed a cheap SSL certificate that already had a trusted root authority in Windows, Linux and Fruits. £12 for 3 years un

Where possible I try to get mail systems setup so that they can be verified as true senders by the recipient by using SPF and DKIM. Seems a shame that few

I'm beginning to think this is going to be a blog about SSL certificates as most of the articles seem that way inclined just now! When it comes to IIS serv

I've been using Remmina to RDP to my Windows servers for some time and it's been just great. But just recently it started popping up with a fairly bland me

Having updated the CA certificate it's time to start rolling out the new SHA-256 algorithm to the other Windows servers. Group Policy (GPO) takes care of t

Set the Server to use the proxy at the command line using: C:\> netsh winhttp set proxy "http://myproxy:3128" "<local>" Where the <local> parameter means s

It's that time again. Scanning for vulnerabilities means keeping certificates up to date. After updating our CA certificate to SHA-256 and KSP we now need

http://sphinxsearch.com/ https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-sphinx-on-ubuntu-16-04?utm_medium=social&utm_source=

Got Nginx installed, got PHP installed. All ready to go, but all you get from your test PHP page is... nothing. Catches me out regularly. The php5-fpm daem

Trakt.tv is a very helpful little plugin for Kodi. What makes it so helpful is that it acts as a backup of what I've watched and how far through a series I

Every so often I get caught out by not being able to access a remote server because of my firewall config. Not allowed to remotely access a resource unless

Has it really been 10 years since I deployed a Windows Certificate Authority? Well obviously it has as the certificate is up for renewal. Not only that the

http://html5doctor.com/ Helping you implement HTML5 today.

I've been a fan and and user of OpenELEC on my Raspberry Pi's for some time. It's always performed great and was pretty straightforward to install and use. But it seems the developers are struggling to keep up with the releases of Kodi.

Keen to press on a try new suff I figured that seeing as I'd now tried Nginx 1.10 that I'd put that together with PHP 7.0. I started of by thinking I'd rem

In order to satisfy a number of security requirements we implemented 802.1X authentication throughout our network - wired and wireless. Initially this was

Getting your Linux box to talk with Active Directory is pretty straight forward. But doing it securely will need you to have installed your CA certificate

Usenet has been around since God was a lad. It's been part of the internet for so very long it predates all the graphical stuff we see today.

This is something that catches me out regularly. Adding our CA certificate onto a Linux server. Just so it can trust the interactions of LDAP over a secure channel. It's pretty straightforward to do but bites me almost every time. The secret seems to be make sure you CA certificate is in PEM format and named with a .crt extension. A .pem or .cer extensions just doesn't cut it.

Following on from the previous post about setting up a Home Media Client/Server setup I thought I'd put together a "how to" for building your own Raspberry Pi Media Centre with Kodi and a list of ingredients.

A couple of years ago I decided to get the TV connected to something other than satellite and cable. It seems that in this environment XMBC was the daddy of all things media and a few generations on it's now called Kodi and is truly an awesome media player.

We needed a semi-secure method of transferring files between staff and 3rd parties. To handle those frequent time when someone tries to attach 150MB file onto an email. OwnCloud to the rescue.

This new version of NGINX is tending to be a bit of a pain in terms of installation. Gone are the sites-available and sites-enabled folders and it does a c

When I setup a Debian server there's a few basic things I do to get it online. First steps boot from the netinst CD and follow the installer. First logon u

NGINX needs a little special setup to handle Laravel as Laravel only really serves one page. All others are served through index.php as a route.

Absolutely my favourite web server. Small footprint and very fast to get running. First add the repositories to your Debian sources by creating the file /e

With a Debian Jessie install right now you'll be getting MySQL 5.5. If you want something newer you'll need to use MySQL's own repositories by adding them

Brackets is a lightweight, yet powerful, modern text editor. We blend visual tools into the editor so you get the right amount of help when you want it without getting in the way of your creative process. You'll enjoy writing code in Brackets.

Good old rsync. Very handy for backing up and entire system to another. It only transfers files that have changed too. rsync -av -e ssh --delete --exclude

Some months ago we bought a Barracuda firewall/VPN box to allow IT staff to connect and manage other IT devices securely. The idea was that the Barracuda would not only authenticate them against Active Directory and support two-factor authentication, but also carry out some Network Access Control and only allow devices that meets specific criteria connect to the network. Eg. Must be a domain member with a current Anti-virus and active firewall.

So you know a bit of logical programming and can put together a script. The syntax is all there the code works and delivers what it should. Then six months

What have I learnt lately? Stop reinventing the wheel. If someone's already done something great an you can make use of it, do it. When it comes to framewo

Having had the pleasure of handling json data I found that there are a few implementations within PHP libraries that I could make use of rather than rolling my own. The one I settled on 'tobscure/json-api' met my needs and was easy to use.

https://github.com/spatie/laravel-permission Easy to implement Roles and Permissions for Laravel.

https://github.com/Adldap2/Adldap2-Laravel Essential for using Active Directory (LDAP) from Laravel. With a nice friendly developer too. Also available as

I'm not new to PHP and have used it quite often, but what I've not really used are frameworks. There are plenty of them out there all capable of different

http://www.lalit.org/lab/convert-php-array-to-xml-with-attributes It's an old library, but still works well. It has proven invaluable in a recent project f

Getting where you intended to go with Laravel

Having an API so others can interface with your product is one thing. But having a poorly deployed one doesn't do you any favours. It's almost as if no one has looked around to see what best practices or standards that are already out there.

But how late is it? When it comes to messing with dates, times and duration there's a lot of pitfalls. Again, don't reinvent the wheel use some one elses g

Laravel has a nice built in feature to prevent Cross Site Request Forgeries. In each form you simply drop in a {{ csrf_field() }} and you end up with an _t

JQuery certainly saves a lot of hassle when it comes to writing JavaScript. On a recent project I've been struggling to get my head around some selectors t

General OpenSSL Commands These commands allow you to generate CSRs, Certificates, Private Keys and do other miscellaneous tasks. Generate a new private key

Spent ages looking at various options including rconfig and Laravel SSH, but had to surrender. Eventually figured out it couldn't be simpler! Setup an Open

Arno is a manager for the iptables firewall. It's pretty easy to setup and configure for the straightforward rules you need. Install it using eth0 as your

This box runs Linux and many of my favourite services so can handle Postfix, Dovecot, SpamAssassin and many others that are documented here. There are a fe

This is a useful addition to Dovecot and will pass messages marked as spam directly into a Junk mail folder. Trouble is when you're working with the Outloo

Well turns out that setting this up isn't really as straight forward as simply treating Active Directory like LDAP. The main reason seems to be the way you need to authenticate and the limitations of doing any kind of user lookup whilst using auth_bind = yes, just doesn't seem possible.

PAM and LDAP Getting this going is a challenge. It needs some tweaks with PAM to get the authentication going. In order to get it to work we needed libpam-

In order to get LDAP etc. using SSL from the get go you need to make sure the LDAP client has the CA certificate that was used to issue the certificate to

We have a few special requirements in our network. For internet based traffic we use an appliance based proxy server that users must authenticate with to g