Category: Setup

  • Install System Shock 2 on Batocera

    Install System Shock 2 on Batocera

    Installing System Shock 2 onto Batocera has proved to be tricky. The eventual solution I found these posts here:

    https://www.systemshock.org/index.php?topic=106.0

    https://www.systemshock.org/index.php?topic=4141.0

    It turns out that all that is needed is the content of the Sshock2 directory. Put that on a standard Windows PC – not a WINE instance at this stage.

    The get and run ss2tool on this directory – I tried in WINE, but the RSYNC that it needs to run would not work for some reason.

    Finally, copy the Sshock2 directory into a WINE location. This should be made using the command line as shown in WINE in Batocera.

    Everything should now work.

  • WINE in Batocera

    WINE in Batocera

    These are my notes from attempting to get some older versions of games working under WINE in Batocera.

    This makes a win32 instance:

    WINEARCH=win32 WINEPREFIX=/userdata/roms/windows/SystemShock2.wine /usr/wine/wine-proton/bin/wine wineboot

    Enable d3dx9:

    batocera-wine windows tricks /userdata/roms/windows/CIV3.wine d3dx9

    List all tricks:

    batocera-wine windows tricks /userdata/roms/windows/CIV3.wine list-all

  • Renew LetsEncrypt in Traefik

    I’d setup Traefik to use LetsEncrypt, but due to the scarey words around rate limits etc, I felt it sensible to use the staging LetsEncrypt servers, rather than the production ones – basically I wasn’t sure how many changes I’d have to make as it has been a while since I played with any of this in anger. I assumed that Traefik would renew the certificates with LetsEncrypt when I needed production ones.

    I surprisingly got this working quite straightforwardly – I had more issues with getting Apache and WordPress (mainly Apache) playing nicely with everything.

    However, the staging certificates result in a warning which I didn’t want any longer than necessary. Since it now was working, I altered my certificate resolver in Traefik to point to the production LetsEncrypt server. I then performed a bounce to pick up the changes, expecting to see a new certificate and no more errors.

    Anxious pause…

    I waited a bit (pressing F5) and was disappointed to see that it hadn’t changed. Same certificate was in use, and I could see in the log that no attempt had been made to fetch a new certificate.

    Frantic prodding ensued as I attempted to work out what I had done wrong. Nothing was the answer. The problem, such as it is, is that Traefik already has a certificate that it can use. Traefik doesn’t feel it needs to change it the certificate.

    Solution?

    A quick google later found me a couple of links:

    Whilst the last link on the face of it initially seemed less relevant (it related to fixing a security flaw), on reading it gave the simplest answer for my situation.

    In my situation, it looked like I could simply delete the storage acme.json file. No certificates needed to be kept – I could just start again from scratch.

    I stopped Traefik, moved acme.json out of the way (belts and braces right), and then restarted it.

    Traefik Renew from LetsEncypt!

    Hey, Presto! I could see in the log file the lack of certificate being identified and Traefik calls to renew certificates from the production LetsEncrypt server.

    Padlock look right, everything is gravy! Let’s move on to the next thing.

  • Traefik Log Rotation

    An explanation of how to set up Traefik Log Rotation. This covers both the access log AND the traefik log.

    I initially setup simple log rotation using the standard logrotate package i have installed for everything else. I implemented this by following this page (there are others about) but this covered my scenario the best (as I have traefik running natively, not in a container.

    The main change I made was in the directory (mine is /var/log/traefik/) and then the files (I have an access.log and a traefik.log, so I altered the pattern to be *.log. I also added size – more on that in a minute.

    This resulted in a file /etc/logrotate.d/traefik below:

    <directory location>/*.log {
      compress
      create 0640 <user> <group>
      daily
      delaycompress
      missingok
      notifempty
      rotate 5
      size 10M
    
      postrotate
        kill -USR1 `pgrep traefik`
      endscript
    }

    However, I began to spot that it did not working as anticipated.

    • access.log wouldn’t rotate
    • traefik.log rotated but still wrote to the rotated our file

    It turns out access.log not rotating was because I misunderstood what size would do. It’s not an either/or with the daily setting – size supersedes daily if it is in the file. Simply removing size made access.log rotate as expect.

    However, traefik.log still won’t rotate on a USR1 – which seems contrary to their own documentation (link).

    I decided that something weird must be going on, so I dug about a bit. If you check the code in git (link) you’ll see that the code specifically mentions rotation of the access log, and their tests also only check the access log.

    This means that USR1 signal only rotates the access log. That was annoying.

    I wondered if I was missing something, so I went in search of rotate in git (link) and found something that whilst documented at source level seems to be missing in the Traefik log documentation (link).

    It turns out that Traefik can do some quite clever stuff with rotating its own log if you configure it right.

    log:
      # Log level
      #
      # Optional
      # Default: "ERROR"
      #
      level: <whatever level you want>
    
      # Sets the filepath for the traefik log. If not specified, stdout will be used.
      # Intermediate directories are created if necessary.
      #
      # Optional
      # Default: os.Stdout
      #
      filePath: <directory location>/<file>.log
    
      # Format is either "json" or "common".
      #
      # Optional
      # Default: "common"
      #
      #format: json
      maxSize:    5
      maxBackups: 50
      maxAge:     10
      compress:   true

    This will rotate at 5Mb, compress the old copies, and keep for 10 days and keep a maximum of 50 files. There are other options in the document – I have not used them.

    This then means I can make the logrotate configuration focus just on the access log:

    <directory location>/access.log {
      compress
      create 0640 <user> <group>
      daily
      delaycompress
      missingok
      notifempty
      rotate 5
    
      postrotate
        kill -USR1 `pgrep traefik`
      endscript
    }

    Combining these two pieces of information (access log rotation and traefik log rotation) together gives me a functional solution.

    -rw-r----- 1 traefik traefik   706383 Sep 15 13:46 access.log
    -rw-r----- 1 traefik traefik  2071725 Sep 14 23:59 access.log.1
    -rw-r----- 1 traefik traefik   101616 Sep 13 23:59 access.log.2.gz
    -rw-r----- 1 traefik traefik    43272 Sep 12 23:59 access.log.3.gz
    -rw-rw-r-- 1 traefik traefik   574683 Sep 12 12:29 access.log.4.gz
    -rw-r----- 1 traefik traefik       23 Sep 10 02:11 traefik-2023-09-10T01-11-42.862.log.gz
    -rw-r----- 1 traefik traefik    62635 Sep 12 20:48 traefik-2023-09-12T19-48-36.125.log.gz
    -rw-r----- 1 traefik traefik    45843 Sep 12 23:48 traefik-2023-09-12T22-48-51.210.log.gz
    -rw-r----- 1 traefik traefik    47196 Sep 13 02:50 traefik-2023-09-13T01-50-47.804.log.gz
    -rw-r----- 1 traefik traefik    46280 Sep 13 05:51 traefik-2023-09-13T04-51-02.691.log.gz
    -rw-r----- 1 traefik traefik    59591 Sep 13 08:44 traefik-2023-09-13T07-44-32.782.log.gz
    -rw-r----- 1 traefik traefik    51714 Sep 13 11:35 traefik-2023-09-13T10-35-02.705.log.gz
    -rw-r----- 1 traefik traefik    62231 Sep 13 14:31 traefik-2023-09-13T13-31-29.208.log.gz
    -rw-r----- 1 traefik traefik    47698 Sep 13 17:30 traefik-2023-09-13T16-30-44.233.log.gz
    -rw-r----- 1 traefik traefik   114460 Sep 13 20:00 traefik-2023-09-13T19-00-49.560.log.gz
    -rw-r----- 1 traefik traefik    88101 Sep 13 22:45 traefik-2023-09-13T21-45-27.953.log.gz
    -rw-r----- 1 traefik traefik    45687 Sep 14 01:48 traefik-2023-09-14T00-48-21.418.log.gz
    -rw-r----- 1 traefik traefik    48091 Sep 14 04:48 traefik-2023-09-14T03-48-36.486.log.gz
    -rw-r----- 1 traefik traefik    45339 Sep 14 07:49 traefik-2023-09-14T06-49-32.199.log.gz
    -rw-r----- 1 traefik traefik    58615 Sep 14 10:29 traefik-2023-09-14T09-29-32.183.log.gz
    -rw-r----- 1 traefik traefik    50523 Sep 14 13:24 traefik-2023-09-14T12-24-47.288.log.gz
    -rw-r----- 1 traefik traefik   111852 Sep 14 15:48 traefik-2023-09-14T14-48-17.251.log.gz
    -rw-r----- 1 traefik traefik   102566 Sep 14 18:19 traefik-2023-09-14T17-19-54.417.log.gz
    -rw-r----- 1 traefik traefik    49430 Sep 14 21:08 traefik-2023-09-14T20-08-39.426.log.gz
    -rw-r----- 1 traefik traefik    52971 Sep 14 23:53 traefik-2023-09-14T22-53-09.416.log.gz
    -rw-r----- 1 traefik traefik    48757 Sep 15 02:45 traefik-2023-09-15T01-45-41.245.log.gz
    -rw-r----- 1 traefik traefik    47160 Sep 15 05:37 traefik-2023-09-15T04-37-56.255.log.gz
    -rw-r----- 1 traefik traefik    48261 Sep 15 08:29 traefik-2023-09-15T07-29-56.249.log.gz
    -rw-r----- 1 traefik traefik    48879 Sep 15 11:18 traefik-2023-09-15T10-18-41.241.log.gz
    -rw-r----- 1 traefik traefik  4548970 Sep 15 13:46 traefik.log
  • Setup ETCD Cluster

    Follow-up

    So, I’ll try to write up some notes, but the long and short of this is – Registrator doesn’t work. Having managed to setup the ETCD cluster I began to expand it with Registrator – and immediately hit various problems. FWIW, Registrator does function and can write to an ETCD cluster.

    Registrator isn’t being developed properly anymore. This means it’s has drifted away from supporting etcd properly – and etcd has changed quite a bit recently. There is an updated version of the API that should be used to interact with it and guess what v2 and v3 are incompatible. The API stores the data in two places. And wouldn’t you know it, Registrator talks v2 and Traefik talks v3. So, it’s now back to the drawing board.

    Looks like consul is the way to go, tbh.

    Pre-amble

    Continuing the setup of traefik, I want to setup an ETCD Cluster to allow the two Docker instances to be able to register changes and have traefik pick those up and push to the internet/intranet as appropriate.

    This has been driven by a discovery – traefik will only work with a Docker provider once. My original thought process was to setup a Docker ssh connection from Traefik. So, I’d setup a user on the remote Docker instance, configured it to allow ssh, and fought with a weird location for the docker command. I could set a DOCKER_HOST environment variable, run docker info and see the remote machine setup. However, after added the duplicate provider into the traefic.yaml I discovered the fatal flaw – no duplicate providers.

    Having no real desire to hard code everything all the time, it was back to a drawing board.

    The original source of this idea was this page:

    https://technologyconversations.com/2015/09/08/service-discovery-zookeeper-vs-etcd-vs-consul

    I had toyed with Consul before – but ran into an issue with DNS, which resulted in my dumping it. I had been hunting around how to maintain the etcd repository – there didn’t seem to be many formally documented software solutions that I could see. However, this page also talks about using Registrator – which solves the other side of the problem I was seeing too.

    Setup ETC Cluster

    That means I have a potential solution, and if I get this working properly, I can think about Consul again in the future.

    To make this work, I need etcd clustering, which lead to here:

    https://gist.github.com/kanwar-saad/b54a728fa872a767c037a5b8dc7f6e75

    Although some of the cluster setup has also come from here in the end:

    https://etcd.io/docs/v3.5/tutorials/how-to-setup-cluster/

    This is mainly because I wanted to setup the etcd services in Portainer, and I wanted them to be stacks – which means formulating a compose file.

    Couple to that the fact that I didn’t want to use a HELM image (I couldn’t be bothered to make another account). Which meant making a Bitnami image work.

    So, this is my docker compose file. Obviously, alter IP address and names as needed:

    version: '3'
    
    services:
      etcd:
        image: bitnami/etcd:latest
        restart: unless-stopped
        container_name: etcd
        ports:
          - "2379:2379"
          - "2380:2380"
        volumes:
          - etcd-data:/bitnami/etcd
        environment:
          ETCD_ADVERTISE_CLIENT_URLS: http://<host ip address>:2379
          ETCD_INITIAL_ADVERTISE_PEER_URLS: http://<host ip address>:2380
          ETCD_INITIAL_CLUSTER: etcd1=http://<host ip address>:2380,etcd2=http://<other host ip address>:2380
          ETCD_INITIAL_CLUSTER_STATE: new
          ETCD_INITIAL_CLUSTER_TOKEN: token-01
          ETCD_LISTEN_CLIENT_URLS: http://0.0.0.0:2379
          ETCD_LISTEN_PEER_URLS: http://0.0.0.0:2380
          ETCD_NAME: etcd<id number of cluster member>
          ALLOW_NONE_AUTHENTICATION: yes
        labels:
          - "traefik.enable=false"
    
    volumes:
      etcd-data:

    Starting this up on both docker nodes has resulted in a stable cluster, that I can connect to from my external PC using etcdctl – and seems quite stable when I take a node away (i.e. it still answers questions).

  • Configure Microsoft Live Writer to work with Drupal

    Hey! I’ve managed to configure Microsoft Live Writer to work with my Drupal install (see this URL).

    I had a minor issue configuring Microsoft Live Writer, where I couldn’t login as my non-administration user. Initially, I worked that that returning the edit privilege in Drupal “Authenticated Users” made it work. Since then I had a more detailed look at this issue. It seems that rights to the Blog API needed to be granted. After that, I managed to restrict the rest of the rights to more or less where they were before.

    So, now I might actually start using Live Writer… it’s much easier to blog this way (yes, I like to do things the easy way were ever possible).

  • Locally persist Bering changes

    Locally persist Bering changes

    So I decided to add an user wolagent and put the script into his home directory. The question is how to backup this user.  Simply using the ‘s’ – command from the Bering 3.x – menu doesn’t backup the user and his homedir. In short, there seemed to be no way to persist this Bering change locally.

    So how can I do that?
    Add your stuff to /var/lib/lrpkg/local.local

  • Update Tripwire policy

    It’s pretty simple really.

    Just run this:

    sudo twadmin -m p > twpol.txt

  • Update Tripwire

    OK, only waited a few months before adding this!

    I’d recommend not doing this as root, as if you do, the root directory modification time will change as you modify twpol.txt. Also twpol.txt will change as you modify it.

    All of this means you’ll have to run 1-3 before you can run 4. And tripwire takes ages to run. Besides you should be using sudo anyway (you are right?!).

    1. Validate current policy

    sudo tripwire -m c

    2. Find the latest tripwire log

    sudo ls -lt /var/lib/tripwire/report/*.twr | head -1

    3. Use that to update the database

    sudo tripwire -m u -r <above file>

    4. Then update policy

    sudo tripwire -m p twpol.txt

    You should see this:

    Parsing policy file: twpol.txt
    Please enter your local passphrase:
    Please enter your site passphrase:
    ========
    Policy Update: Processing section Unix File System.
    ========
    Step 1: Gathering information for the new policy.
    The object: \"/lib/init/rw\" is on a different file system...ignoring.
    The object: \"/dev/.static/dev\" is on a different file system...ignoring.
    The object: \"/dev/pts\" is on a different file system...ignoring.
    The object: \"/dev/shm\" is on a different file system...ignoring.
    The object: \"/proc/bus/usb\" is on a different file system...ignoring.
    ========
    Step 2: Updating the database with new objects.
    ========
    Step 3: Pruning unneeded objects from the database.
    Wrote policy file: /etc/tripwire/tw.pol
    Wrote database file: /var/lib/tripwire/web-proxy.twd

    5. After the policy is accepted you need to run steps 1-3
    This is because if you don\’t and want to make further changes you\’ll see stuff like this:

    ========
    Policy Update: Processing section Unix File System.
    ========
    Step 1: Gathering information for the new policy.
    The object: \"/lib/init/rw\" is on a different file system...ignoring.
    The object: \"/dev/.static/dev\" is on a different file system...ignoring.
    The object: \"/dev/pts\" is on a different file system...ignoring.
    The object: \"/dev/shm\" is on a different file system...ignoring.
    The object: \"/proc/bus/usb\" is on a different file system...ignoring.
    ### Error: Policy Update Added Object.
    ### An object has been added since the database was last updated.
    ### Object name: /etc/tripwire/tw.pol.bak
    ### Error: Policy Update Changed Object.
    ### An object has been changed since the database was last updated.
    ### Object name: Conflicting properties for object /etc/tripwire
    ### > Size
    ### > Modify Time
    ### Error: Policy Update Changed Object.
    ### An object has been changed since the database was last updated.
    ### Object name: Conflicting properties for object /etc/tripwire/tw.pol
    ### > Modify Time ### > CRC32
    ### > MD5
    ========
    Step 2: Updating the database with new objects.
    ========
    Step 3: Pruning unneeded objects from the database. Policy update failed; policy and database files were not altered.

    This is because tripwire hasn\’t capture changes caused by the policy change.

    This might also be useful (I login as a normal user to do administration, so I want to do all of these sudo\’d). This script allows me to run a report, and then use that generated report to update the database.

    I call the script update_tripwire.bash

    #!/bin/bash
    sudo tripwire -m c
    sudo tripwire -m u -r $(/bin/ls -t /var/lib/tripwire/report/*.twr | head -1)

  • Configure Tripwire on Debian

    I have finally gotten around to configure the Tripwire setup on my Debian installation, after having it bleat at me for the last 3 years! I found details on http://articles.techrepublic.com.com/5100-10877_11-6034353.html which pointed me in the correct direction. My installation is Debian based, so it fitted the “no twinstall.sh” case shown most closely.

    I have had to tweak what the linked article says, slightly to make it work. I have also included the output that I saw, so you should know that you are in the correct place when you run the command (my principle is that sample output gives you the warm feeling that things are going well).

    First we should generate the site key:
    twadmin --generate-keys -S site.key
    (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.)
    Enter the site keyfile passphrase:
    Verify the site keyfile passphrase:
    Generating key (this may take several minutes)...
    Key generation complete.

    Then generated the local key:
    twadmin --generate-keys -L ${HOSTNAME}-local.key
    (When selecting a passphrase, keep in mind that good passphrases typically have upper and lower case letters, digits and punctuation marks, and are at least 8 characters in length.)
    Enter the local keyfile passphrase:
    Verify the local keyfile passphrase:
    Generating key (this may take several minutes)...
    Key generation complete.

    Then had to edit the config template, before generating the configuration file:
    twadmin --create-cfgfile --cfgfile tw.cfg --site-keyfile site.key twcfg.txt
    Please enter your site passphrase:
    Wrote configuration file: /etc/tripwire/tw.cfg

    Then generated the policy file:
    twadmin --create-polfile --cfgfile tw.cfg --site-keyfile site.key twpol.txt
    Please enter your site passphrase:
    Wrote policy file: /etc/tripwire/tw.pol

    Set file permissions:
    chown root:root site.key $HOSTNAME-local.key tw.cfg tw.pol
    chmod 600 site.key $HOSTNAME-local.key tw.cfg tw.pol

    Finally, initialized the database:
    tripwire --init
    Please enter your local passphrase:
    Parsing policy file: /etc/tripwire/tw.pol
    Generating the database...
    *** Processing Unix File System ***
    ### Warning: File system error.
    ### Filename: /var/lib/tripwire/.twd
    ### No such file or directory
    ### Continuing... Wrote database file: /var/lib/tripwire/.twd
    The database was successfully generated.

    Then deleted the source file: rm twcfg.txt twpol.txt

    Haven’t run it for very long, so might update this if I have problems.