Dev notes

How to configure dark colorscheme for dev tools

Thu, 18 Oct 2018 11:04:00 +0000

Problem

Reconfigure environment in favor of dark (or night or drakula) colorscheme My personal preference is a “drakula” schema. So in this post

Embedded schemas

IntelliJ Idea

Switch to drakula scheme.

Mac OS X

System Preference -> General -> Use dark menu bar and Dock

External configurators

Project Dracula

Project Dracula supports 50+ different applications including Terminal.app

Gnome Terminal

Use dracula gnome terminal colorschema.

How to configure CI server for java projects doing encryption

Fri, 05 Jan 2018 18:07:00 +0000

Problem

You have an CI server building the java projects in encryption domain. These projects use a java security libs and requires a lot of random data. The server itself may run out of entropy for /dev/random which caused of a nasty problems that processes are stuck on CI whereas they run smoothly on your dev machine.

Solution part 1 - securerandom.source

First thing you want to do is to switch from /dev/random to /dev/urandom. You can modify $JAVA_HOME/jre/lib/security/java.security file to set the option securerandom.source=file:/dev/urandom.

If for some reason you can’t modify this file, there’s another option for you - use special env variable that’s picked up by java:

export _JAVA_OPTIONS="-Djava.security.egd=file:///dev/urandom"

Solution part 2 - securerandom.strongAlgorithms

Even though random source is set to pseudo random generator, the process may still hang. The reason can be that SecureRandom.getInstanceStrong() is called, so the strongest crypto source is choosen regardless to securerandom.source. To change it modify $JAVA_HOME/jre/lib/security/java.security as following:

securerandom.strongAlgorithms=NativePRNGNonBlocking

For Linux and MacOS, the available algorithms are(full list):

Algorithm	nextBytes	generateSeed
SHA1PRNG	???	????
NativePRNG	/dev/urandom	/dev/random
NativePRNGBlocking	/dev/random	/dev/random
NativePRNGNonBlocking	/dev/urandom	/dev/urandom

It still doesn’t work - how to debug?

If you want to see what your SecureRandom implementation is doing, then you can turn on debugging:

-Djava.security.debug="provider,engine=SecureRandom"

Future reading

Enable docker remote api

Wed, 03 Jan 2018 11:17:07 +0000

This article describes how to configure a docker to be able to connect to it over tcp.

Enable the remote API on a new socket

Create a file called /etc/systemd/system/docker-tcp.socket to make Docker available on a TCP socket on port 2375.

[Unit]
Description=Docker Socket for the API

[Socket]
ListenStream=2375
BindIPv6Only=both
Service=docker.service

[Install]
WantedBy=sockets.target

Then enable this new socket:

systemctl enable docker-tcp.socket
systemctl stop docker
systemctl start docker-tcp.socket
systemctl start docker

Test that it’s working:

docker -H tcp://127.0.0.1:2375 ps

Connect from another machine

On another machine use DOCKER_HOST env variable (docker-host is an address of a docker machine):

DOCKER_HOST=tcp://docker-host:2375 docker ps

From https://coreos.com/os/docs/latest/customizing-docker.html

git diff tricks

Tue, 17 Oct 2017 11:17:07 +0000

Exclude files from git diff

To remove pom.xml (or another) files from git diff output, use following command:

git diff COMMIT_TO_COMPARE  -- . ":(exclude)*/pom.xml" ":(exclude)pom.xml"

Run git diff in GUI

git difftool allows you to use different diff tools to review changes in the git repo.

To see available tools run it as following:

$ git difftool --tool-help
'git difftool --tool=<tool>' may be set to one of the following:
    bc
    bc3
    emerge
    opendiff
    vimdiff
    vimdiff2
    vimdiff3

  user-defined:
    sourcetree.cmd opendiff "$LOCAL" "$REMOTE"

The following tools are valid, but not currently available:
    araxis
    codecompare
    deltawalker
    diffmerge
    diffuse
    ecmerge
    examdiff
    gvimdiff
    gvimdiff2
    gvimdiff3
    kdiff3
    kompare
    meld
    p4merge
    tkdiff
    winmerge
    xxdiff

Some of the tools listed above only work in a windowed
environment. If run in a terminal-only session, they will fail.

From time to time I want to use beyond compare to review the changes:

git difftool --tool=bc3

Tooling: command-line mail client

Wed, 11 Oct 2017 11:53:57 +0000

mutt allows you to access a mailbox via command line and it has a good-enough user interface.

All configuration is kept in ~/.mutt folder. Here’s how I configured it to access different fodlers/accounts navigating via F-keys.

Create a account file named like ~/.mutt/account.%accontname% , for example account.com.gmail.test for test@gmail.com. Here’s a template:

 set my_server = %CHANGEME%
 set my_smtp_server = %CHANGEME%
 set my_user = %CHANGEME%
 set my_pass = %CHANGEME%
 # Account - SMTP
 set smtp_url = "smtp://$my_user:$my_pass@$my_smtp_server:587"
 set smtp_pass = $my_pass
 set imap_user = $my_user
 set imap_pass = $my_pass
 set ssl_force_tls = yes
 set ssl_starttls = no
 set ssl_verify_host = no
 set ssl_verify_dates = no
 #
 # Default inbox
 #
 set spoolfile=imaps://$my_server/INBOX
 #
 # Default location of mailboxes
 #
 set folder=imaps://$my_server/INBOX
 bind index G imap-fetch-mail
 #bind index d purge-message

In ~/.mutt/muttrc file register folder-hook and add a macro for each account. In following example test@gmail.com account is registered and mapped to F2.
```
 folder-hook 'account.com.gmail.test' 'source ~/.mutt/account.com.gmail.test'
 macro index  'source ~/.mutt/account.com.gmail.test!'
```

In ~/.mutt/muttrc file define a default account:

 # Default account
 source ~/.mutt/account.com.gmail.test

Define a shortcut to fetch new emails (in ~/.mutt/muttrc):
```
 bind index G imap-fetch-mail
```

SSL Debugging

Wed, 11 Oct 2017 11:53:57 +0000

Show server’s ssl certs:

openssl s_client -showcerts -connect 127.0.0.1:8444

Get certificate (from here):

openssl s_client -connect localhost:8443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'

Save the content from BEGIN CERTIFICATE to END CERTIFICATE inclusive to the server.crt file. Then you can convert it to the jks file:

$ cat server.crt # an example how the file should look like
-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEEoaVPzANBgkqhkiG9w0BAQsFADBsMRAwDgYDVQQGEwdV
bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYD
VQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3du
MB4XDTE4MDIyMTE1MDU0MFoXDTI4MDIxOTE1MDU0MFowbDEQMA4GA1UEBhMHVW5r
bm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UE
ChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEQMA4GA1UEAxMHVW5rbm93bjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALykWgm+XOINMD8ZVYQbABj5
aJcRErGqmLIg2wLH3IL8kjjFSrslmc/QcoYN+/NUp1HtPcM+mGbn++h4MkUwiTJR
G92sgO+ZYoB/hwRL0uyXO5srBQ4r0Uv6lcQlcSBa3pJoHfM/LEF9nsGQjzHrnvtS
muwgUTb/lCTQyONg44WORVnTHS09yMliXpfKMTq5vkev5DXYGy/lzDFBJ6eHWN/x
SF0zWD2Yb1OylkBBghYl+/+WDWNUmeLeW+gACgKvhm13gED+RajEFIt3T9FVakJI
BE+jMdDkwh+sHwYBQey81fBc6MkcsJ/zzyrq3/lBhDH9XttROenIrPNrMwARZi8C
AwEAAaMhMB8wHQYDVR0OBBYEFAXzn1lYd1vW2FNCe+WQmc/utFbnMA0GCSqGSIb3
DQEBCwUAA4IBAQAJzC4vMt2fufbkPDSSqePSxgl3ddfAhEq4UdNyRriTbWJwFtdF
bDScrc3EbIS00duspKkMj2PbM/pM3mqRfXc1RavQpMBTSW/yR3fTjOy+RcoNSnVX
RXmnlE57hRfh+vALd5v2vrI51l+nOK3qn6nLY9+uJzJ/ZTb+JY+bWuU+0EST1Kyk
0Mi0GC9faXBEKZqJd/NLCuzFfE8fn2YN9FZC/1pxxPo0NoHGo1KX18t99GePIzzT
Ot4+kQZ7KhrYzcT3eO/9VryFVAbj+qRgu6yLU9U1mSX6/ZqaLr9FQma+P26jVsjC
CQS+77jHXzGTw/Yg5YWwkf47guhzJvk2GjAr
-----END CERTIFICATE-----

$ keytool -genkey -keyalg RSA -keysize 2048  -alias localhost -keypass CHANGEME -dname "CN=Unknown, OU=truststore, O=Unknown, L=Unknown, ST=Unknown, C=Unknown" -keystore truststore.jks -storepass CHANGEME
$ keytool -list -keystore truststore.jks -storepass CHANGEME # shows content of jks -> original key is there
$ keytool -delete -alias localhost -keystore truststore.jks -storepass CHANGEME
$ keytool -list -keystore truststore.jks -storepass CHANGEME # jks is empty
$ keytool -import -alias SERVER_NAME -keystore truststore.jks -file server.crt -storepass CHANGEME -noprompt
$ keytool -list -keystore truststore.jks -storepass CHANGEME # jks contains server's certificate

UI for certs: portecle (see also frequently used ssl commands)

# show certs in jks
keytool -keystore myks.jks --list
# export cert from jdk
keytool -keystore myks.jks -exportcert -alias key -file key.der
# show cert info
openssl x509 -noout -text -in key.der -inform der
# convert der to pem
openssl x509 -inform der -in key.der -out key.pem
# test a server ssl
openssl s_client -connect 172.17.0.1:8444 -prexit -cert key.pem

Troubleshooting

The Signature does not match error is the symptom that the server identity is unknown to the client, ie the client truststore does not have the server certificate.
Add -Djavax.net.debug=ssl or -Djavax.net.debug=all to debug the traffic
Add custom private certificate or truststore using java properties:

-Djavax.net.ssl.keyStoreType=pkcs12 -Djavax.net.ssl.keyStore=clientcertificate.p12 -Djavax.net.ssl.keyStorePassword=CHANGEME

-Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStore=gridserver.keystore -Djavax.net.ssl.trustStorePassword=CHANGEME

bash programming

Fri, 27 Jan 2017 00:03:58 +0000

Useful links

shortcut to toggle fn keys in macOS

Tue, 10 Jan 2017 20:03:53 +0000

Problem: create a shortcut to toggle “Use F1, F2, etc. keys as standard function keys” in macOS Sierra.

Here’s the solution.

Download fntoggle program and save it to /usr/local/bin, make it executable.
In Automator create a new Service.
1. Select “no input” for recieving
2. Add “Run Shell Script” action with command /usr/local/bin/fntoggle ; echo "ok"
3. Save it as “fntoggle”
In System Preferences/Keyboard/Shortcuts find fntoggle under Services, sub-section General. Click on right column (with text none) to assign new shortcut.

mail server for testing

Thu, 04 Aug 2016 01:12:51 +0000

Set up a mail server

Create a docker-compose.yml:

version: '2'

services:
 mail:
 image: tvial/docker-mailserver:latest
 # build: .
 hostname: mail
 domainname: domain.com
 container_name: mail
 ports:
 - "25:25"
 - "143:143"
 - "587:587"
 - "993:993"
 volumes:
 - maildata:/var/mail
 - ./config/:/tmp/docker-mailserver/

volumes:
 maildata:
 driver: local

Create your mail accounts

mkdir -p config
docker run --rm \
 -e MAIL_USER=user1@domain.tld \
 -e MAIL_PASS=mypassword \
 -ti tvial/docker-mailserver:latest \
 /bin/sh -c 'echo "$MAIL_USER|$(doveadm pw -s SHA512-CRYPT -u $MAIL_USER -p $MAIL_PASS)"' &gt;&gt; config/postfix-accounts.cf

Start the container:

docker-compose up -d mail

source or alternative

Send a mail (SMTP)

Install sendemail to send a mail:

brew install sendemail
sendemail -f user1@domain.tld -t user1@domain.tld -u test2 -m content -s 0.0.0.0:25 -o tls=no

* alternative approach

Read a mail (IMAP)

Install mutt (howto) client. Create ~/.muttrc file as following:

set my_server = 0.0.0.0
set my_smtp_server = 0.0.0.0
set my_user = user1@domain.tld
set my_pass = mypassword

# Account - SMTP

set smtp_url = "smtp://$my_user:$my_pass@$my_smtp_server:587"
set smtp_pass = $my_pass
set imap_user = $my_user
set imap_pass = $my_pass
set ssl_force_tls = yes
set ssl_starttls = no
set ssl_verify_host = no
set ssl_verify_dates = no


#
# Default inbox
#
set spoolfile=imaps://$my_server/INBOX

#
# Default location of mailboxes
#
set folder=imaps://$my_server/INBOX

bind index G imap-fetch-mail
#bind index d purge-message

Start mutt to retrieve the mails via smtp, press G to check for updates.

renting a flat in Zurich

Wed, 03 Aug 2016 07:05:27 +0000

Here's the list of apartments available for rent in Zurich:

backlog