Author Archives: Tom

ISC DHCP Server – Option 43 (Vendor specific attribute)

DHCP (RFC 2132) allows for vendor specific data to be distributed to clients.

Important notes:
– clients must request Option 43 in their Parameter Request List (Option 55).
– the Vendor Class Identifier (Option 60) sent by the client in the DHCP Request, must match ‘VendorName’ which is used in the ISC DHCP Server configuration below.

Example server configuration section from dhcpd.conf:

    option space VendorName;
    option VendorName.serviceName code 1 = text;
    option local-encapsulation code 43 = encapsulate VendorName;
    option VendorName.serviceName "data";

– where VendorName matches the value of the client’s Vendor Class Identifier (Option 60).
– ‘serviceName’ is used only as an internal reference within the DHCP server’s configuration, and must be different for each ‘code’ value.

Up to 256 codes may be used for each Vendor specific configuration. All fields will be returned to the client which matches the Vendor Identifier.

The DHCP server will return the Vendor attributes in the DHCP Response. The data returned is encoded in binary in the following format for each code:
Byte 0: code
Byte 1: length
Byte 2: data
…
Byte length+2: final data byte
… then follows the next field, starting with code, length, data…

Restarting Enlightenment (e17) from the command line

The scenario is that your Enlightenment (e17) desktop has locked up, and your keyboard and mouse appear to be non-responsive. However you do not want to reboot as you will lose all of your open windows.

It is possible to restart the Enlightenment engine without affecting the windows being currently displayed.

Either switch to a TTY (by pressing Ctrl+Alt+F1) or login remotely over ssh, and then execute:
env DISPLAY=:0 enlightenment_remote -restart

Your desktop should have now recovered its pre-locked up state.
(on most setups you can switch back to the desktop from your TTY by pressing Alt+F7)

Manually Adjusting Fan Speed on Lenovo L420

Platform: Debian Jessie (Testing), Linux 3.16

I have found that under considerable load such as video processing, the Lenovo L420 Thinkpad laptop gets very hot and instantly powers off.

As far as I can make out, the automatic fan speed doesn’t work as well as it should. Therefore when running under high load, it might be wise to force the fan to its highest setting. I should try and make a better fix sometime.

To manually adjust the fan speed, the thinkpad_acpi kernel module must be loaded with an extra option. Create the file /etc/modprobe.d/thinkpad_acpi.conf containing just one line:
options thinkpad_acpi fan_control=1
reboot.

The fan speed can be set to maximum with the command run as root:
echo “level 7” > /proc/acpi/ibm/fan
and then reset to auto:
echo “level auto” > /proc/acpi/ibm/fan

Read the current status by using:
cat /proc/acpi/ibm/fan
Note, the reported fan speed appears to be incorrect.

Quick and dirty introduction to GnuPG (GPG) on Linux

It’s a few simple steps to create GPG encryption keys and use these for signing and encrypting files and emails.

GPG Key Creation

Create a new pair of public/private cryptographic keys:
user@yourhost:~$ gpg --gen-key … follow the prompts use the defaults if unsure, Enter your name and email address.
List keys
tom@tomsalmon:~$ gpg --list-keys
pub 1024D/C96ACE6A 2010-03-30 [expires: 2015-03-29] uid Tom Salmon <tom@tomsalmon.com> sub 4096g/2BEF6E4A 2010-03-30 [expires: 2015-03-29]
Upload the Public Key to one of the Key servers
gpg --keyserver hkp://keys.gnupg.net --send-keys C96ACE6A
The key ID is retrieved using the above list keys function.
Export the Public Key in ASCII
tom@tomsalmon:~$ gpg --export -a C96ACE6A
Sample output
Import a Public Key in ASCII format
gpg --import < key.asc gpg --edit-key C96ACE6A … run the commands: 'trust', 'sign', 'save', 'quit'

GPG with Email

Mutt comes with built-in GPG support and integrates perfectly with the system's GPG setup

File Encryption

Encrypting
gpg -r your@emailaddress.org -e intheclear.txt
Creates a new file intheclear.txt.gpg which is encrypted with your public key. Only your private key can decrypt this file.
Decrypting
gpg [-d] secret.txt.gpg
(requires that you enter your passphrase) creates the unencrypted file 'secret.txt', if the '-d' flag is used the unencrypted data is displayed on the command line

You may encrypt files for other people if you have imported their Public Key. Only their Private Key will be able to decrypt the file.

Key Signing

Search the Keyserver:
gpg --keyserver hkp://keys.gnupg.net --search-keys tom@tomsalmon.com
… select the most recent key that matches, find the Key ID
To make life easier, add the following line to your .bashrc file: alias gpgsearch='gpg --keyserver hkp://keys.gnupg.net --search-keys' restart your shell, and run 'gpgsearch user@example.com'
Verify the Key fingerprint with its owner (manually, in person)
gpg --fingerprint KEY_ID
Set the trust level and sign the key
gpg --edit-key KEY_ID … run the commands: 'trust', 'sign', 'save', 'quit'
Upload the signed key to the keyserver
gpg --keyserver hkp://keys.gnupg.net --send-keys KEY_ID

Checking signatures on new keys

Search the keyserver and download the matching key
Check to see if the key has been signed by any trusted keys
gpg --check-sigs KEY_ID
Based on this result, you can determine if the key belongs to the user

Implementing IPv6 Privacy Extensions (RFC4941)

IPv6 auto configuration on Linux will normally assign the same address every time when connecting to a specific network. This address would normally be formed from the network prefix and local interface MAC address.

When using IPv4 your identity is slightly masqued by NAT. Although your single public IP address may be tracked, it is hard to track individual devices that exist on the local network. This is not the case with IPv6 where there is no NAT. Every device has a visible unique public IP address that rarely changes.

RFC4941 (obsoletes 3041) defines privacy extensions to IPv6 which will randomly assign an additional Global IPv6 address to the interface. This additional random address will have the same network prefix and be used for outgoing internet connections.

To enable the privacy extensions under Linux (using Debian Wheezy):
echo 2 > /proc/sys/net/ipv6/conf/${ifname}/use_tempaddr
replace ${ifname} with the name of your interface, eg wlan0

Possible values for this setting:
(0=off, 1=assign, 2=prefer)

Now at least you will be anonymized amongst the other nodes of your local network.