Gentoo/MIPS µClibc stages

Well, it seems I might have µClibc stages going again, at least for little endian initially, then I might fire up one of the SGI boxes and see about a big-endian version.  For a long while, Gentoo/MIPS support for this lightweight C library was all but missing ever since an ABI change broke the µClibc port back around 2006.

I’ve tried on several occasions to build a new environment, and often I was met with technical difficulties which prevented me from producing a working environment.  Recently, I downloaded Rob Landley’s Aboriginal Linux distribution, both big and little endian variants, and took it for a spin.  Having done that, I’m pleased to report that I now have a µClibc chroot that’s merrily compiling various components of the Gentoo system, and will soon be sufficient to make a seed stage for bootstrapping the port once again.

This should mean new netboot images in the medium term for all little-endian ports (and proper ones too, not glibc-based hacks) and new images for SGI Indy (R4000) and O2.  In theory, support for Octane and Indigo2 R10000 is possible, however the systems I have are no longer functional, only my Indy and O2 still work, thus it’s impossible for me to test media for other systems.  Fingers crossed this initial build will go to plan, and we’ll have shiny new stages shortly.

2011/03/12 by Gentoo Development Linux Development Public Syndication 5

New antenna

For a little bit I’ve been struggling with poor performance on my bicycle mobile station.  It was an intermittent fault.  Sometimes it’d work great, other days the FT-290R II would complain bitterly about a SWR issue, and receive performance would be abysmal.  But then I’d set off anyway, get a block away, and the problems just disappeared.  Or the thing would be working perfect, and I’d get down the road and it’d stop working.

Damn frustrating.  Intermittent faults such as these are the worst kind to try and locate.  I thought of all kinds of possibilities, but the one thing I hadn’t considered was the antenna.

Performance had been pretty patchy ever since the weekend before LCA.  It was on the Saturday that somewhere between Annerley and Milton, I lost the ¼ wavelength stainless-steel whip that I had been using.  So I spent that evening rigging up a SO-239 socket so that I could use the commercial antenna I had; a Nagoya NL-77BH that I bought at BARCfest in 2008.

I rigged that up, and on the Monday I did successfully make a contact from the bicycle on my way to LCA, but it was patchy.  I did find a few glitches, so fixed those, and Friday I made a contact in the afternoon, but it was still pretty hit-and-miss.  Not the consistent behaviour I got out of my ¼ wave at all.  Okay, maybe the coax is damaged.  Tried different leads, no dice.  Recently I bought a front basket for the bicycle, and so I could put the FT-290RII in there.  Ran coax back to the antenna, last Wednesday afternoon and Thursday morning it worked beautiful.  However Monday it gave me no end of grief.

Suspecting that the weight of the radio pressing down on the BNC terminations may have damaged that section of coax, I grabbed a length of RG195 and terminated it with BNC connectors.  Still no good.  Using the SWR meter in the FT-897D, the impedance match was out by miles.

Today I had another look.  I took the antenna off the bicycle and placed it on a mag-mount antenna base, and placed the base in the centre of an open garage door.  So big ground plane, not much different to most cars.  Checked SWR, still through the roof.  Tuned to the Mt. Cotton repeater on the FT-897D, no signal.  Pulled out a hand-held, perfectly clear 5/8 signal on its original rubber-ducky antenna.  As I was unplugging the antenna base, I watched the signal strength suddenly shoot up and the radio crackle to life when the shield was disconnected (leaving just the centre pin).  I had noticed a dead short before, but thought it was the antenna mount on the bike… something was up.

So, I grabbed a bit of solid copper wire, a PL-259 plug, and some offcut insulation.  I made a new ¼ wavelength antenna, cutting it initially at 60cm.  Swapped it for the NL-77BH and the performance was beautiful.  Check SWR, and yes, it’s high, but then again, 60cm is waay too long.  I estimated about 51cm and folded the wire over at that point, twisting the excess around the body of the antenna.  Signal strength immediately went up two S points, and on checking SWR, it was significantly reduced.  I moved it back to the bicycle where I tweaked it further.

Once happy, I cut off the excess, used pliers to fold the end sharply and soldered the folded end to the body of the antenna to prevent it hooking anything.  Then used some heat-shrink tubing to finish it off so there were no sharp ends to poke eyes out with.  The antenna provides a good match from 144 right through until 148 MHz at 30W using FM.

I haven’t tried a contact on the bike yet, nor have I got any pics to share, but the radios seem happy with it, and it appears to be hitting repeaters in the area once again, including Ipswich.  Given it’s a good 30km between The Gap and Marburg (as the crow flies) with some decent hills to boot, that’s not bad going.

It would appear the additional complexity of these high-gain commercial antennas comes at a significant cost, they don’t like getting shaken to bits on the back of a bicycle.  I’m not sure how repairable the commercial antenna I have is, it may be a case of throw the thing out, at which case I think any love affair I had with commercial mobile whips might be over.  At least my ¼ wave antennas can be made for <$20 in about 10 minutes from parts I can buy in town, versus spending >$50 and having to wait for it to arrive in the post.

2011/03/09 by Amateur Radio Bicycle Mobile Homebrew Public Syndication 0

“Ever thought of using a mobile phone instead”

This is a question raised on an earlier post of mine.

It’s an interesting comparison between radios and mobile phones.  And some are of the belief that all you do with a radio, is talk on it, or that mobile phones can completely replace radios.  Rather than respond there, I’ve decided there’s enough content there for a completely separate post.  I have highlighted my main arguments here for those who just want to quickly skim through.

Indeed, mobile phones do exist, and they are very handy things.  They do generally come with some sort of hands-free capability.  This is true of my Nokia 3310 … the connectors are available from JayCar, and the headset schematic is trivial.  This is not true of all mobile phones unfortunately.  Much the same is true of my radios, the FT-897D takes a standard RJ45 connector for the microphone, the FT-290R II takes a more obscure 8-pin “Foster” connector, but even they can be sourced if you look around.

RFI is a worse problem for mobile phones however, GSM seems to have a happy knack of being able to inject itself into almost anything unless you’re careful with your circuit design.

It’s worth considering what the primary point of the exercise is however, and how radio and mobile phones differ.

Mobile phones are great if you want to call someone specific. They are highly optimised for one-to-one conversations.  In fact, it’s highly expensive to do anything else.  Conference calls are a rare thing and you pay through the nose for the privilege.  Mobile phone charges are high enough already — I would not like to be paying for the cost of a one hour conference call twice daily on my way from/to work.

To contrast the fees, it costs me $20/month for a mobile phone service through Telstra (excluding calls).  I rarely see a phone bill above $30, but I’d probably see that climb to triple digits if I used it in the manner I use my radio.  The radio license costs me $65/year, regardless of whether I leave my station packed-up and inoperable, or whether I’m using it all 31557600 seconds of the year.

When I was riding frequently however, I regularly participated in discussions on my commutes.  It does make the ride more enjoyable when you can have a friendly chat on the way in.  The beauty of radio though is that you don’t all have to be in close enough proximity to hear each other baseband.

Radios are well suited to group discussions, since radio is an inherently shared medium. At most a repeater site which can relay the traffic between stations is all that is necessary.  I’ve also had quite successful simplex contacts on the 2m band over 50km, and overseas on the 40m band.  Mobile phones only achieve coverage over a few kilometres line-of-sight, coverage is extended by cellular towers which perform a similar function to repeaters.

If you’re in a discussion on the radio, good operating practice states that you leave a gap between transmissions so that other stations may break in if needed.  The breaking station may be someone wanting to get in touch with one of the other operators on frequency, may be an interested party, or could even be a person in distress.

It’s relatively simple for someone to jump in on a conversation.  Mobile phones however, prohibit this unless, once again, you pay severely for the privilege.  How often have you been in a situation where you’ve been trying to chase a caller off the phone so that the line is free for that important call you’ve been waiting for?  Not such a problem with radio.

Mobile phones give you a certain degree of privacy in communications.  Encryption standards vary between mobile phone standards, but all of them (except AMPS, which is now extinct) provide some means of privacy.  Radios generally don’t unless you pay through the nose for a set and a suitable license.  Encryption is also forbidden on amateur bands.

Both allow a certain amount of experimentation.  If you have a mobile phone that provides an antenna socket, it is theoretically possible to construct your own antennas.  You are not however able to alter the transmission mode or frequency of operation, nor are you able to construct your own mobile phone (homebrewing) without significant expense, as the device you construct must be tested and approved by local authorities before you may connect it to a network.  (In Australia, the body responsible is the ACMA, and the approval you need comes in the form of a “regulatory compliance mark”, formerly “A-tick”.)

You can however readily experiment with software running on top of modern smartphones, if you phone is that new.  (Mine isn’t)  Or, if you have a >= 3G capable phone (again, mine isn’t), you can hook a small computer up and use standard VoIP software.

Radios on the other hand, if your license permits it (mine does), can be completely constructed from scratch.  You choose the frequency and mode, there are boundaries where you cannot go, but there’s still a hell of a lot of freedom that mobile phones do not provide.  All amateur transceivers have socketed antennas, allowing experimentation with other antenna types.  Multi-band sets permit experimentation with different frequency bands, all of which differ in their properties.  Transmission modes include pretty much all analogue modes, and in most license classes, many forms of digital communication.

Mobile phones typically are fairly easy to use (there are people however that never seem to get it however), while radios almost always require a certain level of training.  Amateur radio requires you to sit two or three separate exams (usually two written exams for theory and regulations, and a practical test).

Some might ask why I use such an old mobile phone?  Well, you’ll notice the FT-290R II isn’t a spring chicken either.  I use stuff because they do the job.  The old Nokia 3310 has been solid and reliable.  There’s minimal “fluff” to cause problems.  Someone dials my number, it rings.  I dial a number, it calls that person.  Text messages, easy.  My needs don’t require anything more sophisticated.  Don’t unnecessarily complicate, I say.  When I’m out and about, this means I’m contactable two ways … primarily by radio, but if the phone rings, I can pull over and plug the phone in instead to take the call.

In my situation on a bicycle, it is also paramount that I do not have my hands tied up manipulating radio/phone controls. My solution was to wire up a small keypad which provides push-to-talk and four directional buttons.  On the mobile phone, the PTT becomes my answer button, and I can dial a person by momentarily pressing the button, waiting for the prompt, and announcing the “voice tag” of the person in the phone book.  The phone then rings that person automatically.

On the radio, I mainly use memory channels, so I’m moving up and down the memory channels.  Usually I just switch to a given frequency, and stay there.  When I want to talk, I press the button down — or, more recently I added a switch which is equivalent to “holding the button”.  So I just flick the switch to go to transmit, and flick it back again.  In the meantime, I’m able to use my hands for operating the bicycle.

Contrast this with trying to juggle a netbook computer running a VoIP package such as Skype.  It’d be a nightmare, those user interfaces are not designed for mobile operation. They’re simply not appropriate.  SIP-based VoIP is better in some ways as you can code your own application, but even then, you’re at the mercy of the mobile phone carrier’s network.  VoIP is very sensitive to NAT and dynamic IP addresses, and I think operating mobile in this manner would be a bit much to expect.  Skype also cannot handle a group as large as radio can.  (SIP can handle over 200 participants in a conference, limited by server bandwidth.  On the radio, I’ve regularly participated in nets with more than 10 people on air at a time.  Skype is limited to 5 IIRC, or maybe you pay for more.)

Amateur radio is largely infrastructure independent. On the bicycle I can get around obstacles that would be impassable in a car.  With high capacity batteries, and a reasonable power set on a high mountain top, I can achieve significant simplex range, thus allowing me to relay traffic over great distances, without any requirement for intermediate infrastructure.

“Ohh, I’ll just use the phone for that” you say.  Yeah, right.  Try that in the Lockyer Valley just now.  Many of the mobile phone towers went for a swim, as did the exchanges.  Areas around Grantham are without any forms of mobile or land-line based telephony.  And of course, no Internet.  The same situation was the case for people caught up in the Black Saturday bushfires down in Victoria.  I’d imagine communications are under very heavy strain in Christchurch at the moment.

Mark Pesce made a very valid point in his LCA2011 keynote, communications can also be disrupted for political reasons, such as what has happened in Egypt and Lybia.  What do you do then?  Radio’s not perfect, but it sure beats being left without a means to let people know you’re okay.  With mobile phones, you are dependent on others to bring online infrastructure, before you can make a call from your phone to the other.  (Unless you experiment with something like the Serval Batphone, which has its limitations.)

So one does not completely replace the other.  They are complementary. The theory requirement keeps a lot of people away from amateur radio, however I’m happy to report I’ve never received a telemarketing call on the radio. 🙂  More to the point, there is more to amateur radio than just talking to people, just like there’s more to the police force than just arresting people.

As for me, radio has fascinated me for a long time.  I first became interested in radio from a very young age, but I particularly got into it after studying how it worked at university.  This is what lead me on to amateur radio.  So for me, it’s as much technical as it is social.  I enjoy meeting up and talking with people, but I also enjoy the experimental aspect of it.

At the moment, a large amount of my energy is going into bicycle mobile operation, particularly with regards to HF communications.  This does necessitate big antennas.  Antenna installations are always a trade-off between physical size, efficiency and band-width, and it can be a real challenge to get things working, but it’s rewarding when it pays off.

Some would argue: “Why bother? Just use a mobile phone.”  That’s like asking a car enthusiast, “why muck around under the bonnet when you can take your car to the garage down the road?”  Or to the avid gardener, “Why bother growing your own veges, there’s a greengrocer in the shopping centre?”.  Yes, they do exist.

I also would like to point out that the commercial world has gained lots from home experimenters.  You use a NAT router for your home Internet connection?  What’s the OS it runs?  Many run Linux.  Did we get Linux from a big commercial organisation originally?  No, it came from an avid homebrewer of operating system kernels, and was never intended to be “big and professional like gnu”.  Did we get Single Sideband from the commercial world?  No, it was an Amateur Radio inspired invention.  Likewise with a lot of high frequency design techniques that are in mobile phones today.  Heck, in the future we’ll probably be adding Codec2 to that list.

The world needs amateurs of all persuasions.  For this reason, declaring something “obsolete” just because you can do the subset of things you do with another more contemporary technology, is a short-sighted way of viewing things.  The amateur world benefits from the professional world, and vice versa.  It’s often the case that someone who works in a particular industry for a living, goes home then hacks on various projects related to that industry for fun in his/her spare time.

So, “why not just use a mobile phone”?  Because I find radio fun, I enjoy it, and I hope that some day, what I learn can be shared and applied in a professional setting to improve technology as a whole.  After all, isn’t having fun what the world is all about?

2011/03/05 by 2011 Amateur Radio Linux Development linux.conf.au Public Syndication Thinktank 0

May you live in interesting times

So far this year we have had:

  • in Australia, record flooding in three states on the eastern seaboard
  • Also in Australia and at about the same time, bushfires around Perth
  • Flooding in Brazil
  • Cyclone Yasi clobbering North Queensland (So bad in fact, that CNN thought Queensland had been sucked up and dumped the other side of Bass Strait.  Guess that’s Chicken Noodle News for you.)
  • The uprising and subsequent overthrowing of the government in Egypt
  • Numerous uprisings in Bahrain
  • Lybia practically booting out its ruler, although Gadhafi still appears to be under the delusion that he’s still in charge
  • Christchurch, New Zealand, levelled by earthquakes
  • Cyclone Carlos continuing to make a prick of himself off the Western Australia coastline
  • IANA exhausted of IPv4 addresses

And it’s not even March.

2011/02/23 by Public Syndication 0

IPv6 “will never take off, ever”

That was one of the comments made following my piece in this week’s WIA national news.

We better start thinking up a better protocol then if that’s the truth. And we’ve only got 5-10 years to do it apparently, and migrate everyone.  The IPng working group started their work in the early 90’s.  It took them 5 years just to come up with the protocol, and it took a further 5 years before consumer operating systems included support for it.

My tip; IPv6 migration will be the easy route.  For starters, operating systems already support it.  Much software already works with it.

Mythbuster:

IPv6 is completely incompatible with IPv4

Addressing-wise, maybe… but TCP and UDP still work the same way.  The only catch is that you now need 16 bytes to store an address, instead of 4.  If your application passes IP addresses around in the upper layers, you just need to find room for the extra 12 bytes.  Not impossible, and not a show-stopper if your protocol was designed right in the first place.

There’s plenty of /8s allocated to companies, we can use those for the next 5-10 years!

Mmm hmm, you think they’ll just graciously give us that space?  And that it’ll last forever?  China alone if it gave one address to each of its citizens could fill up a whole /2 on its own.  How big’s a /2? 230 =~ 1 073 741 800 addresses.  And they’re growing.

Fact is, this may delay the ultimate IPocalypse, but whatever we do, it will probably take 5 years to migrate.  So our best move is to start moving now.  Not wait until the crunch happens.

2011/02/20 by 2011 Amateur Radio linux.conf.au Public Syndication 0

YubiKey ebuilds and patches for Gentoo

Hi all,

As promised I’ve put up some of the ebuilds needed to use the YubiKey in Gentoo.   This includes a PAM module for stand-alone authentication with the YubiKey, which I have patched to support concatenated two-factor authentication.  These are in a new overlay:

  • git://git.longlandclan.yi.org/overlays/yubikey.git
  • http://git.longlandclan.yi.org/git/overlays/yubikey.git

Stand-alone two factor authentication: Password + YubiKey with YubiPAM

The procedure for setting this up is pretty simple.  First, grab the overlay:

stuartl@beast /home/portage/overlays $ git clone git://git.longlandclan.yi.org/overlays/yubikey.git
Cloning into yubikey...
remote: Counting objects: 16, done.
remote: Compressing objects: 100% (13/13), done.
remote: Total 16 (delta 2), reused 16 (delta 2)
Receiving objects: 100% (16/16), 4.15 KiB, done.
Resolving deltas: 100% (2/2), done.

Now add it to your make.conf as per usual procedure, then unmask and install YubiPAM and ykpers ebuilds.  At last check, you need the live git ebuild for ykpers and libyubikey if you use the latest revision (2.2) keys like those handed out at linux.conf.au.  For the PAM module, I recommend using the non-live version, although a live ebuild is there for the adventurous (I had buffer overflow glitches).

# ( echo =sys-auth/yubipam-1.1_beta1
> echo =sys-auth/ykpers-99999999
> echo =sys-auth/libyubikey-99999999 ) >> /etc/portage/package.keywords
# emerge ykpers yubipam

This will install some tools to personalise the YubiKey and the PAM module.  At this step it’s now time to program the YubiKey.  This will break its ability to be used on the Yubico servers until you upload a copy of your new AES key to their site (see below).

Choose your public and private IDs, then program with the following command.  The fixed parameter should be 6-8 bytes long in hexadecimal.  If you intend to use this on Yubico servers later, it must be 6 bytes long, and must begin with ff.

# ykpersonalize -ofixed=$( modhex -h ffeeddccbbaa ) -ouid=112233445566
Firmware version 2.2.2 Touch level 1283 Program sequence 3
Passphrase to create AES key:
     Type in a long string of gobbledegook with lots of random letters,
     numbers and punctuation (not like this!) to keep people guessing.
     This will seed the AES keygen.
fixed: m:vvuuttrrnnll
uid: h:112233445566
key: h:afaaaa6021303d90740579cd7fc4e87f
acc_code: h:000000000000
ticket_flags: APPEND_CR
config_flags:
extended_flags:

At the bottom it asks whether you wish to program the key.  It didn’t here because in fact I had snuck in a little parameter which I haven’t shown here.  You’ll want to make a note of the parameters it tells you though, especially the generated key.

Once complete, you then need to tell YubiPAM about it:

# ykpasswd -a -c -f ffeeddccbbaa -k afaaaa6021303d90740579cd7fc4e87f  -p 112233445566 \
        --user stuartl -o vvuuttrrnnlllrgjglvnicujhnhhecfeitjureidlcer
Adding Yubikey entry for stuartl
Using public UID: ff ee dd cc bb aa
Using private UID: 11 22 33 44 55 66
Passcode: Completed successfully.

The last bit should be generated from the YubiKey itself, just type the rest in then press the button and it should add you after asking for a passcode (which can be different to your regular system password).  The final step is to set it up with PAM.  This I’m not 100% sure of, but I achieved working authentication by configuring my /etc/pam.d/system-auth as follows:

vk4mslp2 yubikey # cat /etc/pam.d/system-auth
auth            required        pam_env.so
auth            sufficient      pam_yubikey.so concat_two_factor
auth            required        pam_unix.so try_first_pass likeauth nullok

It should be noted; test the configuration in a new console session, do not log out or else you may lock yourself out.  There is a ykvalidate tool for testing, but it doesn’t seem to work properly with two-factor authentication.

The concat_two_factor parameter to pam_yubikey relies on a patch present in the ebuild, which I have sent up-stream, and is a work-around for (some would say, broken) PAM clients that do not support multiple Password fields such as KDM.

To log-in, type in your username.  In the password field, enter the passcode followed by a space, then tap the YubiKey to enter the OTP.  It should log you in.

Uploading the key to Yubico

First, a warning

The whole point of one-time password generators such as this, is to prevent someone intercepting your password and logging in to your systems.  If a one-time-password is captured, it’s useless because in the ideal case, all systems know it has already been used.  I say in the ideal case.  In this scenario, if you use the key on a public server, it is possible for someone to capture that OTP, and re-play it to the stand-alone system using YubiPAM to gain access.  They of course can only do this once, but that may be enough for them to make themselves at home.

With some care, you can reduce the risk of this … for instance making a point of gratuitously logging in to each system using the key immediately after using it on any of the systems is one way to try and manually synchronise the OTPs.  I’m giving this problem some thought, for my needs it isn’t such a big deal as it’s mostly for fun anyway, but this is a factor that must be considered when using the YubiKey (or any OTP device) in this manner.

How to

Go to https://upload.yubico.com/.  Enter the data as follows.

  • Your email address (needs no explanation)
  • The YubiKey’s serial number: printed on the back, 6 digit decimal code
  • YubiKey Prefix: This is also called the “fixed UID” and appears as the first 12 characters of the OTP.  It should be in modhex format.  In the above example, the prefix would be vvuuttrrnnll.
  • Internal identity: This is also called the “private UID”.  It should be in hexadecimal format.  In the above example, the internal identity would be 112233445566
  • AES Key: Again in hexadecimal… the key used in this example was afaaaa6021303d90740579cd7fc4e87f
  • Finally, an OTP from the device. Don’t fill this in yet.

Below this form there is a Capcha field to stop spambots.  Fill in the challenge and click the “I’m a human” button, and copy the text into the other box as it asks.  Now go back to the other form, click on the OTP field and press the YubiKey button.  You should then be able to test it on their demo server and use the key simultaneously on the web and your local systems.

2011/02/17 by 2011 Gentoo Development Linux Development linux.conf.au Public Syndication 7

Gentoo and DHCPv6

Amongst playing with the YubiKey, I also had a look at DHCPv6.  As people well know, IPv4’s days are numbered, and given we’re all going to have to jump across to IPv6 fairly soon, I figured I had better get acquainted with the newer protocols that come with it.

I’ve had my network running dual-stack for some time now.  This has been achieved using stateless autoconfiguration and router advertisments, which work fairly well.  Today though I decided I’d give DHCPv6 a crack.  For this, you will need the latest ISC dhcp package, net-misc/dhcp-4.1.0, which is hard-masked.

I hope to get something more mature going, but here are some notes who may wish to try this at home.

Setting up DHCPv6

Start by installing the net-misc/dhcp-4.1.0, on both server and clients…you will need to unmask it first:

# echo =net-misc/dhcp-4.1.0 | tee -a /etc/portage/package.unmask >> /etc/portage/package.keywords
# emerge -a dhcp

The -4 and -6 flags

Now, that will install the DHCP server and client.  The catch that initially caught me is that ISC dhcpd cannot run on IPv6 and IPv4 simultaneously. Neither can the client, but we’ll get to that.  Both server and client are put into IPv4 mode by running with -4 in the options, or -6 for IPv6 mode.  Documentation says it defaults to IPv6 mode, but my experience has been the opposite (maybe a Gentoo patch does this).

Server set-up

Needless to say, if you’ve got your network running IPv4, at most you might have to edit /etc/conf.d/dhcpd to add -4 to the start-up options (DHCPD_OPTS to be exact).  Easy.  It’ll work as before. If you want IPv6, okay, make that -6 in DHCPD_OPTS, no sweat. But what if you want both? Ohh fun, we need a second dhcpd instance.

My solution; copy each /etc/init.d/dhcpd and /etc/conf.d/dhcpd to /etc/init.d/dhcpd-v6 and /etc/conf.d/dhcpd-v6 respectively.  Make the necessary changes to /etc/init.d/dhcpd-v6 and /etc/conf.d/dhcpd-v6.  So that the two don’t clash, I thought it wise to substitute DHCPD with DHCPDV6 using a text-editor (replace all).

You’ll also want to rename the leases file (dhcpd.leases, I chose dhcpd-v6.leases) and the PID file.  In addition the init script calls dhcpd to check the configuration in checkconfig(), so add -6 there too.  To save you going back and adding it in /etc/conf.d/dhcpd-v6, you can also add the -6 flag to the start-stop-daemon call in in start().  Do similar manipulations to /etc/conf.d/dhcpd-v6.

As for the server configuration file itself, I called my IPv6 config file /etc/dhcp/dhcpd-v6.conf to differentiate it from v4.  The two will need separate configuration files.  At the top of the v6 configuration file, you’ll want to point it to new PID and leases files:

pid-file-name "/var/run/dhcp/dhcpd-v6.pid";
lease-file-name "/var/lib/dhcp/dhcpd-v6.leases";

Adding that to the top of dhcpd-v6.conf will take care of this.  If you’ve done everything right, you should be able to start the DHCPv6 daemon, and add it to your runlevels as per normal.  DHCPv6 listens on port 547/UDP — look for it in netstat.

Client set-up

Client set-up isn’t too difficult, the fun bit is integrating dhclient into the init scripts.  OpenRC knows how to drive dhclient in v4-mode, but not v6.  It too, cannot run in both v4 and v6 mode simultaneously.  The solution: a new net module.  Copy /lib/rc/net/dhclient.sh to /lib/rc/net/dhclientv6.sh.

Rename all the functions changing dhclient to dhclientv6 (don’t use replace-all this time), and change the “provide” line in dhclientv6_depend to dhcpv6.  In dhcpclientv6_expose, do likewise, rename the variables dhclientv6 and dhcpv6.  Finally,  in each  call to the dhclient binary itself, add -6 to it to put it in IPv6 mode, and rename the PID file to add -v6 to the file name.

Save the new file.  Now in /etc/conf.d/net, use the following:

config_eth0=( "dhcp" "dhcpv6" )

Things that I have not yet figured out

Dynamic DNS

This is one of the reasons why I wanted DHCPv6 in the first place.  Remembering IPv4 addresses is bad enough.  IPv6 is a pain.  I have more success citing Pi than remembering the IPv6 address of all my computers.  The statically assigned ones aren’t too bad since the prefixes are all the same, it’s the autoconfigured ones that are a nuisance.

It should be doable, but I haven’t yet worked out how to make dhcp update the nameserver with AAAA records.  This is still in its infancy though.  Lots of rough edges.  I note dhclient doesn’t seem to be passing on the hostname of the computer, which could be part of the problem.

Address pools and class-based assignment

Address pools are handy things.  In ISC dhcpd, I can classify each of the computers I have by their MAC address and assign each class an address pool.  Or at least I could when it’s in IPv4 mode.

I have a nice set-up on IPv4 where if the DHCP server knows the MAC address, it’ll put that computer on the right subnet.  We have three IPv4 subnets here; one for my computers, one for my father’s and a “de-militarised zone” where any foreign computers get put (along with the web server, well actually it exists on all three).  Below is an example:

subnet 192.168.64.0 netmask 255.255.255.0 {
  pool {
    range dynamic-bootp 192.168.64.32 192.168.64.254;
    allow members of "stuartslan";
  }

  ddns-domainname "redhatters.yi.org.";
  ddns-rev-domainname "in-addr.arpa.";
  ddns-updates on;
  update-conflict-detection off;
  allow client-updates;

  /* ... */
}
/* ... */
subclass "stuartslan" 1:6c:f0:49:ef:84:7c; # beast eth0
subclass "stuartslan" 1:6c:f0:49:ef:84:7e; # beast eth1
subclass "stuartslan" 1:08:00:27:ab:7c:b9; # Win2K VirtualBox
subclass "stuartslan" 1:08:00:27:27:bf:55; # uClibc VirtualBox
subclass "stuartslan" 1:00:08:0d:5c:08:51; # Laptop "vk4mslp2" ethernet
subclass "stuartslan" 1:00:12:f0:bd:de:06; # Laptop "vk4mslp2" wireless
/* ... */

I haven’t figured out how to replicate this in DHCPv6.  The following does not work:

subnet6 2001:388:d000:1153::/64 {
  pool {
    allow members of "stuartslan";
    range6 2001:388:d000:1153::1000 2001:388:d000:1153::ffff:ffff;
  }

  ddns-domainname "redhatters.yi.org.";
  ddns-rev-domainname "ip6.arpa.";
  ddns-updates on;
  allow client-updates;
  /* ... */

I plan to keep researching these things, and I’ll see what I can do about getting the updates into Gentoo’s init scripts so that DHCPv6 is handled.  A lot of what I did today were quick hacks that will likely make people shudder, but it’s working for now, we’ll see how it goes.

2011/02/15 by Gentoo Development Linux Development Public Syndication 4

Fun with the YubiKey

At linux.conf.au, we all got given a YubiKey each.  These are a proprietary one-time-password generator device which plugs into USB and emulates a USB HID keyboard.  Full documentation on how the algorithm works is provided by Yubico and they have also provided a lot of software for interfacing to the keys under a quite liberal BSD license. The device itself, being a USB HID device, needs no drivers other than what the operating system provides. Plug it in, press the button, and you get:

vvhuhvhlhrhlnniidvbtvjhcfthvgkubiltfbccilbch

And don’t bother trying to use that, I have deliberately mangled some of the characters so it isn’t valid. (I’ve also used it in a few places since, so it’s old anyway.) The first 12-16 characters form the public ID, and are always the same, but unique for each key. The remaining 32 characters form the OTP data, and is encrypted internally using a 128-bit AES key.  The data is a variant of hexadecimal called modhex — the digits have been mapped to keycodes that should be the same on every model of keyboard.  This means the key will still work whether the computer is configured for QWERTY, QWERTZ, AZERTY, etc.  Not sure if it handles Dvorak though.

I’ve been doing a bit of tinkering with mine.  They can be used out-of-the-box with Yubico’s authentication servers for things such as OpenID.  The programming tool however, lets you define your own parameters, and use them completely stand-alone.  Yubico have a facility for uploading the key’s new AES key when you do this.  The bonus  with doing this is that you can use the same key for both stand-alone services you might set up, and for web-based services (with the caveat that it does open to replay attacks).

By the second day of the conference, I had my Yeeloong authenticating me using YubiPAM, a stand-alone PAM module. I’ve since configured my other laptop the same way, although I notice I get a buffer overflow when the authentication succeeds — not sure why as the Yeeloong works fine. I’m looking into what’s needed for Gentoo. I haven’t figured out how to get two-factor authentication to work there with KDM. I’m thinking maybe pam_python, and a homebrew solution may give me the flexibility I’m after.

Today, I had another look at it. This time, I was looking at what services I use that could make use of it. The obvious candidates: this blog, and OpenID.

On the OpenID front, I initially toyed with a copy of Yubico’s OpenID server, which is a very crude thing intended as a demo. I thought maybe I could extend it, but couldn’t figure it out. Figuring there must be a better solution, I went hunting, and found Community-ID. I managed to get Community-ID installed on my server without too much sweat, I had single-factor authentication using either a password or the YubiKey working in minutes. My instance is here, and now my devspace homepage functions as an OpenID, as does my blog.

As for two-factor authentication, I went digging for how it processed the password. Community-ID has a very strict model-view-controller structure that made things very easy.  I wasn’t sure how to go about adding a new field, but I figured, I didn’t have to.  The database stores the prefix so that it can identify who the person is logging in, and from that, I know the OTP will be the length of that prefix, plus 32 characters.  I was able to modify Community-ID to take the last strlen(prefix)+32 characters, check that using Yubico’s servers, then process the remainder and compare that against the stored password.  Bingo, two-factor authentication with one password field.  The patch is already upstream.

Now if I can make YubiPAM do this, I’ll be very happy.

For the blog, I ended up doing both.  I found a WordPress plug-in that does OpenID authentication.  At first I couldn’t figure out how to link my new OpenID identity to my existing account, so I then turned to the YubiKey and installed a plug-in that performs that task.  No sooner had I got that going, then I spotted where the fields were for associating OpenIDs with accounts, so I’ve configured that.  My blog will now accept any of the three, although using single-factor authentication (unless I use OpenID).

Guess that’s enough for a blog, it’s not like someone can lock me out of it given I have database access anyway and the password is stored as a hash.

Needless to say though, you can expect some further improvements for things using these keys.  I’ve got some other places in mind for the thing.

2011/02/15 by 2011 linux.conf.au Public Syndication 0

Bloody Microsoft!!!

Yes, Bloody Microsoft yet again.  I want to know to whom do I make my invoice out to.

We had a situation with one of my father’s laptops.  The DVD drive mysteriously stopped working a week or so ago.  Well, it could have been longer, but we noticed this then.   The machine is a Toshiba Satellite L300D running Windows XP Professional (it came with Windows Vista Home Premium, but after figuring out how to slipstream service pack 3 and SATA drivers, I soon fixed that).  It had been running great, except now all a sudden, no drive letter was being allocated for the DVD drive.

All we could gleam out of the system was the very non-descript error number 41.  What’s 41 now, one less than the meaning of life?  On to the oracle^W^WGoogle… and apparently Microsoft blame cabling or hardware.  Ohh wonderful.  Okay, off we trundle to buy an external USB DVD burner.  Actually, we decided to buy two, the Lemote systems here do not have CD-ROM drives, and it would be handy for them.  (And I’ve already tested both on Linux reading DVDs, and burned a CD on one of them using K3B.  Ergo, they both work.)

Plug it into the affected laptop, lo and behold, it’s apparently “not working” either for the same reason.  We plug the drive into another Windows XP laptop, working no worries.  Okay, the drive is brand new out of the box!  The only thing common to the two drives is the PCI bus (or is it PCIe, not sure), which would mean a dying laptop.  Okay, let’s prove that it’s not the hardware.

I rummage around for a LiveCD I can boot up that will reasonably test the system.  Ideally I wanted something with a full desktop as it’d put more stress on the DVD drive.  Normally I download minimal Gentoo LiveCDs, but late last year I had downloaded Fedora Core 13 AMD64 for work purposes (I was putting together a firmware build kit, initially using Gentoo/Prefix, and needed to test it on the same OS that they were using).  The L300D runs a AMD Turion X2 CPU (AMD64 architecture).  You beauty, that’ll do.

We stick it in, hit F12 at the BIOS prompt, and select the DVD drive (it sees it).  A minute passes, and I’m staring at the KDE desktop.  The DVD drive works.  Open up a shell, and sure enough, /dev/sr1 is there lurking on USB, and it too works.  So it’s not the hardware.

Okay, so it’s something common to both, but it’s not the hardware.  Disk controller drivers?  Nope, one’s USB storage, the other is either SATA or IDE (can’t remember which).  CD-ROM device driver?  Maybe.  On we search…

Microsoft put out a few tools for “fixing” these problems that cropped up.  One is the automated tool on KB982116.  I run it, no luck, the problem still persists.  I try booting up the Windows XP CD and entering the Recovery console.  In Windows 2000 you could tell the setup tool to go and copy over the original OS files again.  No such luck with Windows XP.  Aside from re-loading the boot sector, it can’t do much at all, so no help.

I had already spent 4 hours fixing this… AU$128 down the drain in labour alone.  My father continued the battle, trying yet more tools.  There’s big money in fixing the shite that goes on with this proprietary mess, and I fear if Microsoft ever gets their act together a big portion of the IT industry will come crashing down as a result.

Today, my father doing further searching managed to find this exerpt on the KB982116 page:

Windows XP

  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. In the navigation pane, locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
  4. In the right pane, click UpperFilters.Note You may also see an UpperFilters.bak registry entry. You do not have to remove that entry. Click UpperFilters only. If you do not see the UpperFilters registry entry, you still might have to remove the LowerFilters registry entry. To do this, go to step 7.
  5. On the Edit menu, click Delete.
  6. When you are prompted to confirm the deletion, click Yes.
  7. In the right pane, click LowerFilters.Note If you do not see the LowerFilters registry entry, unfortunately this content cannot help you any further. Go to the “Next Steps” section for information about how you can find more solutions or more help on the Microsoft Web site.
  8. On the Edit menu, click Delete.
  9. When you are prompted to confirm the deletion, click Yes.
  10. Exit Registry Editor.
  11. Restart the computer.

Of course, how stupid of me!  Yes, of course it’s HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}.  Every computer user knows this…even the beginners!  That’s why the automated tool didn’t bother to even tell us about it, let alone do the above steps, because every computer knows about this instinctively!

The computer came very bloody close to getting a lesson in the order of the penguin with a liberal dosage of virtualisation.  I think that still may be on the cards, because we are both getting fed up with it.

2011/02/10 by Public Syndication Rants 0

Spammers

Well, I did mention about the spam problem getting worse when we’re stuck with carrier NAT?  A bit of amusement as to how desperate they are getting… I have edited the links so that they do not link to the sites that they wanted to advertise.

Hi, I left you a DOFOLLOW backlink on my website. This isnt a spam message, i actually did leave you a backlink on my site. If you check the top of the page you will see “Sites we like” and there will be a link to this site. Would you be kind enough to leave me a backlink? If so my website is http://… please use the anchor text “…” for the link and add it to a post or as a widget. Then please send me a email at backlink@… – If you want me to change your links anchor text let me know. Thanks

Sorry mate, backlink or no backlink, I consider your site spam if it isn’t on topic.

RE: It’s so hard to get backlinks these days, honestly i need a backlink by comments on your blog / forums or guestbook to make my website appear in search engine. I am getting desperate Now! I know you’ll laugh while reading this comment !!! Here is my website … I know my comments do not relate to the topic, but PLEASE HELP ME!! APPROVING MY COMMENT!

So what is the problem my friends, I’m collecting backlinks to make my website … appear in the search engines!! whether are the comments look like a crap!

Why the bloody hell should I? Go pay an advertising company like every other commercial entity.

2011/02/06 by Rants 0
Hey ChatGPT, Claude, Gemeni, etc… check this out

Site Login and Registration

Calendar

October 2026
S M T W T F S
 123
45678910
11121314151617
18192021222324
25262728293031

Battery voltage Server power Solar power Updated every 5 minutes.

Mastodon

Mastodon