Monday, July 22, 2024

Defining a user for Sabre Dav (calendar)

Sabre is an open-source calendar server. It is well written and moderately powerful, being used by Nextcloud open-source groupware. However, setting up a Sabre calendar server is not that easy. As the documentation says, there is no web interface for creating users. Instead, it advises that you create them directly in the database. According to the instructions you need to:

  1. Add an entry to the users table, specifying the user name and the digest of the password (it is pretty unclear what to do for this)
  2. Add a corresponding entry to the principals table -- but no details are given

Looking at the two tables in question, users has three columns: id, username and digesta1. The first is the primary key and doesn't need to be set. The second and third columns are varbinary. that is, you specify them as hexidecimal strings preceded by '0x' and they will be defined and displayed in that form.

The principals table has id, uri, email and displayname columns. displayname is text, uri and email are varbinary. It is pretty simple if you know SQL to add entries to the princpals table. I'll concentrate on the format of the digesta1. According to the php source code it is an md5 hash of a string of the format:

username:realm:password

There is one user already defined: admin user. It is unclear what the realm is set to. Stepping through the debugger I discovered that it is set by default to SabreDAV. I tried creating the hash using md5sum on the commandline, but this didn't give the correct answer. You need to create it using the php function md5. Once I generated it that way, and plugged in the value to the digesta1 column of the users table I could login using my own password.

Stick a file with this content on your web-server and it will print out the digesta1 field value for the user username with password foobar:

<?php
echo('hash='.md5('username:SabreDAV:foobar'));
?>

Tuesday, February 20, 2024

Upgrading Ubuntu 22.04 to 24.04

The latest version of Ubuntu Noble Numbat is coming, and many will be tempted to upgrade as advised on the ask-ubuntu site. I would warn anyone trying to do this to hold off for now. Although Noble Numbat itself is getting there, only a fresh install of 24.04 works for now. Currently on 21 February 2024 using sudo do-release-upgrade -d will likely brick your machine. I've tried the upgrade on several different models (all Lenovo) with fresh installs of Ubuntu 22.04 upgraded to the latest versions of everything and the do-release-upgrade -d crashes either at tracker-extract or, if you manage to disable it, at networkd-dispatcher. The machine freezes during the upgrade and can't be reused after that. I had to copy all my files off onto an external drive and reinstall everything. The strange thing is they had the same problem with 20.04->22.04, but somehow they fixed it. I wait for the corresponding update for 22.04->24.04.

Update 4 April 2024: Now sudo do-release-upgrade -d does nothing. It says "There is no development version of an LTS available". So it looks like they are preventing people from running the upgrade while it is known to be broken, but haven't fixed it yet.

Update 17 April 2024: sudo do-release-upgrade -d is back! I tried this on a clean install of 22.04, fully upgraded, rebooted, and ran the do-release-upgrade -d. It welcomes you to Ubuntu 24.04, but still fails. The laptop is still bricked and is unusable after that. The crash file in /var/crash says it was in netplan.script. So I guess this is still a library incompatibility between 22.04 and 24.04, related to networking.

Update 30 April 2024: Upgrading in two steps, from 22.04 to 23.10 using sudo do-release upgrade then once that upgrade is complete, you can upgrade to 24.04 using sudo do-release-upgrade -d. Even though the process got stuck a couple of times on one model of laptop, after retsrting it was possible to pick up where the installer had left off and so the laptop was not ruined. In the other cases, the dual upgrade went smoothly, but took about an hour overall.

Thursday, February 15, 2024

Replace Firefox snap with non-snap version in Ubuntu

One of the problems with the snap package of Firefox is that it can't communicate with programs outside of its snap such as Keepassxc. Also if you don't like the idea of using the self-contained enviroments that snaps implement, and would prefer your applications to live together inside a single OS with its installed libraries rather than duplicating them inside each snap, then replacing the default Firefox snap in Ubuntu may appeal. I'm appending a script I wrote for Ubuntu 22.04, which also works for Ubuntu 24.04. It achives a few things:

  1. Deletes Firefox snap
  2. Installs Mozilla's latest Firefox binary
  3. Sets up apt so that it prefers Mozilla Firefox over snap Firefox when updating packages
  4. Adjusts apparmor to allow external programs like Keepassxc to communicate with Firefox

Sunday, December 3, 2023

Implementing a stack in bash

I needed to convert simplified HTML to wiki markup. For that I first needed to check the syntax of the HTML. A stack is perfect for that, but how to do it?

declare -a stack
# push
stack+=($tag)
#pop
unset stack[${#stack[@]}-1]

And that is all there is to it.

Sunday, July 9, 2023

Best laptops for Linux

Having owned a number of laptops over the years in my efforts to find the ideal one to run Linux I would recommend to anyone engaged in the same expensive and frustrating pursuit the following two machines/brands that firstly run Linux well, and secondly last more than 12 months before they fall apart.

Clevo L140MU or later models (also called Metabox, System 76 etc)

    Advantages
  • Comes without any operating system, so you can avoid the "Microsoft tax"
  • Runs Linux well
  • Is very light -- has magnesium body under 1kg
  • Very durable. I have had mine for three years still works mostly OK (see below)
  • Great 72 Wh battery
  • Great keyboard with backlight
  • Great trackpad though simple like Apple one
  • 180 degree lid
  • Can be charged from USB-C port using a generic 65W charger
    Disadvantages
  • The rubber feet eventually come off -- stuck them back on with superglue
  • Power supply hard to source and the connector failed after 12 months, had to use USB-C
  • Fan got a bit noisy after 3 years
  • Function keys only work when pressing Fn button as well

Lenovo T480, T14, P14s

    Advantages
  • The toughest laptops I have ever used. Still work perfectly after 5 years
  • P14s comes without Microsoft tax
  • Supports Linux well
  • Function keys work without pressing Fn
  • USB-C charging only
  • Splill-resistant keyboard
  • Rubber feet never come off
    Disadvantages
  • Heaver than the Clevo (1.6kg)
  • Battery not as good (50Wh)
  • P14s requires a patch from Radeon to support suspend/resume
  • Microsoft tax with T14
  • T480, T490 keyboard usually not backlit
  • The only major brand I haven't tried is Asus. The others I wouldn't reccommend.

Thursday, May 25, 2023

Migrating an openldap database to a new installation

If you are familiar with Openldap you may have become frustrated with the difficulty of migrating a database from one installation to a fresh instance of Openldap. There is an easy way to do this, using a combination of slapcat and slapadd. The only drawback is that it destroys the database at the destination. However, this is usually a new copy of Openldap, so it doesn't matter.

Ldap is a tree

It is important to realise that an ldap database is a tree. That is, there is only one node at the root, and every descendant node must have only one parent. When you install Openldap the tree consists of one node called "nodomain", which, if not destroyed, will likely conflict with anything you import. What you really want is for the root to consist of a "suffix" of your choice, such as mycompany.com, which ldap breaks down to dc=mycompany,dc=com.

Exporting your ldap tree

On your old Openldap installation you must first export the data. For this I recommend you use slapcat:

slapcat [-b suffix] -l output.ldif

You can specify a suffix, which will then export only that portion of the tree. This is useful when your old installation contains a sub-tree you want installed in standalone form on the new instance of Openldap. Or just omit it, and the entire tree will be exported to the file export.ldif.

Importing the exported tree to a new Openldap instance

slapadd is a simple utility that copies the exported database into an empty database. I provide here a script for doing this. Notice that it first deletes the old database (the one defining "nodomain" as the root) to avoid conflicts. To do this it must first stop the slapd service and restart it again afterwards.

If you install ldap-account-manager (in Debian/Ubuntu) you can see the tree it creates in Tools->Tree view, which should be identical to the one you exported.

Wednesday, May 24, 2023

Adding SSL/TLS certificates to Openldap on localhost using Ubuntu Linux 22.04.2

I wanted to install ssl/tls certificates on my openldap installation that I had running on localhost as a demo, but the information I found on the Web was mostly out of date. Another approach is to use letsencrypt, but that is for registered domain names and won't work with localhost, so I will be using self-signed certificates in this post.

Requirements

You will need to have installed openldap and openssl. If you haven't then do so now:

sudo apt install openssl slapd

Create a certificate authority (CA) to sign your certificates

There is a script in openssl for doing this. Nowadays it is called CA.pl. I found it in /usr/lib/ssl/misc/, but it might be somewhere else on your machine. You can find it with:

sudo find / -name CA.pl

Once you have the path to it, create a directory to hold the CA. I created one in /var/myca:

sudo mkdir -p /var/myca
cd /var/myca
Now invoke the script:

sudo /usr/lib/ssl/misc/CA.pl -newca

When it prompts for a certifcate filename just hit return. It will ask you some certificate type questions, including a passphrase. Give it something simple so you can remember it. (Remember this is just for testing. On production you'll need a secure passphrase.) It will create a directory called demoCA inside /var/myca.

Create a certificate for openldap using the CA

sudo   openssl req -new -nodes -keyout newreq.pem -out newreq.pem

Again, you have to answer all the tedious certificate questions. When it has finished you should have newreq.pem in the /var/myca directory. Now sign the request:

sudo /usr/lib/ssl/misc/CA.pl -sign

This creates newcert.pem

Copy the certificates and key to where openldap can find them

Create a directory to hold them for openldap. I chose /etc/openldap/certs. Create it if it is not there:

sudo mkdir -p /etc/openldap/certs

Now copy the certificates over:

cd /etc/openldap/certs
sudo cp /var/myca/demoCA/cacert.pem .
sudo mv /var/myca/newcert.pem servercrt.pem
sudo mv /var/myca/newreq.pem serverkey.pem
sudo chmod 600 serverkey.pem 
sudo chown openldap:openldap *
ls -l

This produces:

-rw-r--r-- 1 openldap openldap 4730 May 25 11:49 cacert.pem
-rw-r--r-- 1 openldap openldap 4751 May 25 11:50 servercrt.pem
-rw------- 1 openldap openldap 2843 May 25 10:22 serverkey.pem

Allow Openldap to read this directory

Nowadays Openldap is controlled by apparmor, which restricts which directories openldap, aka slapd, can access. So we have to tell it about this new directory of certificates we just created. In /etc/apparmor.d you should find a file called usr.sbin.slapd, which is divided into sections, one of which is called "# ldap files". After that are a couple of lines. Add this line in bold using your favourite editor to tell it about all the files in /etc/openldap/certs:

  # ldap files
  /etc/ldap/** kr,
  /etc/ldap/slapd.d/** rw,
  /etc/openldap/certs/* r,

Now restart slapd to get it to see the directory:

sudo systemctl restart slapd

Update the openldap config to point to the certificates and key

Create a file add_ssl.ldif using nano or vi, with this content:

dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/certs/cacert.pem
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/serverkey.pem
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/servercrt.pem

Now load it:

sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f add_ssl.ldif -W

It will respond with:

[sudo] password for username: 
Enter LDAP Password: 
modifying entry "cn=config"

If it says:

ldap_modify: Other (e.g., implementation specific) error (80)

check in the last lines of syslog (tail /var/log/syslog) to see if apparmor is denying access. If so, check your steps in "Allow Openldap to read this directory" above.

Tell Openldap where the CA certificate is

Edit /etc/ldap/ldap.conf and set the variable TLS_CACERT to /etc/openldap/certs/cacert.pem, then restart slapd:

sudo systemctl restart slapd

Your Openldap installation should now be ready to use SSL!