System Administration on The Lone C++ Coder's Blog

If you get this error from Time Machine on Samba, check available disk space

Timo Geusch — Sun, 07 Jul 2024 20:31:00 -0500

I’ve been using Samba with the time machine setting for years to back up the couple of Macs I own. I’ve recently been running into issues with Time Machine backups erroring out with "The network backup disk does not support the required capabilities". Poking around the Internet didn’t really point at an obvious culprit until I found some mumblings about this potentially begin a disk space issue.

Bingo!

While the Samba server had more than enough disk space left, I had set the maximum Time Machine volume size to 3.5TB using the setting fruit:time machine max size = 3.5T. Bumping this up to 4.5T magically made Time Maching backups work immediatly.

Don't forget to set the home directory for Emacs on Windows

Timo Geusch — Sun, 05 Nov 2023 11:03:00 -0500

I’m currently rebuilding my main Windows machine after it had become close to unusable. Given that I upgraded it multiple times from Windows 7 all the way to Windows 11 without ever reinstalling the OS, this shouldn’t have come as a major surprise. Either way, this is the reason for the sudden outburst of Windows related posts so I can go and refer to my blog as my Internet Notes repository.

How to install WSL on Windows 11 without a default distribution

Timo Geusch — Sat, 04 Nov 2023 14:03:00 -0500

On my Windows machine, I’ve mostly moved from using separate virtual machine products like Hyper-V or Virtualbox to have access to a Linux machine to using WSL. The PC is dual-boot with a separate Linux install anyway, but sometimes I just want to quickly fire up a Linux machine, take care of a couple of quick tasks and go back to Windows.

WSL installs Ubuntu by default, but I tend to want a different distribution like OpenSUSE, Fedora etc. To not end up with a “spare” Ubuntu install, you can eitehr install WSL on a fresh Windows install without specifying a distributuion using wsl --install --no-distribution or by installing a different distribution immediately using wsl --install -d <distro name>.

Migrating source code from RCS to Mercurial

Timo Geusch — Sat, 12 Mar 2022 19:47:03 -0500

Version control system migrations are a fact of life for developers in any longer lived codebase. In fact, I’ve had a hand in quite a few migrations as newer, more workable version control systems became available. Also, like a lot of developers, I’ve got fragments of source code dating back quite some years floating around on various servers and development machines of mine. Not necessarily code that is still being used, but still code that I don’t want to just delete forever. Some of the oldest code I have uses RCS for source control and hasn’t been touched for a long, long time. As my machines generally don’t have anything as old as RCS installed for version control, I decided this might be a good time to migrate the code to my version control system of choice, Mercurial.

Another quick Isso setup tweak

Timo Geusch — Thu, 17 Feb 2022 17:19:54 -0500

While I was implementing a few more changes on my web server - mostly adding the sorely needed blacklistd configuration for sshd - I noticed that NGINX’s log was showing occasional errors when trying to contact the Isso process. They all had one thing in common, namely that they were all trying to contact ISSO via IPV6 as the server has both stacks enabled. Turns out that isso only listens on an IPV4 socket and I could not find an obvious way to get it to listen on both.

Using Elliptical curve cryptography for TLS with Postfix, Dovecot and nginx

Timo Geusch — Sat, 08 Jan 2022 17:42:08 -0500

I may have mentioned this before - I do run my own virtual servers for important services (basically email and my web presence). I do this mostly for historic reasons and also because I’m not a huge fan of using centralised services for all of the above. The downside is that you pretty much have to learn at least about basic security. Over the 20+ years I’ve been doing this, the Internet hasn’t exactly become a less hostile place. Anyway, Elliptic Curve Certificates, what about them?

Unborking my ISSO comments system and making it more resilient

Timo Geusch — Sat, 27 Nov 2021 16:00:00 -0500

First, I apologise for not noticing that the comments had been broken for a while. This was entirely my fault and not fault of ISSO, which I’m still super happy with as a self-hosted comments system. So in this post I’m going to describe what went wrong, and also how I made the system a little more resilient at the same time.

First, what did go wrong?

My web server is using FreeBSD as its OS, with a bunch of software installed via FreeBSD’s ports system. For those not that familiar with FreeBSD’s ports, the system essentially acts like a rolling distribution. As a result, you sometimes have to upgrade tools, especially languages like Perl, Ruby, and in this case, Python. A little while ago, the default Python version on FreeBSD was upgraded from Python 3.7 to Python 3.8, and I eventually followed along with that upgrade. ISSO is run out of a virtualenv as a regular user and the virtualenv was still using Python 3.7, but I decided I didn’t want to keep multiple Python versions on this machine. So, I upgraded the version in the virtualenv to 3.8 as well. So far, so good, especially as ISSO seemed to restart without issue.

Upgrading my OpenBSD WireGuard server to in-kernel WireGuard

Timo Geusch — Sun, 31 Oct 2021 19:00:00 -0500

I’ve blogged about putting together a WireGuard server using OpenBSD a couple of years back. The main purpose of the server was to ensure a slightly more secure connection when I was on hotel WiFi. Of course thanks to the pandemic, I have barely travelled in the past couple of years so the server was mostly dormant. In fact, I kept VM turned off for most of the time. The VPN server was set up on OpenBSD 6.6, which was the last release that supported user mode WireGuard and didn’t have an in-kernel implementation. It was finally time to change that as part of an upgrade to OpenBSD 7.0.

Turning this particular server into a bit less of a pet

Timo Geusch — Mon, 05 Jul 2021 22:30:00 -0500

I’m in the middle of a server redo - right now, I’m setting up a replacement server for my trusty Dell T30, plus it was time to give this web server a new home. When I started the migration from my old WordPress site to the new static site, the static site was running on a small 1 core / 1GB RAM cloud server at Vultr. That had enough oomph for testing and for the last couple of months. That said, this machine is running FreeBSD with ZFS on root, and ZFS likes to have a lot of RAM. Why ZFS on root? Because it allows me to use boot environments. I’ve started using them on my other servers - especially the aforementioned home server - and decided that all my other servers also need them right now as it makes upgrading the OS a lot safer.

Setting up rdiff-backup on FreeBSD 12.1

Timo Geusch — Wed, 20 May 2020 20:31:00 +0000

Update 2021-12-18: It looks like the rdiff-backup port has been removed from the FreeBSD ports tree, so installing it via the port is definitely not an option anymore. Also, the method described below works on FreeBSD 13.0 as well.

My main PC workstation (as opposed to my Mac Pro) is a dual-boot Windows and Linux machine. While backing up the Windows portion is relatively easy via some cheap-ish commercial backup software, I ended up backing up my Linux home directories only very occasionally. Clearly, Something Had To Be Done (tm).

I had a look around for Linux backup software. I was familiar with was Timeshift, but at least the Manjaro port can’t back up to a remote machine and was useless as a result. I eventually settled on rdiff-backup as it seemed to be simple, has been around for a while and also looks very cron-friendly. So far, so good.

Building an OpenBSD WireGuard VPN server part 3 - Unbound DNS filtering

Timo Geusch — Mon, 10 Feb 2020 05:20:46 +0000

In part 2, I reconfigured my WireGuard VPN to use an Unbound DNS server on the VPN server rather than rely on a third party server I had used for the original quick and dirty configuration. It was important for me to set up a validating DNS server, which I did in that part.

In this part, I’m extending the existing configuration to include some basic block lists for known ad and tracking servers. As I’m mainly trying to use the VPN while on the road, I want to ensure that anything I end up doing using the VPN is as secure as I can make it with reasonable effort. That makes tracking and preventing malicious ads the next step. That said, I’m not planning to go for a full Pi-Hole like setup. Initially, I am trying to do is integrate one known good blocklists into the Unbound configuration and automate the process. I can get fancy with a more Pi-Hole like setup later if I want to.

Building an OpenBSD WireGuard VPN server part 2 - Unbound DNS setup

Timo Geusch — Thu, 16 Jan 2020 04:09:36 +0000

In the first part, I described how I set up the basic OpenBSD WireGuard VPN server. I also hinted that I wanted to set up my own validating, filtering DNS server. With a little bit of spare time during the holidays I decided now was a good time as any.

Making sure the VPN server uses the local Unbound DNS resolver first

Before I set up Unbound itself, I need to make sure that the VPN server’s resolv.conf points at its local DNS server first.

Building an OpenBSD Wireguard server

Timo Geusch — Fri, 27 Dec 2019 06:05:00 +0000

In my previous post, I mentioned that I somehow ended up with a corrupted filesystem on the WireGuard server I had set up earlier this year. That iteration of my VPN server was built on Linux as I expected I would get better performance using the kernel-based WireGuard implementation. It had taken me a while to set it up right, and I didn’t get the impression that the performance was so much better anyway. Keep in mind that I mostly use my VPN server from hotel WiFi and we all know how “good” that tends to be performance wise.

While I’ve done a fair bit of Linux admin work, I didn’t fancy re-doing the whole setup again. I also hadn’t scripted it up using Ansible or similar. I tend to prefer BSD anyway, and most of my personal servers run some flavour of BSD Unix. As I didn’t want to spend too much time securing this server, I used OpenBSD as it is a little more secure out of the box compared to FreeBSD. I also hadn’t experimented with OpenBSD for a while so I was curious to see the more recent improvements.

Looks like I get to redo my WireGuard VPN server

Timo Geusch — Wed, 27 Nov 2019 10:43:49 +0000

I’ve blogged about setting up a WireGuard VPN server earlier this year. It’s been running well since, but I needed to take care of some overdue maintenance tasks. Trying to log into the server this morning and I am greeted with “no route to host”. Eh? A quick check on my Vultr UI showed that the VPS had trouble booting. The error suggests a corrupted boot drive. Oops.

Guess what the maintenance task I was looking at was? Creating an Ansible script so I’d be able to stand up the server from scratch in case something like this happened. And yes, the irony of being the guy who regularly preaches to his clients about the need for backups doesn’t quite escape me.

Installing leiningen on Manjaro Linux

Timo Geusch — Sun, 05 May 2019 10:53:49 +0000

I like Lispy languages. One I’ve been playing with – and occasionally been using for smaller projects – is Clojure. Clojure projects usually use Leiningen for their build system. There are generally two ways to install leiningen – just download the script as per the Leiningen web site, or use the OS package manager. I usually prefer using the OS package manager, but Manjaro doesn’t include leiningen as a package in its repositories. Installing leiningen is pretty easy via the package manager and I’ll show you how.