The EdgeRouter X-SFP is a quite powerful dualcore (880Mhz, 256MB RAM, 256MB flash) device powered by a MediaTek MT7621AT SoC. OpenWrt 21 (snapshot) comes with support for the SFP slot (attached to the switch port eth5 via RGMII). Note: it won’t work with OpenWrt 19! Custom build# As of April 2021 it requires a custom […]
With the release of the new AMD EPYC based cloud servers (CPX), Hetzner has applied some changes to their virtualization platform (QEMU). The network interface names have changed due to the modern virtio_net network adapter 0x1041 including different pcie bus addresses. All Hetzner standard images are now using the net.ifnames=0 setting to enforce the kernel […]
gnugp is very useful to encrypt files using a public key – this allows you to create backups without sharing a keyfile. But it’s a bit tricky to explicitly use a public-keyfile instead of the global keyring via fingerprint. Directory Structure# This script creates a custom .gnupg directory (gpg home) in the current working directory […]
In case you’re using self-signed x509 certificates you may see this error message within the traefik logs – the solution is quite easy: the first certificate of your combined pem file (ca+intermediate+server) has to be the server certificate!
These days, some cloud hosting environments still didn’t offer dhcp6 services (for example Hetzner Cloud) – therefore it’s impossible to use an automated ipv6 configuration with iPXE. But a static configuration can still be used: File: config.ipxe#
PS1 magic# The default prompt of BusyBox ash shell looks a bit old fashioned . But thanks to nearly full support of the PS1 environment variable you can customize the prompt to match your needs. Customizing the PS1 variable is quite simple: just add /etc/profile which is read automatically by ash when it’s used as […]
The HPE Microserver GEN10 is an impressive piece of rock-solid hardware. Of course… ILO is missing compared to GEN8 but for most use-cases thats not a real issue.
Debian buster runs nearly out-of-the-box using the netinstall image via USB Stick or network boot. The following tweaks are required to run it flawlessly:
The firmware package firmware-linux-nonfree is required for the AMD APU. Adding “nomodeset” to kernel command line may also work as mentioned on debian.org
You may notice a iommu error on boot: the iommu is disabled by default – to enable it add the following parameters to your grub config:
File: /etc/default/grub
GRUB_CMDLINE_LINUX="amd_iommo=on iommu=pt"
Run update-grub2 to apply the changes and reboot the system – press F2 within the boot menu and to open the BIOS/UEFI menu. The iommu has to be enabled in Chipset -> GFX Configuration -> IOMMU.
In case you didn’t run any VMs on the maschine consider to keep iommu disabled – otherwise the SATA ports (Marvell 88SE9230) on the front become unusable!
Just FYI
# cat /proc/cpuinfo processor : 0 vendor_id : AuthenticAMD cpu family : 21 model : 96 model name : AMD Opteron(tm) X3418 APU stepping : 1 microcode : 0x600611a cpu MHz : 1300.000 cache size : 1024 KB physical id : 0 siblings : 4 core id : 0 cpu cores : 2 apicid : 16 initial apicid : 0 fpu : yes fpu_exception : yes cpuid level : 13 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb bpext ptsc mwaitx cpb hw_pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 xsaveopt amd_ibpb arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic overflow_recov bugs : fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass bogomips : 3593.06 TLB size : 1536 4K pages clflush size : 64 cache_alignment : 64 address sizes : 48 bits physical, 48 bits virtual power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro acc_power [13]
# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1 798003 iterations per second for 256-bit key
PBKDF2-sha256 1126290 iterations per second for 256-bit key
PBKDF2-sha512 1038194 iterations per second for 256-bit key
PBKDF2-ripemd160 529049 iterations per second for 256-bit key
PBKDF2-whirlpool 373424 iterations per second for 256-bit key
argon2i 4 iterations, 638239 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
argon2id 4 iterations, 639177 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
# Algorithm | Key | Encryption | Decryption
aes-cbc 128b 532.4 MiB/s 1417.2 MiB/s
serpent-cbc 128b 68.2 MiB/s 231.7 MiB/s
twofish-cbc 128b 128.6 MiB/s 203.6 MiB/s
aes-cbc 256b 429.0 MiB/s 1177.7 MiB/s
serpent-cbc 256b 78.3 MiB/s 234.3 MiB/s
twofish-cbc 256b 138.3 MiB/s 204.9 MiB/s
aes-xts 256b 848.9 MiB/s 853.7 MiB/s
serpent-xts 256b 246.4 MiB/s 227.9 MiB/s
twofish-xts 256b 195.3 MiB/s 202.2 MiB/s
aes-xts 512b 760.8 MiB/s 769.9 MiB/s
serpent-xts 512b 247.6 MiB/s 227.3 MiB/s
twofish-xts 512b 193.9 MiB/s 201.1 MiB/s
Upgrading a Netgear switch can be very annoying…i’ve recently bought a second GS108Ev3 and wanted to upgrade the firmware initially but the switch stocks in bootloader mode (still web accessible on 192.168.0.239). By running the upgrade via Firefox or Chromium on Debian the firmware upload stops at ~7% with a timeout error. Same issue with tftp.
Use a Windows Machine (Win 10) + Google Chrome Browser and run the firmware upgrade procedure via web interface on 192.168.0.239 – this will even work in case the Netgear ProSAFE Configuration utility throws a timeout error. VERY WEIRD!
Overall the (first) switch performs very well over the last few years and draws very low power – a great SOHO product with VLAN capabilities (PVID/Tagged/Untagged) but the firmware needs a makeover..
Grandstream VoIP telephones are very popular because of their high build quality compared to an excellent price. In some cases you want to use an encrypted communication channel between your device and the PBX (e.g. asterisk). The current grandstream firmware includes basic OpenVPN support (client mode, tun) which allows you to tunnel the whole SIP/RTP traffic over an encrypted channel. This is also the best solution to avoid any kind of NAT/routing issues because all devices are directly accessible within the virtual ip subnet.
Use the following (minimal) configuration as template. The important options are set to work with the current grandstream firmware (1.0.4.106). Certificate based authentication is preferred for security (login/password not needed)!
tls-server dev tunX topology subnet server 172.16.1.0 255.255.255.0 port 10111 proto udp # cert based auth pkcs12 server.p12 # 1024 and 2048 bit dh params are supported dh dh2048.pem keepalive 10 120 script-security 2 # bh-cbc as well as aes-128-cbc are supported by the current firmware cipher aes-256-cbc # well sha1 is a bit weak but its set within grandstream firmware auth sha1 # compression has to be enabled comp-lzo tun-mtu 1500 mtu-disc yes # custom logging verb 3 # retain TOS flags (VoIP) passtos # internal network (VOIP Server) push "route 10.16.0.1 255.255.255.0"
In case your projects make use of external databases like MySQL/MariaDB you need to setup your continuous integration tests with dedicated testcases including application specific database structures. This requires some initial steps to load the database dump before starting the tests. Thanks to travisci.org you do’t need to do this kind of stuff within your application – just use the test configuration!
First of all, we add MySQL Server as service within our .travis.yml file. This initializes a dedicated database instance for testing. Additionally we hook into the before_install action to initialize our database structure. In this example all SQL commands are loaded from an external file located in our test directory.
language: node_js node_js: - "7" - "7.6" - "8" services: - mysql before_install: - mysql -u root --password="" < test/travis.sql
Our Test Database structure is definied within a dedicated SQL file in test/travis.sql. It contains all necessary commands to add a new user, create demo database, create demo tables and finally add some test-data.
# Create Testuser CREATE USER 'dev'@'localhost' IDENTIFIED BY 'dev'; GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP ON *.* TO 'dev'@'localhost'; # Create DB CREATE DATABASE IF NOT EXISTS `demo` DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci; USE `demo`; # Create Table CREATE TABLE IF NOT EXISTS `users` ( `user_id` int(11) NOT NULL, `created_on` timestamp NULL DEFAULT NULL, `modified_on` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, `username` varchar(50) DEFAULT NULL, `salt` varchar(20) DEFAULT NULL, `password` varchar(50) DEFAULT NULL, `email` varchar(150) DEFAULT NULL, `firstname` varchar(50) DEFAULT NULL, `lastname` varchar(50) DEFAULT NULL, `dob` date DEFAULT NULL ) ENGINE=InnoDB DEFAULT CHARSET=utf8; ALTER TABLE `users` ADD PRIMARY KEY (`user_id`); ALTER TABLE `users` MODIFY `user_id` int(11) NOT NULL AUTO_INCREMENT; # Add Data