Root Access

bwDraco

06:00

@FaheemMitha It shouldn't. The UEFI error implicates the network adapter, and only the network adapter.

@FaheemMitha Heh. I've had close to a decade's worth of Linux experience but have never really had to deal with internals all that much.

Faheem Mitha

@bwDraco Ah. Well, good to know. So if it hated the graphics card too, it would say so at that time?

djsmiley2k

@FaheemMitha hmmm

maybe

bwDraco

@FaheemMitha It wouldn't, unfortunately, but I'm sure it would have checked the graphics card first.

Faheem Mitha

@bwDraco Internals suck. And dealing with proprietary drivers is particularly problematic.

djsmiley2k

my experience of drivers generally goes 'get the proper new kernel, build it, boom'

then again I don't use debian because of how old some stuff that ships with it is :/

Faheem Mitha

06:04

@djsmiley2k This isn't a Linux drivers issue. I think that's pretty clear. And these Intel network cards are as old as dirt, anyway.

bwDraco

I've gone through the process of manually installing proprietary drivers on Linux, but at least they were binary packages that mostly automated the process.

Faheem Mitha

They've been supported by the Linux kernel forever.

djsmiley2k

k

but IS this special driver also in kernel?

I am just of the view it's likely easier to fix the software, than buy new hardware.

Faheem Mitha

@bwDraco Yes, binary packages make things much easier. I just looked at the rpm, and there is no way in hell it will work on Debian, even if I convert it to a deb file.

@djsmiley2k It's a third party driver. No, I don't think so.

@djsmiley2k Depends on the software and the hardware. Particularly the cost of the hardware.

I'm not saying I won't give it a try. It's just that I've been down that rabbit hole many times.

And this Wonderland is looking a little stale.

So, do you folks reckon this UEFI thing is a Brave New World?

I certainly like the idea of throwing the MBR and all its evil works in the trash bin.

Weird, that rpm doesn't contain any binaries. Just source and header files. But it isn't a source rpm, as far as I can see.

djsmiley2k

@FaheemMitha sure. I get it :)

@FaheemMitha UEFI has it's own.... 'quirks' lets say XD

Faheem Mitha

06:09

@djsmiley2k hmm

djsmiley2k

@FaheemMitha I found instructions for fixing it...

federicofr.wordpress.com/2011/07/01/…

but oddly now I recall seeing this issue else where before

I never dealt with it myself, but I came accross someone with it a few months ago

bwDraco

@FaheemMitha You may not know this, but these NICs have lifetime warranties. intel.com/content/www/us/en/ethernet-products/…

These cards do tend to last eons if you take good care of them.

Faheem Mitha

@djsmiley2k Yes, I actually just added that link to @bwDraco's answer a little while back.

djsmiley2k

ah ok

Faheem Mitha

@bwDraco Intel's hardware is impressive, no doubt about it.

@djsmiley2k At least, I think it's the same link.

But I'm not sure how useful it is. I haven't looked in depth.

The other thing to bear in mind when messing with hardware drivers is - how much is your time worth? That's something people tend to overlook.

These days, Linux is increasingly mainstream, so it's less and less an issue.

But once it was a real problem.

And incidentally:

aheem@orwell:/usr/local/src/iqvlinux/src/linux/driver$ make
Makefile:27: *** NALDIR variable not set.  Stop.

There doesn't seem to be much of documentation there, either.

bwDraco

06:21

@FaheemMitha mail-archive.com/[email protected]/…

It's getting very late. I'll catch up with you tomorrow.

The install script is available on the same SourceForge page you downloaded the driver package from.

Faheem Mitha

@bwDraco Thank you.

djsmiley2k

heh awesome

Faheem Mitha

And here's a comment from that sourceforge page:

djsmiley2k

batch files don't load the whole file to start with, they litterally read the next line once the previous command has finished.

I added a 'pause' statement to the end of a file, saved it, while it was running, and it did it ;D

bwDraco

What a mess, just to update firmware on a network adapter.

Faheem Mitha

06:25

This driver is cancer on Debian/Ubuntu/Mint/Whatever. They are hard coding kernel versions that they happen to use, rather than compile depending on whatever kernel build source it's being built on(the point of building from src in the first place). So this driver compile shts itself if every planet isn't aligned with one guy using redhat in a dungeon at intel. This is not the way to sell hardware, kids. Just in case you missed the point of vendor supplied drivers.

djsmiley2k

the mess is the fact the firmware was released in that state. :/

also yes.

Faheem Mitha

Probably upgrading it on Linux is not the way to go.

Linux support is always the red-headed stepchild, as the phrase goes.

djsmiley2k

well it seems the 'official' work around on windows was 'just ignore the nvm checksum' so why that option isn't in the kernel driver, I don't know :/

Faheem Mitha

@djsmiley2k The link you gave earlier seems to suggesting booting into some custom utility for flashing. That might be less painful.

bwDraco

3

Q: How to repair the checksum of the non-volatile memory (NVM) of Intel Ethernet Controller I219-V of an ASUS laptop?

I have a problem with a new ASUSPRO B8430UA laptop: its Intel Ethernet Connection I219-V does not work under Linux. In fact, I tried two different laptops of this model, and both had the same problem. The Linux driver used is e1000e, it produces the following messages during Linux (Ubuntu 16.04...

djsmiley2k

06:30

@FaheemMitha that's quite normal as far as I know for updating on board roms

Rahul2001

Morningz u funny people

djsmiley2k

@bwDraco that's the one!

The accepted answer on there lead me down a very weird rabbit hole including me reading and starting to understand some kernel coding

Morning @Rahul2001

not sure y we funny tho

Faheem Mitha

@bwDraco Surprisingly, the thing builds!

faheem@orwell:/usr/local/src/iqvlinux$ sh install
Extracting archive..OK!
make: Entering directory '/usr/local/src/iqvlinux/iqvlinux/src/linux/driver'
make -C /lib/modules/3.16.0-4-amd64/build SUBDIRS=/usr/local/src/iqvlinux/iqvlinux/src/linux/driver modules
make[1]: Entering directory '/usr/src/linux-headers-3.16.0-4-amd64'
make[1]: Entering directory `/usr/src/linux-headers-3.16.0-4-amd64'
  CC [M]  /usr/local/src/iqvlinux/iqvlinux/src/linux/driver/nalioctldrv.o
  CC [M]  /usr/local/src/iqvlinux/iqvlinux/src/linux/driver/linuxnaldriver.o

bwDraco

\o/

Faheem Mitha

Perhaps I shouldn't have sounded so surprised. :-)

bwDraco

06:34

Hmm. The only thing you need to do at this point is to copy the driver manually.

djsmiley2k

it fails on permissions

Faheem Mitha

Since I'm running it as user, it failed with copying the driver into the tree.

bwDraco

@djsmiley2k It did generate a binary. It just couldn't copy it to the installation directory.

djsmiley2k

As root

cp /usr/local/src/iqvlinux/iqvlinux/src/linux/driver/iqvlinux.ko /lib/modules/3.16.0-4-amd64/kernel/drivers/net/iqvlinux.ko

Faheem Mitha

Which I'm really not thrilled about.

djsmiley2k

06:35

Why not?

sounds legit to me

Faheem Mitha

I suppose I could trivially build a deb for it. Or not that trivial, possibly.

djsmiley2k

Maybe it should of tested for running as user.

Faheem Mitha

@djsmiley2k Just general principles.

djsmiley2k

Why do you care for a .deb?

bwDraco

Also, out-of-tree module so tainted (unsupported) kernel.

djsmiley2k

06:35

@FaheemMitha such as?

Faheem Mitha

@djsmiley2k Yes, if it was sensibly designed.

@djsmiley2k Ah. Don't mix local installs and system packages?

Nick

@Rahul2001 Good afternoon :) It's 5 minutes past noon :D

djsmiley2k

@FaheemMitha ubutnu means we live in a world now which goes 'run everything with sudo!'

so expecting root permissions is kind of normal? XD

It's not right but it seems to be normal now

Faheem Mitha

That's a standard principle, at least in the Unixy free software world.

bwDraco

It's a one-shot deal, though. You'll only need this drive once in a blue moon to update the NIC firmware.

Faheem Mitha

06:36

@djsmiley2k That way lies Virus Hell. And possibly the Zombie Apocalypse.

bwDraco

Load the module, then try flashing the firmware again.

djsmiley2k

indeed @FaheemMitha

Faheem Mitha

@bwDraco True. I could delete it afterwards.

bwDraco

If it fails, I'd just give up and get a new NIC.

djsmiley2k

^^

Or decide to not care

Faheem Mitha

06:37

Well, thanks for the help everyone. Almost lunch time.

@bwDraco Right. Again, recommendations/suggestions for a NIC?

Bob

@djsmiley2k It's perfectly right if you're installing a kernel module -_-

djsmiley2k

as Uefi, shrug

Bob

Also, I run everything as root, Much easier.

djsmiley2k

@Bob lol true

Bob

(granted, also inside containers... that's my isolation :P)

djsmiley2k

06:38

@Bob Aaaaaaaaah

yeah but partly you know what you're doing

bwDraco

@Bob Ubuntu isn't exactly designed to work this way.

Faheem Mitha

@Bob Brave New World, that has such people in it.

djsmiley2k

Partly, that's also stupid ;D

Faheem Mitha

That might be Shakespeare.

djsmiley2k

depending if you care about data.

If you're running a 1 user system, sure run everything as root

bwDraco

06:38

Now, I routinely do this on my openSUSE servers, but it's up to you to make sure you don't mess up the system.

Bob

@FaheemMitha Hey... I mean...

I run one container/VM per app.

bwDraco

Just remember that root is for administrative tasks so don't use it for day-to-day stuff.

djsmiley2k

@bwDraco You operate normally as root?

Faheem Mitha

I was close. Here's the exact quote from the Tempest:

> MIRANDA
Oh, wonder!
How many goodly creatures are there here!
How beauteous mankind is! O brave new world,
That has such people in ’t!

djsmiley2k

Don't become another @JourneymanGeek

bwDraco

06:39

I don't. It's just that most of the time, I'm only on the server for maintenance purposes.

Bob

If anything, that's better isolated than your typical 10-apps-on-one-server, where 5 share the www-data or nobody accounts

djsmiley2k

19 hours ago, by Journeyman Geek

"I accidentally my website"

Bob

@djsmiley2k He was referring to @Rahul2001

djsmiley2k

@bwDraco fair enough.

Faheem Mitha

Not really a Shakespeare fan, but it's hard to write in English and not quote him occasionally.

djsmiley2k

06:40

@Bob I know I know ;)

Avery

@djsmiley2k the whole website?!

djsmiley2k

@Avery the entire geocities!

Rahul2001

@Nick I may not be in the same timezone, you realise that?

Bob

Nick

@djsmiley2k my website is a verb refferring to the act of... idk

Rahul2001

06:41

@Avery yeah that was me

bwDraco

rofl

Bob

poof :)

Nick

@Rahul2001 IST?

@Bob which is the worst command you can run there? rm?

djsmiley2k

@Bob --no-preserve-root

Rahul2001

@Avery yeah that was me. Accidentally renamed public_html

Bob

06:42

@djsmiley2k no need, /* takes care of it

djsmiley2k

@Nick mount /backups/; rm -rf /backups/

Avery

@Rahul2001 the entire public_html?!

djsmiley2k

@Bob Oh yeah didn't see that. nice :)

Bob

bash happily expands /* into /var, /etc, etc.

Avery

also

Bob

06:42

rm -rf happily accepts those

Avery

here's the meme's source: knowyourmeme.com/memes/i-accidentally

Bob

Rahul2001

@ave yeah, and then I panicked, and then realised what had happened and renamed it back

djsmiley2k

@Avery Why is 'I accidently a shelf' not there?

Bob

djsmiley2k

06:44

@Bob but again, you're not exactly the 'normal user'

Even then, I'd advise against it :/

Bob

@djsmiley2k I wouldn't do it on a desktop, but we're talking servers here :P

I'd literally have to elevate every single command

djsmiley2k

function not implemented?

did you rm rm?

@Bob Do you ssh in as root?

Bob

@djsmiley2k Yup! Again, no biggie. pubkey only.

djsmiley2k

Are you using putty o_O?

Bob

There's no added security to using a different user.

@djsmiley2k KiTTY

djsmiley2k

06:45

@Bob @Bob ....

I do 'ssh server' and it sshes into my server

Rahul2001

@Bob ...

djsmiley2k

now If I was to accidently do 'ssh server rm -rf /*'

it'd do... that

And nothing would happen.

because default user is tim

Layers.

sudo su isn't hard

Bob

@djsmiley2k Unless you're running your local machine as root...

djsmiley2k

@Bob :D

Bob

you'd go ssh server and it'd attempt to log in as tim@server even if that account doesn't exist. so meh.

@djsmiley2k It's hard when the machine doesn't have sudo!

djsmiley2k

06:47

@Bob why does it not have sudo?

Bob

@djsmiley2k Because Debian's base image doesn't have sudo.

And I see no reason to install more crap when it's not necessary.

@djsmiley2k If you were to "accidentally" do that, you've already messed up.

What if you were to accidentally do ssh server sudo rm -rf /*?

It's just as likely.

bwDraco

So... how do I do containers?

Bob

@bwDraco with great difficulty

bwDraco

doc.opensuse.org/documentation/leap/virtualization/html/… Hmm...

Bob

tbh, depends on your distro and what you want to use them for

I think LXD is probably best going forward. But it's not quite mature on other distros yet.

LXC is ... weird.

bwDraco

06:52

I have never really used openSUSE's virtualization tools before.

Bob

@bwDraco Eh. For actual virt, I used KVM. It works, but I'm not particularly a fan.

Nick

@Bob haha

Bob

Containers are much easier and lighter. Though currently still have teething issues.

Nick

TIL lxc

Bob

Oh, and don't mix lxd and snapd. That way lies pain.

@Nick It's LXD.

lxc is the client command for lxd-client. There's a different LXC that LXD is based on, but that's got its own different commands.

Nick

06:54

LXC (Linux Containers) is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using a single Linux kernel.

...

there are two lxc's!?

djsmiley2k

there'd two ddrescue's too

Bob

@Nick LXC and LXD. Both have a command named lxc.

Nick

O_O wtf is wrong with superusers

Bob

Actually I'm not sure LXC has a lxc command

Nick

@Bob that is... effed up

djsmiley2k

06:55

@Bob it'd ask for my password...

bwDraco

I might try it out on the old HP laptop, which runs openSUSE...

Avery

@Nick there are countless implementations of x11

Bob

@djsmiley2k Then that's a hell no from me.

Avery

all supply X server

Bob

I don't want to keep another password around to type/paste.

Nick

06:55

@Bob That's something I bet my cat can type if it jumped onto the keyboard

Could someone explain this to me. My dad, he had this keycahin thing with numbers that kept changing, it was supposed to be passwords. What are those called?

Oliver Salzburg

@Nick TOTP

One-Time-Password

Bob

@OliverSalzburg Not TOTP.

Similar concept.

Nick

Time-based One-time Password Algorithm

The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OATH), and is used in a number of two-factor authentication systems. TOTP is an example of a hash-based message authentication code (HMAC). It combines a secret key with the current timestamp using a cryptographic hash function to generate a one-time password. Because network latency and out-of-sync clocks can result in...

Bob

But TOTP is specifically RFC 6238

bwDraco

There's a YaST command called "Install Hypervisor and Tools" which installs all the basic stuff, including the Virtual Machine Manager. doc.opensuse.org/documentation/leap/virtualization/html/…

Nick

06:57

I understand the concept

Rahul2001

@Nick my dad had those from his bank for online banking, but that was ages ago

Oliver Salzburg

Pretty sure it's exactly that :P

Bob

It was most likely a RSA SecurID token

Oliver Salzburg

At least it's what I'm using and the description matches

Bob

Which is not TOTP

Nick

06:58

But it was a security thing, how was it implememnted. Adedicated server? How are those connections secured? So many questions...

@Rahul2001 Yeah, my dad had it maybe 5 years ago.

@Bob Yeah, I remember it had the word secure in it.

Bob

RSA SecurID

RSA SecurID, formerly referred to as SecurID, is a mechanism developed by Security Dynamics (later RSA Security and now RSA, The Security Division of EMC) for performing two-factor authentication for a user to a network resource. == Description == The RSA SecurID authentication mechanism consists of a "token" — either hardware (e.g. a key fob) or software (a soft token) — which is assigned to a computer user and which generates an authentication code at fixed intervals (usually 60 seconds) using a built-in clock and the card's factory-encoded random key (known as the "seed"). The seed is different...

SecurID has its own algorithms

TOTP is a specific algorithm. It's not a general concept.

Nick

Either of these open source?

Bob

@Nick TOTP is an open algorithm. There are open source implementations of it.

HOTP is also "open" in a similar manner.

Nick

Cool, I'm going to use it on my mobile robot.

Oliver Salzburg

@Bob So it's the same concept with a different algorithm but with identical outcome?

Bob

07:00

@OliverSalzburg More or less, yes.

SecurID came many years before TOTP though.

Rahul2001

@Nick uh.

Oliver Salzburg

Huh, interesting

Avery

@Nick those aren't TOTP.

Nick

My autonomous mobile robot ^

Still working on it today. Today, we're looking at the ESP Module and how to turn off the annoying buzzer.

Avery

esp8266 or esp32?

also why the hell would you want a TOTP robot?

2

Nick

07:03

@Avery esp 32. It's the silver square between the oled display and the glass frontage

Avery

I know.

Nick

@Avery So, it will come find me and tell me when my password has changed.

Avery

You see, esp32 is technically an open standard.

Oliver Salzburg

I wish I had a hardware OTP device. It means you deal with serious business. Having it on your keychain is like a nice sports car key in certain circles ;D

Avery

@Avery anyone can build a board with it

and those little things look similar to each other.

Nick

07:04

@OliverSalzburg I'd want that too had I any keys.

Avery

@OliverSalzburg I bought a yubikey 4 a week ago

will arrive soon hopefully.

Oliver Salzburg

@Nick :D

Bob

@Nick Just have a timer that beeps every 30s.

Avery

@Nick they change every 30 seconds.

that's how the standard is.

Oliver Salzburg

@Avery I have 2 in front of me. But I have no idea how they could replace my existing OTP workflows

Right now they're just an annoyance because I only use it with GitHub and I always pick the wrong key :(

Bob

07:05

@Avery :D :P

djsmiley2k

@Nick errr

that's not how it works.

Nick

@Bob gah, no. The buzzer was on by deafult in most of the boards and it was a headache working with them. I don't want timers or buzzers. I'll just animate a message on the OLED 168x64 display

Avery

that isn't even a password.

Nick

I pulled that resolution number out my bum, maybe you can tell me the right dimensions.

Avery

esp32s don't come with buzzers by default I think.

@Nick 64x48.

Nick

07:07

@Avery I can encrypt using my sequential mapping technique and just display it on-screen without worry

@Avery No way. One of the dimensions go above 100.

@Avery No, we made a custom board in the lab.

Avery

screens in those sizes usually come in 64x48

@Nick that's not correct.

Nick

@Avery That's squarish. This OLED is wider.

@Avery why?

Avery

@Nick I have the exact same screen.

It's 64x48.

Nick

Satibel only got it half right. The word wasn't Africa.

@Avery Nope, it's 128x64

Just asked the instructor.

Wide enough to display a 4 letter password

djsmiley2k

@Nick so it's 2 screens?

xD

Avery

07:09

It's not 4 letters.

Nick

idk

Avery

It's 6 digits.

As in, numbers.

Nick

@Avery I know but I can use lines and rectangles to make 4 letters in a nice font.

@Avery Ah, that's nice to know.

Rahul2001

@Nick is that a USBasp that I see there?

Avery

I wouldn't recommend flashing your key to an arduino

You can dump the code in assembly and extract the key easily.

Rahul2001

07:11

@Avery I don't think that's an arduino, but yeah

djsmiley2k

it sounds fully legit

Avery

And your method of "encryption", honestly, isn't really secure.

Nick

@Rahul2001 idk. it says USB to TTYL on the back.

Avery

@Rahul2001 ESPs are arduino compatible.

Nick

@Avery why?

Rahul2001

07:12

@Nick Uh, remember that day...?

djsmiley2k

lol

Bob

Vigenère cipher

The Vigenère cipher is a method of encrypting alphabetic text by using a series of interwoven Caesar ciphers based on the letters of a keyword. It is a form of polyalphabetic substitution. The Vigenère (French pronunciation: [viʒnɛːʁ]) cipher has been reinvented many times. The method was originally described by Giovan Battista Bellaso in his 1553 book La cifra del. Sig. Giovan Battista Bellaso; however, the scheme was later misattributed to Blaise de Vigenère in the 19th century, and is now widely known as the "Vigenère cipher". Though the cipher is easy to understand and implement, for three...

djsmiley2k

I feel like i'm watching a class of 10 yr olds D:

Nick

@Avery I have a method to truncate the key array with some primes.

bwDraco

@FaheemMitha: wait a sec. Perhaps ethtool -f /dev/eth0 BOOTIMG.FLB would work?

Nick

07:13

@Bob This sounds... a lot like my technique.

djsmiley2k

@bwDraco I'm wondering if it even has a the eeprom chip on it.

Avery

@Nick give me a minute.

Bob

@Nick And it's considered broken.

See also: reasons to not roll your own cryptography.

bwDraco

All this driver work might not have been not necessary. Use the BOOTIMG.FLB file that came with the firmware package.

If it works, I'll update the answer accordingly.

Rather, ethtool -f BootIMG.FLB <NIC>.

Avery

@Nick: p.ave.zone/teriziwuga

Nick

07:21

Quick question, can 5V from the USB port shock you?

@Avery I feel sorry for you, man. The word is not on there. Did you cross ref a dictionary or something?

afk lunch

Avery

@Nick no.

bwDraco

(probably not eth0 because it's an add-in card)

Nick

@Avery It starts an ends with A. Try again.

bwDraco

@FaheemMitha ethtool -f BootIMG.FLB ethX (replace ethX with the actual name of the device)

Rahul2001

@Avery so you made the tool? :D

Avery

07:25

@Nick yeah I realized

@Rahul2001 partially. I made a word querying tool.

p.ave.zone/pofoniholu

bwDraco

@FaheemMitha: correction: ethtool -f ethX BootIMG.FLB (replace ethX with the actual name of the device)

Avery

@Nick I used the linux words file.

bwDraco

I really need to sleep.

Avery

as far as word lists go, the one I have is small.

Rahul2001

@bwDraco go to bed. NOW!!

Burgi

07:44

morning

Avery

It's 10:45am

and I'm yet to sleep

Burgi

take one of my hayfever tablets

it will knock you out

Journeyman Geek

@djsmiley2k WHAT DID I DO?

djsmiley2k

@JourneymanGeek You accidently!

Nick

@djsmiley2k did what!?

XD

Máté Juhász

07:58

Good morning. I've recently flagged a question as spam, it'll be closed soon, so it's fine. However the author (superuser.com/users/739219/tania-sharma) has all the spam links in his profile, he is also on stackoverflow, his question is already delete there, but the profile is still active.

djsmiley2k

ty @MátéJuhász

they'll shortly be exterminated

/me sets the dog on him

Burgi

but what if i wanted pink city call girls?

Máté Juhász

@djsmiley2k: yes, I agree. I flagged it here, based on this meta question: meta.superuser.com/questions/7793/flagging-a-user

Faheem Mitha

@bwDraco Hi. Is this documented somewhere in the Intel docs? And ethtool -f ethX BootIMG.FLB is your final version?

Máté Juhász

@Burgi: save the link quickly, before it gets deleted

Burgi

07:59

heh :)

i don't even know where the pink city is

Transcript for