- Roundtable - muug.ca

More about network time...
by Gilbert E. Detillieux 13 Sep '17

13 Sep '17

Wyatt's presentation on NTPD last night prompted some discussion about other NTP implementations. (Chrony was mentioned in the presentation, and systemd-timesyncd was mentioned in discussion.) The latest Raspbian boot image for the Raspberry Pi (based on Debian stretch) no longer installs ntpd by default, but relies on systemd-timesyncd instead. (Presumably Debian stretch does something similar, though that may not be the case...) Of course, ntpd, chrony, and openntpd are all available as alternatives. The good news is that systemd-timesyncd seems to work for the very simple case of a client-only setup, where you just want to get the time reasonably close to some official time source (it only implements an NTP client, not a server), requires no special configuration, and seems to get out of the way if you install any of the more-capable NTP server packages. The bad news is that it doesn't do as good a job of keeping time in sync. It only contacts one of the available NTP servers, and sticks to that one until it's not reachable, in which case it tries the next available one, etc. It will use as time sources one of the available pool servers for the distribution, or (if provided) one of those indicated by the DHCP server. So, for the typical client, it may be fine. Also, it doesn't give you much by way of stats. You can use the "timedatectl" command, to find out if NTP synchronization is enabled or not, but that's about it. You can also use the "systemctl -l status systemd-tymesyncd" command, and look at the log entries showing which time server was used... Sep 09 07:02:29 raspberrypi systemd-timesyncd[215]: Synchronized to time server 206.108.0.134:123 (2.debian.pool.ntp.org) Sep 09 23:33:45 raspberrypi systemd-timesyncd[215]: Timed out waiting for reply from 206.108.0.134:123 (2.debian.pool.ntp.org) Sep 09 23:33:45 raspberrypi systemd-timesyncd[215]: Synchronized to time server 208.81.1.244:123 (2.debian.pool.ntp.org) Sep 10 00:43:48 raspberrypi systemd-timesyncd[215]: Timed out waiting for reply from 208.81.1.244:123 (2.debian.pool.ntp.org) Sep 10 00:43:48 raspberrypi systemd-timesyncd[215]: Synchronized to time server 174.94.155.224:123 (2.debian.pool.ntp.org) No way to check for offset and other such stats, though. (It may not even track that.) Chrony seems to be a quite capable replacement for NTPD, with a configuration file format that looks quite similar (at least for the basic config). There are a couple different commands to get stats... [root@host ~]# chronyc sources 210 Number of sources = 7 MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* ntp1.mydomain.net 3 10 377 280 -274us[ -216us] +/- 71ms ^+ ntp2.mydomain.net 3 10 377 585 -348us[ -290us] +/- 66ms ^+ ntp3.mydomain.net 3 10 377 510 -696us[ -638us] +/- 68ms ^+ james.kirk.hungrycats.org 2 10 377 229 -3138us[-3138us] +/- 69ms ^+ ns541050.ip-144-217-252.n 3 9 377 390 -2763us[-2705us] +/- 102ms ^+ sanction.treborlogic.com 2 10 377 983 +573us[ +630us] +/- 75ms ^+ 209.115.181.107 3 10 377 455 +13ms[ +13ms] +/- 108ms [root@host ~]# chronyc sourcestats 210 Number of sources = 7 Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== ntp1.mydomain.net 39 19 273m -0.000 0.007 -814us 65us ntp2.mydomain.net 16 9 90m -0.002 0.066 -619us 68us ntp3.mydomain.net 27 17 226m -0.010 0.013 -784us 52us james.kirk.hungrycats.org 6 4 86m +0.160 1.290 -3291us 739us ns541050.ip-144-217-252.n 8 6 60m -0.143 0.280 -3050us 162us sanction.treborlogic.com 6 3 86m +0.287 0.623 +614us 302us 209.115.181.107 12 9 189m +0.129 0.121 +13ms 262us [root@hedge ~]# The default config is set up to query servers in the pool for the distro (rhel in the above example, with the last 4 servers shown), but will also include any NTP servers indicated by DHCP (the first 3 servers shown, with bogus host names in this example). I haven't tried OpenNTPD (The OpenBSD NTP daemon), so I don't know how that one looks compared to the classic NTPD. Gilbert -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Re: [RndTbl] Roundtable Digest, Vol 153, Issue 3
by Kat 11 Sep '17

11 Sep '17

I don't know about Firefox, but I meant to write about the headless Chrome CLI in the last newsletter. It's been around since v59/60. https://developers.google.com/web/updates/2017/04/headless-chrome On 8 September 2017 at 12:00, <roundtable-request(a)muug.ca> wrote: > Send Roundtable mailing list submissions to > roundtable(a)muug.ca > > To subscribe or unsubscribe via the World Wide Web, visit > https://muug.ca/mailman/listinfo/roundtable > or, via email, send a message with subject or body 'help' to > roundtable-request(a)muug.ca > > You can reach the person managing the list at > roundtable-owner(a)muug.ca > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Roundtable digest..." > > > Today's Topics: > > 1. Firefox remote control / or headless js? MozRepl gone... > (Trevor Cordes) > 2. massive equifax hack (Trevor Cordes) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 8 Sep 2017 00:24:43 -0500 > From: Trevor Cordes <trevor(a)tecnopolis.ca> > To: MUUG RndTbl <roundtable(a)muug.ca> > Subject: [RndTbl] Firefox remote control / or headless js? MozRepl > gone... > Message-ID: <20170908052443.GA10410(a)pog.tecnopolis.ca> > Content-Type: text/plain; charset=us-ascii > > MozRepl, which I use to remotely control Firefox, is officially broken as > of FF55 and the devs say it won't be fixed and can't really work in the > future anyhow as FF ditches XPCOM. That means I can't use > WWW::Mechanize::Firefox anymore (as demo'd (demoed? demod?...) in a MUUG > meeting a couple of years back). > (https://github.com/bard/mozrepl/issues/68#issuecomment-322212759) > > So I'm left looking for alternatives... Anyone else know of / is using any > good progrmamatic browser remote-controllers? Hopefully they'd support FF > and Perl, but I could convert/find workarounds if it supported different > browser/languages. > > Also, beyond that, are there any good libraries /modules for interacting > with web pages "headless", that is, having the dom and js handled all in > memory without any actual browser or window showing? > > I'd love to hear about personal experience / anecdotes, but just rattling > off some names to research would be helpful too. Thanks! > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Sep 2017 05:06:56 -0500 > From: Trevor Cordes <trevor(a)tecnopolis.ca> > To: MUUG RndTbl <roundtable(a)muug.ca> > Subject: [RndTbl] massive equifax hack > Message-ID: <20170908100656.GA3883(a)pog.tecnopolis.ca> > Content-Type: text/plain; charset=us-ascii > > Equifax blew it and allowed SQL injection (that's soooo 2005) vulns to > leak access to id/credit details of 143M Americans, as well as undisclosed > number of Canadians and UK. This is pretty big news. No word yet on how > Canadians can check their status or access the freebies they are handing > out. > > https://www.theinquirer.net/inquirer/news/3016920/equifax- > hack-exposes-personal-details-of-44-per-cent-of-us-citizens > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Roundtable mailing list > Roundtable(a)muug.ca > https://muug.ca/mailman/listinfo/roundtable > > > ------------------------------ > > End of Roundtable Digest, Vol 153, Issue 3 > ****************************************** > -- ------------------------------------------------------------ Katherine Scrupa Network Technology CCNA, Hons.

1 0

massive equifax hack
by Trevor Cordes 09 Sep '17

09 Sep '17

Equifax blew it and allowed SQL injection (that's soooo 2005) vulns to leak access to id/credit details of 143M Americans, as well as undisclosed number of Canadians and UK. This is pretty big news. No word yet on how Canadians can check their status or access the freebies they are handing out. https://www.theinquirer.net/inquirer/news/3016920/equifax-hack-exposes-pers…

2 1

Firefox remote control / or headless js? MozRepl gone...
by Trevor Cordes 08 Sep '17

08 Sep '17

MozRepl, which I use to remotely control Firefox, is officially broken as of FF55 and the devs say it won't be fixed and can't really work in the future anyhow as FF ditches XPCOM. That means I can't use WWW::Mechanize::Firefox anymore (as demo'd (demoed? demod?...) in a MUUG meeting a couple of years back). (https://github.com/bard/mozrepl/issues/68#issuecomment-322212759) So I'm left looking for alternatives... Anyone else know of / is using any good progrmamatic browser remote-controllers? Hopefully they'd support FF and Perl, but I could convert/find workarounds if it supported different browser/languages. Also, beyond that, are there any good libraries /modules for interacting with web pages "headless", that is, having the dom and js handled all in memory without any actual browser or window showing? I'd love to hear about personal experience / anecdotes, but just rattling off some names to research would be helpful too. Thanks!

1 0

lisa (muug.mb.ca) is down - change your bookmarks/contacts!
by Trevor Cordes 05 Sep '17

05 Sep '17

For everyone's information, our old server (still used for a couple of things) went down over the weekend. It has (shock, horror) bad capacitors. This is a reminder to make sure all of your MUUG web and email bookmarks have been changed to use the new server muug.ca, not the old muug.mb.ca. In particular, if you have email contacts/nicknames to write to the muug mailing lists, make sure they are set to the new (muug.ca) domain. We are working to make it so the old domain will still function, but it may not take effect for a day or two. In any event, one day we will decomission the old domain completely, so you might as well make your changes now. Thanks! And, as always, if you find something doesn't work as it should, email board(a)muug.ca

1 0

MUUG Meeting, Sept. 12, 7:30pm -- NTP, RCS Redux
by Gilbert E. Detillieux 05 Sep '17

05 Sep '17

*** Please note the updated meeting location below *** The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, September 12. The meeting topic for this month is as follows: NTP Wyatt Zacharias will be presenting NTP, with a bit of theory and practical information on setting up NTPD. RTFM: RCS Redux Adam Thompson will be hosting this month's RTFM segment about Revision Control System. Like other version control systems, RCS automates the storing, retrieval, logging, identification, and merging of revisions. This primer will help you manage your frequently-revised text, source code, programs, documentation, graphics, papers, and form letters. The group usually holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our *NEW* meeting location for this month: *Room 1C16A* Centennial Hall, University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Neat bitcoin tracker
by Adam Thompson 25 Aug '17

25 Aug '17

I know we have a number of Bitcoin enthusiasts on the list, so I forward without further ado: http://www.bitlisten.com/ -Adam

2 1

HPC sysadmin job at UVic
by Grigory Shamov 23 Aug '17

23 Aug '17

Hi, Not sure if it is the appropriate list. A sysadmin job, University of Victoria. https://uvic.mua.hrdepartment.com/hr/ats/Posting/view/3034 -- Grigory Shamov WestGrid Site Lead / HPC Specialist University of Manitoba E2-588 EITC Building, (204) 474-9625

1 0

Best update problem ever
by Glen Ditchfield 18 Aug '17

18 Aug '17

"When I run apt-get upgrade on my Ubuntu 17.04 machine, sometimes it starts Dwarf Fortress by itself." -- https://askubuntu.com/questions/938606/dwarf-fortress-starting-during-apt-g…

3 2

mail server help
by Trevor Cordes 18 Aug '17

18 Aug '17

I just started getting some weirdness with some email sent to my mail servers. Greylisting "come back later" (451) messages are being interpreted (it appears) by remote MTAs as a 5xx level error, meaning they immediately abort send attempts and bounce the email! I have never seen this before. I've seen it from two separate remote MTAs so far, but from reports I'm getting in, it's happening on more. Here's what I get from umce3cip03.ad.umanitoba.ca: Remote Server returned '554 5.0.0 <[50.71.247.87] #5.0.0 smtp; 5.1.0 - Unknown address error 550-'<foobar(a)tecnopolis.ca>... 451 4.7.1 Greylisting in action, please come back later' (delivery attempts: 0)>' On my server sendmail log I see: Aug 16 08:43:15 pog sendmail[14379]: v7GDhFav014379: Milter: to=<foobar(a)tecnopolis.ca>, reject=451 4.7.1 Greylisting in action, please come back later So umce3cip03.ad.umanitoba.ca appears to be taking my 451 and turning it into a 500/554/510 permanent error. I also see this from yahoomail, but that's a different situation because yahoo is always considered "broken mta" in milter-greylist and we must whitelist all of their servers... but, the usual/previous symptom was yahoo would keep retrying as normal, just with a different IP each time, thus never passing greylisting. And now yahoo is doing the same thing as umce3cip03.ad.umanitoba.ca above (when I haven't yet whitelisted the particular IP that day, grrr): Sorry, we were unable to deliver your message to the following address. <foo(a)tecnopolis.ca>: 550: <foo(a)tecnopolis.ca>... 451 4.7.1 Greylisting in action, please come back later So at least 2 MTAs, probably more, are changing 451 greylist into 5xx. Is there some new massive change out there to basically take greylist MTAs as broken? Is there a way to find out what MTA (or outsourced service provider) umce3cip03.ad.umanitoba.ca is using? Perhaps there is just one brand that unilaterally decided on this action? I can find no google hits on any of this. :-( There is an easy workaround/gotcha: if people wait the greylist timeout (usually 2 to 20 minutes) and then resend the same to-from-ip tuple email, it will go through as their server will have been whitelisted in the interim! But that makes it harder to troubleshoot this problem because it then becomes transient. If any MUUGers have problems with MUUG mailing lists bouncing, please resend your email after 1 hr if it hasn't showed up yet (you can check the website mail list archives section) and/or please email me directly with your bounce email message (twice, wait 20 mins!) so I can solve this for both MUUG servers and my own. If this problem is a) permanent/deliberate, and b) widespread, I think that spells the death of greylisting (grrrrr...) and the nearing of "spf strict" enabling.

3 5