Creating an SSL Certificate Signing Request

To create a CSR, use the openssl command.

openssl req -nodes -new -keyout server.key -out server.cert

The -nodes option tells openssl not to use DES to encrypt the key.


For a self-signed certificate: openssl req -nodes -new -x509 -keyout server.key

Comparing two Postgresql tables

To find differences between two tables with the same columns, use the EXCEPT keyword. This can be extended to as many columns as are in the tables.

SELECT id, employee_id, effective_on, 'not in table2' AS note FROM table1 EXCEPT SELECT id, employee_id, effective_on, 'not in table2' AS note FROM table2;

Online resizing of an LVM logical volume on Linux under VMWare

Layer upon layer of abstraction can complicate this procedure. The common case is that a logical volume is running out of space and needs to be expanded. This can all be done non-destructively and while the volume is in use. It can be expanded by adding a SCSI disk within VMWare or by increasing the size of an existing SCSI disk in VMware. There may be some SAN level commands required first, and those will vary by the kind of SAN connected to VMWare. This specific recipe is based on first increasing the size of an existing SCSI disk in VMWare.

Step One - tell Linux to check the size of the SCSI disk that was expanded in VMWare.

Initially, Linux will not see any changes in the disk configuration. To see all the SCSI devices the system knows about, run:
ls /sys/class/scsi_device/
0:0:0:0 0:0:1:0 0:0:2:0

Once the expanded disk is identified, enable a rescan on the device:
echo 1 > /sys/class/scsi_device/0\:0\:2\:0/device/rescan

Then, run pvdisplay to make sure the physical volume shows the new size. Also, note in the output which volume group the physical volume is assigned to for the next step.

Step Two - make the sure the volume group shows free space

vgdisplay volume-group-name

Check to verify the volume group now has free space.

Step Three - expand the logical volume

Run the following command (replacing the logical-volume with the correct name) to expand the logical volume using ALL available free space in the volume group. If that's not what you want, check the syntax of lvexpand to add the amount of space you want to use.

lvextend -l +100%FREE logical-volume

Step Four - expand the Linux filesystem

Ext3/4 and XFS filesystems can be expanded

resize2fs /dev/mapper/vg-name/lv-name
OR
xfs_growfs /dev/mapper/vg-name/lv-name

Dumping PDF form fields in Linux

To see form fields in a fillable PDF:
pdftk pdf-file dump_data_fields

Note the operator (dump_data_fields) comes after the PDF file name.

How to dump your Ipod

A long time ago, in a galaxy nearby, I bought into the Apple-Unix fusion. Apple scrapped their weak OS and gave birth to OS X, essentially FreeBSD with a nice GUI. And it was good. Most of my Linux command line skills directly transferred, and I could manage Macs as easily as Red Hat boxen. But then time happened. Services started collapsing into Apple proprietary services. Config files and dot files morphed into XML registries with binary fields. Apple started fixing Unix until it was broken. I got off the bandwagon.

I always kept my data in neutral formats. Text, PDF, mp3. It was easy for me to transfer my data to a new system and pick up new programs, or crusty old programs. The one clinger was an ipod nano. I used my ipod in my Toyota mainly to run playlists and be able to play music when I was out of service for streaming. I spend a lot of time in the back country so being out of service is a common thing. Despite my disillusionment with Tim Cook and his wonder watch, the ipod was and is a state of the art music player. Itunes on the other hand, followed the same degrading path as OS X, becoming less usable, unfriendly, and more buggy with each new version. This became a real problem when the 5 year old ipod started to fail. Rebuilding it from scratch would not fix the issues with it and it was time to look for a new solution. Replacing that symbiotic ecosystem was not easy as I found out.

Where are all the ipod competitors? There are a few Chinese knock offs, but the big players have all given up. Microsoft dumped the Zune. Samsung stopped making their ipod competitor. A replacement required a hardware and software combo solution. After some trial and error, including trying one of the knock offs, I settled on Music Monkey (free) and a low profile USB flash drive. I bought a 32 GB SanDisk Cruzer Fit for $11.95 on Amazon.

I do development on Linux, but I have a Win10 machine for home use and game play. Media Monkey easily imported my music files and could dump them onto the Cruzer without problems. I had everything in a single flat directory. But things were not that simple. The Toyota music head (2015) would only index up to 999 files in a directory before giving up. This meant that even through my music was all on the USB flash drive, the car did not see it all. I went back and manually organized the files into directories by artist. This improved the situation, but the car created it's index not based on the physical layout (other than the 999 file restriction), but based on MP3 metadata tags. It was able to index more of the music but not everything. The work around for that was to clean up my metadata. Not an insignificant amount of work.

The final hurdle was to get playlists working. The car did not understand the standard playlist format from Media Monkey. What I did instead was use Genre. The Genre tag is so arbitrary that it is otherwise useless. When I want to change a playlist, I first create a true playlist in media monkey, select all the files and assign the playlist name to the Genre of all the files. Boom, done! A bonus hack is start all the Genre names with AA* so they all appear in the same place at the top of the genre index. For example, AABeatles for a Beatles playlist. It took some trial and error, but I have a better, cheaper solution for offline music and have abandoned the last vestiges of the company with the flying saucer HQ.

Exim cheatsheet

BradTheMad published this excellent reference for getting things done with Exim.

SSH

SSH Client

Common client files in the ~/.ssh/ directory

known_hosts => ip/hostname and fingerprints of servers that have been seen before
authorized_keys => concatenated list of public keys that can login as this user without a password

To generate a public/private RSA key pair (id_rsa and id_rsa.pub)

ssh-keygen -t rsa -b 4096 Private keys must be readable only by the user or SSH will ignore it for safety. Also, the .ssh directory must be readable only by the user.

To copy the public key to a server

ssh-copy-id -i id_rsa.pub user@server
After completion, make sure the key was appended to the .ssh/authorized_keys file on the server.

SSHd server

The config file is /etc/ssh/sshd_config

Best practice security settings

• On public facing servers, always disable root logins with PermitRootLogin no
• For extra security, specifically limit the users that can login with AllowUsers neo trinity
• Allow login via keys with AuthorizedKeysFile .ssh/authorized_keys
• You can change the port that SSH listens on, but a good port scanner will find it wherever it is