Citrix on linux

How to get the black address bar

1. Use Firefox. It works way better with the ICACLient than chromium. I have not tested chrome, buit I suspect it is the same.

1. Setup of local ICAClient

- Navigate to the root of the ICA installation. For me /opt/Citrix/ICACLient.

- Find the file All_Regions.ini 

- Under [Client Engine\GUI]

- Add ConnectionBar=* 

Restart your ICAClient and log on again. It should now be visible in the top of the screen.

Read More

FreeBSD 11 - vt console debacle

Vt console in FreeBSD

Introduction

For some reason server distributions of *nix now have to have a vt based (compositing) console, so that you can get your console into the larger resolutions.

Personally I fail to see the need for this at all. When you connect to your server it is via ssh 95% of the time. Or probably more. And your client PC where off you run ssh probably has a hd display today. Using the actual console is something you do when there are problems. Usually in single user mode. This does not have to be bling bling.

What about us, that depend on the serial console? Or text mode without a compositor. Well it would seem FreeBSD is now going down the Ubuntu server road, and we have to do some fiddeling in order to make our Inside Lights out cards, serial consoles and what not working again.

At least for me, my iLO card on my HP server could no longer bridge to the console after an upgrade to FreeBSD 11. I was told the console was in an unsupported graphics mode and after plugging a monitor onto the server, it was in 640x480.

How to fix this.

Fortunately this is simple not requiring a custom kernel build or anything. In loader.conf put:

kern.vty=sc

And you are back to the old sc driver for the console. And I can again get a console via ethernet. Also in single user via the iLO.

Conclusion

Back to normal ..

Read More

HP inside lights out and OpenSSH

Problem

The sshd server implementation made by HP on ILO cards - especially older ones - can be notoriously difficult to use with newer versions of OpenSSH.

The main reason is algorithms rendered unsafe by old age combined with a very strange implementation by HPs hands.

Solution

The following configuration on the client side made my current version of OpenSSH play reasonably nice with ILO / SSH. There is some unexplained disconnects by the server I cannot figure out. 

In .ssh/config

Host <hostname>/<IP>

PasswordAuthentication yes

ChallengeResponseAuthentication no

GSSAPIAuthentication no

HostbasedAuthentication no

PubkeyAuthentication no

RSAAuthentication no

Compression no

ForwardAgent no

ForwardX11 no

Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128

HostKeyAlgorithms ssh-rsa,ssh-dss

KexAlgorithms diffie-hellman-group1-sha1

MACs hmac-sha1

ServerAliveInterval 0

Result

You can now SSH to the ILO card and use the cmd line tool from HP. Issue a 

</>hpiLO-> remcons

To get a real HW console bridged over the network.

Read More

Automount with systemd

Automount with systemd 

Introduction 

As many others I have used autofs for automagically mounting nfs / cifs shares from my clients to my local servers for a while. You can see some of my experiments with this here.

However systemd has now got this as a standard feature with a few small steps. This all reqires nfs server to be configured at your local server before setting this up on your client.

/etc/fstab content 

You need to add you server to your local /etc/fstab 

my.server.com:/server/files /my/files nfs noauto,x-systemd.automount,soft,rsize=16384,wsize=16384,timeo=14,intr 0 0 

You can do this by restarting the system or using sysctl.

$> sudo systemctl daemon-reload 
$> sudo systemctl restart remote-fs.target 
$> sudo systemctl restart local-fs.target 

You need to add you server to your local /etc/fstab

Conclusion 

Your shares should now automount when you cd into the folder. Here that would me /my/files on the client.

Read More

Lenovo T440P + Ubuntu = driver hell .. And how I fixed it.

New laptop and the nasty suprises

I have purchased the Lenovo T440P in order to run Ubuntu for my development environment. I had a lot of initial issues using this laptop with external displays. The laptop display is too small to use on its own for development, so this was kind of a show stopper.

My target environment was:

1. Lenovo T440P patched to a sensible BIOS level. I think mine is 2.31 or 2.32.
2. Ubuntu 14.04.3 LTS
3. 3.19.0-30-generic #34~14.04.1-Ubuntu SMP Fri Oct 2 22:09:39 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
4. Gnome-Shell / not Unity
5. Nvidia proprietary drivers
6. Some sort of util to manage the use of the new daisy chaining of monitors on a single channel.

A lot of people spent many many hours getting this to work. This was what worked for me.

Installation of base system

1. I started out with a system with no nonsense. That is the server release of Ubuntu. Install it, and you will get a system without any GUI at all.
2. Install the package gnome-shell. This will give you the most basic gnome-shell install shaved down to the bones. No empathy, no Evolution. The downside is you have to add many of the usual tools by hand.
3. Install nvidia-331 + Anything above this worked for me.
4. Replace GDM with LightDM. This is the crucial point. GDM did not work for me on this laptop. I think LightDM is more advanced in managing the session with multiple monitors as of now. done by firstly installing the package lightdm and then dpkg-reconfigure lightdm. Select lightdm over GDM.
5. See to it that the GRUB boot loader has no hokus pokus in it. You need a plain "quiet splash" no modeset changes unless you are fiddeling around and know what you are doing.
6. The above should also have installed the package prime. So prime-select query should show you what GPU you are using.

Result

I am able to use both monitors with the Intel or the NVIDIA driver. Of cause the Intel card does not perform as well as the nvidia one. Some people have reported memory leaks / kernel crashes. I have not experienced this with the above setup. I am writing this from the lappie with an external monitor attached using the monitor on the laptop itself. 

It is really nice that the external monitors no longer tie hard to the discrete graphics card.

switching is done with prime-select <query|nvidia|intel>

For now I think I will use the intel card as it seems to be easily fast enough to power a developer workstation. In fact I struggle to see, why Lenovo does not produce a variant of the T440P with ONLY the Intel card. Seems to be more than what an old codegrunt like me need anyway.

Performance wise glxgears give me around 60 fps with the Intel driver and 2000+ fps when using the NVIDIA card. This goes for both screens.

Outstanding issues

I also have the advanced dock. The above setup does not work for me at all using this yet. I am able to get a text console (mirror) on both displays, but cannot get a GUI up and running on either screen using the advanced dock. I have read that the same is the issue with some versions of MS Windows. So in fact Lenovo has made a patch, that I have yet to flash onto the advanced dock.

https://support.lenovo.com/us/en/documents/ht081248)

I think the next step is to flash the firmware of the dock and see, what the outcome of that is. Right now I do not have a windows boot device compatible with the dock, so I probably have to create a boot partition for Windows on the lappie itself (which sucks) or replace the disk with another one and install on that.

What not to do ..

I have read some have had success downgrading to the 1.14 version of the BIOS. If you have a later version of the T440P I cannot emphasize enough how bad an idea that is.

The older BIOS is made for the older versions of the hardware, and even a minor version incompability in a device in your laptop could transform your laptop into the most expensive paperweight you ever owned.

Only do this if the laptop originally shipped with the early version of the BIOS.

Update:

It seems the above is not a problem on Ubuntu 15.10. On that release displays and dock work just as they are supposed to. I think this is mainly due to the major release upgrade of the kernel / 4.*.

For now the above fixes are still needed for the LTS product.

Update 2:

Distributor ID: Ubuntu
Description: Ubuntu 16.04 LTS
Release: 16.04
Codename: xenial

All works on this LTS out of the box. And it occurred to me that Cannonical actually ship a Gnome-Shell only dist now! Hell just froze over apparently. So forget about the steps to get a clean gnome env above. Just fetch the "gubuntu" distro. 

Read More

DJBDNS and Netflix - Outside USA.

Introduction

In Europe most countries have access to Netflix by now. However the content presented is still lacking much compared to what is available in the USA.

Several services on the net offer DNS + VPN / Proxy solutions to circumvent this. However, if you are like me, you do not really feel ok with giving some service on the net your entire internet traffic for tunneling. In theory they could sniff logins to other services made from a device using their DNS / Tunnel setup.

Background

I was reading this article and decided to do it one better: In place of merely using the host file on a single pc or server I decided to configure it directly on my own DNS server and apply it network wide on my own LAN.

Goal

So the goal here is to *only* use their DNS/Proxy for Netflix specifically. The rest of the DNS lookups will resolve as they have done always.

The end result is a DNS setup that will allow you to use a Proxy Service in the USA for Netflix alone.

Prerequisites 

1.  A DNS + Proxy / VPN service. I am currently using the excellent service from Unblock US. You could also buy a real VPN solution or even a VPS server in the USA, so that you could do the entire config by yourself.
2. Your own configured DNS server on your local network. I am using DJBDNS. 
3. A good understanding of things related to IP networking and DNS configuration.

DNS configuration

dnscache

You need to take over two domains for hosting on your own DNS:

1. netflix.com
2. netflix.net

[user@dnsserver /service/dnscache/root]$ ls -la servers/

total 1

drwxr-sr-x  2 root  wheel  512 17 mar 16:47 .

drwxr-sr-x  6 root  wheel  512  4 jan  2008 ..

-rw-r--r--  1 root  wheel   10 12 nov  2003 1.168.192.in-addr.arpa

-rw-r--r--  1 root  wheel  168  4 feb 20:06 @

-rw-r--r--  1 root  wheel   10 13 nov  2003 barnabas.dk

-rw-r--r--  1 root  wheel   10 17 mar 16:47 netflix.com

-rw-r--r--  1 root  wheel   10 17 mar 16:47 netflix.net

You will probably already have the two first files. The first one may be named differently because it is the reverse DNS entry for hosts on your local network. The "@" file contains a list of root nameservers on the net.

The barnabas.dk file contains the IP address of the DNS server hosting that particular domain. The domain resolves differently on my LAN than it does out on the net. This makes it easier to do development of new stuff locally without making DNS changes visible on the net. The DNS server is running on the loopback (127.0.0.1) interface of the DNS server host. So that is the IP put into it. Now edit a similar file to a netflix.com and a netflix.net.

Restart your server nicely with a kill -HUP <pid>.

tinydns

This is where things become a little more tricky, because we now want the netflix.com and netflix.net CNAME domains to point to the correct IP addresses with unblock-us. This is done to send IP traffic via their servers onto the ones with Netflix. So edit the "data" file in your tinydns server or use the DJBDNS tools to do this on the command line.

# Forward zone

Zbarnabas.dk:sauron.barnabas.dk:hostmaster.barnabas.dk::::::::

Znetflix.com:sauron.barnabas.dk:hostmaster.barnabas.dk::::::::

Znetflix.net:sauron.barnabas.dk:hostmaster.barnabas.dk::::::::

# NS records: primary nameservers

&barnabas.dk::sauron.barnabas.dk:::

&netflix.com::sauron.barnabas.dk:::

&netflix.net::sauron.barnabas.dk:::

#netflix aname

=www.netflix.com:54.243.127.15:36000::

=signup.netflix.com:23.21.78.133:36000::

=movies.netflix.com:204.12.200.61:36000:: 

=cbp-us.nccp.netflix.com:204.12.200.65:36000::

=movies.netflix.com:204.12.200.61:36000:: 

=cbp-us.nccp.netflix.com:204.12.200.65:36000::

=movies1.netflix.com:204.12.200.130:36000::

=movies2.netflix.com:204.12.200.104:36000::

=netflix.com:204.12.200.14:36000::

=moviecontrol.netflix.com:204.12.200.7:36000::

=api-global.netflix.com:204.12.200.88:36000::

=api-us.netflix.com:204.12.200.83:36000::

=api.netflix.com:204.12.200.2:36000::

=www2.netflix.com:204.12.200.100:36000::

=redirects-us.nccp.netflix.com:204.12.200.119:36000::

=redirects-eu.nccp.netflix.com:204.12.200.118:36000::

=nccp-nrdp-31.cloud.netflix.net:204.12.200.26:36000::

=ios.nccp.netflix.com:204.12.200.92:36000::

=atv.nccp.netflix.com:204.12.200.14:36000::

=uiboot.netflix.com:204.12.200.11:36000::

=signup.netflix.com:204.12.200.39:36000::

=iphone-api.netflix.com:204.12.200.14:36000::

=nccp-fuji.netflix.com:204.12.200.14:36000::

=nccp-fuji.cloud.netflix.net:204.12.200.27:36000::

=nccp-nato.cloud.netflix.net:204.12.200.22:36000::

=nccp-nato.netflix.com:204.12.200.14:36000::

=mcdn.netflix.com:204.12.200.14:36000::

=secure.netflix.com:204.12.200.12:36000::

=htmltvui-api.netflix.com:204.12.200.13:36000::

=nccp-ps3.netflix.com:204.12.200.14:36000::

=nccp-ps3.cloud.netflix.net:204.12.200.18:36000::

=api-user.netflix.com:204.12.200.17:36000::

=mobile-api.netflix.com:204.12.200.42:36000::

=api-public.netflix.com:204.12.200.14:36000::

=dvd.netflix.com:204.12.200.14:36000::
=android.nccp.netflix.com:204.12.200.93:36000::

If you bother you could setup an an ANAME record for each of the IPs in that list and then CNAME each of the hosts needed. That would be the nicest way to do it but I am lazy and like cut and paste ..

After editing the data file run make. This will produce the actual file for tinydns to use containing your new entries.

You should now restart your tinydns server like you did the dnscache server.

Conclusion

You should now be able to run your Netflix app using Unblock-US Proxy services and your *own* DNS server putting the control back where it belongs - in your own hands.

If you have corrections, improvements or additions to the above feel free to post them here.

FAQ

1. Q: "What happens if I do this and Netflix or Unblock US changes IPs." A: "You are screwed basically. You asked for full control now you have it. You should proably use a different public DNS to find the correct ip values."
2. Q: "This makes my xyz device do the two step shuffle instead of showing me Netflix, what should I do" A: "Fix the DNS setup and mail / post your findings here once you have a working solution"

Errata

It seems the later versions of the netflix app also requires:

api.crittercism.com

The list of CNAMES above is severely outdated. The method is, however, still sound.

Read More

Mencoder webcam grab for youtube

I have been looking for an easy way to grab the signal from a regular USB webcam and get something from it that is usable on youtube. In the newer versions of ubuntu the /dev/audioN has been dropped from the kernel, so you have to use the audio signal from the ALSA layer instead. Here is how:


mencoder tv:// -tv driver=v4l2:width=320:height=240:device=/dev/video0:forceaudio:alsa:adevice=hw.1:amode=1:channel=3:fps=30:audiorate=32000 -ovc lavc -lavcopts vcodec=mpeg4:vbitrate=1500:keyint=25 -oac mp3lame -lameopts cbr:br=128:mode=3 -fps 30 -o webcam.avi


The output will be in mpeg4.

Read More