Valentin Heidelberger

Get Ledger Live working on NixOS

2019-11-14T18:21:22+00:00

The Ledger Nano series are hardware wallets for crypto currencies. They’re managed through an application called Ledger Live. Ledger Live runs on Linux but might - depending on your distro - require some adjustments in order to correctly identify the device via USB. I couldn’t test whether this config works with all Ledger devices so far. Feel free to drop me a tweet if you have anything to add to this post and I’ll gladly update it.

On NixOS I needed the following additional config snippets to use my Ledger fully:

Define a group called “plugdev”

groups.plugdev = {};

Add user(s) to “plugdev”

Note that you your user will most likely already be in various other groups such as networkmanager or wheel. Just append plugdev to the extraGroups list. Replace myUser with your user name.

users.users = {
...
myUser = {
extraGroups = [ "plugdev" ];
...
};
};

Add extra rules for udev

Ledger provides udev rules which need to be added kind of hidden (Linux -> Troubleshooting -> Option 3) on their website. You can check out my NixOS config containing these rules on GitHub. I’ve decided to not statically post them here and instead refer to the GitHub mirror of my NixOS config, because they might change with Ledger firmware updates. You must change “val” to your username.

I’m not entirely sure whether it’s really necessary but I reload the rules after I’ve changed them and rebuilt NixOS just to make sure they are being applied:

udevadm trigger
udevadm control --reload-rules

Dynamically update Cloudflare DNS records using the web API

2019-11-12T17:30:46+00:00

Why

I’m using Cloudflare as a CDN and DNS provider. For a system with an external IPv4 address that changes daily, I needed a dynamically updated DNS record. There are numerous ways to do DynDNS but I wanted to get into Cloudflare’s API anyway and it turns out that this is, at least in my opinion, much easier to set up than some generic DynDNS package.

How

Getting the script

I’ve forked a script by benkulbertis. The fork does not require a general API token. So you can set up API tokens specifically authorized for what the script needs to do. You can get the script here.

Setting up API tokens

Next, you need to set up the required tokens. The script needs two tokens: one to read DNS records and settings and one to actually edit a DNS zone. To set the tokens up, log in to your Cloudflare account, go to this page and click Create Token. Note, that you can also limit the tokens to a specific domain! This is of course important to know if you have multiple domains in your Cloudflare account and the script shall only read/edit the settings of one of these. You can give your token a custom name and then have to select the permissions it’s supposed to have. These are as follows:

Read token

Type	Resource	Permission
Account	Access: Organizations, Identity Providers, Groups	Read
Zone	Zone Settings	Read
Zone	DNS	Read

Edit token

Type	Resource	Permission
Zone	DNS	Edit

Configuring the script

Now, that you’ve successfully created the API tokens, configure the script by modifying the first four variables accordingly.

Variable	Value
read_token	The read token you’ve just created
edit_token	The edit token you’ve just created
zone_name	The DNS zone your record lies in (e.g. example.com)
record_name	The DNS record (e.g. mysubdomain.example.com)

Moving on

I’ll probably rewrite the script in Python and add an argument parser soon. If you have any other ideas, feel free to drop them here as an issue or pull request.

Providing access to thousands of external storages using Nextcloud

2019-10-28T18:41:14+00:00

A few weeks ago I’ve held a talk involving a solution I’ve built @univention for a customer using Univention Corporate Server and Nextcloud at this year’s Nextcloud conference.

The talk is available on YouTube.

The documentation for the cool solution I’m referring to in the talk can be found in the Univention Knowledge Base.

Thanks a lot to the folks at Nextcloud and especially Nina and Jos for the invitation and great discussions!

Nextcloud for UCS now comes with SSO out of the box

2019-09-29T13:42:20+00:00

A few weeks ago I’ve held a talk involving a solution I built @univention for a real customer using Univention Corporate Server and Nextcloud at this year’s Nextcloud conference. The video of that will probably be available in the next few weeks and I’ll share it here once it’s available.

Another interesting thing regarding Nextcloud and UCS happened in the meantime though: The Nextcloud app for UCS now comes with pre-configured Single Sign-On (SSO) using SAML. This is very cool because lots of our customers want to make use of SSO but the configuration is not always trivial. Using a blog post I wrote for the Univention blog in February, Nextcloud, namely Arthur Schiwon aka @blizzz, were able to bake the configuration into the app and thus make it really easy for people to get started with UCS, Nextcloud and SSO! If you’d like to find out more about SSO with SAML, feel free to check out my blog post about it.

Raspberry Pi: Configure WLAN/WiFi + SSH before first boot

2018-09-10T19:31:23+00:00

Why

Lots of Raspberry Pis are used for purposes requiring a wireless network connection. Configuring WLAN for the Pi requires a config file including the network’s name and access keys. To save time otherwise spent on connecting the Pi to a screen and keyboard or wired network to configure this, you can just create the config file before even booting the Pi for the first time. Here’s how that works.

How

Having flashed the Raspbian image onto your Pi, use your file explorer or terminal to move to a newly created partition called “boot” on the micro SD card. Create a file called wpa_supplicant.conf in the root of that partition and paste the following contents in there. Change the country parameter as well as the ssid and psk accordingly and save the file:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=US

network={
     ssid="Your network name/SSID"
     psk="Your WPA/WPA2 security key"
     key_mgmt=WPA-PSK
}

Having created the config for WLAN, create another (empty) file simply called ssh in the “boot” partition. If you’re on Windows, make sure that both ssh and wpa_supplicant.conf don’t have any other extension such as .txt.

Once the files are saved, eject the SD card safely, put it in your Pi and boot it up. You should be able to connect via SSH using the default user pi and password raspberry shortly after.

Simple file encryption module for Python projects

2018-09-08T11:40:23+00:00

tl;dr

Plasm focuses on a very specific use case: encrypting and decrypting files using public key encryption. If plasm doesn’t fit the scope of what you want to do, feel free to have a look at pynacl’s documentation and use it directly.

Why

I have experimented a lot with camera software for the Raspberry Pi. One project that particularly stuck with me is motionEye, a web frontend for the motion daemon, which allows you to easily set up an open source motion triggered camera for about 50€. MotionEye also offers a cloud upload functionality, which I like a lot. Unfortunately it doesn’t allow the user to encrypt their media files before uploading them. Since I wanted to use Google Drive as my data grave but at the same time not upload unencrypted media files into the cloud, I decided to build a simple python module to easily hack file encryption into motionEye.

What it is

The result of this is plasm, which is an acronym for “PynacL AbStraction Module”. Plasm is based on pynacl, which in turn binds to libsodium. Plasm uses public key encryption and is supposed to make the creation of public key pairs as well as encryption and decryption of files very simple. One key requirement for me was that plasm had to be able to encrypt using only a public key. The private key, which is required to decrypt, shouldn’t be required so that I could store it in a safe place on another device. To accomplish this, I chose to use the sealedBox construct, because it only requires a public key. The main difference of the sealedBox compared to another construct simply called “Box” is that it doesn’t offer cryptographic proof of the sender’s authorship, which is out of scope for plasm anyway. Additionally, I wanted to protect the private key by encrypting it as well using secret key encryption. That’s why plasm requires a password for creating a key pair and decrypting files. The password is used to encrypt and decrypt the key so that an attacker needs both the private key file and the password to be able to decrypt files.

Installation and how it works

Please have a look at the README to find out how to use plasm.

Plasm is currently not available via PyPi, but you can install it directly from Github as follows:

wget https://github.com/va1entin/plasm/-/archive/master/plasm-master.zip
unzip plasm-master.zip
cd plasm-master
pip install .

Integration into motionEye

The integration into motionEye currently requires a little patch to be applied to it’s uploadservices.py, which is located at /usr/local/lib/python2.7/dist-packages/motioneye/uploadservices.py on Raspbian. You can download it directly here (right click -> save as). Make sure to change the path to your public key accordingly and add removeInputFile=True as shown in the README, if you want plasm to remove the unencrypted input file once encryption is finished. Plasm also logs what it’s doing using the logging module by default. Most logging happens at debug log level currently. Have a look at the motionEye wiki to find out how to enable debug logging.

Conclusion

Plasm is licensed under the Apache 2.0 License. Feel free to report issues or create merge requests at Github. Please note that I don’t plan to extend plasm’s scope on other use cases at the moment to keep it as simple as possible. If plasm doesn’t fit the scope of what you want to do, feel free to have a look at pynacl’s documentation and use it directly.

Setting up unattended upgrades on Debian

2018-08-25T12:30:21+00:00

Why

I have a Raspberry Pi running on Raspbian in my home network. It mainly provides a DNS server based on Pi Hole and runs some cronjobs for me. Of course you don’t want to login to such a system regularly and install package upgrades. That’s where unattended upgrades come into play. I’ll tell you how to set unattended upgrades up on Debian and walk you through some config parameters that I find very useful.

Why
How
Debugging

How

Firstly, you need to install the unattended-upgrades pkg:

apt install unattended-upgrades

unattended-upgrades is run automatically by the cronjob /etc/cron.daily/apt-compat.

The config file

Now let’s have a look at the config file:

vim /etc/apt/apt.conf.d/50unattended-upgrades

The config file might look a bit messy at first due to a LOT of comments and the (in my opinion) unaesthetic apt config syntax. The most interesting part to begin with is the “Origins-Pattern”:

Unattended-Upgrade::Origins-Pattern {
      "o=Debian,a=stable";
      "o=Debian,a=stable-updates";
      "o=Debian,a=proposed-updates";
      "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

Defining package origins

The Origins-Pattern defines from where unattended-upgrades will install upgrades. If an origin is missing here, package upgrades from there will be ignored. Which origins to configure here is totally up to you of course. Maybe you have installed some exotic PPA, which you always want to upgrade manually? To find out how to configure the origins you want, you can have a look at apt’s lists:

val@pi:~ $ ls /var/lib/apt/lists/ | grep InRelease
archive.raspberrypi.org_debian_dists_stretch_InRelease
raspbian.raspberrypi.org_raspbian_dists_stretch_InRelease

These InRelease files provide the information you need. To find out their origin and suite (o= and a=), use the grep command:

val@pi:~ $ grep -E '(Origin|Suite)' /var/lib/apt/lists/archive.raspberrypi.org_debian_dists_stretch_InRelease
Origin: Raspberry Pi Foundation
Suite: stable

So the origin of this particular apt list is “Raspberry Pi Foundation” and it’s suite is “stable”. To configure this for unattended-upgrades, you’d adapt the config to look as follows:

Unattended-Upgrade::Origins-Pattern {
      "o=Raspberry Pi Foundation,a=stable";
      "o=Raspbian,a=stable";
      "o=Debian,a=stable";
      "o=Debian,a=stable-updates";
      "o=Debian,a=proposed-updates";
      "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

Defining package blacklist

If you don’t want to upgrade certain packages from a defined origin automatically, you can put them in the blacklist, that should already be in the config file:

Unattended-Upgrade::Package-Blacklist {
//      "vim";
//      "libc6";
//      "libc6-dev";
//      "libc6-i686";
};

Automatically remove unused dependencies (autoremove)

To automatically remove unused dependencies, set the following config parameter to true:

Unattended-Upgrade::Remove-Unused-Dependencies "false";

Automatically reboot

Some packages require a reboot. You probably want to control when that happens. In my case the pi reboots at 2 AM, when everyone’s usually asleep, if needed.

Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Debugging

unattended-upgrades offers a debug parameter, that makes debugging very easy. With –apt-debug and –verbose you can get even more debug output. To debug previous runs of unattended-upgrades, check the log files: /var/log/unattended-upgrades/unattended-upgrades.log and /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.

val@pi:~ $ sudo unattended-upgrades --dry-run --debug
sudo: unable to resolve host pi
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: ['o=Raspberry Pi Foundation,a=stable', 'o=Raspbian,a=stable', 'o=Debian,a=stable', 'o=Debian,a=stable-updates', 'o=Debian,a=proposed-updates', 'origin=Debian,codename=stretch,label=Debian-Security']
...

Userscript to hide YouTube comments

2018-03-17T20:01:00+00:00

Why

Most comments below YouTube videos are, well, irrelevant, to say the least. Since they’re pretty much in the middle of the page, they still regularly caught my eyes and distracted me when I was checking the recommended videos and scrolled down the site. That’s why I built a little userscript to hide the comments by default and make them visible with the click of a button.

Installing the script

Chrome

Just download the script by right-clicking and selecting Save link as. Open chrome://extensions and drag-and-drop the file into Chrome. Chrome should ask, if you want to install it. You can also disable or remove it here.

Alternatively, you can also use a dedicated userscript manager from the Chrome web store. Read the paragraph on Firefox, to learn how to install the script in such a manager.

Firefox and others

Firefox requires you to install a userscript manager add-on. One of the most famous ones is Greasemonkey. I’m using a relatively new add-on called Tampermonkey, though, because it is available across different browsers and also offers a nice configuration interface with a built-in editor. Feel free to use whatever you want. I’ll describe how to install the script in Tampermonkey here.

After Tampermonkey is installed, click on the following link. Tampermonkey should ask, if you want to install the script: Click to install

Using the script

With the script enabled, comments will be hidden by default.

You can make them visible by clicking the button Show comments and scrolling a little.

You can also easily modify the texts on the buttons. Just open the script and change the two values of the two variables at the very top as you wish.

Source code

The source is available on GitHub.

Run Dropbox client in a Docker container

2018-03-07T20:01:00+00:00

Why

The official Dropbox client seems to be quite a mess on some Linux distributions. There are official packages for Ubuntu/Debian and Fedora/RedHat, which seem to be pretty stable, but at least in my distribution (which builds it from source) it is unusable. Considering the plethora of distros, that are out there, it is a good idea to not waste much time trying to get it to work on your particular distro, but to simply use a Docker container.

How

Implementing this is actually incredibly simple. Just add the following two shell aliases to your .bashrc, .zshrc or whatever:

   alias dropbox="docker exec -it dropbox dropbox"
   alias dropbox-start="docker run -d --restart=always --name=dropbox -v /home/val/Dropbox:/dbox/Dropbox -v /home/val/.dropbox:/dbox/.dropbox -e DBOX_UID=1000 -e DBOX_GID=100 janeczku/dropbox"

The alias dropbox-start pulls the docker image janeczku/dropbox from Dockerhub and runs it with restart set to always. This makes sure, that the container is immediately restarted, if it crashes and also starts it on system boot. Also the command mounts the folders /home/val/Dropbox and /home/val/.dropbox at the mountpoints /dbox/Dropbox and /dbox/.dropbox inside the container and gives the container two variables containing the UID and GID to use for read/write operations.

Don’t forget to replace the folder paths with your desired paths and the variables DBOX_UID and DBOX_GID with your uid/gid; otherwise Dropbox might have a permission problem. Don’t give it the UID “0”, because that is root and you just don’t wan’t something to run with root privileges, if it doesn’t need to.

Make sure, that the folders /home/user/Dropbox and /home/user/.dropbox do not exist before you execute dropbox-start the first time. Dropbox insists on creating these folders itself and will simply crash over and over again if it can’t. I spent quite some time debugging until I found that out actually…

dropbox-start should print a container ID to your screen, if it was successful. You can also use “docker ps” to check, if and how long the container’s running:

$ docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
91eee27158bb        janeczku/dropbox    "/root/run"         3 days ago          Up 4 hours          17500/tcp           dropbox

Once the container is up and running, you need to check it’s logs to link the client to your Dropbox account. Dropbox keeps printing a link to the logs until you connect it to a account:

$ docker logs --follow 91eee27158bb
Checking for latest Dropbox version...
Latest   : 44.4.58
Installed: 11.4.21
Downloading Dropbox v44.4.58...
######################################################################## 100.0%
Installing new version...
Dropbox updated to v44.4.58
Starting dropboxd (44.4.58)...
dropbox: locating interpreter
!! dropbox: failed to create log file (Permission denied)!
dropbox: initializing
dropbox: initializing python 2.7.11
dropbox: setting program path '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/dropbox'
dropbox: setting home path '/opt/dropbox/dropbox-lnx.x86_64-44.4.58'
dropbox: setting python path '/opt/dropbox/dropbox-lnx.x86_64-44.4.58:/opt/dropbox/dropbox-lnx.x86_64-44.4.58/python-packages-27.zip'
dropbox: python initialized
dropbox: running dropbox
dropbox: setting args
dropbox: applying overrides
dropbox: running main script
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/cryptography.hazmat.bindings._constant_time.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/cryptography.hazmat.bindings._openssl.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/cryptography.hazmat.bindings._padding.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/psutil._psutil_linux.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/psutil._psutil_posix.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/linuxffi.pthread._linuxffi_pthread.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/tornado.speedups.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/cpuid.compiled._cpuid.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/linuxffi.resolv.compiled._linuxffi_resolv.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/posixffi.libc._posixffi_libc.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/linuxffi.sys.compiled._linuxffi_sys.so'
dropbox: load fq extension '/opt/dropbox/dropbox-lnx.x86_64-44.4.58/librsyncffi.compiled._librsyncffi.so'
This computer isn't linked to any Dropbox account...
Please visit https://www.dropbox.com/cli_link_nonce?nonce=22a3a1f3d92077590f37fcd5ae1aa687 to link this device.
This computer isn't linked to any Dropbox account...

Of course the nonce will be different in your logs. Open the link in your web browser to authenticate and connect. Once the client has been successfully linked to your account a message will appear in the logs and the client will start syncing:

...
Please visit https://www.dropbox.com/cli_link_nonce?nonce=22a3a1f3d92077590f37fcd5ae1aa687 to link this device.
This computer is now linked to Dropbox. Welcome Valentin

The alias dropbox simply executes the “dropbox” command inside the container. With the various subcommands of “dropbox” you can check lots of things. E.g. if it’s currently synchronizing something:

$ dropbox status
Up to date

Calling the “dropbox” alias without a subcommand will output a list of available subcommands:

$ dropbox
Dropbox command-line interface

commands:

Note: use dropbox help <command> to view usage for a specific command.

 status       get current status of the dropboxd
 throttle     set bandwidth limits for Dropbox
 help         provide help
 puburl       get public url of a file in your dropbox's public folder
 stop         stop dropboxd
 running      return whether dropbox is running
 start        start dropboxd
 filestatus   get current sync status of one or more files
 ls           list directory contents with current sync status
 autostart    automatically start dropbox at login
 exclude      ignores/excludes a directory from syncing
 lansync      enables or disables LAN sync
 sharelink    get a shared link for a file in your dropbox
 proxy        set proxy settings for Dropbox

Summary

Containerizing apps is a very nice thing in general, because it makes the stuff inside the container basically independent from what’s going on outside (system updates, new/old versions of libraries, etc.). However, you should always check what’s going on in the Docker images, before giving it’s container access to your private data. Especially, if you don’t know the author(s). The source for the docker image used above is available on GitHub and built automatically from there, so you can actually check what’s going on. I know it’s a bit ironic to talk about privacy in an article about Dropbox but remember: everyone can upload their stuff to Dockerhub and theoretically hide something inside.

So, embrace simplicity, but keep your eyes peeled.

How to play YouTube in background on mobile

2018-03-05T21:14:00+00:00

One of the most requested features for mobile devices in, well, forever, is playing YouTube videos without having the app in foreground. YouTube introduced this feature with YouTube Red for paying customers. So if you’re lucky enough to live in one of the countries, where you can actually subscribe to YouTube Red, you can pay a few bucks per month to get this.

If you’re not so lucky (like me) or just don’t want to pay, you could still use a mobile browser. Until recently at least, when YouTube blocked playing videos without having the according tab open on mobile devices. This is accomplished by utilizing the so called page visibility and fullscreen API. This allows a webpage to check, if you’re actually viewing the page.

Luckily, Timothy Chien built an add-on for Firefox that blocks these APIs and allows you to listen to YouTube videos with another tab open or Firefox in background entirely on mobile.

Just download Firefox from your favourite app store, if you haven’t already, and visit this page to install the add-on.

This way you don’t need to access YouTube in desktop mode, change your user-agent or do anything else.

Also, the code for the add-on is available on GitHub. So feel free to contribute!