Carsten Clasohm's Blog

offlineimap and gnome-keyring

Mon, 22 Sep 2008 20:17:22 GMT

offlineimap allows you to keep a local copy of your emails, and synchronize it with the IMAP folders on the server. Not only handy for offline use, but also for dealing with slow mail servers and unreliable network connections.

Unfortunately, offlineimap exits with an error from time to time and needs to be restarted. The restarts are easily done with a script, but each time you restart it, offlineimap requires the IMAP server's password. offlineimap allows you to store the unencrypted password in a file, but that should not be an option if you care about security.

On Fedora 9, there's a better way to hand the password to offlineimap: gnome-keyring

First, install the Python bindings for gnome-keyring:

yum install gnome-python2-gnomekeyring

Download the file ~/.offlineimap.py and add the following settings in ~/.offlineimaprc. This assumes that you use a local IMAP server.

[general]

pythonfile = ~/.offlineimap.py

[Repository localhost]

type = IMAP
remotehost = localhost
remoteusereval = get_username("localhost")
remotepasseval = get_password("localhost")

[Repository Zimbra]

type = IMAP
remotehost = mail.example.com
remoteusereval = get_username("mail.example.com")
remotepasseval = get_password("mail.example.com")

Download the script imap-passwords and run it to add the IMAP usernames and passwords to your keyring. It will prompt you for server, username and password - use the same host names as in .offlineimaprc.

Now you can run offlineimap in a loop to automatically restart it in the case of some unrecoverable error, like so:

#!/bin/bash

while true; do
  /usr/bin/offlineimap
  echo Restarting in 60 seconds ...
  sleep 60
done

During the first run, gnome-keyring will ask you to authorize offlineimap to access your IMAP authentication data in the default keyring.

Thanks to Sebastian Rittau for the Keyring Python module.

Why External Forwarding with Sendmail's virtusertable is A Bad Idea

Fri, 04 Jul 2008 19:28:38 GMT

If you run a mail server with sendmail, and a user wants to forward his mail to another server, one way is /etc/mail/virtusertable:

joe@example.com         joe@gmail.com

As you probably know, the sender address of most spam mails belongs to someone - not the spammer of course. If you refuse to accept a spam email, you must never send back an error email to the alleged sender address. Otherwise, you have become a source of unsolicited email yourself.

When in our example, gmail.com does not accept an email, your server will send an error mail to the alleged sender address.

If you watch your postmaster mailbox, you will notice this every time the alleged sender address is invalid. You might be tempted to suppress these postmaster notifications with

define(`confDOUBLE_BOUNCE_ADDRESS', `')dnl

But this only supresses the double bounces. If the sender address is valid, someone will get an error email about spam he didn't send.

The solution is to not use virtusertable for external forwarding, but instead do it in /home/joe/.procmailrc:

:0
* ^From: Mail Delivery Subsystem <MAILER-DAEMON@example.com>
* ^To: <joe@example.com>
bounced-mails

:0
! joe@gmail.com

In this case, the sender address is set to joe@example.com before the mail is forwarded to gmail.com, and any error messages go back to joe.

Dell Latitude D800 Suspend to RAM with Fedora 7

Fri, 15 Jun 2007 12:27:08 GMT

Fedora 7 on a Dell D800 requires a little work to get suspend/resume working. The default configuration causes it to freeze during the resume, with the shift and scroll lock LEDs blinking.

The following has been tested with kernel-2.6.22.9-91.fc7 and NVIDIA-Linux-x86-100.14.19 on a Dell Latitude D800 with GeForce FX Go5200 graphics.

If you use the binary-only nvidia driver, append "agp=off" to the kernel line in /etc/grub.conf. This disables the built-in AGP driver and allows nvidia to load its own.
```
kernel /vmlinuz-2.6.22.9-91.fc7 ro root=/dev/vg1/root quiet agp=off
```

Edit /etc/X11/xorg.conf and set the NvAGP option:

Section "Device"
    ...
    Driver         "nvidia"
    Option         "NvAGP" "1"
EndSection

Reboot, log in and check if the nvidia AGP driver is used:

# cat /proc/driver/nvidia/agp/status
Status:          Enabled
Driver:          NVIDIA

Create /etc/pm/config.d/unload_modules with the following content:
```
SUSPEND_MODULES="uhci_hcd"
```
Create /etc/pm/config.d/nvidia with the following content:
```
DISPLAY_QUIRK_VBE_POST=false
```
Make the files executable with
```
chmod +x /etc/pm/config.d/unload_modules /etc/pm/config.d/nvidia
```

Suspend and resume should work now.

Vodafone UMTS with Fedora 7

Thu, 14 Jun 2007 16:23:03 GMT

After upgrading to Fedora 7, my Vodafone 3G Datacard (the old UMTS PCMCIA adapter) stopped working. Here's what I had to do to make it work again.

Create /etc/udev/rules.d/48-UMTS.rules with the following content:

BUS=="usb", KERNEL=="ttyUSB0", SYSFS{interface}=="Data Interface", SYMLINK+="umts", \
  RUN+="/usr/bin/wvdial --config /etc/wvdial-pin.conf"
BUS=="usb", KERNEL=="ttyUSB2", SYSFS{interface}=="Data Interface", SYMLINK+="gsm"

The wvdial configuration for setting the PIN is stored in /etc/wvdial-pin.conf. Replace "1234" with your own PIN.

Modem = /dev/umts
Baud = 460800
SetVolume = 0
Dial Command = ATDT
FlowControl = NOFLOW
Init1 = ATZ
Init2 = AT+CPIN="1234"

/etc/wvdial.conf contains the settings for establishing an UMTS connection:

[ModemUMTS]
Modem = /dev/umts
Baud = 460800
SetVolume = 0
Dial Command = ATDT
Init1 = ATZ
Init2 = ATM0
Init3 = ATM0
FlowControl = NOFLOW
[Dialer umts]
Username = VFD2
Password = WAP
Phone = *99***1#
Stupid Mode = 1
Init1 = ATZ
Init2 = ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0
Init3 = AT+CGDCONT=1,"IP","web.vodafone.de"
Inherits = ModemUMTS

Next, we need to configure a network interface. Put this into /etc/sysconfig/network-scripts/ifcfg-umts:

IPV6INIT=no
ONBOOT=no
USERCTL=yes
PEERDNS=yes
TYPE=Modem
DEVICE=ppp0
BOOTPROTO=dialup
LINESPEED=460800
MODEMPORT=/dev/umts
IDLETIMEOUT=300
PROVIDER=umts
DEFROUTE=yes
PERSIST=no
WVDIALSECT=umts
MODEMNAME=ModemUMTS
DEMAND=no
PAPNAME=VFD2
AC=off
BSDCOMP=off
VJCCOMP=off
CCP=off
PC=off
VJ=off

This configuration has to be made available at two other locations:

ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/devices/ifcfg-umts
ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/profiles/default/ifcfg-umts

Now, tell PPP about the connection in /etc/ppp/peers/umts:

connect "/usr/bin/wvdial --remotename umts --chat 'umts'"

In /etc/ppp/peers/chap-secrets and pap-secrets, append this line at the end:

"VFD2"  *       "WAP"

SELinux prevents udev from running wvdial, and initialization of the PIN fails. To get around this, create /tmp/udevwvdial.te:

module udevwvdial 1.0;

require {
        type var_lock_t;
        type udev_t;
        class dir { write remove_name add_name };
        class file { write read create unlink };
}

allow udev_t var_lock_t:dir { write remove_name add_name };
allow udev_t var_lock_t:file { write read create unlink };

Compile and load the SELinux module.

checkmodule -M -m -o udevwvdial.mod udevwvdial.te
semodule_package -o udevwvdial.pp -m udevwvdial.mod
semodule -i udevwvdial.pp

The semodule command stores the module in /etc/selinux, so it will stay active when you reboot.

You should now be able to establish a connection with ifup umts and terminate it with ifdown umts. When the card switches between UMTS and GPS, the connection attempt may time out, so retry before checking the configuration files.

Encrypted /tmp and swap with Fedora 7

Tue, 12 Jun 2007 12:30:24 GMT

If you carry around business information on your laptop, it's a good idea to encrypt /tmp and the swap volume, and not only your home directory. You could already do this with a little scripting on Fedora Core 6. With Fedora 7, it got a little easier. First, create /etc/crypttab with the following content:

swap    /dev/vg1/swap   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256
tmp     /dev/vg1/tmp    /dev/urandom    tmp,cipher=aes-cbc-essiv:sha256

In /etc/fstab you only list the swap volume:

/dev/mapper/swap        none            swap    defaults        0 0

Because the encrypted volumes are created after /etc/fstab is processed, the following script has to take care of mounting /tmp:

#!/bin/bash
#
# cryptotmp setup crypted tmp partition
#
# chkconfig: 2345 01 90
# description: adds crypted tmp partition.

. /etc/init.d/functions

# See how we were called.
case "$1" in
    start)
        mount /dev/mapper/tmp /tmp
        restorecon /tmp

        action "Adding encrypted tmp"

        touch /var/lock/subsys/cryptotmp
        ;;
    stop)
        rm -f /var/lock/subsys/cryptotmp
        ;;
    *)
        echo $"Usage: $0 {start|stop}"
        exit 1
esac

exit 0

Save it as /etc/init.d/cryptotmp and run

chmod +x /etc/init.d/cryptotmp
chkconfig --add cryptotmp

When the system boots, it overwrites the contents of /dev/vg1/swap and /dev/vg1/tmp, using a random key for encryption. Once the system shuts down, the content will no longer be accessible, as the encryption key is not stored anywhere.

Warning: The above configuration erases /dev/vg1/swap and /dev/vg1/tmp when the system boots. Files stored in /tmp are lost when the system is shut down. Also, suspend to disk does not work with an encrypted swap volume.

Presenting: Dell D800 TwinView

Sat, 05 May 2007 20:20:45 GMT

Some time ago I described how to put presentations on a projector with a Linux notebook with two X displays. In the meantime, I have switched to a Dell D800 with NVIDIA TwinView. I still do presentations where I want the image from the projector in a window on the LCD, without showing my whole desktop. Here's how to do it.

After setting the TwinView parameters in xorg.conf, configure VNC's ~/.vnc/xstartup to start the Metacity window manager and a gnome-terminal.

All you need then is the present script to start the VNC server and clients. Drag the view-only VNC window to the right, adjust its position so the title bar is not visible (Alt + left mouse button), and you can start your presentation in the second VNC window. To use Firefox, you either need to quit it on your primary display, or start it as a different user.

When you are done, stop the VNC server with the present-kill script.

New Content: Nepal and Dachstein

Fri, 16 Mar 2007 18:29:15 GMT

A week ago, I returned from a trekking trip in the Solukhumbu region of Nepal. The pictures can be found in the following photo sets:

And with a little delay, I finished a page about the hikes I did in Austria's Dachstein region in 2004: Dachstein

UMTS Image Compression

Fri, 05 Jan 2007 16:39:54 GMT

If you use Vodafone's UMTS service in Germany, you have probably noticed that JPEG images are compressed in low-quality mode. This is done by a transparent HTTP proxy, and there is no obvious way around it. Apart from very poor image quality, you might see messages about IP address 1.2.3.4 in your browser's status bar, and pop-ups advising you to press Ctrl+F5 to improve image quality.

2x magnified original and re-compressed JPEG image

The software that does this is provided by Bytemobile, and is used by other phone companies.

For MS Windows, the Vodafone HighPerformance Client apparently allows you to change the compression settings, but if you use Linux, you are on your own.

Fortunately, it is pretty easy to convince the Bytemobile proxy to stop messing around with your images. All that is needed is contained in a small Perl script, which sends a magic byte sequence to the proxy. As long as the script is running, compression is turned off.

The magic bytes should be the same as the ones sent by the HighPerformance Client, but use the script at your own risk.

Nautilus Identifying OpenOffice Documents as Java Archives

Mon, 25 Dec 2006 11:25:59 GMT

After installing the Java 6 RPM on Fedora Core (jdk-1.6.0-fcs), Nautilus prints the following error when you try to open an OpenOffice document:

The filename "Report.sxw" indicates that this file is of type "OpenOffice Writer". The contents of the file indicate that the file is of type "Java Archive". If you open this file, the file might present a security risk to your system.

This is because the file /usr/share/mime/packages/x-java-archive.xml that is created by the Java RPM is broken. To fix it, add a "<" in front of the second "match" tag:

--- x-java-archive.xml.orig     2006-12-24 14:47:05.000000000 +0100
+++ x-java-archive.xml  2006-12-25 11:57:03.000000000 +0100
@@ -32,7 +32,7 @@
     <glob pattern="*.jar"/>
     <magic priority="85">
       <match type="string" value="PK\003\004" offset="0">
-       match type="host16" value="0xcafe" offset="40" />
+       <match type="host16" value="0xcafe" offset="40" />
       </match>
     </magic>
   </mime-type>

Then run the following command:

update-mime-database /usr/share/mime

Log out and log in again to restart Nautilus.

Update 12 Jan 2007: This has been filed as ticket 6510610 in Sun's Bug Database.

Update 7 Jul 2007: The bug has been fixed in Java 6 Update 2.

Linux and the iriver T10

Tue, 12 Dec 2006 16:44:21 GMT

A while back I bought an iriver T10 music player. For the next months, I had to use gPhoto to upload audio files from Linux to the T10. Only because someone decided to use Microsoft's Media Transfer Protocol (MTP), instead of the good old USB Mass Storage protocol (UMS).

My gPhoto setup broke when I upgraded to Fedora Core 6, so I searched around, and found that iriver had released new firmware to replace MTP with UMS. The firmware updater requires Windows to run, but after using it, I finally can access the T10 like any other USB storage device under Linux.