offlineimap allows you to keep a local copy of your emails, and synchronize it with the IMAP folders on the server. Not only handy for offline use, but also for dealing with slow mail servers and unreliable network connections.

Unfortunately, offlineimap exits with an error from time to time and needs to be restarted. The restarts are easily done with a script, but each time you restart it, offlineimap requires the IMAP server's password. offlineimap allows you to store the unencrypted password in a file, but that should not be an option if you care about security.

On Fedora 9, there's a better way to hand the password to offlineimap: gnome-keyring

First, install the Python bindings for gnome-keyring:

yum install gnome-python2-gnomekeyring

Download the file ~/.offlineimap.py and add the following settings in ~/.offlineimaprc. This assumes that you use a local IMAP server.

[general]

pythonfile = ~/.offlineimap.py

[Repository localhost]

type = IMAP
remotehost = localhost
remoteusereval = get_username("localhost")
remotepasseval = get_password("localhost")

[Repository Zimbra]

type = IMAP
remotehost = mail.example.com
remoteusereval = get_username("mail.example.com")
remotepasseval = get_password("mail.example.com")

Download the script imap-passwords and run it to add the IMAP usernames and passwords to your keyring. It will prompt you for server, username and password - use the same host names as in .offlineimaprc.

Now you can run offlineimap in a loop to automatically restart it in the case of some unrecoverable error, like so:

#!/bin/bash

while true; do
  /usr/bin/offlineimap
  echo Restarting in 60 seconds ...
  sleep 60
done

During the first run, gnome-keyring will ask you to authorize offlineimap to access your IMAP authentication data in the default keyring.

Thanks to Sebastian Rittau for the Keyring Python module.

Fedora 7 on a Dell D800 requires a little work to get suspend/resume working. The default configuration causes it to freeze during the resume, with the shift and scroll lock LEDs blinking.

The following has been tested with kernel-2.6.22.9-91.fc7 and NVIDIA-Linux-x86-100.14.19 on a Dell Latitude D800 with GeForce FX Go5200 graphics.

1. If you use the binary-only nvidia driver, append "agp=off" to the kernel line in /etc/grub.conf. This disables the built-in AGP driver and allows nvidia to load its own.

   kernel /vmlinuz-2.6.22.9-91.fc7 ro root=/dev/vg1/root quiet agp=off
   

2. Edit /etc/X11/xorg.conf and set the NvAGP option:

   Section "Device"
       ...
       Driver         "nvidia"
       Option         "NvAGP" "1"
   EndSection
   

3. Reboot, log in and check if the nvidia AGP driver is used:

   # cat /proc/driver/nvidia/agp/status
   Status:          Enabled
   Driver:          NVIDIA
   

4. Create /etc/pm/config.d/unload_modules with the following content:

   SUSPEND_MODULES="uhci_hcd"
   

   Create /etc/pm/config.d/nvidia with the following content:

   DISPLAY_QUIRK_VBE_POST=false
   

   Make the files executable with

   chmod +x /etc/pm/config.d/unload_modules /etc/pm/config.d/nvidia
   

Suspend and resume should work now.

After upgrading to Fedora 7, my Vodafone 3G Datacard (the old UMTS PCMCIA adapter) stopped working. Here's what I had to do to make it work again.

Create /etc/udev/rules.d/48-UMTS.rules with the following content:

BUS=="usb", KERNEL=="ttyUSB0", SYSFS{interface}=="Data Interface", SYMLINK+="umts", \
  RUN+="/usr/bin/wvdial --config /etc/wvdial-pin.conf"
BUS=="usb", KERNEL=="ttyUSB2", SYSFS{interface}=="Data Interface", SYMLINK+="gsm"

The wvdial configuration for setting the PIN is stored in /etc/wvdial-pin.conf. Replace "1234" with your own PIN.

Modem = /dev/umts
Baud = 460800
SetVolume = 0
Dial Command = ATDT
FlowControl = NOFLOW
Init1 = ATZ
Init2 = AT+CPIN="1234"

/etc/wvdial.conf contains the settings for establishing an UMTS connection:

[ModemUMTS]
Modem = /dev/umts
Baud = 460800
SetVolume = 0
Dial Command = ATDT
Init1 = ATZ
Init2 = ATM0
Init3 = ATM0
FlowControl = NOFLOW
[Dialer umts]
Username = VFD2
Password = WAP
Phone = *99***1#
Stupid Mode = 1
Init1 = ATZ
Init2 = ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0
Init3 = AT+CGDCONT=1,"IP","web.vodafone.de"
Inherits = ModemUMTS

Next, we need to configure a network interface. Put this into /etc/sysconfig/network-scripts/ifcfg-umts:

IPV6INIT=no
ONBOOT=no
USERCTL=yes
PEERDNS=yes
TYPE=Modem
DEVICE=ppp0
BOOTPROTO=dialup
LINESPEED=460800
MODEMPORT=/dev/umts
IDLETIMEOUT=300
PROVIDER=umts
DEFROUTE=yes
PERSIST=no
WVDIALSECT=umts
MODEMNAME=ModemUMTS
DEMAND=no
PAPNAME=VFD2
AC=off
BSDCOMP=off
VJCCOMP=off
CCP=off
PC=off
VJ=off

This configuration has to be made available at two other locations:

ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/devices/ifcfg-umts
ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/profiles/default/ifcfg-umts

Now, tell PPP about the connection in /etc/ppp/peers/umts:

connect "/usr/bin/wvdial --remotename umts --chat 'umts'"

In /etc/ppp/peers/chap-secrets and pap-secrets, append this line at the end:

"VFD2"  *       "WAP"

SELinux prevents udev from running wvdial, and initialization of the PIN fails. To get around this, create /tmp/udevwvdial.te:

module udevwvdial 1.0;

require {
        type var_lock_t;
        type udev_t;
        class dir { write remove_name add_name };
        class file { write read create unlink };
}

allow udev_t var_lock_t:dir { write remove_name add_name };
allow udev_t var_lock_t:file { write read create unlink };

Compile and load the SELinux module.

checkmodule -M -m -o udevwvdial.mod udevwvdial.te
semodule_package -o udevwvdial.pp -m udevwvdial.mod
semodule -i udevwvdial.pp

The semodule command stores the module in /etc/selinux, so it will stay active when you reboot.

You should now be able to establish a connection with ifup umts and terminate it with ifdown umts. When the card switches between UMTS and GPS, the connection attempt may time out, so retry before checking the configuration files.

If you carry around business information on your laptop, it's a good idea to encrypt /tmp and the swap volume, and not only your home directory. You could already do this with a little scripting on Fedora Core 6. With Fedora 7, it got a little easier. First, create /etc/crypttab with the following content:

swap    /dev/vg1/swap   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256
tmp     /dev/vg1/tmp    /dev/urandom    tmp,cipher=aes-cbc-essiv:sha256

In /etc/fstab you only list the swap volume:

/dev/mapper/swap        none            swap    defaults        0 0

Because the encrypted volumes are created after /etc/fstab is processed, the following script has to take care of mounting /tmp:

#!/bin/bash
#
# cryptotmp setup crypted tmp partition
#
# chkconfig: 2345 01 90
# description: adds crypted tmp partition.

. /etc/init.d/functions

# See how we were called.
case "$1" in
    start)
        mount /dev/mapper/tmp /tmp
        restorecon /tmp

        action "Adding encrypted tmp"

        touch /var/lock/subsys/cryptotmp
        ;;
    stop)
        rm -f /var/lock/subsys/cryptotmp
        ;;
    *)
        echo $"Usage: $0 {start|stop}"
        exit 1
esac

exit 0

Save it as /etc/init.d/cryptotmp and run

chmod +x /etc/init.d/cryptotmp
chkconfig --add cryptotmp

When the system boots, it overwrites the contents of /dev/vg1/swap and /dev/vg1/tmp, using a random key for encryption. Once the system shuts down, the content will no longer be accessible, as the encryption key is not stored anywhere.

Warning: The above configuration erases /dev/vg1/swap and /dev/vg1/tmp when the system boots. Files stored in /tmp are lost when the system is shut down. Also, suspend to disk does not work with an encrypted swap volume.

Some time ago I described how to put presentations on a projector with a Linux notebook with two X displays. In the meantime, I have switched to a Dell D800 with NVIDIA TwinView. I still do presentations where I want the image from the projector in a window on the LCD, without showing my whole desktop. Here's how to do it.

After setting the TwinView parameters in xorg.conf, configure VNC's ~/.vnc/xstartup to start the Metacity window manager and a gnome-terminal.

All you need then is the present script to start the VNC server and clients. Drag the view-only VNC window to the right, adjust its position so the title bar is not visible (Alt + left mouse button), and you can start your presentation in the second VNC window. To use Firefox, you either need to quit it on your primary display, or start it as a different user.

When you are done, stop the VNC server with the present-kill script.

If you use Vodafone's UMTS service in Germany, you have probably noticed that JPEG images are compressed in low-quality mode. This is done by a transparent HTTP proxy, and there is no obvious way around it. Apart from very poor image quality, you might see messages about IP address 1.2.3.4 in your browser's status bar, and pop-ups advising you to press Ctrl+F5 to improve image quality.

The software that does this is provided by Bytemobile, and is used by other phone companies.

For MS Windows, the Vodafone HighPerformance Client apparently allows you to change the compression settings, but if you use Linux, you are on your own.

Fortunately, it is pretty easy to convince the Bytemobile proxy to stop messing around with your images. All that is needed is contained in a small Perl script, which sends a magic byte sequence to the proxy. As long as the script is running, compression is turned off.

The magic bytes should be the same as the ones sent by the HighPerformance Client, but use the script at your own risk.

After installing the Java 6 RPM on Fedora Core (jdk-1.6.0-fcs), Nautilus prints the following error when you try to open an OpenOffice document:

The filename "Report.sxw" indicates that this file is of type "OpenOffice Writer". The contents of the file indicate that the file is of type "Java Archive". If you open this file, the file might present a security risk to your system.

This is because the file /usr/share/mime/packages/x-java-archive.xml that is created by the Java RPM is broken. To fix it, add a "<" in front of the second "match" tag:

--- x-java-archive.xml.orig     2006-12-24 14:47:05.000000000 +0100
+++ x-java-archive.xml  2006-12-25 11:57:03.000000000 +0100
@@ -32,7 +32,7 @@
     <glob pattern="*.jar"/>
     <magic priority="85">
       <match type="string" value="PK\003\004" offset="0">
-       match type="host16" value="0xcafe" offset="40" />
+       <match type="host16" value="0xcafe" offset="40" />
       </match>
     </magic>
   </mime-type>

Then run the following command:

update-mime-database /usr/share/mime

Log out and log in again to restart Nautilus.

Update 12 Jan 2007: This has been filed as ticket 6510610 in Sun's Bug Database.

Update 7 Jul 2007: The bug has been fixed in Java 6 Update 2.

A while back I bought an iriver T10 music player. For the next months, I had to use gPhoto to upload audio files from Linux to the T10. Only because someone decided to use Microsoft's Media Transfer Protocol (MTP), instead of the good old USB Mass Storage protocol (UMS).

My gPhoto setup broke when I upgraded to Fedora Core 6, so I searched around, and found that iriver had released new firmware to replace MTP with UMS. The firmware updater requires Windows to run, but after using it, I finally can access the T10 like any other USB storage device under Linux.

Despite its name, POPFile can sort mails using a couple of protocols, including IMAP. It monitors a configurable list of IMAP folders (usually your inbox), classifies the mails with a Bayesian algorithm, and moves them to one of the target IMAP folders. If the classification was wrong, just move the mail to the correct folder in your email client, and POPFile will learn from its mistakes.

POPFile has been sorting my mail into four folders named 00todo, 01important, 02later and 03trash for the last week. It now has an accuracy of 78%, and is especially good at getting rid of mailing list threads which I am not interested in.

Installation instructions for Linux, Mac OS X and MS Windows can be found on the QuickStart page. While the IMAP module is labelled as experimental, I did not have any problems with it so far. Contrary to the ImapInstructions, it comes with the standard installation of version 0.22.4. So skip the first part of the page, and start with the "How to get it running" section.

Update 15 Jun 2007: See Dell Latitude D800 Suspend to RAM with Fedora 7 for an updated version of this article.

Suspend to RAM on my Dell Latitude D800 just works with Fedora Core 5 and the free nv driver. Suspend also works with the binary-only nvidia driver, but the display either stays black or shows some fascinating color patterns after resume.

It turns out that fixing this is easy, and well worth it. The nvidia driver not only gives you 3D support, but also feels faster when switching tabs in Firefox.

The following has been tested with kernel-2.6.17-1.2174_FC5 and NVIDIA-Linux-x86-1.0-8774 on a Dell Latitude D800 with a GeForce FX Go5200.

As described in the nV News Forum, the following has to be done:

1. Append "agp=off" to the kernel line in /etc/grub.conf. This disables the built-in AGP driver and allows nvidia to load its own.

   kernel /vmlinuz-2.6.17-1.2174_FC5 ro root=/dev/vg1/root quiet agp=off

2. Edit /etc/X11/xorg.conf and set the NvAGP option:

   Section "Device"
       ...
       Driver         "nvidia"
       Option         "NvAGP" "1"
   EndSection
   	

3. Edit /etc/pm/functions-nvidia and disable the "vbetool post" call:

   resume_video()
   {
   	...
   #       /usr/sbin/vbetool post
           ...
   }
   	

4. Reboot, log in and check if the nvidia AGP driver is used:

   # cat /proc/driver/nvidia/agp/status
   Status:          Enabled
   Driver:          NVIDIA
   	

Suspend and resume should work now.

Avi Alkalay has written a great document on optimal use of fonts on Linux. Following his instructions, it is easy to get high-quality TrueType fonts on your screen with Fedore Core 5.

First, decide if you want to replace the freetype package with a version in which the Bytecode Interpreter (BCI) is enabled. There may be legal issues with this in your country - see the Freetype page on patents for more information.

Below is a side-by-side screenshot, done with the same TrueType fonts, but with BCI disabled (left) and BCI enabled (right).

The Fedora 7 freetype package with BCI can be found here. For other distributions, see Get a Better FreeType RPM. And don't forget to restart your X server after upgrading the RPM.

The next thing you need is a set of TrueType fonts, like the Webcore Fonts. Before downloading the RPM, be sure to read the legal notice on Avi's page.

All that remains is to configure Gnome, KDE, Firefox, Thunderbird and OpenOffice to use your shiny new fonts. Step-by-step instructions can be found in Configure Your Desktop.

Update 6 Jul 2006: One thing to note when configuring Thunderbird is that it has a list of separate font settings. The default "Western" font setting is only used for mails encoded with ISO-8859. To get the same fonts for UTF8 mails, you have to set the fonts for "Other Languages".

I currently spend most of my time in a corporate network where I have to use a proxy auto-config (.pac) file.

For some time I have been bothered by Firefox 1.0 and 1.5 shortly freezing for no apparent reason. I tried to disable all extensions, removed the Flash and Java plugins, but to no avail. Today, I accessed a domain with a defunct DNS server and Firefox froze for more than just a short moment, giving me an opportunity to track down the problem.

It turns out that this is a known issue, described in Bugzilla #208287. The .pac file I use contains something like this:

for (i = 0; i < cDirectIPs; i += 2)
  if (isInNet(host, DirectIPs[i], DirectIPs[i + 1]))
    return "DIRECT";
  }
return "PROXY 10.0.0.1:3128;";

isInNet(host, NET1, NET2) checks if the host name from the HTTP request is part of numerical subnet 1 or subnet 2. And this is done 16 times for every single HTTP request in this .pac file.

Even one call to isInNet() can be fatal for Firefox. If the DNS server for the host name is not reachable, the call will only time out after a couple of seconds. And during this time, Firefox will be completely unresponsive. No display updates, no response to keyboard or mouse input.

Bottom line: isInNet() should not be used with Firefox, until someone works on Bugzilla #208287.

Last week, I visited the 22nd Chaos Communication Congress in Berlin. One of the presentations was about Bluetooth hacking. My Dell Latitude D800 laptop was suspended and stowed away in my backpack, but during one of the live demonstrations, its corporate Intranet name appeared on the presentation screens. As indicated by the blue light, Bluetooth is still active on the D800 even in suspended mode. And I didn't bother to change the default configuration.

While the laptop didn't get hacked, I prefer to not broadcast the company and office I work for while walking around. If you use the bluez-utils RPM, this can be prevented by changing the default /etc/bluetooth/hcid.conf as follows:

# Default settings for HCI devices
device {
    ...
    # Local device name
    name "foobar";
    ...
    # Inquiry and Page scan
    iscan disable; pscan enable;
    ...
}

The default name is "%h-%d", which is the host name and device ID. Depending on your network configuration, this can reveal quite a lot about where you come from. Also, inquiry scans are enabled by default, so anyone can detect the name of your Bluetooth device.

After you have changed the configuration options, run service bluetooth restart to active them.

The Compaq nx6125 is a relatively inexpensive laptop with an AMD CPU and ATI chipset. If you try to install Linux with a kernel <= 2.6.9, you will encounter some problems. Here's how I made Red Hat Enterprise Linux 4 work on this laptop.

The first thing you'll see is a frozen progress bar when the installer formats the hard disk. Switching to a virtual console (Ctrl+Alt F2) and running hdparm -tT /dev/hda shows that the installer has not stopped, but that the disk gives you a whopping buffered read speed of 350 KB/sec. hdparm /dev/hda further reveals that DMA is not used, and hdparm -d 1 /dev/hda tells you that you are not allowed to activate DMA.

The reason for this is the ATI chipset, and in particular the IDE controller. Older kernels do not support the IDE controller yet. While there is a generic IDE driver, the kernel doesn't use that either, because some older controllers say they support it, and promptly crash when confronted with generic commands.

While the kernel contains a list of IDE controllers which work in generic mode, hardware vendors do not always announce new controllers in advance. But there is a solution: At the boot prompt, just add the kernel option all-generic-ide, which although fairly recent, is present in the RHEL4 U2 kernel.

With this, installation works, but the machine feels a little slow. top shows a 50% CPU utilization by soft interrupts ("si"), and you might notice that the wall time clock runs about twice as fast as it should. To fix this, add the kernel options "noapic nolapic", which disable the advanced programmable interrupt controller. Not using the APIC hurts performance a bit, but not to noticable degree.

That seemed to be the last problem, until one of the developers started a long compile run on his laptop. The machine froze for a minute and then continued as if nothing had happened. ls -ltr /var/log pointed to a temperature-related message in /var/log/acpid.

watch "cat /proc/acpi/thermal_zone/*/temperature" showed a temperature well above 70C during another compile run, and the CPU had probably been forced to stop previously to prevent permanent damage.

Instead of returning the laptops to the vendor, we put the following into /etc/cpuspeed.conf:

VMAJOR=1
VMINOR=1
DRIVER="powernow-k8"
OPTS="$OPTS -n -i 1 -t /proc/acpi/thermal_zone/TZ1/temperature 70"
    

This sets the right driver for the AMD CPU, and tells cpuspeed to slow things down when the temperature gets above 70C. Another performance hit, but it works.

Some time ago, I replaced my old IBM Thinkpad with a Dell notebook that has an Intel IPW2200 wireless network card inside. With that, I lost the ability to monitor wireless networks with Kismet.

But as Patrick Olsen describes in "ipw2200 driver install on Fedora Core 4", the latest versions of the IPW2200 driver and Kismet work together just fine. Installation is even easier than described by Patrick - you do not need the kernel source. The only thing to look out for is to first remove old versions of ieee80211 and ipw2200 with the remove-old script from each package, and then compile and install ieee80211 and ipw2200 in that order. Also, the current version of ieee80211 has trouble deleting two directories in /lib/modules, so I manually moved include/config/ieee80211 and drivers/net/wireless/ieee80211 about which it complained out of the way.

On my Dell D800, the source setting for Kismet is ipw2200,dev30359,ipw2200, where dev30359 is the same interface name displayed by iwconfig.

This week, a buffer overflow vulnerability has been discovered in Adobe Reader 5.0.10. For Linux users, the only fix is an upgrade to version 7.

Unfortunately, Adobe Reader 7 can execute Javascript inside PDF documents, which is used by some authors to track readers. Javascript can be disabled with the menu item Edit - Preferences - JavaScript, but everytime you exit Acrobat Reader, it will ask you to reenable Javascript. To get rid of this annoying warning, do the following:

cd ~/.adobe/Acrobat/7.0/JavaScripts
rm glob.settings.js
ln -s /dev/null glob.settings.js

Update 11 Jul 2005: After upgrading from Adobe Reader 5 to 7, you also need to change your Mozilla or Firefox configuration. Instructions for Fedora Core can be found in the Fedora Core 4 Linux Installation Notes.

Today, I discovered a gem added to the 2.6.9 Linux kernel by Intel engineer Venkatesh Pallipadi: the Ondemand cpufreq governor. This kernel module uses the Enhanced SpeedStep Technology available with Pentium M processors to rapidly change the CPU speed, based on current load.

cpuspeed does the same thing, but takes noticeably longer to reach the maximum speed, and also waits longer before slowing down again. X applications feel much faster with Ondemand, and my guess is that battery life will be slightly better.

So if you have an Intel CPU with Enhanced SpeedStep Technology and want to give Ondemand a try, stop any running cpufreq daemons, like cpuspeed or cpudyn, and run the following commands. Note that I have only tested this on Fedora Core 3 with the 2.6.11-1.14_FC3 kernel.

/sbin/modprobe cpufreq_ondemand
echo ondemand > /sys/devices/system/cpu/*/cpufreq/scaling_governor

You can then start

watch -n 1 cat /sys/devices/system/cpu/*/cpufreq/scaling_cur_freq

in a terminal window, and run some X application to see how Ondemand changes the CPU speed.

To permanently install Ondemand, make sure that the cpuspeed service is turned off, and add the above modprobe and echo commands to /etc/rc.d/rc.local.

If you want to switch back to cpuspeed for some reason, you can deactivate Ondemand by running

echo userspace > /sys/devices/system/cpu/*/cpufreq/scaling_governor

Update 14 Apr 2006: This also works with Fedora Core 5.

Ever got I/O errors on CDs burned with cdrecord under Linux, although you were 100% sure the ISO image and the CD medium was OK?

I had that experience yesterday, while on-site at a customer. The I/O errors always occurred at the end of the burned CD, when I ran md5sum /dev/cdrom.

Today, I found this in the cdrecord manual:

-raw96r: This is the preferred raw writing mode as it gives best control over the CD writing process. [...] There are several CD writers with bad firmware that result in broken disks when writing in TAO or SAO mode.

I guess the Samsung CDRW/DVD SN-324S, revision U303, which came with my Dell Latitude D800, is one of them. Running cdrecord with the -raw96r option results in perfectly readable CDs with correct MD5 digests.

Interestingly enough, we had the same problem on the customer's IBM notebook running Nero under MS Windows.

Update 15 Jun 2007: See Dell Latitude D800 Suspend to RAM with Fedora 7 for an updated version of this article.

With a 1-day delay of my Air France flight to Paris, I had enough time to fix suspend to RAM on my new Dell Latitude D800 under Fedora Core 3.

The following assumes that your D800 contains an NVIDIA graphics card, a Broadcom ethernet adapter, and an Intel PRO/Wireless 2200 adapter.

As noted in Aram Kananov's How To, you first need to replace the nv driver with NVIDIA's nvidia driver. The setup is described in the README that is part of the driver package.

Next, you need a script to remove certain modules before entering suspend mode, and for reloading those modules afterwards. Place the following in /etc/acpi/actions/suspend2mem.sh - credits for the original version go to Tomislav Vujec:

#!/bin/sh

PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
export PATH

# The synergyc process would block the unloading
# of the ethernet module, so we kill it.
killall synergyc

# Unmount all network filesystems
service netfs stop

# Stop local networking
service network stop

# Disable network modules
rmmod tg3
rmmod ipw2200
rmmod ieee80211
rmmod ieee80211_crypt

# Disable USB modules
rmmod usb_storage
rmmod uhci_hcd
rmmod ehci_hcd

# Preventive sync
sync

# Suspend
echo mem > /sys/power/state

# Come back...

# Resync clock
hwclock --hctosys

# Reenable USB
modprobe uhci_hcd
modprobe ehci_hcd

# Reenable network modules
modprobe tg3
modprobe ipw2200

# Start local networking
service network start

# Mount all network filesystems
service netfs start

To make ACPI use this script when you press Fn+Esc, put this into /etc/acpi/events/sleep:

event=button/sleep.*
action=/etc/acpi/actions/suspend2mem.sh

Now, don't press Fn+Esc yet. As noted in Appendix S of the NVIDIA driver README, the 2.6 kernel AGP driver has problems when waking up from a suspend. So, save everything and try Fn+Esc, but don't be surprised if X won't come back.

To test if the AGP driver is the culprit, add the following line in the "Driver" section of /etc/X11/xorg.conf:

Option      "NvAgp" "0"

Restart your X server, and try suspend+resume again. If it works now, you should compile a custom kernel to disable the kernel AGP driver.

If suspend doesn't work, look into /var/log/messages, and search for "Stopping tasks". This sometimes fails for some processes, which you then have to kill in the suspend2mem.sh script. Other processes, like Synergy2, can block the unloading of network modules, so they too have to be killed.

Install the kernel source RPM with up2date --get-source kernel, or download it from one of the Fedora mirrors. Go to /usr/src/redhat/SPECS, and generate the patched kernel source with rpmbuild -bp --target=i686 kernel-2.6.spec.

Afterwards, the source is in /usr/src/redhat/BUILD/kernel-2.6.10/linux-2.6.10. Configure it to compile the AGP drivers as modules - the easiest way to do this is to remove all lines starting with "CONFIG_AGP" from .config. Build and install the kernel with make modules bzImage modules_install install.

If you need special drivers or LVM to mount your root filesystem, don't forget to run mkinitrd. You also have to reinstall the NVIDIA driver for the new kernel.

In /etc/X11/xorg.conf, change the NvAgp option to "1", to activate NVIDIA's internal AGP support.

I found no clean way to disable the kernel AGP driver, so I just renamed /lib/modules/2.6.10-prep/kernel/drivers/char/agp/intel_agp.ko to intel_agp.ko.disabled.

When you now start X, and look at /proc/driver/nvidia/agp/status, you should see that the NVIDIA AGP driver is used, and suspend+resume should work.

Yet another round of fun with USB under Fedora Core 3. This time, I brought home an Epson Stylus CX6600 printer/scanner/copier.

The printer part of it was easy to set up with the Printing system settings. There is no driver for the CX6600 yet, but the CX6400 driver works just fine.

Before I was able to use the scanner, I had to fix the usual permissioning problem, because only root has access to the scanner by default. Following the ideas in Karl Heinz Kremer's SANE Epson HowTo, I added the following line in /etc/hotplug/usb/libsane.usermap, which is part of the sane-backends RPM:

libusbscanner 0x0003 0x04b8 0x0813 \
  0x0000 0x0000 0x00 0x00 0x00 \
  0x00 0x00 0x00 0x00000000

This has to be entered as one line without the backslashes. The second and third hexadecimal numbers can be found by running lsusb, the 0x0003 at the start and the zeros at the end are identical for all device entries.

With this line, hotplug invokes the script /etc/hotplug/usb/libusbscanner whenever the Epson CX6600 is connected or disconnected, and gives the currently logged-in user access to the USB device.

This would already be enough for using the scanner with the excellent VueScan. If you want to use it with SANE, you'll have to add the following line in /etc/sane.d/epson.conf:

usb 0x04b8 0x0813

Before doing this, you can run sane-find-scanner to check if your version of SANE detects the scanner. Afterwards, scanimage -L should list an "Epson Unknown model flatbed scanner".

What follows is a short tale about how to recover digital photos from a broken hard disk under Linux.

When I returned from a short vacation this week, one of the hard disks reported read errors for the Reiser filesystem superblock. And while I had multiple backups of all valueable data, my digital photos were only stored on this hard disk.

To add insult to injury, I noticed that I had deliberately switched off a SMART warning some months ago: for the "offline uncorrectable sector count". I had ignored this early warning sign because further SMART offline tests returned a count of zero.

After running badblocks for a while, it looked like only two small areas at the start of the disk were damaged.

Not wanting to take any more risks, I bought another 160GB hard disk, and copied the whole disk:

dd if=/dev/hdb of=/dev/hdc bs=512 count=65536 conv=noerror,sync
dd if=/dev/hdb of=/dev/hdc bs=4096 skip=8192 conv=noerror,sync

The conv parameters ensure that read errors on /dev/hdb are ignored, and that any data missing due to these errors is replaced with null bytes. Because I hoped that there were no errors after the first 32 MB, I used a larger block size for the second run, to speed up dd.

While all blocks after the first 32 MB were indeed readable, the disk grew hot, and only delivered 2.5 MB per second. This gave me 18 hours to plan the next steps.

First, I ran reiserfsck. The superblock was gone, so I had to use the --rebuild-sb parameter. Didn't help much, so --rebuild-tree was next. After that, I saw some familiar directories and filenames, but looking at the content of those files did not turn up a single of my photos.

So, do what special agents do, and use some forensic tool for evidence recovery. Reading the list from the Knoppix Security Tools Distribution, I first tried foremost, but found that it was unusable for 2.5 MB digital photos, because its memory consumption grew exponentially with the size of searched files. The next tool was photorec, a tool specifically written "to recover pictures from digital camera memory".

As with all filesystem-agnostic tools, it cannot deal with fragmented files, but it recovered almost 90% of my photos. Its usage is pretty simple, as it has a text-based UI. The recovered files are stored in a directory named recup_dir, which is created in the current working directory.

The only problem I had with photorec was that it sometimes did not find the end marker for a file type before it had copied a few hundred MB. And it seems that it looks for that start marker in areas which it already has copied to a file, because I ended up with more data than I could store.

Telling photorec to only scan a specific area of a disk is not possible, but one can use fdisk for that. Changing the partition table of an unmounted disk which you don't plan to write to does not erase any data, except for the old partition table. So I created a couple of partitions, ran photorec on one of them, sorted out the good data, and moved on to the next partition.

Now, I have two hard disks connected to two different IDE channels, housed in fan-cooled aluminium docking bays. I use software RAID level 1 to mirror my data, and I have set up multiple smaller partitions with LVM so I don't ever have to shift through the whole disk when a few thousand bytes disappear. And of course I have included my photos in my backup process.

Setting up RAID and LVM and copying an existing Fedora Core 3 installation to the new disks was pretty easy. The only tricky part was that I use LVM for the root partition (not recommended). To make this work you just have to create a new initial RAM disk with mkinitrd, as the RAM disks from the kernel RPMs do not contain the necessary LVM stuff.

Update 20 Jan 2005: The initial RAM disk is not part of the kernel RPM, but is created when you install the kernel on your machine. So if /etc/fstab already points to an LVM root partition during a kernel upgrade, there is no need to created a custom RAM disk.

Installing the Web application framework Rails on Fedora Core 3 is not as straightforward as the instructions suggest. FC3 comes with the required Ruby 1.8.1 RPM, but if you try to install Rails with Ruby Gems, it crashes with the error /usr/lib/ruby/1.8/yaml.rb:39: [BUG] Segmentation fault.

So, deinstall the ruby and ruby-libs RPMs, and install Ruby and Gem from the source:

1. Download Ruby 1.8.2+. Install it with ./configure && make && make install

2. Download rubygems 0.8.1+. Install it with ruby install.rb

Update 29 Jan 2005: The new Ruby 1.8.2 RPM in the FC3 update channel can be used to install Rails. Just be sure to also install irb and ruby-devel. The latter is needed for installing the Ruby PostgreSQL driver, and probably other database drivers.

Update 14 Jun 2007: This article has been rewritten for Fedora 7. See Vodafone UMTS with Fedora 7.

I got a new toy today - a Vodafone 3G Datacard, which is a UMTS PCMCIA adapter. There are a couple of HowTo pages for it already, but I couldn't find one describing the complete setup for Fedora Core 3. Note that I have only tested this with the German Vodafone network.

In /etc/hotplug/usb, create the file umts.usermap with this content:

umts 0x03 0xaf0 0x5000 0 0 0 0 0 0 0 0 0

The vendor ID 0xaf0 and the product ID 0x5000 can be found in /proc/bus/usb/devices, searching for "Vodafone", once the card is plugged in.

In the same directory, create the file umts, which will initialize the PIN for the UMTS SIM card:

#!/bin/sh

if [ "${ACTION}" = "add" ]
then
    wvdial --config /etc/wvdial-pin.conf
fi

For the card to work, the usbserial module has to be loaded. I had some problems with getting the device node created the first time the card is detected, and with removing the module when the card is disconnected. Instead of trying to fix this with udev and hotplug, I just put the following into /etc/rc.d/rc.local:

/sbin/modprobe usbserial vendor=0xaf0 product=0x5000

# The first time the card is connected, the device node is created
# as /dev/0. So we create the right note manually if
# necessary.
test -e /dev/ttyUSB0 || mknod /dev/ttyUSB0 c 188 0

# Initialize the SIM PIN, in case the UMTS card is already plugged in.
# Otherwise, this will be done by /etc/hotplug/usb/umts.
wvdial --config /etc/wvdial-pin.conf >/dev/null 2>&1

Append the following to the end of /etc/wvdial.conf:

[ModemUMTS]
Modem = /dev/ttyUSB0
Baud = 460800
SetVolume = 0
Dial Command = ATDT
Init1 = ATZ
Init2 = ATM0
FlowControl = NOFLOW
[Dialer umts]
Username = VFD2
Password = WAP
Phone = *99***1#
Stupid Mode = 1
Init3 = AT+CGDCONT=1,"IP","web.vodafone.de"
Dial Attempts = 3
Inherits = ModemUMTS

Because the system-control-network utility will remove certain entries from /etc/wvdial.conf, I put the configuration for setting the PIN into a separate file, /etc/wvdial-pin.conf. Replace "1234" with your own PIN.

[Dialer Defaults]
Modem = /dev/ttyUSB0
Baud = 460800
SetVolume = 0
Dial Command = ATDT
FlowControl = NOFLOW
Init1 = ATZ
Init2 = ATM0
Init3 = AT+CPIN="1234"

Next, we need to configure a network interface. In /etc/sysconfig/network-scripts/ifcfg-umts, add this:

IPV6INIT=no
ONBOOT=no
USERCTL=yes
PEERDNS=yes
TYPE=Modem
DEVICE=ppp0
BOOTPROTO=dialup
LINESPEED=460800
MODEMPORT=/dev/ttyUSB0
IDLETIMEOUT=600
PROVIDER=umts
DEFROUTE=yes
PERSIST=no
WVDIALSECT=umts
MODEMNAME=ModemUMTS
DEMAND=no
PAPNAME=VFD2
AC=off
BSDCOMP=off
VJCCOMP=off
CCP=off
PC=off
VJ=off

This configuration has to be made available at two other locations:

ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/devices/ifcfg-umts
ln /etc/sysconfig/network-scripts/ifcfg-umts \
  /etc/sysconfig/networking/profiles/default/ifcfg-umts

The final three files are for configuring PPP. First, /etc/ppp/peers/umts:

connect "/usr/bin/wvdial --remotename umts --chat 'umts'"

In /etc/ppp/peers/chap-secrets and pap-secrets, append this line at the end:

"VFD2"  *       "WAP"

Now, either reboot your machine, or execute the commands you added to /etc/rc.d/rc.local. You should then be able to establish a connection with ifup umts and terminate it with ifdown umts. When the card switches between UMTS and GPS, the connection attempt may time out, so retry before checking the configuration files.

Update 14 Apr 2006: With Fedora Core 5, hotplug has become part of udev, so the configuration looks a bit different. Instead of /etc/hotplug/usb/umts.usermap, create the file /etc/udev/rules.d/48-UMTS.rules with the following content:

BUS=="usb", DRIVER=="option", SYSFS{interface}=="Data Interface", SYSFS{bInterfaceNumber}=="00", SYMLINK="umts", RUN+="/lib/udev/umts-pin.sh"
BUS=="usb", DRIVER=="option", SYSFS{interface}=="Data Interface", SYSFS{bInterfaceNumber}=="02", SYMLINK="gsm"

Create the script /lib/udev/umts-pin.sh:

#!/bin/bash

wvdial --config /etc/wvdial-pin.conf

You don't need the modifications in /etc/rc.d/rc.local any more, and you can replace "/dev/ttyUSB0" with "/dev/umts" in the other configuration files. The rest stays the same as on FC3.

Thanks to Patrick Ernzer for the new udev rule.

When I was in Paris last week, I not only had the opportunity to test my tips on how to use an IBM ThinkPad during a presentation, but I also faced the challenge of preparing the material for a three-day training on a tight schedule. I needed a tool for keeping track of new ideas and of the topics I had already covered, with spending as little time as possible on the organizing part.

A good tool for such a task is FreeMind, which organizes information in a "flexible" tree. Being a Java Swing application, its toolbars and menus look ugly, but this is made up by the keyboard shortcuts and mouse button actions. Information can be added, modified and moved around so easily and is displayed in such a nice way, that you can fully concentrate on being creative. And the Java Swing implementation has the advantage of working under Linux, Mac OS X and Windows.

The next thing I had to try was connecting my Palm to the Internet via Bluetooth, using Fedora Core 3. Thanks to this Usenet posting, it wasn't too hard.

The only Bluetooth adapter I have is in my IBM ThinkPad. It has to be switched on with a hardware button, so I first had to configure the Bluetooth services to be started whenever the device becomes available. After installing the bluez RPM packages, create the script /etc/hotplug/usb/hci_usb:

#!/bin/sh

if [ "${ACTION}" = "add" ] && [ -f "${DEVICE}" ]
then
 [ -e /var/lock/subsys/bluetooth ] || service bluetooth start
 [ -e /var/lock/subsys/dund ] || service dund start

 if [ "X$REMOVER" != "X" ]
 then
 cat >$REMOVER <<EOF
#!/bin/sh

[ -e /var/lock/subsys/dund ] && service dund stop
[ -e /var/lock/subsys/bluetooth ] && service bluetooth stop
EOF
 chmod +x $REMOVER
 fi
fi

Because the script is invoked for multiple devices, it has to check if the bluetooth and dund services are running or not. This only works if the bluetooth service is not started when the system boots, so we have to disable it:

service dund stop
service bluetooth stop
chkconfig dund off
chkconfig bluetooth off

As described in Blumf's posting, create /etc/ppp/peers/dun:

noauth
local
debug
115200
noipdefault
noipx
idle 0
ms-dns <DNS-SERVER-IP>
netmask 255.255.255.0

If you don't have a local DNS server, copy an IP address from /etc/resolv.conf after establishing your usual Internet connection.

In /etc/ppp/options.rfcomm1, the IP addresses of the PC and the Palm are given:

<PC_IP_ADDRESS>:<PALM_IP_ADDRESS>

In my network, I set the Palm IP address to 192.168.2.1.

Modify /etc/sysconfig/dund:

DUNDARGS='--listen --channel 1 call dun'

You also need to enable IP forwarding and masquerading. In /etc/sysctl.conf, set net.ipv4.ip_forward to "1". Run echo 1 >/proc/sys/net/ipv4/ip_forward to activate forwarding without a reboot.

In /etc/sysconfig/iptables, add these lines:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE 
COMMIT

For this to take effect, you have to run service iptables start.

On the Palm side, just follow Blumf's instructions:

1. In prefs/Bluetooth add your PC to the trusted device list. Pass key is found in /etc/bluetooth/pin, default is "BlueZ".
2. In prefs/Connection create a new entry. (Connect to: PC, Via: Bluetooth, Device $YOUR_PC)
3. In prefs/Network create a new service. (Username/password same as your normal linux login, Connection to whatever you created in the previous step, no need to change details)
4. Tap 'Connect', if all's well you should see the palm connecting. Check the end of /var/log/messages to see the ppp log.
5. Tap 'Disconnect'.

If you want to synchronize a USB Palm under Fedora Core 3, and don't want to spend hours reading about udev and hotplug, here's how to do it.

The problem with USB syncing a Palm under Fedore Core 3 is that the device file will not be created until you press the Hotsync button. And when it is created, it is only accessible by root.

This can be fixed by creating /etc/udev/rules.d/10-visor.rules with this content:

BUS=="usb", SYSFS{product}=="Palm Handheld*", KERNEL=="ttyUSB[13579]", SYMLINK+="pilot"

For detailed information on writing udev rules, see Daniel Drake's excellent document. To create the above rule, I pressed the Hotsync button, looked for the newest symlink in /sys/bus/usb/devices, and then examined the product file in the directory to which the symlink pointed. Because the product string had a trailing space on my computer, I added the "*" at the end. The check for the kernel device name "ttyUSB[13579]" is necessary because I use Card Export II, which lets me access the Palm's memory card as a USB drive. Card Export II also identifies itself as a "Palm Handheld" product, but with a different kernel device name. Tim Harper suggested to use "[13579]" in the device name. This is important because udev creates two subsequent, but more or less random ttyUSB devices, and only the one with the odd number works.

A simpler rule would match the kernel device name with KERNEL="ttyUSB1", but that would break if ttyUSB1 is occupied by some other toy when the Palm is connected.

As pointed out in the comments, it is not necessary to create a file in /etc/udev/permissions.d, because the configuration in /etc/security/console.perms takes care of setting the right permissions, once we have created the symlink /dev/pilot.

The rules.d file must have the given name so it is loaded before the default 50-udev.rules. Restarting udevd is not necessary for these changes to take effect.

If you use pilot-xfer to access your Palm, the following script allows you start it before pressing the Hotsync button.

#!/bin/sh

until [ -e /dev/pilot ]; do sleep 1; done
exec /usr/bin/pilot-xfer "$@"

During the last three weeks, I have set up Red Hat Enterprise Linux 4 on this server, watched Revolution OS and examined the kernel timeline to find out I must have started with Linux 0.99 in 1993, passed the Red Hat Certified Engineer exam, installed Fedora Core 3 on four machines, and I attend the RH423 course about Directory Services and Authentication this week.

In this course, I came across pam_ssh. When you work on multiple machines and use SSH to connect to them, using a public/private key pair for authentication is a great convenience. You no longer need to remember passwords for the different servers, but only the one for the private SSH key. And there is ssh-agent, which caches the private key, so you do not have to enter the password for every SSH login. Still, you do have to enter the password after login to your local machine.

Now, wouldn't it be cool if you could log in to your desktop machine, and never enter another password until you log out? That's where pam_ssh comes in. It hooks into the login process, asks you for the SSH password instead of your Unix account password, authenticates you and starts ssh-agent.

Configuring it is trivial if you know PAM. The instructions below assume that you use gdm for graphical login, but the process for kdm or xdm should be almost the same.

1. Save a copy of /etc/pam.d/gdm and make sure that you can log in on a text console before proceeding. Otherwise, you could easily lock yourself out.

2. Download and install pam_ssh, with the usual ./configure && make install

3. In /etc/pam.d/gdm, add this line before the line "auth required pam_stack.so service=system-auth":

   auth sufficient pam_ssh.so

   This will make gdm prompt for your SSH private key password, and if it is correct, authenticate you. Otherwise, it will proceed with the usual authentication, ie. ask for your Unix password.
   

4. At the end of /etc/pam.d/gdm, add this line:

   session optional pam_ssh.so

   This will set up ssh-agent after you have been authenticated.

5. On Fedora Core 3, the resulting /etc/pam.d/gdm should look like this:

   auth       required	pam_env.so
   auth	   sufficient   pam_ssh.so
   auth       required	pam_stack.so service=system-auth
   auth       required	pam_nologin.so
   account    required	pam_stack.so service=system-auth
   password   required	pam_stack.so service=system-auth
   session    required	pam_stack.so service=system-auth
   session    optional     pam_console.so
   session	   optional	pam_ssh.so
   

Update 11 Aug 2005: This also works with Fedora Core 4 x86_64, but only after manually installing the pam_ssh module. It is compiled for 64 bit, but installed in the 32 bit lib directory. To fix this, run the following command after make install:

mv /lib/security/pam_ssh.* /lib64/security

Update 14 Apr 2006: Fedora Core 5 comes with pam_ssh as one of the Extras RPMs. You still have to edit /etc/pam.d/gdm, though:

auth       required     pam_env.so
auth       sufficient   pam_ssh.so
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
session    include      system-auth
session    required     pam_loginuid.so
session    optional     pam_console.so
session    optional     pam_ssh.so

Update 26 Nov 2006: When using pam_mount to mount your encrypted home directory during login, put a copy of your SSH key into the unencrypted mount point (usually /home/USERNAME/.ssh). pam_ssh needs to access it before pam_mount does its work. With both pam_mount and pam_ssh, my FC6 /etc/pam.d/gdm looks like this:

auth       required    pam_env.so
auth       required    pam_mount.so
auth       sufficient  pam_ssh.so use_first_pass
auth       include     system-auth
account    required    pam_nologin.so
account    include     system-auth
password   include     system-auth
session    optional    pam_keyinit.so force revoke
session    include     system-auth
session    required    pam_loginuid.so
session    optional    pam_console.so
session    optional    pam_mount.so
session    optional    pam_ssh.so

When I did my first training with a Linux-powered IBM ThinkPad, I naively entered the training room, connected the beamer, and expected things to work. For the rest of the day, a quarter of my desktop was projected on the screen, while the rest was only visible on the laptop's LCD. Not too bad, because I could do a few things in the private area of the desktop. As long as I did not move the mouse.

The next day, I figured out the right order in which to switch on and connect the beamer and the laptop, and was able to use the full desktop, albeit with a scaled-down resolution. And I no longer had a private workspace.

Today, I found the solution on Alexander Wagner's ThinkPad page: A dual head setup for X, and VNC for controlling what gets sent to the beamer. The dual head setup (configuration file for X.org 6.7 and ThinkPad A31p) gives you two separate displays, one for external displays, and one for the LCD. Each with its own resolution, and set up so the mouse can move from one to the other.

Next, we need to install a rearview mirror on the laptop, to check the beamer display without turning our back on the audience. VNC gives us exactly that, with its ability to put a complete X display in a window which is then displayed on another X display, and also allowing us to have multiple windows showing the same VNC display. The present script (tested with Fedora Core 2 and the above X.org configuration) starts a VNC X server, displays it in fullscreen mode on the beamer display, and also opens it in a window on the LCD.

Update 27 Nov 2004: Preparing for another training next week, I noticed that there is a little problem with the dual-head setup, which may be caused by the upgrade to Fedora Core 3. When I boot with an external display connected, Fedora Core 3 hangs while starting the HAL daemon. And when I connect the external display after X has started, the external display gets the same screen resolution as the internal LCD. Solution:

1. Keep the external display disconnected while booting.
2. After the graphical login appears, change to a text console and log in as root.
3. Run "init 3", wait a bit, run "init 5".
4. Use the graphical login with your user account, and everything should be fine.