Categories
Uncategorized

KPrepublic XD87 TKL kit – Build Notes

So I built my first keyboard.

With so many options, I wanted something for my first build that was relatively available and accessible, so I landed on the KPrepublic XD87. Thankfully louwii has a wonderful build log documenting his build, which I used for the majority of my experience, however, I had a few items that tripped me up which may be useful for folks building this kit in the future.

Kit contents

I’ve heard that there are some advantages of purchasing from AliExpress rather than from the KPrepublic store, so that’s what I did. I did hear that the plate was back ordered and that it would take 1-2 weeks to restock, but six days later I received a shipment notice and 26 days after the original order I had boxes in hand.

Here’s exactly what I ordered:

I didn’t see how to specify the options for the kit when I placed the order, so I sent a chat message immediately after placing the order, and that seemed to work without incident. Also, don’t forget the stabilizers, as they’re not included and that’s strange.

Build Notes

The following will be more or less in the order that I encountered issues. Likely some of this was from lack of paying attention to louwii’s guide.

Soldering Iron

If you don’t have a soldering iron, the UY CHAN TS100 is fantastic. I had done a few smaller jobs with it, but for this assembly it was great.

RGB LEDs

My PCB came with the underglow RGB LEDs pre-soldered, which was helpful, but the reality is that the underglow effect is mostly non-existent with the current case design. I’m not young enough to be sold on all the RGB, so not a big deal for me.

Firmware

Firmware did not appear to be loaded out of the box, so I loaded something to at least make sure the LEDs were working.

USB Module

The kit came with a Type-C module pre-installed on the back case. I ended up unscrewing it so I could leave it attached to the PCB while I soldered everything.

USB Type-C Cable

The included USB Type-C cable is only a little over 15 inches long, which for my needs is less than practical. I’m going to be trying my hand at a sleeved and coiled cable in a few weeks.

Neat, but too short to be useful for me.

Initial Assembly Mistakes

Pay attention to the orientation of the stabilizers. I attempted to install them the wrong way around, and almost broke one of the stabs. If you’re pushing too hard (which I was) they’re likely the wrong way. Also, I didn’t see notes on the orientation of the stem so I had to sort that out by looking at the photos on AliExpress. The notched side should point towards the screw hole.

Stabilizer Installation Highlight
The notch on the inner stem ‘thing’ should face the screw hole.

Put the plate on BEFORE putting the switches in. I had built a Macro Pad from 1up Keyboards before that used PCB mounted switches, so I started right in mounting the switches for this build on the PCB and soldered a couple in place while wondering why it was sloppy. Don’t do what I did.

DON’T INSTALL A SWITCH NEXT TO THE ESC KEY. I did this twice, once before I put the plate on, and once again after. This was stated in louwii’s guide, but it’s easy to miss. I ended up putting tape over this spot and the other two locations to help me out because I’m an idiot.

Don’t be like me. Skip these switch locations.

Get a tool to remove switches, or pay attention to how they release from the plate. I didn’t have a tool and used pliers before I realized that the little tabs on the top and the bottom are what release things, almost breaking a few of the switches in the process. A small flathead screwdriver was what I used later on. An appropriate tool would have been better.

Backlight LEDs

I didn’t do the SIP socket route, so I soldered LEDs through the hole in the switch. Make sure that the longer leg of the LED (positive/anode) lines up to the square pad on each point, which typically is on the left if you’re looking at the front of the board, however, there are a few important exceptions which I’ll get to below.

As I installed these, I would insert the LEDs and bend the pins outward slightly to prevent them from falling out when I flipped the PCB over. Flip the board over, check and make sure the square pad has the longer leg, and then pin the LEDs in place with a little bit of solder on that square pad side.

Next I’d go back through with one hand on the LED (on the underside of the board now that it’s flipped over) and reheat that same pad with the iron in my right hand while pressing gently on the LED into the board with my left hand. This would reheat and align the LED snug up against the switch.

Finally, solder the cathode/negative side of the LED and add solder if necessary to the anode/positive leg. Repeat for the section of LEDs and test.

Bottom Row and Caps Lock Switch Placement

The supported layout info on the XD87 page was confusing to me, and I didn’t realize what the layout of a standard bottom was (1.25x for all modifiers, 6.25x for the spacebar). All I knew is that I wanted to get the board built quickly and use the keycaps I purchased.

There are a variety of mounting options on the bottom row, and I had originally tried centering them, but then testing keycap fitting I couldn’t get things to line up.

In short, what I determined was that for the bottom row, the modifier keys should be mounted towards the outside edges. So to the left of the spacebar, mount the switches on the leftmost point, and on the right side, use the rightmost point. This should allow the standard bottom row to fit, but test this out before soldering your switches in place.

This also means that the LEDs for the modifier switches to the right of the keyboard have the long leg (positive/anode) going the other way.

View from the back for the modifers on the right side of the spacebar; should be mounted towards the outer edge of the board, and the LEDs are backwards on this side.

For the Caps Lock switch, the switch should be mounted on the right, closer to the A key, if you want to use the keycap that comes with the standard set of modifiers. There’s another version of the keycap that has this cool bump on it but I realized too late that the mount is in a different place, so oh well.

Caps Lock switch mounted closer to A.
Also install the optional LED for Caps Lock light if desired.

Test Test Test

Test both the switches and the LEDs regularly. Aqua’S KeyTest seemed to work well enough for me for checking the switches, but testing the backlighting LEDs regularly is a good idea. I started by testing every four switches or so but eventually ended up doing rows or half rows as I got further into it.

Minus Top Case
Completed!

Post-Build Thoughts

After getting through the initial set of mistakes (of which there were plenty), the rest of the assembly was pretty straightforward. Overall assembly was likely under 4 hours. I need to work through some of the firmware programming, but I typed this post on the keyboard and it’s been an enjoyable experience.

I don’t have much experience in the mechanical keyboard world, but compared to my currently daily driver (WASD CODE V2) here’s what I think:

  • I still like browns. I have them on the CODE (Cherry) and again on the XD87 (Gateron). Admittedly, I haven’t spent a lot of time with any of the other styles, but it feels good.
  • The F and J reference bumps don’t exist on these keycaps, and that’s a little weird but really only seems to matter when I’m bringing my hands back to the keyboard. I try and drive from the keyboard as much as I can already, but it does feel a little strange. (Edit: a coworker pointed out that the F and J keys are sculpted a little differently, and after realizing that it’s not so bad, and I can feel it. Also, those bumps are called homing bars.)
  • The spacebar is pretty noisy, especially compared to the CODE. I may try some o-rings on it and a few of the larger keys. I flipped it over too, so trying to join the cool kids to try that out.
  • Key height (SA Profile) doesn’t seem to have an effect on my typing, and I like the look.
  • I wish I had better information on the lighting effect options. It’s pretty unclear at the moment. I may try QMK as there appear to be some updates as of July 2020, so we’ll see. As mentioned before, the RGB underglow can barely be seen, and I feel like the only way that would be visible is with a different bottom case.
Obligatory photo with the other mechanical keyboard things.
Highlighting the oh-so-short Type-C cable.

Big thanks again to louwii for his actual build log. Go read that for actual good info on assembling this keyboard. And thanks to KPrepublic for making a delivering a kit for me to build!

Categories
System Administration

Flashing IT Firmware to the LSI SAS 9211-8i HBA, 2014 EFI Recipe

Many, many thanks go out to Bryan Vyhmeister and alpenwasser for their original writeups on this topic.

Disclaimer: Not my fault if you screw this up.

At this point, I think you’re in the minority if you don’t have the ability to boot an EFI shell, so this is a concise version of what I did to flash the LSI SAS 9211-8i HBA to Initiator Target (IT) mode for use with FreeNAS.

Ingredients

Directions

Format the USB Flash Drive. Use Rufus or the built-in Windows formatting tool if you want, but use MBR and FAT, and there’s no need to make a bootable disk since we’ll be using EFI.

Rufus 1.4.9.506_2014-07-09_15-19-38

Open the two zip files you downloaded and find the following three files and copy them to your USB drive:

  • sas2flash.efi
  • 2118it.bin (from the Firmware\HBA_9211_8i_IT folder)
  • mptsas2.rom

5126 (H_)_2014-07-09_15-21-48

Disconnect all the other drives and remove any extra controllers from your computer, leaving just the LSI card and plug in your USB drive.

Figure out how to boot an EFI shell and do it.

If it lists your drives, that’s great, otherwise type map to display what drives are detected, then type mount <yourdrive> to mount the drive. ie, I typed mount fs0.

type fs0: to switch to your mounted drive and ls or dir to verify that all your necessary files are there.

Now we flash!

sas2flash.efi -listall to show the controller and verify the current version.

sas2flash.efi -o -e 6 to erase the BIOS, do not reboot after this command.

sas2flash.efi -o -f 2118it.bin -b mptsas2.rom to write the new firmware and BIOS.

And finally, sas2flash.efi –listall once more to verify the updated card. Reboot and press Ctrl-C to get into the LSI BIOS and make sure you’re actually in Initiator Target (IT) mode.

Categories
System Administration

SNMPv3 Configuration for Dell PowerConnect 3500 Series

So apparently SNMP should be secured. Disable write access if you don’t need it, and use SNMPv3 instead of the other versions.

I setup some ProCurve switches recently, and evilrouters.net had a great writeup on configuring SNMPv3. So configured me some ProCurve and went on my way.

Then came my Dell PowerConnect 3548P. I bought it before I decided to go with ProCurve for all the switches, but since it ain’t broke, let’s secure it.

Ideally, I’d configure it similar to the ProCurve switches, so that I can monitor it the same with Cacti and Spiceworks. I was able to map the ProCurve commands to PowerConnect speak for most of it, but I run into a spot where the Dell documentation is painfully unclear:

auth-sha-key sha-des-keys — Indicates the HMAC-SHA-96 authentication level. The user should enter a concatenated hexadecimal string of the SHA key (MSB) and the privacy key
(LSB). If authentication is only required, 20 bytes should be entered; if authentication and
privacy are required, 36 bytes should be entered. Each byte in the hexadecimal character
string is two hexadecimal digits. Each byte can be separated by a period or colon. (20 or 36 bytes)

Dell PowerConnect 3500 Series CLI Reference Guide, p354

In ProCurve land, I enter in plaintext passwords for both authentication and privacy, and it hashes that out for me, but here in the Dell universe, I haven’t the slightest idea how to make a key.

After a few hours of head scratching, here’s what I did.

You’ll need:

  • CLI access to your switch
  • A linux machine. I’m using Ubuntu Server.

Log into your switch and type:


enable
show snmp engine id

It’ll spit out an engineID. Make note of that ID.

On your linux machine, you’ll need to install the snmpkey utility. I did it with the following:


sudo apt-get install libnet-snmp-perl libcrypt-des-perl libdigest-hmac-perl

Then, run the following command to generate the mysterious keys:


snmpkey sha <auth_password> <engine_id> des <priv_password>

It should return an authKey and a privKey.

Back on your switch, move up to the config mode (type enable and config), then create a SNMPv3 group:


snmp-server group operatorauth v3 priv

Then create the user and assigned it to that group:

snmp-server user snmpuser operatorauth auth-sha-key <authKey><privKey>

Make sure there’s no space between the authKey and the privKey. This will create a user named snmpuser. And you’re done!

If you’ve got snmpwalk installed on your linux server, test the connection with:


snmpwalk -v 3 -a SHA -A <auth_password> -u snmpuser -l authPriv -x DES -X <priv_password> <ip_of_switch>

With any luck, you should see a stream of OIDs.

If anyone has a smarter way to generate the keys, please let me know in the comments!

Categories
Software System Administration

Static Devices on Remote Side of a SonicWALL Site-to-Site VPN? Remember to Renegotiate!

tl;dr If you are having trouble with devices that have static IPs on the remote side of your Sonicwall Site-to-Site VPN, go to VPN and click Renegotiate under the Currently Active VPN Tunnels.

We’ve got another warehouse with a site-to-site VPN setup using SonicWALL devices. It works decently enough for what we need.

While most of the workstations at the remote site get an IP from the DHCP server at the central site, some of the devices at the other warehouse have static IPs (printers, wireless APs, etc).

Defining these static IPs in the SonicWALL is pretty easy. On the remote gateway side, go to VPN –> DHCP over VPN –> Configure –> Devices Tab and enter the IP and MAC address of your static devices under Static Devices on LAN.

However, occasionally when adding another static IP, or when updating the firmware, or when it just feels like it, the routers will have trouble passing traffic from the central side to the remote side for just the static IPs. I’m using Nagios to report on the status of most of these devices, so it starts complaining fairly quickly that it can’t access them. Usually the remote side can still see those static devices, but for printers that connect back over the VPN to a printer server, this becomes a problem.

I used to think that just deleting all the static devices listed and re-adding them would work, but I had major problems with this today.

The workaround that seems to work for me now is simply going to the VPN settings page and clicking Renegotiate under the Currently Active VPN Tunnels section.

I don’t see anything like this written up on any of the SonicWALL support pages, so if anyone else runs into this weird situation, it’s worth a shot.

Categories
Computer Fixin' Lifehacks Software System Administration

Extend Toner Life on Your Brother HL-2270DW By Enabling Toner Continue Mode

I’ve got a number of Brother HL-2270DW laser printers around the office, and they’re wonderful. I even have one at home. Wireless-capable with built in duplexing, and on sale the unit is under $100. What’s not to like?

Toner is fairly inexpensive too, but I like to squeeze as much of the life out of them as I can. By default, the toner life is strictly regulated by the page counter, and once the limit is reached, the printer stops until you replace the toner.

Enter the all important Toner Continue Mode. If the printer is networked, you can simply bring up the control panel by browsing to your printer’s IP in your browser. Click on Printer Settings (log in with username ‘admin’ and password ‘access’ if you haven’t changed the defaults) then make sure you set Replace Toner to Continue. Hit Submit at the bottom to save, and you’re set! You’ll be able to take the cartridge and shake it until you can’t shake it any more, just like the good ol’ days.

Brother HL-2270DW - Replace Toner

Important Note (12/20/2012): I just caught my error and updated the screenshot and post, but there’s a difference between the Continue Mode on the settings screen and the Replace Toner option. I think the Continue Mode will toggle the printer for recovering from a printer error, for example, after you unjam the printer. Replace Toner is the option you want to set, and isn’t available on all Brother printers. It’s super confusing because they call them the same thing…

I’ve found that after changing toner cartridges, this mode will often be reset, so you’ll need to remember to change it back when swapping cartridges.

The other method to set this is useful if your printer is in USB mode, directly connected to a computer. I just found out about this today. To quote Brother’s FAQ:

To enable Continue Mode, please follow the steps below:

Press the GO button 7 times (quickly). All of the LEDs should flash twice, and the Ready LED should turn on. Continue mode is now enabled.

To disable Continue Mode, please follow the steps below:

Press the GO button 7 times (quickly). All of the LEDs should flash once. Continue mode is now disabled.

I would assume this would also work for a networked printer, but it’s nice to know that this can also be set for a standalone one. There’s no setting in the driver to adjust this option, so here’s how to do it.

For more information:

Categories
Software System Administration

The Journey From MyFax to MetroFax

(edited 2012/09/20 to add some important caveats)

I’ve already established that MyFax is slowly going down the tubes. The following chronicles my experience switching to a new service.

After some research, I settled on MetroFax as my new internet faxing provider. They’re based just a few hours away from me in the beautiful Pacific Northwest, and don’t appear to be attached to any large corporate conglomerate of faxing companies. They’re a little cheaper too, which I can’t complain about.

Now, here’s the important thing to note: MetroFax doesn’t allow porting from MyFax numbers, because I believe they’ve historically had problems with MyFax releasing numbers. Go figure. They must’ve been burned pretty hard to not even bother trying anymore.

So how do you get to MetroFax without losing your number? The answer is NumberGarage.

An Important Caveat

As mentioned in the comments, you can only port a number out of MyFax that you originally ported in. Section 19 of the MyFax terms goes into the particulars on this, but essentially when signing up for their service they do not provide you with permanent access to the phone number if they assign it to you, and retain the right to take that number back and charge you money if you try to port it away.

MetroFax has a similar stipulation (see Limited License To Use; Limitation of Transfer Rights), so as much as I’ve been pleased with their service, this is something to keep in mind.

FaxLogic will actually allow you to port a number out that they’ve assigned to you, so if you don’t already have a faxing service and are thinking about starting out, this is a good option to consider.

(So no warranties here. Consider this an educational example of a possible process. I’m not liable if your experience is different that what’s documented here.)

Porting from MyFax to NumberGarage

Signup is painfully simple. Your account number is your fax number, after which you provide some contact information and carrier transfer info. There’s a $29.95 charge for the initial port, but for me that was better than losing the number or staying with MyFax.

You’ll also setup whether you want to park or forward your number. If you want interrupted faxing service, start up a trial account with MetroFax, and then set up forwarding in NumberGarage to forward to the number they assign you during the trial.

Providing a bill is the last step, and it’s a little tricky, as MyFax doesn’t provide you with a bill that shows your phone number. I ended up printing the bill, then taking a few screenshots highlighting my account number and phone number for verification, then zipping it all together and sending it as proof.

MyFaxCentral-User Administration Main Page - Google Chrome_2012-08-21_13-49-51-obfuscatedMyFaxCentral-User Profile Administration - Google Chrome_2012-08-21_13-50-37-obfuscated

You’ll receive an email after they confirm the port request, followed by a estimated porting date.

NumberGarage_before

Then you wait. And a few days later, success!

NumberGarage_after

Porting from NumberGarage to MetroFax

The process here is about as easy as the first port. Make sure you’ve converted from the trial to a full plan, then contact MetroFax’s porting department, and they’ll send you over a Letter of Agency/Authorization (LOA) document to fill out. NumberGarage gives you a PDF bill the instant you sign up for their service, so attach that to the email with the signed LOA, and that’s all you need! Note that there’s another porting fee here, but it’s the price of doing business, I guess.

MetroFax will confirm with you that you want to replace your temporary number with the ported one, and then you wait.

A few short days later, you’ll be greeted with a welcome email with your ported number, and you’re done!

Cleanup and Final Thoughts

Be sure to cancel your MyFax and NumberGarage services at this point, or they will both probably gladly keep charging your card for services you no longer need. You could probably cancel MyFax immediately after porting out to NumberGarage, but I figure waiting until the whole process is completed is a little safer.

Prior to finding out about NumberGarage, I did another port from MyFax to MetroFax through a VOIP provider, and while it worked just fine, the process was much more convoluted than using NumberGarage. I also considered having our phone provider handle the port. NumberGarage just worked, and was easy to use.

Let met know in the comments if you find another service that works for you, or if MetroFax is ever able to start porting directly from MyFax.

Good luck porting!

Categories
Uncategorized

Epicor 9 Phone Support Menu Tree (Updated Aug 2012)

We’re now using Epicor 9.05, and I’ve noticed that the phone tree has been updated slightly since last year. Sorry to you folks running on Vantage/Vista, but if someone wants to submit a phone tree for the 8.03 product, I’d be happy to put it up. So this is up to date as of August 13, 2012.

There’s been a few small changes in the sub-menus. Refer to the old menus if you really want to compare.

Common Options

  • * (star, asterisk) – return to the main menu from a sub-menu
  • # (pound, hash) – repeat options on the main menu
  • 0 – repeat options on a sub-menu
  • You can also leave a message for support after any of the menus.

Epicor 9

  •  4 – System Down Issue (No users can login into your live environment or completely unable to use the software)
  • 1 – Production issue/Application Support
    • 1 – Sales Processing Modules – Orders, RMAs, Security, Shipping and Receiving, MES, and CRM
    • 2 – Production Processing Modules – Quoting, Engineering and Jobs, Purchasing, Inventory, Quality Assurance, Advanced Inventory Management, and Advanced Materials Management
    • 3 – Advanced Production Modules – Product Configurator, Scheduling, Advanced Planning and Scheduling, and MRP
    • 4 – PLM (Product Lifecycle Management)
    • 5 – IQS or Advanced Quality Modules
  • 2 – Financial Issue
    • 1 – Accounts Receivable (AR), Accounts Payable (AP), and General Ledger (GL)
    • 2 – Cost Accounting, WIP Reconciliation, Capture Post Process, and Epicor Payroll
    • 3 – Add-On Modules – Open4 and Payroll and Human Resources
  • 3 – Technical Issue
    • 1 – Installation, Upgrade, or Database Performance Issues
    • 2 – Crystal Reports or ODBC Assistance
    • 3 – Tools – Sonic, Customer Connect, Mobile Connect, or Sales Connect
    • 4 – Customization, Personalization, Dashboards, and BAQs
    • 5 – Third-Party – Service Connect, Corview, PLM, FRX, Open4, APM, and others
Categories
Software System Administration

Gmvault: gmail backup (Ubuntu install and setup)

(edit 8/20/2012: Originally written for v1.5, this has been tested and works fine as of Gmvault v1.7-beta, so just change things accordingly and install away! I’ve updated the links below.)

I’ve been using getmail for over a year to backup my Gmail account. As far as I know, it’s been working, but it just grabs email over POP, dumps them into an mbox file, and that’s that. It’s a fairly basic procedure, but since it just blindly downloads emails, getmail doesn’t account for ones I’ve deleted, and I don’t know if it keeps any label information.

So along comes Gmvault, the new kid on the block with fancy restore features and multiple OS capability. Let’s give it a shot.

Python should be installed on a default Ubuntu machine, but let’s install a few other pre-requisites as well. I’m using Ubuntu 12.04 LTS (Precise Pangolin).

sudo apt-get install python python-setuptools
sudo easy_install -U distribute

Then download the source package for Gmvault:

wget https://github.com/downloads/gaubert/gmvault/gmvault-v1.7-beta-src.tar.gz

Unpack it:

tar xvzf gmvault-1.7-beta-src.tar.gz

Then install!

cd gmvault-1.7-beta/
sudo python setup.py install

The basic setup is about as simple as it comes:

gmvault sync your_email@gmail.com

The setup process will take you through an authentication process with your email account.

Since I ran the install on an Ubuntu headless server, it loaded the text-based w3m browser, which I was able to login to my account, but then was unable to approve Gmvault to access my email. Pressing ‘q’ quits the browser and you’ll be presented with with an OAuth link you can copy into a normal browser and authorize Gmvault that way. (Note: you can manage what apps can access your Google Account at any time)

Once Gmvault is given the okay, it’ll start churning away downloading emails. Give it a few minutes (or hours) to finish, and feel better knowing that your hoard of oh-so-important emails are now tucked away in yet another location.

There’s a few other parameters you can pass to the program, which will allow you to change the vault database location, provide a user/pass rather than the OAuth token, and to run custom synchronization of certain emails. Take a look at the in-depth documentation on Gmvault.

After running the initial sync, you can run the following command to run a quick sync (only the last 2 months are scanned):

gmvault sync --type quick your_email@gmail.com

Restoration of emails appears to be straightforward (although I haven’t tried it) and emails are stored in month folders as individual .eml.gz and .meta files. The gzipping appears to be fairly efficient, as the Gmvault database reports to be about 2/3rds the reported size of my Gmail inbox. Not bad at all!

Also–for the sake of completeness, a few days after I wrote this I found out about BaGoMa, which is another Python-based utility to backup your Gmail. Seems to follow a similar path as Gmvault, but I like Gmvault’s ability to use OAuth rather than have to provide my password each time.

So far, Gmvault appears to have a simple and easy to use product that fits my needs. Good work!

Categories
System Administration

Ubuntu 12.04 + rkhunter 1.3.8 = false positives!

rkhunter (Rootkit Hunter) is a wonderful tool to assist in securing your system, but it becomes much less helpful if it constantly reports false positives.

After updating your rkhunter.conf file appropriately, you may still be left with the following error:

Warning: Hidden file found: /dev/.initramfs: symbolic link to `/run/initramfs’

This file can’t be whitelisted because it’s a symlink, and rkhunter 1.3.8 doesn’t check for this condition. The 1.4.0 release fixes this bug, but it’s not available from the Ubuntu repos. So you’ve got a few options.

  • Install rkhunter 1.4.0 manually.
  • Download the rkhunter 1.4.0 tarball and extract the executable and conf file yourself
  • Patch the rkhunter executable

I opted to patch the rkhunter executable, which really amounted to adding a few lines (one actual test case line + a few comments). Follow along!

Open up /usr/bin/rkhunter and move down to line 834. You should see the following:

            #
            # Now test for the different file types.
            #

            if [ -f "${FNAME}" ]; then
                case "${OPT_NAME}" in
                ALLOWHIDDENDIR|TMPDIR|DBDIR|BINDIR|SCRIPTDIR|ROOTDIR|SSH_CONFIG_DIR|SUSPSCAN_DIRS|SUSPSCAN_TEMP)
                    ERRCODE=1
                    test $CONFIG_CHECK -eq 1 && RET_CODE=1
                    echo "Invalid ${OPT_NAME} configuration option: Not a directory: ${FNAME}"
                    ;;
                esac
            elif [ -d "${FNAME}" ]; then
                case "${OPT_NAME}" in
                                                                                                                                                                                     WRITEWHITELIST|IMMUTWHITELIST|SCRIPTWHITELIST|ALLOWHIDDENFILE|LOGFILE|SYSLOG_CONFIG_FILE|INETD_CONF_PATH|XINETD_CONF_PATH|PASSWORD_FILE|RTKT_FILE_WHITELIST|OS_VERSION_FILE|IGNORE_PRELINK_DEP_ERR|WEBCMD|*_CMD)
                    ERRCODE=1
                    test $CONFIG_CHECK -eq 1 && RET_CODE=1
                    echo "Invalid ${OPT_NAME} configuration option: Not a file: ${FNAME}"
                    ;;
                esac

Now, after line 846, you’ll want to add the following lines:

                #
                # For the ALLOWHIDDENFILE option we need to allow
                # a hidden symbolic link to a directory.
                #
                test "${OPT_NAME}" = "ALLOWHIDDENFILE" -a -h "${FNAME}" && continue

So it looks like this:

            #
            # Now test for the different file types.
            #

            if [ -f "${FNAME}" ]; then
                case "${OPT_NAME}" in
                ALLOWHIDDENDIR|TMPDIR|DBDIR|BINDIR|SCRIPTDIR|ROOTDIR|SSH_CONFIG_DIR|SUSPSCAN_DIRS|SUSPSCAN_TEMP)
                    ERRCODE=1
                    test $CONFIG_CHECK -eq 1 && RET_CODE=1
                    echo "Invalid ${OPT_NAME} configuration option: Not a directory: ${FNAME}"
                    ;;
                esac
            elif [ -d "${FNAME}" ]; then
                #
                # For the ALLOWHIDDENFILE option we need to allow
                # a hidden symbolic link to a directory.
                #
                test "${OPT_NAME}" = "ALLOWHIDDENFILE" -a -h "${FNAME}" && continue


                case "${OPT_NAME}" in
                                                                                                                                                                                     WRITEWHITELIST|IMMUTWHITELIST|SCRIPTWHITELIST|ALLOWHIDDENFILE|LOGFILE|SYSLOG_CONFIG_FILE|INETD_CONF_PATH|XINETD_CONF_PATH|PASSWORD_FILE|RTKT_FILE_WHITELIST|OS_VERSION_FILE|IGNORE_PRELINK_DEP_ERR|WEBCMD|*_CMD)
                    ERRCODE=1
                    test $CONFIG_CHECK -eq 1 && RET_CODE=1
                    echo "Invalid ${OPT_NAME} configuration option: Not a file: ${FNAME}"
                    ;;
                esac

Save the file and then open up /etc/rkhunter.conf and add the following line:

ALLOWHIDDENFILE="/dev/.initramfs"

Save, and finally, update the rkhunter properties:

sudo rkhunter –-propupd

There you go! There are a few other items that need to be whitelisted in the conf, but they should all work with the rkhunter 1.3.8, so it’s just a matter of updating the file accordingly.

Thanks to reinhold and Tim Miller Dyck for the patch implementation information and unSpawn for the actual patch. Here’s hoping to see an actual backport fix into the Ubuntu repos.

More information:

 

Categories
Lifehacks System Administration

Synergy and Text Expansion Programs on Windows 7? Don’t run as admin.

Synergy is great. And text expansion/replacement tools are great (ie, PhraseExpress or AutoHotKey). And Windows 7…well I guess it’s alright as well.

Synergy lets me share my mouse and keyboard between my Windows desktop, my Macbook, and even a linux machine (if I still ran one at work). It even synchronizes the clipboard betweeen screens. Great stuff.

PhraseExpress is my current favorite text expansion tool. I use it to insert my signature into emails and other places where I might repeatedly type something. And it’s free for personal use. I’d use TextExpander on my Mac, but I’m cheap.

Now here’s the problem: if you run Synergy (either 1.3.8 stable or 1.4.8 beta at the time of this writing) and install it to autostart on login, your text expansion tool will problem not work.  So just run it manually after you login, and you’ll be okay. The autostart process for Synergy requires administrative rights, and seems to interfere with the hooks that the text expansion tools need to work.

After switching to a new workstation, I installed my necessary programs including the ones listed above, and noticed that PhraseExpress didn’t work. I thought it was a problem with that specific program. I tried uninstalling and reinstalling and updating, and even tried AutoHotKey for a bit (which is great, but it’s

Until I come up with something smarter, I’ll just start Synergy manually when I restart my computer. That’s not the end of the world, and at least PhraseExpress will work.

So beware. Two great programs, but don’t run them as admin.