Just a Nothing Special Gitea with SSH CLI Install

Starting with my default Debian build, I want a local gitea machine for acting as a centralized git repo with a graphical UI available via a web browser and I want it to at least look like I care about security.

The link to the description of my default install: Debian Buster Ultra Basic Install

Okay, first things first.

If it is orange, this is likely something that will be special and unique to your install, so change the values where necessary.

Prerequisites.

We'll need a few things.

$ sudo apt install -y curl default-jre git golang-go mariadb-client mariadb-server ufw

$ sudo ufw allow dns

$ sudo ufw allow OpenSSH

$ sudo ufw allow 443/tcp

$ sudo systemctl enable ufw

$ sudo systemctl restart ufw

$ sudo systemctl enable mariadb.service

$ sudo systemctl restart mariadb.service

For SSL we will need the SSL certificate and key files. You'll see these again when we write the app.ini file. Adjust the filenames as needed on your part, the names don't matter, they just need to match what is in the app.ini file.

$ sudo cp wildcard-domain.com.* /etc/ssl/certs/

$ sudo chmod 440 /etc/ssl/certs/wildcard-domain.com.*

Bear with me, we are going to imitate the mysql_secure_install database modifications.

$ mysql -uroot -p -e "DROP DATABASE IF EXISTS test;"

$ mysql -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'db-root-password' WITH GRANT OPTION;"

$ mysql -uroot -pdb-root-password -e "FLUSH PRIVILEGES";

$ mysql -uroot -pdb-root-password -e "GRANT ALL PRIVILEGES ON *.* TO 'root-user'@'127.0.0.1' IDENTIFIED BY 'db-root-password' WITH GRANT OPTION;"
$ mysql -uroot -pdb-root-password -e "GRANT ALL PRIVILEGES ON *.* TO 'root-user'@'::1' IDENTIFIED BY 'db-root-password' WITH GRANT OPTION;"

$ mysql -uroot -pdb-root-password -e "DELETE FROM mysql.user WHERE User='';"
$ mysql -uroot -pdb-root-password -e "DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"

$ mysql -uroot -pdb-root-password -e "FLUSH PRIVILEGES;"

$ mysql -uroot-user -pdb-root-password -e "DELETE FROM mysql.user WHERE User='root';"

$ mysql -uroot-user -pdb-root-password -e "CREATE USER 'backup'@'localhost' IDENTIFIED BY 'db-backup-user-password';"
$ mysql -uroot-user -pdb-root-password -e "GRANT SELECT, SHOW VIEW, RELOAD, REPLICATION CLIENT, EVENT, TRIGGER ON *.* TO 'backup-user'@'localhost';"

$ mysql -uroot-user -pdb-root-password -e "FLUSH PRIVILEGES";

$ sudo systemctl restart mariadb.service

Now for the Gitea specific database work we need to complete.
$ mysql -uroot-user -pdb-root-password -e "CREATE DATABASE IF NOT EXISTS gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;"

$ mysql -u"$root-user" -pdb-root-password -e "GRANT ALL ON gitea.* TO 'gitea-user'@'localhost' IDENTIFIED BY 'gitea-db-password';"


$ mysql -uroot-user -pdb-root-password -e "FLUSH PRIVILEGES;"

$ sudo mkdir -p /var/lib/gitea/{custom,data,indexers,log,public}
$ sudo chown -R git:git /var/lib/gitea
$ sudo chmod 750 /var/lib/gitea

$ sudo mkdir /etc/gitea
$ sudo chown root:git /etc/gitea

$ sudo chmod 770 /etc/gitea

$ sudo mkdir /root/gitea

$ cd /tmp

$ sudo curl -o gitea https://dl.gitea.io/gitea/1.9.1/gitea-1.9.1-linux-amd64

$ sudo chmod 550 gitea

$ sudo mv gitea /usr/local/bin/gitea

If we want to avoid the GUI UI to make an app.ini file, we need to provide an app.ini file. Use your favorite editor (nano, vi, emacs...) to put the following configuration into /usr/local/bin/gitea/custom/conf/app.ini .

APP_NAME = PROJECT_NAME
RUN_USER = root
RUN_MODE = prod

[ui]
DEFAULT_THEME = arc-green

[database]
DB_TYPE  = mysql
HOST     = 127.0.0.1:3306
NAME     = gitea
USER     = GITEA_DB_USER
PASSWD   = GITEA_DB_PASSWORD
SSL_MODE = disable
CHARSET  = utf8mb4
PATH     = /usr/local/bin/data/gitea.db

[repository]
ROOT = /root/gitea-repositories

[server]
SSH_DOMAIN       = DOMAIN.COM
DOMAIN           = DOMAIN.COM
HTTP_PORT        = 3000
ROOT_URL         = https://DOMAIN.COM:3000/
DISABLE_SSH      = false
SSH_PORT         = 22
LFS_START_SERVER = false
LFS_CONTENT_PATH = /usr/local/bin/data/lfs
LFS_JWT_SECRET   = GITEA_JWT_SECRET
OFFLINE_MODE     = false
PROTOCOL         = https
CERT_FILE        = /etc/ssl/certs/DOMAIN.COM.crt
KEY_FILE         = /etc/ssl/certs/DOMAIN.COM.key

[mailer]
ENABLED        = true
HOST           = MAILGUN_SMTP_HOST:465
FROM           = GITEA_SYSTEM_EMAIL
USER           = MAILGUN_SMTP_USER
PASSWD         = MAILGUN_SMTP_PASSWORD
IS_TLS_ENABLED = true

[service]
ACTIVE_CODE_LIVE_MINUTES          = 1440
RESET_PASSWD_CODE_LIVE_MINUTES    = 1440
REGISTER_EMAIL_CONFIRM            = true
ENABLE_NOTIFY_MAIL                = true
DISABLE_REGISTRATION              = false
ALLOW_ONLY_EXTERNAL_REGISTRATION  = false
ENABLE_CAPTCHA                    = true
REQUIRE_SIGNIN_VIEW               = true
DEFAULT_KEEP_EMAIL_PRIVATE        = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING       = true
NO_REPLY_ADDRESS                  = noreply

[security]
INTERNAL_TOKEN        = GITEA_INTERNAL_TOKEN
INSTALL_LOCK          = true
SECRET_KEY            = GITEA_SECRET_KEY
LOGIN_REMEMBER_DAYS   = 7
COOKIE_USERNAME       = gitea_awesome
COOKIE_REMEMBER_NAME  = gitea_incredible
MIN_PASSWORD_LENGTH   = 8
IMPORT_LOCAL_PATHS    = false
DISABLE_GIT_HOOKS     = false
PASSWORD_HASH_ALGO    = pbkdf2
CSRF_COOKIE_HTTP_ONLY = true

[picture]
DISABLE_GRAVATAR        = false
ENABLE_FEDERATED_AVATAR = true

[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = true

[oauth2]
JWT_SECRET=GITEA_JWT_SECRET

[session]
PROVIDER = file

[log]
MODE      = file
LEVEL     = info
ROOT_PATH = /usr/local/bin/log

We are ready to mimic the last of the install processes kicked off by the GUI install. The benevolent Gitea developers have blessed us with a little script we can run from the command line. Bless you Gitea devs!

$ sudo gitea migrate

Now to create a service to manage Gitea and start it at boot.

$ sudo touch /etc/systemd/system/gitea.service

Use your favorite editor (nano, vi, emacs...) to put the following configuration into /etc/systemd/system/gitea.service .

[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
#Requires=mysql.service
Requires=mariadb.service
#Requires=postgresql.service
#Requires=memcached.service
#Requires=redis.service

[Service]
# Modify these two values and uncomment them if you have
# repos with lots of files and get an HTTP error 500 because
# of that
###
#LimitMEMLOCK=infinity
#LimitNOFILE=65535
RestartSec=2s
Type=simple
User=root
Group=root
ExecStart=/usr/local/bin/gitea web
Restart=always
Environment=USER=root HOME=/root/gitea
# If you want to bind Gitea to a port below 1024 uncomment
# the two values below
###
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
#AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

Lastly, what we do is enable and start the service with the following commands.

$ sudo systemctl enable gitea

$ sudo systemctl daemon-reload
$ sudo systemctl start gitea

That should more or less do it. Navigate to https://domain.com:3000/ to see your handiwork...

(The reason I left my installation listening on port 3000 is because I usually have a whole network reverse proxy running and using the SNI hostname on port 443 to direct the proper web traffic to each host.)

Debian 10, Buster, is here. What did you do to my $PATH!!! Debian Base Install

Well for me, I installed minimally as best I could. No desktop. Yes SSH. I did create a regular user.

Let's get things rolling. Since I do not have a sudo user yet, I will log in with my regular user and become root.

$ su

Most of us know we'll need the root password next, but for those that don't...

First things first, the system does work. But, I do not like the default upon install $PATH env variable.

To fix the /sbin & /usr/sbin issues I added the line to my /etc/environment file:

PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

I was lazy, I rebooted.

Again with the becoming root.

$ su

Then I added my regular user to the sudo group with:

# usermod -aG sudo myusername

I also set an internally routeable static IPV4 address in my /etc/network/interfaces file:

source /etc/network/interfaces.d/*

auto lo

iface lo inet loopback

allow-hotplug enp1s0

iface enp1s0 inet static

address 10.0.0.100

broadcast 10.255.255.255

netmask 255.0.0.0

gateway 10.0.0.1

Systemd replaced the more or less awful resolv.conf
DNS Server information is now contained in the /etc/systemd/resolved.conf file:

[Resolve]
DNS=1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4

Then I restarted the network.

# systemctl restart networking

Lastly, I installed vim-- because I am not a masochist.

# apt install openssh-server sudo vim
# systemctl enable ssh

And for whatever reason you find acceptable, this sets your hostname well enough.

# hostnamectl set-hostname myhostname

It is likely I will use this as my Debian "base" install going forward.

And just for funsies, ipconfig is deprecated.

ip a

Will Technology Have an Uneven Application to Various Races Based on Physical Characteristics or Cultural Patterns?

I came across this snippet, it in and of itself is insignificant and unremarkable.

>Police are using software to predict crime. Is it a ‘holy grail’ or biased against minorities?

Being in the industry I am, there are things that cross in front of my eyes that make me stop and think for a moment.

Certain visual tech has very often ended up being biased towards white people-- I see it, I don't think it is primarily racist. There are a bunch of us in the target disposable income demographic and they want to make money. Yeah, it sucks. I work on problems that bother me, anyone that this particular matter bothers is free to invest their resources... Anywho, I suppose visuals aren't the only trick in the bag that could be leveraged.


Heres a Look at How Color Film Was Originally Biased Toward White People

HP Face Tracking Webcams Don't Recognize Black People

iPhone X Racist, Apple Refunds Device Can't Tell Chinese People Apart

My examples provided above just touch on the image processing facet of technology. The implication that a technical solution will in general be applied unevenly between people with various physical characteristics or cultural patterns is a very real issue. Right now, minimal impact. But, as always that is subject to change.

Certbot Non Interactive Scripted LetsEncrypt SSL Helpful Stuff

The secret weapon I wish I had found earlier, here it is:

certbot --help all

Then the settings I was using...

certbot certonly --agree-tos --non-interactive --staging --text --allow-subset-of-names --rsa-key-size 4096 --email bradchesney79@gmail.com --webroot --webroot-path /var/www/html --domains "rustbeltrebellion.com, www.rustbeltrebellion.com"

certonly what it says on the tin, handles only requesting a new cert. No webserver configuration by certbot.

--agree-tos agrees to the terms of service on the command line instead of the GUI.

--non-interactive tells certbot you're not there to interact.

--staging was put in to test everything would complete and certs would be somewhere under the /etc/letsencrypt directory... right or wrong. Remove it when you're ready to put rubber to the road.

--text makes certbot not use the ncurses text tool.

--allow-subset-of-names allows you to specify the cert cover more subdomains and domains without checking if those domains can be verified to be under your control.

--rsa-key-size lets you use a bigger key, like 4096 bits long.

--email so you can get expiration warnings and the like about your certs.

--webroot is the method of using an existing webroot for certbot to use to verify that you are in control of one or more of the domains listed.

--webroot-path the actual location of the webroot for certbot to put its files in.

--domains is the quoted comma separated list of hosts you want the cert to cover since you can specify more than one.

There is a little bit of nginx config that makes this all work better. We can logically assign the URL Let's Encrypt will try to access to be the actual webroot. We are doing this because we put the challenge in the actual webroot as you can see in our certbot command above-- having an actual .well-known/acme-challenge path is unnecessary and lacks elegance.

location /.well-known/acme-challenge/ {
  root /var/www/html;
  try_files $uri =404;
}

Updated Favorite Subdomains List

This is a small addition due to the reworking of the SSL strategy I am using on my projects-- with the advent of StartSSL no longer being a choice for me due to some poor unrelated decisions by the staff. --That being said, I had a good experience with them before the kerfluffle and wish them well as we part ways now that they no longer fulfill the needs I have from a cert issuer.

On the github -- https://github.com/bradchesney79/subdomains

I added a few more to the list:

admin
alpha
app
api
beta
blog
css
dev
feed
files
forum
ftp
help
image
images
imap
img
info
js
lists
live
m
mail
media
mobile
mysql
news
photos
pic
pop
search
secure
smtp
static
status
store
support
test
videos
vpn
webmail
wiki
www

as a comma separated value (CSV) list:

admin,alpha,app,api,beta,blog,css,dev,feed,files,forum,ftp,help,image,images,imap,img,info,js,lists,live,m,mail,media,mobile,mysql,news,photos,pic,pop,search,secure,smtp,static,status,store,support,test,videos,vpn,webmail,wiki,www

bash script ready:

#!/bin/bash

arraytest[0]='test' || (echo 'Failure: arrays not supported in this version of bash.' && exit 2)

unset arraytest[0]

SUBDOMAINS=(
  admin
  alpha
  app
  api
  beta
  blog
  css
  dev
  feed
  files
  forum
  ftp
  help
  image
  images
  imap
  img
  info
  js
  lists
  live
  m
  mail
  media
  mobile
  mysql
  news
  photos
  pic
  pop
  search
  secure
  smtp
  static
  status
  store
  support
  test
  videos
  vpn
  webmail
  wiki
  www
)

for i in ${SUBDOMAINS[@]}
  do
    printf "$i\n"
done

exit 0

I am worried that I do not like leading high speed software teams

I take away from this uncomfortable situation that I need to start thinking about how to channel all this 'productivity'. I hope to come up with a process that ensures forward progress from all this 'productivity' so that days after this eye opening experience I can guide everyones experience better.

I have experienced my first complete break down of working with people not like myself. It is disheartening to give up nights and weekends-- my own aspirations and extra time with the people I love most. I have chosen to make a sacrifice in the short term by investing in a project. I've given up some things dear to me for duty to an obligation. The motivation for accepting was thatI believe the investment will yield a comfortable schedule, much autonomy in my private and professional life, and a rewarding end result that makes the world a better place to live in because that matters to me.

Today I had to take time to be a better person than I was when I woke up. I am angry that people did not listen to my request to better themselves and know the subject material when directly asked to study. The pseudo code I received in the morning as part of a question made it clear that no effort was made to acquaint themselves with the concepts of this task.
 

Remember the movie The Matrix? I felt like the spoon kid in the Oracle's apartment. The whole time I'm thinking to myself, "Login, *creepy stare and mystical hand movements*, there is no login..."

The following is the resulting response e-mail regarding a 'login issue' that is actually an authentication & access issue:

This is a conceptual change in thinking. We keep saying login, but in reality this is merely a tool to persistently accept something given that we trust. (They get the trusted thing by supplying credentials but never actually 'log in'. They get the token and we forget about them essentially until they come back asking for something with the token.

The token is a tool to verify authentication on an ongoing basis. There is no 'state' preserved during the life of the token.

It is okay to send as a header item as we are because SSL does encrypt it there-- we have maintained the user's privacy.

By sending the token in a cookie as 'httpOnly' and 'secure', client side javascript has no access through common channels-- we have matched the security level of a session cookie.

What makes us trust them is that we have baked in a secret that cannot be distilled from the whole. Since we made it and we know the secret, we can compare what we received to a newly generated one (just like with comparing a password hash to the hash created with a submitted password) -- we can trust a token because we can verify that it has not been tampered with.

As a bonus we can include very basic arbitrary data like a user id, their name in text, and any organizations they belong to (eventually themeing colors)-- this saves us some database lookup overhead.

However, we must be careful with what data we decide to put in the token as this increases the size of every request of a protected resource received and many responses.

We are using PHP sessions with AWS Redis flavored elasticache. At this time we are using it as a cache to lighten the load on the database-- not as any part of authentication or 'login'. We need to shift our thinking from the idea of 'logged in' as an active user and more to the idea that the person is authenticated and has access.

That changes the question from "is this person logged in" to "does this person have a valid thing we gave them"

Please adjust your code to match these concepts. If I were doing it, this is a method I might write.

validateRequest() {

if (isset(cookie('token')) && tokenIsValid()) {

  if(!associatedCache()) {

    get userObject by userId from token

    store generatedUserObject

    get orgObjects by associatedOrg[] from userObject

    store generatedOrgObject[]

  }

  return '{"validToken":"true"'};
}

else {

  //regardless of what is wrong with the token they need a new one
  return '{"requestedResource":"' . __FILE__ . '","validToken":"false"}';
}

Since we are not using routing __FILE__ is meaningful data.


*You might see some fibbing or incomplete things -- no logging, or cache invalidation, and a session token is more secure if we don't add any of our own arbitrary data in the second block of the JWT. That the info is available at all makes it 'less secure'. I've balanced the security against the convenience-- this is where the chips lay, I have some data in my JWT.

sources.list Generators, Yaaay!

This stuff is important, so definitely pay attention to where you are sourcing the parts of your system. However, this stuff saves a lot of time when dealing with stuff that isn't often played with. As always this post is more for me than you, but if you can benefit from it, good.

For Debian:

https://debgen.simplylinux.ch/index.php

 And what I usually want for Debian Jessie is...

#------------------------------------------------------------------------------#
#                   OFFICIAL DEBIAN REPOS                   
#------------------------------------------------------------------------------#

###### Debian Main Repos
deb http://ftp.us.debian.org/debian/ jessie main contrib non-free

###### Debian Update Repos
deb http://security.debian.org/ jessie/updates main contrib non-free

#------------------------------------------------------------------------------#
#                      UNOFFICIAL  REPOS                       #
#------------------------------------------------------------------------------#

###### 3rd Party Binary Repos

#### Dotdeb - http://www.dotdeb.org
## Run this command: wget -q -O - http://www.dotdeb.org/dotdeb.gpg | apt-key add -
deb http://packages.dotdeb.org jessie all


For Ubuntu/Kubuntu:

https://repogen.simplylinux.ch/

And similarly as above...

#------------------------------------------------------------------------------#
#                            OFFICIAL UBUNTU REPOS                             #
#------------------------------------------------------------------------------#


###### Ubuntu Main Repos
deb http://us.archive.ubuntu.com/ubuntu/ xenial main restricted universe multiverse

###### Ubuntu Update Repos
deb http://us.archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe multiverse

###### Ubuntu Partner Repo
deb http://archive.canonical.com/ubuntu xenial partner

#------------------------------------------------------------------------------#
#                           UNOFFICIAL UBUNTU REPOS                            #
#------------------------------------------------------------------------------#


###### 3rd Party Binary Repos

#### Gimp PPA - https://launchpad.net/~otto-kesselgulasch/+archive/gimp
## Run this command: sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 614C4B38
deb http://ppa.launchpad.net/otto-kesselgulasch/gimp/ubuntu xenial main

#### Google Chrome Browser - http://www.google.com/linuxrepositories/
## Run this command: wget -q https://dl.google.com/linux/linux_signing_key.pub -O- | sudo apt-key add -
deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main

#### Opera - http://www.opera.com/
## Run this command: sudo wget -O - http://deb.opera.com/archive.key | sudo apt-key add -
deb http://deb.opera.com/opera/ stable non-free

#### Oracle Java (JDK) Installer PPA - http://www.webupd8.org/2012/01/install-oracle-java-jdk-7-in-ubuntu-via.html
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EEA14886
deb http://ppa.launchpad.net/webupd8team/java/ubuntu vivid main

#### Samsung Unified Linux Driver Repository (SULDR) - http://www.bchemnet.com/suldr/index.html
## Run this command: wget -O - http://www.bchemnet.com/suldr/suldr.gpg | sudo apt-key add -
deb http://www.bchemnet.com/suldr/ debian extra

#### SimpleScreenRecorder PPA - http://www.maartenbaert.be/simplescreenrecorder/
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 283EC8CD
deb http://ppa.launchpad.net/maarten-baert/simplescreenrecorder/ubuntu xenial main

#### VirtualBox - http://www.virtualbox.org
## Run this command: wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox_2016.asc -O- | sudo apt-key add -
deb http://download.virtualbox.org/virtualbox/debian xenial contrib

#### Wine PPA - https://launchpad.net/~ubuntu-wine/+archive/ppa/
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 883E8688397576B6C509DF495A9A06AEF9CB8DB0
deb http://ppa.launchpad.net/ubuntu-wine/ppa/ubuntu xenial main

## Run this aggregated command: sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 614C4B38; wget -q https://dl.google.com/linux/linux_signing_key.pub -O- | sudo apt-key add -; sudo wget -O - http://deb.opera.com/archive.key | sudo apt-key add -; sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EEA14886; wget -O - http://www.bchemnet.com/suldr/suldr.gpg | sudo apt-key add -; sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 283EC8CD; wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox_2016.asc -O- | sudo apt-key add -; sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 883E8688397576B6C509DF495A9A06AEF9CB8DB0

How to Avoid Interactive SSH Prompts for Git Clone and SSH in General with bitbucket and Good for github as Well

So, I'm searching for a mundane way to bypass the unkown host manual interaction of cloning a git repo as shown below:

brad@computer:~$ git clone git@bitbucket.org:viperks/viperks-api.git
Cloning into 'viperks-api'...
The authenticity of host 'bitbucket.org (104.192.143.3)' can't be established.
RSA key fingerprint is 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40.
Are you sure you want to continue connecting (yes/no)?

Note the RSA key fingerprint...

So, this is a SSH thing, this will work for git over SSH and just SSH related things in general...

brad@computer:~$ nmap bitbucket.org --script ssh-hostkey

Starting Nmap 7.01 ( https://nmap.org ) at 2016-10-05 10:21 EDT
Nmap scan report for bitbucket.org (104.192.143.3)
Host is up (0.032s latency).
Other addresses for bitbucket.org (not scanned): 104.192.143.2 104.192.143.1 2401:1d80:1010::150
Not shown: 997 filtered ports
PORT    STATE SERVICE
22/tcp  open  ssh
| ssh-hostkey:
|   1024 35:ee:d7:b8:ef:d7:79:e2:c6:43:9e:ab:40:6f:50:74 (DSA)
|_  2048 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 (RSA)
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 42.42 seconds

First, install nmap. nmap is highly helpful for certain things, like this-- verifying manually SSH fingerprints. But, back to what we are doing.

Good. I'm either compromised at the multiple places and machines I've checked it-- or the more plausible explanation of everything being hunky dory is what is happening.

That 'fingerprint' is just a string shortened with a one way algorithm for our human convenience at the risk of more than one string resolving into the same fingerprint. It happens, they are called collisions.

Regardless, back to the original string which we can see in context below.

brad@computer:~$ ssh-keyscan bitbucket.org
# bitbucket.org SSH-2.0-conker_1.0.257-ce87fba app-128
no hostkey alg
# bitbucket.org SSH-2.0-conker_1.0.257-ce87fba app-129
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==
# bitbucket.org SSH-2.0-conker_1.0.257-ce87fba app-123
no hostkey alg

So, ahead of time, we have a way of asking for a form of identification from the original host.

At this point we manually are as vulnerable as automatically-- the strings match, we have the base data that creates the fingerprint, and we could ask for that base data (preventing collisions) in the future.

Now to use that string in a way that prevents asking about a hosts authenticity...

The known_hosts file in this case does not use plaintext entries. You'll know hashed entries when you see them, they look like hashes with random characters instead of xyz.com or 123.45.67.89.

brad@computer:~$ ssh-keyscan -t rsa -H bitbucket.org
# bitbucket.org SSH-2.0-conker_1.0.257-ce87fba app-128
|1|yr6p7i8doyLhDtrrnWDk7m9QVXk=|LuKNg9gypeDhfRo/AvLTAlxnyQw= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==

The first comment line infuriatingly shows up-- but you can get rid of it with a simple redirect via the ">" or ">>" convention.

As I've done my best to obtain untainted data to be used to identify a "host" and trust, I will add this identification to my known_hosts file in my ~/.ssh directory. Since it will now be identified as a known host, I will not get the prompt mentioned above when you were a youngster.

Thanks for sticking with me, here you go. I'm adding the bitbucket RSA key so that I can interact with my git repositories there in a non-interactive way as part of a CI workflow, but whatever you do what you want.

#!/bin/bash
cp ~/.ssh/known_hosts ~/.ssh/known_hosts.old && echo "|1|yr6p7i8doyLhDtrrnWDk7m9QVXk=|LuKNg9gypeDhfRo/AvLTAlxnyQw= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==" >> ~/.ssh/known_hosts

So, that's how you stay a virgin for today. You can do the same with github by following similar directions on your own time.

I saw so many stack overflow posts telling you to programmatically add the key blindly without any kind of checking. The more you check the key from different machines on different networks, the more trust you can have that the host is the one it says it is-- and that is the best you can hope from this layer of security.

WRONG
ssh -oStrictHostKeyChecking=no hostname [command]

WRONG
ssh-keyscan -t rsa -H hostname >> ~/.ssh/known_hosts


Don't do either of these things, please. You're given the opportunity to increase your chances of avoiding someone eavesdropping on your data transfers via a man in the middle attack-- take that opportunity. The difference is literally verifying that the RSA key you have is the one of the bona fide server and now you know how to get that information to compare them so you can trust the connection. Just remember more comparisons from different computers & networks will usually increase your ability to trust the connection.

Stupid Concatenated SSL .pem Maker

I seem to forget which order concatenated .pem certificates go in. I only do this kind of thing every so often.

The short answer is:

Private key on top.
Certificate from the signing authority in the middle.
Certificate Authority Chain file next.

https://github.com/bradchesney79/make-concatenated-ssl-pem

I have seen people refer to both the Certificate Authority Chain file and the file my script creates as a bundle. That is wrong-- the bundle is all two or three things (sometimes the chain file is optional).

If you want to know more about why and how certificates work, keep reading.

You start by generating a private key, this is a string that can be used mathematically to modify data in a way that it is not easily read by conventional means. This key is generally used to make a certificate signing request (CSR)-- it is a block of text based upon the private key that allows a Certificate Authority to issue an SSL certificate without you giving them your private key.

A Certificate Authority(CA) signs and distributes SSL certificates. SSL certificates are used in a similar manner as a public key and has meta data about your site such as the domain name secured, where the 'owner' of the site says the site is based, what level of 'reversible entropy(chaos)' is used to encrypt the data, what type of encryption to use, and sometimes less commonly used factoids. You will see 2048-bit or SHA256 for current levels and types of encryption for instance.

There is one root Certificate Authority in a chain-- which is conceptually shaped more like a tree in reality. The next top most Certificate Authorities are all verified as trusted by the root Certificate Authority. And layer upon layer so on and so forth so that the demonstration CA "Deering" and CA "Dunkirk" are trusted by CA "Catskills" who in turn is trusted by CA "Bridgeport". CA "Bridgeport" is trusted by none other than the root CA, CA "Alpha".



The Certificate Authority Chain file allows the browser to identify which signing authority said the site in question can be trusted. Due to it being a chain of trust, there may be more than one block. Some CA Chain files have more blocks to facilitate verifying trust for web 'agents' (usually a browser) in case the parent entity issuing the certificate isn't one your browser inherently trusts.

Certificates that are inherently trusted happen because the entities publishing the browser software may decide to include portions of the chain to bypass certain lookups and speed up verification of trust. Say a website is being provided by CA Eastwood. The browser asked Dunkirk about Eastwood, Dunkirk says yes Eastwood is good. Your browser asks Catskills if Dunkirk is trusted, Catskills affirms Dunkirk is trusted. Your browser then asks Bridgeport if Catskills is trusted, which it says Bridgeport is trusted. Finally, your browser asks Alpha if Bridgeport is on the up & up, and it is so your webpage you asked for shows up on the screen instead of an SSL warning screen.

Much of this is silly, the publisher decides Catskills is as far down as it will be asking, instead of going to the Internet and verifying up and down the chain every little detail-- many of the bits and pieces are installed right in the browser reduces a 5 entity request process by three requests, lessening load times and network traffic.

On a sort of related note, these preinstalled certifications are a good reason to keep your browser updated. Changes in which certs are sanctioned for good or bad happen with browser application updates.

And at a high level, that is how it works.

Protip for getting to the bottom. After installing the browser-- you can install the certificates your favorite sites use with the publisher installed certs and it can help load times-- more for smaller sites that may be paying bottom dollar for SSL certificates from a CA in the nosebleed seats of the chain of trust.

Fun Stuff with MySQL and Forks Giving Analyse() a Whirl

Go ahead, try it on your tables...

mysql> select * from users procedure ANALYSE();

Yeah, it's neat. Tells you all kinds of stuff like what the optimal column data types or lengths might be. Curious about what the longest length value is for a particular column in a table-- this "procedure ANALYSE()" will tell you.

Docker Push Trials and Tribulations...

So, we've got a little bit of an *buntu, docker, & dockerhub SNAFU.

Cannot push to my little corner of the default and standard repo. I kept seeing docker.io when I was hoping to see hub.docker.com . I mean that is how the URL works for github why wouldn't dockerhub work the same way? Right? Wrong.

So, below is the problem:

[brad@T540p testContainer]$ ls
Dockerfile
[brad@T540p testContainer]$ docker build -t bradchesney79/test:latest .
Sending build context to Docker daemon 2.048 kB
Step 1 : FROM bradchesney79/ubuntu:20160615
 ---> 9cde4627020a
Step 2 : MAINTAINER Brad Chesney <bradchesney79@gmail.com>
 ---> Running in aa3bc6c8be24
 ---> 2a8f3a7e4d36
Removing intermediate container aa3bc6c8be24
Step 3 : RUN apt-get -y update && apt-get -y upgrade
 ---> Running in 39c0d05faae7
Hit:1 http://archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://archive.ubuntu.com/ubuntu xenial-updates InRelease [94.5 kB]
Get:3 http://archive.ubuntu.com/ubuntu xenial-security InRelease [94.5 kB]
Get:4 http://archive.ubuntu.com/ubuntu xenial-updates/main Sources [84.3 kB]
Get:5 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages [268 kB]
Get:6 http://archive.ubuntu.com/ubuntu xenial-updates/universe amd64 Packages [117 kB]
Fetched 659 kB in 1s (586 kB/s)
Reading package lists...
Reading package lists...
Building dependency tree...
Reading state information...
Calculating upgrade...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
 ---> c97c8d3d88be
Removing intermediate container 39c0d05faae7
Successfully built c97c8d3d88be
[brad@T540p testContainer]$ docker login -u bradchesney79 -p password hub.docker.com && docker push bradchesney79/test:latest
Login Succeeded
The push refers to a repository [docker.io/bradchesney79/test]
bcf9ff8e307f: Preparing
75ea94f4fa07: Preparing
3c584ff3f03d: Preparing
5f70bf18a086: Preparing
737f40e80b7f: Preparing
82b57dbc5385: Waiting
19429b698a22: Waiting
9436069b92a3: Waiting
unauthorized: authentication required


The first part of last command was the problem. Needs --email or -e as part of the login credentials as shown below:


[brad@T540p testContainer]$ docker login -u bradchesney79 -e bradchesney79@gmail.com -p password hub.docker.com && docker push bradchesney79/test:latest
Warning: '-e' is deprecated, it will be removed soon. See usage.
Login Succeeded
The push refers to a repository [docker.io/bradchesney79/test]
bcf9ff8e307f: Pushed
75ea94f4fa07: Pushed
3c584ff3f03d: Pushed
5f70bf18a086: Pushed
737f40e80b7f: Pushed
82b57dbc5385: Pushed
19429b698a22: Pushed
9436069b92a3: Pushed
latest: digest: sha256:4f3069d3833c4519f5aa0fc5b805bde9963c705ef8c66aa1e472f451053f4bd9 size: 1985

Note the deprecated -e flag... fun stuffs. I wonder what I am supposed to use instead when -e stops working?

Quick Login Woes

So, off the top of my head I had a slower than I would like login to three sites today.

I don't mean to say they are bad sites or whatever. What I do mean to say is that it would be nice to be able to log in from the initial landing page.

The three I will name and the different ways they could be more efficient to use:

gMail

Come on Google, I get that allowing me to fill in my email or account name, clicking, having the account textbox fade out, the password textbox fade in, and then letting me give my password before submitting is nice, smooth, and fancy. Well done for the goals attempted.

But, I'd rather both textboxes and the submit button be available right on the index page.

Funimation

I don't want to dump on this company, they have provided me much entertainment for the very reasonable price of $8 a month. However, my first visit is redirected to http://www.funimation.com/welcome which has a login link. At least when you click that link from the welcome page, the login fields are showing by default at http://www.funimation.com/home. I want them to know that improvement is noticed and appreciated as formerly that was not the case.

But, I'd rather both textboxes and the submit button be available right on the index page.

Evernote

Again, well done for their purposeful execution of the designed functionality. But, after I land on the index page I have to click, then I can log in. This one is the most frustrating as I use this site so often. Aside from the initial unnecessary, annoying click, I like using it and it is very helpful in my day to day.

But, I'd rather both textboxes and the submit button be available right on the index page.

I would love to hear why these designs are unavoidable and not any excuses about brute force bots, which won't have any trouble navigating to the Step 2 where logging in happens.

Unable to find expected entry 'main/binary-i386/Packages' in Release file (Wrong sources.list entry or malformed file)

So, I was getting an error when updating due to my laptop automatically wanting to install the 32-bit Chrome browser package from the Google deb repository.

The error verbatim:
Failed to fetch http://dl.google.com/linux/chrome/deb/dists/stable/Release  Unable to find expected entry 'main/binary-i386/Packages' in Release file (Wrong sources.list entry or malformed file)

The solution is to specify you want the package for 64 bit architecture in your sources. You can do it in your /etc/apt/sources.list or via files within /etc/apt/sources.list.d/ (which is where Google installs its PPA for you).

Notice the architecture specification in the deb PPA line:
deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main

This is my whole sources.list file with the exception of the ubuntu make for installing android studio-- because why not:

#------------------------------------------------------------------------------#
#                            OFFICIAL UBUNTU REPOS                             #
#------------------------------------------------------------------------------#


###### Ubuntu Main Repos
deb http://us.archive.ubuntu.com/ubuntu/ wily main restricted universe multiverse

###### Ubuntu Update Repos
deb http://us.archive.ubuntu.com/ubuntu/ wily-security main restricted universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ wily-updates main restricted universe multiverse
deb http://us.archive.ubuntu.com/ubuntu/ wily-backports main restricted universe multiverse

###### Ubuntu Partner Repo
deb http://archive.canonical.com/ubuntu wily partner

#------------------------------------------------------------------------------#
#                           UNOFFICIAL UBUNTU REPOS                            #
#------------------------------------------------------------------------------#


###### 3rd Party Binary Repos

#### Gimp PPA - https://launchpad.net/~otto-kesselgulasch/+archive/gimp
## Run this command: sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 614C4B38
deb http://ppa.launchpad.net/otto-kesselgulasch/gimp/ubuntu wily main

#### Google Chrome Browser - http://www.google.com/linuxrepositories/
## Run this command: wget -q https://dl-ssl.google.com/linux/linux_signing_key.pub -O- | sudo apt-key add -
deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main

#### Kubuntu Backports PPA - https://edge.launchpad.net/~kubuntu-ppa/+archive/backports
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8AC93F7A
deb http://ppa.launchpad.net/kubuntu-ppa/backports/ubuntu wily main

#### LibreOffice PPA - http://www.documentfoundation.org/download/
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1378B444
deb http://ppa.launchpad.net/libreoffice/ppa/ubuntu wily main

#### Opera - http://www.opera.com/
## Run this command: sudo wget -O - http://deb.opera.com/archive.key | sudo apt-key add -
deb http://deb.opera.com/opera/ stable non-free

#### Oracle Java (JDK) Installer PPA - http://www.webupd8.org/2012/01/install-oracle-java-jdk-7-in-ubuntu-via.html
## Run this command: sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EEA14886
deb http://ppa.launchpad.net/webupd8team/java/ubuntu wily main

#### VirtualBox - http://www.virtualbox.org
## Run this command: wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | sudo apt-key add -
deb http://download.virtualbox.org/virtualbox/debian wily contrib

#### Linode CLI
## Run this command: wget -O- https://apt.linode.com/linode.gpg | sudo apt-key add -
deb http://apt.linode.com/ stable main

Getting basic relevant Macbook specs from the command line

So, this is a command to show you the specs, then dump the information on your Desktop in an XML file. Yaaay!

system_profiler SPHardwareDataType SPSerialATADataType SPAirPortDataType SPDisplaysDataType -detailLevel mini && system_profiler SPHardwareDataType SPSerialATADataType SPAirPortDataType SPDisplaysDataType -detailLevel mini -xml > "$HOME/Desktop/$USER-system-profile.xml"

"Man, you could do it with this one super obscure convention you would hardly ever use without the &&..."
'Yeah, probably.'

Lenovo s10-3 Netflix fix

So, when you unload video from the Intel Atom N45x series processor, thing get better six ways of Sunday. But, then you've filled up your regular mini PCIe slot and you have to go with USB Wifi some way or another. They make USB Wifi modules that use the USB wiring in the other little mini PCIe slot (since there is no PCIe connection in the extra slot).

The parts are linked below:

Broadcom BCM70015 Crystal HD PCI Express Mini Card Video/Audio Hardware DecoderHardware Decoder for Apple TV 1080p(TBS7015)
A discrete mini PCIE video card

SparkLAN WPER-172GN / 802.11nbg 1Tx2R MIMO / USB Half-Size MiniCard (Ralink RT5390U)
A 802.11n/g/b/a Wifi card with a mini PCIe connection-- but wired for USB

People also have reported luck with the Qcom Q802XKG.
Qcom QCM-Q802XKG Wireless WiFi WLAN Mini PCI-E Card 54Mbps 802.11b/g 60-6229-1A
Qcom QCM-Q802XKG

Beast on a Budget Section 1: Parts & Costs

So, I spent some of today posting the initial thread and a breakdown of the list prices, the shipping costs, the handling costs and the total costs for each.

Asrock Q2900M Motherboard
105.74P + 2.46S + 36.92H = 145.12
https://item.taobao.com/item.htm?id=35032832716

8GB DDR3 PC3-10600 1333MHz
39.99P + 0S + 0H = 39.99
http://www.amazon.com/gp/product/B0075U12H8

12V 6A 72W AC Adapter Power Supply
7.22P + 0S + 0H = 7.22
http://www.amazon.com/gp/product/B000VE7GQQ

12V DC 160W Pico PSU
18.98P + 0S + 0H = 18.98
http://www.amazon.com/gp/product/B00HLCT9HK

Intel PRO/1000 VT Quad Port Ethernet Card
29.99P + 0S + 0H = 29.99
http://www.ebay.com/itm/191634249417

2 (Two) Mini PCIe to PCIe Adapter with Three Antennas
10.23P + 1.70S + 0H = 11.93
http://www.dx.com/p/mini-pci-e-to-pci-e-pci-express-adapter-with-three-antennas-39267

Bplus MP2W-RPSMA : Full & Half mPCIe / minicard to PCIe Adapter with USB2.0 interface & 3pcs RP-SMA connectors for Wi-Fi & Bluetooth
29.99P + 0S + 0H = 29.99
https://www.amazon.com/gp/product/B00LBYVZZS
*This adapter works with the Atheros QCA9880 XB140 reference board based boards-- like the Compex WLE900VX, SparkLAN WPEA-352ACN, and AIRETOS AEX-QCA9880-NX --which do master mode among other state of the art 802.11ac things. Many other adapters do not.

Compex WLE900VX 802.11ac 2.4/5GHz Mini PCIe WiFi Card
55.00P + 0S + 0H = 55.00
http://www.ebay.com/itm/171865971474

Atheros AR5BXB112 802.11n 2.4/5GHz Mini PCIe WiFi Card
17.99P + 0S + 0H = 17.99
http://www.amazon.com/gp/product/B00881PHO2

MyDigitalSSD 64GB (60GB) 50mm Bullet Proof 4 BP4 50mm mSATA Solid State Drive SSD SATA III 6G - MDMS-BP4-060
20.00P + 0S + 0H
http://www.amazon.com/MyDigitalSSD-Bullet-Proof-mSATA-Solid/dp/B00B3X72TU

Syba mSATA SSD to 2.5-Inch SATA Adapter (SY-ADA40050)
10.99P + 0S + 0H
http://www.amazon.com/Syba-mSATA-2-5-Inch-Adapter-SY-ADA40050/dp/B007PPZ2I8

Grand Total 404.41

Getting ready to build the Q2900M beast router on a budget.

So, my faithful router is aging, badly. Time to let it "go to the farm" to live out it's days in peace. I've looked at what I can get out there to replace it. There is a lot of really neat networking tech out there these days, some more friendly to turbocharged 3rd-party firmware and some not.

A lot of really expensive hardware too. The most coherent and simple to set up thing to do would be to get a bunch of things that do one thing well-- as in one machine to do the thinking, a good switch, two access points. That was a pricey option and required several things.

I am willing to forgo some coherence to have it all in one unit that that the manufacturer expected me to load with third-party software. Having it all in one unit also gives me a lot of frugal upgrade options. Additionally, it is the least expensive way to meet all the criteria I have for such a device-- which has been missing in my current setup.

Having done a lot of reading, the software is the sticky part. Some of it is really great, but until you try it first hand and it works as expected then also is nice to use.

It was neat seeing what I had documented get shared so much when I wrote about my OpenSolaris/OpenIndiana ZFS file server build several years ago and I was kind of hoping to do the same with this-- maybe trying to do a better job this time with your help. Starting with that I have almost $400 of equipment to play with in the immediate future. What would you like to see me try? Are there any tests you would like to see?

I tried to not be ounce wise and pound foolish. What would it cost for me to build a router that I love? Turns out possibly $400 if everything works out as expected.

Yesterday I booted the motherboard for the first time.

I'm still waiting on the 802.11n package and a mini-PCIe to PCIe card converter (with antennae!) from dx.com. So, no wireless, but getting my USB flash drives loaded up with the installers will take some time and then there's the sitting down and doing it... They will be here in plenty of time.

Starting the documentation now.

The following sections are what I think I should compile to document this. Stay tuned while I write them. I have my ears open if you have any input.

5 Sections

---

• -Parts (Where sourced from, part, shipping/handling, & total cost when I can make a line item break down).
• -OpenWRT - Setup Notes & Bash Script (Not even sure if OpenWRT has bash, read ash through busybox-- I'll find out as I go.)
• -pfSense - Setup Notes & Bash Script
• -IPFire - Setup Notes & Bash Script
• -My conclusion and thoughts, metrics and comparisons; the opinion part based on the metrics and a few days of use.

The build is in the context of the following reqs:

---

• Use of Multi-Core 64-bit Processing. (Fanless Intel Quad Core J2900)
• Use of DDR-3... or better. (8GB)
• Use of Gigabit LAN Ports. (5, one onboard, four via Intel PRO/1000 VT)
• Use of 802.11b/g/n/ac. (one 3x3 MIMO 802.11ac with AP Mode, one 3x3 MIMO 802.11n with AP Mode)
• Use of USB for printing. (USB 3.0 -- and a paralell port...)
• Use of mass storage possibly by PCI-E, SATA, MSATA, and/or SD-Card(micro || full-size). (two SATA2 ports)
• Use of USB for mass storage. (two at the back plate, three via motherboard headers)
• Low voltage and low power consumption. (72 W)

To the following ends:

---

I stream a lot of video via my Roku, the kids watch a lot of Netflix in the morning, I have a half dozen hardwired machines in my office that make fair use of gigabit speed file transfers, the router & two other machines use DDNS, SSH via NAT happens, a couple IP cameras store images & send MJPEG streams, an old HP LaserJet USB->Paralell network prints, and more and more wireless devices as time creeps on over g & n wireless adapters.


I am ~70% happy with my current setup. Preferably, I'd like to run a little web-server & file server right from my firewall/router as well as have more SSIDs. This is the missing 30%. I'm already serving a site from a separate machine-- but seriously, the traffic is so low that I feel guilty for burning the watts. And I also wouldn't even consider giving up my dedicated file server, but somewhere to quickly stash files I don't have too much care for would be nice.

I have my Roku on the same wireless as my own personal botnet I play with, I'd like separate APs so that my internal traffic doesn't affect my kid watching Netflix in the morning when I do need the TV to be a babysitter (I know, I know, just turn off the machines talking to each other... but, I don't).

I'll keep my eye on the reddit posts, hope to hear some words of wisdom or things I should do some heavy reading about that will make my task easier. Thanks.

My Favorite 3rd Level Subdomains

alpha app

admin

api

beta

blog

dev

feed

files

forum

ftp

help

image

imap

img

info

lists

live

mail

media

mobile

mysql

news

photos

pic

pop

search

secure

smtp

status

store

support

videos

vpn

webmail

wiki

www

Not committing merge; use 'git commit' to complete the merge.

So, say you are leaving your current development branch in git to a standard base branch of your repository-- you checkout the branch in your local environment then you pull from the remote and lo and behold there is a merge conflict.

Not committing merge; use 'git commit' to complete the merge.

What I usually want to do is to:
git checkout remote/branch local/path/to/file

Here's to no more 'github shenanigans commit messages...'