Configuring SSSD for GPO Access Control and XRDP

To configure SSSD (System Security Services Daemon) for Active Directory Group Policy Object (GPO) access control and XRDP integration, follow these steps:

SSSD Configuration

1. Open the SSSD configuration file: /etc/sssd/sssd.conf
2. Add the following lines to the configuration file:

ad_gpo_access_control = enforcing
ad_gpo_map_remote_interactive = +xrdp-sesman

Explanation:

• ad_gpo_access_control = enforcing enables enforcement of GPO access control policies.
• ad_gpo_map_remote_interactive = +xrdp-sesman maps XRDP sessions to the appropriate GPOs.

Restart SSSD

After making the changes, restart the SSSD service:

service sssd restart

Reference

For more information, refer to the following GitHub issue:

https://github.com/neutrinolabs/xrdp/issues/906

LUKS2 on gentoo

We'll create an encrypted root partition.

At first we measure the performance of encryption:
cryptsetup benchmark

Probably the one of the fastest encoder and decryption is the aes-xts so we format with it:

cryptsetup luksFormat -c aes-xts-plain64 -s 256 -y -v /dev/nvme0n1p3
cryptsetup luksOpen /dev/nvme0n1p3 root
cryptsetup status root
cryptsetup --allow-discards --perf-no_read_workqueue --perf-no_write_workqueue --persistent refresh root
cryptsetup luksDump /dev/nvme0n1p3 | grep Flags
cryptsetup close root # of course you don't have to close here

Now create a F2FS filesystem about this encrypted partition:
mkfs.f2fs -O extra_attr,inode_checksum,sb_checksum,compression /dev/mapper/root

Now install your gentoo following the gentoo handbook.
After install base system you have to set up the following: grub, dracut, fstab.

Query the UUIDs:

lsblk -o name,uuid

You need two UUID one is for filesystem another the LUKS partition (above we named it root).

vim /etc/defaults/grub
GRUB_CMDLINE_LINUX="rootflags=atgc rw rd.luks.uuid=yourLUKS_UUID root=UUID=yourROOT_UUID"
--exit

We added atgc and rw because F2FS by default mount with RO.

Now update fstab, similarly add boot and root as a common ways, be sure not mixed with LUKS UUID.

Update /etc/dracut.conf.d/luks.conf
add_dracutmodules+=" crypt dm rootfs-block " kernel_cmdline+=" root=UUID=luksIDD rd.luks.uuid=rootIDD "

Generate initial image:
dracut --kver yourkernelID (you can find it under /lib/modules/)

Now you ready to reboot, of course sync and umount partitions. 

 

Refs.:

https://wiki.archlinux.org/title/dm-crypt/Encrypting_an_entire_system#LUKS_on_a_partition

https://wiki.archlinux.org/title/F2FS

https://wiki.gentoo.org/wiki/Handbook:AMD64/Installation/About

F2FS Encryption: Enhancing Storage Security and Performance

F2FS (Flash-Friendly File System) is a modern file system designed specifically for flash-based storage devices. In this post, we'll explore F2FS encryption and how to set it up, along with some advanced features to optimize your storage.

To create an F2FS partition with encryption support, use the following command:
mkfs.f2fs -O extra_attr,inode_checksum,sb_checksum,compression /dev/nvme0n1p3 -f

Let's break down the options:

• extra_attr: Enables extended attributes, which are necessary for encryption.
• inode_checksum: Adds checksums to inodes for improved data integrity.
• sb_checksum: Enables superblock checksums for additional protection.
• compression: Activates built-in compression support.

To mount your F2FS partition with encryption add the following line to your /etc/fstab file:
/dev/nvme0n1p3 / f2fs defaults,compress_algorithm=lz4:5,compress_chksum,atgc,gc_merge,noatime 0 1

Explanation:

• compress_algorithm=lz4:5: Uses LZ4 compression with a compression level of 5 (range: 1-6).
• compress_chksum: Enables checksum for compressed data.
• atgc: Activates Active Garbage Collection for improved performance.
• gc_merge: Merges segments during garbage collection for better space utilization.
• noatime: Disables updating access times, reducing write operations.

Above article was generated by Claude AI based on my inputs.
My goal was to reduces the wear and tear on the NVME thanks for the compression.

gentoo existing backup/reinstall your system quickly

 There is a good tool for Linux that simplifies the archiving process:

"Mkstage4 - Stage 4 Tarballs Made Easy"

This blog post was made for me. I understand the risks, so keep them in mind while reading the following. Partitioning can cause data loss, so make sure you have backups of everything. It's best to work on a new and empty machine without dual-boot or any data that hasn't been backed up.

Using it is simple:

$ sudo mkstage4 -l -e "/home/*"  -C zst -s genci

After this step finishes, you'll get a "genci.tar.zst".

Here's a copy-paste from the help:
-l: excludes lost+found directory.
-e: an additional excludes directory (one dir one -e, do not use it with *).
-s: makes tarball of current system.
-C: specify tar compression (default: bz2, available: lz4 xz bz2 zst gz).

The last parameter is the archive name without extension. You can safely use the home folder because it will be excluded. I prefer zst because it is super fast, although not the most efficient compressor.

Now we have an archive of the system without the home folder.

Boot a new machine (I also prefer gentoo livecd, because it set up wifi/net easily, and has GUI partition editor) or the same one:

Create the required partitions and mount the root to /mnt/gentoo.

$ mkdir -p /mnt/gentoo/boot

Mount boot EFI partition (a partition with fat32, about 0.5Gib or 1Gib) into /mnt/gentoo/boot

cp genci.tar.zst /mnt/gentoo
tar xvpf genci.tar.zst

mount --types proc /proc /mnt/gentoo/proc
mount --rbind /sys /mnt/gentoo/sys
mount --rbind /dev /mnt/gentoo/dev
mount --bind /run /mnt/gentoo/run
mount --make-rslave /mnt/gentoo/sys
mount --make-rslave /mnt/gentoo/dev
mount --make-rslave /mnt/gentoo/run

chroot /mnt/gentoo
grub-install --efi-directory=/boot
grub-mkconfig -o /boot/grub/grub.cfgblkid
! Update your UDID in vim /etc/fstab...
exit
umount /mnt/gentoo
sync
reboot

Now you are done. But without the home folder, there may be issues. You can copy the entire home folder if you want, or you can add a new user.

ref.:
https://www.tutorials.chymera.eu/blog/2014/05/18/mkstage4-stage4-tarballs-made-easy

Midnight Commander and Fedora 40

I've been trying to get Midnight Commander (mc) to work properly with the CTRL+SHIFT+ENTER key combination in KDE Plasma, and I'm running into a strange issue.

I've tested this on various distributions, including Gentoo and Debian, and it works flawlessly everywhere.

However, on Fedora 40, CTRL+SHIFT+ENTER doesn't seem to function as expected within mc.

Has anyone else encountered this problem with Fedora 40 and Midnight Commander? Any suggestions or workarounds would be greatly appreciated.

Minimal OpenSUSE Tumbleweed Setup

This guide outlines a minimal setup for OpenSUSE Tumbleweed, focusing on essential applications and addressing common issues like H.264 codec support.

Install Core Applications

$ sudo zypper install smplayer git remmina keepassxc cmake-gui

Fix H.264 Codec Support

Add the Packman repository:

$ sudo zypper ar -cfp 90 https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Tumbleweed/packman

Update your system, pulling packages from Packman:

$ sudo zypper dup --from packman --allow-vendor-change

Install Transgui

For additional functionality, consider installing Transgui. You can find instructions and builds here: https://build.opensuse.org/project/show/home:biserov

Remove Unwanted Applications

If you don't need VLC, remove the following packages:

$ sudo zypper remove vlc-noX vlc-qt

kvm, virtio

$ sudo vim /etc/libvirt/qemu.conf user = "root" group = "libvirt"

$ sudo systemctl restart libvirtd

$ sudo usermod -a -G libvirt $(whoami) KVM:

$ mount -t 9p -o trans=virtio /tagname /tmp/guestname

Removing Unwanted Xiaomi Apps

This guide will show you how to remove pre-installed Xiaomi apps on your Android device using ADB commands.

Identifying Package Names

First, connect your device to your computer and enable USB debugging. Open a terminal window and execute the following commands.

$ adb shell

$ pm list packages | grep ‘xiaomi’
$ pm list packages | grep ‘miui'

These commands will list all installed packages and filter for those containing "xiaomi" or "miui" in their names.

Note down the package names of the apps you want to remove.

Uninstalling Apps

Use the following command to uninstall an app, replacing `<PackageName>` with the actual package name:

$ pm uninstall -k —user 0 <PackageName>

The `-k` flag preserves the app's data, allowing you to reinstall it later. The `--user 0` flag specifies the primary user.

Restoring Apps

$ cmd package install-existing <PackageName>

Removed:

com.xiaomi.micloud.sdk # sdk for developer

com.google.android.projection.gearhead #android auto

com.android.egg # eastern egg

com.miui.yellowpage

com.aura.oobe.bouygues

com.orange.update

com.orange.aura.oobe

com.sfr.android.sfrjeux

Strange list of unwanted apps:

com.altice.android.myapps
com.android.camera
com.android.cameraextensions
com.android.musicfx
com.android.wallpaperbackup
com.android.wallpapercropper
com.android.wallpaper.livepicker

com.google.android.apps.turbo
com.google.android.apps.wellbeing
com.android.egg
com.android.hotwordenrollment.okgoogle
com.android.hotwordenrollment.xgoogle

com.bsp.catchlog
com.fido.asm
com.google.android.apps.googleassistant
com.google.android.marvin.talkback
com.google.mainline.adservices
com.google.mainline.telemetry
com.ironsource.appcloud.oobe.hutchison
com.lbe.security.miui

com.tencent.soter.soterserver
com.wdstechnology.android.kryten

com.miuix.editor
com.miui.miwallpaper
com.miui.miwallpaper.overlay
com.miui.miwallpaper.overlay.customize
com.miui.miwallpaper.wallpaperoverlay.config.overlay
com.miui.player
com.miui.videoplayer
com.miui.wallpaper.overlay
com.miui.wallpaper.overlay.customize
com.aura.oobe.vodafone
de.telekom.tsc

com.sfr.android.sfrjeux
com.orange.aura.oobe
com.orange.update
com.aura.oobe.bouygues
com.miui.yellowpage

debian + NetworkManager generate resolve.conf at every reboot

Sadly the NetworkManager overwrite my resolv.conf. To fix I found followings:

$ vim /etc/NetworkManager/conf.d/90-dns-none.conf

[main]

dns=none

$ systemctl reload NetworkManager

Above section disable update NetworkManager overwrite your custom dns resolver.

Now you can add you favorite dns provider like me with Cloudflare:

$ sudo tee /etc/resolv.conf << END
nameserver 2606:4700:4700::1111
nameserver 1.1.1.1
nameserver 1.0.0.1
nameserver 2606:4700:4700::1001
END

Have nice day...

Set up tc_malloc to default on the whole system on Linux

You can use a faster memory allocator for multi-core CPU if you use Google's tcmalloc (https://github.com/google/tcmalloc).

At first install tcmalloc from your repository:

$ apt install libtcmalloc-minimal4

 Now ready for testing with Firefox:

$ LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libtcmalloc_minimal.so.4 firefox

If you like it, now you're ready to apply system wide:

$ cat /etc/ld.so.preload
/usr/lib/x86_64-linux-gnu/libtcmalloc_minimal.so.4


This is tested on Debian Bookworm and Linux Mint.

Do at your own risk! On this site I give the quick step without detailed description, benchmark and other things.

 

Have a nice day!

Mounting nfs

Mount NFS share on Fedora with Asustor. At first check official description here:

https://www.asustor.com/en/knowledge/detail/?id=&group_id=508

After you do the share on your Linux you can add to /etc/fstab:

192.168.1.66:/volume1/Z /media/Z nfs defaults 0 0

192.168.1.66:/volume2/X /media/X nfs defaults 0 0

 

Of course you can try mount manually:

$ mount -t nfs 192.168.1.66:/volume1/X  /media/X

Longer sudo

Debian based:

$ sudo update-alternatives --config editor

Fedora based: 

$ export EDITOR=vim 

$ sudo visudo /etc/sudoers

Add timestamp_timeout after env_reset:

Defaults        env_reset,timestamp_timeout=40

Now bash will remember for 40 minutes.

0 means always ask passwd, disable passwd forever set to -1.

DualBoot headphone bluetooth connection issue

So my XM3 unable to connect when I change OS at boot (Win10 vs Debian11).

Short version (all in superuser, su or sudo):

$ bluetoothctl

$ devices (this will print macaddresses)

$ remove xx:11:22....

$ service bluetooth restart

Description:

Some bluetooth device don't like pairing associated by same MAC address. Remove and repair bluetooth.

Debian Sony XM3 bluetooth connection issue

I installed Debian 11 but sometimes got connection error. Now I provide a simple solution to fix it in case the following:

sap-server: Operation not permitted (1)


At first the SAP stands for SIM Access Profile.


With vim edit "/etc/systemd/system/bluetooth.target.wants/bluetooth.service"

At line ExecStart=/usr/lib/bluetooth/bluetoothd add the following:
--noplugin=sap

Like this:
ExecStart=/usr/lib/bluetooth/bluetoothd --noplugin=sap


Now restart:

$ sudo systemctl daemon-reload
$ sudo service bluetooth restart
$ sudo service bluetooth status



You're becoming a happy user who able to connect to your Sony headphone.

Just a minor update:

For fresh Linux installment you can grab deb or rpm broadcom drivers:

https://github.com/winterheart/broadcom-bt-firmware

Garmin Connect Driver and Sht Windows 10 in VirtualBox

I have a Garmin ForeRunner 945 sport watch. I like it worked everything fine until I had an idea to leave Windows for Linux. I become a happy Linux Mint Cinnamon 20.2 User.

Of course Garmin has no official Express for Linux but I installed a VirtualBox with Windows. I think this should work I would like to sync a weekly in OS, maybe software update etc..., not just phone.

But as other guys on the Internet I met the followings "Garmin Express not working in Windows 10/VirtualBox" :(

I spent two weeks to find a solution in a random forum:

"

To install the Media Feature Pack, navigate to Settings > Apps > Apps and Features > Optional Features > Add a Feature and find the Media Feature Pack in the list of available Optional Features

"

grrrrr, I was angry and happy...

add user to sudoers

Add new user to sudoers:

 $ vi /etc/sudoers

username  ALL=(ALL) NOPASSWD:ALL

To request password remove NOPASSWD:

username  ALL=(ALL) ALL 

GarminExpress on Linux Mint 20

Little bit late tonight, but I promise to you I'm going to explain the details:




Quick steps:


$ WINEARCH=win32 WINEPREFIX=/home/$USER/GarminExpress winetricks d3dcompiler_47 dotnet472 vcrun2010 corefonts

$ WINEARCH=win32 WINEPREFIX=/home/$USER/GarminExpress winetricks win7

 

$ WINEPREFIX=/home/$USER/GarminExpress wine-stable explorer /desktop=garmin,1366x768 /home/$USER/Downloads/GarminExpress.exe

This works with the latest version Garmin Express 7.1.0.0.


Have a nice day.




Useful VS hotkeys

Keys:

quick info = Ctrl + k + i
format code = Ctrl + k + f
output window = Ctrl + Alt + o

Rebuild debian package

You can recompile your favorite package:

First you have to install this package:
apt install build-essential

In this example were going to rebuild midnight commander:

Create file for your custom flags under /etc/dpkg/buildflags.conf:
APPEND CFLAGS -march=native
APPEND CXXFLAGS -march=native
APPEND LDFLAGS -fuse-ld=lld


$ apt source mc
$ apt build-dep mc
$ dpkg-source -x mc-revision.dsc # this is optional, extract source package
$ cd mc-revision
$ debian/rules binary

I had to set up PATH for ldconfig:
$ PATH=/usr/sbin:$PATH dpkg -i mc-revision.deb

or "single" liner (or course you need fakeroot or su):

# apt build-dep mc

$ apt-get --build source mc


Or is a better to use apt-build to fetch and optimize packages for your machine.

 

After you got the packages you can install with dpkg.

$ dpkg -i mc

Or you can create your local repository:

$ sudo mkdir -p /usr/local/mydebs

$ cd /usr/local/mydebs 

$ dpkg-scanpackages . /dev/null | gzip -9c > Packages.gz

  Add this one to sources (/etc/apt/sources.list) :

deb[trusted=yes] file:/usr/local/mydebs ./ 

 
sudo apt-get update 

And you your a happy owner of your own super native repositorty.

Gerrit change meta config

To get Gerrit repository meta config:

git fetch origin refs/meta/config:refs/remotes/origin/meta/config
git checkout meta/config

And upload your changes:

git commit -a -m "Added label - Verified"
git push origin meta/config:meta/config