Posts

    Neues Dokument 1

    Bitte habt ein wenig Nachsicht mit mir, es ist mein erstes Mal auf dieser Bühne.

    …

    Eigentlich…

    Eigentlich müsste man das ja alles mal aufschreiben…

  • Adding your Yubikey's SSH keys to your agent automatically

    Sometimes, systemd makes things reasonably easy:

    First of all, we want a new udev rule we can latch onto:

    % cat /etc/udev/rules.d/98-yubikey5.rules 
SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="1050", SYMLINK+="yubikey", 
TAG+="systemd"

    This will create /dev/yubikey when a USB device from Vendor 0x1050, Yubico, is plugged in. Use udevadm control --reload to enable the new rule.

    Now, we can have a user-level systemd unit that is started by this device:

    % systemctl --user cat yubissh.service 
# /home/(me)/.config/systemd/user/yubissh.service
[Unit]
Description=Autoload Yubikey SSH keys

BindsTo=dev-yubikey.device
After=dev-yubikey.device

[Service]
RemainAfterExit=true
Type=oneshot
ExecStart = ssh-add -s /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
ExecStop  = ssh-add -e /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

[Install]
WantedBy=dev-yubikey.device

    Enable this with systemctl --user daemon-reload && systemctl --user enable yubissh.service and you should be good to go. (Don't forgot you need some sort of ssh-askpass binary, too!)

  • I dent, you dent, we all dent for syslog.

    This was a "fun" one to figure out… we run a (actually several) shared PHP-FPM setups at work for our customers. While they're not big or sensitive enough to warrant per-user process segregation, we'd still like them to get their own php error logs, so we can tell them they need to fix their own messes.

    This is possible, but a bit… batteries not included, let's say. I have about six points in the following where either the semantics are unclear but currently work the way I want them to, or the features I use are so obscure that PHP might drop them.

    Step 1: use syslog.

    Starting from PHP 7.3, you can set syslog.ident, the prefix of syslog messages. It's configurable at PHP_INI_SYSTEM level, i.e. basically in php.ini. I won't go into detail on how to point the syslog to a remote logging server or something like that, partially because I don't understand rsyslog enough, it can't possibly be as bad as it feels to me.

    Step 2: but that doesn't work, does it?

    We have several users connecting into the same php-fpm processes, which share a common php.ini. Are we out of luck? As it turns out, no. Well-hidden in the docs, we find that you can have php.ini sections that only apply to certain directories or hostnames:

    [PATH=/home/user1/public_html]
syslog.ident = "user1php"

[PATH=/home/user2/public_html]
syslog.ident = "user2php"

    Step 3: but you'll have a monolithic, often-changing php.ini now!

    Turns out, no. There is an environment variable PHP_INI_SCAN_DIR, again so documented you only find it if you know it exists, that points at a directory full of .ini files and applies all of them. You will have to augment your systemd service file to use it:

    Environment=PHP_INI_SCAN_DIR=:/etc/php/7.4/fpm/accounts.d/

    Step 4: but that doesn't work, does it?

    You're right. phpinfo() will tell you all the settings get there, but you won't see the prefixes you want in the syslog. This is because even though you can set syslog.ident on a per-directory basis, it's only used once, when openlog is called. (This might be implicitly when syslog() is called for the first time.)

    So, we need more help, by way of auto_prepend_file. Prepending something to every file at parse time is exactly what we need to make sure the proper syslog.ident is applied:

    @closelog();
@openlog(ini_get('syslog.ident'),
         LOG_NDELAY,
         constant("LOG_" . strtoupper(ini_get('syslog.facility'))));

    Yes, that constant(…) construct looks ugly and is probably not the best way to do it. In practice, you could probably hardcode the value you want there anyway. You probably don't strictly need the closelog() either.

    And yes, this is semantically very odd: as per docs,

    [t]he [autoprepended] file is included as if it was called with the require function

    and it doesn't itself need to be within the scope given by the [PATH=] section, it just needs to be covered by open_basedir and include_path. This is something I'm pretty worried about, because it looks like the intended behaviour is under-defined, so if it breaks it's just "why did you use such a border case anyway".

    Step 5: Is this going anywhere useful?

    We're almost there. It'll look good when you test it. It'll fall over in production and direct all logs to a small number of files. The problem will mysteriously go away as you try to debug it, and come back when you're not looking.

    The problem is: opcache. PHP keeps some files parsed and precompiled to bytecode for performance reasons. Since our autoprepended file is getting hit for literally every request, it will never leave the cache unless you change the source file. Unfortunately, though, bytecompiling it will apparently resolve the ini_gets since it thinks they're constants. I can't blame opcache here, after all, it's the literally same file, just included from different paths.

    Fortunately, there is the (at time of writing still named thusly) opcache.blacklist_filename, with which you can tell PHP to never cache bytecode for the autoprepended file.

    Step 6: Profit??

    Now you should get your nice stream of syslog messages with the right prefixes. Splitting that off into different files is left as an exercise for the reader. ;-)

  • This is not the error page you aren't looking for

    Tired of manually managing redirects because users can't spell? Proxy all 404 pages to your local link shortener, and let that sort it out.

    ErrorDocument 404 /.404/%{sha1:%{SERVER_NAME}%{REQUEST_URI}}?%{QUERY_STRING}
RewriteRule ^/.404/(.*)$ http://sho.rt/$1 [P]

    (Needs to be a [P] in order to not have a redirect to a 404 in case of non-existing page.)

    Some days, I love myself.

    I just found this left to me by myself in an internal workflow: 

    Mass update steps
Updating now, cross your fingers and hold on to your hats

    
/preptest
    cau201y.editors:default ... done
    cau201y.theme:default ... done

    Unfortunately, I didn't tell myself how to hold the hat with crossed fingers.

    Tempora mutantur, nos et mutamur in illis


    While the new semester is not to start for yet another while, it already casts its shadows: new students moving into the flats, wandering across campus aimlessly, standing at the supermarket checkout buying prosecco, Jägermeister, beer and frozen pizza to celebrate the beginning of this new, exciting phase in their lives.
    How different it feels, eleven years later, at the other end of that particular tunnel. No longer one of the bright-eyed and bushy-tailed masses, but one who will part them effortlessly by December, as their instincts tell them: he doesn't carry a coat, he must have an office, he must be staff. And staff I am, a position of good security and rather moderate pay, the limited contract I took on as a breather after my degree un-limited to a permanent position.
    Sometimes, in retrospect, that student life seems so much more desirable than the one I have now. But then, it is as much their life that seems this way: a life that runs a more conventional course, that is undisturbed by the very binary approach to drug abuse both recreational and non- that is the best thing I can manage, a social life that is not routinely thrown out of kilter by fits of depression, not to mention the occasional breakdown and suicide attempt.
    If one were to look at the blue notepad on the top shelf next to my graduation yearbook, one might find: "we all prefer the problems of the past to the problems of the present: existance of the latter proves the solvability of the former". A sentiment I still agree with, and one I'd rather push than any claim that "it gets better" and the world is about to turn into pink bunny fluff because one is entitled to it. It is not some unspecifiable "it" that improves by the human sacrifice we make at its altar, it is ourselves. As much as I have renounced the faith of docile servitude, it is the theological concept of adversary (Anfechtung) that resonates in me on this.
    But I digress, and I shall steer away from such melancholy musings. The hubbub of students will recommence soon outside my office, and I might feel the occasional abstract twitch. Naturally, I am coming into an age where this is rather ridiculous: beside any socio-legal issues, all parties involved would feel rather awkwardly silly about this. Maybe, the blackness of a golden age is dawning [if Goethe is allowed "green is the golden tree of life", I can have a dawn into golden blackness if I bloody well please], the urge for companionship, so messily tangled into sexuality, finally firmly put back into its cardboard box, neatly shelved and stencilled.
    There's classical music on the radio, only interrupted by bursts of static from the thunderstorm outside -- another upside of AM radio over the technical sterility of digital music transmission --, Beethoven's Pastorale, linked in my mind to deer prancing across green meadows in the death scene of Soylent Green.
    Don't worry about that, that was just a freak event that fit too well to omit. And don't worry about me, I'm fine. Even when I'm not fine, I am. Decades of depression have trained me for a lifetime of it. Trust me, I'm a professional.

    It's February, I bring you links. And a rant.

    Renamed, because that seems to be more appropriate now. Oh, and ever since the cheezburger stuff has started doing pointless adlayer shite, I'll link to the images here directly.
    So, not much to link.
    But not much is coming my way. Apart from the score to "The internet is for porn":


    A propos the recent discussion on body image, German magezine Der Spiegel reported on a student who interviewed and photographed people who had been in treatment for eating disorders. Nice artful pictures, I'm not sure if it's worth running the rest through your babelfish of choice, apart from this one bit:
    Sampson (the artist): I had always planned to visit the clinic again one day. Back [when I was there myself for anorexia], I always lacked somebody coming to say "it's possible to succeed". I always read the statistics, and they look bleak. There's an oft-quoted staple amongst people with E.D., which I used to use, too: "Well, you learn to live with it." Very few believe in a total recovery. I wanted to encourage the affected. Well, well, well, what do you expect me to say? No, you will not "recover entirely". It becomes part of your past, part of who you are, even if you don't have to watch it. Frankly, I believe that those who want total recovery have drunken the Kool-Aid of societal standards. Fuck that. Everybody who, being "entirely recovered", erases these things from their past perpetuates the thought that these are poor misguided minorities who need to be cured. Again, fuck that. I've been an active functioning alcoholic for several years, I have my share of depressive phases, including three or four attempted suicides, and my sexuality only varies in what kind of deviant it is. None of this will magically become undone. And all of these things have made me a better person, they've made me more like me, they've given me insight and serenity and humility and compassion. Maybe not enough of these, but some. And I'm not bloody going to recover from being myself, and I'm not going to say I'm sorry for that.