KDE and Qt programs look bad when in a different window manager

If you are using KDE or Qt programs but not in a full KDE session (specifically, you did not run “startkde”), then as of KDE 4.6.1 you will need to tell Qt how to find KDE’s styles (Oxygen, QtCurve etc.)

KDE and Qt programs: look without oxygen theme with gnome look
KDE and Qt programs: look without oxygen theme with gnome look
KDE and Qt programs: look with oxygen theme
KDE and Qt programs: look with oxygen theme

You just need to set the environment variable QT_PLUGIN_PATH. E.g. put

export QT_PLUGIN_PATH=$HOME/.kde4/lib/kde4/plugins/:/usr/lib/kde4/plugins/

into your /etc/profile (or ~/.profile if you do not have root access). qtconfig should then be able to find your kde styles and everything should look nice again!

Helper links:

KDE and Qt programs: qtconfig tool menu
KDE and Qt programs: qtconfig tool menu

Black Mirror. La miniserie

Black Mirror. Cabecera de la serie
Black Mirror. Cabecera de la serie

Black Mirror son en realidad 3 capítulos, no es ni siquiera una serie.

– El primero me ha costado verlo pero no está mal. Aunque sea ficción, hay ficción que es dificil de creer.

Black Mirror. The National Anthem. El himno nacional. Fotograma
Black Mirror. The National Anthem. El himno nacional. Fotograma

– El segundo lo he pasado por encima a las 2 minutos de lo aburrido que era.

Black Mirror. 15 Million Merits. 15 millones de méritos. Fotograma
Black Mirror. 15 Million Merits. 15 millones de méritos. Fotograma

– El tercero magistral. La interpretación de la obsesión, la investigación y el ver plasmado como invento tecnológico ese cacharro que siempre he querido tener.

Black Mirror. The Entire History of You (In Memoriam). Tu historia completa. Viendo, el interfaz de usuario.
Black Mirror. The Entire History of You (In Memoriam). Tu historia completa. Viendo, el interfaz de usuario.

Black Mirror. The Entire History of You (In Memoriam). Tu historia completa. Viendo recuerdos.
Black Mirror. The Entire History of You (In Memoriam). Tu historia completa. Viendo recuerdos.

Si sois de los que os gusta saber de qué va algo antes de visionarlo os dejo un enlace a un muy buen análisis y completo de los 3 capítulos en uno de los medios más interesantes que han surgido últimamemte, jotdown.
En jotdown la lectura plácida de artículos recupera la vida.

Actualización:
Para quien tenga curiosidad, existen casos de gente que tiene una memoria prodigiosa que se asimila al invento del tercer capítulo.
Los enlaces son estos 3:

Espero que lo disfrutéis.

How to securely activate SSH into your Synology DiskStation with SSH Keys and no root login

I like to have access to my private network at home, wherever I am, and for me the best choice is to have an ssh server available. I use it for privacy reasons, because i don’t want anyone to know what could be my email, what webs do i visit, etc. Like I explained while ago in Jump over private corporate proxy with Firefox (or git, or any SOCKS ready app) through a SSH tunnel.

As I’ve shutdown my own server to avoid the noise, power waste, gain some space, and to stop worrying about hardware or connection failures and I’ve recently purchased and advanced NAS (Synology DiskStation) I would to explain how to securely active ssh on it.

The Synology DiskStation supports both telnet and SSH, but you should never use telnet when dealing with passwords or when you don’t want to be spied, as it is completely insecure.
Everyone should instead use SSH as it is very secure and almost the standard option.

Synology DiskStation DS211
Synology DiskStation DS211

How to enable SSH and users to login

It’s easy to enable SSH on your DiskStation by going to Control Panel > Terminal & checking the box next to Enable SSH Service.
You can now log in with your root username & password. If you need to login with any other user, you need to enable user’s home and let them use login with a shell.
To enable your user’s home, go to Control Panel -> User -> User Home -> There enable the user home service.
To enable your user’s to login with a shell, you have to edit the file /etc/passwd. Here is an example with the common contents when you have 2 users, one with a enabled shell (/bin/sh) the other without:

How to enable SSH with SSH keys

But that’s not enough. Logging in with a username and password isn’t nearly as secure as requiring SSH keys. When you use password based authentication, anyone can try to reach the port and use bruteforce to gain login credentials.
With public keys authentication, you have a private key on your computer, a public key on the SSH server (the Synology DiskStation in this case). When someone tries to log in via SSH, the server looks at the public key and asks for the corresponding private key. No private key, no login.
NOTE: I’m assuming that you have already generated SSH keys. If you haven’t, you can easily find instructions on the Web.
The needed SSH daemon’s config file to allow access via keys differs from original in :
Edit /etc/ssh/sshd_config using vi, I’ve highlighted in a shortened example the changed options to harden SSH:

Save the file and restart the SSH daemon. The easier is to use the GUI/WEB login. Click on the Control Panel -> Terminal. Uncheck Enable SSH Service, apply, check it again, and press apply again.

Enabling your user public key in authorized_keys

Of course you have to copy to your home directory your ssh public key inside a ssh directory and file called authorized_keys. I would recommend to be careful with permissions.

Try logging in now, with a username enabled to login. You won’t be prompted for a password; instead, you’ll get a nice shell see:

To test our hardening Try logging in now, but use a username that doesn’t exist on the server. You won’t be prompted for a password; instead, you’ll see:

No key, no admittance. No passwords accepted. Excellent.

Extra point. No root login, just for localhost.

An allowed ssh root login for a hacker/juanker is like honey for a bear.
So what we will do is to enable ssh public key access just for our localhost..

Edit /etc/ssh/sshd_config using vi, I’ve highlighted in a shortened example the changed options to harden SSH:

And, next, include this Match rule at the end of file, as Match rules may affect all config options below it. Using without-password we allow root login using public key.

One more step is needed, repeat point “Enabling your user public key in authorized_keys” for root user.

Save the file and restart the SSH daemon. The easier is to use the GUI/WEB login. Click on the Control Panel -> Terminal. Uncheck Enable SSH Service, apply, check it again, and press apply again.

Extra point enable root login from a shell using su. DEPRECATED

DEPRECATED
Of course we still need to have root access to Synology, anything can happen.
If along any of the steps, or whatever, you have seen this error message while trying to use ‘su’:
‘su: must be suid to work properly

What is happening is that permissions on binary /bin/busybox are “wrong”, run this as root to fix it.

DEPRECATED

Restart ssh server from CLI

If you want to restart your ssh server from CLI, use this script. Running it in background guarantees that the command will be completed. Because when you launch it, your currrent ssh session will be lost/closed.

 


For some reason, this command is not fully restarting the server or not loading the modified config, so, a workaround in order to restart the ssh server is to restart the whole system.

Important

This adds a nice layer of security, but it also means that you’d better keep backups of your SSH keys, or you are hosed!
If you’ve fucked up and you can’t get a root shell or you need help because using vi is boring, try to look for a config file editor

CENSORED | CENSURADO

censored
censored

that’s how most of the websites could look like if we let the censorship in internet start
not to SOPA and PIPA

así es cómo pueden acabar la mayoría de las páginas web si dejamos que la censura llegue a internet
no a la ley sinde

#nolesvotes: por un voto responsable

Viñeta comica Lo inaceptable_Manel
Viñeta comica Lo inaceptable_Manel
  • 1.- OBJETIVO DE #NOLESVOTES. Las personas que apoyamos a la iniciativa #nolesvotes desde sus inicios, a la vista de la catarata de tergiversaciones vertidas por políticos y medios de comunicación, queremos recordar y subrayar que la iniciativa en ningún modo promueve la abstención, y que surgió para hacer una llamada al ejercicio del voto responsable el próximo 22-M. La iniciativa pide específicamente que no se vote a los partidos que responden a intereses distintos a los de la ciudadanía: PP, PSOE y CiU, pero recomienda que en su lugar se examinen otras opciones. La iniciativa no pide el voto para ninguna opción concreta: el voto es responsabilidad de cada ciudadano.
  • 2.- HAZ DE TU PÁGINA UN CARTEL ELECTORAL. Las calles están llenas de carteles electorales, pero muchas personas no se ven representadas en ellos: la intermediación hizo que la política sea cada vez más lejana al ciudadano. Para subsanar tal déficit democrático, proponemos que todo ciudadano que así lo desee pueda convertir su blog, su web, su muro o su twitter en un “cartel electoral” del movimiento. Si quieres respaldar esta iniciativa, convierte tu sitio en Internet en un cartel electoral antes de las 24 horas del próximo día 20 de mayo, con el logotipo de #nolesvotes o de las plataformas con las que simpatices, y el texto “ni PP, ni PSOE, ni CiU”.
  • 3.- COLABORACIÓN DISTRIBUIDA. Te invitamos a copiar este texto y construir páginas de enlaces que referencien todos los sitios que dan apoyo a la iniciativa. De igual modo, invitamos a los demás colectivos que comparten nuestra propuesta a que lleven a cabo acciones similares. La fuerza de la red reside en la distribución y colaboración entre sus nodos.
  • 4.- TÚ ERES EL ALTAVOZ. Tan importante es la red como la calle: no te limites a actuar en internet. Levántate y explícaselo a todos tus conocidos, especialmente a aquellos más vulnerables a la propaganda en los medios de comunicación masivos.
  • 5.- ACCIÓN. No te quedes en casa el domingo 22. Sal a la calle y ejerce tu derecho al voto. No votes a quienes, actuando abiertamente en contra de la voluntad e intereses de los ciudadanos, han convertido la democracia en una burla de sí misma. Por la participación democrática activa: ni PP, ni PSOE, ni CiU.

#nolesvotes

no somos mercancia en manos de politicos y banqueros_15M toma la calle_democracia real ya
no somos mercancia en manos de politicos y banqueros_15M toma la calle_democracia real ya
Más información

Howto to intercommunicate processes in different(remote) machines through DBus

Introduction

In this post I’m going to try to connect two processes in different machines through DBus. The method is a little bit complex, so be patient if you try.
Also is to advert that this has been the result of 3 days of tests (reference1). So maybe this method may be improved with time and use reference2.

Tools (The actors)

  • dbus
  • gabriel
    • socat
    • libssh
  • ssh
  • your apps

Debian official packages are dbus libssh-2 socat
gabriel is not part of Debian yet (but I’ve build one for myself)

Knowledge (Actors curriculum)

In this section I will describe the basics about the tools we are going to use.

DBus. Extracted from DBus page:

D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a “single instance” application or daemon, and to launch applications and daemons on demand when their services are needed.

D-Bus supplies both a system daemon (for events such as “new hardware device added” or “printer queue changed”) and a per-user-login-session daemon (for general IPC needs among user applications). Also, the message bus is built on top of a general one-to-one message passing framework, which can be used by any two apps to communicate directly (without going through the message bus daemon). Currently the communicating applications are on one computer, or through unencrypted TCP/IP suitable for use behind a firewall with shared NFS home directories.

Gabriel is a simple utility to enable D-Bus clients to connect to a D-Bus daemon running on a remote machine, through SSH.
This is the main piece of this puzzle. If you are interested in understanding how it works you should take a look at socat and libssh. As I’ve had to take a look at code, and make some modifications, you should read it as a punishment.

Extracted from socat man page:

socat – Multipurpose relay (SOcket CAT)
socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. Because the streams can be constructed from a large set of different types of data sinks and sources (see address types), and because lots of address options may be applied to the streams, socat can be used for many different purposes. It might be one of the tools that one ‘has already needed´.

Libssh. Extracted from libssh page:

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

You should know about ssh and about your application.

Architecture

Local host will run gabriel and your application.
Remove host will need a running ssh server, a running dbus server and will need socat installed and ready to use.
We need to run gabriel, that will act as a server that will connect our host to the remote host through SSH. After that gabriel will use this SSH connection to intercommunicate our local application with remote DBus applications by using socat.

Remote DBus communication Architecture
Remote DBus communication Architecture

Howto (Main action)

At the moment I’ve only achieved to connect a process using session-bus, I’m still testing until I get connection through system-bus which was my initial purpose.
After reading next information, you will be able to connect using session bus and system bus.

As I commented somewhere else, I’ve made some modifications on gabriel code. I needed some common parameters as SSH port (my virtualbox testing environment ), better help explanations or add a verbose output.
Gabriel establish a connection with the remote ssh and by socat commands it communicates with the remote DBus “environment”. You should administrate ssh parameters and Dbus parameters to gabriel.

We have to put special attention to -d, –bus-address=BUS_ADDRESS because this info must be gotten from the REMOTE machine.
That address is the one used by processes to communicate through DBUS. It’s something “internal” and automatically done when you use DBus api/library. I’m going to show you where to get it.

DBUS_SESSION_BUS_ADDRESS, DBUS_SYSTEM_BUS_ADDRESS, DBUS_SYSTEM_BUS_DEFAULT_ADDRESS

Again, this info should be gotten from REMOTE machine.
At the moment I don’t know any nice command where to get this info.
We have two main options of DBus buses. System and Session (more info in DBus page).
If you need SESSION bus address, you can choose what it better fits you:

  • You can can get it from process environment
  • You can stole it from any other process suspicious from being involved in DBus activities…
  • You can create your own dbus-daemon (which, actually, I don’t know if it uses it’s own BUS_ADDRESS)

If you need SYSTEM bus address, you can choose what it better fits you:

  • You can can get it from process environment. If it’s not defined, take a look at /etc/dbus-1/system.conf where you should locate a string like <listen>unix:path=/var/run/dbus/system_bus_socket</listen>
  • You can stole it from any other process suspicious from being involved in DBus activities…

Examples:

This command gives you a dbus-daemon in your session with the one you can contact.

Howto (Main action): Back to local host

Those ugly unix:stri:ngs/asdkaj/numbers we have seen is what we need for -d, –bus-address=BUS_ADDRESS.
See a session example:

See a system example:

The moment we have or gabriel server running we (may have nothing) need to set DBUS_XXX_BUS_ADDRESS. Many apps would use, or have, this environment variable to connect to a DBus instance and intercommunicate with other process.
This is is easy, DBUS_XXX_BUS_ADDRESS should be the address gabriel shows few instants after being launched.
When we have defined this environment variable (in command line) we can execute our app, and it will happily communicate with the remote DBus world.
Example:

dbus-browser is a program that uses a session bus.

Curiosity: DBus protocol messages interchanged

Modifying a couple of lines in gabriel can let you see DBus raw protocol messages. It’s a didactic info.
If you enable verbose code at least at level 2, you will get raw DBus protocol messages.

My modifications and hacks

Code will be publish under GLKM project page.

Links and references
  • dbus site
  • gabriel site
  • socat site
  • libssh site
  • reference 1. (informational note, it had implied jumping into gabriel, libssh, and dbus code and testing with a virtualbox machine)
  • reference 2. (personal note, take a look at “Securing traffic between two socat instances using SSL” article in socat page)

"Le mètre cube de sperme" by Philippe Meste

SPERMCUBE, it’s… collecting 1 cubic meter of sperm preserved frozen in a transparent cube. A collective artwork, international, open to all, universal. PARTICIPATE!

If you think you’re prepared, click to read more… Continue reading “"Le mètre cube de sperme" by Philippe Meste”

Google daily traffic patterns

Weeks ago I watch a talk, starring Robert Love and Google and Open Source.
What it was funny was the moment he showed some Google daily traffic patterns. He, as part of the audience, suggested the siesta was maybe responsible of that pattern in Spain.
Well, Spain is now more cosmopolitan and very few people take siesta daily. Although many people take more than one hour at midday meal. I think this is a most real explanation.

4738

It should have been better comparing U.S.A. and Europe. Don’t you think?