W10. I'm all set

For the last few weeks my laptop has got more updates then  my LG G3.

Recently I've updated Virtual box to the new 5.0 release. I love VirtualBox. It's lightweight, cross-platform, easy to use and now (at least!) it supports USB 3.0.  Even better now you can run guest system in detached or background mode. It's not a killer feature, but if you have more than one system it's great relief (I know that VMware server does it for ages).


  Next, I've my system to Windows 10 . I could say only WOW, yep in capital. It's fast, sharp looking, and seamless. I've never ever had such system upgrade experience form Microsoft.Every single device were detected and installed properly. Every program was saved and ready for use. The only one exception - Skype, I have to get new version and install it, but I don't mind, because now I have one application.

The only cloud on my sunny sky: Pristine new VirtualBox had not detected any USB devices on my shiny Windows 10. I've went through all guest systems and reinstalled and updated addons. I've updated all guest system (I know it doesn't help with host, but it's a good reason) and changed USB configuration. I've reinstalled extension pack.
I've googled and binged around (Btw, new browser is amazing) with no luck.
Well,  if you can't find any meaning results but SMM posts and virus traps, it means - no one has this issue but you. I've checked Virtual Box service logs and found several entries like this one:

00:00:52.291557   WARNING [COM]: aRC=E_FAIL (0x80004005) aIID={afca788c-4477-787d-60b2-3fa70e56fbbc} aComponent={HostWrap} aText={Could not load the Host USB Proxy Service (VERR_FILE_NOT_FOUND). The service might not be installed on the host computer}, preserve=true  aResultDetail=1

Well I've checked vboxdrv service and it seems to be fine, but it's not. Long story short - I've uninstall extension pack and uninstall VirtualBox completely. Of course after fresh installation all my devices have returned from non existence.

I don't blame Microsoft or Oracle. they have done a great job -  It's a Windows baby.

Automate e-Payment Directory updates

Recently I've faced a tricky case, related to integration. One e-business system used to update e-payment directory with shell concurrent program and data from Federal Reserve Bank Services web site. System has worked quite well with wget  utility and direct link to text file with routing information.
But once it delivered HTML document instead of text document. The reason is quite simple - from now on  you should agree with Service terms and then you will get access to the data.
This changes even has led to Github project FedACHDir. Well, with all my respect to GitHub and project authors, I'm not comfortable at all to get such sensitive information from the third party. So I have had to overcome it and automate download.
Let's rethink approach to the task. Well known wget utility allows you to download  data form internet but now we have to interact with site, POST information and maintain web session. Answer is simple - curl another well known web utility, included in the most of Linux repositories and compiled for  the rest of the operating systems.
Long story short below is a small but elegant Shell script to get data from Federal Reserve Bank Services.

Reminder: use this script means that you are agree with terms and conditions posted on the FRBS site

---

#!/bin/sh #check output file name if [ -z $1 ]; then achout=/tmp/FedACHdir.txt >&2 echo "Save data to /tmp/FedACHdir.txt" else achout=$1 fi # Set session cookies rm /tmp/fedc.txt 2>/dev/null curl -s -c /tmp/fedc.txt \

 https://www.frbservices.org/EPaymentsDirectory/FedACHdir.txt -o /dev/null # Submit agreement curl -s -b /tmp/fedc.txt -c /tmp/fedc.txt -d "agreementValue=Agree" \

 -H "Referer:https://www.frbservices.org/EPaymentsDirectory/agreement.html" \

 https://www.frbservices.org/EPaymentsDirectory/submitAgreement -o /dev/null #read FedACH catalog curl -b /tmp/fedc.txt \

 https://www.frbservices.org/EPaymentsDirectory/FedACHdir.txt -o $achout # Cleanup cookies rm /tmp/fedc.txt 2>/dev/null

---

If you find this useful: enjoy and have fun.

Why you don't trust me foxy browser?

I'm looking on my blog counters and realize how lucky I'm. Recently I've found a small configuration issue in my Apache 2.4 SSL configuration. It may not affect you at all especially you have one hoop  trust chain between you and your CA. But if stars have lined up in a bad way after system re-confguration you get this:



It means you have more then one  certificates in the trust chain, so  Firefox can't build it by hjmself. There is no information about trusted certificates. Normally it means HTTP server doesn't present the full chain  but certificate and issuer information.
It's very easy to fix:
Get all your CA certificates in PEM format. Concatenate them  into  single file. Do not forget to put them in proper order. If you have chain like this:

server-cert.pem → sub-ca2-cert.pem → sub-ca1-cert.pem → root-ca.pem

then you should build your file as:

# cat sub-ca2-cert.pem cub-ca1-cert.pem root-ca.pem >/etc/httpd/conf/ssl.certs/ca-certs-chain.pem

Open your SSL Enabled site definition and put another command to the configuration

SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca-certs-chain.pem

Save configuration files.

It's right time to notice - you may have as many chains as you need and maintain two virtual sites with non-matching trust chains, just put them into right place. Check configuration syntax 

#/usr/local/apache2/bin/apachectl -t

Syntax is Ok.

With OHS severs you have no choice - full stop and start. It is fast, but it means service break. With Apache you have a neat option - graceful restart.

#/usr/local/apache2/bin/apachectl -k graceful 

 After a while all sessions will use new configuration.

Will Firefox trust you after? It depends on CA issuer notoriety, at least now you present all your credentials.

some new tricks for old dogs

Recently I've configured a small box with Fedora 21 Linux. I've done all my tasks inside the system with no issues and tested web services access outside. The real surprise was blocked access to standard http/https ports, while upper ports were quite accessible.
I'm an old dog, I'm really are. I know what it means when I see such page.

I see firewall. Especially if I can connect locally. Well, let's keep in mind systemcmd instead of good old services.

[root@fed21 ~]# systemctl status iptables
â iptables.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
[root@fed21 ~]# systemctl status ip6tablesâ ip6tables.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
[root@fed21 ~]# sestatus
SELinux status:                 disabled
[root@fed21 ~]#

Looks pretty open, doesn't it? Actually it does not! Behold the new tricks with firewallD!
Hope I could save you couple hours and give you a hint.
So let's check firewall status:

[root@fed21 ~]# firewall-cmd --list-all
FedoraWorkstation (default, active)
  interfaces: enp0s3
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports: 1025-65535/udp 1025-65535/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

Ok, It block access to ports below 1025 (1025-65536/tcp) for interface enp0s3. Let's find how to fix it. You may use port range, I've stuck with two main ports

[root@fed21 ~]# firewall-cmd --add-port=80/tcp
success
[root@fed21 ~]# firewall-cmd --add-port=443/tcp
success

Now I have access to my browser outside the box. By the way if you want to keep this changes, I bet you do just add --permanent option.

[root@fed21 ~]# firewall-cmd --list-all
FedoraWorkstation (default, active)
  interfaces: enp0s3
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports: 1025-65535/udp 443/tcp 80/tcp 1025-65535/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
If your Apache still not available, reload firewall parameters with command:

[root@fed21 ~]# firewall-cmd --reload
success

Hey I've just learned new tricks, what about you?