One Suggestion by ... Calhariz

Because the instructions in Debian are a bit out of date I put here a quick summary of how to setup a new OpenAFS cell. This instructions complements the existing documentation and add some interesting bits for debug.First setup the kerberos client, we use in this example the MIT implementation:

apt install krb5-user

The install the fileserver software including the aklog command:

apt install openafs-dbserver openafs-fileserver openafs-krb5

Get a keytab to authenticate your OpenAFS servers:

kadmin.local
addprinc -randkey -e aes256-cts-hmac-sha1-96 afs/cell-name
ktadd -k /root/afs.keytab afs/cell-name
getprinc afs/cell-name
quit

Copy this keytab into you first server:

scp afs.keytab afs01:

Move the keytab into the final place:

mv afs.keytab /etc/openafs/server/rxkad.keytab
chown root: /etc/openafs/server/rxkad.keytab

To workaround a bug on afs-newcell:

touch /etc/openafs/server/KeyFile

Check if you mounted the /vicepa:

df -h /vicepa

Bootstrap:

afs-newcell

If something goes wrong you can to debug the aklog command with:

KRB5_TRACE=/dev/stdout aklog -d

List of KRB RPC errors:

There is a new version of at daemon, 3.2.4. Before working on releasing 3.2.3 I forgot to do a "git fetch". So quickly releasing a new version with the missing changes.

You can download the source and the signature from http://software.calhariz.com/at/

The changelog: at 3.2.4 (2022-01-29):

 at 3.2.4 (2022-01-29):
  Danillo Spinella
	Use POSIX timers to wait on next job
	Add timeformat argument in at.c
	Use secure_getenv when available
	Add O_SYNC option when opening atjob file
	Fix mtime check in atd.c
	  https://bugzilla.suse.com/show_bug.cgi?id=680113
	MR18 - Use POSIX timers to wait on next job
	  Upstreaming openSUSE patch: https://build.opensuse.org/package/view_file/Base:System/at/at-3.1.14-usePOSIXtimers.patch?expand=0&rev=d84f9fe442d5b5cce89c22d52581dfa4
	MR21 - Add timeformat argument in at.c
	  Upstreaming openSUSE patch: https://build.opensuse.org/package/view_file/Base:System/at/at-atq-timeformat.patch?expand=1
	MR23 - Use secure_getenv when available
	  https://build.opensuse.org/package/view_file/Base:System/at/at-secure_getenv.patch?expand=1
	MR25 - Fix mtime check in atd.c
	  https://bugzilla.suse.com/show_bug.cgi?id=680113
	MR22 - Print the selected jobs in atq
	  https://build.opensuse.org/package/view_file/Base:System/at/at-3.1.14-joblist.patch?expand=1
	MR24 - Add O_SYNC option when opening atjob file

There is a new version of at daemon, 3.2.2. I add one helper script, so the bump on the patch version.

You can download the source and the signature from http://software.calhariz.com/at/

The changelog:

at 3.2.1 (2019-08-04):
    Jose M Calhariz
	Include config.h on parsetime.l, see
	88a3bed41de234220f007c785e3aa45bd62446c6 for more info and
	original author.
	Check if libc provides __isleap() macro, see
	02a0a98d94b24284177dad7747edbdc3088d63cd

at 3.2.2 (2021-04-25):
  Jose M Calhariz
	Add helper script batch-job

I have not touched switchconf for a long time. Being at DebCamp19 was a good time to work on it.

I have moved the development of switchconf from a private svn repo to a git repo in salsa: https://salsa.debian.org/debian/switchconf Created a virtual host called http://software.calhariz.com were I will publish the sources of the software that I take care. Updated the Makefile to the git repo and released version 0.0.16.

You can download the latest version of switchconf from here: http://software.calhariz.com/switchconf

This is the public announcement of release 3.1.23.

I have made some non public releases of at daemon for internal development of the Debian package, since 3.1.20. This fixes some reported bugs and the development was made using http://salsa.debian.org. You can download the tar from here and the signature from here.

The Changelog:

at 3.1.21 (2018-07-23):
  Jose M Calhariz:
    832368-Using_of_the_meaningless_fcntl
        Fix call of fcntl by replacing (long) 1 with FD_CLOEXEC

    892819-at__improvements_to_atd.service
        Improve atd.service, see bug report 892819

    885891-at__stale_batchjobs_after_reboot
        Remove stale at jobs after a boot.

    897669-897670-Some_fixes_in_the_manuals
        Fix some warnings in manpages at.1 and atd.8

    883730-Remove_invalid_email_from_man_page
        Remove invalid email from man pages.

at 3.1.22 (2018-07-24):
  Jose M Calhariz:
        Draft of a release script

at 3.1.23 (2018-07-24):
  Jose M Calhariz
        Finalised script to release software.

I have a Yubikey from the job and wanted to start signing git commit without copying my Debian PGP key to the work computer. No, I did not want to create a second class PGP key just for the work. Here are the instructions for someone else do the same.

On the master computer

• Create a second home dir for gpg

Because of bug #904596 I recommend to move your GPG home directory out of the way. Copy it into the original directory before starting.

mv ~/.gnupg ~/.gnupg.ref
cp -r ~/.gnupg.ref ~/.gnupg

• Create a subkey just for signing.

Create a subkey and take noticy of is id.

gpg --edit-key <KEY ID>
addkey
list
save

• Move into the Yubikey.

Select the new subkey and move it into the Yubikey.

gpg --edit-key <KEY ID>
key <SUB KEY ID>
keytocard 
save

• Publish the updated PGP Key

gpg --keyserver http://keyserver.ubuntu.com --send-keys <KEY ID>

• Store the public URL of the key on Yubikey

gpg --edit-card
url http://https://keyserver.ubuntu.com/pks/lookup?op=get&fingerprint=on&search=...
quit

• Backup both GPG home dir

On your master computer you need to use the old GPG home dir. But need to store both for the future.

mv ~/.gnupg ~/.gnupg.yubikey4
mv ~/.gnupg.ref ~/.gnupg
cd ~
tar cf gnupg-homedir.backup.tar .gnupg .gnupg.yubikey4

• Test

gpg --armor --sign

Should work without asking for the Yubikey.

• Wait for the Key server to update your public key with the new subkey.

On a new computer

• Plug the Yubikey

• Through Yubikey fetch the public PGP Key

gpg --edit-card
fetch
quit

• Test

gpg -armor --sign

Should ask for the Yubikey.

This article is an experiment in progress, please recheck, while I am updating with the new information.

I have a very old installation of Debian, possibly since v2, dot not remember, that I have upgraded since then both in software and hardware. Now the hardware is 64bits, runs a kernel of 64bits but the run-time is still 32bits. For 99% of tasks this is very good. Now that I have made many simulations I may have found a solution to do a crossgrade of my desktop. I write here the tentative procedure and I will update with more ideias on the problems that I may found.

First you need to install a 64bits kernel and boot with it. See my previous post on how to do it.

Second you need to do a bootstrap of crossgrading and the instalation of all the libs as amd64:

 apt-get update
 apt-get upgrade
 apt-get clean
 dpkg --list > original.dpkg
 apt-get --download-only install dpkg:amd64 tar:amd64 apt:amd64 bash:amd64 dash:amd64 init:amd64 mawk:amd64
 cd /var/cache/apt/archives/
 dpkg --install dpkg_*amd64.deb tar_*amd64.deb apt_*amd64.deb bash_*amd64.deb dash_*amd64.deb *.deb
 dpkg --configure --pending
 dpkg -i --skip-same-version dpkg_*_amd64.deb apt_*_amd64.deb bash_*_amd64.deb dash_*_amd64.deb mawk_*_amd64.deb *.deb
 
 for pack32 in $(grep i386 original.dpkg  | egrep "^ii " | awk '{print $2}' ) ; do 
   echo $pack32 ; 
   if dpkg --status $pack32 | grep -q "Multi-Arch: same" ; then 
     apt-get --download-only install -y --allow-remove-essential ${pack32%:i386}:amd64 ; 
   fi ; 
 done

 dpkg --install /var/cache/apt/archives/*_amd64.deb
 dpkg --install /var/cache/apt/archives/*_amd64.deb
 dpkg --print-architecture
 dpkg --print-foreign-architectures

But this procedure does not prevent the "apt-get install" to have broken dependencies.

So trying to install the core packages and the libraries using "dpkg -i".

apt-get update
apt-get upgrade
apt-get autoremove
apt-get clean
dpkg --list > original.dpkg
apt-get --download-only install dpkg:amd64 tar:amd64 apt:amd64 bash:amd64 dash:amd64 init:amd64 mawk:amd64
for pack32 in $(grep i386 original.dpkg | egrep "^ii " | awk '{print $2}' ) ; do 
  echo $pack32 ; 
  if dpkg --status $pack32 | grep -q "Multi-Arch: same" ; then 
    apt-get --download-only install -y --allow-remove-essential ${pack32%:i386}:amd64 ; 
  fi ; 
done
cd /var/cache/apt/archives/
dpkg --install dpkg_*amd64.deb tar_*amd64.deb apt_*amd64.deb bash_*amd64.deb dash_*amd64.deb *.deb
dpkg --configure --pending
dpkg --install --skip-same-version dpkg_*_amd64.deb apt_*_amd64.deb bash_*_amd64.deb dash_*_amd64.deb mawk_*_amd64.deb *.deb

dpkg --remove libcurl4-openssl-dev
dpkg -i libcurl4-openssl-dev_*_amd64.deb

Remove packages until all there is no brokens packages

dpkg --print-architecture
dpkg --print-foreign-architectures
apt-get --fix-broken --allow-remove-essential install

Still broken, because apt-get removed dpkg

So instead of only installing the libs with dpkg -i, I am going to try to install all the packages with dpkg -i:

apt-get update
apt-get upgrade
apt-get autoremove
apt-get clean
dpkg --list > original.dpkg
apt-get --download-only install dpkg:amd64 tar:amd64 apt:amd64 bash:amd64 dash:amd64 init:amd64 mawk:amd64
for pack32 in $(grep i386 original.dpkg | egrep "^ii " | awk '{print $2}' ) ; do 
  echo $pack32 ; 
  apt-get --download-only install -y --allow-remove-essential ${pack32%:i386}:amd64 ; 
done
cd /var/cache/apt/archives/
dpkg --install dpkg_*amd64.deb tar_*amd64.deb apt_*amd64.deb bash_*amd64.deb dash_*amd64.deb *.deb
dpkg --configure --pending
dpkg --install --skip-same-version dpkg_*_amd64.deb apt_*_amd64.deb bash_*_amd64.deb dash_*_amd64.deb mawk_*_amd64.deb *.deb
dpkg --configure --pending

Remove packages and reinstall selected packages until you fix all off them. Follow the trial for my machine:

dpkg --remove rkhunter
dpkg --remove libmarco-private1:i386 marco mate-control-center mate-desktop-environment-core mate-desktop-environment-core  mate-desktop-environment mate-desktop-environment-core mate-desktop-environment-extras
dpkg --remove libmate-menu2:i386 libmate-window-settings1:i386 mate-panel mate-screensaver python-mate-menu libmate-slab0:i386 mozo mate-menus
dpkg --remove libmate-menu2:i386 mate-panel python-mate-menu mate-applets mate-menus
dpkg -i libmate-menu2_1.16.0-2_amd64.deb
dpkg --remove  gir1.2-ibus-1.0:i386 gnome-shell gnome-shell-extensions gdm3 gnome-session
dpkg --remove  gir1.2-ibus-1.0:i386
dpkg --remove libmateweather1:i386
dpkg -i libmateweather1_1.16.1-2_amd64.deb

apt-get --fix-broken --download-only install
dpkg --skip-same-version --install dpkg_*amd64.deb tar_*amd64.deb apt_*amd64.deb bash_*amd64.deb dash_*amd64.deb *.deb
dpkg --configure --pending
dpkg -i python_2.7.13-2_amd64.deb
dpkg --configure --pending
dpkg -i perl_5.24.1-3+deb9u1_amd64.deb perl-base_5.24.1-3+deb9u1_amd64.deb
dpkg -i exim4-daemon-light_4.89-2+deb9u1_amd64.deb exim4-base_4.89-2+deb9u1_amd64.deb
dpkg -i libuuid-perl_0.27-1_amd64.deb
dpkg --configure --pending
dpkg --install gstreamer1.0-plugins-bad_1.10.4-1_amd64.deb libmpeg2encpp-2.1-0_1%3a2.1.0+debian-5_amd64.deb libmplex2-2.1-0_1%3a2.1.0+debian-5_amd64.deb
dpkg --configure --pending
dpkg --audit

Now fixing broken dependencies on apt-get. Found no other way than removing all the broken packages.

dpkg --remove $(apt-get --fix-broken install | cut -f 2 -d ' ' )
apt-get install $(grep -v ":i386" ~/original.dpkg | egrep "^ii" | grep -v "aiccu" | grep -v "acroread" | grep -v "flash-player-properties" | grep -v "flashplayer-mozilla" | egrep -v "tp-flash-marillat" | awk '{print $2}')

By testing the previous instructions for a full crosgrade I run into trouble. Here is the results of my tests to do a full crossgrade of a minimal installation of Debian inside a VM.

First you need to install a 64bits kernel and boot with it. See my previous post on how to do it.

Second you need to do a bootstrap of crossgrading:

 apt-get clean
 apt-get upgrade
 apt-get --download-only install dpkg:amd64 tar:amd64 apt:amd64 bash:amd64 dash:amd64 init:amd64
 dpkg --install /var/cache/apt/archives/*_amd64.deb
 dpkg --install /var/cache/apt/archives/*_amd64.deb
 dpkg --print-architecture
 dpkg --print-foreign-architectures
 apt-get --fix-broken --allow-remove-essential install

Third do a full crossgrade:

 apt-get install --allow-remove-essential $(dpkg --list | grep :i386 | awk '{print $2}' | sed -e s/:i386// )

This procedure seams to be a little fragile, but worked most of the time for me.

Because of the upgrade of perl, amanda is currently broken on testing and unstable on Debian. The problem is known and I am working with my sponsor to create new packages to solve the problem. Please hang a little more.

I bought a new laptop E200HA, because my previous was a MacBook and It broke after a fall into the ground.

I let it boot first in Win10 to check if everything was OK and because I could not found the way to enter in the UEFI/BIOS. It is F2 and is edge triggered. It boots fast into Win10, but I got the feeling of being a little slow. No worries because I it bought for running Debian and because of the autonomy of the battery, 14hours playing music according to Asus. A little research if the new laptop could run Linux almost return no hits, but one very valuable link on how to setup the Wifi. So I got the feeling that I needed a Debian stretch CD for installation. So I download the first installation DVD from here. Run a trial of the DVD image using kvm

kvm -m 2047 -cdrom debian-stretch-DI-alpha7-amd64-DVD-1.iso

Found that the installer DVD now have the functionality of Live CD. This will be useful. Copy the image to a USB stick using dd command.

I turned on the E200HA, entered into the UEFI/BIOS by pressing and releasing the F2 key. Turned off the secure boot and select USB storage for boot. The E200HA happily boot the Linux and I select the rescue mode. Using another USB stick of 32GB that was formatted in xfs, because of the lower slack for storing the inodes than ext3/4. In this USB stick I put a raw image of the internal storage of the E200HA, preserving this way the Win10.

Another reboot, this time for installation of Debian stretch. It detected the lack of firmware files, for the WiFi adaptor. This link come very handy. The instructions are for an older Linux kernel. So I recommend doing something similar to the following commands:

git clone https://github.com/ajaybhatia/Qualcomm-Atheros-QCA9377-Wifi-Linux
cd Qualcomm-Atheros-QCA9377-Wifi-Linux/firmware-only
tar cvf QCA9377.tar QCA9377

Copy the tar file to a a second USB stick and connect it to the other USB port. This tar is not the files the Debian installer are expecting, so you need to change to the second console "Alt-F2", press enter to activate a shell, and do the following commands:

cd /lib/firmware
mkdir ath10k
mount /dev/sdb1 /mnt
cd ath10k
tar xf /mnt/QCA9377.tar

Return to the first console "Alt-F1" and continue with the installation. The list of missing firmware files is reduced and the WiFi can work. I had problems with the WiFI, but was because a neighbor router was on the same channel, since I changed the channel of my router the WiFi is working as a charm.

The following links maybe useful in the future or as a reference:

kvalo/ath10k-firmware

kernel/git/firmware/linux-firmware.git