Main menu
Categories

Category: Computers, subcategory of The World of Computers

Linux Users: How To Disable Automatic Suspend of HDMI Audio

Instructions

If you are experiencing audio popping or delays when playback starts or stops on your HDMI receiver, follow the steps below to disable automatic audio suspension in PipeWire.

  1. Open the terminal. In GNOME, open the Overview, type terminal, and press Enter. In KDE, open the menu, search for Konsole, and press Enter.

  2. Create the following directory:

    mkdir -p ~/.config/wireplumber/wireplumber.conf.d/
  3. Use your favorite text editor such as vim or nano or whatever you want to use such as GEdit or Kate and create the file:

    vim .config/wireplumber/wireplumber.conf.d/50-local.conf

    Copy in the following (in Vim, press the i to go into INSERT mode):

    monitor.alsa.rules = [
      {
        matches = [
          {
            node.name = "~alsa_card.*"
          }
        ]
        actions = {
          update-props = {
            session.suspend-timeout-seconds = 0
          }
        }
      }
    ]

    Save the file and quit (in Vim, press ESC (escape key), then : (colon), w, q and then press Enter.

    Note: I found a Reddit posting which has node.name = "..." and that ellipsis is incorrect. Pipewire does not complain about the syntax. More on that later as I add in more information at the later time.

  4. Then, type in the following and press Enter:

    systemctl --user restart wireplumber

This should prevent your home theater receiver, your soundbar, or what-have-you from falling asleep.

Audience

The instructions are meant for Linux users who experienced the delay in sound or in some cases, those who hear the popping when starting and stopping audio playback. There is no GUI way in a Linux desktop environment that will allow anyone to disable the audio suspend feature, so the experience with the Linux terminal is needed.

Why Is The Instructions Needed?

I have an Onkyo TX-NZ30 home theater receiver and I'm using it to pipe sound to my home theater receiver through my NVIDIA Geforce RTX 4070 GPU. It's not as seamless as using Behringer Wing Rack or just about any audio interfaces such as the Behringer U-Phoria UMC1820 or just about any sound card for that matter that does not involve either HDMI, Toslink, or optical audio connection.

Currently, managing the power state of audio nodes is a policy decision handled by the daemon configuration. While there are excellent tools like Helvum for audio routing, a simple toggle to disable audio suspension is not yet standard in desktop settings applications, so editing the configuration file is the reliable method for now.

Explanation of the Configuration File

The file 50-local.conf acts as a custom instruction manual for WirePlumber, the session and policy manager for PipeWire (the modern audio backend used in Linux distributions). Because Linux protects the main system configuration files to prevent users from accidentally breaking the OS, you generally shouldn't edit the master settings directly. Instead, placing a file with a name like 50-local.conf inside the .config/wireplumber/wireplumber.conf.d/ directory allows you to safely override the default behavior without touching the system files.

Here is a breakdown of the code you are adding:

monitor.alsa.rules:
This defines a rule set for ALSA (the Linux sound driver architecture) devices.
matches = [{ node.name = "~alsa_card.*" }]:
This tells the system to identify your audio device. The ~alsa_card.* simply serves as a wildcard for all audio devices. Previously, the ellipsis was in the configuration file but that's incorrect and has been replaced.
actions = { update-props = { ... } }:
This specifies the actions to take on the matched device.
session.suspend-timeout-seconds = 0:
This is the critical setting. By default, Linux will suspend an audio device after 5 seconds of silence to save power. Setting this value to 0 commands the system to disable the suspend timeout entirely, keeping the connection active and the device "awake"

For Windows Users Who Plan on Switching to Linux

For those switching from Windows, this process is the command-line equivalent of opening the Device Manager, finding your audio device, and unchecking the box that says "Allow the computer to turn off this device to save power." While Linux offers powerful software like PipeWire, specific power management features for audio often lack a graphical interface (GUI) switch. Editing this configuration file is simply the direct method to tell your computer, "Do not put my HDMI audio to sleep," which prevents the delay or popping noise when you resume audio playback.

My Thoughts About "Linux Is Not Hard" Arguments

For anything simple such as browsing the web, Linux is not hard as long as the Linux terminal is not involved. For those who have to deal with HDMI audio which may seem simple but later on can become complex, the argument that Linux is not hard simply does not hold water, especially for someone who wants use their computer as part of a home theater system which Windows has been doing for decades since Windows XP Media Center Edition. So yes, I want to assert to myself by saying "Linux is hard". This is why I want to make Linux easier for everyone. I only want to provide minimum instructions in order for people to get their sound system working in Linux -- especially for people who came from Windows. We need something equivalent to Windows' Device Manager in Linux, so that those who do not want to touch the terminal can disable automatic audio suspension.

Conclusion

Once the configuration is in place and the service has restarted, the audio playback over HDMI audio should be seamless. Enjoy piping audio from your computer to your home theater receiver or your soundbar! I hope I can be of help!


Article published: 2026-04-13 08:30

Categories: The World of Computers, Computers

Hey Discord! Try Stealing "Find in Page" in the Firefox's "Edit" Menu! I Bet You Cannot!

Seriously, I do not understand why would Discord prevent me from using Ctrl+F to bring up the browser's find feature! This is a very essential feature when looking for something in a web page. Especially in Settings!

If you cannot use Ctrl+F because Discord or even Discorse (a forum software) wants to use Ctrl+F for its own search feature, you can just work around that in Firefox by doing Alt+E, F in quick succession! Try it!

If you use Chrome, I believe you can press the Alt key and arrow down until you get down to the Find command and go from there.

Hope this helps!


Article published: 2024-04-26 17:00

Categories: The World of Computers, Computers, Internet

Vim: How to Delete Text Enclosed In Quotes

Instructions

Navigate to the first character after the quote/double-quote and type the following in Vim:

di"

This is useful if you have something like the following:

{
    "title": "Vim: How to Delete Text Enclosed In Quotes",
    "permalink": "vim-how-to-delete-text-enclosed-in-quotes",
    "published": "2023-08-12 14:00",
    "categoryIDs": "5,5:0,5:1,5:5",
    "description": "In Vim, 'di\"' is the one to use for deleting text in quotes.",
    "thumbnail": "",
    "smallimage": "",
    "largeimage": ""
}

So, to navigate to the first character that starts with a double-quote, simply type /"e; and the insertion point will highlight the double-quote. To get to the next double-quote, press the n key again until you get to the one you want. After that, press the l key to move to the first character and type the following:

di"

The output will be as follows:

{
    "title": "",
    "permalink": "vim-how-to-delete-text-enclosed-in-quotes",
    "published": "2023-08-12 14:00",
    "categoryIDs": "5,5:0,5:1,5:5",
    "description": "In Vim, 'di\"' is the one to use for deleting text in quotes.",
    "thumbnail": "",
    "smallimage": "",
    "largeimage": ""
}

And now, you can type whatever you want by pressing the i key on your keyboard. Press the ESC (escape) key to get out of INSERT mode and back into normal mode. To save changes and quit the Vim text editor, type :wq.

Bonus: If you have delimiters with quotes while writing the code such as:

"This is some \"quote\"!"

Vim will automatically delete the delimiters with quotes along with them, so performing di" will delete everything that is in between quotes.

""

And you do not need to be inside quotes in order to delete inside the quotes! How cool is that? *grinning face*

Oh, and you can also use the "change inside" sequence as well:

ci"
This puts you into INSERT mode so you can type text inside quotes.

Audience

This is for Linux users experienced in using the Vim text editor. Vim users should already know the basics such as :q! for quitting the text editor without saving changes, :wq for saving changes and quitting the text editor, i for going into INSERT mode and use the ESC (escape) key to get back into normal mode. All keyboard commands are beyond the scope of this short article that I wrote.

Conclusion

Hopefully this keyboard command can be of help to you. If you are a Linux user, please give Vim a try.

Original Source

In Vim, how can I delete everything between quotes including the quotes?

Note that I was searching for information about deleting text inside quotes and not including the quotes.


Article published: 2023-08-12 14:00

Categories: The World of Computers, Computers, Information Technology, Scripting and Programming

How To List All SELinux Contexts

Audience and Prerequisites

This is intended for Linux users who have experience working with the command line. You should be running any Red Hat-based distributions such as Rocky Linux, AlmaLinux, or Oracle Linux. CentOS Stream is not a candidate for taking the RHCSA (Red Hat Certified System Administrator) exam. A lot of people in the Linux community are not happy about Red Hat discontinuing support for CentOS 8 and now Red Hat does not want source code to be available for everyone, including Rocky Linux and AlmaLinux. Enough with wordy paragraphs! We don't want anyone to scroll down too much in order to get to the most important part! Let's get into the command line, shall we?

Oh, please pardon me for boring you with this, but I almost forgot. This article assumes that you are logged in as a root user. This is bad security practice in the production environment, but in the exam, it's okay to be root. If you break it, you fix it and that will count against your time in the exam. But the important thing is that you must come up with solutions as fast as possible. Of course, don't be in a hurry in such a way that you will fail the exam. Okay, enough already! Let's get in with it! *grinning face*

Type: File Contexts

The command for listing all available SELinux type contexts is:

seinfo -t

The command for listing only the type contexts that relate to the web server:

seinfo -t | grep httpd

So, you searched for anything related to httpd and you came across httpd_sys_content_t. You need to specify a directory to host your content other than in /var/www. To add the type context to a directory, the command will be as follows:

semanage fcontext -a -t httpd_sys_content_t "/data/nas/www(/.*)?"
restorecon /data/nas/www

Longer version:

semanage fcontext --add --type httpd_sys_content_t "/data/nas/www(/.*)?"

The seinfo command is the SELinux policy information tool, semanage is a SELinux policy management tool, and restorecon is for restoring default SELinux security contexts to files and directories. The "type" contexts is the only one to be to be concerned about when studying for any Linux exams, such as RHCSA (Red Hat Certified System Administrator).

As for (/.*)?, that's called a regular expression. This is for setting any subdirectories and files with the same context as the main directory. Try to remember this in the RHCSA exam: open parenthesis, forward slash, period, asterisk, close parenthesis, question mark, and that's about it. The only thing to remember is to have the entire path along with the symbols in double quotes. In the RHCSA exam, you have access to the man pages, so take advantage of that whenever possible.

For users of NVDA screen reader (Non-Visual Desktop Access), NVDA does not speak a question mark such as CTRL+? (control plus question mark). I do not know if this is a bug in the screen reader or if this is intentional, but at least it's all I can do to help out if screen readers ignore question marks. That symbol is an important part of a regular expression, so it needs to be translated to words. Hopefully I can be of help.

Type: Contexts for Ports

What about ports? If you modify the port number in SSH configuration file (/etc/ssh/sshd_config) and you restart the service (systemctl restart sshd), even if you configure the firewall to allow a different port number (example: firewall-cmd --add-port 12345 --permanent), you won't be able to SSH into your server because SELinux gets in the way! It's easy to disable SELinux if you do not mind exposing your server to outside security risks, but when studying for the exam, it's important to never disable SELinux. Instead, let's search for port-related contexts.

Let's search for any services that have a phrase "port" for any type contexts:

seinfo -t | grep port

You should get a list of services. Let's narrow it down to SSH:

seinfo -t | grep port | grep ssh

Ah ha! There it is. It's ssh_port_t. Of course, I could also type the following:

seinfo -t | grep ssh_port

And that should give me the same output. So, let's configure SELinux to allow TCP port 12345 so that we can SSH into our Linux server.

semanage port -a -t ssh_port_t -p tcp 12345

And there you have it! You should now login to your server using SSH.

ssh -p 12345 username@servernameoripaddress

Of course, if you want to search for other services, such as Postfix:

seinfo -t | grep postfix

Oh, wow! So many contexts to choose from! But aren't we looking for port-related contexts?

seinfo -t | grep port | grep postfix

Hmm... There are no port-related contexts related to Postfix. Of course, what we do want is SMTP, which is port 25 by default, so let's narrow it down to just "port" and "SMTP" (all lowercase, of course).

seinfo -t | grep port | grep smtp
# or "seinfo -t | grep smtp_port" (without quotes)

And you should get smtp_port_t. However, configuring an SMTP server is beyond the scope of this tutorial about viewing the list of available contexts. Plus, configuring firewalls and enabling/starting services in a Linux server is also beyond the scope as well.

What Packages Provides seinfo and semanage?

dnf whatprovides */seinfo

The asterisk represents a wildcard, so this would assume that we do not know the full path to seinfo command. That dnf command, when executed, reveals a package called setools-console. So, so install setools-console, just use the dnf install command as follows:

dnf install setools-console

The same is for semanage:

dnf whatprovides */semanage
dnf install policycoreutils-python-utils

That package policycoreutils-python-utils is so wordy, isn't it? *smile* Don't stress over trying to remember that package name in the exam and in the real world.

Conclusion

I hope I can be of help to anyone studying for RHCSA exam. Hopefully you should be able to know how to set SELinux type contexts for directories and ports. If you are not taking an exam (you should if you want to further your career in Linux and Information Technology), I hope I can be of help as well! Have fun administrating your Linux servers!

And yes, I could have used emojis, but screen readers come first! *smile*


Article published: 2023-08-12 13:10

Categories: The World of Computers, Computers, Information Technology, Security

Use $HOME, not /home/$USER in BASH scripts

Audience

This article is for experienced Linux users who are familar with environment variables such as $HOME and $USER. These are the Linux users who are familiar with the command line.

Problem and Solution

Here is an example not to use /home/$USER:

[gpeddie-games@epcotcenter ~]$ su - gpadmin
Password: 
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
touch: cannot touch '/home/gpadmin/Templates/Text file': No such file or directory
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
-bash: /home/gpadmin/.local/share/DaVinciResolve/configs/.version: No such file or directory
Welcome. All activities monitored at all times.
Unauthorized access is strictly prohibited.
gpadmin@epcotcenter 
  ~
$

And here's the script (/etc/profile) that illustrates an example:

# fix gnome missing 'New file' option
if [ ! -f /home/$USER/Templates/"Text file" ]
then
    mkdir -p /home/$USER/Templates
    touch /home/$USER/Templates/"Text file"
fi

# ...

# this is a hack to bypass the Davinci Resolve new install Welcome/Onboarding screen since it does not render properly and is not required.
if [ ! -f /home/$USER/.local/share/DaVinciResolve/configs/.version ];then
    mkdir -p /home/$USER/.local/share/DaVinciResolve/configs/
    echo "Onboarding.Version=10" > /home/$USER/.local/share/DaVinciResolve/configs/.version
fi

To fix this issue, simply replace all instances of /home/$USER with $HOME. I am familiar with a text editor called Vim. It's a program that runs inside a terminal, similar to the Command Prompt or PowerShell in Windows.

Before we proceed any further, let's create a backup copy of /etc/profile:

sudo cp /etc/profile /etc/profile.bak

If anything goes wrong, you now have a backup. You can simply use the cp (copy) command to restore from the backup. Now let's begin.

  1. First, open the Terminal (Konsole in KDE).

  2. As root (or with sudo privileges), type the following command:

    sudo vim /etc/profile
  3. Type in the following command, starting with a colon:

    :%s/\/home\/$USER/$HOME/g

    The syntax for search and replace in Vim is as follows:

    :%s/search/replace/g

    Let's not concern ourselves with g at the end for now. Basically this command replaces "search" with the next text "replace." In other words, we want to replace /home/$USER with $HOME.

    Let's have a look at the script again:

    # fix gnome missing 'New file' option
    if [ ! -f $HOME/Templates/"Text file" ]
    then
        mkdir -p $HOME/Templates
        touch $HOME/Templates/"Text file"
    fi
    
    # ...
    
    # this is a hack to bypass the Davinci Resolve new install Welcome/Onboarding screen since it does not render properly and is not required.
    if [ ! -f $HOME/.local/share/DaVinciResolve/configs/.version ];then
        mkdir -p $HOME/.local/share/DaVinciResolve/configs/
        echo "Onboarding.Version=10" > $HOME/.local/share/DaVinciResolve/configs/.version
    fi

    So why would we want to replace /home/$USER with $HOME? That /home/$USER should still work!

    Let's look at the output again after we save the changes.

  4. Save the changes to the /etc/profile file.

    :wq

    A : begins a command. w writes changes to the file and q quits Vim

    If you don't want to make changes to the file, then all you have to do is type :q! to exit without saving any changes.

As I mentioned, let's look at the output again when I log into my administrator account from a user account.

[gpeddie-games@epcotcenter ~]$ su - gpadmin
Password:
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
touch: cannot touch '/home/gpadmin/Templates/Text file': No such file or directory
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
-bash: /home/gpadmin/.local/share/DaVinciResolve/configs/.version: No such file or directory
Welcome. All activities monitored at all times.
Unauthorized access is strictly prohibited.
gpadmin@epcotcenter
  ~
$

Now, let's see the new output when I log back in as an administrator.

[gpeddie-games@epcotcenter ~]$ su - gpadmin
Password: 
Last login: Sat Mar 18 11:13:52 EDT 2023 on pts/0
Welcome. All activities monitored at all times.
Unauthorized access is strictly prohibited.
gpadmin@epcotcenter 
  ~
$

How Did That Work?

Let's see the output of $USER and $HOME.

gpadmin@epcotcenter 
  ~
$ echo $USER
gpadmin
gpadmin@epcotcenter 
  ~
$ echo $HOME
/home/graysonpeddie.lan/gpadmin
gpadmin@epcotcenter 
  ~
$

Scenario

You have an Active Directory server running in a Windows Server virtual machine. You installed Nobara so that you can do content creation and play games. You wanted to join your Linux desktop to a Windows Active Directory in your home network (or a homelab, if you want to call it). This is how you install the needed packages for Nobara 36 (that's what I am running) so that you can join your Linux desktop to the Windows domain:

sudo dnf install realmd sssd sssd-tools adcli oddjob oddjob-mkhomedi
sudo realm join yourlocaldomainname.lan -U youradminusername

Replace yourlocaldomainname.lan with your local domain name and do the same for youradminusername.

So when you log into your administrator account that's part of the Domain Administrators so that you can gain sudo privileges, you might be wondering why you are getting strange output. Here it is again.

[gpeddie-games@epcotcenter ~]$ su - gpadmin
Password:
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
touch: cannot touch '/home/gpadmin/Templates/Text file': No such file or directory
mkdir: cannot create directory ‘/home/gpadmin’: Permission denied
-bash: /home/gpadmin/.local/share/DaVinciResolve/configs/.version: No such file or directory
Welcome. All activities monitored at all times.
Unauthorized access is strictly prohibited.
gpadmin@epcotcenter
  ~
$

If you look at the /etc/profile script that Linux executes when you log into your Linux account, you will notice that the developer of Nobara assumed that your home directory is /home/gpadmin and not /home/graysonpeddie.lan/gpadmin.

This is how I configure the System Security Services Daemon (SSSD, for short) which allows Linux users to log into the Windows domain from the Linux desktop. Please note that only root can read /etc/sssd/sssd.conf.

[sssd]
domains = graysonpeddie.lan
config_file_version = 2
services = nss, pam

[domain/graysonpeddie.lan]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = GRAYSONPEDDIE.LAN
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%d/%u
ad_domain = graysonpeddie.lan
use_fully_qualified_names = False
ldap_id_mapping = True
access_provider = ad
ad_gpo_access_control = permissive

Let's ignore the entire file and focus in the fallback_homedir. The %d is for the domain name that I logged into and the %u is for the username. In my case, since I logged into my Linux desktop as gpeddie-games (that's my account designed only for gaming), my full path is /home/graysonpeddie.lan/gpeddie-games and not /home/gpeddie-games.

I have all my users (only me) in a separate home folder in order to prevent any kind of conflict with local user accounts, but then I still append my local admin account with -local in order to prevent any kind of conflicts in my Linux desktop machine.

Conclusion

This is why you should never assume that all users will be in the parent folder of the home directory. The only use-case for using a $USER environment variable is if you need to get the name of the user. Referring back to the /etc/profile script, here is an example:

if [ -x /usr/bin/id ]; then
    if [ -z "$EUID" ]; then
        # ksh workaround
        EUID=`/usr/bin/id -u`
        UID=`/usr/bin/id -ru`
    fi
    USER="`/usr/bin/id -un`"
    LOGNAME=$USER
    MAIL="/var/spool/mail/$USER"
fi

After reading the script, I'm not sure why $LOGNAME and $MAIL exists in that profile. Plus, I checked to see if I can get the name of the $USER in my VPS server and there is already a $USER in the list of environment variables even though it's not listed in /etc/profile. Strange...

Anyway, I hope I can be of help and use to the people within the Linux community and I am hoping that people can learn from mistakes when getting the user's current home directory.


Article published: 2023-03-18 15:37

Categories: The World of Computers, Computers, Information Technology, Scripting and Programming

Need a Command Line-based File Manager for Linux?

Audience

This short article is intended for Linux users who are both familiar with the command line and a terminal-based text editor called vim.

For blind users, I don't believe the ranger program is accessible for screen readers. Probably not even in VoiceOver for Mac. For file management tasks, if only the Mac's Finder could support SSH's Secure Copy Protocol (scp for short) or SSHFS (Secure Sheel File System). Third-party applications will have to be installed. I do have brew installed for installing homebrew applications tAhat run Linux-like applications in a Mac, but Brew does not support Mac OS 13 (pre-release). I think the problem with ranger is that VoiceOver for Mac does not read the currently highlighted directory or file that I currently select.

Keyboard Commands for ranger:

Key: h, j, k, l
Left, down, up, and right. Basic commands similar to Vim and Vi. You can also use arrow keys if you want to! Arrow keys work in Vim as well.
Key: yy and pp
Copy and paste a file or directory.
Key: gg
Go to the beginning of the list of files or directories (typing g once instead of twice opens the list of available commands; type g again and it should move the selector to the top of the list).
Key: G
Go to the end of the list of files or directories.
Key: Enter
Depending on the file associations, opening an HTML file opens w3m and opening a JSON file opens a text editor such as Vim.
Key: F4 (function key)
Opens a text editor for a selected file.
Key: r
Open with: (Type the name of the program you want to open with.)
Key: spacebar
Select multiple files or directories. This is useful when copying files or directories in bulk.
Key: q
Quit ranger.
Command: :search <filename>
Searches for a file. Replace <filename< with the name of the file you are looking for.

Additional details for ranger can be found by visiting the ArchWiki page.

Install ranger:

For Fedora/Red Hat-based Linux distributions:

sudo dnf install ranger

Replace dnf with yum if you are running an older version of Red Hat-based Linux distribution.

For Debian/Ubuntu-based Linux distributions:

sudo apt install ranger

For those who use Arch Linux (if you use Arch Linux, I'm going to assume you know the commands for installing and updating packages. Explaining flags for pacman is beyond the scope of my article.):

sudo pacman -Syu ranger

Why choose ranger as a terminal-based file manager?

I need a way to copy and paste files into multiple directories. I can do it via the command line, but I can be very lazy with typing the names of directories. With a new flat-file CMS (Content Management System), I had a new blog setup and I needed to import all of my posts from ClassicPress to my new CMS. For creating new posts, I follow the convention where the date comes first before the permalink (yyyymmdd-hhmm-permalink). The following list shows how I break it down.

yyyy
Year: 2023
mm
Month: 02 (February)
hhmm
Hour/Minute: 11:00 (Eastern Time)
permalink
Permalink: need-filemanager-linux

The more I use ranger, the more I begin to fall in love with the program. But if I'm going to be using a screen reader with the screen turned off, this can be a problem for me and even a problem for blind users as well. However, at least ranger saved me from having to type a lot, especially when performing file management tasks. If you are looking for a file management program while working over a secure shell (SSH), give ranger a try. Oh, and the more I discover keyboard commands, the more I add to the list of commands. And of course, the more I enjoy using ranger.


Article published: 2023-02-19 11:15

Categories: The World of Computers, Computers

Pro Tip for Proxmox Users: Using Linux Containers (LXC) For Testing The Ability To Join Linux to an Active Directory?

Short Version

When creating Linux containers for the purpos of joining them to an Active Directory Domain Controller, make sure the checkbox after the "Unprivileged Container" is unchecked. The "unprivileged container" checkbox is after the "Hostname" edit box. Unprivileged Linux containers won't be able to join to an Active Directory. Essentially, I forgot to uncheck the "Unprivileged Container" and wasted hours of my time, but I consider time well spent when learning the hard way.

Proxmox has "Unprivileged Container" checked by default when creating a new Linux container. That option cannot be changed once a Linux container is created, so the Linux container will have to be deleted in order to start from scratch with "Unprivileged Container" unchecked.

Skip ahead to Long Version section for more details.

Who Is This Article For?

This article is for anyone who has experience with Proxmox. Proxmox is a Linux distribution and it comes with a web interface for running and managing virtual machines and Linux containers. This link will take you to the web page that explains how virtual machines and Linux containers work. The "long version" also mentions SSSD when I was troubleshooting issues while attempting to log into an Active Directory. System Security Services Daemon (SSSD, for short) is what enrolls a Linux client to an Active Directory. A "daemon" in Linux is another name for "services" in Windows that runs in the background. This article is intended for advanced Linux users only.

Long Version

I wanted to see if I can implement Active Directory functionality without needing Windows Server operating system. A software called "Samba" lets me do just that, so I followed instructions on getting Samba's Active Directory Domain Controller (AD-DC, for short) up and running. I set this up in a privileged Linux container. The reason why Linux containers need to have privileges is because when I did a search for "setresgid failed [22][Invalid argument]" (without quotes) in StartPage, I came across a page in GitHub titled Cannot log in with Active Directory users via SSSD on Proxmox #3153. That was when I created a new Linux container and I forgot to uncheck the "Unprivileged Container" checkbox. I did a lot of troubleshooting when I looked into /var/log/sssd/sssd_graysonpeddie.lan.log and /var/log/sssd/krb5_child.log. graysonpeddie.lan is my local domain name for my home network. This web page explains how to setup a Linux client for joining to a Samba domain. From what I have learned, if I execute an id command in my Linux client:

gpeddie@ubuntu-desktop1:~$ id
uid=1451201106(gpeddie) gid=1451201104(grayson peddie) groups=1451201104(grayson peddie),1451200513(domain users)

According to the GitHub page that I linked earlier, the maximum user ID and group ID (UID and GID for short) is 65536 for an unprivileged Linux container. Within the issue page, the max UID and GID can be changed to 1000000000 or something higher. However, as this is for experienced Linux users who know the inner workings of Linux containers, the moral of the story is that "Unprivileged Container" needs to be unchecked in order for domain joining to work.

Warning

Bear in mind that privileged containers are not safe for businesses when it comes to attackers exploiting privileged Linux containers. And yes, it's all about vulnerabilities and exploits when it comes to escaping Linux containers and causing damage to the host; however, for homelab purposes, a privileged Linux container is fine for my needs. If you are concerned about the security of Linux containers, spin up virtual machines instead of Linux containers in Proxmox. Of course, depending on your security hygiene, virtual machines can be as unsafe as privileged and unprivileged Linux containers if you do not have security precautions in place. For more details, learn more about privileged and unprivileged containers.


Article published: 2022-09-22 06:27

Categories: The World of Computers, Computers, Information Technology

Internet and Safety: Why Physical Businesses Should Not Require Everyone To Use Internet?

(For my blog post, I want to focus on the audience regarding people who use Internet every single day and knows a lot about cybersecurity. Myself included.)

Imagine a scenario: you went to get your haircut and the place you went to requires you to enter an email address before you get your haircut. Why? Even if I do have a smartphone and I use Internet every single day, why must I put in my email address? For what purpose? To send spam? For businesses, they might say "we respect your privacy and take security seriously," but in my mind, I would say that if an email gets compromised in a data breach, it's more likely that those who are not tech-savvy are more likely to receive spam and phishing emails. Not thinking about security when using the Internet can lead to ransomware and identity theft. They might stop using the computer altogether because of fear of feeling unsafe online.

Okay, so I can imagine people asking...

What is ransomware?

So anyone who have not used the Internet before would then ask...

Okay, so what is malware? Oh, maybe I should click in the link. Oh, and what is a file?

Okay, I can imagine tech-savvy folks asking "what do you mean, 'what is a file?' Do you ever know how to use a computer before?" How can we guide people who does not use Internet every single day, let alone not knowing "what is an Internet?"

What is an operating system? Windows? Mac? Linux? What is an email address? What is a "file?" See where I'm going with? What is Android? iPhone? iOS? How do I manage files and folders in my computer? How do I check my email? I hope you get my point.

So back to the topic about email address requirement, people who have no plans to educate themselves regarding security and privacy should not have an email address and should not be using the Internet. Even a smartphone can be very complex compared to a cell phone that only make and receive phone calls and nothing else. Let alone how to send and read text messages. And yes, I'm talking about people who use cell phones with no capability for browsing the Internet. Not even Firefox, Chrome, or Safari.

Okay, so you say that your 90-year-old family member knows how to use the Internet, takes care of security themselves, and I should not overly-generalize myself. Well, that's great, but we should not force everyone to have a smartphone just so they can face dangers lingering in the Internet.. People should be educated regarding the implications regarding cyber attacks and how to protect themselves; however, as long as people out there (Demographics of Cybercrime Report) do not take their time to educate and protect themselves, businesses should not require them to have an email address when they check in. Even dentists should make email address requirement optional as well. Even though I have close to 200 email addresses at the time of writing (one email address per site with no plus addressing and no catchall for my domain), I do not want to enter my email address if I do not want to for privacy and security reasons.

Businesses say "we take security and privacy seriously," yet businesses do not take their time to harden and patch their systems over time. Of course, training employees regarding how to protect themselves against phishing emails is a very important part of having a security culture for businesses. But then again, an email address would be a requirement for businesses for getting your customers to setup an account online, but in a physical world where people simply walk in, as long as people do not use the Internet and do not plan to educate themselves, an email address should not be a requirement. At all.


Article published: 2021-10-06 12:00

Categories: The World of Computers, Computers, Security

My Dream Home of the Future: Computer in Server Closet; KVM in Home Office; Home Theater

I have been watching a couple of YouTube videos of people who want a computer in one room (such as a wiring closet) and a keyboard, video, and mouse (KVM) in a home office. To give you an idea of what I'm talking about, I want to post links to YouTube videos.

Embedding YouTube or Odysee videos will insert a tracking cookie in users' personal computers. As a citizen of the US, I need to follow GDPR if European visitors visit my website. I don't like and want to talk to lawyers to be honest. 🤣😀

As for the video from Linus Tech Tips, I would much rather have a couple of computers rather than single computer that can house a couple of virtual machines running desktop OSes such as Linux and Windows just to make it easier for me. So yeah, a virtual machine is a computer within a computer that can serve different purposes such as running Ubuntu within Windows using VirtualBox or by running Windows OS in a Linux host using KVM or Xen.

So, I have an idea of my own. When it comes to building a house, I would like to wire my future house for Ethernet and HDMI connectivity. The computer will be in a wiring and server closet and my essentials such as my mouse, keyboard, monitor, audio interface, and a couple of others will be in a recording studio/home office room. So here's what I'm thinking of buying in the future:

One concern I had with USB over Ethernet is latency from the audio interface to the computer over the Ethernet cable. However, one look at the images and answers to questions tells me that latency over Ethernet cable should not be a factor. That way, I can have my computer fans spin at max RPM in the server room (well, maybe not too loud) and still have complete silence in my studio/office with sound proofing and acoustic panels.

Oh, here something that I would like to show you (for those with eyesight). It's a home theater room made in Blender.

Home theater rendered in Blender with 3 chairs and cup holders between chairs
This is a rendering of my home theater made in Blender. It has a 200" projection screen, 7.2.4-channel speaker system, and comfy seats with cupholders in between.

My dream of a home theater will be a lot simplistic than that with flat ceilings with no light strips in between them. A home theater will be in a basement. Speaking of home theater, I could patch my home desktop over to my home theater while in the server closet if I want to watch YouTube/Odysee videos. How cool would that be if a house can have a central computer core just like in a starship such as U.S.S. Enterprise D or U.S.S. Voyager? Speaking of starships in Star Trek, do you know that a central computer core can span over several decks? Actually, a starship can contain two or more computer cores. My house might have only a single central computer core with a couple of rack-mounted desktops and servers as part of a homelab! Here is an example of a homelab shown in a YouTube video.

As for rack-mounted desktop PCs, I'm thinking of Rosewill RSV-L4500U Rackmount Server Chassis and put them inside a StarTech.com 42U Server Rack Cabinet. Oh, sure the rack-mounted enclosure costs more than an open-frame 42U rack, but to me, it will look a lot cleaner by having an enclosure. Now if only there are 5U or 6U rack-mountable computer cases so I can fit a tall heatsink such as Noctua NH-D15 or Scythe Ninja 5 heatsink. Now keep in mind. I do not care about the looks of computer components. No RGB fans, no tempered glass side panels from the likes of Lian-Li 011 Dynamic XL or even from Phanteks line of computer cases, no nothing.

Why!?

Out of sight, out of mind.

That's my mindset when it comes to computers. If you watch Star Trek, you must know that Captain James T. Kirk does not look at a central computer core every single day while he's in his quarter or in the bridge! No Starfleet officers should care about how cool computers look as long as they perform their jobs! Sorry elite gamers, but I do not like the market the computer case manufactures are targeting. Go look at how cool your computer looks while you are failing your Cisco CCNA course because hey! All that cool RGB fans and that NZXT Kraken Z73 cooler of yours are so much fun to look at! 🤣

As for me? I'm excelling in Cisco CCNA course! Why? My Silverstone FARA R1 computer case only has a plain side panel and is free of distractions. It's unfortunate that a computer case with a plain side panel is unavailable. But I have it! However, the limitation I have is I cannot take the case feet off so I can fit on top of a rack-mounted shelf.

Oh, did I meant to taunt you for having all that cool tempered glass computer case with all that RGB gizmos? Get over it! Seriously. I know you've been playing games 24/7 while you look at how cool your computer looks. Okay, okay. I'll be nice to you elite gamers! 🙂

If you want to get into the world of homelab, Lawrence Systems and Learn Linux TV has done a couple of videos for setting up different aspects of homelab such as Home Assistant, storage server, firewalls and switches, Linux, Ansible, securing your lab, and so much more. Check out the playlist on YouTube and enjoy! Any desktop PCs will be part of a homelab as well. And yes, RAID is not a backup solution. In a RAID 5 setup with 7 hard drives (6 for data and 1 for parity), if one drive fails, swap out the hard drive as soon as possible. But if two drives out of 7 fail, you lose all the data inside the hard drives.

Now here's a question. What about entertainment devices such as NVIDIA Shield TV, and PlayStation 5? These devices can sit on a rack-mountable shelf and can be patched to my home office room using an Ethernet-based USB extender. For HDMI, I can make use of Anthem MRX 740 for my home office room and use HDMI Zone 2 Out to pass HDMI audio/video signal to Anthem MRX 1140 receiver, which can go to the home theater room. What I've learned from a thread over at avforums.com is that the main receiver (MRX 740) will pass audio/video signal to another receiver and plays no part for processing A/V signals.

What that means is I can independently select a source in the second zone while the first source will remain intact in the main office room. Just tell Home Assistant to switch to NVIDIA Shield in the second zone of MRX 740 receiver, and Home Assistant will do the rest. Whatever is shown in MRX 1140 for the home theater room will reflect what was shown from MRX 740's HDMI Zone 2 output.

So yeah, centralizing desktop PCs in a wiring/server closet is my dream of the future! Centralize all the desktop computers into one 45U server rack! 🙂


Article published: 2021-08-14 17:42

Categories: Visionary Living and Exploring Tomorrow, Homes and Buildings, Home Theater, The World of Computers, Computers, Networking