'Backup plan' with rsync

After todays partition failure, thank you Win7 for no safe unmount on my USB harddisk I decided to rsync some important data onto my shared hosting.

https://raw.github.com/mikaelz/bin/master/backup.sh

#!/bin/sh

# ~/bin/backup.sh
# 
# https://wiki.archlinux.org/index.php/Rsync#Automated_backup_with_SSH
# https://wiki.archlinux.org/index.php/Full_System_Backup_with_rsync
# http://www.sakana.fr/blog/2008/05/07/securing-automated-rsync-over-ssh/
# https://www.linux.com/news/enterprise/storage/8200-back-up-like-an-expert-with-rsync

time rsync -vhaz --stats --progress -e ssh \
    --exclude ".DS_Store" \
    --exclude "._.DS_Store" \
    --exclude "Thumbs.db" \
    --exclude "thumbs.db" \
    --exclude "desktop.ini" \
    --exclude ".svn" \
    /Volumes/data/Dropbox \
    example.com@example.com:/backup/Dropbox
    # >> backup.log # log output
    # &> /dev/null # no output at all

# TODO
# if sshfs mounted
# time rsync -vhaz --stats --progress -e "ssh -i .ssh/id_rsa USER@example.com" \
#     --exclude ".DS_Store" \
#     --exclude "._.DS_Store" \
#     --exclude "Thumbs.db" \
#     --exclude "thumbs.db" \
#     --exclude "desktop.ini" \
#     --exclude ".svn" \
#     /Volumes/data/Dropbox \
#     /home/USER/backup/Dropbox
#     # &> /dev/null

Couldn't find cacert.pem & irssi SSL struggling

I was setting up irssi to connect via SSL so I needed a CA (Certificate Authority) bundle.
I couldn't find it in /etc/ssl/certs (it was empty), in tutorials this path was mentioned, maybe Linux convention :)

I was reading http://ilia.ws/files/sunshinephp_application_security.pdf and found enlightment :)
wget http://curl.haxx.se/ca/cacert.pem so I downloaded it and watched into it.

On the 2nd row there was the following

# ca-bundle.crt -- Bundle of CA Root Certificates

From curiosity I tried locate ca-bundle and the following output came:

/opt/local/share/curl/curl-ca-bundle.crt
/opt/local/share/doc/curl/html/mk-ca-bundle.html
/opt/local/share/doc/curl/pdf/mk-ca-bundle.pdf
/opt/local/share/doc/mutt/samples/ca-bundle.crt
/opt/local/share/ncat/ca-bundle.crt

From experience /opt/local is the standard macports install (--prefix) path directory so I checked

mike@mikembp:~$ ls -l /opt/local/etc/openssl/
total 32
lrwxr-xr-x  1 root  admin    40B Feb  2 01:21 cert.pem@ -> /opt/local/share/curl/curl-ca-bundle.crt
drwxr-xr-x  9 root  admin   306B Jan 11 12:55 misc/
-rw-r--r--  1 root  admin    11K Jan  7 08:34 openssl.cnf

After some playing around to get some insight I found the trust command

mike@mikembp:~$ trust
usage: trust command ...

Common trust commands are:
  list             List trust or certificates
  extract          Extract certificates and trust
  extract-compat   Extract trust compatibility bundles
  anchor           Add, remove, change trust anchors

See 'trust  --help' for more information

So without internet connection I can still have outdated CA bundle with the following command

mike@mikembp:~$ trust extract --format=openssl-bundle --comment -f cacert.pem

irssi was screaming SSL warning on me without CA bundle

= 08.084055 [freenode] |-INFO > Irssi: Connection lost to irc.freenode.net
= 08.084055 |-INFO > Irssi: warning Could not verify SSL servers certificate: unable to get local issuer certificate
= 08.084055 |-INFO > Irssi: warning   Subject : /serialNumber=A7/cAN-TICcVTifiF1F5wuRPLpK75-AJ/C=US/ST=California/L=Mountain View/O=Mozilla Corporation/CN=irc.mozilla.org
= 08.084055 |-INFO > Irssi: warning   Issuer  : /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
= 08.084055 |-INFO > Irssi: warning   MD5 Fingerprint : FC:A1:52:CF:D9:97:2B:3D:55:F5:4A:2F:7C:10:99:69

Or connecting to port 7000

= 08.085921 |-INFO > Irssi: warning Could not load CA list for verifying SSL server certificate
= 08.085921 |-INFO > Irssi: Unable to connect server irc.freenode.net port 7000 [Operation now in progress]

mike@mikembp:/etc/ssl/certs$ sudo wget http://crt.gandi.net/GandiStandardSSLCA.crt
Password:
--2014-02-08 08:51:51--  http://crt.gandi.net/GandiStandardSSLCA.crt
Resolving crt.gandi.net (crt.gandi.net)... 178.255.83.2, 2a02:1788:2fd::b2ff:5302
Connecting to crt.gandi.net (crt.gandi.net)|178.255.83.2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1191 (1.2K) [application/x-x509-ca-cert]
Saving to: ‘GandiStandardSSLCA.crt’

mike@mikembp:/etc/ssl/certs$ sudo wget http://www.instantssl.com/ssl-certificate-support/cert_installation/UTN-USERFirst-Hardware.crt
--2014-02-08 08:53:41--  http://www.instantssl.com/ssl-certificate-support/cert_installation/UTN-USERFirst-Hardware.crt
Resolving www.instantssl.com (www.instantssl.com)... 199.66.206.224, 2a02:1788:4fd:ce::c742:cee0
Connecting to www.instantssl.com (www.instantssl.com)|199.66.206.224|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1630 (1.6K) [application/x-x509-ca-cert]
Saving to: ‘UTN-USERFirst-Hardware.crt’

Converting CRT to PEM as mentioned at https://pthree.org/2010/01/31/freenode-ssl-and-sasl-authentication-with-irssi/ didn't help

mike@mikembp:~$ openssl x509 -inform der -outform pem < /etc/ssl/certs/GandiStandardSSLCA.crt > GandiStandardSSLCA.pem
mike@mikembp:~$ sudo mv GandiStandardSSLCA.pem /etc/ssl/certs/

I tried downloading the certificates with Firefox

Output of SSL connection

mike@mikembp:~$ openssl s_client -CApath /etc/ssl/certs/ -connect irc.freenode.net:6697
CONNECTED(00000003)
depth=1 /C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.freenode.net
   i:/C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA
 1 s:/C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA
   i:/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIE5TCCA82gAwIBAgIQPAK59bPbZcCxzaKLiC8OjTANBgkqhkiG9w0BAQUFADBB
MQswCQYDVQQGEwJGUjESMBAGA1UEChMJR0FOREkgU0FTMR4wHAYDVQQDExVHYW5k
aSBTdGFuZGFyZCBTU0wgQ0EwHhcNMTQwMTEzMDAwMDAwWhcNMTUwMTE0MjM1OTU5
WjBiMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxJDAiBgNVBAsT
G0dhbmRpIFN0YW5kYXJkIFdpbGRjYXJkIFNTTDEXMBUGA1UEAxQOKi5mcmVlbm9k
ZS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVuq/Gyqk79Uyp
CZvlGv4ROFrZy4/bnZCI3Y9eGmgPz3oEhiyi5La3+e/QdxhAvY4Cr6E6yAOcnQrF
99YxTfAy5J4t5p6clPfIbYf2iegwZpOjOP94N+MQrgH/sw+lD1Ue3y2SGbjhnEt4
Mc+78jFvbcQilTpZ8ncGe+eDWfp5e6Z3pdel5MyNDRHcRVKhHNcCNZ4v3hldDu0s
Qo9Vd63WM5Hiaqpbt6YusOMTZ/bfNUuRrHOdTgBQ27w1vkwjwUbudK1ZqBlYuKES
jEBtJxWxS4JvXw2XLMw3kqH+TrYoCypfJTuhZkEa8nGimJ63j1cPTz7G/IJ9ktKk
JvmTU4EFAgMBAAGjggG2MIIBsjAfBgNVHSMEGDAWgBS2qP+iqC/Qps1LsWjz51AQ
Mad5ITAdBgNVHQ4EFgQUc6PotnJGCOnbZIXwlz9oO+61JB0wDgYDVR0PAQH/BAQD
AgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
MGAGA1UdIARZMFcwSwYLKwYBBAGyMQECAhowPDA6BggrBgEFBQcCARYuaHR0cDov
L3d3dy5nYW5kaS5uZXQvY29udHJhY3RzL2ZyL3NzbC9jcHMvcGRmLzAIBgZngQwB
AgEwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5nYW5kaS5uZXQvR2FuZGlT
dGFuZGFyZFNTTENBLmNybDBqBggrBgEFBQcBAQReMFwwNwYIKwYBBQUHMAKGK2h0
dHA6Ly9jcnQuZ2FuZGkubmV0L0dhbmRpU3RhbmRhcmRTU0xDQS5jcnQwIQYIKwYB
BQUHMAGGFWh0dHA6Ly9vY3NwLmdhbmRpLm5ldDAnBgNVHREEIDAegg4qLmZyZWVu
b2RlLm5ldIIMZnJlZW5vZGUubmV0MA0GCSqGSIb3DQEBBQUAA4IBAQAUJNxQB+ui
agYe5vkeEW27w4+O9eoTmzVoecAYs04HPrc8eMtpdUW2HUxVLi0sJNYLANS5YiV9
Bba1Sdk5c2dN7KjCuvtJYC0Bjbvk1HjXOHieMmZGe6GKoG0UVYgSekOOAQLE8OED
DC2DapvP22Zmx6kjf6LSp/C3oW8wT5Dc7x0pCCuRNRzOMbZ3pv+jINovexmoABTQ
8y/7pYz+yVTuDx0yogl/+m3+d4p2YVhnm2eJyMLoGB/Vkw+kgsKDuntLWpDNDO6H
Dw7kPAPlXGNaqyncGiJTnY0u6QqJft5CZLmzTml+X4JMFDqdctXCCyAeEV4oe0tD
t04HEAoub+H+
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/OU=Gandi Standard Wildcard SSL/CN=*.freenode.net
issuer=/C=FR/O=GANDI SAS/CN=Gandi Standard SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 3162 bytes and written 340 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 79702A9A129FAEEBFE1C78DCBB8692D7E3235C61197C06157CF3679E628C1153
    Session-ID-ctx:
    Master-Key: 8AF72A2403FD491437296F3FD2F33F7B352F89A59D5078D6B5A8F4ACECA887B1F55A9894D7F9B8540C7EE15C697502AF
    Key-Arg   : None
    Start Time: 1391853886
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
:sendak.freenode.net NOTICE * :*** Looking up your hostname...
:sendak.freenode.net NOTICE * :*** Checking Ident
:sendak.freenode.net NOTICE * :*** Your forward and reverse DNS do not match, ignoring hostname
:sendak.freenode.net NOTICE * :*** No Ident response

Finally working bash_completion in GNU screen

I was struggling without bash_completion in GNU screen and the solution was adding the following to .screenrc:

defshell -bash

Some more info at:

https://www.gnu.org/software/screen/
http://magazine.redhat.com/2007/09/27/a-guide-to-gnu-screen/ 
http://www.debian-administration.org/article/An_introduction_to_bash_completion_part_1

My .screenrc https://raw.github.com/mikaelz/dotfiles/master/.screenrc

#
# ~/.screenrc
#
# Thanks to:
# https://www.gnu.org/software/screen/manual/screen.html#Command-Summary
# http://www.debian-administration.org/articles/560
# http://www.alexandrulazar.com/junk/articles/.screenrc

startup_message off

defshell -bash # dash makes it a login shell

vbell on # no annoying audible bell
vbell_msg "  !! Something interesting has happened !!  "
activity "%c activity -> %n%f %t"
bell "%c bell -> %n%f %t^G"

autodetach on  # autodetach session on hangup instead of terminating screen completely
altscreen on
defscrollback 5000
defutf8 on
defnonblock on
msgwait 1 # message timeout 1 second
shelltitle "$ |bash"

defmonitor on # turn monitoring on
activity "%"  # tell me when stuff happens!

# allow bold colors - necessary for some reason
attrcolor b ".I"

# http://www4.cs.fau.de/~jnweiger/screen-faq.html
# https://stackoverflow.com/a/4833946
# http://pjkh.com/articles/osx-iterm-screen-vim-256-colors/
term screen-256color
termcapinfo screen* 'Co#256:AB=\E[48;5;%dm:AF=\E[38;5;%dm'
termcapinfo screen* ti@:te@ # make scrollbar work

defbce on # erase background with current bg color

bind R eval "source $HOME/.screenrc" "echo '.screenrc reloaded!'"
bind % screen -t htop htop

screen -t netlog 0 watch -n 2 -d lsof -iTCP -P
screen 1 mc
screen 2
screen 3
screen 4

backtick 0 0 0 whoami # set "%0`" to equal the output of `whoami`

hardstatus alwayslastline "%{.bW} %-w%{.rW}%n %t%{-}%+w %=%{..} %l | %0`@%H | %D %c:%s %d.%m.%Y"

My Mac OSX workspace february 2014

From left to right:
Console.app or Filezilla.app
Firefox.app with Firebug vertical split
VIM in GNU screen in iTerm2.app terminal

How to set up irssi advanced window list

I just finally made advanced window list to work. I was getting the following in the statusbar 'AWL: Run adv_windowlist from the shell or switch to sbar mode' and didn't know until I asked for help on freenode irssi channel.

The solution was /set awl_viewer off

Additional changes to AWL layout
/format awl_display_key = $Q%K|$N%n $H$C$S
/format awl_display_key_active = $Q%K|$N%n $H%U$C%n$S
/format awl_display_nokey = [$N]$H$C$S

Info from adv_windowlist.pl 

# /format awl_display_(no)key(_active|_visible) 
# * string : Format String for one window. The following $'s are expanded:
#     $C : Name
#     $N : Number of the Window
#     $Q : meta-Keymap
#     $H : Start highlighting
#     $S : Stop highlighting

Full script https://raw.github.com/mikaelz/dotfiles/master/.irssi/scripts/adv_windowlist.pl

More info for setting up:
http://quadpoint.org/articles/irssi/
http://www.antonfagerberg.com/archive/my-perfect-irssi-setup/

Nezabúdajme na našich vytrvalcov

Myšlienky, ktoré jednoducho musím zo seba vydať :-)

Nedávno som sa začal lepšie zaujímať o ľudí okolo mňa a tak zistil, že čo u nás v Kolárove vzniklo a ako sa necení :(
Písal sa rok 1998, keď Andrea Hajdú začala krasojazdu (http://www.cyklistikaszc.sk/sk/salova-cyklistika) s malou skupinou detí.

Čo mi, ale nedá pokoj je, že si ich neceníme dostatočne. Je pravda, že každí z nás je jedinečný, ale už menej z nás to sebe a ostatným dokáže. Netvrdím, že by sme im mali postaviť sochy, ale taká návšteva napríklad na majstrovstvách SR by nezaškodilo. Človek myslí v prvom rade len na seba, čo máme geneticky dané, ale druhí nás môžu inšpirovať a motivovať, aby sme zapracovali na sebe. Veľa ľudí chce viac v živote, ale navštevuje prostredie, kde nie sú motivovaní ľudia, ktorí chcú v živote niečo dosiahnúť, tak takto sa bude mať ťažko dobre.

Majstrovstvá sveta 2011 (Kagoshima, Japonsko) - 3. miesto


Aquabella. Nič proti futbalu. Kde celý problém viazne? No predsa v marketingu a čo je dôležitejšie v medziľudských vzťahoch, že sa takmer nepoznáme. Vopred sa ospravedlňujem všetkým ostatným, ktorých som nespomenul.

Mac OS X firewall software

I was searching for a firewall app for my Mountain Lion, because I'm not really satisfied with the default OSX firewall option in System Preferences. For me it lacks customization. On a security presentation I asked the presenter and introduced me to a paid firewall app 'Little Snitch' which is very nice and full of cool features. I continued to search if some free app exists and found IceFloor which is a frontend interface for the OSX built in firewall, PF - Packet Filter. For older OSX than 10.8 there is WaterRoof