Allow sudo to use fingerprint auth when laptop lid is open on Fedora 44

I want to achieve the following on Fedora 44 on Thinkpad x1c gen 10,

• fingerprint auth is allowed in sudo
• fingerprint auth not allowed anywhere else
• fingerprint auth is skipped when laptop lid is closed.

I did the following

check current authselect config

authselect current

If the result contains  with-fingerprint, disable it

sudo authselect disable-feature with-fingerprint

cat /etc/pam.d/system-auth to verify that fprintd is not listed

This disables fingerprint auth for everything

Then add these two lines in /etc/pam.d/sudo, immediately below the #%PAM-1.0 line

auth [success=ok default=1] pam_exec.so quiet quiet_log /bin/grep -q open /proc/acpi/button/lid/LID/state
auth   sufficient   pam_fprintd.so

This two lines enables fingerprint auth only when the laptop lid is open.

Lastly, run fprintd-enroll to enroll fingerprints.

 

References

https://www.man7.org/linux/man-pages/man8/pam_exec.8.html

https://www.man7.org/linux/man-pages/man5/pam.conf.5.html 

 

 

 

 

 

Remeber screen brightness in Fedora

My laptop's screen is always at the lowest brightness when resuming from sleep. It is very annoying. I found a fix.

 

Create an executable file at /usr/lib/systemd/system-sleep/brightness with following contents,

#!/usr/bin/sh

case $1 in
    pre) cp /sys/class/backlight/intel_backlight/brightness  /tmp/saved_brightness ;;
    post) cp /tmp/saved_brightness /sys/class/backlight/intel_backlight/brightness  ;;
esac

Extend a BTRFS filesystem on LUKS protected partition

My computer's root partition is a BTRFS sub-volume inside of a LUKS encrypted partition. Its space is running low. Fortunately the SSD has unallocated space after the LUKS partition.

Steps,

1. run parted /dev/nvme0n1
2. type resizepart to resize the LUKS partition
3. type q to quit
4. run cryptsetup resize {name_of_the_dm} -v to grow the LUKS volume.
5. run btrfs filesystem resize max /

Credits

• https://blog.tinned-software.net/increase-the-size-of-a-luks-encrypted-partition/
• https://btrfs.readthedocs.io/en/latest/btrfs-filesystem.html

Disable fingerprint scanner when laptop lid is closed

Since Fedora 32, I was able to enable login and sudo with fingerprints in Gnome settings. However, when my laptop is docked and the lid closed, sudo still prompts from my fingerprints. I have to wait for a few seconds for the fingerprint reader to time out before I can input my password.

I would like to change sudo to skip fingerprint authentication when the laptop lid is closed. I came up with two options,

1. Enable the fingerprint reader when I open the lid and disable it when I close the lid.
2. Change PAM config to check for lid status and skip pam_fprintd.so when the lid is closed.

For either options to work, they need to know the lid status. On my ThinkPad X1 7th gen laptop, /proc/acpi/button/lid/LID/state has the lid status. I think the second option is better. But I did not figure out how to tell PAM to skip pam_fprintd.so conditionally. So I implemented the first solution.

On Linux, you can enable/disable an USB device by setting the authorized bit in sysfs.

I also found a acpid program that monitors ACPI events and runs scripts when certain events happen. I installed it and create these two files.

/etc/acpi/events/lid

event=button/lid.*
action=/etc/acpi/actions/lid.sh 

/etc/acpi/actions/lid.sh

#!/usr/bin/sh
 
PATH=/usr/sbin:/usr/bin
 
grep -q close /proc/acpi/button/lid/LID/state
if [ $? = 0 ]; then
    echo 0 > /sys/bus/usb/devices/1-9:1.0/authorized
fi
 
grep -q open /proc/acpi/button/lid/LID/state
if [ $? = 0 ]; then
    echo 1 > /sys/bus/usb/devices/1-9:1.0/authorized
fi
 
exit 0

So every time the lid status changes, acpid will run lid.sh and it will check the lid status and the disable/enable the fingerprint reader. To prevent acpid conflicting with Gnome, I removed all other files in /etc/acpi/events.

Policy Based IPv6 Routing on LEDE

My home router runs LEDE 17.01. It has two IPv6 connections, an ISATAP tunnel and TunnelBroker. The ISATAP connection has shorter latency than the TunnelBroker. However, ISATAP only allows one IPv4 address to have one IPv6 address. In order to let my home computers have IPv6 connections, I have two choices. The first is to use NAT on IPv6 so that hosts behind the router appears as one hosts on the IPv6 Internet. The second choice is to assign home computers addresses allocated on TunnelBroker and route all their traffic through TunnelBroker. And installing a SOCKS/HTTP proxy on the router, so a host can enjoy the low latency ISATAP link via the proxy.

So, I configured the router to have the following IPv6 routing table

default from 2001:xxxxx::/64 dev 6in4-henet proto static metric 16 pref medium
default from 2001:xxxxx::/64 dev 6in4-henet proto static metric 16 pref medium
2000::/3 via 2001:da8:xxxx dev isatap src 2001:da8:xxxx metric 2 pref medium

As a result, the router will opt for the ISATAP link over the TunnelBroker link. However, I found that although hosts behind the router can get IPv6 addresses, they cannot connect to any IPv6 hosts outside my home, because the router puts all IPv6 traffic whose destination matches 2000::/3 through the ISATAP link!

Later, I came up with a solution. Linux supports policy-based routing. So the router can have two IPv6 routing tables, namely the `main` and `henet` table. For IPv6 packets whose source addresses are within my TunnelBroker's block, the router should lookup the `henet` table, which contains

2001:xxxxx/64 dev br-lan
default from 2001:xxxxx::/64 dev 6in4-henet

I wrote a script to achieve this effect

ip -6 route flush table henet
ip -6 route add 2001:xxxx/64 dev br-lan metric 128 table henet
ip -6 route add default dev 6in4-henet metric 256 table henet
ip -6 rule add from 2001:xxxxx/64 table henet

You should also add `252 henet` to /etc/iproute2/rt_tables before invoking the above commands.

Setting up IKEv2 with strongSwan on OpenWrt 15.05.1

I have been using OpenVPN on my OpenWrt router for remote access. OpenVPN is a SSLVPN solution similar to Anyconnect from Cisco. IPsec is a IETF standard for providing network layer security. The support of IPsec is builtin to recent Linux kernel. However, the kernel needs the encryption key before setting up IPsec. You can manually create IPsec tunnels with a preshared key, but this approach does not support mobile clients which have dynamic IP addresses.

The Internet Key Exchange protocol is aimed at negotiating security parameters before setting up an IPsec tunnel. Usually, an IKE daemon listens on UDP/500 for requests and then does several rounds of exchanges with the remote client and then send negotiated parameters to the Linux kernel and thus sets up an IPsec tunnel.

IKEv2 is the latest one which is much easier to deploy than its predecessor IKEv1. StrongSwan is an IKE daemon with full support of IKEv2. To install strongSwan on OpenWrt, you need install strongswan-minimal package. You also need to install strongswan-mod-openssl in order to use pubkey authentication.

There are several configuration files:

/etc/ipsec.conf contains information of IPsec tunnels.
/etc/strongswan.conf contains configuration for strongswan.
/etc/ipsec.secrets contains various credentials of IPsec tunnels.


The following is all needed to setup a tunnel with PSK. PSK is not so safe as public key, especially if the PSK is very weak.

in /etc/ipsec.conf:

conn mytunnel
left=%any
 leftsubnet=10.1.0.0/16
leftid=home
leftfirewall=yes
right=IP_OF_THE_PEER
 rightsubnet=10.2.0.0/16
rightid=moon
auto=add
mobike=no
authby=psk

in /etc/ipsec.secrets:

moon : PSK YOUR_PSK_FOR_TUNNEL

use `ipsec up mytunnel` to establish the tunnel and `ipsec statusall` to check tunnel status.

Adding an Intel Wireless-AC 7260 Card on ThinkPad T420s

I bought an Intel 7260AC card from jd.com yesterday in order to replace the 6205 card on my T420s and enjoy the speed of 11ac. The card arrived this morning. The card is not specially made for ThinkPads.

As all ThinkPad's BIOS is equipped with a whitelist of authorized wirless cards. I need to flash a BIOS with whitelist removed. I found one made by TimeWalker75a on bios-mods.com. Here is the link. Apart from removing the whitelist, the modified BIOS also unlocks RAM clock speed and some advanced settings. But before flashing the modified BIOS, you need to flash the original 1.41 BIOS offered by Lenovo.

Then, I removed the battries and the shield above the RAM modules and saw the 6205 mini-PCI-E wireless card. I unplugged the two antenna cables, loosed the screw and removed the old card. And then installed the new 7260 card and plugged the cables. The gray cable should be connected to the main port while the black one should be connected to the aux port.

I plugged in the power cord and turn it on. Fedora identified the new card successfully, and the hardware wireless switch worked flawlessly. But all WiFi history is lost. This 7260AC card also contains a Bluetooth 4.0 module, and the laptop also has a embedded Bluetooth module(BCM2045B) from Broadcom, I can see both of them by running hciconfig. Removing BCM2045B needs opening the palm rest. I found a way to blacklist it with udev at here.

Update:

Do not remove the embedded BCM2045B module, or the BIOS will disable Bluetooth even if there is one module in 7260.

Auto run VirtualBox VM in background on Fedora 22 with systemd

Recently, I discovered that VirtualBox has a headless mode, where you can run a VM in background. You can start a VM in background with this command,

VBoxManage startvm Win7 --type headless

Win7 is the name of the VM

You can also save the state of a VM with this command,

VBoxManage controlvm Win7 savestate

So, I wrote a systemd service file so as to start and stop the VM automatically.

[Unit]
Description=Vbox for win7
After=network.target multi-user.target vboxdrv.service

[Service]
Type=forking
ExecStart=/usr/bin/VBoxManage startvm Win7 --type headless
ExecStop=/usr/bin/VBoxManage controlvm Win7 savestate
TimeoutSec=60

[Install]
WantedBy=default.target

Put this file as vbox.service in ~/.config/systemd/user/ and use systemctl --user to manage the service.

Redshift on Fedora 22

Redshift adjusts the screen's color temperature according to the time. It relieves your eyes when working at night. It's homepage is http://jonls.dk/redshift

To install redshift on Fedora 22, type sudo dnf install redshift in terminal. You may also install redshift-gtk, a GUI front-end for gnome desktop. Then you should enable location service in privacy settings. Also add these lines to /etc/geoclue/geoclue.conf to allow redshift to get location from geoclue.

[redshift]
allowed=true
system=false
users=

Finally, type redshift in terminal, and you should notice the change of the color temperature of your screen. However, the shipped systemd service does not work (redshift starts, but no change of color temperature, quite mysterious.) So I installed redshift-gtk and make it autostart when I login. 

用netcat传送文件

一些特殊情况下，比如ssh挂掉了，可以用netcat传输文件。当然，是明文传输。

首先在接收端listen，输入

nc -l 6000 > filename

然后在发送端输入

nc IP 6000 < file_to_send

IP是接收端IP地址，filename是文件保存的名字。

也可以改成在发送端Listen，适用于BusyBox里不支持-l的netcat

发送端：
cat file_to_send | pv -b | nc -l -p 3333
接收端：
nc IP 3333 > filename

还有一个办法，用Python的SimpleHTTPServer和wget

服务端：

python -m SimpleHTTPServer

会在当前目录下运行一个HTTP服务器，端口号为8000

客户端：

wget http://IP:8000/filename

Gnome 3.14添加自动启动

Fedora21已经找不到gnome-session-properties了，虽然gnome-tweak-tools提供了添加子启动程序的功能，不过相当鸡肋。最后找到一个方法可以实现原来gnome-session-properties的功能

在~/.config/autostart/下新建一个xxx.desktop文件，内容如下：

[Desktop Entry]
Type=Application
Name=xscreensaver-autostart
Comment=Autostart xscreensaver
Exec=/usr/libexec/xscreensaver-autostart
Terminal=false
X-Desktop-File-Install-Version=0.22

X-GNOME-Autostart-enabled=true

OnlyShowIn=GNOME;

要注意的是，Exec后面必须是程序的完整路径。

真心想吐槽Gnome，怎么越改越麻烦了。

暂时弃用Gnome3，转投Mate

最近发现笔记本电脑发热量惊人，有时甚至引发CPU过热警告。电池使用时间也大大缩短。查看了一下进程，发现gnome-shell的CPU使用量相当高，尤其在播放视频的时候，甚至超过Chrome浏览器。我尝试禁用所有extensions，甚至创建一个全新的用户，都没有改善。

我是一个忠实的Gnome用户，Gnome 3.0发布后很快就适应了它一致的、优雅的界面。现在，Gnome已经升级到了3.10，虽然增加了功能（我几乎没有用到，比如说什么online accounts），但是bug也越来越多。有很多用户反映CPU占用高，内存泄漏，经常崩溃。有人猜测问题处在Gnome和显卡驱动的接口上（Intel显卡用户反映的问题比Nvidia用户多）。不过我没有找到有效的解决方案。

所以，唯一的选择就是换一个Desktop Manager。因为是Gnome的老用户，故选择了Mate，这是一个由Linuxmint主导的Gnome2的分支。虽然没有了那些窗口阴影，Overview等特效，Mate对资源的需求很低，目前也没有遇到崩溃的情况。唯一不足是有几个程序（比如Virtualbox）的外观变得很难看。

估计要等Fedora21出来后才会再试一下Gnome3了。

2015年2月4日更新：

Fedora21推出后，本人又投入了Gnome的怀抱。 目前没有发现CPU占用率过高的情况。不过Gnome真心变得臃肿了。

在Fedora 20上使用TLP进行笔记本电源管理

Update: TLP is currently in Fedora Official Repository. Use "dnf install tlp".

升级Fedora 20后发现笔记本电池的使用时间有所缩短，用powertop一看，处理文字时的耗电量就有20W，明显不正常。于是就看了一下pm-utils的scripts。果不其然，/usr/lib64/pm/power.d下面空空如也。我东拼西凑了一个powersave script, 放到/etc/pm/power.d下面。后来发现，拔下电源后脚本没有运行，只有手动执行pm-powersave true才可以生效。查了一下，发现pm-utils已经deprecated了，只能另寻方案。

Arch wiki推荐用acpid，不过它只能在有ACPI事件时运行某个脚本。这样就需要自己写一个开机启动脚本判断是否处于电池模式，相当不爽。

后来，在Fedora论坛上发现了一个相关的讨论，有用户推荐用TLP（主页）。 这个东西的功能很强大，可以在电池模式和市电模式采用不同的电源配置（硬盘，WLAN，WWAN，蓝牙，USB，声卡，显卡，SATA控制器，PCIE等等）。此外，它还可以配置Thinkpad电池的thresholds.其配置文件在/etc/default/tlp，几乎不需要太大改动。

使用后效果还是相当明显的，电池模式下功耗降低到了15W,可以多用半小时啦。这里凸显了Linux发行版和Windows的差别，一个电源管理都有好多套方法。说不定什么时候又搞出个更强大的。

Kindle Paperwhite 越狱

大约半个月前把用了好久的第一代Kindle Paperwhite越狱了。由于防火墙的原因，很久没能上blogger，直到几天前搞了个VPS。

越狱的方法来自http://www.mobileread.com/forums/showthread.php?t=198446，第二代KPW越狱方法在http://www.mobileread.com/forums/showthread.php?t=186645 ，由于当前的5.3.9版本不支持DEBUG模式，所以需要先降级到5.3.5版本（和升级的方法相同）。

然后，按照越狱包README的要求拷贝相应文件，再次更新Kindle后就越狱成功了。

 

越狱后可以发现多了一本书jailbreak-log，可以打开看看越狱过程。

然后，就可以下载5.3.9的固件，重新升级到5.3.9.不过，升级后要记得安装Rescue Pack和Kindlet Developer Certificates。这些都可以在上面的网址中找到。

越狱完成后，就可以在Kindle上运行许多小程序了，比如扫雷、中国象棋、Midori网页浏览器等等。不过，首先要做的是安装usbnet和KUAL，http://www.mobileread.com/forums/showthread.php?t=203326 它提供了一个访问各种Kindlets的界面。并且，可以在KUAL中开启和关闭usbnet。由于Kindle是基于Linux的，usbnet可以把kindle的usb口转化成一个虚拟网卡，连接电脑并安装驱动后即可用SSH连接kindle。此外，usbnet也支持在Wifi网络上运行SSH和SFTP服务，因此打开SSH over WIFI后可以不用数据线拷书籍了，唯一遗憾就是SFTP的中文支持不是很好，会乱码。

关于kindlet，koreader，扫雷，记事本，收藏夹管理器的安装，以及更改屏保等操作都可以在下面的网页中找到，我也就不再重复了。
http://www.douban.com/group/topic/42835056/
http://www.mobileread.com/forums/showthread.php?t=205064

最后推荐一个Kindlet,BackDoorLock,它可以禁用Kindle的后台自动更新功能。

DD-WRT之定时调节无线功率

为了获得较好的传输速度，我通常会把无线路由器的传输功率设置为最大（17dbm）。但是，到了夜深人静的时候，就没有必要继续维持最高功率了。如果路由器可以根据时间自动设置无线发射功率那该多好啊！

实际上，DD-WRT带有定时开关无线的功能，不过只适用于基于Boardcom芯片的路由器。本人的WR740N是Atheros方案的，因此，只能另辟蹊径。

通过搜索引擎，我找到了这篇文章：Precise Radio Scheduling with DD WRT。

不过，Atheros版本的DD没有wl组件，所以只能使用iwconfig代替了。于是，本人在startup script中加入：

echo '50 06 * * * root /usr/sbin/iwconfig ath0 txpower 17' > /tmp/cron.d/savepower
echo '20 23 * * * root /usr/sbin/iwconfig ath0 txpower 4' >> /tmp/cron.d/savepower

重启之后，就可以实现在23：20调低传输功率，在6：50恢复最高设置。

有一点需要补充，要在service下面勾选crond，并且设置启用NTP client才可以cron才可以生效。

TL-WR740N刷DD-WRT

DD-WRT是一个基于Linux的开源无线路由器固件，可以安装在大部分采用Atheros、Boardcom或者Ralink方案的无线路由器上，进而增加路由器的功能。

近日，从朋友那里淘来一个闲置的WR740N路由器，硬件版本V3。拆开看了一下，无线模块是atheros的AR9285，主控芯片上覆盖着散热片，做工明显好于本人用了两年的D-LINK-DIR-615(version F3，Realtek方案)。于是搜了一下，发现果然可以刷DD-WRT。

事不宜迟，本人迅速下载了对应的固件（在dd的官网上的router database中找WR740N，下载factory-to-dd那个）。WR740N刷机相当容易，先重置为出厂设置（这个是必须的），然后断开所有网线，只留一根连接电脑。接着手动设置电脑的IP地址（貌似说刷DD后DHCP服务不会默认开启）。接下来就是最关键的一步了，进入路由器的管理界面（最好用firefox），在软件升级页面中上传下载的文件，等个几分钟就完成了。

需要注意的是刷机后LED指示灯不能正常工作，不过其他功能正常。

在地址栏输入192.168.1.1，进入dd-wrt的管理界面，第一次登录会要求修改用户名和密码。然后浏览器就会跳转到DD的info页，可以看出，V3版本的WR740N有32M内存，还算比较大的了。最后，只要调整好各个设置（一定要点save），apply changes就搞定了。

关于如何使用DD-WRT的各项功能，本人将在后面的文章中介绍。

Gnome3之Shell Extension

在同学推荐下，本人下载安装了openSUSE 12.1版（本人一直使用Linux Mint，不过不太适应Linux Mint 12，因此一直停留在11版）。由于不太喜欢KDE的风格，俺选择了Gnome 3.2。

用了几天发现Gnome 3提供了一个叫Gnome shell extension的东西，就研究了一下。下面推荐几个认为不错的扩展。

貌似用Chrome打开下面的链接是不能安装扩展的，只有开启GNOME Shell Integration扩展的Firefox可以。

Remove Accessibility
点此安装

Media player indicator
点此安装

Touchpad Indicator
点此安装

Net Monitor
点此安装

Input-Method Status Indicator
比ibus自带的那个好多了
点此安装

Dock
提供一个额外的dock
点此安装