Quassel and Let’s Encrypt

I love Let’s Encrypt. It is just the right way to secure our http communications.

And I love IRC, and chatting with people using it. Because is a well known and long lived protocol and because it is there a lot of tech geeks and nerds gather 🙂

Team Chat(from https://xkcd.com/1782/)

I also love Quassel (https://quassel-irc.org/), not because it is written in Java (I do not understand it), but because of its paradigm (a core that acts as a client to the IRC servers and to which many clients can connect). And because it is a good solution to use IRC on the smartphone (at least on Android), because connections to IRC servers are unstable via mobile connections.

What I disliked is the fact that I have to authenticate the client to the core at first connection. This is because Quassel core creates a self-signed certificate at installation. This is one of the problems of not having a widespread and accessible system to secure our communications via TLS…but we have it!

Let’s obtain a Let’s Encrypt certificate:

$ certbot certonly --standalone -d my.domain.tld

Following the procedure, we will obtain the certificate, the fullchain and the private key in a specific folder

$  ls /etc/letsencrypt/live/my.domain.tld 
cert.pem chain.pem fullchain.pem privkey.pem README

Now, let’s check where Quassel reads the configuration. On debian-based installations, Quassel creates a user quasselcore with a specific home directory

$ cat /etc/passwd|grep quassel
quasselcore:x:109:114::/var/lib/quassel:/bin/false

There it is

$ ls /var/lib/quassel 
quasselCert.pem quasselcore.conf quassel-storage.sqlite

Let’s backup the self-signed certificate

$ mv  /var/lib/quassel/quasselCert.pem /var/lib/quassel/quasselCert.pem.old

And now let’s use the Let’s Encrypt one

$ cat /etc/letsencrypt/live/my.domain.tdl/{fullchain,privkey}.pem >> /var/lib/quassel/quasselCert.pem
$ systemctl restart quasselcore

And now we can connect to my.domain.tdl with a Let’s Encrypt signed certificate!

If you want also to automate this procedure on certificate renewal, you can create a systemd unit like this

$ cat /lib/systemd/system/quasselcert.path
[Unit]
Description=Triggers the recreation of quassel certificate at certificate renewal 

[Path]
PathChanged=/etc/letsencrypt/live/my.domain.tld/privkey.pem

[Install]
WantedBy=multi-user.target
WantedBy=system-update.target
$ cat /lib/systemd/system/quasselcert.service
[Unit]
Description=Recreation of quassel certificate at certificate renewal

[Service]
Type=oneshot
ExecStartPre=/bin/rm -f /var/lib/quassel/quasselCert.pem
ExecStart=/bin/bash -c 'cat /etc/letsencrypt/live/my.domain.tld/{fullchain,privkey}.pem > /var/lib/quassel/quasselCert.pem'

This should opefully work (not tested!).

Drupal 8 and external smtp relay

I have been recently involved in developing a web portal on drupal. One of the requirements of the project was to run on docker.

Letting aside the royal pain that understanding docker is being to me, I had (and I still have) to face strict limitations on the “customizability” of the environment.

I took drupal directly from the docker image repository, and I have to admit that for a basic and straightforward configuration it is quite simple and plain. But what about more specific needs, like, for example, sending emails? The truth is that it is not so crazy, but it requires a bit of understanding of how docker works. Such understanding I evidently still lack.

Anyway, the basic idea behind it is that, if someone yet “conteinerized” it (please, forgive me for this lingustic murder), you can use it and skip all the mess it would be doing it by yourself. Nice and, in some sense, assigning different tasks to different containers is somehow a modern view of the UNIX way.

Future is scary.

Confine virtual machines

I am not an expert and I came out with a working hack for my need of isolating some VM in my virtual farm from the rest of other VMs.

I use Xen+libvirt. The ingredients for this receipt are:

  • a working vm
  • a persistent named tun interface that connects somewhere via VPN
  • policy routing

Let us call the existing VM goofy. It has a virtual NIC attached to a virtual bridge created with libvirt. This virtual bridge is in NAT mode.

<network connections='1'>
  <name>unsafe-nat</name>
  <uuid>fa91e8bf-6666-5555-4444-222211110000</uuid>
  <forward dev='tun-ovpn' mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
    <interface dev='tun-ovpn'/>
  </forward>
  <bridge name='virbr3' stp='on' delay='0'/>
  <mac address='52:54:00:9a:ca:ca'/>
  <domain name='unsafe-nat'/>
  <ip address='192.168.126.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.126.128' end='192.168.126.254'/>
    </dhcp>
  </ip>
</network>

As you can see, it is a bridge that includes all the virtual NICs of the VMs and an interface on my host, tun-ovpn, that I previously created with openvpn.

Now you can finish all this mess creating a new routing table, that I choose to be number 666

root@host $ ip route add to default via <vpn_gateway> dev tun_ovpn table 666
root@host $ ip route add to 192.168.126.0/24 dev virbr3 table 666

and creating a new rule to match the traffic from the subnet of the unsafe VMs

root@host $ ip rule add from 192.168.126.0/24 lookup 666

To end all of this, if you want to give access to this VM from the outside, but you don’t want to set up complicated NATing and routing rules, you can create a Tor hidden service inside goofy and bind it to ssh (adding these lines in /etc/tor/torrc)

HiddenServiceDir /var/lib/tor/ssh/
HiddenServicePort 22 127.0.0.1:22

The remaining is to secure your host from the VMs in 192.168.126.0/24 from being malicious.

Take back your life

I’m very proud and happy to say that, finally, I managed to configure and put online my mail server! I relied on Postfix as MTA and Dovecot as MDA. Authentication is done on an openldap instance.

I followed this great guide. Though sometimes a bit too easy on some passage, yet very straightforward.

I don’t like to leak information about me, therefore I managed to remove unnecessary mail headers from outgoing mail via Postfix, following this post.

Then I secured (or at least I tried) the communications using TSL. I rely on LetsEncrypt, following this other guide.

The next step is to configure a working XMPP server 🙂

 

String theory and (braided) real life

I spent some time in the academia. I was involved in some theoretical physics stuff that had to do with quantum gravity. It was a lot of fun, but given the lack of job positions together with my laziness, I choose to quit and to find a much more stable work in the IT.

I have to admit that my idea of the academia was too generous: considering that it is still a prolongation of human society it was easily foreseeable that it could suffer from the same problems that any other socially closed human group could suffer.

But I have to acknowledge that the extreme specialization led to a form of madness very specific to this field of human experience: overcomplexification (ok, it is not even an English word, but this is just a curl of wind with respect to the violent hurricane that every day storms this and many other languages on the web).

What do I mean? As the word suggests, it is the trend in the scientific community to produce over-formalized baroque papers with a supposed principle of elegance. In my miserable opinion, it is functional just to cover up the lack of physical understanding and of new concepts. It is perceived by the rookie physicist as a way to impress the community (again with this alleged elegance) and by the tenured professor or researcher as a road to immortality.

I write this words with a deep understanding at least of the “rookie physicists” psychology, as far as I was affected by this syndrome in my early attempts. I was lucky to be driven out from this madness by the environment and by the research group I was in.

A great manifestation of such a madness,  and also of the much more earthly need for funds, is String Theory. I try to speak with all the needed respect for such a great effort in finding nothing¹. It is all about building something very complicated, all on paper or on a computer. Then to make it the most elegant and beautiful as possible. Then to say around that it is a (possible²) description of the way Universe works.

Well, I have been just a rookie, and I have no interest in become a super star physicist, therefore i don’t give a fuck in demonstrate how righteous I am. I just want to contribute to this mess with an unsolicited advice. Recently I had to make my house’s electrical system, and I found it a very useful exercise. It was very tricky to me to understand from the bottom how to minimize the number of cables in the pipes and still it is something that has to come to an end. The possible outcome is quite narrow: either it works or not.

Dear theoretical physicist, if you are going to prepare something very complex and full of baroque notation, just stop for a moment and ask yourself: will it help me understand better my house’s electrical system? And also, will it work?

 

¹ “Not Even Wrong” is a way of characterizing a logical model that is not falsifiable. In particular it is not only practically falsifiable, because of the lack of a sufficient high energy particle source to probe directly the quantum gravity realm. It is a fairy tale told by advocates of this theories. It is also theoretically impossible to distinguish between many (infinite) string theory models.

² Recently the approach of the communities (because, like religions, also science is split in many factions) is to be more conciliatory between each other and to admit that there is the remote possibility not to be on the right side of the quarrel.

Small tricks for large disks

Create a vmpool on an existing lvm logical volume

I have the very bad habit to create a volume group over which build the pool of
my main disk. Then I suddenly need a lvm pool for my virtual machines with libvirt.
I use this trick: I create a logical volume in the volume group, I place
another volume group inside the aforementioned logic volume and then I create
over it the lvm pool. In commands

% lsblk
sdb                         8:16   0   5.5T  0 disk  
└─sdb1                      8:17   0   5.5T  0 part  
  └─lvm                   254:1    0   5.5T  0 crypt 
    ├─vg-vms              254:2    0   600G  0 lvm   
    ├─vg-data             254:3    0   1.7T  0 lvm   
    ├─vg-Winzozz          254:4    0    30G  0 lvm   
    └─vg-shared           254:5    0     8G  0 lvm
% sudo lvcreate -l 100%FREE vg -n vmpool-me

% sudo vgcreate vmpool /dev/mapper/vg-vmpool--me

% lsblk
sdb                         8:16   0   5.5T  0 disk  
└─sdb1                      8:17   0   5.5T  0 part  
  └─lvm                   254:1    0   5.5T  0 crypt 
    ├─vg-vms              254:2    0   600G  0 lvm   
    ├─vg-data             254:3    0   1.7T  0 lvm   
    ├─vg-Winzozz          254:4    0    30G  0 lvm   
    ├─vg-shared           254:5    0     8G  0 lvm   
    └─vg-vmpool--me       254:6    0   3.1T  0 lvm

% sudo virsh

virsh # pool-define-as vmpool logical - - /dev/Terone/vmpool-me vmpool /dev/vmpool
Pool vmpool defined

virsh # pool-build vmpool
Pool vmpool built

virsh # pool-start vmpool
Pool vmpool started

Obviously, everything is inside a luks encrypted partition 😉

I do(n’t) belive so

I have been involved for a while in some academic stuff. I had lots of fun but then it ended and I had to find a true job.

Now I play the Game, pretending to be a bad guy. But I am still trying to realize if I’m moving or if I am still.

Some day I will talk (mainly to my own pleasure) about all this mess.

 

Meanwhile enjoy the maze run.