hg serve multiple projects

1. Create a file under the parent directory of the multiple project hg directories
Example:
#> cat webconf
[collections]
repos/ = .

[web]
allow_push = *
push_ssl = false

2.  hg serve --web-conf ./webconf -d

debian add key

sudo gpg --keyserver subkeys.pgp.net --recv-keys 55BE302B
sudo gpg -a --export 55BE302B | sudo apt-key add -

vim man page skip command line

In vim, when you want to get the man page of the word under the cursor, you can just type shift-k or "K". However, for some functions, there is a "command line" tool with the same time, so you will get the man page for that command line instead of the function you are looking for.

For example, if you hit "K" on "unlink", you will get the bash unlink man page instead of the system call unlink(). To solve this problem, put the following line in your .bashrc:

    export MANSECT=3,2,1,4,5,6,7,8,9

This tells man to search section 3 first, then section 2, then section 1, etc., thus solved the problem of section 1 coming up before section 2 or 3.

While on this topic, you can also add the following line to your .bashrc file to make your man page have colors. Make sure you installed the program "most" on your computer.


    export MANPAGER="/usr/bin/most -s"

Or you can use the default "less" program and add the following lines to .bashrc to make "less" colorful:

man() {
 env \
  LESS_TERMCAP_mb=$(printf "\e[1;31m") \
  LESS_TERMCAP_md=$(printf "\e[1;31m") \
  LESS_TERMCAP_me=$(printf "\e[0m") \
  LESS_TERMCAP_se=$(printf "\e[0m") \
  LESS_TERMCAP_so=$(printf "\e[1;44;33m") \
  LESS_TERMCAP_ue=$(printf "\e[0m") \
  LESS_TERMCAP_us=$(printf "\e[1;32m") \
   man "$@"
}

Flags to enable thorough and verbose g++ warnings

-pedantic -Wall -Wextra -Wcast-align -Wcast-qual -Wctor-dtor-privacy -Wdisabled-optimization -Wformat=2 -Winit-self -Wlogical-op -Wmissing-declarations -Wmissing-include-dirs -Wnoexcept -Wold-style-cast -Woverloaded-virtual -Wredundant-decls -Wshadow -Wsign-conversion -Wsign-promo -Wstrict-null-sentinel -Wstrict-overflow=5 -Wswitch-default -Wundef -Werror-Wno-unused

General warning options and C++ options (scroll down to the bottom for warnings)

A good base setup for C is:
-std=c99 -pedantic -Wall -Wextra -Wwrite-strings -Werror
and for C++
-ansi -pedantic -Wall -Wextra -Weffc++

My C++ version:

-g -O -Wall -Wextra -Weffc++ -pedantic -Wformat=2 \
 -Waggregate-return -Wcast-align \
 -Wcast-qual   -Wconversion \
 -Wdisabled-optimization  -Wfloat-equal   \
 -Winit-self  -Winline \
 -Winvalid-pch   -Wunsafe-loop-optimizations  -Wmissing-braces \
 -Wmissing-format-attribute   \
 -Wmissing-include-dirs \
 -Wpacked  -Wpadded -Wpointer-arith \
 -Wredundant-decls -Wshadow  -Wstack-protector \
 -Wswitch-default  -Wswitch-enum \
 -Wunknown-pragmas  -Wunreachable-code -Wunused \
 -Wvariadic-macros  -Wwrite-strings \
 -Wlogical-op -Wsign-conversion  \
 -Wstrict-overflow=5 -Wundef




Windows 7 change alt-tab preview deplay

Open Registry Editor and create the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AltTab.

In that key, create the following DWORD value: LivePreview_ms and set it to the delay (in milliseconds) of the first live preview.

Restart Explorer to see the changes.

Other Aero-peek related registry entries that I've found on the net are:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

    DesktopLivePreviewHoverTime
    ThumbnailLivePreviewHoverTime
    ExtendedUIHoverTime

These control the delay of other components of Aero-peek.

Give regular user right to start/stop service in Windows 7

1. Download and install SubInACL.exe
2. run "C:\Program Files\Windows Resource Kits\Tools\subinacl" /service Spooler /grant=<username>=TO

SubInACL works on Windows 7.
The T grant parameter is for start service access and the O parameter is stop service access.
Now <username> can:

• run sc stop Spooler and sc start Spooler
• run net stop "Print Spooler" and net start "Print Spooler"
• use the Restart button on the Print Spooler item in services.msc

Source: http://superuser.com/questions/419194/is-there-a-way-to-allow-standard-users-to-restart-stop-start-the-print-spooler

Update: The single subinacl.exe download seems to be not available anymore. Try download the windows 2003 resource toolkit at

Windows Server 2003 Resource Kit Tools

How to Resolve “mount error(12): Cannot allocate memory” on a Windows Share

From: http://jlcoady.net/windows/how-to-resolve-mount-error12-cannot-allocate-memory-windows-share

If you mount a Windows 7 share using Samba/CIFS you may run into “mount error(12): Cannot allocate memory” if you are using very large files on the Windows machine. Looks like in certain situations Windows needs to be told to run as a file server and to expect large files. You can read more details at Large Files are locking up Windows 7 32 bit and 64 bit, but the solution is to make two registry edits and then restart a service:

1. Set “HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\LargeSystemCache” to “1″.
2. Set “HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size” to “3″.
3. Restart the “server” service.

Once you have done that you should be able to mount the share using a command like “sudo mount -a” or just reboot the Linux machine.

__USE_GNU (use GNU specific feature)

Directly define __USE_GNU is wrong, __USE_GNU is glibc internal macro that shouldn't be ever defined by apps.

The way to select GNU feature set in glibc headers is to define _GNU_SOURCE, either before including first include header in the source .c/.C file, or by defining it on the command line (-D_GNU_SOURCE).

VirtualBox USB from the command line

Credit: http://richardhorwood.com/108/virtualbox-usb-from-the-command-line/

How to add a USB device using vboxmanage

1. Ensure you actually have USB support for your target VM:

   # VBoxManage showvminfo "somevm" | grep USB
   USB:             enabled

2. If it’s not set to “enabled” you’ll have to add USB support to your VM.  You’ll need to power off the VM to do this:
   
   

   # VBoxManage modifyvm "somevm" --usb on --usbehci on

3. To attach a device that’s plugged into the same system as your VM (in my case, a Sony USB memory stick), grab its UID as follows:

   # VBoxManage list usbhost
   Sun VirtualBox Command Line Management Interface Version 3.1.4
   (C) 2005-2010 Sun Microsystems, Inc.
   All rights reserved.
   
   Host USB Devices:
   [...]
   UUID:               2a2c7255-3b90-448e-aa7a-b1c5710ddd79
   VendorId:           0x054c (054C)
   ProductId:          0x0243 (0243)
   Revision:           1.0 (0100)
   Manufacturer:       Sony
   Product:            Storage Media
   SerialNumber:       6A08102832911
   Address:            0x54c:0x243:256:/pci@0,0/pci108e,5347@2,1
   Current State:      Busy
   

4. Create a usb filter which will tell VirtualBox to provide the USB device to your virtual machine when it’s detected as plugged in on the host:

   # VBoxManage usbfilter add 0 --target "somevm" --name usbstick \
                  --vendorid 054C --productid 0243

5. Go ahead and power on your Virtual Machine.  You’ll notice that the USB device (if it’s currently plugged in) immediately becomes unavailable on the host.  You can confirm that it’s attached and that you didn’t make a typo with the vendor and/or product IDs:

   # VBoxManage showvminfo "somevm"
   [...]
   Currently Attached USB Devices:
   
   UUID:               582313d4-1d51-41ea-a053-ba5ac552d2e5
   VendorId:           0x054c (054C)
   ProductId:          0x0243 (0243)
   Revision:           1.0 (0100)
   Manufacturer:       Sony
   Product:            Storage Media
   SerialNumber:       6A08102832911
   Address:            0x54c:0x243:256:/pci@0,0/pci108e,5347@2,1

That’s it.  You can mount and unmount this device now inside your VM.

Import certificate and key into java key store using keytool

If you have the certificate and key in pkcs12 format you can directly import it into an existing java key store:

keytool -importkeystore -srckeystore server.p12 -srcstoretype pkcs12 -destkeystore server.jks -deststoretype jks

If you have it in PEM you can convert it to pkcs12 first:
cat server_key.pem server_cert.pem server_cacert.pem > server.pem
openssl pkcs12 -export -out server.p12 -in server.pem

Windows VPN: this connection requires an active internet connection

Even though selecting Start>Connect To won't let you connect, this will:
 - Go to Control Panel > Network and Sharing center
 - Click on Manage Network Connections
 - You can see the VPN connection(s) and connect to it (right click and select "Connect")

Command line tools on Linux to beautify CSS ,Javascript, and PHP

For CSS, I use "csstidy", the C++ version. I added CSS 3.0 support to it and also added a default "indented" template. You can get the latest version at:
    https://bitbucket.org/tiebingzhang/csstidy

For Javascript, I use the command line version of jsbeautifier, which can be downloaded at
http://github.com/einars/js-beautify/zipball/master

For PHP, I use an enhanced version of phptidy:
https://bitbucket.org/tiebingzhang/phptidy

php.ini send email on Linux

If you just want to send email (not receiving email) from your PHP server, and you have a SMTP Email server, here is how you do it:

(First, you don't need to edit your php.ini file SMTP settings, because on Linux those are not used by PHP)

1. Install SSMTP on your system (Debian/Ubuntu via apt-get, RHEL/CentOS using the Fedora EPEL Package search to find the package.
2. Use "ssmtp" to replace "sendmail" on your system. ssmtp use the same command argument as sendmail.
3. configure your /etc/ssmtp/ssmtp.conf file:


root=postmaster
mailhub=SMTP SERVER IP ADDRESS
RewriteDomain=your_from_domain.com
#this allows you to specify your from address
FromLineOverride=YES

4.  Now send an email. Type

ssmtp recipient_email@example.com
sSMTP will then wait for you to type your message, which needs to be formatted like this:
To: recipient_email@example.com
From: myemailaddress@gmail.com
Subject: test email

hello world!
Note the blank like after the subject, everything after this line is the body of the email. When you’re finished, press Ctrl-D.

You can also use script. Create a file msg.txt, then send it:
ssmtp myemailaddress@gmail.com < msg.txt


msg.txt is a simple text using the proper formatting for sSMTP:
To: myemailaddress@gmail.com
From: myemailaddress@gmail.com
Subject: alert

The server is down!


Credit: http://tombuntu.com/index.php/2008/10/21/sending-email-from-your-system-with-ssmtp/

CentOS or RHEL enable PHP to make TCP Connect

setsebool -P httpd_can_network_connect 1

RHEL/Centos sysconfig network scripts

The /etc/sysconfig/network-scripts/ifcfg-ethN files

File configurations for each network device you may have or want to add on your system are located in the /etc/sysconfig/network-scripts/ directory with Red Hat Linux 6.1 or 6.2 and are named ifcfg-eth0 for the first interface and ifcfg-eth1 for the second, etc. Following is a example /etc/sysconfig/network-scripts/ifcfg-eth0 file:

DEVICE=eth0 IPADDR=208.164.186.1 NETMASK=255.255.255.0 NETWORK=208.164.186.0 BROADCAST=208.164.186.255 ONBOOT=yes BOOTPROTO=none USERCTL=no

If you want to modify your network address manually, or add a new network on a new interface, edit this file -ifcfg-ethN, or create a new one and make the appropriate changes.

• DEVICE=devicename, where devicename is the name of the physical network device.
• IPADDR=ipaddr, where ipaddr is the IP address.
• NETMASK=netmask, where netmask is the netmask IP value.
• NETWORK=network, where network is the network IP address.
• BROADCAST=broadcast, where broadcast is the broadcast IP address.
• ONBOOT=answer, where answer is yes or no. Do the interface need to be active or inactive at boot time.
• BOOTPROTO=proto, where proto is one of the following :
  
  
  1. none - No boot-time protocol should be used.
  2. bootp - The bootp now pump protocol should be used.
  3. dhcp - The dhcp protocol should be used.
• USERCTL=answer, where answer is one of the following:
  
  
  1. yes - Non-root users are allowed to control this device.
  2. no - Only the super-user root is allowed to control this device.  
     
     
     NM_CONTROLLED="no"/"yes" : Whether Network-Manager controlled
     
             

xargs argument replacement

This is how xargs works:

cat listfile | xargs ls 

but if you want to use the argument in the middle, such as "mv", you need to do the following:

cat listfile | xargs -I {} mv {} trash

-I {} tells xargs to replace all instances of {} with the argument from listfile.

So you can use other weird strings as long as you know it does not appear in the listfile, such as

cat listfile | xargs -I HAHA mv HAHA trash

Windows 7 IKEv2 with StrongSwan Certificate Generation Guide

Windows 7 supports IPSec IKEv2 with machine certificate authentication. Using StrongSwan on Linux for server, this is a good solution for Road Warrior remote access.

The problem with Windows 7 IKEv2 client is that it does not provide any log for trouble-shooting at all. So if it does not like something in your setup, it simply throws an error number and a very vague error message.  Error 13806 is one of them.

I spent a few days finally got my Windows 7 running IKEv2 machine authentication with my strongswan server. Below are a few tips for Error 13806:

1. Error 13806 is because the machine certificate or CA certificate  on the Windows 7 has problems. This is NOT about the Server's certificate. So focus on fixing the Windows 7 certificates. The error message does not really tell you this clearly.

2. There are a few variables in your client certificate that are important, whether you use OpenSSL or StrongSwan ipsec pki to generate your certs:

1. The Common Name (CN) in the subject of your certificate
2. The Subject Alternative Name (SAN) 
3. The Key Usage
4. The Extended Key Usage, where you can specify "clientAuth", "serverAuth", "1.3.6.1.5.5.8.2.2", either one or a combination of them.

Here is what works and what does not work in my tests (For Windows 7 client only, not for StrongSwan server):

• You do not need to set Key Usage and Extended Key Usage(EKU). If you set them, some combinations may cause trouble. see more below.
•  You do not need to set SAN. If you really want to set it, it has to be exactly the same as the CN. Otherwise you will get Error 13806.
•  Set CN to either a full DNS name such as "win7.mycompany.local", or just a string name "win7". Either one works.
•  If you set Key Usage to "nonRepudiation, digitalSignature, keyEncipherment", and Extended Key Usage to "1.3.6.1.5.5.8.2.2,serverAuth,clientAuth", you MUST set your CN to the long form of DNS name such as "win7.mycompany.local". Using the short form "win7" will fail and cause error 13806.

The name win7.mycompany.local does not have to be in your DNS server.

What works:

• CN="win7", no SAN, No Keyusage, No EKU.
• CN="win7", SAN="win7", No Keyusage, No EKU.
• CN="win7.mycompany.local", SAN="win7.mycompany.local", No Keyusage, No EKU.
• CN="win7.mycompany.local", SAN="win7.mycompany.local",keyUsage = nonRepudiation,   digitalSignature, keyEncipherment,  extendedKeyUsage = 1.3.6.1.5.5.8.2.2,serverAuth,clientAuth

What does not work (Error 13806):

• CN="win7", SAN="something else", No Keyusage, No EKU.
• CN="win7", SAN="win7",keyUsage = nonRepudiation,   digitalSignature, keyEncipherment,  extendedKeyUsage = 1.3.6.1.5.5.8.2.2,serverAuth,clientAuth

Your server certificate should have the following:

•   CN 
•   SAN, which should be exactly the same as your CN
•   keyUsage = nonRepudiation,   digitalSignature, keyEncipherment,  
•   extendedKeyUsage = 1.3.6.1.5.5.8.2.2,serverAuth

Your Windows 7 VPN connection host name should exactly the same as the Server's CN. And that CN name should be DNS resolvable. The easiest way to do that in a test environment is to add the CN name to your local computer's host file, located at "c:\windows\system32\drivers\etc\hosts"

Of course you should read StrongSwan's Wiki page on Windows 7. Very helpful, although can be a little bit more detailed on the client side. (http://wiki.strongswan.org/projects/strongswan/wiki/Windows7)

Andreas at StrongSwan also pointed out to me that although ECDSA has been supported by Windows since Windows Vista, it only works in IKEv1. IKEv2 in Windows 7 and Windows 2008 R2 does not support ECDSA. I have also personally verified that this is true.

One more important note:

Please make sure all your certificates has the PKIX recommended "Authority Key Identifier" in it. Otherwise, Windows 7 will give an Error 13806.


If you use OpenSSL to generate your certs, make sure the following line is in your openssl.conf file:

authorityKeyIdentifier=keyid,issuer

"Subject Key Identifier" seems to be optional for Windows 7.

Another useful post on this subject: http://forums.opensuse.org/english/get-technical-help-here/network-internet/435097-strongswan-opensuse-11-2-quick-setup.html

More Update:
Following above-written rules, I was able to generate certificates using StrongSwan ipsec pki command for both Windows 7 and StrongSwan, and the IKEv2 connection was established.

Here are the scripts:

First, Generate the CA:



bits=2048
ipsec pki --gen --type rsa --size $bits --outform pem > ca.key
ipsec pki --self --flag serverAuth --in ca.key --type rsa --digest sha1 --dn "C=CH, O=strongSwan, CN=pkiCA" --ca > caCert.der

Next, generate two certs, one for Server and one for Win7

bits=2048

for user in server win7; do

    ipsec pki --gen --type rsa --size $bits --outform pem > $user.key

    flags="";

    [ "$user" = "server" ] && flags="--flag serverAuth";

    ipsec pki --pub --in $user.key --type rsa | ipsec pki --issue --cacert caCert.der --cakey ca.key --digest sha1 \

        --dn "C=CH, O=strongSwan, CN=$user.mycompany.local" --san "$user.mycompany.local" $flags --outform pem > $user.cert

done;

Next convert Win7 cert to P12 format:

# Usage: ./convert-to-p12.sh Username

user=$1

openssl pkcs12 -export -inkey $user.key -in $user.cert -name "$user" -certfile caCert.der -caname "vpnserver7" -out $user.p12

then run ./convert-to-p12.sh win7

Next convert Server key to DER format so that Strongswan can take it:

openssl rsa -in $1.key  -out $1.der -outform DER

where $1 is "server"

[Solved] apt-get “is to be installed” errors in Debian

Fortunately, you can force the version in apt-get:

sudo apt-get install deluge-common=1.3.0-0ubuntu1

Source: http://www.absolutelytech.com/2010/10/17/solved-apt-get-is-to-be-installed-errors-in-ubuntu/

use vimdiff for hg diff

put the following to your ~/.hgrc file

[extensions]
hgext.extdiff =

[extdiff]
cmd.vimdiff =

[alias]
vi  = vimdiff
vim = vimdiff

ubuntu update issue

If your ubuntu is failing to update/install software, make sure you have the ubuntu update repository set in your apt source.list file:

###### Ubuntu Main Repos

deb http://us.archive.ubuntu.com/ubuntu/ lucid main restricted universe multiverse 

###### Ubuntu Update Repos

deb http://us.archive.ubuntu.com/ubuntu/ lucid-security main restricted universe multiverse 

deb http://us.archive.ubuntu.com/ubuntu/ lucid-updates main restricted universe multiverse