- Arch-general - lists.archlinux.org

Re: [arch-general] Can anyone share experience with "preloader" on Arch (UEFI secure boot)?
by Maarten de Vries 26 Sep '20

26 Sep '20

On Thu, 24 Sep 2020 at 14:18, Manuel Reimer <mail+archgeneral(a)m-reimer.de> wrote: > Hello, > > I want to occasionally run Linux on a system which was set up with > Windows 10 with Bitlocker enabled. > > Disabling secure boot for Linux and reenabling it when booting into > Windows starts to get annoying. > > So my idea was to just use "preloader" and add it to the chain of EFI > binaries to execute. But as Arch gets kernel updates pretty often I am a > bit worried about getting my MokList corrupted at some time as described > here: > > > http://blog.rootserverexperiment.de/2013/06/02/moklist-gesemmelt-boot-unmog… > > Has anyone ever noticed this problem? How are the hashes stored? If I > update the kernel, will preloader *replace* the hash in MokList or add a > new one? How is this MokList stored? Is this flash memory with limited > write cycles? > Depending on how much you actually value the security of secure boot, you could just add your own DB key (so not a MOK) and sign grub with that key directly rather than using shim. Grub will then happily load any unsigned linux kernel. This is a bug in the shim_lock grub module, but even when it is fixed, you can get grub to ignore secure boot as long as you don't use the shim_lock module. If you actually want to prevent unsigned code from running, you should use shim with a MOK. You only need a single key that you can use to sign your bootloader and kernel images. By using a key for signing, you don't have to add any hashes to the MOK database. So there also shouldn't be much risk of corrupting your MOK database. -- Maarten >

1 0

[arch-general] Abuse of arch wiki?
by LuKaRo 25 Sep '20

25 Sep '20

Hi, I was searching for information on firejail, when the fourth hit on my search engine was: https://www.linuxsecrets.com/archlinux-wiki/wiki.archlinux.org/index.php/Fi…. This looks like an exact copy of our archlinux wiki (including the header bar) but hosted on Google's servers with no administrative contact given. They also seem to run additional obfuscated JavaScript on "their" copy of arch wiki. Their main page's "about us" page gives just a 404 error, and there is no further imprint given. However, on their main page it says "Copyright Linuxsecrets.com. All Rights Reserved". It looks like they at least tried to copy ArchLinux Forums, Ubuntu Forums and Linux Mint Forums as well. I know that GNU FDL allows redistribution of content, but I do think that copying the entire wiki with no attribution or information at all violates at least ethical principles. They also copy the wiki login page, which is also interesting from a security point of view. An unknowing user is misleaded by this content, and considering that this site was the fourth hit on a common search term in my search engine I'm worried by the impact. At least I wanted to make you aware of that our arch wiki contents are copied without any notice. Regards, LuKaRo

3 3

[arch-general] Can anyone share experience with "preloader" on Arch (UEFI secure boot)?
by Manuel Reimer 24 Sep '20

24 Sep '20

Hello, I want to occasionally run Linux on a system which was set up with Windows 10 with Bitlocker enabled. Disabling secure boot for Linux and reenabling it when booting into Windows starts to get annoying. So my idea was to just use "preloader" and add it to the chain of EFI binaries to execute. But as Arch gets kernel updates pretty often I am a bit worried about getting my MokList corrupted at some time as described here: http://blog.rootserverexperiment.de/2013/06/02/moklist-gesemmelt-boot-unmog… Has anyone ever noticed this problem? How are the hashes stored? If I update the kernel, will preloader *replace* the hash in MokList or add a new one? How is this MokList stored? Is this flash memory with limited write cycles? Thanks Manuel

1 0

[arch-general] cockpit-docker no longer in [community]
by karx 22 Sep '20

22 Sep '20

Hey all, Today I noticed that the Docker section was gone from my cockpit[1] dashboard on my server. I then tried uninstalling and reinstalling cockpit-docker, and realized I cannot install it anymore. Some google searching tells me that the cockpit-docker package has been removed from [community], and it is not in the AUR. Is there a reason it was removed? I am okay with installing an old version and putting it in IgnorePkg. Thanks, Yash [1]: https://cockpit-project.org/

2 1

[arch-general] Tbird 78.2 enable Master Password of GPG keys stored in profile unencrypted
by David C. Rankin 17 Sep '20

17 Sep '20

All, Just a heads up. SuSE has been doing work with Thunderbird 78.2 trying to prepare for a move to it with the openPGP replacement for Enigmail. One issue that has come from that is the realization that unless you enable a Master Password for thunderbird passwords, once you import your GPG keys, they will be stored unencrypted in your thunderbird profile. If you have never set a mater password for thunderbird before (I haven't), it looks like that will be required with 78.2 hits. -- David C. Rankin, J.D.,P.E.

3 3

[arch-general] [off-topic] Alternative to Thunderbird, with GPG support, caldav + cardav support, and ics remote webcal support and syncing
by Javier 16 Sep '20

16 Sep '20

Hi ! I'm looking for a mail client integrated with a calendar system and a contacts system, that works on both GNU+Linux and Windows, hopefully not Thunderbird, Kontact (Kmail + Korganizer + Kaddressbook), neither Evolution. I'm looking for a client which supports and uses GPG and its keyring and agent, for signing and recognizing signatures, encrypting and decrypting, and that supports autocrypt (autocrypt is pretty important to me). I'm also looking for integration with calendar, being able to receive invitations and events via email, and adding them to the calendar if wanted. The calendar must be able to add and keep in sync caldav remote calendars as well as ics remote web calendars (syncing them periodically, being able to set the period up, and the ics included calendars can be read only, but not the caldav ones). I'm also looking for integration with contacts, and the contact must be able to add and keep in sync cardav remote contancts. Until Thunderbird v68, it was the option through the enigmail, lightning and the cardbook extensions, but I really don't want to keep using Thunderbird v78 and beyond any more. I don't like several design decisions made by the Thunderbird team, regarding how they'll handle PGP, like not using the GPG keyring, not using the GPG agent, not integrating with GPG in general, and neither supporting autocrypt initially (which should be a must to release, or so I think, even K9 for android supports it). I understand Kontact is close, it even works on Windows, but besides the fact I don't like the bunch of dependencies brought to the system by it, neither its Akonadi sort of DB, I never got it syncing ics remote web calendars and I really don't know if one can't set autocrypt for it. I really never liked Evolution either, so that really is less of an option for me, but besides it doesn't work on windows that I know of. I'd prefer Qt applications, but that's just a preference, not a requirement. I was investigating about Trojitá, to see if it would integrate with other applications it doesn't provide, but I found it can decrypt, but not encrypt, and it doesn't support carddav contacts, and even less keeping them in sync, so it was not worth investigating about calendars being able to extend the Trojitá functionality... Kube looked promising, but it's only for GNU+Linux and Mac (perhaps, though not officially supported BSDs). Are there any options for such client, or set of clients working together? Thanks ! -- Javier

3 7

[arch-general] pam_faillock -- can we just remove it from /etc/pam.d/login?
by David C. Rankin 12 Sep '20

12 Sep '20

Following the [arch-dev-public] Pam lockout thread, Can we just remove the faillock entries from /etc/pam.d/login without breaking anything if we don't need it at all (like for home computers, etc..) The any 3 attempts in 15 minutes which is the default under faillock.conf: # The default is 900 (15 minutes). # fail_interval = 900 means that if I mistype a password on login, then 10 minutes later mess up with sudo, and then 14 minutes later have another slip with sudo, I'm locked out by faillock. That seems like overkill for home users. It should be limited to 3 failed logins at a single prompt, not any 3 in 15 minutes. # admin_group = <admin_group_name> is another option -- but at this point, I'd rather just remove it from the pam stack. Is that doable? -- David C. Rankin, J.D.,P.E.

3 3

[arch-general] [off-topic] Korganizer: get ics webcals periodically sync (can be read only)
by Javier 11 Sep '20

11 Sep '20

Hi ! Sorry for being a bit off-topic, however there might be Kontact Arch users that can help me out answering a question about Korganizer, from the Kontact suite. See when I tried using Korganizer, I could add caldav calendars, and I also could add ics online web calendars, however it seems the only way to add such calendar is treating them as static calendars, meaning they get added, but can't be periodically sync, which is what I'm looking for, since I access as read only my office calendar from office365, which requires pretty frequent syncs, and I also access astronomy events calendars and holidays calendars, which all evolve over time. Examples (excluding the office one): https://cantonbecker.com/astronomy-calendar-files/astrocal.ics https://www.officeholidays.com/ics/ics_country_code.php?iso=US https://www.officeholidays.com/ics/ics_country_code.php?iso=CR When adding those ics calendar as ical files (the only way I found to add them), I got sad warnings: > Select the file whose contents should be represented by this resource. If the file does not exist, it will be created. A URL of a remote file can also be specified, but note that monitoring for file changes will not work in this case. I'm assuming no monitoring means no syncing at all, :( Isn't there a way to add such calendars, but keeping them doing periodic syncs, hopefully with individual periods each (more frequent for the office one, and less frequent for the other ones). Thanks ! -- Javier

2 2

[arch-general] conflict on /usr/bin generated by tigervnc?
by Javier 10 Sep '20

10 Sep '20

Hi ! On Today's upgrade: % pacman -Syu :: Synchronizing package databases... ... Packages (9) ... tigervnc-1.11.0-1 ... ... tigervnc-1.11.0-1-x86_64 131.3 MiB 3.51 MiB/s 00:37 [########################################################] 100% (9/9) checking keys in keyring [########################################################] 100% (9/9) checking package integrity [########################################################] 100% (9/9) loading package files [########################################################] 100% (9/9) checking for file conflicts [########################################################] 100% error: failed to commit transaction (conflicting files) tigervnc: /usr/sbin exists in filesystem (owned by filesystem) Errors occurred, no packages were upgraded. Usually that get fixed by using "--overwrite /usr/sbin". But I find it wrong for tigervnc to own "/usr/sbin", so I think in this case tigervnc is not right. Would this be the case, or it's OK for tigervnc to be the owner and then to overwrite? Thanks ! -- Javier

8 10

[arch-general] What companion SW to use with Trojitá to get integration and syncing of calendar (caldav) and contacts (carddav)
by Javier 08 Sep '20

08 Sep '20

I've been thinking on trying Trojitá as e-mail client, specially because it's GNUPG integration and support. However I understand it doesn't integrate neither synchronize with a calendar, neither it recognizes calendar invitations to integrate with a calendar, and I believe it doesn't support neither synchronize with remote contacts. I do depend on syncing with a remote caldav calendar, as well as with remote ics calendars for events like holidays, or astronomy calendars. And I also depend on syncing with a remote cardav contacts addressbook. I'm wondering if there is SW that can interact with Trojitá to get the needed functionality. Has anyone gotten such functionality using Trojitá? Which sw/applications? How? Thanks ! -- Javier

2 2