Centroid.EU Blog

4000 Watthours for the year?

As you know I have a solar panel on one side of my living room windows. I'm currently at 3500 Watthours consumption or so and I'm guessing I'll have enough capacity to get past 4000 Watthours by October for the year. The load on the battery/panel is a 3 Watt Freifunk router. So what is 4KWh's? About 1 EUR worth of electricity from the grid. The most joyous moment was getting ~30 days continuous operation centered around the summer solstice. With better timing on the battery I could perhpas get 45-60 days next year. Will have to see. The investment of the solar panel at this rate will pay itself off in 500 years considering I don't move it to a more sunny spot.

Update: below are the users and load of the router where a 30 day sprint with about 2500 watthours were consumed. In three days I'm turning that router off, until the battery is recharged fully.

Delphinusdnsd now has zinclude's

zinclude is like an include, but it restricts further include's downtree. It also restricts everything but zone { } declarations hence the z before include. This I felt was valuable. This bumps the config file version to 8.

In other matters in and around delphinusdnsd I'll likely release 1.3 version next week. I'll have 1 more round of checking it on other platforms than OpenBSD and then roll the release. Cheers!

Yesterday I bought a used computer

I bought a used Apple G5 Power Mac for 185 EUR inlcuding shipping. It's coming from Germany north of here. AFAIK. It'll be here in the next few days. It has dual CPU, 4 GB RAM and should hopefully run OpenBSD/macppc. I'd be interested in making it work in 64 bit mode, but we'll see. I bought this off ebay as a guest and paid with paypal.

In a bilingual poetic mood

A Computer is a machine                 | Ein Computer ist eine Maschine
it does not hate, it does not love      | Es tut nicht hassen, Es tut nicht Lieben
it does not strike you lucky            | Es tut kein Glueck bringen
all it does is wait for input           | Alles was es tut is es wartet auf Eingaben
and then it processes the output        | und dann erarbeitet es die Ausgabe
A Computer is not a gambling machine    | Ein Computer ist keine Zock Maschine
You don't play games on it for feelgoods| Du spielst keine Spiele damit es dir gut tut
It will suck you in and spit you out    | Es wird dich einsaugen und ausspucken
if you don't treat it for what it is    | wenn du Es nicht behandelst fuer was Es ist
It is a machine, waiting for programs   | Es ist eine Maschine, wartend auf Programme
A Computer wants to be programmed       | Ein Computer moechte Programmiert werden
a billion "hello worlds" it is bored of | Eine Milliarde "Hallo Welt" findet es langweilig
It wants you to pick up a book and read | Es will das Du ein Buch Liest
on how to program it with care          | ueber wie es Programmiert wird mit Sorgfalt
And then the source code you'll share   | Und dann den Quellcode wirst du teilen

Donated 15 EUR to F3 Netze

This brings this years total for F3Netze to 80 EUR. Since I'm entering unemployment in a few days this will likely be the last donation of the year.

scp for skey login

With help from Todd Miller and Darren Tucker who have been very kind in providing these examples I am finally able to use scp to a skey OTP system. Here is the syntax:

beta$ scp scp://pjp:skey@localhost/tmp/blah .  
otp-md5 94 beta40350
S/Key Password:

beta$ scp -o user=pjp:skey localhost:/tmp/blah .
otp-md5 94 beta40350
S/Key Password:

We know! or More Boogyman stories from the NSA

In this telepolis article (german) the message is reiterated. Yes the NSA is still listening. Great! Didn't we already have confirmation of this in 2013, with the Snowden revelations? I'm not sure that US President Trump is doing anything regarding this, at least I haven't heard of this. What do you do when you are under control such as the NSA? Ignore it. That's all I can conclude right now. Do what you're doing and know that if you do anything illegal over a wire, every bit is registered somewhere. I don't do anything illegal because I know this. I'm against surveillance, but I also have my hands tied behind my back. I can't help the situation any. Have a nice day. Oh btw today is my last day of sick leave.

My new SMTPD config

One aspect of Open Source is that it's a moving target. Things change and so do configs. SMTPD has in the past done a few 180 degree turns in the config (ie. adding filtering and then removing it, now changing the config). I did a test config on my extra workstation theta which has a snapshot from Jun 17th. Before I show my new config though I want to show you the old config (with some domains removed for privacy). So here is the old config from OpenBSD 6.3:

pki mail certificate "/etc/certs/mail.solarscale.de.crt"
pki mail key "/etc/certs/mail.solarscale.de.key"
### listen on 3 addresses
## 1
listen on 108.61.211.139 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
## 2
listen on 127.0.0.1 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
## 3
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
# and on the despammed port
listen on 127.0.0.1 port 10025 tag DESPAMMED hostname "mail.solarscale.de"

table aliases db:/etc/mail/aliases.db
table users file:/etc/mail/smtpusers

max-message-size 90000000

accept tagged DESPAMMED for domain "centroid.eu" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "solarscale.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "io.solarscale.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "virgostar.net" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "schweinfurtdating.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "dtschland.eu" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "goldflipper.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "freifunk-schweinfurt.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "delphinusdns.org" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "enhancedrisc.de" virtual <users> deliver to mbox

accept for local alias <aliases> deliver to mbox

# domains in order
accept from any for domain "centroid.eu" relay via smtp://127.0.0.1:10024
accept from any for domain "solarscale.de" relay via smtp://127.0.0.1:10024
accept from any for domain "io.solarscale.de" relay via smtp://127.0.0.1:10024
accept from any for domain "virgostar.net" relay via smtp://127.0.0.1:10024
accept from any for domain "schweinfurtdating.de" relay via smtp://127.0.0.1:10024
accept from any for domain "dtschland.eu" relay via smtp://127.0.0.1:10024
accept from any for domain "goldflipper.de" relay via smtp://127.0.0.1:10024
accept from any for domain "freifunk-schweinfurt.de" relay via smtp://127.0.0.1:10024
accept from any for domain "delphinusdns.org" relay via smtp://127.0.0.1:10024
accept from any for domain "enhancedrisc.de" relay via smtp://127.0.0.1:10024

accept for any relay

pki mail cert "/etc/certs/mail.solarscale.de.crt"
pki mail key "/etc/certs/mail.solarscale.de.key"
### listen on 3 addresses
## 1
listen on 108.61.211.139 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
## 2
listen on 127.0.0.1 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
## 3
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
# and on the despammed port
listen on 127.0.0.1 port 10025 tag DESPAMMED hostname "mail.solarscale.de"

table aliases file:/etc/mail/aliases
table users file:/etc/mail/smtpusers
table domains { "centroid.eu", "solarscale.de", "virgostar.net", \
	"schweinfurtdating.de", "dtschland.eu", "goldflipper.de", \
	"freifunk-schweinfurt.de", "delphinusdns.org", "enhancedrisc.de" }

smtp max-message-size 90000000

action "mbox" mbox virtual <users>
action "spampd" relay host smtp://127.0.0.1:10024
action "local" mbox alias <aliases>
action "relay" relay

match for domain <domains> tag DESPAMMED action "mbox"
match for domain <domains> action "spampd"
match for local action "local"
match for any action "relay"
# end

PS: relaying to another host with self-signed certificate may mean I have to no-verify something. Let me know if you know better.

My DNS Infrastructure in 2018

I don't get DNS from my ISP, I self host. This is what my map looks like:

        My DNS Infrastructure in 2018


                                     +----[phi vps]
        Internal RFC1918 network     |  recursive DNS server at port 8053
            |                        |
        [ uranus ] ----- Internet ---|
        recursive DNS server|        |
                            |        |
                            |        +----[omega vps]   
                            |           recursive DNS server at port 8053
                            |           authoritative DNS server at port 53
                        [psi vps]
                        authoritative DNS server at port 53

# uranus
server 108.61.211.139 {
        keys { "secret-key"; };
}; 

server 78.47.14.22 {
        keys { "secret-key"; };
};

server 2a01:4f8:d13:1980::22 {
        keys { "secret-key"; };
};

server 2001:19f0:6c00:9041:5400:ff:fe11:3332 {
        keys { "secret-key"; };
};
options {
        version "";     // remove this to allow version queries

        listen-on    { 127.0.0.1; 192.168.42.20; 192.168.180.1; 192.168.181.1; 1
92.168.183.1; 192.168.184.1; };

        listen-on-v6 { ::1;};

        empty-zones-enable yes;

        allow-recursion { clients; };

        querylog yes;

        dnssec-enable yes;
        dnssec-validation auto;

	forward only;

        forwarders {    108.61.211.139 port 8053;
                        78.47.14.22 port 8053; 
        };
        
        dns64 64:ff9b::/96 {
                clients { 2001:db8::/56; 192.168/16; };
                mapped { !10/8; !192.168/16; !172.16/12; any; };
                exclude { 64:ff9b::/96; };
                recursive-only yes;
        };
};

options {
        version "";     // remove this to allow version queries

        listen-on port 8053    { 78.47.14.22; 127.0.0.1; };
        listen-on-v6 port 8053 { 2a01:4f8:d13:1980::22; ::1; };

        allow-recursion { clients; key "secret-key"; };


        disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
        disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
        disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

        dnssec-enable yes;
        dnssec-validation auto; 

        querylog yes;
};

I'm completely confused on EU's Internet policies

Completely confused. I read a lot of law-based online publications such as heise.de and once again I think they are telling us stories of the boogyman. Upload filter? What on earth does that mean? Let's see if anything of this affects me? If not there wasn't much loss.