Onion Information

Page Clicks: 0

First Seen: 03/11/2024

Last Indexed: 10/21/2024

Domain Index Total: 195

A GitHub gist is backed by a regular git repository, but it's not exposed explicitly via the user interface. For example, this "secret" gist can be cloned using this command: git clone https://gist.github.com/fmarier/b652bad2e759675e8650f3d3ee81ab08.git test Within this test directory, the normal git commands can be used: touch empty git add empty git commit -a -m "Nothing to see here" A gist can contain multiple files just like normal repositories. In order to push to this repo, add the following pushurl : git remote set-url --push origin git@gist.github.com:b652bad2e759675e8650f3d3ee81ab08.git before pushing using the regular command: git push Note that the GitHub history UI will not show you the normal commit details such as commit message and signatures. If you want to access the latest version of a file contained within this gist, simply access https://gist.githubusercontent.com/fmarier/b652bad2e759675e8650f3d3ee81ab08/raw/readme.md . Using NetworkManager and systemd-resolved together in Debian bookworm does not work out of the box. The first sign of trouble was these constant messages in my logs: avahi-daemon[pid]: Host name conflict, retrying with hostname-2 Then I realized that CUPS printer discovery didn't work: my network printer could not be found. Since this discovery now relies on Multicast DNS , it would make sense that both problems are related to an incompatibility between NetworkManager and Avahi . What didn't work The first attempt I made at fixing this was to look for known bugs in Avahi. Neither of the work-arounds I found worked: the one proposed in https://github.com/avahi/avahi/issues/117#issuecomment-1651475104 : [publish] publish-aaaa-on-ipv4=no publish-a-on-ipv6=no nor the one proposed in https://github.com/avahi/avahi/issues/117#issuecomment-442201162 : [server] cache-entries-max=0 What worked The real problem turned out to be the fact that NetworkManager turns on full mDNS support in systemd-resolved which conflicts with the mDNS support in avahi-daemon . You can see this in the output of resolvectl status : Global Protocols: LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported resolv.conf mode: stub Link 2 (enp6s0) Current Scopes: DNS mDNS/IPv4 mDNS/IPv6 Protocols: +DefaultRoute -LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 192.168.1.1 DNS Servers: 192.168.1.1 DNS Domain: lan which includes +mDNS for the main network adapter. I initially thought that I could just uninstall avahi-daemon and rely on the systemd-resolved mDNS stack, but it's not actually compatible with CUPS . The solution was to tell NetworkManager to set mDNS to resolve-only mode in systemd-resolved by adding the following to /etc/NetworkManager/conf.d/mdns.conf : [connection] connection.mdns=1 leaving /etc/avahi/avahi-daemon.conf to the default Debian configuration. Verifying the configuration After rebooting, resolvectl status now shows the following: Global Protocols: LLMNR +mDNS -DNSOverTLS DNSSEC=no/unsupported resolv.conf mode: stub Link 2 (enp6s0) Current Scopes: DNS mDNS/IPv4 mDNS/IPv6 Protocols: +DefaultRoute -LLMNR mDNS=resolve -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 192.168.1.1 DNS Servers: 192.168.1.1 DNS Domain: lan Avahi finally sees my printer (called hp in the output below): $ avahi-browse -at | grep Printer + enp6s0 IPv6 hp @ myprintserver Secure Internet Printer local + enp6s0 IPv4 hp @ myprintserver Secure Internet Printer local + enp6s0 IPv6 hp @ myprintserver Internet Printer local + enp6s0 IPv4 hp @ myprintserver Internet Printer local + enp6s0 IPv6 hp @ myprintserver UNIX Printer local + enp6s0 IPv4 hp @ myprintserver UNIX Printer local and so does CUPS: $ sudo lpinfo --include-schemes dnssd -v network dnssd://myprintserver%20%40%20hp._ipp._tcp.local/cups?uuid=d46942a2-b730-11ee-b05c-a75251a34287 Firewall rules Since printer discovery in CUPS relies on mDNS, another thing to double-check is that the correct ports are open on the firewall. This is what I have in /etc/network/iptables.up.rules : # Allow mDNS for local service discovery -A INPUT -d 100.64.0.0/10 -p udp --dport 5353 -j ACCEPT -A INPUT -d 192.168.1.0/24 -p udp --dport 5353 -j ACCEPT and in etc/network/ip6tables.up.rules : # Allow mDNS for local service discovery -A INPUT -d ff02::/16 -p udp --dport 5353 -j ACCEPT I know that people rave about GMail's spam filtering, but it didn't work for me: I was seeing too many false positives. I personally prefer to see some false negatives (i.e. letting some spam through), but to reduce false positives as much as possible (and ideally have a way to tune this). Here's the local SpamAssassin setup I have put together over many years. In addition to the parts I describe here, I also turn off greylisting on my email provider ( KolabNow ) because I don't want to have to wait for up to 10 minutes for a "2FA" email to go through. This setup assumes that you download all of your emails to your local machine. I use fetchmail for this, though similar tools should work too. Three tiers of emails The main reason my setup works for me, despite my receiving hundreds of spam messages every day, is that I split incoming emails into three tiers via procmail : not spam : delivered to inbox likely spam : quarantined in a soft_spam/ folder definitely spam : silently deleted I only ever have to review the likely spam tier for false positives, which is on the order of 10-30 spam emails a day. I never even see the hundreds that are silently deleted due to a very high score. This is implemented based on a threshold in my .procmailrc : # Use spamassassin to check for spam :0fw: .spamassassin.lock | /usr/bin/spamassassin # Throw away messages with a score of > 12.0 :0 * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\* /dev/null :0: * ^X-Spam-Status: Yes $HOME/Mail/soft_spam/ # Deliver all other messages :0: ${DEFAULT} I also use the following ~/.muttrc configuration to easily report false negatives/positives and examine my likely spam folder via a shortcut in mutt : unignore X-Spam-Level unignore X-Spam-Status macro index S "c=soft_spam/\n" "Switch to soft_spam" # Tell mutt about SpamAssassin headers so that I can sort by spam score spam "X-Spam-Status: (Yes|No), (hits|score)=(-?[0-9]+\.[0-9])" "%3" folder-hook =soft_spam 'push ol' folder-hook =spam 'push ou' # d = de-register as non-spam, register as spam, move to spam folder. macro index \ed " unset wait_key\n spamassassin -r\n set wait_key\n =spam\n" "report the message as spam" # u = unregister as spam, register as non-spam, move to inbox folder. macro index \eu " unset wait_key\n spamassassin -k\n set wait_key\n =inbox\n" "correct the false positive (this is not spam)" Custom SpamAssassin rules In addition to the default ruleset that comes with SpamAssassin, I've also accrued a number of custom rules over the years. The first set comes from the (now defunct) SpamAssassin Rules Emporium . The second set is the one that backs bugs.debian.org and lists.debian.org . Note this second one includes archived copies of some of the SARE rules and so I only use some of the rules in the common/ directory. Finally, I wrote a few custom rules of my own based on specific kinds of emails I have seen slip through the cracks. I haven't written any of those in a long time and I suspect some of my rules are now obsolete. You may want to do your own testing before you copy these outright. In addition to rules to match more spam, I've also written a ruleset to remove false positives in French emails coming from many of the above custom rules. I also wrote a rule to get a bonus to any email that comes with a patch: describe FM_PATCH Includes a patch body FM_PATCH /\bdiff -pruN\b/ score FM_PATCH -1.0 since it's not very common in spam emails SpamAssassin settings When it comes to my system-wide SpamAssassin configuration in /etc/spamassassin/ , I enable the following plugins: loadplugin Mail::SpamAssassin::Plugin::AntiVirus loadplugin Mail::SpamAssassin::Plugin::AskDNS loadplugin Mail::SpamAssassin::Plugin::ASN loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold loadplugin Mail::SpamAssassin::Plugin::Bayes loadplugin Mail::SpamAssassin::Plugin::BodyEval loadplugin Mail::SpamAssassin::Plugin::Check loadplugin Mail::SpamAssassin::Plugin::DKIM loadplugin Mail::SpamAssassin::Plugin::DNSEval loadplugin Mail::SpamAssassin::Plugin::FreeMail loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof loadplugin Mail::SpamAssassin::Plugin::HashBL loadplugin Mail::SpamAssassin::Plugin::HeaderEval loadplugin Mail::SpamAssassin::Plugin::HTMLEval loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch loadplugin Mail::SpamAssassin::Plugin::ImageInfo loadplugin Mail::SpamAssassin::Plugin::MIMEEval loadplugin Mail::SpamAssassin::Plugin::MIMEHeader loadplugin Mail::SpamAssassin::Plugin::OLEVBMacro loadplugin Mail::SpamAssassin::Plugin::PDFInfo loadplugin Mail::SpamAssassin::Plugin::Phishing loadplugin Mail::SpamAssassin::Plugin::Pyzor loadplugin Mail::SpamAssassin::Plugin::Razor2 loadplugin Mail::SpamAssassin::Plugin::RelayEval loadplugin Mail::SpamAssassin::Plugin::ReplaceTags loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody loadplugin Mail::SpamAssassin::Plugin::SpamCop loadplugin Mail::SpamAssassin::Plugin::TextCat loadplugin Mail::SpamAssassin::Plugin::TxRep loadplugin Mail::SpamAssassin::Plugin::URIDetail loadplugin Mail::SpamAssassin::Plugin::URIEval loadplugin Mail::SpamAssassin::Plugin::VBounce loadplugin Mail::SpamAssassin::Plugin::WelcomeListSubject loadplugin Mail::SpamAssassin::Plugin::WLBLEval Some of these require extra helper packages or Perl libraries to be installed. See the comments in the relevant *.pre files or use this command to install everything: apt install spamassassin pyzor razor libencode-detect-perl liblog-log4perl-perl libgeoip-dev libmail-dkim-perl libarchive-zip-perl libio-string-perl libmail-dmarc-perl fuzzyocr My ~/.spamassassin/user_prefs file contains the following configuration: required_hits 5 ok_locales en fr # Bayes options score BAYES_00 -4.0 score BAYES_40 -0.5 score BAYES_60 1.0 score BAYES_80 2.7 score BAYES_95 4.0 score BAYES_99 6.0 bayes_auto_learn 1 bayes_ignore_header X-Miltered bayes_ignore_header X-MIME-Autoconverted bayes_ignore_header X-Evolution bayes_ignore_header X-Virus-Scanned bayes_ignore_header X-Forwarded-For bayes_ignore_header X-Forwarded-By bayes_ignore_header X-Scanned-By bayes_ignore_header X-Spam-Level bayes_ignore_header X-Spam-Status as well as manual score reductions due to false positives, and manual score increases to help push certain types of spam emails over the 12.0 definitely spam threshold. Finally, I have the FuzzyOCR package installed since it has occasionally flagged some spam that other tools had missed. It is a little resource intensive though and so you may want to avoid this one if you are filtering spam for other people. As always, feel free to leave a comment if you do something else that works well and that's not included in my setup. This is a work-in-pro