mounting Azure blob storage

We looked at the different ways in which Azure storage could be mounted on a Linux Moodle instance, using blobfuse

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-how-to-mount-container-linux

but did not find any mentions using

mount

or

crontab -l (for various users)

Edit: It turned out it was using Moodle's Object storage file system plugin, which manages all the storage from within Moodle. But see this caveat.

Fresh install of Moodle on Ubuntu 20.04 with apt

Using the command at https://www.tecmint.com/install-moodle-in-ubuntu/

sudo apt update
sudo apt install php-common php-iconv php-curl php-mbstring php-xmlrpc php-soap php-zip php-gd php-xml php-intl php-json libpcre3 libpcre3-dev graphviz aspell ghostscript clamav

Then git-based install after

sudo apt install git

Edit: For the error "PHP has not been properly configured with the MySQLi extension for it to communicate with MySQL. Please check your php.ini file or recompile PHP."
we can follow the installation instructions at
https://docs.moodle.org/310/en/Step-by-step_Installation_Guide_for_Ubuntu

Installing the lapp stack on Ubuntu 20

https://kb.amijani.net/web-server/how-to-install-lapp-apache-php-postgresql-on-ubuntu-20-04/

Basically, 
sudo apt install apache2
sudo apt install php7.4 libapache2-mod-php7.4 openssl php-imagick php7.4-common php7.4-curl php7.4-gd php7.4-imap php7.4-intl php7.4-json php7.4-ldap php7.4-mbstring php7.4-pgsql php-ssh2 php7.4-xml php7.4-zip unzip

Then install PostgreSQL with
https://www.digitalocean.com/community/tutorials/how-to-install-postgresql-on-ubuntu-20-04-quickstart

connecting to a pptp VPN

A VPN to some servers was configured on Windows 10 clients as 
Type of sign-in info: User name and password
and under "Advanced", 
VPN type: Automatic.

Other windows clients were able to log on to the VPN with no problems, but when I tried with Linux Mint and the default pptp VPN settings, the connection was failing. My first thought was that some setting was missing, but it turned out that the reason for the VPN to fail was that my internet connection was via a mobile hotspot - just connecting via a broadband connection did the trick, I did not have to do any port-forwarding or any settings on the router. And then I found that some mobile hotspots work too - 
LG Q6 with Airtel 4G on primary SIM slot - no
LG Q6 with Airtel 3G on primary SIM slot - sometimes works. 
Redmi 4 with Jio SIM - works
Realme U1 with Jio SIM in secondary SIM slot - no
JioFi router (2018 model) - works
BSNL ADSL broadband with wifi router - works

With the default routing, all connections are routed through the VPN, and normal internet browsing doesn't work. With the help of this post, changed the routing so that only connections to those machines which are on the VPN are routed through the VPN.

/var/log/syslog gave the internal gateway info, which is on the private subnet, different from the external gateway which is on a public subnet.

 

making a rectangle in Gimp

1. Select using Rectangle Select Tool
2. Edit - Stroke Selection

rsync, screen and ssh-agent

On some of our other Ubuntu servers, rsync in a cron job as root works fine with ssh and key-based authentication. But not on a CentOS server I recently logged on to, because ssh-agent was not automatically started on login.

So, I have to run the following - 

eval `ssh-agent -s` 
ssh-add /path/to/keyfile.pem

and then do the ssh -i keyfile user@remoteserver

If I want to run a long rsync job from within screen, I need to run the above commands again from within screen, or else the ssh-agent is not accessible from within screen.

The next issue was the use of rsync with directories which had spaces in them. Instead of laboriously escaping each space with a backslash, I used the --protect-args method.

rsync -azvhrt --protect-args -e ssh  "/local path/with spaces/directory to copy" "user@remotemachine.tld:/remote/path/with spaces/"

php oauth server - link dump

PHP 5

https://www.sitepoint.com/creating-a-php-oauth-server/

https://bshaffer.github.io/oauth2-server-php-docs/

PHP 7

https://github.com/thephpleague/oauth2-server

Using firebase (PHP 7)

https://github.com/jeromegamez/firebase-php-examples

Edit: We finally did not use any of these, and instead authenticated using google sign-in against our own database as mentioned at https://hnsws.blogspot.com/2021/12/using-google-sign-in-for-our-php-portal.html

creating rectangular boxes with Gimp

Just to remember - rectangular marquee to select - shortcut key is R
Then, menu item Edit - Stroke selection

Line width of 4 pixels looks quite good for onscreen viewing, like below. 

forcing chrome to reconnect to a website

For purposes like profiling site load speeds etc, making Chrome close connection to a web server and start over - 

https://stackoverflow.com/questions/37170812/force-chrome-to-close-re-open-all-tcp-tls-connections-when-profiling-with-the-ne

Go to

chrome://net-internals#sockets

and close idle sockets.

Also works for sessions opened with SSH tunnels, when we want to close the connection immediately.

HTTP to HTTPS redirection on Windows Server and IIS

Certbot can automatically add http to https redirection when used with Apache on Linux, by appending

RewriteEngine on
RewriteCond %{SERVER_NAME} =whatever.tld
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

To do the same on Windows, I followed the method given at
https://www.ssl.com/how-to/redirect-http-to-https-with-windows-iis-10/

for redirecting http to https on IIS+Windows. 

• Download and install the URL Rewrite module
• In IIS Manager, choose the relevant website, double-click URL Rewrite
• Click Add Rules on RHS, create a Blank Rule in inbound section.
• Choose Requested URL: Matches Pattern and Using: Regular Expression, with the Pattern: (.*) and Ignore Case ticked. 
• Logical Grouping: Match All, then Add...
• In the Add Condition box, Condition Input: {HTTPS}, Check if input string: Matches the Pattern, Pattern: ^OFF$, Ignore case: ticked.
• In the Action setting, Edit Inbound Rule, set Action type: Redirect, Rewrite URL: https://{HTTP_HOST}/{REQUEST_URI} ,  Append query string: uncheck, Redirect type:  Permanent (301).
• Finally, click Apply in the Actions section on Right-hand side.

This would create a web.config in the site's home directory, with contents like:

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

    <system.webServer>

        <rewrite>

            <rules>

                <rule name="HTTPS Redirect" stopProcessing="true">

                    <match url="(.*)" />

                    <conditions>

                        <add input="{HTTPS}" pattern="^OFF$" />

                    </conditions>

                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" />

                </rule>

            </rules>

        </rewrite>

    </system.webServer>

</configuration>

scripts to alert admin when hard disk is full, and to delete older files

Proposed solution to alert admin when a server hard disk becomes close to full, and for auto deleting old files - 

1. Script to email us when hard disk becomes full -
https://www.google.com/search?q=script+to+email+me+when+hard+disk+crosses+free
gives this script,
https://www.linuxjournal.com/content/tech-tip-send-email-alert-when-your-disk-space-gets-low

by adjusting the THRESHOLD=90 line, we can adjust when the script will email us. 10 GB out of 500 GB hard disk means we need to put THRESHOLD=98

#!/bin/bash
CURRENT=$(df / | grep / | awk '{ print $5}' | sed 's/%//g')
THRESHOLD=98
if [ "$CURRENT" -gt "$THRESHOLD" ] ; then
    mail -s 'Disk Space Alert' mailid@domainname.com << EOF
Your root partition remaining free space is critically low. Used: $CURRENT%
EOF
fi

And a cron to run this daily like 
@daily ~/ourScriptName.sh

2. Script to automatically delete files older than one month - 

https://www.google.com/search?q=script+to+automatically+delete+files+older+than+one+month
gives us this,
https://tecadmin.net/delete-files-older-x-days/
which lists the steps manually. 

If we just write this as a script and put a cron job like the earlier script, this should work. Something like
find /our/path -name "*.zip" -type f -mtime +30 -delete

error on booting Linux Mint 20

https://www.google.com/search?q=Buffer+I%2FO+error+on+dev+sda7%2C+logical+block+32495328%2C+async+page+read

https://www.linuxquestions.org/questions/linux-hardware-18/buffer-i-o-error-on-dev-sdb1-async-page-read-4175600715/

Hardware error might be fixed by zeroing out the partition and then reformatting, the last posts above indicate.

upgrade Linux Mint 18.3 to 20

Tried the upgrade as per
https://community.linuxmint.com/tutorial/view/2416

Regenerating fonts cache ... failed.

(Probably this was due to Google Chrome or Google Fonts which were installed?)

So, just installing 20.1 as a fresh install on lenovoPC.

icecast reload

Tried an implementation of icecast compiled with ssl support - but needs reload whenever the certificate is changed.

(Edit - see the later implementation using icecast-kh which does not have this reload requirement. )

Tried
kill -HUP  processid

after
ps -A | grep icecast

to find process id.

But that did not seem to work - neither as non-root user nor as root. probably because the process was started as nohup.

So, did

kill processid

Verified with
ps -A | grep icecast

that the process was killed,

then did

nohup /path/bin/icecast -c /path/icecast_ssl.xml > sh.out 2> sh.err < /dev/null &

This seems to work fine even though the order of the certificate is reversed - cer first and priv second as compared to the other way for the self-signed cert.
Edit - this followed the cat strategy at
https://forum.armbian.com/topic/11436-solved-icecast2-and-ssl/

And again, seems to work fine even though it has RSA PRIVATE KEY instead of PRIVATE KEY as in the self-signed certificate.

Edit - see the later implementation using icecast-kh which does not have this reload requirement. 

too many authentication failures with ssh

The reason for the error "too many authentication failures" was the presence of too many ssh keys in my .ssh directory and the solution was to add the option IdentitiesOnly like

ssh -o "IdentitiesOnly=true" -i key.pem user@server.tld

or for password-based login, can also use

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@server.tld

monitoring icecast stream with uptimerobot

Just a reminder to myself that the uptimerobot monitor for Icecast streams has to be a GET monitor, because Icecast sends a 400 Bad request error for HEAD requests. So, for example, we can set up a GET monitor for
https://streamingurl.tld/mountpoint/status.xsl

But then we would not really know if the streams are running - for that, we rely on our shell scripts to email us like
COULD NOT FIND PLAYLIST nameof.playlist AT Sun May 28 06:01:01 IST 2017
PLAYING EMERGENCY INSTRUMENTAL PLAYLIST!!

another domain name for the same page, implemented with Plesk

We wanted the same content as oldname.tld/url to be served from newname.tld/url for a domain which was being served from a shared server running Plesk. We could not do it by adding a domain alias, instead we had to do it by adding newname.tld as a new domain in Plesk and pointing it to the same directory as oldname.tld for wwwroot.

creating a Linux filesystem on a VHD file

In order to create a timeshift backup before upgrade, creating a virtual hard disk volume,
https://www.tecmint.com/create-virtual-harddisk-volume-in-linux/

This took 20 minutes on lenovo pc for 30 GB. mkfs finished in just seconds.

fiber link tests

Our fiber link, which used a 2-core media converter, had gone down. Checking various segments which were looped at different locations, each segment by itself was OK. But with all the loopings, though light was seen when testing with a "visual fault locator" or laser, one core was less bright. So, used a single-core media converter, and link became OK. 

Google Forms for creating a feedback form

Initially, I thought our non-profit edition of Google Workspace did not have Google Forms, and so created a form manually, following

https://dev.to/omerlahav/submit-a-form-to-a-google-spreadsheet-1bia

https://github.com/jamiewilson/form-to-google-sheets

and a template from jotform.com

Then PB pointed out that accessing Google Forms from Google Drive -> New -> Google Form works, and that the scripts.google link has a problem of not displaying if the user is logged on to more than one google account at the time of clicking that link.

So, PB recreated as a Google Form. 

google apps scripts limitation on multiple logins

One of the limitations of Google Apps Scripts - apps created with script.google.com fail when logged in to multiple accounts.
https://www.demandsage.com/blog/google-multi-account-authentication-bug-what-it-is-possible-workarounds/

For standalone scripts which have a url like https://script.google.com/macros/s/LONGID/exec?parameter the error shown is:
"Sorry, unable to open the file at present.

Please check the address and try again."

renewing a dot tk domain

Freenom is the domain registrar for .tk and currently, their process for renewing free domains is - 

• we get a reminder email 2 weeks before expiry
• free renewal is possible only 2 weeks before expiry
• the current link to renewal is via the Services menu item - Services -> Renew domains and not via "My Domains" as mentioned in their email. 

exploring creating issues on github using email

Checked out ifttt email -> github - that needs the email to be sent from a particular email id, which will then create an issue on github. Could possibly implement using gmail's auto-forwarding features.

https://ifttt.com/connect/email/github
https://ifttt.com/applets/TKuX3JY6-create-github-issue-via-email

Edit - Another way to do it via the Fire bot - https://www.ilovefreesoftware.com/25/programming/how-to-create-github-issues-by-sending-email.html

adding SSL (https) to http mp3 streams - Apache reverse-proxy and letsencrypt

Our audio streams were getting blocked by Chrome's insistence on https. Our initial workaround was to not use any javascript-based player, and instead just use a link to the stream URL with target = _blank to open it in a new window or tab. Now, working towards https support for our audio streams, we found two options.

1. Icecast 2.4.4 has support for SSL, but we need to recompile it on most platforms with the flag set as the icecast package which is available at this repo doesn't support SSL. ./configure --with-curl --with-openssl

2. The other option is to use an SSL reverse-proxy - Apache or Nginx.

Since we had Apache running on our server already, I tried the reverse-proxy method. I had to use acme.sh and not certbot since our server needs an OS upgrade. After the acme.sh installation, have to log out and log in (or open another shell) for the .bashrc changes to take effect. On the server, the main steps were:

a2enmod proxy
a2enmod proxy-http  #(without this, got Internal Server Error)
service apache2 restart

a2ensite stream.ourdomain.tld
service apache2 reload

The file created for stream.ourdomain.tld in /etc/apache2/sites-available/stream.ourdomain.tld.conf was copied from another virtual host and then I added the lines like

ProxyPass /nameofstream http://11.22.33.44:8567/
ProxyPassReverse /nameofstream http://11.22.33.44:8567/ 

ProxyPass /nameofanotherstream http://11.22.33.44:8577/ 
ProxyPassReverse /nameofanotherstream http://11.22.33.44:8577/ 
</VirtualHost>

The file created for the ssl version had to be hand-written since acme.sh doesn't automatically create the config files unlike certbot. stream.ourdomain.tld-ssl.conf had the additional lines

<IfModule mod_ssl.c>
<VirtualHost *:443>

SSLEngine on
  SSLCertificateFile      /etc/ssl/certs/stream.ourdomain.tld.cer
  SSLCertificateKeyFile /etc/ssl/private/stream.ourdomain.tld.key

So, with acme.sh, first issued the certificate in Apache mode as root - 

acme.sh --issue --apache -d stream.ourdomain.tld

and then installed it using

acme.sh --install-cert -d stream.ourdomain.tld \
--cert-file      /etc/ssl/certs/stream.ourdomain.tld.cer  \
--key-file       /etc/ssl/private/stream.ourdomain.tld.key

a2ensite stream.ourdomain.tld-ssl
service apache2 reload

Worked.

Everything seems to be fine - Apache was not having any issues I could detect with top and a tail -f of the Apache access log. Cloudflare proxying had been turned on, but I'm not sure if it had any impact since this was a stream and not a static file which could have been cached.

CPU utilization and RAM utilization didn't change more than 1-2% - 97% idle CPU, and all the Apache processes together were using only 14% RAM or less of our 8 GB server, which didn't increase substantially from what it was before the test. Some 300+ clients connected via our website with the new links to the various streams in the last 90 minutes or so of the test. 

Edit: See the later post, implemented with icecast-kh
https://hnsws.blogspot.com/2021/06/adding-ssl-https-to-http-mp3-streams.html

github phasing out password authentication for commits

While making some command-line commits to github, I'd received an email from github that password-based authentication is deprecated, and would be unavailable after Aug 2021. Github docs also mention that pw auth is deprecated. This stackoverflow post also discusses the change, and its advantages. So, basically we need to create the password token, give it suitable permissions and use that instead of the password on the commandline.

centre-click for restoring xfce minimized windows

Working with xfce on a GCP cloud server, minimized windows were not visible. My workaround as suggested by this forum post was to centre-click on the desktop (right+left click on my trackpad) and choose the relevant window from the list.

RDP failure and resolution

Last week, I could not remote desktop into one of our servers which was a VM on Azure - Remote Desktop was working only immediately after a restart, and later not at all. Remmina failed with

connected to ip.address.tld:3389
recv: Connection reset by peer
Error: protocol security negotiation or connection failure

and rdesktop failed with

ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ?
Failed to connect, CredSSP required by server.

I thought I got the explanation for CredSSP from this post and thought disabling NLA would solve the issue. But then, I could not connect at all. I'd done this by right-clicking on System, Properties, Remote, and disabling the check-box 'Allow connections only from computers with NLA...' 

Tried resetting the connection configuration from Azure portal, still no. (Choose the VM in Azure Portal, Support + Troubleshooting, Reset Password screen, choose 'Reset configuration only').

I tried logging on using a Windows 10 VM on another server, but got an "internal error". Perhaps this was due to the Windows trial license expiring on that machine. Today when I re-installed a trial version of Windows 10 and tried to connect, the Remote Desktop connection worked fine. Turned on NLA, it still worked. Tried with Remmina on my local machine, that also worked. 

So, why did it fail and why did it start working again? Was it due to a Windows update causing issues like in this forum thread? Perhaps a network glitch? Perhaps restarting the VM (which I did several times) or resetting the configuration solved the issue but I was unable to check due to turning off NLA? At that time, I did not see this post, but maybe in the future I might need these tips again. 

port forwarding workaround

One of our external IP addresses had port-forwarding set up to allow incoming ssh. That external network failed and the alternate network took over for web browsing, but our ssh connections would fail. Workaround was to set up identical port-forwarding rules for this alternate network external IP address also. Then, if the primary network fails, we can ssh in using the alternate network. 

recommended font sizes for responsive websites

Troubleshooting an issue of iSpring's output html not appearing properly on a mobile app, found this page with some recommendations on font sizing for mobile devices. The issue itself might be due to javascript support issues or user-agent issues, I guess, since the page appears properly on mobile browsers. 

importing emails into google groups

Sending invites to a large number of email ids from google groups, found the following. 

• The "500 per day" limit seems to include those email ids which were selected for sending, and then were not sent since they were already members of the group.
• So, sending invites one by one - only one email at a time - would result in the maximum invites sent per day. But - this is very time consuming. Even with an automated script made with SikuliX, approximately 15 seconds per email id if processing one email at a time. 
• Filtering out existing users makes the process much smoother. Script for that shared below. But the list still needs manual filtering of typos like gamil.com or gmailcom or gmail com etc. 

For comparing this list with the list of subscribers made earlier, the technique discussed here was modified to make the formula
=IF(ISERROR(MATCH(A143,Sheet2!B142:B,0)),"",A143)

That is, the existing users were copied into a sheet called Sheet2 on the same Google spreadsheet. This was further improved using the technique of ARRAYFORMULA discussed here, so that the entire column of thousands of cells were populated with one click. That is, enter the formula in the first cell, and instead of specifying just A2, mention the entire column in the form A2:A, and hit Ctrl+Shift+Enter after entering the formula.

Then a modified SikuliX script was used to do the import 10 emails at a time, which I've copy-pasted below. Captcha is not required for 10 emails or less. Alt+Shift+C is the key combination to abort the SikuliX script.

from time import sleep

sleeptime=0.5

lastlineofsheet=Location(412,656)

#Addbutton=Location(1068,286) changed to 75 percent below

Addbutton=Location(982,202)

#DirectAddToggle=Location(840,670) changed to 75 percent below

DirectAddToggle=Location(895,580)

#MembersToAddBox=Location(880,320) changed to 75 percent below

MembersToAddBox=Location(922,346)

#WelcomeMesgBox=Location(915,415)

#sometimes the gmail profile comes in the above spot

#WelcomeMesgBox=Location(1180,446) changed to 75 percent below

WelcomeMesgBox=Location(1138,438)

#TextEditOnTaskbar=Location(751,751)

#Taskbar location is often non-reproducable, avoid.

TextEditOnTaskbar=Location(600,31)

InsideTextEdit=Location(650,400)

#MemberListOnTaskbar=Location(435,751)

#SendButton=Location(1164,555) changed to 75 percent below

#SendButton=Location(1146,520) changed for 10 at a time to

SendButton=Location(1128,543)

while(True):  

  click(lastlineofsheet)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  type(Key.DOWN, KeyModifier.SHIFT)

  sleep(sleeptime)

  type("c",KeyModifier.CTRL)

  sleep(sleeptime)

  click(Addbutton)

  sleep(sleeptime)

  sleep(sleeptime)

  sleep(sleeptime)

  click(DirectAddToggle)

  sleep(sleeptime)

  click(MembersToAddBox)

  sleep(sleeptime)

  type("v",KeyModifier.CTRL)

  click(TextEditOnTaskbar)

  click(InsideTextEdit)

  sleep(sleeptime)

  type("a",KeyModifier.CTRL)

  type("c",KeyModifier.CTRL)

  #click(MemberListOnTaskbar)

  sleep(sleeptime)

  click(WelcomeMesgBox)

  sleep(sleeptime)

  type("v",KeyModifier.CTRL)

  

  popup("waiting for paste")

  click(SendButton)

  popup("waiting for no error")

  #sleep(7.0)

  

  click(lastlineofsheet)

  sleep(sleeptime)

  type(Key.DOWN)

  sleep(sleeptime)

  #popup("waiting for next")

GCP costs for 2 16 GB VMs

Google Cloud Platform's Billing -> Overview shows the number of free credits remaining as well as the number of days remaining. 

Running 2 instances of e2-highmem-2 (2 vCPUs, 16 GB memory) cost approximately Rs. 600 or US$8 per day, or $250 per month, or $3000 per year.  

URL addressability API removed from Alfresco

URL Addressability API (superseded by WebScripts)

https://hub.alfresco.com/t5/alfresco-content-services-hub/alfresco-community-5-0-b-release-notes/ba-p/289468

Interestingly, this is in version 5-0-b. But ticket-based addressing of image URLs is working locally (I believe?) in 5-0-d. Does Alfresco's versioning go from d to c to b? Or is my understanding of the URL Addressability flawed?

The URL addressability documentation says that it has been obsoleted - 5

https://hub.alfresco.com/t5/alfresco-content-services-hub/url-addressability/ba-p/291489

mounting remote volumes and cloud drives - sshfs and rclone

Rclone can mount a wide variety - over 40! - of cloud storage options as drives on Linux, Windows and Mac. If we're ssh-ing into a remote machine and want to authenticate, we can tunnel the temporary web server which Rclone opens on port 53682.

Another option for remote mounting is sshfs. 

When I tried it with key-based authentication, 
sudo sshfs -o allow_other,default_permissions,IdentityFile=~/.ssh/id_rsa bitnami@xxx.xxx.xxx.xxx:/ /mnt/mymount
I got errors - connection reset by peer. 

Apparently, the full path to the key file is needed - 
sudo sshfs -o allow_other,default_permissions,IdentityFile=/home/myhomedir/.ssh/id_rsa bitnami@xxx.xxx.xxx.xxx:/ /mnt/mymount

Then it worked. 

deploying war files on wildfly

There seem to be multiple ways to deploy WAR files in Wildfly. 
https://www.baeldung.com/jboss-war-deploy

Just copying the WAR file to the wildfly/standalone/deployments directory seems the most easy for us to do. And if the WAR file is already exploded, we also need to create a appname.war.dodeploy marker file as mentioned in RedHat's documentation.

Change configuration files only after stopping wildfly -
/opt/bitnami/ctlscript.sh stop wildfly
on Bitnami Wildfly VM.

Takes ~15 sec to stop Wildfly

Takes ~5 minutes to start Wildfly and deploy wars if there are errors, but only a few seconds (less than a minute) if there are no errors.
Monitoring the log is a good way to judge if Wildfly is running or stopped - 
sudo tail -f /opt/bitnami/wildfly/standalone/log/server.log

Examples of configuration files which might need to be set up - 
wildfly/standalone/deployments/CAS.war/WEB-INF/deployerConfigContext.xml
wildfly/standalone/deployments/CAS.war/WEB-INF/cas.properties

wildfly/standalone/configuration/standalone.xml
wildfly/modules/org/CustomAppName/properties/configuration/main/Environment.properties

If a WAR file deployment fails with Null Pointer Exception (seen in the server.log file mentioned above), there is a good chance that this is due to some non-existent file or path mentioned in one of the properties files above. The usual culprit would be Windows-style paths for log or conf files. 

If a large number of WAR files are to be deployed, deployment may fail with Out of Memory errors. We can increase heap size and MetaSpace size by editing /opt/bitnami/wildfly/bin/standalone.conf line for JAVA_OPTS like

JAVA_OPTS="-Xms2G -Xmx10G -XX:MetaspaceSize=2G -XX:MaxMetaspaceSize=6G -Djava.net.preferIPv4Stack=true"

Edit - Adding data-sources - if needed, we can deploy the db driver as a module, and configure via the data source via the web console. For the postgres driver, I directly downloaded the jar from

http://localhost:9990/console/index.html#deployment;deployment=postgresql-42.2.14.jar

so gave the 

 <resource-root path="postgresql-42.2.14.jar"/>

Using the jboss-cli method for creating the db driver as a module, 

wildfly/bin/jboss-cli.sh

ran as sudo, needed to put the entire command in one line

/subsystem=datasources/jdbc-driver=postgresql:add(driver-name=postgresql, driver-module-name=org.postgresql, driver-class-name=org.postgresql.Driver)

Outcome success.

location of Apache configuration files on Bitnami Wildfly VM and easy SSL configuration with LetsEncrypt

As of this writing in Dec 2020, this discussion on configuring redirects is not directly applicable to Bitnami's Wildfly VM. The Proxy Pass commands etc are located in /opt/bitnami/apache2/conf/vhosts/wildfly-http-vhost.conf
and
wildfly-https-vhost.conf

Bitnami makes it easy for us to use https by providing an interactive script which will set up SSL certificates with LetsEncrypt as well as a cron job for renewal - 
sudo /opt/bitnami/bncert-tool

check if a service is running

One way to easily check for a service listening on a port for a Linux server running systemd is using ss - need not be run as root.

ss -tulpn

shows all listening ports 

ss -tulpn | grep 5432

would indicate if PostgreSQL is running or not, and so on.

quick temporary phpPgAdmin installation using Bitnami

On Bitnami's Alfresco VM, installing phppgadmin using 
sudo apt-get install phppgadmin
causes problems since apt-get on the platform (Debian 10) tries to install apache2 which is already installed as httpd on the Bitnami stack. 

Bitnami's LAPP stack has phpPgAdmin, so one can install it as a user, disable or stop postgres from that stack, change phppgadmin/htdocs/ conf file for accessing any other db which we may have, change apache's port if another server is running at 8080, to 18080 for example, by modifying
apache2/conf/httpd.conf
and
apache2/conf/bitnami/bitnami.conf

Virtual hosts, host alias equivalents and LetsEncrypt SSL for IIS on Windows Server

The equivalent of adding virtual hosts in Apache is adding Sites in IIS. And similar to adding a host alias, what is done is to add a site binding. IIS Manager -> Servername -> Sitename -> Edit site 

Then, getting SSL certificates from LetsEncrypt and applying them - 
https://weblog.west-wind.com/posts/2016/feb/22/using-lets-encrypt-with-iis-on-windows
suggests using LetsEncrypt-Win-Simple which is now WinAcme. Very simple interactive script as described on their website.

Also, various possible reasons for IIS errors are listed at https://superuser.com/questions/741486/page-not-found-in-iis-but-its-there

Bitnami Wildfly VM default user is called user and not manager

Bitnami's documentation mentions that the username to access the wildfly admin console is manager. But with the credentials supplied, I was unable to log on to the VM deployed using GCP marketplace (Version: 21.0.2-0-r02). Then, looking at how to change the credentials, looking at the file /opt/bitnami/wildfly/standalone/configuration/mgmt-users.properties found that the username is actually user and not manager. Then I was able to log on.

Monitoring RAM usage of a VM on GCP

CPU usage is shown by default on the monitoring console, but in order to see how much RAM is used by a VM on Google Cloud Platform, one has to first install the agent, then in the Monitoring dashboard, open Metrics explorer, choose the GCE VM Instance Resource Type and choose the agent called Memory Usage (agent.googlapis.com/memory/bytes_used). This last part is a bit non-intuitive, because there are many entries labelled Memory Usage, and we have to scroll down till agent.googlapis.com/memory/bytes_used. The resulting chart can be saved to an existing dashboard or we can create a new dashboard.

tried and failed to change Alfresco port in Bitnami VM

In some of my initial attempts, working with Bitnami's Alfresco VM, I tried a few ways to change the port and failed. Just documenting what does not work - 

https://docs.alfresco.com/4.2/tasks/share-change-port.html

mentions changing the <web-extension>/share-config-custom.xml file, not just in alfresco-global.properties -

https://docs.alfresco.com/4.2/concepts/share-configuration-files.html

The path above is tomcat/shared/classes/alfresco/web-extension/share-config-custom.xml

But probably these docs assume that Tomcat is already configured to run on the fresh port, and that is probably why just doing the above failed for me.

And finding the location of the Apache configuration files on this Bitnami VM which were doing the proxypass from port 8080 to port 80 - 

/opt/bitnami/apache2/conf/bitnami/bitnami.conf
had a line 

Include /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf

bitnami/bitnami-apps-prefix.conf has

Include /opt/bitnami/apps/alfresco/conf/httpd-prefix.conf

httpd-prefix.conf has

Include "/opt/bitnami/apps/alfresco/conf/banner.conf"

Include /opt/bitnami/apps/alfresco/conf/httpd-app.conf

and finally 

/opt/bitnami/apps/alfresco/conf/httpd-app.conf

has the proxypass lines for alfresco and share, like

<Location /alfresco>
ProxyPass ajp://localhost:8009/alfresco etc.

MySQL and PostgreSQL command line cheat sheet

 MySQL

From https://www.a2hosting.in/kb/developer-corner/mysql/managing-mysql-databases-and-users-from-the-command-line

mysql -u root -p
(or bitnami user for bitnami VMs)

show databases;
use dbname1; 
show tables; 

create database dbname;
use dbname;
GRANT ALL PRIVILEGES ON *.* TO 'username'@'localhost' IDENTIFIED BY 'password';

Example SQL script import usage

mysql -u username -p < example.sql

And if required,

drop table tablename;

or

drop database dbname;

For cloning a database, this page has instructions, which also needed the permissions as detailed here. as root user, opening mysql and

GRANT PROCESS, SELECT, LOCK TABLES ON *.* TO 'bn_alfresco'@'localhost'; 

mysqldump -u bn_alfresco -p bitnami_alfresco -r bnalf.sql

mysql -u bn_alfresco -p

CREATE DATABASE my_project_copy;

USE my_project_copy;

SOURCE bnalf.sql;

PostgreSQL

For Debian-based distributions, 
sudo apt-get install postgresql-client
psql -h <REMOTE HOST> -p <REMOTE PORT> -U <DB_USER> <DB_NAME>

\l

to show databases, or

select datname from pg_database;

And to show tables,

\c databasename
\dt

Edit: For exporting the database, various options for pg_dump, most common would be
sudo su postgres
pg_dump dbname > dumpfile.sql
or if local authentication is not supported in the hba.conf, and username/pw auth is supported,
pg_dump --no-owner --dbname=postgresql://dbuser:dbuserpasswd@host:port/dbname > dump.sql

From bash shell, as postgres user, can import like
psql dbname < dbdump.sql

From https://medium.com/coding-blocks/creating-user-database-and-adding-access-on-postgresql-8bfcd2f4a91e

create database dbname;
create user username;
(To change, alter user username with encrypted password 'MyPassWord';)
grant all privileges on database dbname to username;

If the database was imported as postgres user, and another user is given all privileges as above, a possible issue is "permission denied when accessing schema postgres". My rough workaround was to create another super user (since I did not know the postgres user's password and didn't want to change it and potentially break things) by logging on as root, su postgres, and 
CREATE USER newadmin WITH SUPERUSER PASSWORD 'newadminpassword';

changing bitnami alfresco db to postgresql and resetting the password

After following the steps below, was unable to log on as alfresco admin user - the credentials were not being accepted. The solution is at the end of the post.

https://docs.alfresco.com/4.0/tasks/postgresql-config.html
https://computingforgeeks.com/install-postgresql-11-on-debian-10-buster/

To set the postgres alfresco user password MyPassWord

sudo su -
sudo postgres

psql
alter user alfresco with password 'MyPassWord';

Downloaded driver from

https://jdbc.postgresql.org/download.html

https://docs.bitnami.com/bch/infrastructure/tomcat/get-started/get-started/

says TOMCAT_HOME is /opt/bitnami/tomcat

but for the Bitnami Alfresco Community VM, found it was

/opt/bitnami/apache-tomcat

https://docs.alfresco.com/6.1/reuse/conv-syspaths.html

indicates location of <classpathRoot> as tomcat/shared/classes, so on this bitnami VM,

/opt/bitnami/apache-tomcat/shared/classes

Ask the database the location of pg_hba.conf as mentioned at

https://askubuntu.com/questions/256534/how-do-i-find-the-path-to-pg-hba-conf-from-the-shell

In our case doing
psql -t -P format=unaligned -c 'show hba_file';
as postgres user, 

sudo nano /etc/postgresql/11/main/pg_hba.conf to add the line

host all all 127.0.0.1/32 password

and

systemctl restart postgresql

Then, restarting alfresco with

/opt/bitnami/ctlscript.sh restart

brings up alfresco by bootstrapping the required tables in the new database, but can't log in - the credentials are not accepted. 

Tried various methods as given at https://docs.alfresco.com/5.1/concepts/admin-password.html and http://www.giuseppeurso.eu/en/alfresco-tips-and-tricks-1-reset-the-admin-password/ using hashes as given at https://blog.atucom.net/2012/10/generate-ntlm-hashes-via-command-line.html and so on. But did not work.

The solution was:

Delete or comment out the line with admin credentials at /opt/bitnami/apache-tomcat/shared/classes/alfresco-global.properties like

#alfresco_user_store.adminusername=admin
#alfresco_user_store.adminpassword=209c6174da490caeb422f3fa5a7ae634

so that when alfresco is restarted with

/opt/bitnami/ctlscript.sh restart

with a blank database, the admin username and password is reset to admin admin. After logging in, the password can be set as desired from the web console.

Installing activemq on Debian 10

Following
https://www.howtoforge.com/tutorial/debian-activemq-message-broker/

to install activemq on Debian 10 for a Bitnami Alfresco VM starting from step 2, found that activemq failed to start with 
ERROR: Configuration variable JAVA_HOME or JAVACMD is not defined correctly. (JAVA_HOME='', JAVACMD='java')

Set the environment variables as mentioned at 
https://stackoverflow.com/questions/31400148/apache-activemq-5-11-1-doesnt-start-in-ubuntu
in this case, for the bitnami stack, I defined  JAVA_HOME and JAVACMD in /etc/default/activemq as

JAVA_HOME="/opt/bitnami/java" 

JAVACMD="/opt/bitnami/java/bin/java"

Now 

systemctl start activemq

systemctl enable activemq

systemctl status activemq

shows

● activemq.service - Apache ActiveMQ

   Loaded: loaded (/etc/systemd/system/activemq.service; disabled; vendor preset

   Active: active (running) 

etc. 

The default username and password for admin user are admin admin, and for non-admin user, user password. The default port is 61616, the web console configuration panel can be accessed from localhost:8161.

public key authentication fails with agent refused operation

I generated a private+public key pair on a Windows 10 machine, copied the key over to a Linux Mint 18.03 (based on Ubuntu Xenial 16.04) machine and used it to ssh into that machine with no issues. Then I generated another key pair on another Windows 10 machine, which had been upgraded to 10 from a lower version of Windows, and tried to use that key pair to log on to that machine from the Linux machine, but it failed with "agent refused operation". 

Looked at various possible reasons for this failure, finally found that the private key was of a different size, and also had the string OpenSSH PRIVATE KEY instead of RSA PRIVATE KEY at the beginning and end. This might have been due to a different OpenSSH server from MLS software I had tried installing on the 2nd Windows machine, or it could have been due to something else. Anyway, I just created one more key from the 1st Windows machine and used that key pair instead for authenticating into the 2nd machine. That worked fine.

Edit - This discussion seems to be related, and has an explanation.

Load testing a moodle server - log in with token parsed with Beautiful Soup

While trying automated logins with a simplistic python script like this -
import requests

url = 'https://theserver.tld/login/index.php'
myobj = {'username': 'theUserName', 'password': 'ThisIsThePassWord!', "logintoken": "hCBVa2gzAWqSa2u7iNzdzlE9kwpVehFf"}
x = requests.post(url, data = myobj)
print(x.text)

Moodle would return authentication failure - it was checking the logintoken, which was hard-coded above. R used a modified script to get the logintoken correctly first, which then works - 

import sys
import requests
from bs4 import BeautifulSoup 

#driver = webdriver.Chrome()
# using this technique, the testing machines would run out of RAM
# after a dozen or so Chrome instances were loaded!

#def login(url,usernameId, username, passwordId, password, submit_buttonId):

#   driver.get(url)
#   driver.find_element_by_id(usernameId).send_keys(username)
#   driver.find_element_by_id(passwordId).send_keys(password)
#   driver.find_element_by_id(submit_buttonId).click()

#myMoodleEmail = sys.argv[1]

#login("https://server.tld/login/index.php", "username", myMoodleEmail, "password", "ThePW!", "loginbtn")

#driver.close()

login_data = {

    #'logintoken': 'XPc8nw0a2gLXpgsn6njpehwEoW43mzYQ',
'username': sys.argv[1], 'password': 'ThePW!'

}

headers = {'user-agent': 'Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36'}

with requests.Session() as s:

    url = "https://theserver.tld/login/index.php"
    r = s.get(url)
    soup = BeautifulSoup(r.content, 'html5lib')
    login_data['logintoken'] = soup.find('input', attrs = {'name': 'logintoken'})['value'] 
    r = s.post(url, data = login_data, headers = headers)
    print(r.text)

So I didn't have to try JMeter as the moodle documentation suggests, 
https://moodle.org/mod/forum/discuss.php?d=313489

which points to the moodle documentation on load testing. 
https://docs.moodle.org/dev/JMeter#Make_JMeter_test_plan

Edit: Example usage of JMeter - 
jmeter -n -t [jmx file] -l [results file] -e -o [Path to web report folder]

Edit: The final result was, on AWS, "R5A Quadruple Extra Large - 128 GB RAM, 16 Virtual CPUs, 10 GB Network" - for 2000 users to log in concurrently. 

some ssh tunnel notes

While setting up an ssh server on Windows, found that PermitTunnel is not supported by the Microsoft port of OpenSSH-Server. But then, PermitTunnel is not required to do local port forwarding at the client side, like 
ssh -L 5990:192.168.12.34:5990 user@server.name

And interestingly, this sort of "poor man's VPN" using such an ssh tunnel seems to be much faster than OpenVPN etc as mentioned here, due to having less overhead.

Installing OpenSSH on Windows 10 which had been upgraded from Windows 7

When trying to install OpenSSH on a machine running Windows 10 which had been upgraded from Windows 7, the Optional Features under Apps -> Apps and Features -> Manage Optional Features as mentioned in the documentation was completely blank. But the install with Powershell (run as administrator) method as mentioned in the same documentation page worked.
Add-WindowsCapability -Online -Name OpenSSH*

For troubleshooting permission issues, this post or this one may be useful - it talks about using PowerShell to change the permissions - ACL - on the authorized_keys file. Or, just make sure the permissions are appropriate using windows explorer -> file properties -> security -> advanced, 

For the private key (and for the authorized_keys file?), 

change the owner to the login user (if it's not already).

Disable inheritance (if it's set).

Remove all permissions for every one but this user.

Give this user “Full Control”.

avoiding multiple redirects in cloudflare

Changing the SSL settings from Flexible to Strict fixed the too many redirects error for one of the domains - https://support.cloudflare.com/hc/en-us/articles/115000219871-Troubleshooting-redirect-loop-errors

adding share links

Used this medium post which links to this codepen as a starting point for implementing share over email (a mailto link), copy to clipboard, and sharing via facebook, twitter and linkedin. Our code is on my (private) github repo.

firebase authentication tutorial without the need to set up billing - but ...

The official firebase auth tutorial from Google needs you to set up billing. This tutorial made by the community doesn't need you to set up billing. 

But since it's based on old versions of libs, with the current (newer) version of falcon, gives error at

from falcon.version import __version__  # NOQA

exporting users from a large google group

We wanted to export all the current subscribers to a large google group (>30k), and the export members functionality doesn't seem to work even for owners of the group*. So, brute-forcing to the rescue. Used SikuliX to automate the process of going to each page of subscribers, select all, copy, paste into a text file, save, and move to the next page of 100 users after sorting the users by join date earliest first. Since I didn't have opencv installed using apt on this machine and didn't want to break any opencv3.x configuration I might have done, used hard-coded locations on screen instead of Sikuli's feature detection. So, I had to manually click popups to ensure proper wait times after each operation. The script looked like this - 

 

i=18 #the page from which we're starting

while(True):  

  dragDrop(Location(721,265), Location(821,365)) #drag at the top end

  type("a",KeyModifier.CTRL)        #Ctrl a - select all

  type("c",KeyModifier.CTRL)        #Ctrl c - copy

  click(Location(1301,565))         #click inside text editor

  type("v",KeyModifier.CTRL)        #Ctrl v - paste

  popup("waiting for paste")

  click(Location(1336,450))         #click save toolbar icon

  popup("waiting for save dialog")

  click(Location(726,102))          #click on save dialog

  type(str(i))                      #save filename = pagenumber

  popup("waiting for save")

  click(Location(1311,720))

  popup("waiting for creating new file")

  click(Location(1276,450))

  i=i+1

  click(Location(1207,232))

  popup("waiting for pageload")

Then the following python script helped parse it into a csv - 

#!/usr/bin/env python3

import sys

count = 0

for line in sys.stdin:

    #print(line)

    if line.startswith("Profile image"):

        Profileim = line

        username = next(sys.stdin).strip()

        ExtOrRadiosaiId = next(sys.stdin).strip()

        if (ExtOrRadiosaiId == "External"):

            emailid = next(sys.stdin).strip()

        else:

            emailid = ExtOrRadiosaiId

        print('{},{}'.format(username, emailid))

        count = count + 1

        

print(count)

by calling it as 

cat * | parsedumpinfile.py > mycsvfilename.csv

Earlier, I had thought about importing the txt files into a spreadsheet and processing the fields there, creating a formula to copy every sixth (email id) to column next to username, taking care to select six + six + six before dragging down, using a modified method from

https://www.wikihow.com/Select-Alternate-Rows-on-a-Spreadsheet

to select every sixth row. Or using autoformat in LibreOffice Calc, which looks like this.

But the python script above is much easier and cleaner, of course. 

*Edit - For a group inside a GSuite account, this method using Directory API might work. But GSuite api and googlegroups.com api are different. Only brute-forcing works for googlegroups.com :)

low cost video capture and streaming

How times have changed since the days of the $1000 Matrox RT2000 which we purchased in 1999-2001. This HDMI frame-grabber costs only $35. But it's just a simple HDMI to USB conversion, raw frames with no encoding. So the PC needs to be capable enough to handle the high-bitrate stream and do encoding on the fly. Since these are generally used by gamers for streaming, beefy machines are not an issue. And OBS Studio is the software of choice. Then, OBS Studio has "BrowserSource" which can be used to capture - no hardware required, except OBS Studio's own hardware requirements. 

All these could be possibilities if Google goes ahead with its plan to remove access to Google Meet recording ability for Education customers.

creating and distributing private keys as pem files

I wanted to create and distribute some keys as filename.pem for people to ssh into a server like

ssh -i filename.pem username@machine.name

as is done for qwiklabs. With a bit of digging, found that the pem file is actually the private key and not the public key, and the whole process would be as follows.

ssh-keygen -t rsa -m PEM

cd .ssh

cp id_rsa filename.pem

cp id_rsa.pub authorized_keys

chmod 600 authorized_keys

References:

https://docs.oracle.com/en/cloud/paas/integration-cloud/ftp-adapter/generate-keys-pem-format.html

https://hnsws.blogspot.com/2006/01/adding-rsa-auth.html

https://serverfault.com/questions/706336/how-to-get-a-pem-file-from-ssh-key-pair

https://inkel.github.io/posts/pem-to-authorized-keys/

How to log on using the pem file with PuTTY on windows is via PuTTYgen as explained at 

https://aws.amazon.com/premiumsupport/knowledge-center/convert-pem-file-into-ppk/

for example.)

setting up letsencrypt certificates for multiple virtual hosts with apache

The preferred method is to just run certbot multiple times with each required domain, as mentioned at https://www.digitalocean.com/community/tutorials/how-to-set-up-let-s-encrypt-certificates-for-multiple-apache-virtual-hosts-on-ubuntu-14-04 

So, sudo certbot --apache -d example.com -d www.example.com

and later

sudo certbot --apache -d example2.com -d www.example2.com

or whatever. And then add to root's cron,

15 3 * * * /usr/bin/certbot renew --quiet

which checks every morning at 3:15 AM and renews any certs with validity less than 30 days more.

troubleshooting a ruby on rails web server

To troubleshoot a web server running ruby on rails, checked the history of the ssh login I had been supplied (up arrow, up arrow, etc) and found that the admin had started rails using

rails s -p 5001 -b <ipaddress> -d
rails s -p 3001 -b <ipaddress> -d

for the two sites, and that they were running apache to proxy these ports to the two websites. The sites-available had virtual hosts configured like

DocumentRoot /full/path/to/rubyonrails/project/production
...
ProxyPass / http://xx.yy.zz.ww:5001/
ProxyPassReverse / http://xx.yy.zz.ww:5001/

and so on.

Found that the apache sites-enabled directory had some wrong entries + duplicate entries, which were causing apache to go back to the default configuration with no virtual servers, hence the various errors. There may be some issues with apache, serveralias and rails as mentioned here,

https://serverfault.com/questions/300226/serving-rails-through-apache-using-proxypass

that it was serving up the test page when the main domain was a server alias. So, I created a separate virtual server conf file in sites-available, with main-domain-name.conf which solved that issue. Then ran certbot for both domains for getting letsencrypt certificates.

debugging the radiosai google assistant action's audio search issue

Going step by step, found that dialogflow was returning the value "search" instead of the words the user was using. After going through the codelabs example at https://codelabs.developers.google.com/codelabs/actions-1/ ,  saw that after the dialogflow intent was edited with new training phrases without template mode, I needed to delete the old phrases, and then retrain before the changes would take effect, as per

https://github.com/googleapis/nodejs-dialogflow/issues/219

https://cloud.google.com/dialogflow/es/docs/training

Now, instead of the word "search", dialogflow returns the correct user phrase, as in the screenshot below.

After submitting this version as a release, the corrected version is live now. 

test of creating a free tier instance, using it for multiple users like students

Though GCP's "recommended way" of adding SSH keys is quite convoluted, found that I could use my usual method to add my key, and use PasswordAuthentication yes in /etc/sshd-config to allow password-based logins for users.

As can be seen in this techrepublic post, the way to prevent newly created users from seeing each others' directories is to edit the /etc/adduser.conf file, changing the default home directory permissions from 755 to 750. We can of course do this manually with sudo chmod 750 /home/user1 and so on.

Then, using a "Free Tier" f1 micro instance, someone can do text-based teaching like conducting a C lab after installing the required build tools like apt install gcc or apt-get install build-essential. Currently the specs of a free tier compute instance are -

1 F1-micro instance per month
Scalable, high-performance virtual machines.

1 non-preemptible f1-micro VM instance per month in one of the following US regions:
Oregon: us-west1
Iowa: us-central1
South Carolina: us-east1

30 GB-months HDD
5 GB-month snapshot storage in the following regions:
Oregon: us-west1
Iowa: us-central1
South Carolina: us-east1
Taiwan: asia-east1
Belgium: europe-west1

1 GB network egress from North America to all region destinations (excluding China and Australia) per month.

Azure AD guest account and how to close an azure account

There are conflicting posts all around, saying that one can only remove subscriptions and not close an Azure account once it is opened. Since I had used this from a test domain, it was an "unmanaged organization" 

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/users-close-account

1. Sign in to close your account, using the account that you want to close.

2. On My data requests, select Close account.

   

I used this to remove the test account I had created to delegate permissions for an app being developed by a third-party. The delegation of permissions via Azure Active Directory implies that the guest user has to switch directory to the directory of the current resource in the Azure portal, and then the guest user would have view access to the current directory name (and probably more). 

diffuse not opening - needs python2

 The graphical diff tool Diffuse was not opening - running it from the terminal gave the error message 

diffuse
  File "/usr/bin/diffuse", line 74
    print codecs.encode(unicode(s, 'utf_8'), sys.getfilesystemencoding())
               ^
SyntaxError: invalid syntax

Apparently this is because diffuse is written for python2.

So, edited the hashbang for /usr/bin/diffuse to use /usr/bin/env python2 instead of /usr/bin/env/ python, works now.

#!/usr/bin/env python2