Tuesday, September 20, 2022

deleting an Azure free trial and deleting a hotmail account

Earlier, I had posted about stopping the Azure free trial from an unmanaged domain account. This post is about stopping an Azure free trial subscription and deleting a free hotmail account. 

https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/cancel-azure-subscription

portal.azure.com  --> Cost Management + Billing --> Overview --> your plan --> select Cancel --> verify that you want to cancel and select Yes, cancel.

After that, to delete the hotmail account which had that free trial,
https://www.makeuseof.com/tag/how-to-delete-outlook-hotmail-account/

account.microsoft.com --> login --> Your Info tab  --> Scroll down to the Help with Microsoft account  -->  How to close your account --> Choose whether you want Microsoft to retain your data for 30 days or 60 days --> Next etc (various security confirmations)  

This info is probably subject to change as these portals constantly undergo slight revisions in UI.

Monday, September 19, 2022

steps taken for a suspended Google Workspace domain

Unfortunately, one of our domains missed out migration to non-profit edition. Copy-pasting from some email exchanges which happened, to document one possible way of dealing with such a situation.

The following were carried out:

1. For emergency continuation of requireduser@our-lapsed-domain.tld, our-lapsed-domain.tld was upgraded to Business starter. Would cost approx Rs. 250 per month, so instead of continuing this, we would migrate the users.

2. For doing this, the easiest way was to find out the admin account of our-lapsed-domain.tld in the legacy Google Apps for Domains.

Initially, many of our domains had been administered by Mr. MM's team, so I tried searching for their hand-over email which listed all assets and all logins, in which I had also been cc'd - found our-lapsed-domain.tld also in that list. Tried with its administrative account - apparently not logged in for many years - and enrolled in Business Starter.

There were 4 accounts seen - of which only the administrative account and requireduser@our-lapsed-domain.tld had any data.

3. Have started the migration of archived emails from supersededemail@our-lapsed-domain.tld (just for safety's sake, probably these have already been saved earlier) to currentemail@anotherdomain.org

4. Will delete notused@our-lapsed-domain.tld - since it seems to be not in use.

5. Since the current email id used by Dr. is in ourdomain.org, P has been requested to ask S to create requireduser@ourdomain.org. Once this is done, requireduser@our-lapsed-domain.tld will be migrated there - perhaps an outage of a day, which can be decided by requireduser at their convenience. Outage will be only in terms of accessing old emails. Fresh emails will go to requireduser@our-lapsed-domain.tld without any outage.

6. Once the new email id is ready, we can start forwarding new email which goes to requireduser@our-lapsed-domain.tld to requireduser@ourdomain.org - for this, I have used https://improvmx.com/
in the past, and seems to be a good service.

I can set up forwarding for supersededemail@our-lapsed-domain.tld to currentemail@anotherdomain.org also if desired. And adminaccount to orgadminaccount@gmail if desired.

7. Future - checking if there are any other domains which have been orphaned like this - I will check
(a) the hand-over email from MM's team
(b) the MX records in all domains which are under our control
and make a list of all domains which have emails enabled, and who administers them.

----
Later, to S   ...
---

So, the steps would be:
1. I would reset the pw of requireduser@our-lapsed-domain.tld
2. I would log in to requireduser@our-lapsed-domain.tld and ensure that IMAP is set to ON in gmail settings.
3. I would ensure that "Allow insecure apps" is set to ON in Google account settings
4. I would then give you the password, which you can use in Google Workspace Admin panel to do the migration.
5. The screenshots below explain the process.
6. I can also call you at 2.30 pm tomorrow if you want. Google's documentation for this is at https://support.google.com/a/answer/9476255

Scroll down to Data Migration



Inside Data Migration, choose the Add user link - 



In the next screen, you may see another option,

Choose source. There, you can choose "Google Workspace" as the source. Then, it will use IMAP with imap.gmail.com as the source. If it gives an option to choose the date, give a date very long back, like 2001 or something, so that all the emails will be selected. Then if it asks whether
Migrate Junk
Migrate Deleted
etc,
just choose the default, which is not to migrate Junk/Deleted. Etc. Then, you would see the following.




There, the source email would be
requireduser@our-lapsed-domain.tld
the Google Workspace Email would be
requireduser@ourdomain.org
and the password would be the password for requireduser@our-lapsed-domain.tld, which I will send you tomorrow.

----
Later, after S had created the new account ...
---


In case you use any other services - google keep, youtube, blogger, calendar, drive, anything else - please take a backup by logging on to requireduser@our-lapsed-domain.tld and then navigating to takeout.google.com

This is important, so please let me know once you have taken the backup (or let me know if you don't use any services except email.)

So, from 2 pm tomorrow or so, you would not have access to requireduser@our-lapsed-domain.tld

The emails will start getting migrated hopefully by 2:30 pm.

Depending on the total disk size as well as the number of emails, this process can take between 1-7 days.
(The migration happens via IMAP,
https://support.google.com/a/answer/9476255?hl=en
In our experience, if total emails size is less than 2 GB, it would take only one day.)

You will start seeing the newest emails - from the last few weeks - within an hour, and the older emails will continue to be added to requireduser@ourdomain.org over the course of the migration.


direct url of play console and google apps script editor url

For uploading or editing apps in the Google Play Store, the play console url, if logged in to multiple accounts at the same time, would be like

https://play.google.com/console/u/6/

(if using the account number 6, etc.)

similar to 

https://drive.google.com/drive/u/6 etc.

The google apps script editor url is of the form

https://script.google.com/u/6/home/projects/project-id/edit

This usually works if we just double-click on the script in google drive if the editor is set to "new editor", but if the editor is set to the "classic" version of GA script editor, double-clicking on a script may not work, we need to use the above url. 

Thursday, September 15, 2022

xfce icons still not showing

Running xfce over VNC on a cloud server, the icons were not showing up, even after

and
installing xubuntu-desktop
Need to check if the  last command in the thread above works,
# gtk-update-icon-cache --force /usr/share/icons/hicolor

Tuesday, September 13, 2022

modify and build the Moodle app version 4+

Edit - There is a newer post on building the release version entirely from Github Actions - for the moodle app v4.1.0.

There are a few changes from my earlier post about building the Moodle app. I'll try to write this post as a bash script which could be run on an Ubuntu-based machine which does not have the build environment set up, so that it would be possible to use something like Travis CI to build it. The current script below will not work without a gui on headless servers, since there are some steps like previewing in Chromium, installing android studio etc require a GUI. 

# the following are for a headless server, to get a gui over VNC

https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-vnc-on-ubuntu-18-04

sudo apt update

sudo apt install xfce4 xfce4-goodies -y

sudo apt install tightvncserver -y

vncserver

# This starts up VNC server and asks to set up a password.

# The following will be after logging on to VNC - my preferred method is 

# to tunnel port 5901 over ssh.

# following the documentation at https://moodledev.io/general/app/development/setup

sudo apt install git chromium-browser -y

# from https://github.com/nvm-sh/nvm#installing-and-updating

wget -qO- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash

source ~/.bashrc


git clone https://github.com/moodlehq/moodleapp.git
cd moodleapp
git checkout v4.0.1

# Here we make all the customizations, described at the bottom of this post

cd ..

git clone https://github.com/ourPrivate/Repo-with-customization-files.git

cd  customizedMoodleApp4changes

cp -Rvf * ../moodleapp

cd ../moodleapp

 

# node version should be < v15, 

# https://github.com/moodlehq/moodleapp/blob/master/package.json#L178

nvm install 14.15.0

npm install

npm start 

# npm start is to see if it works in chromium browser 

# Initially it will open the browser and complain connection refused.

# It will take around 5 minutes to compile, only then a browser reload will work.

# Even after the first compile, it takes around 90 seconds on a 16 GB machine for

# each npm start command - till the chokidar error comes up.

# Fix the chokidar error - too many watch files - with

# https://stackoverflow.com/questions/55763428/react-native-error-enospc-system-limit-for-number-of-file-watchers-reached

# echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p 

# Check if this is OK with

# cat /proc/sys/fs/inotify/max_user_watches 

 

# For building Android or iOS app, need more setup,

# https://moodledev.io/general/app/development/setup

# via my previous post, need to install cordova - 

npm install cordova

npm i -g cordova-res

sudo apt install libsecret-1-dev -y

sudo apt install openjdk-11-jdk -y

sudo add-apt-repository ppa:maarten-fonville/android-studio

sudo apt update

sudo apt install android-studio -y

# This ppa install does not add the required environment variables, so

# to find java home, via https://www.baeldung.com/find-java-home

dirname $(dirname $(readlink -f $(which javac)))

export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64

export PATH=$JAVA_HOME/bin:$PATH

export ANDROID_SDK_ROOT=/home/azureuser/Android/Sdk

export PATH=$ANDROID_SDK_ROOT/tools:$ANDROID_SDK_ROOT/tools/bin:$ANDROID_SDK_ROOT/platform-tools:$PATH 

nano .bashrc
# and added all these export commands to the end of .bashrc also

# We may need to install the android-30 SDK separately,

# https://developer.android.com/studio/command-line/sdkmanager

# but it is far easier to do it from within the gui SDK manager

npm run prod:android 

# This will probably fail due to not finding gradle, 

# and at this point, we can just open android studio, 

# import the platforms/android folder, and build there.

# The android studio build may complain that build tools ver 30 are not found.

# The way to install them using SDK manager is to choose

# the SDK Tools tab, and check the "Show package details"

# in order to make the Build tools 30.0.3 show up, which we can mark and install. 


 

# Unfortunately, building this way with the above steps seems to result in

# an app with the default cordova or ionic icons. To change to our icons, 

# we could use Android Studio's Image Asset Studio

https://github.com/ionic-team/capacitor-assets/issues/108 

# But the standard way to generate icons as per

# https://capacitorjs.com/docs/guides/splash-screens-and-icons

# was creating files in android directory instead of platforms/android, so

# since mv cannot do it, 

#https://unix.stackexchange.com/questions/9899/how-to-move-and-overwrite-subdirectories-and-files-to-parent-directory 

cordova-res android --skip-config --copy 

cp -Rvf android/* platforms/android

# Then build with Android Studio. 

# https://stackoverflow.com/questions/37300811/android-studio-dev-kvm-device-permission-denied

# if you want to install an Android emulator

# sudo apt install qemu-kvm

#sudo adduser $USER kvm

# sudo reboot

# To run the emulator outside Android Studio in a separate window, 

# start the emulator before opening the project

# https://stackoverflow.com/questions/70986530/android-studio-emulator-in-a-separate-window 

To sign the app with our existing keystore, followed a procedure similar to my previous post, with a change that the location of the Build types tab has changed in the latest 2021.2.1 chipmunk version of Android Studio. In short, following the official documentation (which shows screenshots of the older version)

  1. Project window --> right-click on app --> Open Module settings


  2. Modules on LHS pane --> app --> Signing configs tab --> create a new signing config by giving it some name like releaseconfig


  3. Modules --> app --> Build types tab --> choose the newly created signing config under "Signing" for the release build. (Extreme scrolling to the right was needed before the drop-down was visible, in one case)


  4. Build variants --> choose the release build



The app build so far was fine. But unfortunately, the 4.00 branch of the Moodle app has show-stopping bugs - 

https://tracker.moodle.org/browse/MOBILE-4135

https://tracker.moodle.org/browse/MOBILE-4084

So, I'll continue trying fixes for these in separate posts. One option might be to use the 3.9.4 or 3.9.5 version and fix only the zip path traversal vulnerability in them - 

https://tracker.moodle.org/browse/MOBILE-3949





Virus and threat protection not opening in Windows 10

After restoring Windows 10 on a refurbished mini-desktop purchased on Amazon, found that the Start button was not displaying any content when left-clicked, and the Virus / threat protection / Windows Defender settings page was also not opening. Tried these steps, https://www.thewindowsclub.com/virus-and-threat-protection-not-working-on-windows

  • cmd as administrator using right-click of start menu
  • ran System File checker with
    sfc /scannow
    - this showed some errors, and said they were fixed.
  • ran Deployment Image Servicing and Management with
    DISM.exe /Online /Cleanup-image /Restorehealth

It also did not report any issues, but the problem continued. Then tried anti-rootkit scan from Malwarebytes - it found and fixed some issues. Rebooted, ran another malwarebytes full scan, did windows update. Then Windows Defender and Virus threat protection page started opening. Start menu (left click) still doesn't work, but other things seem ok.

Make Windows boot by Default in Windows + Linux Mint Dual Boot System

Via https://www.techmesto.com/set-windows-as-default-in-linux-dual-boot/

sudo nano /etc/default/grub

and edit the line which says

GRUB_DEFAULT=2

(the entries start from 0, up to down.)

Monday, September 12, 2022

hotstar scaling

Happened to come across this video - Scaling hotstar.com for 25 million concurrent viewers - interesting to note the types of challenges when scaling up with record-breaking numbers of users. And there's a whole channel with such tech talks, HasGeekTV

Friday, September 09, 2022

Personal finance apps - UI - SIP delete in Groww and Valueresearchonline

In the Groww app,
--> Mutual funds tab (at the bottom)
--> Dashboard tab (at the top)
--> SIP is shown on top - click on the arrow to the right
click on the relevant sip's arrow to the right
Cancel SIP button on top.

In valueresearchonline.com's portfolio manager,
--> My investments
--> Overview
--> Action drop-down - last column on the right
--> Edit/view SIP / SWP etc


Wednesday, September 07, 2022

Samsung Galaxy Book 2 - Samsung settings on Windows

Some extra settings are available for the Samsung Galaxy Book2 via Start - Samsung Settings - 

https://www.youtube.com/watch?v=QOVJK-yaCpo

I have turned on the "Power on when lid opened" setting, and the "Charge only up to 85% to conserve battery" setting.

Monday, September 05, 2022

Moodle page and requiring login

We can create a new custom page in a Moodle site by following the template below,

<?php
require_once(dirname(__FILE__) . '/../config.php');
$PAGE->set_context(get_context_instance(CONTEXT_SYSTEM));
$PAGE->set_url('/ourfolder/ourfile.php');
echo $OUTPUT->header();
?>

<p>Our content</p>

<?php
echo $OUTPUT->footer();
?>

Another page example is at

https://moodledev.io/docs/apis/subsystems/output

Then for requiring login, we can add require_login() and then use the conditional  isguestuser() for allowing or not allowing guest users.

https://docs.moodle.org/dev/Access_API

https://moodledev.io/docs/apis/subsystems/access

<?php
require_once(dirname(__FILE__) . '/../config.php');
$PAGE->set_context(get_context_instance(CONTEXT_SYSTEM));
$PAGE->set_url('/ourfolder/ourfile.php');
$PAGE->set_title('Our page title');
$PAGE->set_pagelayout('standard');
require_login();
echo $OUTPUT->header();
if (isguestuser()) {
echo "<h2>Please log in to see this page!</h2>";
}
else {
?>
<iframe
src="https://our.iframe.source.pg/"
name="search_result_frame" width="100%" height="800px">
</iframe>
<?php
}
echo $OUTPUT->footer();
?>

Then we can add this newly created page to our Moodle navigation using various methods. One way would be to add it to the custom menu settings box,
https://oursite.org/admin/settings.php?section=themesettings

and then also adding it to the custom menu items on the mobile app,
https://oursite.org/admin/settings.php?section=mobilefeatures

Edit: Our page worked only in the "open in browser" mode because it had javascript and a form inside an iframe, and we had not included this page in the app code. Simple pages would probably work in the in-app browser mode also.

Saturday, September 03, 2022

cloudflare and 3rd level domains

I created a test domain like dev.operation.ourdomain.tld to check for using dynamic dns with BSNL fiber - the domain works with "DNS only" mode, but if we turn on cloudflare proxying, we get SSL errors, ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

Apparently these errors are due to the third level domain which I created. 
Probably can work around this by adding operation.ourdomain.tld as a separate domain in cloudflare, and then adding dev.operation.ourdomain.tld DNS record to that domain. Or, of course, use a 2nd level name like devoperation.ourdomain.tld

investigating Linux server crash

One of our Linux servers stopped responding unexpectedly. Checking for issues - https://serverfault.com/questions/386985/how-to-investigate-unexpected-linux-server-shut-down

grep -i error /var/log/syslog

Sep  2 01:55:49 servername-php systemd[1]: Condition check resulted in Process error reports when automatic reporting is enabled (file watch) being skipped.

This seems to be the first error in the log. So, around 2 am to 7:30 am, the server might have been down.

Did not check
/var/log/apache2/error.log

Instead, checked for ssh brute-forcing and or other issues with the logs, but did not find anything just before the shutdown.

https://serverfault.com/questions/68500/how-do-i-determine-if-my-linux-box-has-been-infiltrated

tail /var/log/auth.log -n4000 | more

Lots of Unable to negotiate and Invalid user ssh brute forcing attempts, but nothing at the relevant time. But did find something which pointed the finger to some process running on the server -
Sep  1 18:42:40 servername-php su: pam_unix(su:session): session opened for user www-data by (uid=0)
Sep  1 18:42:40 servername-php su: pam_systemd(su:session): Failed to create session: Connection timed out

Then, checked the Moodle logs on that machine, https://oursite.tld/report/log/

Found that only very few users were logged in (if at all). So, not due to too many users logged in. 

https://oursite.tld/admin/tasklogs.php

Filter result = Fail

Date range 1 to 3 - lots of email fails.

Execute adhoc task: mod_forum\task\send_user_notifications
... started 08:36:04. Current memory use 41.1 MB.
Sending messages to ..retracted.. (2404)
Error: lib/moodlelib.php email_to_user(): SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/TroubleshootingSMTP server error: Called RSET without being connected
  Failed to send post 3878
Error: lib/moodlelib.php email_to_user(): SMTP connect() failed. https://github.com/PHPMailer/PHPMailer/wiki/TroubleshootingSMTP server error: Called RSET without being connected
  Failed to send post 3879
Sent 0 messages with 2 failures
... used 44 dbqueries
... used 1.9203059673309 seconds
Adhoc task failed: mod_forum\task\send_user_notifications,error/Error sending posts.

... very large number of Email sending failed notifications.
44,000 failed notifications between 11:45 pm and 12:45 pm last night.

Most probably this is the reason for the server failure.

The error says Called RSET without being connected
which is usually due to connection issues with the hosting provider or mail server.
Azure or Google might be blocking excessively rapid email sending. 

The site default was to send an email notification to every user who has posted to a forum whenever anyone else posts to a forum. I have now changed this to "email daily digest" instead.

With the earlier setting, if 100 users post to a forum (like there are forums which say "please post your feedback", so all enrolled users may try to post there)
then around 5000 emails would go out. (When user 2 posts, 1 email is sent to user 1. When user 3 posts, 2 emails are sent, to 1&2. When user 4 posts, 3 emails are sent, to 1,2,3 - and so on.)

But changing this setting alone is probably not sufficient. This is only the default setting for new users and new forums, I think. We would have to manually change the messaging preferences for all existing users to prevent such email storms. I'm not sure how to do this. Maybe by directly modifying the database? To be checked out. There is some discussion about this at
https://moodle.org/mod/forum/discuss.php?d=28908
which I have to read and understand.

The way Moodle is designed, individual users can set their preference, whether they want an email or digest or not. There doesn't seem to be an admin setting to reset preferences for all users.
 

There are many other places where emails are sent in Moodle. The above two are just indicative. 

Checking the database, for a user login which I control, maildigest=0, mailstop=0 - mailstop=1 would stop all emails I guess. 

maildigest=1 for all users might be a bit draconian?
A discussion about this is at https://moodle.org/mod/forum/discuss.php?d=28908
But according to https://moodle.org/mod/forum/discuss.php?d=19599
changing maildigest=1 will not change anything for current users.


creating an efi partition manually in Linux

For system recovery, when the EFI partition is hopelessly damaged or over-written, we can try re-creating an efi partition, installing refind in it or reinstalling Windows or something like that.

https://askubuntu.com/questions/743095/how-to-prepare-a-disk-on-an-efi-based-pc-for-ubuntu

Fat 32, 1st partition, after creating, which should be 128 MB minimum, but recommended 512 MB, add flags boot and esp.

Friday, September 02, 2022

how to create an EFI boot partition

https://askubuntu.com/questions/743095/how-to-prepare-a-disk-on-an-efi-based-pc-for-ubuntu

Using GParted, we can
Then this partition will be recognized as an EFI /boot partition by Linux installers as well as Windows. For Windows10/11 there is the additional requirement to make "C drive" GPT partitioned instead of MBR partitioned. With GParted, this is via the new partition table - GPT option,

And to mount the EFI partition if it exists, from a live CD or USB,
sudo fdisk -l
will list the EFI partition as "type" "EFI System", and then we can mount the identified partition as
sudo mount /dev/sda1 /mnt
or whatever. 

Pushbullet and uptimerobot

Our old favourite uptimerobot now has support for push notifications via Pushbullet - I have installed Pushbullet and set up on my phone now. But then I found that uptimerobot app also has push notifications which are also free. Anyway, Pushbullet has other features, so I will keep it for now. 

Edwiser reports for Moodle

The Edwiser Reports plugin for Moodle was not visible on one of our sites after the upgrade to Moodle4. Looking around, found this page 
https://edwiser.org/documentation/edwiser-reports/block-setup/
where it says that the link is added to the side-bar in 3.10 and 3.11 and to the header of default theme in 4.0, or else we can access it from  moodlesite.com/local/edwiserreports/index.php and or create a html block in dashboard with the link. 

adding display modes in Linux

Following various posts, first we use cvt to find a mode supported by the monitor and get the modeline, and then add it and enable it using xrandr:
cvt 1600 900
# this would return the relevant mode-line, which is copy-pasted below.
xrandr --newmode "1600x900_60.00"  118.25  1600 1696 1856 2112  900 903 908 934 -hsync +vsync
xrandr 
# use xrandr without arguments to find the display name, which was VGA-1 in this case
xrandr --addmode VGA-1 "1600x900_60.00"

If there is a working mode in Windows, we can use Powerstrip to find it, copy-paste the modeline and use it in Linux.

There are various ways to make this permanent, including xorg.conf editing as mentioned at

Thursday, September 01, 2022

win-acme - scheduled update problem and solution

There was a notification from one of our Windows servers that the LetsEncrypt certificates would expire in 17 days. Checking, found that the DNS was set to "DNS only" and not "Proxied" in Cloudflare, so that may not be the reason for the auto-renewal to fail. Running wacs.exe, it mentioned that a scheduled task has a different path to the executable and had problems. Ah! I had moved the location of win-acme - that was the reason. 

Ran wacs with the Edit option, choosing to edit "Everything", choosing the defaults for everything except the step of "remove existing scheduled task" for which I chose "Yes". Then it renewed and set up auto-renewal again.

Edit March 2023: Shifted to Cloudflare origin certificate since this problem repeated. https://hnsws.blogspot.com/2023/03/setting-up-cloudflare-origin.html

Wednesday, August 31, 2022

exploring moodle file download links and associated database tables

Our users wanted a search implementation which could enable users to download resources from courses to which they are not enrolled. Checking out the possibilities, the download link is of the form
https://oursite.org/pluginfile.php/15810/mod_folder/content/0/Teaching%20Aids/Filename.pptx

The structure of the link is described in
https://docs.moodle.org/dev/File_API

But user permissions are checked before allowing the download. So, this is not suitable for our use case.

Tuesday, August 30, 2022

QT creator tutorial - creating a notepad app

Apparently QT is pronounced "cute". 

A tutorial to create a notepad app, which demos many of the work-a-day aspects of QT creator,


But the best may be the included examples inside QT creator itself.




 

caution when trusting vendors

We are located in a small town, a pilgrimage centre. So, there is generally a tendency to trust people. Unfortunately some bad actors abuse the trust placed on them. An example below, where the protagonist had earlier supplied a printer to our office, with payment only after delivery.

Unfortunately, I trusted him with two personal laptops for repair, and the timeline is shown below. On initial contact, he asked for 100% payment in advance, and I agreed. Would it take a week? Two weeks? A month? He said that it would take only 10 days or so, not longer.

12 July 2022 - paid Rs. 7950 + 5200 





13 July 2022 - paid Rs 800 more - 



18 July 2022 - paid Rs. 5000 more - 


Now starts the delay after delay.


30 July 2022 - There was no response on 21st or 22nd, when he was supposed to deliver. I waited a whole week, then sent a message asking him to give a realistic date. He sends a picture of a Covid-19 rapid test, saying he tested positive today. It's only humane to wait - so I did not ask again - for two weeks. Since there was no message at all from him, on 15 Aug, I sent a message asking if he has tested negative for Covid.

15 Aug 2022 - 

So the promised date was 18 Aug. But no.



On 23rd Aug, he brought one laptop. Hinge display issue was fixed, but overheating issue remained. Instead of 8 GB RAM, only 6 GB RAM had been installed (so he took out a 2 GB stick and put in a 4 GB stick?) No explanation, no word about why this was so ... 

Then he wanted to take the hard disk mounting bracket for the 2nd laptop. I told him to bring the laptop to the office and install it from there. He said he would bring it by 4 pm. Again no show. So, the current status is that he promises to deliver, but has not delivered - multiple times.

Yesterday, 28th Aug - the message from the Security Officer was to give him an ultimatum - if no laptop within this week, complaint will be filed with the police.

Then I sent a message to some of my local contacts, warning about this person. 6 of them got back, saying that they too had burnt their hands with him!

Unfortunately, if we keep quiet about such behaviour, we are enabling further abuse of trust.

Update: 4 Sep was the ultimatum last date. On 3 Sep I get a set of messages from him that he is bringing the laptop "after lunch". Finally, on 4 Sep, he delivered it in the morning. Then he promised to add more RAM to the other laptop where only 6 GB had been installed. On 5 Sep, he tried adding two 4 GB sticks. Machine did not boot. Apparently one of the 4 GB sticks was defective. He said he will replace. 
 
Update: On 15 Sep, he came again with another memory module, tried it on the Lenovo laptop which had only 6 GB instead of the promised 8 GB, didn't work. Said will replace, if he can take the laptop to his office and test with various modules. I said OK, no hurry, so he said he would return the laptop the next day and took the Lenovo laptop. I also requested him for 2 hard disk enclosures as part-repayment of the 5k.

On 24th Sep, I got a message that he succeeded in making the 8 GB RAM work,
"Tomorrow will handover". That worked OK. Then he said he would get the hard disk enclosures and "total invoice for everything" the next day.

On 10th October, he brought 2 hard disk enclosures, "Rs. 950 each". I thanked him. (On Amazon, they are currently on sale for Rs. 595 each.)
 
 

Moodle - User suspended for spamming - Google Workspace

One of our servers running Moodle uses a Google Workspace account for emailing notifications to users. That account was suspended "for spamming". 

Checking, the issue seems to be that there is a forum message "Please post your feedback" - and people were copy-pasting matter as their feedback. (Or are they real users or are they spammers?)

Due to this, the spam filters have been triggered.

I am going to change the default setting of default forum subscriptions for new users from "every post separate email" to "daily digest of subject".
https://ourmoodleserveraddress.tld/admin/settings.php?section=userdefaultpreferences

Monday, August 29, 2022

Moodle versus Wordpress - a comparison

Copy-pasting from an email exchange, regarding queries about using Wordpress instead of or in addition to Moodle -


Option Two: 
Website using WordPress both for content creation and distribution.

A quick google search turned up
 - so there seem to be plugins available which would enable collaborative editing.

I have not used them myself, but should be relatively easy to set up. If you have some volunteer who knows a bit of Wordpress usage (like you had S for Moodle), they can suggest ways and means of customizing Wordpress to best suit your needs. People with Wordpress experience are much more common than people with Moodle experience. 

Wordpress, in general, would use less hardware resources than Moodle too, because Moodle has much more elaborate logging, reporting and forum tools. There is also the option of using completely managed Wordpress hosting, like

3) Option Three: 
One more instance of CMS and WordPress for making available content to stakeholders plus general users as explained above.

This is, of course, possible. A quick google search yields

One potential disadvantage would be that Wordpress is very common, so attacks on Wordpress are also very common - mostly due to plugins which don't get updated etc. 
We would need to be vigilant, subscribe to some WP security bulletins etc and keep updating regularly to avoid issues. Using Managed WP hosting as in the link above,
can help with managing some of the security issues more easily. 


Blender as a video editor

The Blender start-up splash screen gives the Video editing option - a playlist and a video for introductory Blender as a video editor usage - 

  • Compositing - Blend - Over Drop - this is required to show video on lower tracks.
  • Add - Effects Strip - Speed control - then drag clip or change its duration in properties to speed up - can do /2 etc also.
  • To drag edge etc - click on edge, g to grab, then drag. Esc to undo.
  • Ctrl click to snap (hold down ctrl while dragging?)
  • Audio - can change pitch.
  • For transitions:
    Have cursor in left area, press backspace, removes gap between clips.
  • Drag to overlap,
    Shift click to select both,
    Add - transition - 
    Clip in Orange will be at the back!
  • Cross fade sound is a separate option.

Sunday, August 28, 2022

don't use tilde in variables

I had set 
$ANDROID_HOME=~/Android/Sdk 
but 
cd $ANDROID_HOME was not working.

It seems we should use $HOME instead of ~ when setting environment variables - or use the full path -  

Tuesday, August 23, 2022

Moodle upgrade from 3.11 to 4.0

Decided to do this upgrade from the command line. So,
sudo zip -r /path/to/data_disk/site_old.zip /var/www/site_old
etc to take a backup, then
sudo -u www-data /usr/bin/php admin/cli/maintenance.php --enable
git fetch
git branch --track MOODLE_400_STABLE origin/MOODLE_400_STABLE
git stash
git checkout MOODLE_400_STABLE
sudo chown -R azureuser:www-data *
sudo -u www-data /usr/bin/php admin/cli/upgrade.php
sudo -u www-data /usr/bin/php admin/cli/maintenance.php --disable

On one of our sites which had the Enlightlite theme, after the upgrade, the login page was completely black. So, deleted the /theme/enlightlite directory, which forced the default theme, and then from the web interface, installed the updated version of the theme, all OK. 

(
Since we had upgraded using git earlier, just did a trial run using
git clone /path/to/source /path/to/destination
cd /path/to/destination
git remote set-url origin git://git.moodle.org/moodle.git
but 
git branch -r still showed only the 311 branch, no 400 branch.

Then, did
git fetch
which then allowed me to do 
git branch --track MOODLE_400_STABLE origin/MOODLE_400_STABLE
git checkout MOODLE_400_STABLE
)


Friday, August 19, 2022

scheduled start and stop for VMs on Azure

Setting up auto-shutdown on Azure VMs is easy, there is an option under Operations - Auto-shutdown directly in the VM's left-hand side panel. Setting up auto-startup is more involved. Currently, Azure has a Start/Stop VMs V2 feature which can directly be deployed. But since it makes use of some storage and so on, it is billed separately. And it is not available to deploy in the "South India" region. But still, choosing the default region, it is able to start our "South India" VM when I configured it using the "start all VMs in a particular Resource group" method, like

"RequestScopes": { "ResourceGroups": [ "/subscriptions/12our78-1sub4-56id8-1234-123456781234/resourceGroups/OurResourceGrp/" ],

as in the example linked above.

Thursday, August 18, 2022

dynamic dns options

I wanted to try out self-hosting using BSNL's fiber internet. One of the ways to get dynamic dns to work is to use Cloudflare's api and the script given at

Unfortunately the script needs Powershell 7, which only ships with Windows Server - I was trying out on a Win11 home machine. Even with Win10 Pro, this approach may not work. 

Of course, there are bash scripts which can do the job, like

But, since it was available, tried the Dynamic DNS option in our syRoTech ONT - Device Model SY-GPON-1110-WDONT. 

Under Application - DDNS menu option, we can set dynamic dns from oray.com (a Chinese site), DynDNS and NoIP. Since NoIP has a free plan, set up a free hopto.org sub-domain with NoIP, and made appropriate CNAMEs in our organisation's DNS - working fine. 

Tuesday, August 16, 2022

youtube hosted videos on Moodle

There was a query from one of our units, asking how to disable the "Share" link to youtube videos which they embed in their Moodle course. Copy-pasting from my reply:

Some possibilities -

Option 1 - Youtube Custom player embed -
https://www.lifewire.com/embedded-youtube-video-customization-1082489
(I've not tried it, so I don't know if this will help.)

https://www.youtube.com/watch?v=f0iN7jfM7vs

The above video says that you can just add two parameters like controls=0, but now youtube no longer supports the showinfo=0 parameter.

Option 2 - Custom javascript player embed - something like
https://tikku.com/open-source/jquery-plugins/youtube-tubeplayer-plugin/
(I've not tried it, so I don't know if this will help.)

Option 3 - Youtube hosted videos have an option to make them "private".

Then, only those people who have been specifically given permission to view them can see them.

https://support.google.com/youtube/answer/157177?hl=en&co=GENIE.Platform%3DDesktop#zippy=%2Cprivate-videos

Disadvantage - The user would need to be signed in to their google account in order to view the video.

Option 4 - Putting the videos elsewhere, like Google Drive or some other provider like vimeo,
https://www.colby.edu/acits/2020/01/30/how-to-embed-a-video-from-google-drive/




setting up DMARC for better email delivery, feedback loops and XML DMARC reports

Copy-pasting from some emails

Google Workspace (GSuite), which we use for sending our domain's emails, makes it quite easy to set up DMARC for better email delivery.

Setting up DMARC involves
1. setting up DKIM signing for all outbound emails from our domain (SPF is already set up)
2. setting up an email id (or group) which will receive all spam notifications 

If emails are being sent only from Google's servers and not using any other servers, the setup is relatively straight-forward. In case any other servers are being used, those also would need to support DKIM signing. 

But I was mistaken about the DMARC reports being useful for finding out which recipient's spam filter is blocking our emails - it was not DMARC which we enabled in 2009, it was Yahoo's complaint feedback loop, for which we needed to set up DKIM. The DMARC reports don't seem to give us detailed info about spam complaints, while the complaint loop did.

Our emails being sent via Google Apps Script are to GMail users - Google does have a feedback loop mechanism, but it needs additional header information to work - https://support.google.com/mail/answer/6254652?hl=en

And Google Apps Script MailApp does not support DKIM signing with our domain.

Viewing the xml DMARC reports - to make them more human-readable, tried out XSLT from https://www.tana.it/sw/dmarc-xsl/#xslt - didn't seem to work. 
( For this, tried editing the xml file in the reports, and adding the line
<?xml-stylesheet type = "text/xsl" href = "dmarcstyle.xsl"?>
after saving the script above as the file dmarcstyle.xsl in in the same folder as the dmarc report xml file.
Then right-click and open the xml file in some browser. But didn't seem to work. Tutorial on how to use XSLT - 
)

 Then tried dmarcian's XML to Human converter, gives good results.

Monday, August 15, 2022

Google Apps Script importxml for xml file stored in Google Drive

This link - https://stackoverflow.com/questions/45988417/how-to-use-importxml-function-with-a-file-from-google-drive - gives a good overview of how to use a file stored in Google Drive in Google Apps script. Either it has to be shared as viewable by all, or it has to be read using DriveApp.

Sunday, August 14, 2022

meaning of the tags in DKIM signature

When setting up DMARC, we have to set up DKIM first. Google Workspace makes it easy. But I was curious to know what exactly the tags mean in the DKIM header. From
https://help.returnpath.com/hc/en-us/articles/222438487-DKIM-signature-header-detail
v = version
a = algorithm of the hash
h = hash
s = selector record name in DNS
d = domain used with the selector s
b = hash data (body)
bh = computed hash of the message body
h = list of headers used in the hash algorithm

t = timestamp of the hash
x = expiry time of signature

c = canonicalization algorithm in case mail server makes minor changes
i = identity of user or agent


Friday, August 12, 2022

LetsEncrypt certificate renewal issue with Cloudflare proxied Bitnami server

Found one of the Bitnami servers on AWS had an expired LetsEncrypt certificate. Checking, found that its bncert-tool was not able to renew the certificate because it was checking DNS as part of validation, and the server was being proxied by Cloudflare

  1. Temporary solution - turning proxying off (DNS only) in cloudflare, ran bncert to renew, OK for now.
  2. Looking for ways in which the renewal can happen without us having to manually change the cloudflare settings, I found the following:
    https://nodehost.ca/docs/containers/make-lets-encrypt-work-when-using-cloudflare-acme-challenge

    But this is when the host uses certbot and not bitnami's bncert-tool, which uses a different authentication method. This does not work out of the box for Bitnami servers since the config files' paths are different. On the server itself, there is the rule
    RewriteCond %{REQUEST_URI} !^/\.well-known
    in the file /opt/bitnami/apache2/conf/bitnami/bitnami.conf
  3. Possibly the final solution:
    bncert-tool uses the lego client, documentation at
    https://go-acme.github.io/lego/usage/cli/options/

    From the documentation, it looks like we can choose Cloudflare as the DNS provider and get the actual dns address. For this, we will need an api key for lms.sssihl.edu.in -
     via
    Creating API tokens · Cloudflare API docs

    (Using api key instead of api token for initial testing,
    Cloudflare and restricted API tokens · Issue #984 · go-acme/lego (github.com) )

    Then we can try and configure the server to auto update the ssl certificates by authenticating the IP address from cloudflare.

    So, I have added two files on the server,
    /home/bitnami/cloudflare-user
    and
    /home/bitnami/cloudflare-api-key

    and I have modified the cron command which runs daily to check for renewal,
    from
    51 23 * * * sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="theemail@thedomain.in" --http --http-timeout 30 --http.webroot /opt/bitnami/apps/letsencrypt --domains=thedomain.in --user-agent bitnami-bncert/1.0.0 renew && sudo /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf -k graceful # bncert-autorenew

    to
    51 23 * * * sudo CLOUDFLARE_EMAIL_FILE=/home/bitnami/cloudflare-user CLOUDFLARE_API_KEY_FILE=/home/bitnami/cloudflare-api-key /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --dns cloudflare --email="theemail@thedomain.in" --http --http-timeout 30 --http.webroot /opt/bitnami/apps/letsencrypt --domains=thedomain.in --user-agent bitnami-bncert/1.0.0 renew && sudo /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf -k graceful # bncert-autorenew

    Let's see after 30 days if it successfully renews. Seemed to work OK during testing.
    Edit: 14 Sep - Yes, it has auto-renewed on 10 Sep.

Some other alternative solutions, which I did not explore:

  1. There is an alternative method using self-signed certificates, but that would need cloudflare HTTPS setting to be changed to Full instead of Full (Strict), https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/ )
     
  2. Another option is, you could create an Origin Certificate using Cloudflare, and use that instead of the LetsEncrypt certificate.
    https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/
    This would need a one-time set up on the server, after that would not need renewal (for 15 years.)
    Setup on the server would be similar to this, https://visser.io/2018/03/setting-up-a-cloudflare-ssl-certificate-for-bitnami-wordpress-on-google-cloud-compute-engine/
    Edit - I have implemented this, and posted about it here.
  3. There is probably another option using manual configuration of certbot, but more difficult than the above, so I'm skipping that.

Thursday, August 11, 2022

accessibility toolbars and PDFs

There was a query about meeting WCAG standards.  

 Diksha.gov.in also meets WCAG standards.
All websites provide accessibility tool bar consisting of:
1) Font size increase of text
2) Dark mode or contrast.
Moodle version 4 also provides this if enabled.

On Diksha, it is found that both the tools do not work on PDFs and PPTs and only  work on other content on website. What could be the reason for this?

Copy-pasting from my reply, 

The toolbars usually used on websites generally use javascript to modify the display of HTML content by the web browser (like Chrome, Firefox, etc). PDF, PPT and other content are not displayed on the screen by the web browser directly, but instead depend on other software like PDF plugins, Microsoft Office etc. Therefore, the toolbars will only work with HTML content.

If the Userway widget works with PDF and PPT , it would be because they use some other technique for changing the display.

Windows boot error - A data disk is currently set as active in BIOS

An error encountered when trying A's Windows install -  "A data disk is currently set as active in BIOS. Set some other disk as active or use the DiskPart utility to clean the data disk, and then retry the restore operation. (0x80042406)"

https://answers.microsoft.com/en-us/windows/forum/all/a-data-disk-is-currently-set-as-active-in-bios-set/eb931d76-9d23-424c-ba40-8fcd20633125

Apparently this means that the boot partition is borked and we have to boot with a System Restore disk and then restore the image.

Windows 10 recovery - cannot be done with Win7 startup disk

There was a Windows 10 installation on a laptop which needed boot recovery after Linux had been installed on another partition and then removed or something like that. Tried with a Windows 7 DVD - the bootup disk complained that "this startup disk is not compatible with the Recovery version" etc - so I downloaded Win10 startup disk (install disk) from Microsoft, created a USB boot disk using Rufus, and used that to recover the Win10 installation.

Wednesday, August 10, 2022

Openshot vs Avidemux - ffmpeg - avisynth - Virtualdub

Checked out Openshot for cropping and resizing some videos. https://www.youtube.com/watch?v=uUyqWu8A2OQ

(Advanced view)
--> crop size
--> crop left
(location)

Much faster to do it in Avidemux. For my needs, Openshot does not seem to be a good fit. Avidemux - ffmpeg - avisynth - Virtualdub seem to be more suited for my requirements.

Tuesday, August 09, 2022

Google group subscriptions which don't list the email to group owners

Found that there were some Google group subscriptions which don't list the email to group owners also - when we search by email for members, these don't show up. But if we choose the filter "Not in Org" and in Descending order, such subscribers are listed by name at the top. We could then see if the displayed name is similar to the subscriber we are looking for.





Sunday, August 07, 2022

Windows 10 network time update fails on BSNL FTTH - NetTime works

BSNL's FTTH seems to block UDP port 123, hence Windows 10 network time update fails as noted in this set of posts, which also gives the workaround, installing NetTime.

Windows time sync issue with BSNL FTTH and workaround

Noticed that the Windows 11 machine I was working on had 11:32 showing as the time when it was well into the afternoon. Found this thread,
https://broadbandforum.co/threads/cannot-sync-network-time-ntp-on-win10-on-bsnl-ftth.202104/

So apparently Windows tries to poll port 123 from port 123, and that is blocked by many ISPs. 

The easiest workaround was to install NetTime which probably changes the source port and gets around the block. 

Saturday, August 06, 2022

sending mail from GMail smtp servers instead of postfix

Our internal server used to send us notification emails for various server tasks. Recently, our server started getting blocked by GMail with 550-5.7.1 "likely unsolicited mail". Since setting up a "proper" smtp server with reverse DNS, DKIM signing, etc etc would be more painful than just using GMail SMTP servers, we preferred using one of the solutions below - 
or

Since our server scripts were bash scripts and not PHP scripts, we used the latter. 
sudo apt install ssmtp
(which would remove postfix)
and modifying the configuration file as in the link above, /etc/ssmtp/ssmtp.conf with
mailhub=smtp.gmail.com:587
AuthUser=ouruser@ourdomain.org
AuthPass=ourpassword
useSTARTTLS=YES
useTLS=YES

(and allow less secure apps must be enabled on that account.)

With that, the notification emails from our server resumed.