Blog

FreeBSD, System Administration

External USB SSD storage with FreeBSD GELI and ZFS

Identify device.

Attach the external storage and identify the device.

# dmesg
da0 at umass-sim0 bus 0 scbus7 target 0 lun 0
da0: <Seagate Performance 1337> Fixed Direct Access SPC-4 SCSI device
da0: Serial Number 1337XSCZ
da0: 400.000MB/s transfers
da0: 1907729MB (3907029167 512 byte sectors)
da0: quirks=0x2<NO_6_BYTE>

Create encryption key.

Create a secure encryption key component. The block size of this file is not directly related to the data key length for the encryption algorithm.

# dd if=/dev/random of=foobar.key bs=256 count=1
1+0 records in
1+0 records out
256 bytes transferred in 0.000037 secs (9560043 bytes/sec)

Initialize GELI encryption.

The sector size is set to 4.096 bytes for better alignment with SSDs. The default encryption algorithm is AES-XTS. The data key length for the encryption algorithm is 256 bit. A backup of the metadata is written to the file foobar.eli. The utility will ask for a password to be used as the component of the key.

# geli init -s 4096 -K foobar.key -e aes-xts -l 256 -B foobar.eli /dev/da0
Enter new passphrase: 
Reenter new passphrase: 
Metadata backup for provider /dev/da0 can be found in foobar.eli
and can be restored with the following command:
  # geli restore foobar.eli /dev/da0

Attach provider.

Attach the encrypted provider and get an accessible block device.

# geli attach -k foobar.key /dev/da0
Enter passphrase:

Create ZFS pool.

Create a ZFS pool on the encrypted device. Optimize the pool for 4.096 byte sectors, which is common for SSDs, as this setting controls the alignment of ZFS data.

# zpool create -o ashift=12 foobar /dev/da0.eli

Optimize ZFS pool.

If the device will be used for backup, you might want to enable LZ4 compression and disable access time updates for increased performance.

# zfs set compression=lz4 foobar
# zfs set atime=off foobar

Create ZFS datasets.

Create ZFS datasets in the pool as needed.

# zfs create foobar/backup

Set mountpoint.

Set ZFS mountpoint.

# zfs set mountpoint=/mnt/foobar foobar

Export ZFS pool.

When the USB SSD is no longer to be used, then it can be prepared for disconnection by exporting the ZFS pool.

# zpool export -f foobar

Detach provider.

# geli detach /dev/da0.eli

The external USB SSD can now by physically disconnected from the USB port and storead in a safe place.

Attach provider.

When the USB SSD is to be used again, it is connected via USB and the GELI provider is attached by supplying the encryption key component and the password component.

# geli attach -k foobar.key /dev/da0
Enter passphrase:

Import ZFS pool.

The ZFS pool can not be imported.

# zpool import foobar

The external USB SSD is now mounted and is ready to be used.

References.

FreeBSD, System Administration

Dynamic DNS (DynDNS, DDNS) with BIND

What is Dynamic DNS?

Dynamic DNS, also referred to has DynDNS or just DDNS, is a method, that can update ressource records (RR) in the zone of a DNS. An example of this is updating the IP address of a hostname. DNS updates must be authenticated by a transaction signature (TSIG). The update is performed using a DNS update utility.

Where is DDNS used?

DDNS is a requirement, where a client needs to provide a service from a server or host, that does not have a static IP address from the ISP. DDNS is also a requirement, where a client has security devices, such as DVRs and IP security surveillance cameras, that can not be reached via a static IP address from the ISP.

Confirm connection to IP address.

Confirm, that the service can be reached via the currently assigned IP address from Internet. If the service is behind a router, the dashboard of the router will show the currently assigned IP address. If you are using a VPN service, you can not use the IP address from the VPN exit node. If necessary, you will also need to allow and map access from Internet via the router to the service on your LAN.

% ping 13.37.13.37
% ssh -p 1337 -l foobar 13.37.13.37

If the service is behind a 5G router, that is connected to a modern 5G network, that use carrier-grade NAT, also known as CG-NAT or just CGN, then you will not be able to reach the service via the assigned IP address from Internet. The reason is, that the assigned IP address is actually shared between other routers. In that case, DDNS is no longer a solution. You might want to use a VPN instead. This way, the client and server can connect to a VPN server on a VPS with a static IP address.

To be continued…

More about DDNS.

FreeBSD, System Administration

How to create exFAT on USB drive with FreeBSD

Why use exFAT for USB drives and removable drives?

The exFAT, short for Extended File Allocation Table, file system supports very large volume sizes, which is one of the reasons, that it is used for larger USB drives and SD cards. exFAT does not have the 4 GB file size limit, that the FAT32 has. exFAT is compatible with different operating systems and physical devices.

Create exFAT on USB drive or removable drive.

If the the drive is already mounted, then unmount it, before creating the exFAT file system.

# umount /dev/da0

Create the exFAT file system on the removable USB drive. The exFAT file system willl not have a partition scheme. This ensures compatibility.

# mkexfatfs /dev/da0
mkexfatfs 1.4.0
Creating... done.
Flushing... done.
File system created successfully.

Confirm, that it mounts.

# mount.exfat /dev/da0 /mnt
FUSE exfat 1.4.0 (libfuse2)

More about exFAT.

Photography

Outdoor TTL Flash Portrait Photography

What is TTL flash?

TTL is short for through the lens. TTL is a mode, that a flash can operate in. When the flash in in TTL mode, the flash will fire a pre-flash and the flash power will then be automatically set in a fraction of a second, based on a light metering through the lens by the camera.

When is TTL flash used?

If the the eyes, face or other important features of the subject is unevenly lit and the subject is too dark with high contrast, then TTL flash can lift the shadows and light the subject to match the natural ambient light in the background. If the sun is warm and setting, then an orange gel or filter can make the flash warm as well.

Find a good spot for portrait photography.

Consider a place with some trees or some shade. Face should be in neutral even light. Not in harsh uneven light. This will make it possible to control the light.

Dial in the exposure on the camera.

Set camera to manual mode. Set light metering to an averaging mode. Dial in the exposure to 1/160-200s, f/1.2-5.6 and ISO 100-400. Keep ISO as low as possible to avoid noise. Make sure, that the flash is turned off, and take a test image and review the image and the histogram. A correct exposure will not have peaks up against the left side nor the right side. Adjust as necessary.

Dial in the exposure on the flash.

If it is sunset and the light is yellow, then use an orange gel or filter on the flash. This will make the flash light become warmer and the image will become more natural. There are usually a half tone and a full tone.

If the flash can not be bounced off a light wall, then point it directly at the subject.

Set flash to TTL mode.

If direct flash is used, then adjust the shutter, so the meter is zero or slight over-exposed. The flash will become more soft. The reason is, that a dark background wil make the flash too bright. Is it better to just use FEC and reduce flash power?

Use a flash transmitter and a softbox to make the light source bigger and softer. Place the softbox as close as possible to make the light as big as possible for softer light. Use a diffuser and un umbrella to make the light source bigger and software.

Adjust flash exposure compensation (FEC) as necessary to make the light soft and natural. Remember, that the camera will by default measure the brightness of the average scene and light it towards grey. Dark scenes will become too bright. Bright scenes will become too dark.

Shoot.

More about TTL flash portrait photography.

Adventure, Photography, Photography Work

Vordingborg Festuge 2024

Pictures from Vordingborg Festuge 2024

This is some of the pictures, I shoot of bands and guests, from the annual music festival Vordingborg Festuge 2024. Conditions were challenging heavy clouds and rain. This did not leave much light for capturing pictures. I used a handheld digital camera with a 70-200mm zoom lens. I used an optimal balance between high speed exposure and narrow depth of field. I used my own custom in-camera picture profile settings for capturing true colors as seen on site. I did not not apply any editing, filters nor generative artificial intelligence to the pictures.

FreeBSD, System Administration

How to install VPN on FreeBSD

This is the procedure for installing, configuring and using a VPN server with OpenVPN on FreeBSD. Tested with OpenVPN 2.6 .10 on FreeBSD 13.2 on 2024-04-26.

Install OpenVPN client on FreeBSD.

Install OpenVPN. The package comes with an OpenVPN client.

# pkg install openvpn

Create a directory for VPN configuration files. Ensure, that login credentials can only be read by the OpenVPN client.

# find / -type d -name '*openvpn*'
# mkdir /usr/local/etc/openvpn
# chown openvpn:openvpn /usr/local/etc/openvpn

Install VPN configuration file for OpenVPN client on FreeBSD.

Get the VPN configuration file from the website of the VPN service. The configuration file should support FreeBSD or GNU/Linux operating systems. The protocol should be UDP. This ensures, that TCP problems, that can arise from encapsulating TCP packets in TCP packets, is avoided. Copy the VPN configuration file to the OpenVPN directory from above.

# chown openvpn:openvpn /usr/local/etc/openvpn/foobar.ovpn

Configure OpenVPN to start without asking for username and password.

If you want to be able to use VPN without OpenVPN client asking for username and password, then configure it to read the login credentials from a text file.

# nano /usr/local/etc/openvpn/foobar.ovpn
auth-user-pass /usr/local/etc/openvpn/foobar.txt

Then store the username and password in the text file. The username on the first line and the password on the next line. Note, that some VPN services provides optional features the VPN service. Such features can be enabled or disabled by modifying the username.

# touch /usr/local/etc/openvpn/foobar.txt
# chown openvpn:openvpn /usr/local/etc/openvpn/foobar.txt
# nano /usr/local/etc/openvpn/foobar.txt
QfHrW8QGf1OYjubt
5r8JzcOBIPNbq6pqhxA0L-FLTVrl4pIl3a0G8qUqyB-DzwFLLfuNlf6j

Configure DNS resolver up scripts for OpenVPN client on FreeBSD.

Ensure, that up scripts, that takes care of DNS resolver configuration, exist. This is not only important for operation, but also for avoiding DNS leak by using an DNS, that is not related to the VPN. The OpenVPN client comes with up and down scripts for this.

# nano /usr/local/etc/openvpn/foobar.ovpn
up /usr/local/libexec/openvpn-client.up
plugin openvpn-plugin-down-root.so /usr/local/libexec/openvpn-client.down

How to start and stop VPN with OpenVPN on FreeBSD.

Start the VPN by using the OpenVPN client with the VPN configuration file as the argument. Stop the VPN by pressing Ctrl+C.

# openvpn-client /usr/local/etc/openvpn/foobar.ovpn

How to start VPN automatically at boot time on FreeBSD.

Add it to the system configuration.

# nano /etc/rc.conf
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/foobar.ovpn"
openvpn_dir="/usr/local/etc/openvpn"

The VPN can now be started and stopped with the system service utility.

# service openvpn start
# service openvpn stop

If a firewall is used, such as PF, then it might be necessary to create an up script, that can reload the firewall script during the startup process.

# nano /usr/local/etc/openvpn/pfreload.sh
#!/bin/sh
/usr/sbin/service pf reload
# chmod 0700 /usr/local/etc/openvpn/pfreload.sh

Add it to the system configuration.

# nano /etc/rc.conf
openvpn_flags='--script-security 2 --up "/usr/local/etc/openvpn/pfreload.sh"

Check DNS resolver for DNS leak.

Confirm, that the DNS resolver has been updated, so DNS leak is avoided.

# cat /etc/resolv.conf

Check IP address for VPN.

Go to What is My IP Address? and confirm, that the IP address is related to the VPN server.

More about VPN on FreeBSD.

OpenVPN and PF at startup on FreeBSD Forums. OpenVPN on FreshPorts. Official website for OpenVPN.

FreeBSD, System Administration

Creating a FAT32 file system on USB flash drive with FreeBSD

This is the procedure for creating an MBR boot sector and a FAT32 file system on a USB flash drive and other removable media, so it can used for sharing files with Windows, TVs or other devices. This procedure is also known as formatting or partitioning.

Attach the external storage and identify the device. Optionally check for existing partitioning schemes and file systems on the device. Destroy any existing partitioning scheme even if it is not empty. Create a new partitioning scheme with an MBR boot sector. Add a new partition of the FAT32 type. Optionally confirm the new boot sector and partition. Construct a new MS-DOS FAT32 file system with optional label. The label, that can use up to 11 characters, is used by Windows and some devices to present the file system to the user. Consider putting a physical label on the flash drive as well. The USB flash drive is now ready to be mounted, used and unmounted again.

# dmesg
# gpart show
# gpart destroy -F /dev/da0
# gpart create -s mbr /dev/da0
# gpart add -t fat32 /dev/da0
# gpart show
# newfs_msdos -L FOOBAR -F 32 /dev/da0s1
# mkdir /mnt/foobar
# mount -t msdos /dev/da0s1 /mnt/foobar
# cp /home/foobar/foo.* /mnt/foobar/
# df -H /mnt/foobar
# umount /mnt/foobar

More about creating file systems.

GPART and NEWFS_MSDOS on FreeBSD Manual Pages. How to mount FAT32 formatted SD memory card on FreeBSD and How to mount exFAT formatted SD memory card on FreeBSD by myself.

Photography

Må man fotografere og dele billeder af en anden person uden samtykke?

Denne sider handler om samtykke til fotografering og deling af billeder, der i Danmark er reguleret i kapitel 27 om freds- og æreskrænkelser i straffeloven. Skrevet 20. marts 2024.

Må man fotografere en anden person uden samtykke?

Man må gerne fotografere en anden person, der befinder sig i offentlige omgivelser eller på et frit tilgængeligt sted. Eksempler på sådanne steder er en koncert, en zoologisk have og en fritidsklub eller forening med udfoldelse af aktiviteter.

Hvis man vil fotografere en anden person, der befinder sig i private omgivelser eller på et ikke frit tilgængeligt sted, så skal der indhentes samtykke til det. Eksempler på sådanne steder er en læge, bank, et fitnesscenter, en bar, natklub, et diskotek og en arbejdsplads.

§ 264 a. Den, der uberettiget fotograferer personer, der befinder sig på et ikke frit tilgængeligt sted, straffes med bøde eller fængsel indtil 6 måneder. Det samme gælder den, der ved hjælp af kikkert eller andet apparat uberettiget iagttager sådanne personer.

Må man dele billeder af en anden person uden samtykke?

Man må gerne dele eller offentliggøre billeder af en anden person, der er taget i offentlige omgivelser, på et frit tilgængeligt sted og er egnet til en bredere offentlighed.

Hvis man man vil dele eller offentliggøre billeder af en anden person, der er taget i private omgivelser eller på et ikke tilgængeligt sted, så skal der indhentes samtykke til det.

§ 264 d. Med bøde eller fængsel indtil 6 måneder straffes den, som uberettiget videregiver meddelelser eller billeder vedrørende en andens private forhold eller i øvrigt billeder af den pågældende under omstændigheder, der åbenbart kan forlanges unddraget en bredere offentlighed. Bestemmelsen finder også anvendelse, hvor meddelelsen eller billedet vedrører en afdød person.

Må man dele intime billeder af en anden person uden samtykke?

Man må ikke dele eller offentliggøre intime billeder af en anden person uden samtykke. Man må ikke dele eller offentliggøre billeder, der vedrører en anden persrons private forhold eller omstændigheder, der ikke er tiltænkt en bredere offentlighed.

Hvis man vil dele eller offentliggøre intime billeder af en anden person eller billeder, der vedrører en anden persons private forhold eller omstændigheder, der ikke er tiltænkt en bredere offentlighed, så skal der indhentes samtykke til det.

§ 264 d. Med bøde eller fængsel indtil 6 måneder straffes den, som uberettiget videregiver meddelelser eller billeder vedrørende en andens private forhold eller i øvrigt billeder af den pågældende under omstændigheder, der åbenbart kan forlanges unddraget en bredere offentlighed. Bestemmelsen finder også anvendelse, hvor meddelelsen eller billedet vedrører en afdød person.

Må man dele adgang til billeder, der er forbeholdt betalende brugere?

Man må ikke dele eller offentliggøre en adgang til billeder, der er forbeholdt betalende brugere. Med adgang menes også brugernavn, adgangkode, login-oplysninger, gengivelse eller anden form for adgang.

§ 263 a. Med bøde eller fængsel indtil 1 år og 6 måneder straffes den, der uberettiget 3) skaffer sig eller videregiver et adgangsmiddel til et datasystem, c) hvortil adgangen er forbeholdt betalende brugere.

Mere om fotografering og deling billeder.