Marc Hefter

Marc Hefter

marchefter@hub.march42.net

This channel has not added a profile description yet

Location:: Bavaria

Germany

Hometown:: Bad Kissingen

Gender:: Human being

Status:: Commited to consent

Fri, 08 Apr 2022 12:32:22 +0200 last edited: Fri, 08 Apr 2022 13:00:47 +0200

Marc Hefter

marchefter@hub.march42.net

Nextcloud error ImagickException in the logs [and how to fix it]

View article

On the new server, the old problems are coming back. Yesterday I activated the Preview Generator in Nextcloud and today I found the following ImagickException message in my logs.

ImagickException: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/408

I know this one and I fixed it before. It comes from trying to generate a preview image from PDF file. I remember there's a XML configuration file to be edited.

Some thoughts before editing the XML.
PDF (portable document format) is based on PS (postscript) and postscript is a programming language for describing the page layout and ghostscript or Acrobat Reader is the corresponding language interpreter. So keep in mind, that everytime you're viewing a PDF you're running a programm. If this PDF comes from an unknown source it's best practice not to open it without taking precautions.
Before writing files (PDF,PS,EPS,XPS) to the storage or running the preview generation it should be at least checked for known viruses. If in doubt, disable the preview generation of postscript based formats. The postscript formats were disabled for good reasons - see CERT/CC Vulnerability Note VU#332928 for this.

Now to the solution of reenabling ghostscript processing.
Edit the /etc/ImageMagick/policy.xml and comment out the needed file types.

OH SHIT! First I need to figure out, how to post less-then and greater-than special characters in hubzilla.
policy domain="coder" rights="read" pattern="PDF"

I only reenabled reading for PDF files, by changing the policy for pattern=PDF from rights=none to rights=read. So I allowed reading the PDF and converting to other image formats. For security reasons, writing of PDF is less of a risk than reading, so I could have changed to rights=read|write possibly without additional risk. I'm always a better safe than sorry guy.

--
An unknown source can never be trusted.
As less as possible. As much as needed.
Running a server or service comes with work to do and that's what I love about it.

Sun, 20 Mar 2022 10:30:23 +0100

Marc Hefter

marchefter@hub.march42.net

optimizing backup cronjob execution

View article

Previously I always started the cronjobs to times, when the other job should have finished. I didn't knew excactly how the jobs are executed and therefore this was the easiest.

# /etc/cron.d/backup-jobs
#min  hour  dom mon dow  user          command
5       1    *   *   *   root          /usr/local/sbin/backup_functions.sh CRON DAILY
7      13    *   *   1   root          /usr/local/sbin/backup_functions.sh CRON WEEKLY
42     21    1   *   *   root          /usr/local/sbin/backup_functions.sh CRON MONTHLY

Now I researched, to optimize the backup jobs running. I'm using Ubuntu 20.04-LTS, package cron/focal 3.0pl1-136ubuntu1.

# /etc/cron.d/backup-jobs
#min  hour  dom mon dow  user          command
@daily                   root          /usr/local/sbin/backup_functions.sh CRON DAILY
@weekly                  root          /usr/local/sbin/backup_functions.sh CRON WEEKLY
@monthly                 root          /usr/local/sbin/backup_functions.sh CRON MONTHLY

The cronjobs start time is set by shortcuts @daily, @weekly, @monthly to 00:00. Where @weekly sets dow=0, to start the job on sunday and @monthly sets dom=1, to start the job on the 1st. The jobs are started with very little delay and running simultaneously. So every sunday and every 1st there are two scripts and when the 1st is on sunday there are three script running concurently.

For now, I choose to use flock and waiting for the previous script to finish. This will not be a problem until the next 1st on a sunday, which will be 1st of May in 2022. So I don't have to worry for the next five weeks.

To finish this I have two options, with different advantages and disadvantages.
1. Order @daily, @weekly, @monthly and waiting for the previous to finish.
  * Could break on 1st is a sunday, because there would be two scripts waiting for the first to finish. Who knows, which would be the second to run.
  * In the end all three scripts would be run.
2. Order @monthly, @weekly, @daily and break, if another script is running.
  * Every day only one script would run.
  * The script must execute the other tasks, if needed.
I currently believe option 2. to be the robuster handling and therefore prefer this.

Sun, 20 Mar 2022 11:13:12 +0100

Catherine LeGrand

catherine@hub.march42.net

I have a list, of the crontab shortcuts.

#min hr  dom mon dow
# @reboot, on system startup
0    0    1   1   *     @yearly, January 1st 00:00
# @annually is an alias for @yearly
0    0    1   *   *     @monthly, every 1st 00:00
0    0    *   *   0     @weekly, every sunday 00:00
0    0    *   *   *     @daily, everyday 00:00
# @midnight is an alias for @daily
0    *    *   *   *     @hourly, every hour hr:00

Tue, 29 Mar 2022 14:14:02 +0200

Marc Hefter

marchefter@hub.march42.net

Super simple backup job.

backup to /srv/system-backup
exclude list in backup-exclude
stages list in backup-stages

configuration and constants

BACKUP_DESTINATION=/srv/system-backup
BACKUP_JOBDATE=$(/bin/date --utc +%Y%m%d)

cleanup oldest backup stages

for STAGE in $(/usr/bin/head --lines=-9 ${BACKUP_DESTINATION}/backup-stages); do
rm -fR ${BACKUP_DESTINATION}/${STAGE}
done

prepare new stage destination directory

BACKUP_LASTSTAGE=$(/usr/bin/tail --lines=1 ${BACKUP_DESTINATION}/backup-stages)
if [ ${BACKUP_LASTSTAGE} != "${BACKUP_JOBDATE}" ]; then
cp --archive --link ${BACKUP_DESTINATION}/${BACKUP_LASTSTAGE}/. ${BACKUP_DESTINATION}/${BACKUP_JOBDATE}
echo ${BACKUP_JOBDATE} >> ${BACKUP_DESTINATION}/backup-stages
fi

synchronize stage directory

[ ! -e ${BACKUP_DESTINATION}/backup-exclude ] && echo ${BACKUP_DESTINATION}/* >>${BACKUP_DESTINATION}/backup-exclude
/usr/bin/rsync --archive --delete --delete-excluded --exclude-from=${BACKUP_DESTINATION}/backup-exclude / ${BACKUP_DESTINATION}/${BACKUP_JOBDATE}/

Sat, 19 Mar 2022 08:44:24 +0100

Marc Hefter

marchefter@hub.march42.net

Sun is shining. Weather is sweet.

View article

New server

Wed, 09 Mar 2022 09:25:50 +0100

Marc Hefter

marchefter@hub.march42.net

Finally I have my new server up and running.

View article