ZioByte's questions

Sorry for the dumb question: how do I debug ip-forwarding?

My setup is as follows:

• I have a Linux SoC connected via serial line to a Linux laptop

• over that serial line I have a working PPP

  sudo pppd updetatch connect 'chat -f chatscript' noauth nocrtscts local 192.168.8.1:192.168.8.2 /dev/ttyUSB0 115200

• the laptop on the other end of the serial line has regular net connection (192.168.7.xxx)

• I added a default route on SoC pointing to the remote PPP

  ip route add default via 192.168.8.1

• I enabled ip_forward on laptop

  echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

This is not enough to have a working network though.

In order to reach the Internet I should enable NAT on laptop, but this is not my primary concern.

I checked ip-tables on laptop and they all show

`Chain [INPUT/FORWARD/PUTPUT] (policy ACCEPT 0 packets, 0 bytes)`

My real problem is I would need to route form SoC to some other machine sitting om my regular LAN (192.168.7.0/24).

I assume I need to add some sort of static route as addresses in 182.168.x.y are not routable by default.

I am stuck here as I didn't find a way to ip route add ... to make it working.

I am able to ping from SoC to Laptop and vice-versa, but nothing beyond that.

What should I add?

I have a bunch of identical, brand new HDs (4*3T, if it matters) I need to use for a single RAID5 array (Linux mdmadm).

It is still undecided if I'll use the entire combined content for a single FileSystem (ext4?) or I'll partition in several virtual drives using LVM.

RAID5 will span the full content of the disks and I don't need boot sector (booting is from another device).

In this condition is there any advantages (or disadvantages) to "traditionally partitioning" the drive with a single partition vs using the whole, unpartitioned, device as base for mdmadm assemble?

Saying the same thing in a different way: Is there any advantage in doing

mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb1 /dev/sdc1 /dev/sdd1 --spare-devices=1 /dev/sde1

versus

mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/sdb /dev/sdc /dev/sdd --spare-devices=1 /dev/sde

beside trivial loss of a few sectors in the former (which is a negligible "disadvantage")?

I have one site somewhere that's accessible on the internet as "https://site.example1.com".

I also have one another site accessible on the internet as "https://www.example2.com".

I have full control over both sites and they both have valid Certificates.

Now I want to have the first site to be accessible as a location on the second; this means that "https://www.example2.com/site" should display the contents of "https://site.example1.com".

I tried a plain:

server {
    listen 443 ssl;

    resolver 127.0.0.1 8.8.8.8;

    server_name updates.okcash.com;
    ssl_certificate /etc/letsencrypt/live/www.example2.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example2.com/privkey.pem;

    ssl_verify_client optional_no_ca;

    location /site {
        proxy_pass              "https://site.example1.com";
        rewrite                 /site/(.*) /$1     break;
        proxy_redirect          off;
        proxy_set_header        Host               $host;
    }
    location / {
        proxy_pass              "http://localhost:5001";

        proxy_connect_timeout   60;
        proxy_read_timeout      86400; # 24h
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         "upgrade";
    }
}

but this does not work well because browser (accessing "https://www.example2.com/site") is presented server certificates from backend ("https://site.example1.com") which are invalid for the request.

How can I force nginx front-end to send out its own certificates and verify backend identity on its own?

I saw this Question, but it doesn't seem to work for me.

Current (working) situation is:

server {
    listen 443 ssl;

    server_name updates.example.com;
    ssl_certificate     fullchain.pem;
    ssl_certificate_key privkey.pem;

    location /update {
        proxy_pass              "http://localhost:5000";

        proxy_connect_timeout   60;
        proxy_read_timeout      60;
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        X-Client-Subject   $ssl_client_s_dn;
        proxy_set_header        X-Client-Cert      $ssl_client_cert;
    }

    location / {
        proxy_pass              "http://localhost:5001";

        proxy_connect_timeout   60;
        proxy_read_timeout      60;
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         "upgrade";
    }

}

Now I wanted to add a prefix location to nginx redirect while leaving backend untouched.

Following the above Question's Answers I tried something along the lines:

    location /manage {
        proxy_pass              "http://localhost:5001/";

        proxy_connect_timeout   60;
        proxy_read_timeout      60;
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         "upgrade";
    }

or:

    location /manage {
        rewrite                 /manage/(.*) /$1  break;
        proxy_pass              "http://localhost:5001";
        proxy_redirect          off;

        proxy_connect_timeout   60;
        proxy_read_timeout      60;
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection         "upgrade";
    }

Actually both those "kind of" work, as the correct page is displayed, but both fail to update it via websocket. I see no error in application, but whatever I do on page does not trigger anything in backend application (a python RemI App). Apparently websocket connection is not carried over correctly.

What am I missing?

I have a bunch of clients (too many to easily retrofit) each holding a single certificate (signed by a non-standard CA over which I have no control; I just generated the CSRs).

Now I need to setup a "secured" web service where server is identified in the usual ssl (https) way and client should be identified using its certificate (Subject is already holding all info I need to uniquely identyfy client).

Unfortunately in the signing process almost all "purpose" flags have been cleared:

openssl x509 -in 57EMM020001.cer -noout -purpose 
Certificate purposes:
SSL client : No
SSL client CA : No
SSL server : No
SSL server CA : No
Netscape SSL server : No
Netscape SSL server CA : No
S/MIME signing : Yes
S/MIME signing CA : No
S/MIME encryption : No
S/MIME encryption CA : No
CRL signing : No
CRL signing CA : No
Any Purpose : Yes
Any Purpose CA : Yes
OCSP helper : Yes
OCSP helper CA : No
Time Stamp signing : No
Time Stamp signing CA : No

I assume "culprit" for "400 The SSL certificate error" is the first one: "SSL client : No".

Is there any way to tell my local nginx server (over which I have full control) to disregard these settings?

I fully understand this is "bad" in general because if a certificate was not generated for a specific purpose... well, it shouldn't be used for that purpose! but this is my, very specific, server and I feel I'm entitled to decide who I trust.

Is there some way to convince nginx to do things in a slightly looser way?

My current (not working) setup is quite simple:

server {
    listen 443 ssl;

    resolver 127.0.0.1 8.8.8.8;
    set $backend "http://localhost:5000";

    server_name updates.example.com;

    ssl_certificate /etc/ssl/certs/server.pem;
    ssl_certificate_key /etc/ssl/private/server.key;

    ssl_client_certificate /etc/ssl/certs/CAroot.cer;
    ssl_verify_client on;

    location / {
        proxy_connect_timeout   60;
        proxy_read_timeout      60;
        proxy_send_timeout      60;
        proxy_intercept_errors  off;
        proxy_http_version      1.1;
        proxy_set_header        Host               $http_host;
        proxy_set_header        X-Real-IP          $remote_addr;
        proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto  $scheme;
        proxy_set_header        X-Client-Subject   $ssl_client_s_dn;
        proxy_pass $backend;
    }    
}

Of course I checked that:

openssl verify -verbose -CAfile /etc/ssl/certs/CAroot.cer 57EMM020001.cer 
57EMM020001.cer: OK

Thanks in Advance

I have a Certificate which has been issued by a non-standard CA over which I have no control.

I generated the CSR, sent it to non-standard CA and it returned a valid Certificate.

This Certificate is normally used to sign documents I send to CA owners and they only accept documents signed with their own CA.

So far everything works as expected.

I also have CA public certificate. I would like (for testing and other purposes) to be able to verify locally MY Certificate is valid (i.e.: use some local openssl command to verify Certificate returned against CA Certificate).

Is this at all possible? If, so how?

Plain verification fails (perhaps because I have just the CA Certificate and not the whole chain):

$ openssl verify -CAfile CertificatoCA.pem 9AIN2012501.cer 
C = IT, O = Certificate Authority, OU = Nonstandard Certificate Authority, CN = 9AIN2012501
error 20 at 0 depth lookup: unable to get local issuer certificate
error 9AIN2012501.cer: verification failed

Any idea? Thanks in Advance

I understand I can have nginx to check client certificate before forwarding requests; something along the lines:

server {
    listen 443 ssl;

    server_name my.server.com;

    ssl_certificate     /etc/ssl/my.server.com.crt;
    ssl_certificate_key /etc/ssl/my.server.com.key;

    ssl_verify_client       on;
    ssl_trusted_certificate /etc/ssl/myca.pem;
    location / {
        ...
        proxy_pass http://my.backend.com:9999;
    }
    ...
}

Question is: can I extract certificate details (essentially client certificate Subject:CN) and use it to modify forwarded URL (e.g.: adding a fragment to it)?

If that's possible, how?

I have a RootFS that's a read-only SquashFS overlayed with writable storage (ext4, if it matters).

This is generally working but, after a while, one file became unaccessible:

# cat  /etc/init.d/update 
[  378.714771] overlayfs: failed to get inode (-151)
[  378.719636] overlayfs: failed to get inode (-151)
cat: can't open '/etc/init.d/update': Stale NFS file handle

It seems error is in the directory entry, since i get errors even with plain ls:

# ls  /etc/init.d/update 
[ 1256.618431] overlayfs: failed to get inode (-151)
[ 1256.623489] overlayfs: failed to get inode (-151)
ls: /etc/init.d/update: Stale NFS file handle

This error seems to survive reboot.

This specific file was edited, so I have two versions, one on the "lower" SquashFS and one on the "upper" ext4; both are accessible using the respective mount points: the error seems to come from OverlayFS itself.

I seem unable to clean this error (and I'm scared because this system should go in production 24/7), I already ran fsck -fp on all affected systems (not on SquashFS, of course).

Any hint welcome.

Note: I don't have (and don't need) NFS; I assume they reused this errno (151), but I don't know.

UPDATE: I was able to clear the error by manually deleting the "new" copy of the file from the "upper" directory; subsequent editing of the same file worked as expected.

I'm very scared and I would like to understand what happened (and make sure it won't happen again in "production"!).

UPDATE2: I am using defaults for OverlayFS in my kernel v5.7, should I select more options?

   <*> Overlay filesystem support
   [ ] Overlayfs: turn on redirect directory feature by default
   [*] Overlayfs: follow redirects even if redirects are turned off
   [ ] Overlayfs: turn on inodes index feature by default
   [ ] Overlayfs: turn on metadata only copy up feature by default

I have a fully working (for this part) embedded system based on a rather ancient, vendor-modified, Linux v3.18.29.

To solve other problems I am in the process of upgrading everything to current u-boot/kernel/Buildroot.

Everything seems to work, but I have problems with hot-plugging devices.

I remember I had some problems setting up input handling on the old system, but I can't remember exactly what they were (after several years).

I have full sources and I can successfully rebuild both old and new system, but I could not spot relevant differences (_defconfig's changed enough a simple diff won't give understandable results).

Old system was relying solely on devtmpfs, I tried that and also mdev on new, but apparently mdev is never called (at least it does not log in /dev/mdev.log)

I have UEVENT_HELPER=y, UEVENT_HELPER_PATH=/sbin/hotplug, EVENTFD=y, HAVE_PERF_EVENTS=y, INPUT=y, INPUT_EVDEV=y.

Primary usage of this would be to connect a USB barcode scanner in "keyboard emulation" to system.

In particular I need creation of character device /dev/input/event0

Can someone suggest what I should check/enable/whatever?

Update: A bit of details:

• Hardware is based on a tiny SoM "Vocore2" sporting :
  • mips32 cpu (MT7628)
  • 128M RAM
  • Integrated WiFi b/g/n
  • 100baseT Ethernet MAC
  • Integrated 5 Port Ethernet
  • 16M SPI NOR
  • SD card (currently 8G)
  • USB2 master
  • 3 x Serial (3wire)
• Software is:
  • U-Boot (mips-next from git)
  • Linux v5.5 (just one patch to have fully working SD)
  • Buldroot 2020.02 (plus a few custom packages)
  • Application (written in python3)
  • Most of basic Unix utilities are provided by Busybox, in particular:
    • There is no udevd, substitute is Busybox mdev

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.

I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for casual user.

We currently have schemes with "strong passwords" changed on regular basis and many users are complaining.

I am wondering if replacing passwords with HOTP (possibly google-authenticator, supported by google-authenticator-libpam) would result in lower security than our present scheme.

Question is:

Using google-authenticator-libpam is considered more or less secure than password (8 chars, mixed case, numeric & special chars)?

If viable, what are pitfalls (if any)?

I have a registered domain with my name.

I want to have multiple servers, with different names, hosted on the same physical host.

This is easy to do using reverse proxy (I am currently using nginx). Problem is I need to configure DNS on my provider site for each and every site I set-up; this is inconvenient.

Is there some way to say to DNS there's a "default" IP for the whole domain? I would like to tell DNS "if domain is XXX.yy and you can't find a better fit then default to xxx.xxx.xxx.xxx".

Is this possible? If so how?

In a brand new installation of Redmine 3.4.2.stable (under Centos7/Passenger/NginX, if that matters; I can give the whole setup, if requested) I added two more "Issue priorities": "Postponed" and "Background" which should be lower than "Low".

This is how I see the page after creation ("Postponed" and "Background" have highest priority):

I can reorder priorities as follows:

... but I see no way to save the change and, unsurprisingly, if I reload the page order returns back to the original one.

Also in "Issues" page, when sorting according to Priority, Redmine shows "Background" at top.

What am I missing?

What should I check?

I currently have an office network revolving essentially around three services, all hosted under Linux:

• Shared storage area served via Samba.
• Mail Web/IMAP handled by Zimbra.
• Project management/bugtracking handled by RedMine.
• Other, smaller, services are available (e.g.: git repo).

All these are actually self hosted into a set of managed VMs.

Clients may be local, over the internet (for web services) or remoted via VPN.

Clients are either windows (the majority) or linux.

Currently all services have independent user/pass management and this, coupled with need to periodically change passwords is rapidly leading to a nightmare as user base enlarges (currently I have ~100 users).

Is there some way to manage a Single Sign-on for these (few, bit different) services?

Optimal would be to have a single Authentication Server where each user can manage a dingle password for all services and Administrator can assign (rather specific, at least as Samba and Git are concerned) privileges to users.

Does such system exist?

I am aware some very big services (e.g.: google) can provide authentication for other (mainly web) services, but I'm unsure if this can be scaled down to a single (relatively) Small Office.

I need to know if current date/time is reliable in a small embedded Linux system Busybox-based.

I have Busybox ntpd running, but apparently there is no program to to query status.

On a more conventional Linux installation I would use ntpdc, ntpq, ntpstat or even timedatectl, but none of these is available on this Busybox/Buildroot system.

What else can I do?

I am trying to convert an old infrastructure featuring several webservers into a virtualized environment with a single public IP address.

All servers are relatively low-traffic, so performance isn't an issue.

I currently have nginx installed directly on my firewall/bastion-host reverse proxying to a few servers (three, at the moment).

I have everything working with plain HTTP.

My current HTTP configuration is (simplified):

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen 80;
        server_name mydom.com www.mydom.com;
        location / {
            proxy_pass http://192.168.99.20:80;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    server {
        listen 80;
        server_name redmine.mydom.com git.mydom.com;
        location / {
            proxy_pass http://192.168.99.30:80;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    server {
        listen 80;
        server_name mail.mydom.com email.mydom.com webmail.mydom.com;
        location / {
            proxy_pass http://192.168.99.10:80;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

Question is: How should I configure nginx to forward HTTPS/SSL?

I tried something along the lines:

server {
    listen       443 ssl;
    server_name mydom.com www.mydom.com;
    location / {
        proxy_pass https://192.168.99.20;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

but this does not work for lack of ssl_... stanzas.

The "real" (proxyed) servers already have their certificates, but nginx seems to need "local" certificates (which I wouldn't like to provide).

What is "best practice" in this usage case?

NOTE: as said I need to deploy the reverse-proxy on my firewall (IPFire) so I'm rather limited in my choices; nginx and haproxy are supprted, sniproxy isn't.

On a local workstation I need to have a handful of users to be able to freely write in each other $HOME.

I KNOW this is a security breach and, in the specific situation, I do not care at all.

I have another server (not local to LAN) used mainly as SCM repo. The above mentioned users access server via ssh.

Unfortunately OpenSSH server does not like writable $HOMEs and I found no way to circumvent it (I expected to have some server-side param).

Can someone suggest a workaround?

I seem unable to activete Issue editing.

I am aware of [[http://www.redmine.org/projects/redmine/wiki/RedmineIssues#Editing-an-existing-issue]], but something is wrong.

I am Manager on the project (same behavior even if I login as "admin") and I checked it includes the "Edit Issues" permission. In spite of that the "(more)" link does never appear.

Another (maybe significant) deviation from standards is I do _not_ have the "Update" link; I have an "Edit" link instead. Complete list of links is (note missing "Duplicate" and "Move"):

Feature #2                      Edit Log time Watch Copy Delete

What am I doing wrong?

Any specific setting to check?

My installation is as follows:

root@redmine www/redmine# RAILS_ENV=production script/about

sh: 1: darcs: not found
sh: 1: cvs: not found
Environment:
  Redmine version                2.6.1.stable
  Ruby version                   1.9.3-p194 (2012-04-20) [x86_64-linux]
  Rails version                  3.2.21
  Environment                    production
  Database adapter               Mysql2
SCM:
  Subversion                     1.6.17
  Mercurial                      2.2.2
  Bazaar                         2.6.0
  Git                            1.7.10.4
  Filesystem
Redmine plugins:
  redmine_dmsf                   1.4.9 stable
root@redmine www/redmine#

TiA Mauro

I am trying to migrate an oldish installation:

Environment:
  Redmine version                          2.2.3.stable
  Ruby version                             1.9.3 (x86_64-linux)
  Rails version                            3.2.12
  Environment                              production
  Database adapter                         Mysql2
Redmine plugins:
  no plugin installed

to a new machine:

Environment:
  Redmine version                2.6.1.stable
  Ruby version                   1.9.3-p194 (2012-04-20) [x86_64-linux]
  Rails version                  3.2.21
  Environment                    production
  Database adapter               Mysql2
SCM:
  Subversion                     1.6.17
  Mercurial                      2.2.2
  Bazaar                         2.6.0
  Git                            1.7.10.4
  Filesystem                     
Redmine plugins:
  redmine_dmsf                   1.4.9 stable

I did a simple backup on old server:

root@redmine www/redmine# /usr/bin/mysqldump -u root -p"...redmine" redmine_production | gzip > redmine_`date +%y_%m_%d`.gz
root@redmine www/redmine# tar cjf files.tar.bz2 files

and tried to restore it in the new (working, but empty) machine:

root@redmine ~# cd /var/www/redmine/
root@redmine www/redmine# scp mcon@syno0:files.tar.bz2 .
files.tar.bz2                                         100% 4229     4.1KB/s   00:00
root@redmine www/redmine# scp mcon@syno0:redmine_15_02_12.gz .
redmine_15_02_12.gz                                   100%   11KB  11.2KB/s   00:00

*** here Redmine server is STILL working ***

root@redmine www/redmine# service apache2 stop
[ ok ] Stopping web server: apache2 ... waiting .
root@redmine www/redmine# tar xjf files.tar.bz2
root@redmine www/redmine# zcat redmine_15_02_12.gz | mysql --user=root --password=...redmine     redmine_production
root@redmine www/redmine# rake db:migrate
==  Setup: migrating ==========================================================
-- create_table("attachments", {:force=>true})
   -> 0.0082s
-- create_table("auth_sources", {:force=>true})
   -> 0.0043s
-- create_table("custom_fields", {:force=>true})
   -> 0.0041s
-- create_table("custom_fields_projects", {:id=>false, :force=>true})
   -> 0.0043s
-- create_table("custom_fields_trackers", {:id=>false, :force=>true})
   -> 0.0037s
-- create_table("custom_values", {:force=>true})
   -> 0.0049s
-- create_table("documents", {:force=>true})
   -> 0.0041s
-- add_index("documents", ["project_id"], {:name=>"documents_project_id"})
   -> 0.0127s
-- create_table("enumerations", {:force=>true})
   -> 0.0052s
-- create_table("issue_categories", {:force=>true})
   -> 0.0036s
-- add_index("issue_categories", ["project_id"], {:name=>"issue_categories_project_id"})
   -> 0.0158s
-- create_table("issue_histories", {:force=>true})
   -> 0.0191s
-- add_index("issue_histories", ["issue_id"], {:name=>"issue_histories_issue_id"})
   -> 0.0143s
-- create_table("issue_statuses", {:force=>true})
   -> 0.0046s
-- create_table("issues", {:force=>true})
   -> 0.0045s
-- add_index("issues", ["project_id"], {:name=>"issues_project_id"})
   -> 0.0149s
-- create_table("members", {:force=>true})
   -> 0.0062s
-- create_table("news", {:force=>true})
   -> 0.0052s
-- add_index("news", ["project_id"], {:name=>"news_project_id"})
   -> 0.0139s
-- create_table("permissions", {:force=>true})
   -> 0.0044s
-- create_table("permissions_roles", {:id=>false, :force=>true})
   -> 0.0059s
-- add_index("permissions_roles", ["role_id"], {:name=>"permissions_roles_role_id"})
   -> 0.0168s
-- create_table("projects", {:force=>true})
   -> 0.0582s
-- create_table("roles", {:force=>true})
   -> 0.0045s
-- create_table("tokens", {:force=>true})
   -> 0.0044s
-- create_table("trackers", {:force=>true})
   -> 0.0037s
-- create_table("users", {:force=>true})
   -> 0.0048s
-- create_table("versions", {:force=>true})
   -> 0.0112s
-- add_index("versions", ["project_id"], {:name=>"versions_project_id"})
   -> 0.0428s
-- create_table("workflows", {:force=>true})
   -> 0.0059s
==  Setup: migrated (0.4712s) =================================================

**** MANY LINES, APPARENTLY WITHOUT ERROR ****

==  ChangeChangesetsCommentsLimit: migrating ==================================
-- change_column(:changesets, :comments, :text, {:limit=>16777216})
   -> 0.0081s
==  ChangeChangesetsCommentsLimit: migrated (0.0085s) =========================

==  AddPasswordChangedAtToUser: migrating =====================================
-- add_column(:users, :passwd_changed_on, :datetime)
   -> 0.0104s
==  AddPasswordChangedAtToUser: migrated (0.0108s) ============================

==  InsertBuiltinGroups: migrating ============================================
==  InsertBuiltinGroups: migrated (0.1441s) ===================================

root@redmine www/redmine# service apache2 start
[ ok ] Starting web server: apache2.
root@redmine www/redmine#

After this Redmine is no longer working. Attempts to connect results in:

Internal error

An error occurred on the page you were trying to access.
If you continue to experience problems please contact your Redmine administrator for assistance.

If you are the Redmine administrator, check your log files for details about the error.

Back

And I get the following log:

...
Connecting to database specified by database.yml
Creating scope :system. Overwriting existing method Enumeration.system.
Creating scope :sorted. Overwriting existing method User.sorted.
Creating scope :sorted. Overwriting existing method Group.sorted.
Started GET "/" for 192.168.7.114 at 2015-02-12 14:41:57 +0000
Processing by WelcomeController#index as HTML
  Current user: admin (id=1)
Completed 500 Internal Server Error in 75.0ms

NoMethodError (undefined method `passwd_changed_on' for #<User:0x00000006696f80>):
  app/controllers/application_controller.rb:150:in `force_logout_if_password_changed'

What am I doing wrong?

I need a stable configuration, presumably using ntpd, to keep system clock as precise as possible.

Background: I have several embedded devices (arm9) running linux (currently: 3.16.1 / debian 7.2) that are powered up at random intervals (some may be up 24/7, but others may be up only a few hours/week); they may or may not be connected to the Internet (each station is likely to have an intermittent connection). Hardware includes a passable RTC (drifts a few sec/week), while system clock seems much worse (at least one order of magnitude).

Constraint (IMPORTANT): System time should be strictly monotonic (i.e.: adjustments may slow the clock but should never jump back).

What I would like to do is to use the RTC to keep SystemClock stable and, if connection is available, some external NTP server to correct RTC drift.

Can this be done with stock software? What's the "best practice" in this situation?

I am aware of clock, hwclock, adjtimex, chrony and a few other programs, but they do not seem to do what I need. Did I miss something?