acgbox's questions

I run myscript.sh scheduled in the root crontab and I need it to detect the non-root user (with which the system starts).

I have tried these variants:

local_user=${who -m | awk '{print $1;}'}

local_user=${logname 2>/dev/null || echo $SUDO_USER}

local_user=$(logname)

local_user=$(ps -o user= -p $$)

local_user=${SUDO_UID:-$(id -u)}

local_user=$(id -u $(logname))

if [ "$EUID" -eq 0 ]; then
   local_user=$SUDO_USER
else
   local_user=$(whoami)
fi

# or

if [ -n "$SUDO_USER" ]; then
     local_user="$SUDO_USER"
else
     local_user="$(whoami)"
fi

The only ones that work are:

local_user=${SUDO_USER:-$(whoami)}
local_user=${SUDO_USER:-$USER}

but they only work if I run the script manually, either with sudo or from root account, but it doesn't work in crontab root.

example:

#!/bin/bash
local_user=${SUDO_USER:-$(whoami)}
echo "my user is $local_user" | tee /var/log/syslog

# run crontab
*/1 * * * * /home/user/test/test.sh
my user is root

# run manual
root@foo:/home/user/test# ./test.sh 
my user is user

any idea?

PD: ubuntu 22.04

Update: solved!

I found here: https://unix.stackexchange.com/a/617686/266428

local_user=$(ps -eo user,uid | awk 'NR>1 && $2 >= 1000 && ++seen[$2]==1{print $1}')

or

local_user=$(who | head -1 | awk '{print $1;}')

The glances program tells that a google chrome page consumes 1.10 TB virtual memory and my PC does not have this capacity (RAM + Hard Drive).

About this, quora explains the following: "virtual memory can exceed physical memory. Virtual memory is a system memory management technique that allows a program to use more memory than is physically available on the computer by temporarily transferring data to disk storage. This allows the program to continue running even if all physical memory is in use."

case concrete: If the PC has 16 GB RAM + 500 GB SSD, is it possible that the virtual memory, in a single process, can exceed the physical memory and reach 1.10 TB?

Thk

• I have 2 netcards enp0s3 for WAN and enp0s8 for LAN.
• WAN has dynamic IP address (received from ISP).
• LAN has class C static IP address for my local network
• I have isc-dhcp-server with this config:

nano /etc/dhcp/dhcpd.conf

# ISC-DHCP-Server Configuration
authoritative;
option wpad code 252 = text;
server-identifier 192.168.0.10;
deny duplicates;
one-lease-per-client true;
deny declines;
deny client-updates;
ping-check true;
log-facility local7;
ddns-update-style none;


    host user3 {
    hardware ethernet 40:e2:30:f4:00:04;
    fixed-address 192.168.0.90;
    }

    host user1 {
    hardware ethernet 40:e2:30:f4:00:02;
    fixed-address 192.168.0.50;
    }

class "blockdhcp" {
     match pick-first-value (option dhcp-client-identifier, hardware);
    }
    subclass "blockdhcp" 1:90:68:c3:00:00:00;

subnet 192.168.0.0 netmask 255.255.255.0 {
    option routers 192.168.0.10;
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.0.255;
    #option domain-name "example.org";
    option domain-name-servers 8.8.8.8,8.8.4.4;
    min-lease-time 2592000; # 30 days
    default-lease-time 2592000; # 30 days
    max-lease-time 2592000; # 30 days
    pool {
        min-lease-time 60;
        default-lease-time 60;
        max-lease-time 60;
        deny members of "blockdhcp";
        range 192.168.0.100 192.168.0.250;
    }
}

The problem is that the isc-dhcp-server is showing error messages No subnet declaration for enp0s3 (10.0.2.15) because it asks me to assign a range for WAN, and this is not possible because it is dynamic and the ISP provider can eventually change the IP

sudo systemctl status isc-dhcp-server
● isc-dhcp-server.service - ISC DHCP IPv4 server
     Loaded: loaded (/lib/systemd/system/isc-dhcp-server.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2023-01-18 18:29:32 -05; 7min ago
       Docs: man:dhcpd(8)
   Main PID: 17055 (dhcpd)
      Tasks: 4 (limit: 19112)
     Memory: 4.9M
        CPU: 24ms
     CGroup: /system.slice/isc-dhcp-server.service
             └─17055 dhcpd -user dhcpd -group dhcpd -f -4 -pf /run/dhcp-server/dhcpd.pid -cf /etc/dhcp/dhcpd.conf

ene 18 18:29:32 uservm dhcpd[17055]: Sending on   LPF/enp0s8/08:00:27:8d:e7:c9/192.168.0.0/24
ene 18 18:29:32 uservm dhcpd[17055]: 
ene 18 18:29:32 uservm dhcpd[17055]: No subnet declaration for enp0s3 (10.0.2.15).
ene 18 18:29:32 uservm dhcpd[17055]: ** Ignoring requests on enp0s3.  If this is not what
ene 18 18:29:32 uservm dhcpd[17055]:    you want, please write a subnet declaration
ene 18 18:29:32 uservm dhcpd[17055]:    in your dhcpd.conf file for the network segment
ene 18 18:29:32 uservm dhcpd[17055]:    to which interface enp0s3 is attached. **
ene 18 18:29:32 uservm dhcpd[17055]: 
ene 18 18:29:32 uservm dhcpd[17055]: Sending on   Socket/fallback/fallback-net
ene 18 18:29:32 uservm dhcpd[17055]: Server starting service.

How do I avoid this situation so that these error messages that flood the log no longer appear? Thanks in advance

I have this bash script of ipset v7.15 (run in ubuntu 22.04), courtesy of Martin (that I have made some modifications for this question):

ipset create -! blacklist hash:net family inet hashsize 1024
ipset save -! > /tmp/ipset.txt

cat list.txt | sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n -k 5,5n -k 6,6n -k 7,7n -k 8,8n -k 9,9n | while read line; do
    echo "add blacklist $line" >> /tmp/ipset.txt
done
ipset restore -! < /tmp/ipset.txt

content of list.txt:

125.74.0.0/15
1.0.132.249
125.73.0.0/16
130.255.128.0/20
125.76.0.0/17

out /tmp/ipset.txt:

create blacklist hash:net family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xf164f1c6
add blacklist 1.0.132.249
add blacklist 125.73.0.0/16
add blacklist 125.74.0.0/15
add blacklist 125.76.0.0/17
add blacklist 130.255.128.0/20

out ipset -L (the problem):

sudo ipset -L
Name: blacklist
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xf164f1c6
Size in memory: 696
References: 0
Number of entries: 5
Members:
125.74.0.0/15
1.0.132.249
125.73.0.0/16
130.255.128.0/20
125.76.0.0/17

As you can see, the IPs/CIDRs in the blacklist output are messed up (no sort).

Ipset has this option:

-s, -sorted
Sorted output. When listing or saving sets, the entries are listed sorted.

But I tried it with the following command and the output is the same (without sort. Maybe I'm not using it correctly):

ipset restore -! -s < /tmp/ipset.txt

And if I remove -! option from the restore command, I get the following error:

ipset v7.15: Error in line 1: Set cannot be created: set with the same name already exists

So, i think my script has an error, since it adds a line that I think shouldn't be there:

create blacklist hash:net family inet hashsize 1024 maxelem 65536 bucketsize 12 initval 0xf164f1c6

then I can remove the save line to avoid the error, leaving it like this:

ipset -! create blacklist hash:net family inet hashsize 1024
cat list.txt | while read line; do
    echo "add blacklist $line" >> /tmp/ipset.txt
done
ipset -s restore -f /tmp/ipset.txt

But the output remains the same, no-sort, when I run ipset -L, so the -sorted (-s) option is not working in restore

How can I fix this so that the output is organized?

i have this loop to block IPs and CIDR with ipset/iptables:

# this is just an example. the actual list IPs/CIDR is very large
cat blockip.txt
13.31.0.254
cat blockcidr.txt
13.32.0.0/15

Loop:

#!/bin/bash
ipset -F
ipset -N -! blacklist hash:net maxelem 1000000
for ip in $(cat blockip.txt blockcidr.txt); do
    ipset -A blacklist $ip
done
iptables -A FORWARD -m set --match-set blacklist dst -j DROP

Note: I have always used the ipset -A option, but I don't know exactly what this option means, since it does not appear in "Man Ipset", and at this point, I'm assuming that add is the same as -A, since the output in both cases is the same.

#!/bin/bash
ipset -F
ipset -N -! blacklist hash:net maxelem 1000000
for ip in $(cat blockip.txt blockcidr.txt); do
    ipset add blacklist $ip -q
done
iptables -A FORWARD -m set --match-set blacklist dst -j DROP

out both cases:

sudo ipset -L
Name: blacklist
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0xbc0136c8
Size in memory: 552
References: 0
Number of entries: 2
Members:
13.31.0.254
13.32.0.0/15

"It works fine", but I have read that adding the IPs and CIDR with ipset -A is very slow. Which is faster using ipset save and restore. But I don't understand how works, And my attempt is failed:

Note: I have not found an explanation of why it is faster to use the save/restore options, instead of add or -A

#!/bin/bash
ipset -F
ipset -N -! blacklist hash:net maxelem 1000000
for ip in $(cat blockip.txt blockcidr.txt); do
    ipset add blacklist $ip # ??
    ipset save blacklist -f newblacklist.txt # ???
done
ipset restore -! < newblacklist.txt # ??
iptables -A FORWARD -m set --match-set blacklist dst -j DROP # ??

out:

sudo ipset -L
Name: blacklist
Type: hash:net
Revision: 7
Header: family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0xcb0e583b
Size in memory: 552
References: 0
Number of entries: 2
Members:
13.32.0.0/15
13.31.0.254

cat newblacklist.txt # out wrong
create blacklist hash:net family inet hashsize 1024 maxelem 1000000 bucketsize 12 initval 0xcb0e583b
add blacklist 13.32.0.0/15
add blacklist 13.31.0.254

I would appreciate any help (with a complete answer, including the proposed loop or corrections to my loop)

This is "myfolder":

tree -a 'myfolder'
myfolder
├── 20220902
│   ├── filefoo
│   └── filebar
├── 20221001
│   ├── filefoo
│   └── filebar
└── 20221015
    ├── filefoo
    ├── filebar
    └── filexyz
  etc...

my command:

find $folder/$(date +"%Y%m"*) -type f | xargs -I {} awk '/^total:/{sub(".*/", "", FILENAME); print FILENAME" "$NF}' {})

Problem: i need exclude weekends. How do I do it?

PD: I know that in bash/awk it is

%u The weekday as a decimal number (1–7). Monday is day one.

thanks

Update Solved!

I found the answer in stackoverflow HERE

I have read many HowTo's, e-books, internet pages, etc, about the use of ACLs in programs like iptables, squid, etc. on linux In the examples, they use the following file extensions:

file.lst
file.acl
file.txt
file (no extension)

In the examples, the content of the ACLs is varied (urls, IP addresses, MAC addresses, etc.)

question: On linux, what are the recommended extension for access control lists ACLs for these purposes and for these contents?

thanks in advanced

I have myfolder with this files:

ls myfolder
filefoo filebar filefoobar

For example, the content of filefoo is:

total: 379400041
cache_object://localhost/active_requests    379400041       6778    0-13955161 0-14111309 0-12250718 0-11422369 0-11901178 0-11781835 0-12687756 0-17663930 5-110207691 6-123940805 2-39477289 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0 0-0
bla bla bla

Note: the rest of the files have the same internal structure, but the numbers change

So the value I'm interested in extracting from these files is "total: number". this value is always in the first row of each file:

find myfolder -type f -exec awk '/^total:/{print $NF}' {} +
379400041
35402285
8589934592

And I should compare it with this variable:

max="1073741824"

So what I need is that if any of these values exceeds the $max variable (value > $max), it should output the file to an output list. Example (non-functional):

if (( "value" > "$max" )); then
# or if [ "value" -gt "$max" ]; then
    the command to send the file to a list is missing > output.lst
 else
    echo "do nothing"
fi

expected output:

cat output.lst
filefoobar

Because filefoobar has 8589934592 and this value > $max

How to do that? thanks

I need to disable the following lines in the java.security file (java 8 SE):

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
   DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
   include jdk.disabled.namedCurves

Image in Windows.

Windows path: Program Files\Java\jre1.8.0_301\lib\security\java.security

The purpose of disabling these lines is to avoid the following error message:

Error: javax.net.ssl.SSLHandshakeException: No appropriate protocol 
(protocol is disabled or cipher suites are inappropriate)

And the solution proposal published here (which is to comment on these lines).

I'm not sure if putting a comment at the beginning of the line (#) will disable them for both operating systems. Because this oracle document say is //

whichever one is used to comment out the lines, I also don't know if it is necessary to comment out all 3 lines, or just commenting out the first disables all 3. Example:

this way:

# jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
   DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
   include jdk.disabled.namedCurves

or that way?

# jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
#   DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
#   include jdk.disabled.namedCurves

Question:

How to comment out (disable) the previous lines in java.security file on Windows and Linux to avoid "Error: javax.net.ssl.SSLHandshakeException", or someone explain to me if there is another solution, different from the one published

This is my case. I have a .war that I execute with java and it only works inside its folder:

cd /opt/myappdir/
java -jar myapp.war

Note: It does not work like that:

java -jar /opt/myappdir/myapp.war

I have created a bash script (sudo /opt/myappdir/run.sh) to launch this command

#!/usr/bin/env bash
cd /opt/myappdir/
java -jar myapp.war

So far everything works. Now the problem:

I want to launch it from a shortcut on my desktop. This is my desktop shortcut to start myapp war

[Desktop Entry]
Encoding=UTF-8
Version=1.0
Name=MyApp
Comment=Run MyApp
Type=Application
Exec=/opt/myappdir/run.sh
Icon=/opt/myappdir/myapp.ico
Path=/opt/myappdir/
Terminal=false

But since myapp.war needs to be run with sudo and inside the myappdir I modified my run.sh script as follows

#!/usr/bin/env bash
cd /opt/myappdir/
dir=$(dirname $(readlink -m $BASH_SOURCE))
pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY QT_X11_NO_MITSHM=1 java -jar myapp.war

Why line with dir=$(dirname $(readlink -m $BASH_SOURCE))?

because I need to make sure myapp.war is running inside myappdir

Why line with pkexec?

because when double clicking the desktop shortcut java needs to be run with sudo

out:

Error: Unable to access jarfile myapp.war

someone Here offers a solution to a similar question, but it didn't work for me. (Modifying the proposal:)

#!/usr/bin/env xdg-open
[Desktop Entry]
Version=1.0
Type=Application
Terminal=false
Exec=java -jar 'myapp.war'
Path=/opt/myappdir/
Name=myapp
Comment=myapp
Icon=/opt/myappdir/myapp.ico

how can i fix my run.sh script to run myapp.war with sudo inside myappdir, and call it from desktop shortcut? Thanks

Update

According to what someone explains HERE, pkexec does not run in the same directory (I guess that's the reason why it can't find myapp.war file). So the solution could be to run a command that would force it into the directory to run java, but I've tried and failed

I use the 7zSFX Builder program to build my executable .exe from a .7z and even though I always select English in the settings (and everything else), the properties of the executable show Russian.

7zSFX Builder was abandoned and is no longer supported, so I will not get a response from the creator or the forum. So i tried with 7zSFX Constructor, 7-ZIP SFX Maker, and Make SFX, but they don't allow adding or editing information to the executable's properties.

Here it say using Resource hacker. But the problem with this editor (no updates since 2020) is that it does not work for files larger than 1 GB (System Error. Code: 8). I tried with ResEdit, but this editor corrupts files of that size. I managed to change the language only with the Resource Turner

To avoid using 3rd party programs, is there any way to fix 7zSFX Builder issue, so that I can build my .exe with the English language? Thanks

My iptables script contains many rules. Every time it runs, it flushes the old rules and reloads them so they don't stack. But since it takes a long time to run, I want to create a separate script to run only this rule.

   myacl=$(cat list.txt)
   for string in `echo -e "$myacl"`; do
     iptables -A FORWARD -m string --string "$string" --algo bm -j DROP
   done

So, what I need is to reload this rule, so that it takes the changes I made in "list.txt", but does not affect the rest of the iptables rules, which in another script were already loaded and running.

PD: someone HERE says that with "iptables -D". Example:

    myacl=$(cat list.txt)
    for string in `echo -e "$myacl"`; do
       iptables -D FORWARD -m string --string "$string" --algo bm -j DROP
       iptables -A FORWARD -m string --string "$string" --algo bm -j DROP
    done

But this solution I don't think will work and it is strange to me

Thanks

The program.run I'm trying to run:

• Asks 2 questions that need the answer "y"
• Asks a third question at the end which is "press any key to exit"

In addition, it doesn't have the "-y" option. Only this options:

FreeFileSync installation parameters:
-h, --help    Show help
--directory   Change installation directory e.g. --directory /opt/FFS
--noshortcuts  Don't create desktop shortcuts

And neither of these commands work:

yes | sudo ./program.run
yes y | sudo ./program.run
sudo sh -c 'yes y | ./program.run'
echo y | sudo ./program.run
# etc, etc

Since the "yes" command does not seem to work, I would like to try anything else

In this answer, say: "a .run command is simply a set of commands that are going to be run by sh. A particular .run file might take a -y option but in general you can't count on it. If you need to automate some stuff, consider using Expect".

But I don't know how to use Expect. Some help?

Distro: Ubuntu Mate 20.04 LTS

Bash 5.0.17(1)-release (x86_64-pc-linux-gnu)

Update:

I have posted this issue on the official site and the developers announced that in the next version they will add the parameter:

./program.run --accept-license

what is the correct syntax to declare ports in squid?

In Squid official says (edited):

acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
acl Safe_ports port 563     # snews

But debian says:

acl Safe_ports port 443 563     # https, snews

Question: I would like to know if the following rules would be correct. Example:

acl Safe_ports port 80 21 443 563 1025-65535
acl SSL_ports port 80 21 443 563 1025-65535

Thanks in advanced

Update question about whatsapp ports:

According to official facebook:

5222
443

According to screwloose:

TCP: 4244,5222,5223,5228,5242
TCP/UDP: 50318,59234
UDP: 3478,45395

According to quora:

TCP Ports; 80, 443, 4244, 5222, 5223, 5228, 5242, 50318, 59234
UDP Ports: 3478, 45395, 50318, 59234

According to user github:

TCP = 80, 443, 4244, 5060, 5061, 5222, 5223, 5228, 5282
UDP = 5060-5061, 5242, 9785, 40000-60000

According to netify:

TCP 5349
UDP 3478

According to "someone on the internet":

TCP 4244:5242

as I see it, there is no unification of criteria.

Question: What are the real TCP/UDP ports used by WhatsApp (sending/receiving messages and voice/video calls)

I have this rule to block extensions:

acl bl_ext url_regex -i "/path_to/bl_ext.txt"
http_access deny workdays bl_ext

Example content file "bl_ext.txt":

\.avi([a-zA-Z][0-9]*)?(\?.*)?$
\.m4a([a-zA-Z][0-9]*)?(\?.*)?$
\.m4r([a-zA-Z][0-9]*)?(\?.*)?$
\.m4v([a-zA-Z][0-9]*)?(\?.*)?$
\.mid([a-zA-Z][0-9]*)?(\?.*)?$
\.mov([a-zA-Z][0-9]*)?(\?.*)?$
\.mp3([a-zA-Z][0-9]*)?(\?.*)?$
\.mp4([a-zA-Z][0-9]*)?(\?.*)?$
\.mpeg4([a-zA-Z][0-9]*)?(\?.*)?$
\.mpeg([a-zA-Z][0-9]*)?(\?.*)?$
\.mpegps([a-zA-Z][0-9]*)?(\?.*)?$
\.mpg([a-zA-Z][0-9]*)?(\?.*)?$
#etc, etc, etc

And this rule to block mime_type:

acl bl_mt rep_mime_type -i "/path_to/bl_mt.txt"
http_reply_access deny bl_mt

Example content file "bl_mimetype.txt":

^audio/mp4$
^audio/mpeg$
^audio/wav$
^audio/.wma$
^audio/x-midi$
^audio/x-mp3$
^audio/x-mp4$
^audio/x-mpeg$
^audio/x-mpegurl$
^audio/x-ms-wma$
^audio/x-pn-realaudio$
^audio/x-pn-realaudio-plugin$
^audio/x-scpls$
^audio/x-wav$
^video/
^video/3gpp$
^video/avi$
^video/flash$
^video/flv$
^video/mp4$
^video/mpeg$
^video/mpeg4$
^video/ogg$
# etc, etc, etc

But these rules don't work. According to the analysis I have done, it seems that Squid is unable to block extensions when it is https encrypted traffic (http only)

PD: Additionally I tried with these rules that I found on the internet and neither:

acl video rep_header Content-Type video\/.*
acl audio rep_header Content-Type audio\/.*
http_reply_access deny video
http_reply_access deny audio

and:

acl mediapr urlpath_regex \.(avi|mp4|mov|m4v|mkv|flv|mpg|mpeg|wmv|rmvb|afx|asf|swf)(\?.*)?$
acl mediaprapp url_regex dvrplayer mediastream ^mms://
http_access deny mediapr mediaprapp
# Media Streams
acl media rep_mime_type ^application/x-shockwave-flash$
acl media rep_mime_type ^video/x-ms-asf$
acl media rep_mime_type ^application/vnd.ms.wms-hdr.asfv1$
acl media rep_mime_type ^application/x-mms-framed$
acl media rep_mime_type ^audio/x-pn-realaudio$
acl media rep_mime_type ^video/
acl media rep_mime_type ^video\/
acl media rep_mime_type ^application/x-shockwave-flash
acl media rep_mime_type ^application/vnd.ms.wms-hdr.asfv1
acl media rep_mime_type ^application/x-fcs
acl media rep_mime_type ^application/x-mms-framed
acl media rep_mime_type ^video/x-ms-asf
acl media rep_mime_type ^audio/mpeg
acl media rep_mime_type ^audio/x-scpls
acl media rep_mime_type ^video/x-flv
acl media rep_mime_type ^video/mpeg4
acl media rep_mime_type ms-hdr
acl media rep_mime_type x-fcs
acl media rep_mime_type mms
acl media rep_mime_type x-ms-asf
acl media rep_mime_type video/flv
acl media rep_mime_type video/x-flv
http_reply_access deny media

But nothing happen

Is there any way to block file mime_type file extensions in Squid in proxy-cache mode (not transparent - intercept) coming over https (without using SSL Bumping)?. thanks

PD: If this definitely has to be done with SSL Bump, then I can't. And I wonder if there is another alternative or another program (like a ipset, fail2ban, iptables without string rules because they are unreliable, etc.)?

I have many ports to block, but iptables multiport rule has a restriction and only allows a maximum of 15 ports.

severalports="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16"
iptables -A INPUT -p tcp -m multiport --dports $severalports -J DROP
iptables v1.4.21: too many ports specified

I'd like to know if there is any way to create a custom rule to bypass the maximum 15 ports limit (so I don't have to split the rule). thanks

PD: Ports 1:16 is just to explain the idea. Actual ports are not in sequence

I want to clean a large file from my local git repository (and incidentally clean my repository to reduce size). This is my bash:

#!/bin/bash
bigfile="/path_to_mygitproject/bigfile.tar.gz"
git filter-branch --force --index-filter 'git rm -r --cached --ignore-unmatch '"$bigfile"'' --prune-empty --tag-name-filter cat -- --all
git filter-branch --force --index-filter 'git rm -r --cached --ignore-unmatch '"$bigfile"'' HEAD

But now show the following warning:

WARNING: git-filter-branch has a glut of gotchas generating mangled history
     rewrites.  Hit Ctrl-C before proceeding to abort, then use an
     alternative filtering tool such as 'git filter-repo'
     (https://github.com/newren/git-filter-repo/) instead.  See the
     filter-branch manual page for more details; to squelch this warning,
     set FILTER_BRANCH_SQUELCH_WARNING=1.

I have always used this bash and have never had a problem. Until now. I guess something changed in git.

I try to replace "git filter-branch" with "git filter-repo" but I get the message:

git: 'filter-repo' is not a git command. Look at 'git --help'.but

what should i fix? thanks

Update:

I did this but it seems that everything changed

wget https://raw.githubusercontent.com/newren/git-filter-repo/master/git-filter-repo -O /home/user/.local/bin/git-filter-repo
chmod +x /home/user/.local/bin/git-filter-repo

And replace in my script "git filter-branch" with "git filter-repo". Out:

git-filter-repo: error: argument --prune-empty: expected one argument
git-filter-repo: error: unrecognized arguments: --index-filter git rm -r --cached --ignore-unmatch bigfile.tar.gz HEAD

I checked the examples and I add "--prune-empty auto", but i couldn't fix my script, because I don't know what the alternatives to "--index-filter" or "--tag-name-filter" will be (it seems they don't exist)

git filter-repo --version
ffc6fa9265d8
git --version
git version 2.25.1

Update:

I have managed to reduce the size of my repo with the command:

git filter-repo --strip-blobs-bigger-than 10M

But it is an unsuitable method, since i can delete other files that are larger than 10M and that I do not want to be deleted

Solved!

git filter-repo --path bigfile.tar.gz --invert-paths

vote close

how to stop/start a windows service in cmd with just a fragment of the service name. Example:

NET STOP *part_of_name_of_service*
NET START *part_of_name_of_service*

For example. mysql has many versions of "the name of service".

MySQL57
wampmysqld
etc, etc, etc

The idea is to stop/start any service that contains the word "mysql". Something like that:

net start *MySQL*

But unfortunately my attempt generates error: "The service name is not valid".

Attempts:

1.Dump service names to a file with the following command:

REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services" > services.txt
findstr /i /r "mysql" services.txt
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MySQL
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wampmysqld64

but I could not complete the loop

2.With taskkill

call :winservices "*mysql*"

:: funcion winservices
@echo off
  goto:eof
  :winservices
  set winservices=%1
   taskkill /f /im "%winservices%" /t
  goto:eof

But "*mysql*" not works (only "mysql*" works)

The same happens when trying to delete the service:

sc delete *MySQL*

how I do this?

I know that Android does not support automatic detection pac files, and I also know that port 443 can not be redirected. So, This is what I have:

For example, asssuming the squid-cache proxy port is 3128 (eth1 local, eth0 internet), the following iptable rule does not work for the list "macsphone.txt":

for macsphone in $(/path_to/macsphone.txt); do
    iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source $macsphone -p tcp --dport 80 -j REDIRECT --to-port 3128
    iptables -A INPUT -i eth1 -m mac --mac-source $macsphone -p tcp --dport 3128 -j ACCEPT
    iptables -A FORWARD -i eth1 -m mac --mac-source $macsphone -p tcp --dport 3128 -o eth0 -j ACCEPT
done

PD: the list "macsphone.txt" contains the macs addresses of the smartphones with android

Only this rule would work, where transparent port 8080 is opened for the squid proxy for http, and 443 for https that would not pass through the squid proxy:

for macsphone in $(/path_to/macsphone.txt); do
    iptables -t nat -A PREROUTING -i eth1 -m mac --mac-source $macsphone -p tcp --dport 80 -j REDIRECT --to-port 8080
    iptables -A INPUT -i eth1 -m mac --mac-source $macsphone -p tcp --dport 8080 -j ACCEPT
    iptables -A FORWARD -i eth1 -m mac --mac-source $macsphone -p tcp --dport 8080 -o eth0 -j ACCEPT
    iptables -A FORWARD -i eth1 -m mac --mac-source $macsphone -p tcp --dport 443 -o eth0 -j ACCEPT
done

Is there any way to redirect the android traffic to the squid proxy in non-transparent mode (for http and https) without having to manually set the proxy (ip/port) on android? (with iptables, some script similar to pac file, apache2, qr code, or something else)

That is, avoid this:

PD: DNS, NAT, MASQUERADE, etc is open to my network

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -i eth1  -o eth0 -j MASQUERADE
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT

PD2: Please, do not propose pi-hole, Squid-in-the-middle SSL Bump or similar