David Ljung Madison Stellar's questions

I bought an EasyCap video capture USB device which "works" to some extent right out of the box (go Ubuntu Linux!) but for one of my devices it has trouble getting the color info. The video looks fine otherwise, but when I go through EasyCap it keeps dropping color and switching to B&W. I've tried adjusting the setting "Gain" in VLC for it's capture control, but there's no clear indicator of what the scale is and it doesn't seem to help. I tried switching the RCA cable as well, since the last one was cheap and seemed to make it more likely to drop if I jiggled it, but the new cable still loses color.

Is this just a failure of cheap hardware, or is there some setting I'm missing?

I am suddenly seeing a mass of bruteforce ssh attacks on my personal server. I am using fail2ban, and the attacks are causing fail2ban to have significant CPU load just to keep up with the banning. That's how I noticed the attack - because fail2ban kept spiking up to 100% CPU usage.

I have increased ban time, but I am seeing bruteforce attacks come in from a huge mass of IP addresses, presumably through a botnet.

Is this the current state of affairs for all servers in 2020, or am I being specifically targeted? (though I can't imagine why, there's nothing of value on my server).

I've turned off PasswordAuthentication and now I just see the connect and disconnect, so that's holding them off for now, but it's still using up networking and CPU resources on my server to deal with the attack.

I assume it's not some sort of IP spoofing, since it uses the same IP multiple times until it gets banned. Not even sure if one can spoof the IP address to sshd.

So the question is - is this normal or do I have reason to believe that someone is intentionally attacking my server specifically? And follow-up, is there a good way to stop this attack from using up my resources, or should I just let it run it's course until whomever is controlling the botnet figures out that there's no way in?

I cannot use whitelisting on my ssh server because I need to be logged in from multiple locations.

I can't remove a garbage directory in my lost+found disk (mounted on /attic)

ALL COMMANDS DONE AS ROOT:

% mount /attic/ ; cd /attic/lost+found ; pwd
/attic/lost+found
# rmdir #648843480
rmdir: failed to remove '#648843480': No such file or directory

I can't even 'ls' the directory without causing the filesystem to be remounted ro (because of the option errors=remount-ro) and I can't lsattr to see attributes or even blindly try to turn off all chattr options.

# cd ; umount /attic/ ; mount /attic/ ; cd /attic/lost+found ; pwd
/attic/lost+found
# touch test ; rm -f test
# ls
total 4
4 '#64884340'/
# touch test ; rm -f test
touch: cannot touch 'test': Read-only file system
# cd ; umount /attic/ ; mount /attic/ ; cd /attic/lost+found ; pwd
/attic/lost+found
# chattr -aAcCdDeijPsStTu #64884340
chattr: Permission denied while reading flags on #64884340
# touch test ; rm -f test
touch: cannot touch 'test': Read-only file system

(I'm doing fsck's in between as well and get the same results)

Looking at dmesg it mentions the casefold feature, so I tried chattr -F:

# cd ; umount /attic/ ; mount /attic/ ; cd /attic/lost+found ; pwd
/attic/lost+found
# chattr -F #64884340
Usage: chattr [-pRVf] [-+=aAcCdDeijPsStTu] [-v version] files...
# lsattr #64884340
# touch test ; rm -f test
touch: cannot touch 'test': Read-only file system

Once I do all that I need to fsck the filesystem because it's marked with errors, but fsck finds nothing wrong. Note that no output happened for lsattr

Note the casefold error as well as the encryption context? According to the chattr man page, there's the E (encryption) which can be seen by lsattr but not changed by chattr. Do I have an encrypted file with an error and because of the error I can't fix or remove it?

The dmesg output caused by just trying to 'ls' the directory is:

[602996.921677] EXT4-fs (nvme1n1p5): mounted filesystem with ordered data mode. Opts: discard,errors=remount-ro
[603002.007850] EXT4-fs error (device nvme1n1p5): ext4_lookup:1701: inode #64884340: comm ls: casefold flag without casefold feature
[603002.008874] Aborting journal on device nvme1n1p5-8.
[603002.009475] EXT4-fs (nvme1n1p5): Remounting filesystem read-only

And now I'm noticing that the journal is being blown away (this wasn't true before)

# mount /attic/
# dmesg -c
[601934.070181] EXT4-fs (nvme1n1p5): mounted filesystem without journal. Opts: discard,errors=remount-ro

(Which I'm fixing with 'tune2fs -j ...' and have to do occasionally as well)

Suggestions? This is a fairly new SSD, so I'd be surprised if it's getting corrupted.

Running Ubuntu desktop 18.04.4

When I reboot, everything is fine. But after some time (and maybe some combination of keys that I haven't figured out yet) my keyboard seems to get stuck in a state where my KeyRelease is stuck until another KeyPress happens. In other words, if I watch xevents with xev, then this will happen:

press key 'd'
   See KeyPress 'd'
..
press key 'a'
   See KeyRelease 'd'
   See KeyPress 'a'

I've tried resetting my keyboard setup a number of ways:

dpkg-reconfigure keyboard-configuration

And also:

setxkbmap -layout us
setxkbmap -option

This leaves me with:

% setxkbmap -query
rules:      evdev
model:      pc105
layout:     us,us
variant:    ,

And I've checked to make sure sticky keys are off:

% xkbset -sticky ; xkbset q | grep Sticky-Keys
Sticky-Keys = Off

But the problem persists. Disconnecting the keyboard and reboot do not help. It happens on multiple keyboards.

I know there is often confusion about ctrl-alt-Fkey surprisingly "killing" X when in reality they have just switched to a text virtual console.

This is not that question.

When I switch to a virtual console something happens to X such that I can't switch back to X in vt 7. It's still running, but I can't X to show anything. Instead I see a blank screen at virtual terminal 7 with a blinking underline cursor (that doesn't respond to typing). Sometimes just killing and restarting the window manager will let me switch back, but usually I have to kill gnome-session or Xorg to completely restart it.

It used to only be virtual console 10 that caused this problem, I could switch to other virtual consoles fine and come back to X, but VT 10 would always break X. Now switching to any virtual console is crashing X.

I have a script that I have written that I would like to use whenever I click on a mailto: link. Which means I need to select it as the default Mail handler in my default applications.

But how do I register a mailto handler so that I can select it in the default applications?

Using Ubuntu 18.04, not virtualized.

I am not using a specific mail application, I am trying to write a script that will process the mailto links for me (for example, using different mail clients for different destination domains), but I need to convince Ubuntu that this script is an option for a default mail application

When I boot (Ubuntu 18.04), systemd is starting up pulseaudio under user gdm. I don't want that - I want to run pulseaudio as my user, because of problems with pulseaudio under gdm and mpd.

So I am trying to kill it, and nothing will kill this monster. It keeps respawning. People have asked this question before, and all of the following solutions have failed:

1. Add "autospawn=no" to "/etc/pulse/client.conf" Add "autospawn=no" to "/var/lib/gdm3/.config/pulse/client.conf"
2. Also add "daemon-binary = /bin/true" to client.conf
3. "sudo rm -f /etc/xdg/autostart/pulseaudio.desktop"
4. "sudo systemctl kill pulseaudio" (Returns "Failed to kill unit pulseaudio.service: Unit pulseaudio.service is not loaded.")
5. Removing /etc/xdg/autostart/pulseaudio*
6. systemctl --user stop pulseaudio.socket
7. systemctl --user stop pulseaudio.service
8. systemctl disable pulseaudio

According to pstree, it keeps getting restarted by systemd with user gdm, if I kill it (as root) the process dies, and systemd just respawns it.

But I can't figure out why systemd is starting it:

% systemctl --type=service | grep pulse
% systemctl list-units --type=service | grep pulse

In fact, systemctl doesn't even think it's running:

% systemctl | grep pulse
% systemctl --state=running | grep pulse

Which is why:

% systemctl disable pulseaudio
Failed to disable unit: Unit file pulseaudio.service does not exist.

And systemd doesn't admit to starting it:

% systemd --test | grep -i pulse
Loaded units and determined initial transaction in 27ms.

But pstree tells us that it's lying:

% pstree
    .....
    |-systemd-+-(sd-pam)
    ...
    |         |-pulseaudio---{pulseaudio}

It's also not listed in the init.d or Xsession.d scripts:

% ls /etc/init.d/*pulse*
ls: cannot access '/etc/init.d/*pulse*': No such file or directory
% ls /etc/X11/Xsession.d/*pulse*
ls: cannot access '/etc/X11/Xsession.d/*pulse*': No such file or directory

Although this file does exist:

/var/lib/gdm3/.config/systemd/user/sockets.target.wants/pulseaudio.socket Which claims "WantedBy=sockets.target" whatever that means..

I think it might be partially a path problem with systemd - it's not in the /etc/systemd path:

% find /etc/systemd/ -name '*pulse*'

But:

% find /usr/lib/systemd | grep pulseaudio
/usr/lib/systemd/user/pulseaudio.socket
/usr/lib/systemd/user/pulseaudio.service

I noticed that someone else had this bug on redhat:

https://bugzilla.redhat.com/show_bug.cgi?id=1635119

Frustratingly it was closed as NOTABUG without an explanation.

What does it take to kill this process and keep it killed, without some hack like temporarily moving the binary?

I've installed Ubuntu on a new laptop, the LG Gram 17 which has Whiskey Lake 3x8 GT2 graphics.

Some applications are causing corruption with triangle segments that are blacked out. Screenshot attached of an application that reproduces the issue 100% of the time. I also see the issue with VLC, but only when it switches to fullscreen - but not if I make a window of the same size but not in fullscreen mode. Interestingly enough I just tested tuxracer, and that works fine.

Furthermore, I have the possibly related issue that sometimes opening a new window (even with something as innocuous as xterm) will crash/hang X. The screen will go black and only show a blinking cursor, but the children processes will continue running. I can switch to a text virtual terminal and the machine is still running fine, but I can't get X to display again.

I am running Ubuntu 18.04.3 LTS with HWE enabled - so I'm on kernel 5.3.0-26.

The LG Gram requires the kernel option "pci=nommconf" - don't know if that effects graphics.

I've tried adding i915.blacklist=yes to my kernel boot options, but I am not convinced it actually did anything since it seems that i915 was still enabled. I've also tried:

• i915.enable_fbc=0 (which I verified was actually disabled)
• intel_iommu=on,igrfx_off (not convinced this actually disabled i915)

Any suggestions of what else I can do to figure out what is happening?

My video setup is:

# lshw -c video | grep 'configuration'
    configuration: depth=32 driver=i915 latency=0 mode=2560x1440 visual=truecolor xres=2560 yres=1440

# lshw -c video
  *-display
     description: VGA compatible controller
     product: Intel Corporation
     vendor: Intel Corporation
     physical id: 2
     bus info: pci@0000:00:02.0
     logical name: /dev/fb0
     version: 00
     width: 64 bits
     clock: 33MHz
     capabilities: pciexpress msi pm vga_controller bus_master cap_list rom fb
     configuration: depth=32 driver=i915 latency=0 mode=2560x1440 visual=truecolor xres=2560 yres=1440
     resources: iomemory:600-5ff iomemory:400-3ff irq:177 memory:6022000000-6022ffffff memory:4000000000-400fffffff ioport:2000(size=64) memory:c0000-dffff

Here's the lspci info for the graphics:

00:02.0 VGA compatible controller: Intel Corporation Device 3ea0 (prog-if 00 [VGA controller])
        Subsystem: LG Electronics, Inc. Device 0325
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 0
        Interrupt: pin A routed to IRQ 177
        Region 0: Memory at 6022000000 (64-bit, non-prefetchable) [size=16M]
        Region 2: Memory at 4000000000 (64-bit, prefetchable) [size=256M]
        Region 4: I/O ports at 2000 [size=64]
        [virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
        Capabilities: [40] Vendor Specific Information: Len=0c <?>
        Capabilities: [70] Express (v2) Root Complex Integrated Endpoint, MSI 00
                DevCap: MaxPayload 128 bytes, PhantFunc 0
                        ExtTag- RBE+
                DevCtl: Report errors: Correctable- Non-Fatal- Fatal- Unsupported-
                        RlxdOrd- ExtTag- PhantFunc- AuxPwr- NoSnoop-
                        MaxPayload 128 bytes, MaxReadReq 128 bytes
                DevSta: CorrErr- UncorrErr- FatalErr- UnsuppReq- AuxPwr- TransPend-
                DevCap2: Completion Timeout: Not Supported, TimeoutDis-, LTR-, OBFF Not Supported
                DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-, LTR-, OBFF Disabled
        Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable- 64bit-
                Address: fee00018  Data: 0000
        Capabilities: [d0] Power Management version 2
                Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
        Kernel driver in use: i915
        Kernel modules: i915

Update to the X "crash" - I've discovered that if I go to a text terminal I can restart my window manager and then I can get back to at least part of my desktop, though the window decorator (emerald) and my panels (gnome-panel and cairo-dock) are gone, though if I do a few restarts on emerald and the window manager and gnome-panel, they eventually re-appear. Is there a log somewhere that might be able to tell me what is crashing?

I use xbindkeys, and I want to map some of my keypad keys to be mouse buttons. I don't want to use mouse keys, because the layout doesn't work for my typing. Currently I do something like this:

"echo ButtonPress 1 | xmacroplay :0"
    KP_Insert

"echo ButtonRelease 1 | xmacroplay :0"
    release + KP_Insert

And then I turn off key repeat for KP_Insert (keycode 90 on my setup) with:

xset -r 90

Unfortunately it seems that xmacroplay buttons run by xbindkeys don't seem to be picked up by the window manager, so it can't be used to do things like resize windows.

I'm open to other options for mapping keyboard keys to mouse buttons, but using the mouse keys feature not only takes over the entire numeric keypad, but it doesn't seem to allow changing which keys are the buttons, and on my system I can only get button 3 from any of the keypad presses.

I am running 18.04.3 LTS on my main computer:

# lsb_release -a
LSB Version:    core-9.20170808ubuntu1-noarch:security-9.20170808ubuntu1-noarch
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.3 LTS
Release:        18.04
Codename:       bionic

On a new computer I am installing 18.04.3 LTS and was suprised that it had a different kernel. The new install is using vmlinuz-5.3.0-26-generic, but my (updated/upgraded/etc..) current computer is only on vmlinuz-4.15.0-74-generic.

How can I figure out what is holding my computer back from upgrading?

I don't seem to have anything pinned for the kernel:

# dpkg --get-selections linux
dpkg: no packages found matching linux

I have two Logitech T620 touch mice that I love. They have a touchpad type surface that can be clicked with the following actions:

• click on left: mouse button 1
• click on right: mouse button 3
• click middle lower: mouse button 2
• vertical swipe: scroll (buttons 4&5)

The mouse has a number of other swipe features, like two-finger swiping, that do not work under Ubuntu, and I have been fine with that.

Unfortunately, just recently one of the mice stopped scrolling on Ubuntu (but still works on my Windows machine at work).

So I swapped the T620 I was using on my Windows machine with my Ubuntu machine, and I had scrolling on Ubuntu again.

And then a few days later it suddenly stopped scrolling.

I have tried:

• Using the mouse on my Windows machine (where scrolling works) and connecting and disconnecting the mouse from the "Logitech Unifying Receiver".
• Turning on and off scrolling on the Windows machine to see if it effects scrolling on Ubuntu
• Looking at the button map in 'xinput list-props' - it shows a full list of buttons.
• Installing 'solaar' and connecting/disconnecting the mouse in Ubuntu
• Running xinput test and evtest, both show no events when scrolling, but buttons 1-3 show up fine

All to no avail.

How can I get vertical scroll to work on my xinput device again? It works fine when I plug the device into Windows, but Windows is a nightmare, so help me use it under Ubuntu! :)

Incidentally, here's the output of list-props:

    Device 'Logitech T620':
            Device Enabled (139):   1
            Coordinate Transformation Matrix (141): 1.000000, 0.000000, 0.000000, 0.000000, 1.000000, 0.000000, 0.000000, 0.000000, 1.000000
            Device Accel Profile (270):     0
            Device Accel Constant Deceleration (271):       1.000000
            Device Accel Adaptive Deceleration (272):       1.000000
            Device Accel Velocity Scaling (273):    10.000000
            Device Product ID (257):        1133, 16423
            Device Node (258):      "/dev/input/event5"
            Evdev Axis Inversion (274):     0, 0
            Evdev Axes Swap (276):  0
            Axis Labels (277):      "Rel X" (149), "Rel Y" (150), "Rel Horiz Wheel" (267), "Rel Dial" (268), "Rel Vert Wheel" (269)
            Button Labels (278):    "Button Left" (142), "Button Middle" (143),
                    "Button Right" (144), "Button Wheel Up" (145), "Button Wheel Down"
                    (146), "Button Horiz Wheel Left" (147), "Button Horiz Wheel Right"
                    (148), "Button Side" (262), "Button Extra" (263), "Button Forward"
                    (264), "Button Back" (265), "Button Task" (266), "Button Unknown"
                    (260), "Button Unknown" (260), "Button Unknown" (260), "Button
                    Unknown" (260), "Button Unknown" (260), "Button Unknown" (260),
                    "Button Unknown" (260), "Button Unknown" (260), "Button Unknown"
                    (260), "Button Unknown" (260), "Button Unknown" (260), "Button Unknown" (260)
            Evdev Scrolling Distance (279): 1, 1, 1
            Evdev Middle Button Emulation (280):    0
            Evdev Middle Button Timeout (281):      50
            Evdev Third Button Emulation (282):     0
            Evdev Third Button Emulation Timeout (283):     1000
            Evdev Third Button Emulation Button (284):      3
            Evdev Third Button Emulation Threshold (285):   20
            Evdev Wheel Emulation (286):    1
            Evdev Wheel Emulation Axes (287):       0, 0, 4, 5
            Evdev Wheel Emulation Inertia (288):    10
            Evdev Wheel Emulation Timeout (289):    200
            Evdev Wheel Emulation Button (290):     3
            Evdev Drag Lock Buttons (291):  0

I have a Thinkpad X1 (1st Gen) running Ubuntu (previously on 14.04)

It has multimedia buttons on the side for: XF86Launch1, XF86AudioMute, XF86AudioRaiseVolume, XF86LowerVolume and XF86AudioMicMute. They used to work fine in 14.04, even to the extent that the little orange light inside the 'mute' key would come on when muted and turn off when not.

I upgraded to 16.04 and none of them worked anymore.

I realized that they were getting grabbed by (but not used by) the Keyboard shortcuts as accessible from gnome-control-center or unity-control-center.

When I turned off the keyboard shortcuts for the media keys, I was then able to see the keycodes with xev, and hence was able to use something like xbindkeys for a hack of a solution.

All except for the input mute, which still isn't working. So I check with acpi_listen and see that that the buttonpress is being registered, just as it is for the other media keys, but when I press it, I see:

(gnome-settings-daemon:14711): GLib-GIO-WARNING **: Dropping signal AcceleratorActivated of type (uuu) since the type from the expected interface is (ua{sv})

When I kill gnome-settings-daemon then I can properly see the input mute key in xev and grab it as needed.

How can I keep gnome-settings-daemon from trying to (and failing to) grab this key?

I have a virtual server that I run a web server and openvpn on.

It is not running bind, and port 53 is closed.

I am recently getting flooded with errors in syslog (about 1/sec) such as:

Sep 29 15:06:59 kernel: [4579319.118505] UDP: bad checksum. From 128.47.17.191:4127 to <<my server IP>>:53 ulen 49
Sep 29 15:07:31 kernel: [4579350.981024] UDP: bad checksum. From 69.161.227.72:27788 to <<my server IP>>:53 ulen 39

I've tried checksum offloading with:

ethtool --offload eth0 rx off tx off

Finally I simply blocked all UDP traffic with iptables. I had to remove a rule that was allowing all UDP traffic, which is a bit concerning. iptables -A INPUT -p udp --dport 53 -j DROP

So that leaves two questions:

1. Why was I receiving these errors - was this an attack of some sort?
2. What UDP ports do I need to allow in my iptables to make sure my VPN and web server continue to function properly? Do I need to allow UDP port 53 to my DNS servers?