Replicant 4.2 on Samsung S3

Since November 2013 I have been using Replicant on my Samsung S3 as an alternative OS. The experience has been good for everyday use. The limits (due to non-free software components) compared to a “normal” S3 (running vendor ROM or CyanogenMod) is lack of GPS/wifi/bluetooth/NFC/frontcamera functionality — although it is easy to get some of that working again, including GPS, which is nice for my geocaching hobby. The Replicant software is stable for being an Android platform; better than my Nexus 7 (2nd generation) tablet which I got around the same time that runs an unmodified version of Android. The S3 has crashed around ten times in these four months. I’ve lost track of the number of N7 crashes, especially after the upgrade to Android 4.4. I use the N7 significantly less than the S3, reinforcing my impression that Replicant is a stable Android. I have not had any other problem that I couldn’t explain, and have rarely had to reboot the device.

The Replicant project recently released version 4.2 and while I don’t expect the release to resolve any problem for me, I decided it was time to upgrade and learn something new. I initially tried the official ROM images, and later migrated to using my own build of the software (for no particular reason other than that I could).

Before the installation, I wanted to have a full backup of the phone to avoid losing data. I use SMS Backup+ to keep a backup of my call log, SMS and MMS on my own IMAP server. I use oandbackup to take a backup of all software and settings on the phone. I use DAVDroid for my contacts and calendar (using a Radicale server), and reluctantly still use aCal in order to access my Google Calendar (because Google does not implement RFC 5397 properly so it doesn’t work with DAVDroid). Alas all that software is not sufficient for backup purposes, for example photos are still not copied elsewhere. In order to have a complete backup of the phone, I’m using rsync over the android debug bridge (adb). More precisely, I connect the phone using a USB cable, push a rsyncd configuration file, start the rsync daemon on the phone, forward the TCP/IP port, and then launch rsync locally. The following commands are used:

jas@latte:~$ cat rsyncd.conf
address 127.0.0.1
uid = root
gid = root
[root]
path = /
jas@latte:~$ adb push rsyncd.conf /extSdCard/rsyncd.conf
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
0 KB/s (57 bytes in 0.059s)
jas@latte:~$ adb root
jas@latte:~$ adb shell rsync --daemon --no-detach --config=/extSdCard/rsyncd.conf &
jas@latte:~$ adb forward tcp:6010 tcp:873
jas@latte:~$ sudo rsync -av --delete --exclude /dev --exclude /acct --exclude /sys --exclude /proc rsync://localhost:6010/root/ /root/s3-bup/
...

Now feeling safe that I would not lose any data, I remove the SIM card from my phone (to avoid having calls, SMS or cell data interrupt during the installation) and follow the Replicant Samsung S3 installation documentation. Installation was straightforward. I booted up the newly installed ROM and familiarized myself with it. My first reaction was that the graphics felt a bit slower compared to Replicant 4.0, but it is hard to tell for certain.

After installation, I took a quick rsync backup of the freshly installed phone, to have a starting point for future backups. Since my IMAP and CardDav/CalDav servers use certificates signed by CACert I first had to install the CACert trust anchors, to get SMS Backup+ and DAVDroid to connect. For some reason it was not sufficient to add only the root CACert certificate, so I had to add the intermediate CA cert as well. To load the certs, I invoke the following commands, selecting ‘Install from SD Card’ when the menu is invoked (twice).

adb push root.crt /sdcard/
adb shell am start -n "com.android.settings/.Settings\"\$\"SecuritySettingsActivity"
adb push class3.crt /sdcard/
adb shell am start -n "com.android.settings/.Settings\"\$\"SecuritySettingsActivity"

I restore apps with oandbackup, and I select a set of important apps that I want restored with settings preserved, including aCal, K9, Xabber, c:geo, OsmAnd~, NewsBlur, Google Authenticator. I install SMS Backup+ from FDroid separately and configure it, SMS Backup+ doesn’t seem to want to restore anything if the app was restored with settings using oandbackup. I install and configure the DAVdroid account with the server URL, and watch it populate my address book and calendar with information.

After organizing the icons on the launcher screen, and changing the wallpaper, I’m up and running with Replicant 4.2. This upgrade effort took me around two evenings to complete, with around half of the time consumed by exploring different ways to do the rsync backup before I settled on the rsync daemon approach. Compared to the last time, when I spent almost two weeks researching various options and preparing for the install, this felt like a swift process.

Continue reading

Unattended SSH with Smartcard

I have several backup servers that run the excellent rsnapshot software, which uses Secure Shell (SSH) for remote access. The SSH private key of the backup server can be a weak link in the overall security. To see how it can be a problem, consider if someone breaks into your backup server and manages to copy your SSH private key, they will now have the ability to login to all machines that you take backups off (and that should be all of your machines, right?).

The traditional way to mitigate SSH private key theft is by password protecting the private key. This works poorly in an unattended server environment because either the decryption password needs to be stored in disk (where the attacker can read it) or the decrypted private key has to be available in decrypted form in memory (where attacker can read it).

A better way to deal with the problem is to move the SSH private key to a smartcard. The idea is that the private key cannot be copied by an attacker who roots your backup server. (Careful readers may have spotted a flaw here, and I need to explain one weakness with my solution: an attacker will still be able to login to all your systems by going through your backup server, however it will require an open inbound network connection to your backup server and the attacker will never know what your private key is. What this does is to allow you to more easily do damage control by removing the smartcard from the backup server.)

In this writeup, I’ll explain how to accomplish all this on a Debian/Ubuntu-system using a OpenPGP smartcard, a Gemalto USB Shell Token v2 with gpg-agent/scdaemon from GnuPG together with OpenSSH.

Continue reading

Debian on Lenovo X201

I have acquired a new laptop/netbook, a Lenovo X201. My initial reactions are positive. It runs Debian better than my old Dell laptop does (see my Debian on Dell Precision M65 writeup). The rest of this article will be devoted to notes and information about running a GNU/Linux system on the Lenovo X201.

Continue reading

OpenWRT 10.03 “Backfire”

Earlier I have written about OpenWRT configuration for two routers in a home network and OpenWRT configuration for 3G dial-up (which succeeded my summerhouse OpenWRT writeup) before. The OpenWRT project recently announced a new release, OpenWRT 10.03 Backfire. Thus, this appeared like a good opportunity to wipe out the old configurations on my routers and rewrite the articles using the latest software. I have two articles:

Home Wireless Network

Using OpenWRT with WPA-PSK 2 on Broadcom WLAN routers have been stuck on a quite old bug. Recently someone suggested that it may have been fixed in trunk, which caused me to test it. And it works!

It took some time to work out the details here. To save myself time to reconstruct the commands, and hopefully save you some time too, I wrote down how to use OpenWRT with two Asus WL-500g Premium linked together wirelessly using WDS and PSK2 encryption.

The writeup is long, so I put it on a separate page:

http://josefsson.org/openwrt/wlan.html.

If you are interested in using OpenWRT with a 3G connection, you may find my summer house internet writeup more useful.

Home Audio Server

Procrastinating real work, I documented my home audio server setup. I needed a cross-platform solution, and as a first step, I settled with MPD. The setup is only a few days old, and I may decide to change software eventually. But the current setup works under Gnome, Windows, Mac OS X and even on my Nokia 6233.

Home Audio Server

What may be missing is FM/DAB Radio and streaming of TV, but I’m not sure the little NSLU2 is up to it. We’ll see.

The writeup on how to do this is long, so I put it at a separate page:
http://josefsson.org/grisslan/audio.html

(This is a continuation of my series to document the devices that run my home, the first was the internet setup).

1 TeraByte

The timing of an article about the Hitachi 1TB disk (linked via a slashdot post) and the disk situation on my home server was too good to be missed. Hence this.

dopio:~# df -h|tail -3
/dev/sda1             917G  200M  871G   1% /big
/dev/sdb1             276G  248G   14G  95% /data
/dev/sdc1             276G  264G     0 100% /backup
dopio:~# 

Oh, and not to be missed: the PopSci explanation of Perpendicular technology.

OpenMoko first impressions

The physical design is excellent. The screen quality is awesome.

I started by flashing pre-built images to get something working. I flashed a new kernel and rootfs. The basic functionality is there, but things tend to crash a lot.

Building the software locally took quite some time, maybe close to a day on my laptop. The build tree is 11GB large. That is huge. Updating the software to the latest version and re-building it is pretty fast though; around a few minutes.

With todays’ build, I was finally able to make a voice call. The openmoko-dialer seems quite solid. What is missing is the audio settings. I’m now using alsactl -f /etc/alsa/gsmhandset.state restore to put the audio in the right state. There was a lot of echo and noise during the call.

Playing MP3 works fine. I was worried about performance problems, but the GUI is still responsive, even while copying a ~50MB file onto the 512MB mini-SD card. I discovered that the external audio connector isn’t a standard audio contact, it is smaller. I need to go out and buy a converter to be able to plug the neo into my stereo. It would have been nice if this cable had been included.

I briefly tried bluetooth, and at least the low-level stuff seems to be present and working. There is no GUI to power up the bluetooth chip though.

OpenMoko Neo1973 order confirmed

Greetings,

This message has been automatically generated with regard to the progress of your order at the OpenMoko online store (http://direct.openmoko.com/).

Your credit card has now been charged by the following amount:

Subtotal: $450 USD
Shipping: $88.98 USD
Total: $538.98 USD

Please note that this amount might be less than what was originally mentioned in the webshop, since we meanwhile got better shipping rates!

This means that we will now send out your order ASAP.

You will receive another status update once the order has been sent out.

Linksys WRT54G3G + Huawei E600 + OpenWRT Kamikaze = Internet at summer house

Spending vacation at the summer house without Internet connectivity? Unthinkable.

Linksys WRT54G3GHuawei E600

The first few days, I connected the laptop to my cell phone using Bluetooth, and then to the Internet using 3G/UMTS.

However, we have more than one laptop here, and the range of bluetooth is limited. I ended up setting up a wireless access point with a PCMCIA slot for a 3G/UMTS card. It has worked flawlessly for several days.

The writeup on how to do this is long, so I put it at a separate page:
http://josefsson.org/openwrt/internet.html

Update: I have written a similar howto for OpenWRT 8.09 and Huawei E220, see http://josefsson.org/openwrt/dongle.html