Git and Missing ANSI Colors

While I have quite a few of my projects exposed on GitHub, I also have a private stash on my FreeBSD-based file server.

After a bit of mess-up I had to modify repository directly on server. No biggie, I connected via Putty only to be greeted with a bunch of ESC nonsense upon every Git command execution. From output it was obvious that something was wrong with ANSI color support.

Adding --no-color to each Git command helped a bit but at the cost of color. Some commands that have no support for omitting color I just redirected to tee null. But that also came in black and white only.

After a while I noticed a pattern - Git commands that needed paging were messy while simple ones showed color just fine. On a whim I set Git pager to less:

git config --global core.pager less

And it worked - despite the fact less is generally a Git’s default to start with.

My best guess is that package I installed doesn’t agree well with my environment and that a few switches might actually solve it without Git reconfiguration. However, this worked and I had no will to continue chasing the rainbow any more. :)

Simple SSTP VPN Server on Mikrotik

Few posts ago, I have gone over the procedure needed to get OpenVPN going. However, what about SSTP-based VPN?

This guide is going to assume you are to enter commands into the New Terminal window from WinBox. That way I will simply repeat commands needed instead of going through the screens. Commands are actually quite descriptive and easy to “translate” into GUI actions if that is your preference.

Prerequisite for any VPN server is to get certificates sorted. Procedure is exactly the same as for OpenVPN server setup with the slight difference being that common-name really matters. It must match either external IP or external host name - no exceptions.

For completeness sake, I will repeat the certificate creation steps here:

/certificate
add name=ca-template common-name=^^example.com^^ days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server-template common-name=^^*.example.com^^ days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client-template common-name=^^client.example.com^^ days-valid=3650 key-size=2048 key-usage=tls-client

sign ca-template name=ca-certificate
sign server-template name=server-certificate ca=ca-certificate
sign client-template name=client-certificate ca=ca-certificate

Depending on your router’s speed, that sign command might time-out - nothing to worry about - just wait for CPU to drop below 100%. Or alternatively check the name of certificate - template part will disappear once signing is completed.

For later shenaningans, we will need root certificate export (just move it somewhere on your computer afterward):

/certificate
export-certificate ca-certificate export-passphrase=""

Next we need a IP address pool for clients. I will assume you have your clients in some other network (e.g. 192.168.1.x) and this new network is just for VPN (notice that it can be the same pool as one used for OpenVPN):

/ip
pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99

Instead of editing the default encrypted profile, we can create a new one. Assumption is your Mikrotik will also be a DNS server. And while at it, you can create a bit more imaginative user/password (again, if you did this for OpenVPN server, you can just reuse the same profile and user):

/ppp
profile add name="vpn-profile" use-encryption=yes local-address=192.168.8.250 dns-server=192.168.8.250 remote-address=vpn-pool
secret add name=^^user^^ profile=vpn-profile password=^^password^^

Finally, we get to enable SSTP VPN server interface - first step that is actually needed if you already have OpenVPN server running:

/interface sstp-server server
set enabled=yes default-profile=vpn-profile authentication=mschap2 certificate=server-certificate force-aes=yes pfs=yes

One curiosity is force-aes flag that is officially listed as not working with Windows clients. I’ve tested it on Windows 7 and 10 without any issues. You can clear it if you play with something older.

With this, our SSTP VPN server is up and running - onto the client setup!

For client we first need to import our certificate authority and we need to do it a bit roundabout way. First we start MMC (Microsoft Management Console) using mmc.exe and to it add Certificates (File->Add/Remove Snap-in). When asked select Computer account for Local Computer and find Trusted Root Certification Authorities. Right-click on it will show Import to which we give certificate we’ve exported a few steps ago.

In the Network and Sharing Center now we can go and Set up a new connection. When asked we just select Connect to a workplace and write destination host name (or IP). Remember that it must match certificate common-name (or a matching wildcard) you gave to your server certificate.

If all steps went fine, you should be presented with user name / password prompt and off you go.

PS: Do not forget to adjust firewall if necessary (TCP port 443).

/ip firewall filter
add chain=input protocol=tcp dst-port=443 action=accept place-before=0 comment="Allow SSTP"

[2017-01-26: Adjusted certificate creation to work on RouterOS 6.38 and later] [2017-01-26: Changed key size to 2048 (instead of 4096) so it doesn’t take ages to generate certificates. :)]

In the Year 2016

As before, the first post of (UTC) 2017 is reserved for some stats.

The most notable update this blog saw was a move from jmedved.com to medo64.com domain. It came on a whim and without too much trouble.

In regards to posts this year, there we 69 of them - again a few more then the year 2015. As my plans were to keep up a post every six days, I cannot be dissatisfied. For this year, I will aim for five and let’s see what happens. :)

The most posts were in the electronics category (14%) closely followed by general updates (13%). Programming got 12% as did Mikrotik - something I started playing with again after a while. Lastly we have the Linux category at 10%.

I got a bit lazy with YouTube channel and all chances are that this’ll continue in 2017. Making even a single video simply takes time and that is one thing I rarely have.

Traffic-wise it is annoyingly hard to tell as I changed domain mid-year. Yes, I could spend some time and consolidate numbers but I cannot be bothered. Based on random month selection, traffic is in the same ballpark and that is good enough for me.

For the first time slightly more than 50% of readers is using Chrome, and Firefox is a distant second with 20%. Somehow Internet Explorer is still third at 15%. Safari is further away still at 6% and I cannot believe crappy Edge has almost 3%. I guess Microsoft’s practice of making it default with every Windows update kinda works. Either that or 3% of my readers have lost their mind.

20% of my traffic comes from USA, with Russia at second place with 10%. This is really a surprise to me as Russia wasn’t even in the first 10 previous years. Closer look at sources shows this is probably just due to Russian spam-bots as in the first 10 I could verify only a single source. Germany is thus third at 8%. United Kingdom, France, Japan, and India share the fourth place at 4% each.

Total of 196 countries visible in my logs is again down from the 207 last year - I am losing countries left and right. My favorite single-visit country was definitely São Tomé & Príncipe which gets extra style points for its Unicode rich name.

All the best in 2017!

Simple OpenVPN Server on Mikrotik

Having OpenVPN server on your router is a nifty feature. However, as often with Mirotik, not all is straight forward.

This guide is going to assume you are to enter commands into the New Terminal window from WinBox. That way I will simply repeat commands needed instead of going through the screens. Commands are actually quite descriptive and easy to “translate” into GUI actions if that is your preference.

Prerequisite for any VPN server is to get certificates sorted. For OpenVPN we need main Certificate Authority, server, and client certificate. Yes, strictly speaking, client certificate is optional but let’s not skimp on security.

First we create all the certificate templates (10 years validity) we’ll need:

/certificate
add name=ca-template common-name=^^example.com^^ days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server-template common-name=^^*.example.com^^ days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client-template common-name=^^client.example.com^^ days-valid=3650 key-size=2048 key-usage=tls-client

For the purpose of OpenVPN server common name can be really anything. However, some other VPNs are not as forgiving (yes SSTP, I am looking at you) so it might be best to have either your external IP or host name as the common-name text. Any yes, if you have dynamic IP and you are not using your own domain, you can put *.dyndns.org there - no worries.

Created certificates will need signing:

/certificate
sign ca-template name=ca-certificate
sign server-template name=server-certificate ca=ca-certificate
sign client-template name=client-certificate ca=ca-certificate

Depending on your router’s speed, that sign command might time-out - nothing to worry about - just wait for CPU to drop below 100%. Or alternatively check name of certificate - template part will disappear once signing is completed.

With this we need to export a few files:

/certificate
export-certificate ca-certificate export-passphrase=""
export-certificate client-certificate export-passphrase=^^12345678^^

This should give you three files: cert_export_ca-certificate.crt, cert_export_client-certificate.crt, and cert_export_client-certificate.key. After copying this on computer for later I like to rename them to ca.crt, client.crt, and client.key respectively.

Next we need a separate pool of IP addresses for clients. I will assume you have your clients in some other network (e.g. 192.168.1.x) and this new network is just for VPN:

/ip
pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99

Instead of editing the default encrypted profile, we can create a new one. Assumption is your Mikrotik will also be a DNS server. And while at it, you can create a bit more imaginative user/password:

/ppp
profile add name="vpn-profile" use-encryption=yes local-address=192.168.8.250 dns-server=192.168.8.250 remote-address=vpn-pool
secret add name=^^user^^ profile=vpn-profile password=^^password^^

Finally, we can enable OpenVPN server interface:

/interface ovpn-server server
set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

Now finally we can copy both ca.crt and client.crt to C:\Program Files\OpenVPN\config\ directory alongside client.ovpn.

You don’t have client.ovpn? Well, one is in sample-config directory and we just need to change/add highlighted items:

client
dev tun
proto ^^tcp^^
remote ^^example.com^^ 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
cipher AES-128-CBC
^^auth SHA1^^
^^auth-user-pass^^
^^redirect-gateway def1^^
verb 3

A bit annoying step is being asked for the private key passphrase (in the addition to username/password). Mikrotik doesn’t allow export without it but fortunately we can use OpenSSL to change that:

openssl.exe rsa -in client.key -out client.key
 Enter pass phrase for client.key: 12345678
 writing RSA key

With this, your VPN connection should work like a charm.

PS: Do not forget to adjust firewall if necessary (TCP port 1194).

/ip firewall filter
add chain=input protocol=tcp dst-port=1194 action=accept place-before=0 comment="Allow OpenVPN"

PPS: Do check SSTP guide too.

PPPS: If you’re on RouterOS 7 you might want to check this guide for UDP.

[2017-01-26: Adjusted certificate creation to work on RouterOS 6.38 and later] [2017-01-26: Changed key size to 2048 (instead of 4096) so it doesn’t take ages to generate certificates. :)] [2017-02-25: Changed example to use AES-128 for lower CPU usage on router.]

Fountain Pens on the Plane

As a fountain pen user, I’ve always heard about precautions you must take before you board the flight. Most people I spoke with recommend to clean the pen completely or, if you really want to use it, keep it fully inked as to minimize possibility of air expanding and pushing the ink out.

On the first glance, all this seems logical so I always took precautions. Considering that all my flights lately have been cross-Atlantic, it seemed as a wise choice. However, on my last flight I decided to experiment a little.

On my trip from USA to Croatia (Seattle-Frankfurt-Zagreb) I carried four of my pens: Pilot Custom 74, TWSBI Diamond 580, Platinum Cool, and Pilot Metropolitan. Custom 74 was attached to my notebook while remaining pens had home in the case located in my backpack. All were fully loaded with different inks: Noodler’s Heart of Darkness, Diamine Oxblood, Private Reserve DC Supershow Violet, and Private Reserve Sherwood Green respectively.

I used Custom 74 with Noodler’s during the whole flight and, outside of the nib creep Noodler is famous for, I had no issues what-so-ever. And yes, I used it both during take off and landing - just to be sure. Other pens I took just a few scribbles with for test purposes but I haven’t noticed anything wrong.

On the way back I expected slightly different results as I have used some ink and didn’t refill any pen. Custom 74 was close to being empty, TWSBI was around 50%, while Cool and Metropolitan were reasonably full at around 75%. I expected trouble.

Surprisingly, nothing happened. My pens operated just fine with TWSBI taking more of an main pen role from Custom 74. Absolutely no leakage occurred during any of two flights (Zagreb-Frankfurt-Seattle).

Based on my, admittedly limited, test I don’t see any justification of additional pen preparation before the flight if you are bringing it in cabin with you. Any pressure change in the cabin during flight is small enough that any modern fountain pen can handle it just fine. Yes, in the case of sudden decompression, pen would probably leak but then you’d have more important things to worry about than 2 mL of ink.

If you are transporting pen in unpressurized cargo area I would always go with cleaning out the pen completely. In all other cases relax and write on. :)