I searched online and found a Java tool that could decrypt the ColorNote backup file. However, I didn't want to install Java just for this one task, and I saw that people were complaining about having to manually clean up the output afterwards.

So, I decided to rewrite it as a PowerShell script. With a little help from the Gemini code assistant, and after many iterations, I created a script that worked perfectly for my needs.

The script decrypts the backup and can export all your notes into a clean JSON file and, optionally and more usefully, a Joplin Export (JEX) file. As a bonus, I found it even correctly imported notes that were still in my ColorNote trashcan into the Joplin trashcan. Many other Note apps can import JEX files as well.

How to Use It

First, get a backup file of your notes from ColorNote. Go to Settings -> Backup and tap on the latest backup there, select Send and send it to disk or send it to yourself with one of the other apps, whatever you prefer.

Then clone the repository from GitHub to get the script:

git clone https://github.com/chadoe/Decrypt-ColorNoteBackup.git

Then, open a PowerShell 7 terminal, navigate into the directory, and run the script. The script will prompt you for your password (if you don't have one, just press Enter).

Here is the example command:

.\Decrypt-ColorNoteBackup.ps1 -InputFile .\my_backup.db -OutputFile .\decrypted_notes.json -JexOutputFile .\colornote_export.jex

Then simply import the JEX file in Joplin or any other Notes app that supports importing JEX files. Or alternatively process the JSON output file that contains all notes further into another format.

If you're in the same boat, hopefully, it can save you some time.

Get the script on GitHub: https://github.com/chadoe/Decrypt-ColorNoteBackup

Chassis Intruded! Fatal Error … System halted

but you never set it up for chassis intrusion dectection, just replace the (usually) CR2032 cmos battery on the mainboard. Big chance it is close to being completely drained and causing this error.

In this example the converter will use FFmpeg to convert to AAC with the FDK encoder set to variable bitrate mode 5 (best quality).

Set Encoder to Custom, Encoder file to ffmpeg.exe (posibly with complete path to the executable), extension to whatever extension you want the output files(s) to have and set parameters to -i pipe:0 -y -c:a libfdk_aac -vbr 5 %d where -c:a libfdk_aac -vbr 5 depends on what codec and settings for that codec you want to use.

The -i pipe:0 part of the parameters tells FFmpeg to use stdin as input, which is where foobar pipes it output to.

ERROR: An error occurred (code 0x80070017):
Data error (cyclic redundancy check).

Must be something wrong with the drive right? Chkdsk... nope the drive is fine.

Turns out you need to remove the existing autounlock keys first that migrated from the previous system drive but are no longer valid for the newly bitlockered system. So open an adminitrative powershell or command prompt and run

manage-bde -autounlock -clearallkeys C:

Optionally remove all the old external key(s) from the data drive

manage-bde -protectors -delete -type externalkey F:

F: being the data drive. Or remove specific external keys by listing them first

manage-bde -protectors -get -type externalkey F:

Then deleting the ones you don't need anymore by it's id value

manage-bde -protectors -delete -id "{DBB1A11E-9F5C-41B8-BD79-8A60E27F6369}" F:

After that you can enable auto unlock on the data drive without error.

To get the MD5 hash of a file run the following command in powershell:

get-filehash -algorithm md5 <filename>

Similarly, to get the SHA1 hash run:

get-filehash -algorithm sha1 <filename>

If you just need the hash value output:

(get-filehash -algorithm md5 <filename>).Hash

Volume inspect information was changed in Docker version 1.8 from a "Volumes" list to a new "Mounts" array. See my previous volume parsing post for parsing on Docker <=1.7

Getting a list of volume paths

The Mounts section, if you do docker inspect <container name or id>, is structured like this:

    "Mounts": [
        {
            "Name": "e6c202f832b24e488cedfd0e134db439496c245a4d28f8d6345bb18f55aa61b4",
            "Source": "/var/lib/docker/volumes/e6c202f832b24e488cedfd0e134db439496c245a4d28f8d6345bb18f55aa61b4/_data",
            "Destination": "/dirinmycontainer",
            "Driver": "local",
            "Mode": "",
            "RW": true
        }
    ],

To list all volumes and associated container paths for a docker (1.8.x) container, using go templating:

docker inspect --format='{{range $mount := .Mounts}}{{$mount.Source}} -> {{$mount.Destination}}{{"\n"}}{{end}}' <container name or id>

which will return

/var/lib/docker/volumes/e6c202f832b24e488cedfd0e134db439496c245a4d28f8d6345bb18f55aa61b4/_data -> /dirinmycontainer

After upgrading to VirtualBox 5 on Windows every time I started, focused or unfocused a virtual machine my numlock status would toggle. If you're having the same problem here is how to fix it:

> VBoxManage setextradata "<machine-name>" GUI/HidLedsSync "0"

This will disable keyboard indicators (HID LEDs) synchronization. This setting it supposed to be disabled by default but for some reason it was not on my installation.
VBoxManage is located where you installed virtualbox, usually C:\Program Files\Oracle\VirtualBox.

If you have a lot of virtual machines you can process them all by running the following commands:

1. Open a command prompt

2. Add virtualbox to you path:

    > set path=%path%;C:\Program Files\Oracle\VirtualBox
   

3. Go to the directory where you're virtual machines are located, commands below are for a default install:

    > %HOMEDRIVE%
    > cd "%HOMEPATH%\VirtualBox VMs"
   

4. Update the setting for all machines in the directory

    > for /f "tokens=*" %G in ('dir /b /a:d ".\*"') do (VBoxManage setextradata "%G" GUI/HidLedsSync "0")
   

Hooray, no more numlock weirdness.

Ever tried to spin up two Docker containers, one depending on the other, only to find out the port(s) of the first container aren't actually up and running yet causing the second container to fail to start up?

Wait wait

For a while I stuck some sleep x statements in there to delay the second container but this was of course... a very flaky solution.

The solution is another docker container with the sole purpose of waiting for the port(s) of the first container to become available. Once the wait container has successfully exited the second container can safely be started.

Simple test bash script:

#! /bin/bash

#start a database container
docker run -d --name database -e MYSQL_ROOT_PASSWORD=my-secret-pw mysql

#wait for the mysql port to become available
if docker run --link database:database --rm martin/wait ; then
  echo "yay :) we can now start a container that uses the database"
else
  echo "oh no :( database is unavailable"
fi

#just cleaning up
docker rm -f database

The wait container by default checks all exposed ports in the linked container. You can limit which ports or even check entirely different URLs. See the github page for more details. If you need to check ports in multiple containers link them all in the wait command.

The same concept can be used in systemd by adding the wait command in ExecStartPre

ExecStartPre=/usr/bin/docker run --link database:database --rm martin/wait
ExecStart=/usr/bin/docker run --rm app-that-uses-database

View on Github or View on Docker registry

I know, I know, cron is much easier but I was playing around with systemd and timers were one of the things that weren't very clear to me. So this is what I finally ended up with to run several backup tasks every sunday with systemd.

Write unit-files

To create a recurring task in systemd the following unit-files are needed. A timer file which will trigger a target file at set times which in turn will trigger one or more service files. On ubuntu the files should be created in /lib/systemd/system.

1. weekly-backup.timer

    [Unit]
    Description=Weekly backup timer  
    [Timer]
    OnCalendar=Sun *-*-* 14:00:00
    [Persistant=true](http://www.freedesktop.org/software/systemd/man/systemd.timer.html#Persistent=)=true
    Unit=weekly-backup.target  
    [Install]
    WantedBy=default.target
   

WantedBy=default.target will make sure the timer is enabled when the system starts.
Unit defines the unit that will be triggered when the timer is activated.
Persistant=true makes sure the target is triggered if the system happened to be shut down when the timer should have triggered. (See Persistant)
OnCalendar defines the time(s) this timer file should trigger the target unit. I this case it will trigger on Sunday on any date at 14:00. (See systemd.time)

2. weekly-backup.target^[1]

    [Unit]
    Description=Weekly backup
    StopWhenUnneeded=yes
   

StopWhenUnneeded=yes will make sure the target is set to inactive when it's finished and the timer will be able to trigger it again the next time the timer activates.

3. backup-app.service
   First service.

    [Unit]
    Description=Backup app  
    [Service]
    ExecStart=/usr/local/bin/backupapp  
    [Install]
    WantedBy=weekly-backup.target
   

WantedBy=weekly-backup.target will make sure this service will start when weekly-backup.target is triggered by the timer.
ExecStart defines the script or program that should be run.

4. backup-data.service
   Second service, all services having WantedBy=weekly-backup.target will be triggered.

    [Unit]
    Description=Backup data  
    [Service]
    ExecStart=/usr/local/bin/backupdata  
    [Install]
    WantedBy=weekly-backup.target
   

Enable units

1. Enable the services
   systemctl enable backup-app.service
systemctl enable backup-data.service

2. Enable and start the timer
   systemctl enable weekly-backup.timer
systemctl start weekly-backup.timer

That's it.

Notes:

A couple of months ago I wrote a script to delete orphaned Docker volumes. Several people have helped on Github to improve the script since. I also added a Docker file so you can cleanup Docker volumes using... Docker. I'm not entirely convinced it's easier than downloading the script and running that but hey, you can choose.

Run cleanup using Docker

Run using the latest Docker client version. Use the –-dry-run option to have the script print the volumes that would have been deleted without actually deleting them:

docker run -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/docker:/var/lib/docker --rm martin/docker-cleanup-volumes --dry-run

or run a specific Docker client version, e.g. 1.4.1

docker run -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/docker:/var/lib/docker --rm martin/docker-cleanup-volumes:1.4.1 --dry-run

View on Github or View on Docker registry

Unlocking a full disk encrypted Ubuntu/Debian system with SSH or USB flash drive

I've started encryping my home server long before it was a next next next install option in Ubuntu and Debian. At some point I added USB unlocking with an old hacked up version of the script from How to setup passwordless disk encryption in Debian Etch to my system but had to retract the keys from the luks volume too often because of broken or lost flash drives. So I recently started looking into unlocking it from SSH for which there even was a howto included in the ubuntu distribution (/usr/share/doc/cryptsetup/README.remote.gz). Unfortunately this has been broken since 2010 when plymouth was introduced.

So I patched up the usb unlock script from How to setup passwordless disk encryption in Debian Etch to support unlocking from SSH, while maintaining support for entering the passphrase in plymouth, and
wrote an install script which sets up the system to allow unlocking of full disk encrypted Ubuntu and Debian installs through console, USB-key or SSH.

Tested on:

• Ubuntu server 14.10 (no desktop)
• Debian 7.8 (no desktop)

Use at your own risk, I'm not responsable for any damage this script might do to your system, make backups, make sure you have a safe boot option, test it in a VM first... etc. etc.

Usage

• Install Ubuntu server or Debian with full disk encrypted LVM
• sudo apt-get install -y git-core
• git clone --depth 1 https://github.com/chadoe/luks-triple-unlock.git && cd luks-triple-unlock
• chmod +x *.sh
• sudo ./install.sh [keyfile], it will ask you for the passphrase for the luks drive, keyfile is a path to a file you want to use as a key for the luks volume, this file will be read from an USB flash drive ext(2/3/4)/fat32/ntfs partition on boot. If no keyfile provided on the commandline a file .keyfile will be generated in the current directory.
• sudo reboot

Ways to unlock your machine

• from the console
• from SSH. Copy /etc/initramfs-tools/root/.ssh/id_rsa, this is the private key you need to log into dropbear (no password, root@machinename). When you connect it will ask you for the passphrase to unlock the machine.
• with an USB flash drive. Copy .keyfile (or the file you provided on the commandline to ./install.sh) to any ext(2/3/4)/fat32/ntfs partition on an USB flash drive. Stick it in the machine and boot, it should boot straight through.

View on GitHub

Oh no, access denied

So I was trying Kodi on a new Android device I got (WeTek Play) and soon ran into a problem where I couldn't access my password protected SMB shares on my linux server where my media is stored. Kodi would just ask for the username and password over and over but never authenticate. The error in Kodi's log was:

SMBDirectory->GetDirectory: Unable to open directory : 'smb://USERNAME:PASSWORD@server' unix_err:'d'error : 'Permission denied'

Now the thing was I've been using these shares from XBMC/Kodi on windows for many years and I could access these shares fine from every other machine and device... in fact even from this very same android device, just not from Kodi.
So after googling for a while without any result except people suggesting to just allow guest access to the shares (omg!?). I vaguely remembered that the linux builds, and so probably android, generate a client smb configuration file. In this file lanman auth is enabled in order to be compatible with older servers. The problem is lanman is disabled by default in any "recent" samba version (as in since Samba 3.6.0 from 2011) and I wouldn't want to recommend enabling this broken and deprecated authentication method.

The solution

What you want to do in this case is enable de default NTLMv2 authentication.
To do this you have to edit the smb.conf file stored on the device in

/storage/emulated/0/Android/data/org.xbmc.kodi/files/.smb/smb.conf

(path will vary with device) and add

client NTLMv2 auth = yes

on a new line. You can use ES File Explorer for instance to edit the file. Save, and start Kodi.

If you can't find the file then just enable debug logging in system settings from within Kodi and it will show the path on screen where the logfile is stored which is close to where smb.conf is stored on your device. /storage/emulated/0/Android/data/org.xbmc.kodi/files/.kodi/temp/kodi.log

Happy mediaplaying!

Reminder to myself that YUMI is a great little tool to boot multiple iso's from a single bootable usb-stick.

So I've been playing around with Docker containers for a while now and really like it. In fact this blog is running in a Docker container right now. But Docker sure leaves a mess behind on disk.
One of the things it tends to leave behind is volumes, that is unless you specify the --volumes option when you rm a container which I always forget. So I wrote a little script to delete all the orphaned docker volumes in /var/lib/docker/volumes and /var/lib/docker/vfs/dir:

WARNING: volumes have changed in Docker 1.7.0, the script below is outdated and will delete all volumes on Docker 1.7.0, goto GitHub for the latest version of the script that works with Docker 1.7.0

#! /bin/bash

set -eo pipefail

#usage: sudo ./docker-cleanup-volumes.sh [--dry-run]

dockerdir=/var/lib/docker
volumesdir=${dockerdir}/volumes
vfsdir=${dockerdir}/vfs/dir
allvolumes=()
dryrun=false

function delete_volumes() {
  targetdir=$1
  echo
  if [[ ! -d ${targetdir} ]]; then
        echo "Directory ${targetdir} does not exist, skipping."
        return
  fi
  echo "Delete unused volume directories from $targetdir"
  for dir in $(ls -d ${targetdir}/* 2>/dev/null)
  do
        dir=$(basename $dir)
        if [[ "${dir}" =~ [0-9a-f]{64} ]]; then
                if [[ ${allvolumes[@]} =~ "${dir}" ]]; then
                        echo In use ${dir}
                else
                        if [ "${dryrun}" = false ]; then
                                echo Deleting ${dir}
                                rm -rf ${targetdir}/${dir}
                        else
                                echo Would have deleted ${dir}
                        fi
                fi
        else
                echo Not a volume ${dir}
        fi
  done
}

if [ $UID != 0 ]; then
    echo "You need to be root to use this script."
    exit 1
fi

docker_bin=$(which docker.io || which docker)
if [ -z "$docker_bin" ] ; then
    echo "Please install docker. You can install docker by running \"wget -qO- https://get.docker.io/ | sh\"."
    exit 1
fi

if [ "$1" = "--dry-run" ]; then
        dryrun=true
else if [ -n "$1" ]; then
        echo "Cleanup docker volumes: remove unused volumes."
        echo "Usage: ${0##*/} [--dry-run]"
        echo "   --dry-run: dry run: display what would get removed."
        exit 1
fi
fi

# Make sure that we can talk to docker daemon. If we cannot, we fail here.
docker info >/dev/null

#All volumes from all containers
for container in `${docker_bin} ps -a -q --no-trunc`; do
        #add container id to list of volumes, don't think these
        #ever exists in the volumesdir but just to be safe
        allvolumes+=${container}
        #add all volumes from this container to the list of volumes
        for vid in `${docker_bin} inspect --format='{{range $vol, $path := .Volumes}}{{$path}}{{"\n"}}{{end}}' ${container}`; do
            if [[ ${vid} == ${vfsdir}* && "${vid##*/}" =~ [0-9a-f]{64} ]]; then
                    allvolumes+=("${vid##*/}")
            else
                    #check if it's a bindmount, these have a config.json file in the ${volumesdir} but no files in ${vfsdir}
                    for bmv in `grep --include config.json -Rl "\"IsBindMount\":true" ${volumesdir} | xargs -i grep -l "\"Path\":\"${vid}\"" {}`; do
                            bmv="$(basename "$(dirname "${bmv}")")"
                            allvolumes+=("${bmv}")
                            #there should be only one config for the bindmount, delete any duplicate for the same bindmount.
                            break
                    done
            fi
            done
done

delete_volumes ${volumesdir}
delete_volumes ${vfsdir}

View on GitHub or View on Docker registry

When editing a file in nano I tend to hit ctrl-z to attempt to undo an edit but when you press ctrl-z in nano it dumps you back in the shell... very confusing... and very annoying because I do this all the time and usually just started over using a new nano instance.

It turns out ctrl-z is a global command to send the current process to the background (not just nano) and here's a way to get a background process back, simply type:

fg 

and nano will be back in the terminal as it was before hitting ctrl-z. Hooray!

If there are multiple processes in the background
you can run jobs which will give you a list of processes running in the background:

[1]+  Stopped        nano fileimediting

To bring job nr 1 to back to the foreground run fg 1, simple as that.