Using Linux to fix (clear) Windows 10 password

As part of my redundancy package, I was allowed to buy a second hand laptop (with a pretty good spec for the price). It came with Windows 10. I was very close to blowing W10 away (as I've done with all my previous computers), but I then decided to keep it, and perhaps have an install I can use for other purposes. May be even to test Windows Subsystem for Linux. There was one problem: I couldn't log on - no password. 

I have never used Windows 10, though I am aware of the security features, which we talk about when discussing booting a modern computer. Somehow, the old methods of using Linux to clear the password didn't feel plausible on a system that has security in mind.

But, with nothing to lose, I picked up a random live distribution - happened to be Mint 19. Boot from it (having to fiddle with the BIOS, to allow that in the first place). 

First, to check if the Windows disk is available and recognisable, run

   sudo sfdisk -l

This helped me to identify the system Windows partition as /dev/sda3, which I then mounted:

   sudo mount /dev/sda3 /mnt

Confirm the contents with:

   ls /mnt

All directories (or should I say: folders) I'd expect were there: Windows, Program Files, etc.

Now, prepare Mint, by downloading chntpw (a program capable of peeking into SAM - Windows database where password hashes are stored). 

Connected to the Internet, and run:

   sudo apt install -y chntpw

Amazingly:

   sudo chntpw

worked, listing all users and their password status. After selecting the user (administrator in my case), I was able to enable its account and clear the password. 

Removed the Mint pen drive, restarted the computer, and I was in - as administrator - without even as much as being asked for the password

SL7/RHEL7/Centos7 - don't suspend when lid closed

RHEL 7 and derivatives use Gnome 4, where user preferences are split between two areas: there is the familiar-looking Settings, in System Tools, but there is also a Tweak Tool, dedicated to the desktop preferences. 
Not everything is intuitive, and it took me a while to realise that *some* setting related to power management are no longer with power management...
One of them is the control of the suspend. To prevent your laptop going into suspend when you close the lid, go to: Applications > Utilities > Tweak Tool > Don't suspend on lid close, and turn it ON.

Broadcom wireless on HP 6735s with Mint 16

Last time I installed Linux on this laptop, it was Ubuntu 10.10. I can't remember what I did to get the wireless working, but it was painful. 

So when I started Mint 16, and wireless didn't get recognised, I had a vision of big trouble. However, one of the first articles I found was linux mint tutorial.

Followed the instructions and it all worked without a glitch.

The only comment I will add is that (of course) you need to connect to the  Internet using a wired connection first. After that:

(1) Identify your wireless chip:

$ sudo lspci -nn | grep BCM
06:00.0 Network controller [0280]: Broadcom Corporation BCM4312 802.11b/g LP-PHY [14e4:4315] (rev 01)

(2) Confirm that it is supported, against the hardware compatibility list. Look for the item indexed by the highlighted number above. Here, I'm assuming your device is supported. If not, I can't help any further...

(3) Install the driver with the following command:
$ sudo apt-get install firmware-b43-installer

Disconnect the wired cable, and wireless should pick up where Ethernet left off. Mind you, I had to restart GUI for the applet to refresh and show the wireless icon correctly.

Network fix for Red Hat 7 (Beta) in VMWare Workstation

Having installed Red Hat 7 into VMWare Workstation 10, I was disappointed I wasn't able to connect to the network. Despite VMWare showing card as connected in the bridge mode, within the guest the was no interface available. On second thought, I should have expected it, since during the initial install anaconda reported "no network connection available".

I googled the problem a lot, and the two prevailing solutions didn't do it for me. One was to re-install VM Tools (which I did - but no improvement). The other involved a spectacularly complex installation of a local repository in order to modify the install - I didn't attempt this, although there were users who said this worked for them. Instead, I tried a more basic solution, admittedly a somewhat hammer approach: beat the installation into accepting the card.

The configuration below assumes your host is connected to the Internet, and somewhere on your LAN there is a DHCP server available.

(1) We need to modify the guest's configuration and pass the e1000 card information into it. We will do this by modifying VM configuration, which should never be done whilst the VM guest is running. So, shut down the VM guest, then edit its .vmx file and append the following line:
 
ethernet0.virtualDev = "e1000"

The choice of e1000 as the assignment for the missing Ethernet interface card is just a guess - a decent default to use... Worked for me.

(2) Start the VMWare Red Hat 7 guest.

(3) NetworkManager is useful on laptops, where wireless discovery is needed. Other than that I always disable it (otherwise it is difficult to separate its functionality from the actions of the basic network service). May not be necessary, but always a good thing to do :-)

# systemctl stop NetworkManager
# systemctl disable NetworkManager
# systemctl list-unit-files|grep Network
NetworkManager-dispatcher.service          disabled
NetworkManager-wait-online.service         disabled
NetworkManager.service                     disabled

(4) Identify the name assigned to the Ethernet interface, using ip command

# ip  l l
[...]
2: eno16777736: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000
    link/ether 00:0c:29:b4:14:9d brd ff:ff:ff:ff:ff:ff


(5) Configure card script file
 
# vi /etc/sysconfig/network-scripts/ifcfg-eno16777736
DEVICE=eno16777736
BOOTPROTO=dhcp
TYPE=Ethernet
ONBOOT=yes
IPV6INIT=no
NM_CONTROLLED=no
USERCTL=no
PEERDNS=yes
PEERROUTES=yes

 
(6) Create network script links; start the interface card; enable the network service
 
# chkconfig --level 345 network on
# /etc/sysconfig/network-scripts/ifup-eth eno16777736
# /etc/init.d/network/start
Starting network (via systemctl)

 
(7) Test with ifconfig, ping and dig

# ifconfig eno16777736
eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.108  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::20c:29ff:fe46:dcfd  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:46:dc:fd  txqueuelen 1000  (Ethernet)
        RX packets 202  bytes 19631 (19.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 175  bytes 16269 (15.8 KiB)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=44 time=36.0 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=44 time=32.7 ms
^C

# dig www.qa.com
[...]
www.qa.com.        600    IN    A    193.108.37.110

B-tree wins

RHEL 7 will use xfs as its default filesystem type.

That probably seals the fate for the ext* family of filesystems for commercial installations. No doubt smaller distributions will stick to ext3 or ext4, but once Red Hat moves on, many others will follow. Mind you, it'll be interesting to see what strategy Oracle might adopt, in their quest of making btrfs the standard.

Either way, a b-tree based filesystem has now pushed out the outdated "pointer and list" technology.

I wish I could draw

Pete, my 'other half', who is a hardware engineer, got home last night screaming: "I hate software". He is embarking onto a new project (automating and electronics disciplines) which requires a use of a PIC processor. The processor can be programmed using a version of PIC Basic, and you can download a full PC programming environment software for it.

Well, Pete was having problems with debugging a program, and he was getting really frustrated with it. His view is that when you get a hardware problem, you can methodically analyse it using a meter, scope or a logic analyser - and normally you can 'easily' find where and what went wrong. With software, if things go wrong, it's difficult to identify the source of the problem. Especially in his kind of programming, where you use a PC to write and compile a program, then you upload it into the kit, normally down the serial port. Problem is that it can take a long time to get to the bottom of it, as a successful execution of the program in the PC environment doesn't necessarily mean that it will behave in the target processor environment.

Why do I wish I could draw? Well, there is that joke amongst the software people that when a user calls with a problem, the problem is perceived to be between the seat and the keyboard. And so, as Pete was describing yesterday his frustration, I built up a picture in my head of a hardware engineer trying to debug the program by holding a meter in his hand, with the two probes touching the seat and the keyboard...

Voltron: The marriage of Red Hat and CentOS

When RHEL 7 release notes were published, a hot topic was that Red Hat will start supporting CentOS. That was great news in its own right.

Today, the announcement took it one step further: the operations will merge!

Considering that the two could have been fighting each other to destruction, it is truly remarkable that they chose to pull their efforts together. In my opinion it will be a win-win for all parties, including the customers, of course!

See: http://arstechnica.com/information-technology/2014/01/red-hat-and-centos-become-voltron-build-free-operating-system-together/?goback=.gde_49301_member_5836132652578533378

Using CentOS to create a bootable USB with persistent storage

Using the good old and trusted dd tool we can easily create a simple bootable USB pen drive. Such a device would be perfectly adequate for an ad hoc work. However, this method doesn't allow to save any data or persistently modify configuration of the operating system.

To save changes, we need to create a bootable disk, but also create and configure alongside it a partition that is writeable. In the past that required laborious and long-winded process - massive essays have been written explaining the procedure. No need for that complexity now - a program to do the heavy duty work for us has now been available for a while.

This write up shows how to use such a tool in RHEL 6.2, or any of its derivatives (CentOS or Scientific Linux). It should also work in Fedora, although I haven't tested it there...

First, we need to download (or otherwise obtain) two bits of software:

(a) an up to date EPEL(*) package; go to: http://www.mirrorservice.org/sites/dl.fedoraproject.org/pub/epel/6/i386/repoview/epel-release.html and download: epel-release-6-8.noarch.rpm (or whichever is the latest version).

Then install it:

# rpm -ihV epel-release-6-8.noarch.rpm

(b) a distribution ISO file; mine is called CentOS-6.2-i386-LiveCD.iso

Now install tools for creating a bootable pendrive (it will use the EPEL repository):

# yum install livecd-tools syslinux

Prepare the USB pendrive: insert, identify partition then un-mount it:

# df

# umount /dev/sdX1

Mark partition as bootable:

# parted /dev/sdX

[parted] toggle 1 boot

[parted] quit

Finally, run the install script:

# livecd-iso-to-disk --home-size-mb 500 CentOS-6.2-i386-LiveCD.iso /dev/sdX1

(*) EPEL package gives access to programs not directly supported by Red Hat (or its derivatives). Even if you already have EPEL package installed, before you start, update it (to avoid potential conflicts with older versions). If later on you get error messages “Requires: python(abi) = 2.4 Installed: python-2.6.6-29.el6.i686 “ it means you are using a wrong EPEL version.

Installing OS into VMPlayer from a PXE boot server

We already use an Ubuntu PXE boot server (setup with tftpd, dhcpd and lighttpd) to deploy our UNIX and Linux courses.

However, for a particular event, I needed to install CentOS into VM rather than directly dropping it onto the hardware.

Since vmware runs its own dhcpd, to dish out its own IP addresses, I needed to redirect it to my server. The solution is relatively simple,  but remember, it assumes that you have all PXE boot aspects already configured on the server.

Step (1)
Stop the vmware service:

sudo service vmware stop

Step (2)
Edit vmware's own dhcpd configuration file, to point at you server (here: 192.168.1.242) and its PXE boot file. Below is a snippet of the content. Notice the normally included lease information is now commented out, and the two additional lines point at my server.
Leave the remainder of the file as is.

sudo vi /etc/vmware/vmnet1/dhcpd/dhcpd.conf

[...]

allow unknown-clients;

default-lease-time 1800; # default is 30 minutes

max-lease-time 7200; # default is 2 hours

subnet 172.16.141.0 netmask 255.255.255.0 {

   range 172.16.141.128 172.16.141.254;

   option broadcast-address 172.16.141.255;

   option domain-name-servers 172.16.141.1;

   option domain-name localdomain;

   # default-lease-time 1800;           # default is 30 minutes
   # max-lease-time 7200;               # default is 2 hours
   filename "pxelinux.0";

   next-server 192.168.1.242;

}

Step (3)
Start the vmware service:

sudo service vmware start

You are now ready to start VM Player, create a new disk for a new OS (if you haven't done it already) and start the installation. Your VM should redirect to the server, obtain the IP address and continue with the installation.

Automated kickstart install of ubuntu

Checklist:
Prepare the configuration server:
Install packages
Configure DHCP and TFTP to provide pxe-boot image files
Configure lighttpd to serve operating system files
Prepare kickstart configuration file
Start client; intercept boot and request net boot

Note: the steps below expect all servers (dhcp, tftp and web) to be on the same physical machine, here: 192.168.1.100. Both the installation server, and anticipated clients are Ubuntu machines.

----------------------
Step 1.
(a) Install dhcp3 server. This will provide the initial network boot, for the client's PXE start.

$ sudo apt-get install dhcp3-server

(b) Edit its configuration.
Add the subnet info, leave all other elements of the file as they are.

$ sudo vi /etc/dhcp3/dhcpd.conf
ddns-update-style none;

# option definitions common to all supported networks...

option domain-name "example.com";

option domain-name-servers ns1.example.org, ns2.example.org;

default-lease-time 600;

max-lease-time 7200;

log-facility local7;

subnet 192.168.1.0 netmask 255.255.255.0 {

range 192.168.1.111 192.168.1.222;

option domain-name-servers 212.135.1.36; # your DNS server

option domain-name "internal.example.com"; # your domain name

option routers 192.168.1.254; # your gateway

option broadcast-address 192.168.1.255;

filename "pxelinux.0";

}


(c) Start dhcp server.
$ sudo /etc/init.d/dhcp3-server start


----------------------
Step 2.
(a) Install tftpd-hpa (and its super-daemon, inetd):
$ sudo apt-get install openbsd-inetd tftpd-hpa

(b) Modify the main tftp setup file, in /etc/default/tftpd-hpa, to have the content as shown.
$ sudo vi /etc/default/tftpd-hpa

TFTP_USERNAME=”tftp”

TFTP_DIRECTORY=”/srv/tftp”

TFTP_OPTIONS=”--secure”

TFTP_ADDRESS=”192.168.1.100:69”


The address above is the IP address of your tftp server.

(c) Start the inetd superdaemon
$ sudo /etc/init.d/openbsd-inetd start
Starting internet superserver inetd [ OK ]

(d) Check the tftpd is now active:
$ netstat -a | grep tftp
udp 0 0 *:tftp *:*

----------------------
Step 3.
Copy the netboot files into the tftp server. (Check lftp is there, if not – install it, with sudo apt-get install lftp).
$ sudo mkdir -p /srv/tftp/
$ cd /srv/tftp/
$ sudo lftp -c “open http://archive.ubuntu.com/ubuntu/dists/lucid/main/installer-i386/current/images/netboot/; mirror”

----------------------
Step 4.
(a) Edit /srv/tftp/pxelinux.cfg/default and change string menu.cfg into text.cfg.
After the change, the file should look as follows:

include ubuntu-installer/i386/boot-screens/text.cfg

default ubuntu-installer/i386/boot-screens/vesamenu.c32

prompt 0

timeout 0



(b) Modify the /srv/tftp/ubuntu-installer/i386/boot-screens/text.cfg file to have the following content:

timeout 1

default auto

label auto

menu label ^Auto

menu default

kernel ubuntu-installer/i386/linux

append vga=normal initrd=ubuntu-installer/i386/initrd.gz

ks=http://192.168.1.100/ubuntu/ks.cfg -- quiet



----------------------
Step 6.
(a) Install lighttpd (may need to stop apache first, if running).
$ sudo /etc/init.d/apache2 stop # if running
$ sudo apt-get install lighttpd

(b) Ensure that the root directory is /srv/www (the default /var/www could be used, but we follow proper FHS rules here ;-). This will serve all installation files. The url directive in the kickstart file will direct the installation program to this web page.
$ sudo vi /etc/lighttpd/lighttpd.conf
change the document-root directive to read as follows:
server.document-root = "/srv/www/"

(c) Start lighttpd
$ sudo /etc/init.d/lighttpd start

----------------------
Step 7.
Populate the the web server with the installation files.

Here, we will get the installation files from the Ubuntu installation CD (assumes Ubuntu installation CD is in the drive on the server machine, and mounted).

$ sudo mkdir /srv/www/ubuntu
$ sudo cp -rv /dev/sr0/* /srv/www/ubuntu

(time for a cuppa)

----------------------
Step 8.
Create a text file called ks.cfg with the kickstart instructions, and place it in the /srv/www/ubuntu directory.
Notice that /srv/tftp/ubuntu-installer/i386/boot-screens/text.cfg is pointing at this file.

#platform=x86


#System language

lang en_UK

#Language modules to install

langsupport en_UK

#System keyboard

keyboard gb # not uk !

#System mouse

mouse

#System timezone

timezone Europe/London

#Root password

rootpw --disabled

#Initial user

user fred --fullname "Fred User" --iscrypted --password
$1$TbZtLDPw$YG89LpNillhOvTH4zeEse/

#Reboot after installation

reboot

#Use text mode install

text

#Install OS instead of upgrade

install

#Use Web installation - provide the URL of your web server

url --url http://192.168.1.100/ubuntu

#cdrom

#System bootloader configuration

bootloader --location=mbr

#Clear the Master Boot Record

zerombr yes

#Partition clearing information

clearpart --all --initlabel

#Disk partitioning information

part / --fstype ext3 --size 10000000 # --grow failed for me ;-(

part swap --size 512

part /lvm --fstype lvm --size 512

#System authorization information

auth --useshadow --enablemd5

#Network information

network --bootproto=dhcp --device=eth0

#Firewall configuration

firewall --disabled

#Do not configure the X Window System

skipx

%packages # comment out needed packages, or add new

openssh-server

# ubuntu-vm-builder

# libvirt-bin

# screen

%pre

%post


perl -pi -e "s/kickseed/myserver/g" /etc/hosts /etc/motd

perl -pi -e "s/ubuntu/myserver/g" /etc/hosts /etc/motd


cat > /etc/hostname <<>

myserver

EOF


cat >> /etc/hosts <<>

192.168.1.10 myserver.example.com myserver

192.168.1.11 yourserver.example.com yourserver

192.168.1.12 herserver.example.com herserver

EOF


# any other post-installation shell command(s) can go here


This concludes server configuration.


----------------------------
Step 9. On the client:

Boot, intercept the booting process and enter BIOS. Change the sequence of boot devices, and select network boot.

Ideally, you want to identify a separate key, like F12 on some machines, which request PXE boot without you changing the boot sequence. This will prevent repeated boots as the machine restarts after the installation.

How did Ubuntu speed up boot time?

Fact: Ubuntu 10.04 boots significantly faster than any other desktop/laptop OS I have ever used. On the same machine (Asus), boot time went from about 75 seconds to less than 30. My Lenovo X201 takes approximately 25 seconds to go through full reboot cycle.


How come? Scott of Canonical, explained at LINUXCON.


When booting a Linux system, four distinct phases occur:
1.Load into memory the kernel and ramdisk
2.Load platform drivers
3.Start X-related stuff
4.Start the desktop

Ubuntu developers made a conscious decision to aim for target timing. Rather than tweaking existing sequence of events, they decided to invest time into redesigning the boot process, and aim for 2+2+2+4 seconds for each stage, respectively.


That would give a cold-to-desktop time of 10 seconds. Test base platform that was used was a Dell laptop (can't remember which one, but it doesn't matter, as advantages and shortened time will apply to most contemporary PCs).


How they went about it: first of all, they looked at the monolithic kernel content, and cleaned it up. This had a two-fold benefit: it allowed to remove some of the duplicity, where two (or more !) modules were doing the same thing, but also in the process, they managed to nearly half the footprint of the kernel image itself – a massive saving in resource and time to load.


Ramdisk savings are not that easy to achieve. You can't remove it altogether: ramdisk is essential, as it provides the hibernate/suspend functionality, LVM, RAID, filesystem encryption, etc. However, where the saving can be made is if you start performing ramdisk tasks asynchronously with the loading of mainline kernel. That, of course, relies on the CPU with multi-cores, but even on a single core the benefits are significant, as the kernel will schedule things more efficiently whilst waiting for hardware to return.


Other improvements:


1.
blkid process (relying on while/sleep) poll-style operation has now been fully replaced by libudev process (which instead of polling devices, it works on the “tell me when you are ready” principle. That alone saved 3.5 seconds off the boot time


2.
upstart – a total replacement to the init process; it allowed to eliminate 1000s of shell script code and replaced the sequential processing of the service startup with event-driven service initialisation. For example, in the traditional method, when got to mounting a device and the device wasn't up and running, it would miss out on being connected. With initupstart, device will be mounted when it announces its readiness


3.
ureadahead – a binary providing a method of speeding up disk seeks and reads; much more effective on SSD drives, because HDD disks are still prone to slow seeks, as disk geometry gets in the way; ureadahead is fs-independent, although it still can't cope with the fs metadata location problems
use light-weight desktops


4.
in future compiz will be replaced with faster alternative

Oracle take on Linux

Wim Coekaerts was the first guest speaker at this year's Linuxcon, in Boston. Oracle are one of the event's sponsors, which in itself seems rather significant.

Considering recent acquisition of Sun Microsystems by Oracle, it's not surprising that Oracle's presence here is important.

I'm not going to transcribe the talk. Few comments only: the indication of where Oracle stand on Solaris and Linux is apparently in the fact that they are at present hiring professionals in both of these.

According to Wim, more than 20% of Oracle installations run on Linux. His closing comment was:

"Linux is here to stay, also at Oracle"

That was to say - nobody argues the place of Linux in today's IT, and that has nothing to do with Oracle, no individual or organisation can change the momentum Linux has. However, Oracle are declaring their full embrace for both Linux and open source in general.

Creation time in UniX? Yes - in ext4

The ext4 file system has now been available for a while, but so far Ubuntu is the only distribution installing it by default.

There are significant differences between ext4 and its predecessors, and amongst them is extent mapping (instead of the traditional indirect block mapping), the new 1 nanosecond date resolution capability, date limit pushed back till 25/04/2514, and for the first time in UNIX i-node that stores five file timestamps (i-node width defaults to 256 bytes in ext4).

In addition to the traditional atime (a=access), mtime (m=modification) and ctime (c=change of i-node), in ext4 we now also have crtime (cr=creation) and dtime (d=deletion).

It's this creation time that many people insisted on having... So we now have it. There is one problem, though. Standard Linux tools can't yet deal with this sophistication!

Normally, we would use tools like stat or find to read file attributes from their i-nodes, but at the moment, they are not extracting any more information from ext4 than from ext2 or ext3.

This is where debugfs can help. First, check which partitions are formatted with ext4:

# mount | grep ext4

/dev/sda1 on / type ext4 (rw,errors=remount-ro)

Here, the root file system is ext4. To see all know timestamps on a file in this file system (for example, for /etc/hosts file):

# debugfs -R 'stat /etc/hosts' /dev/sda1

Inode: 133370 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1995841318 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 250
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
atime: 0x4c3da303:c11dd858 -- Wed Jul 14 12:44:03 2010
mtime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
crtime: 0x4c080d16:0bf9435c -- Thu Jun 3 21:14:14 2010
Size of extra inode fields: 28
EXTENTS:
(0): 557470

Alternatively, check its i-node number (with ls -i) and run debugfs aganist it (notice the compulsory angle brackets if using i-node number):

# debugfs -R 'stat <133370>' /dev/sda1

Inode: 133370 Type: regular Mode: 0644 Flags: 0x80000
Generation: 1995841318 Version: 0x00000000:00000001
User: 0 Group: 0 Size: 250
...


At last!

BTW, I'm being told perl can extract the crtime from the i-node, but haven't tried it yet...

Update your SSL certificate for Citrix

Some time ago I wrote in this blog a little tutorial on how to install and configure a Citrix client in Linux. The solution worked then, and still works today (I am now on 64-bit Ubuntu 10.04).

However, some weeks ago, I started getting "You have chosen not to trust..." message when connecting. Unfortunately for me, it coincided with a new laptop build, and I have assumed that my configuration has gone awry. My new system was built from scratch, but the home directory was restored from an rsync backup of my old laptop. That managed to confuse me, in that I suspected that some of the start-up files imported from the old (32-bit) laptop conflicted with the new (64-bit) system. It kept me going! I have repeated my own instructions several times, trying other browsers, googling if others had anything similar issues. The overwhelming set of instructions kept referring to the lack of the certificate in the correct ICAclient location. I have double and treble checked that part of the setup, and all seemed well, but the problem persisted.

Having spent several hours on dissecting the problem and getting nowhere, I suddenly relised that all proposed solutions refer to a couple of certificate authorities, whereas my error message referred to something totally different. Went to their site, and it turned out that my certificate that, I had been using for years, has been updated (even though it was meant to be valid till 2020). Anyway, a new download of the certificate into the keystore:



(an operation that in itself took about 15 seconds) and the problem was sorted.

Fixing sound in Ubuntu

Several installs later, I have noticed a recurring issue. You install base OS (in my case Ubuntu, currently on 10.4), and although system sound is OK, I wasn't getting any sound from video clips, youtube, BBC iplayer, etc. Having been through all sort of attempts to fix it, from simple alsamixer adjustment, to installing new drivers, nothing would manage to fix it.

Then some time later I would try to play an .mp3 track stored on the hard disk, and a pop up screen would suggest installing missing plugins, provided by gstreamer. I followed the instructions (all GUI), and sound works in every application and situation. It's only when this happened again, I think for the third time (same sequence of events when installed 9.04 and 9.10 before), when I clicked it's a 'proper' fix, that seems to work for me consistently. Moral of the story - if youhave problems with sound, see if you can play 'standard' music. If not - with any luck you will be guided how to fix it, and you should be in business in a tick!

BTW, I deliberately missed my hardware spec and setup here, as this has occurred on more than one machine.

A gap year ?

I blame my machines going up and down for the silence, and spending every last computing moment on backups, rebuilds, re-installs.


Some of it is my own fault, pushing the hardware to the limits, experimenting with virtualization, tuning the CPUs (one of the crashes was my incorrect use of the taskset command, another trying to modify udev to read my camera in a particular way).


But the worst disaster was when on a dual boot Windows 7 partition crashed, causing a wonderful blue screen of death. I kept the snapshot of this, for those that don't believe...

Anyway, I'm back, trying to catch up. I'm nearly there, abandoned dual boot (will have all other OSes in VMware), and running with Ubuntu 9.10 again. Getting ready for the new LTS (Long Term Support), the 10.4 version out soon...