ipmitool not working on Supermicro server with Debian 12

I have a server with a Supermicro X7SBI motherboard. It has a dedicated IPMI port but I could no do anything with it, as this was a second hand server and the IPMI had a fixed IP address in the 83... range and the admin password was unknown to me. I thought that resetting it was straightforward, but ran into a few issues:

First issue: Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory

So at first, I thought that the device itself was broken. I unplugged it, checked it, but I could see the IP address and the webserver was accessible, so that seems ok. So I tried to factory reset the BIOS, still no help. Then, after some Googling, I found out that 2 fixes were needed.

1. Adapt the GRUB boot parameters for this type of board

//add logs

These articles explain what needs to be done: different ipmi_si port address and add kernel boot parameter

Run everything as root:

vi /etc/default/grub and change GRUB_CMDLINE_LINUX_DEFAULT="quiet" to

GRUB_CMDLINE_LINUX_DEFAULT="quiet ipmi_si.type=kcs ipmi_si.ports=0xca2"

Save and exit, then update your GRUB

update-grub

Reboot your sever, now the device should be found under /dev/ipmi0

Second issue: Still, there is a second problem with this version of ipmitool for Debian 12

root@debian:~# ipmitool raw 0x6 0x46 0x02
IANA PEN registry open failed: No such file or directory
 61 64 6d 69 6e 00 00 00 00 00 00 00 00 00 00 00
root@debian:~# lsmod | grep ipmi
ipmi_si                73728  0
ipmi_devintf           20480  0
ipmi_msghandler        77824  2 ipmi_devintf,ipmi_si
root@debian:~# ipmitool lan set 1 ipsrc static
IANA PEN registry open failed: No such file or directory
2. Copy missing enterprise numbers
After some Googling, I found out there is some config missing for ipmitool. This command will solve that:

wget -O /usr/share/misc/enterprise-numbers.txt https://jff.email/cgit/ipmitool.git/plain/debian/enterprise-numbers.txt?h=debian/1.8.19-5

After which I could reset the ipmi ADMIN password and set the static IP address. Yeehaa!
root@debian:~# ipmitool user set name 2 ADMIN
root@debian:~# ipmitool user set password 2
Password for user 2: 
Password for user 2: 
Set User Password command successful (user 2)
root@debian:~# ipmitool lan set 1 ipsrc static
root@debian:~# ipmitool lan set 1 ipaddr 192.168.0.199
Setting LAN IP Address to 192.168.0.199
root@debian:~# ipmitool lan set 1 defgw ipaddr 192.168.0.1
Setting LAN Default Gateway IP to 192.168.0.1
root@debian:~# ipmitool lan print
Set in Progress         : Set Complete
Auth Type Support       : NONE MD2 MD5 PASSWORD 
Auth Type Enable        : Callback : 
                        : User     : MD5 
                        : Operator : MD5 
                        : Admin    : MD5 
                        : OEM      : MD5 
IP Address Source       : Static Address
IP Address              : 192.168.0.199
Subnet Mask             : 255.255.255.0
MAC Address             : 00:30:48:95:76:55
SNMP Community String   : public
IP Header               : TTL=0x40 Flags=0x40 Precedence=0x00 TOS=0x10
BMC ARP Control         : ARP Responses Enabled, Gratuitous ARP Enabled
Gratituous ARP Intrvl   : 2.0 seconds
Default Gateway IP      : 192.168.0.1
Default Gateway MAC     : 00:00:00:00:00:00
Backup Gateway IP       : 0.0.0.0
Backup Gateway MAC      : 00:00:00:00:00:00
RMCP+ Cipher Suites     : 0,1,2,3,6,7,8,11,12
Cipher Suite Priv Max   : uuuOXXuuOXXuOXX
                        :     X=Cipher Suite Unused
                        :     c=CALLBACK
                        :     u=USER
                        :     o=OPERATOR
                        :     a=ADMIN
                        :     O=OEM

Renew your Let's Encrypt certificate

You are using a Let's Encrypt certificate, but get the warning that it will expire. These are the quick steps to renew it.

1. Adapt your DNS and point it for the domain to your public IP (if it is currently pointing to an internal IP e.g. 192.168.Y.X)
2. Enable port forwarding for port 80/443 for this internal IP
3. Run the renewal
   

   sudo certbot renew

4. If successful, disable the port forwarding again
5. Change the DNS again

An example Iptables rules file for your Raspberry Pi (and have it applied after each reboot)

Having an Iptables firewall rule set applied onto Raspbian/Debian is fairly easy. I'm trying to build something that is easy to manage, has a certain degree of default security applied, yet will allow that I can easily apply it onto several Raspberry Pi devices.
When adding rules to your running Iptables, they become lost each time you'd reboot or restart your firewall. So, I'm trying to overcome that.

First, let's start with my basic rule set file, which is build around a number of services that I need on my Raspberry Pi:

• SSH server
• OpenVPN server
• HTTP(S) server
• DNS server
• Samba server
• Transmission server

Of course, you can add and customize as much as you want, but here's my example iptables.rules.v4 file:

# Generated by iptables-save v1.6.0 on Sun Feb 18 13:27:56 2018
*nat
:PREROUTING ACCEPT [485:82476]
:INPUT ACCEPT [24:2229]
:OUTPUT ACCEPT [192:15907]
:POSTROUTING ACCEPT [192:15907]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -m comment --comment "Allow OpenVPN routing from source 10.8.0.0 to eth0" -j MASQUERADE
COMMIT
# Completed on Sun Feb 18 13:27:56 2018
# Generated by iptables-save v1.6.0 on Sun Feb 18 13:27:56 2018
*filter
:INPUT DROP [67:11459]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [687:299583]
:f2b-openvpn - [0:0]
:f2b-sshd - [0:0]
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m comment --comment "Block null packets" -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m comment --comment "Block a syn-flood attack" -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m comment --comment "Block Xmas packets" -j DROP
# localhost
-A INPUT -i lo -m comment --comment "Allow localhost traffic" -j ACCEPT
-A INPUT -i lo -p tcp -m tcp --dport 4711:4720 -m comment --comment "TODO" -j ACCEPT
# Established connections
-A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "Allow all established inbound connections" -j ACCEPT
# DNS server
-A INPUT -p udp -m udp --dport 53 -m comment --comment "Allow DNS to this host from anywhere" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -m comment --comment "Allow DNS to this host from anywhere" -j ACCEPT
# OpenVPN server
-A INPUT -p tcp -m multiport --dports 1194 -m comment --comment "Allow OpenVPN to this host from anywhere" -j f2b-openvpn
# SSH server
-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "Allow SSH to this host from anywhere" -j f2b-sshd
-A INPUT -p icmp -m icmp --icmp-type 8 -m comment --comment "Allow ping to this host from anywhere" -j ACCEPT
# HTTP server
-A INPUT -p tcp -m tcp --dport 80 -m comment --comment "Allow HTTP to this host from anywhere" -j ACCEPT
# SSLH multiplexer
-A INPUT -p tcp -m tcp --dport 443 -m comment --comment "Allow HTTPS to this host from anywhere" -j ACCEPT
# SSH server
-A INPUT -p tcp -m tcp --dport 22 -m comment --comment "Allow SSH to this host from anywhere" -j ACCEPT
# Samba server
-A INPUT -p tcp -m multiport --dports 139,445 -m comment --comment "Allow Samba to this host from anywhere" -j ACCEPT
-A INPUT -p udp -m multiport --dports 137,138 -m comment --comment "Allow Samba to this host from anywhere" -j ACCEPT
# Transmission server
-A INPUT -p tcp -m tcp --dport 9091 -m comment --comment "Allow Transmission to this host from anywhere" -j ACCEPT
# Reject rules
-A INPUT -m comment --comment "Reject all other inboud traffic, unless specified" -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -m comment --comment "Reject all other inboud traffic, unless specified" -j REJECT --reject-with icmp-port-unreachable
-A f2b-openvpn -j RETURN
-A f2b-sshd -j RETURN
COMMIT
# Completed on Sun Feb 18 13:27:56 2018

Would you be wanting to be more specific on the rules (e.g. SSH access), you can easily add a source IP to the rule to further limit access.

# SSH server
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 22 -m comment --comment "Allow SSH to this host from anywhere" -j ACCEPT

We will now be saving this file, so that Iptables can use if after each reboot or restart.

1. Make youself root:
   

   sudo -i

2. Go to the Iptables folder:
   

   cd /etc/iptables/

3. Create a backup of the default rule set:
   

   cp -rp rules.v4 rules.v4.ori

4. Edit the rules.v4 file with vi, remove all entries and paste the rule set listed above
   

   vi rules.v4

5. List your current Iptables rules:
   

   iptables -L

6. Import the new rule set:
   

   iptables-restore < /etc/rules.v4

7. List your Iptables rules again and you should see the new rule set applied:
   

   iptables -L

8. Make the rules survive a reboot by creating this pre-up file:
   

   vi /etc/network/if-pre-up.d/iptables

9. Add this content to the file:
   #!/bin/sh
   

   /sbin/iptables-restore < /etc/iptables.up.rules

10. Make the file executable:
    

    chmod +x /etc/network/if-pre-up.d/iptables

11. Reboot to test

If you later on want to add or change rules, you can change your rules.v4 file, or add them command line to your running configuration. Adding them to your rules.v4 file will make them persist. In the latter case, you'd have to dump the running configuration into your rules.v4 file by applying:

iptables-save > /etc/iptables/rules.v4

Trying to find what process is using a certain port

If you run into the situation where you quickly want to know which process is using a certain (TCP) port, use the following command:

pi@server:~ $ sudo ss -lptn 'sport = :443'
State      Recv-Q Send-Q        Local Address:Port          Peer Address:Port 
LISTEN     0      128                       *:443                      *:*      users:(("nginx",pid=29909,fd=8),("nginx",pid=29908,fd=8),("nginx",pid=29907,fd=8),("nginx",pid=29906,fd=8),("nginx",pid=29905,fd=8))
LISTEN     0      128                      :::443                     :::*      users:(("nginx",pid=29909,fd=9),("nginx",pid=29908,fd=9),("nginx",pid=29907,fd=9),("nginx",pid=29906,fd=9),("nginx",pid=29905,fd=9))

GPG error: http://ftp.debian.org jessie-backports InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010

GPG error: http://ftp.debian.org jessie-backports InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 8B48AD6246925553 NO_PUBKEY 7638D0442B90D010

Running into this issue when trying to install certbot under Debian, the following can be done to fix it. Step 1 has probably been done already

echo 'deb http://ftp.debian.org/debian jessie-backports main' | sudo tee  /etc/apt/sources.list.d/backports.list
sudo -i
wget -O - https://ftp-master.debian.org/keys/archive-key-8.asc | apt-key add -
wget -O - https://ftp-master.debian.org/keys/archive-key-8-security.asc | apt-key add -
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8B48AD6246925553
apt-get update

Tip from here.

Building custom Linux kernel (howto)

Just summarizing what I did to build my own custom Debian Linux kernel. As I needed a few modules which where not shipped in the standard Debian kernel. All is based on this tutorial which I ran on a Debian 8.6 with 3.16 kernel. Make sure you're root.

mkdir /root/custom-kernel
cd /root/custom-kernel
apt-get install fakeroot linux-source-3.16 kernel-package libncurses5-dev
tar xf /usr/src/linux-source-3.16.tar.xz
cd linux-source-3.16
make menuconfig
make-kpkg clean
fakeroot make-kpkg --initrd --revision=001
dpkg -i linux-image-3.16.39_001_i386.deb
shutdown -r now

Enable HTTPS for EmonCMS on Raspbian

Our EmonCMS installation at home currently runs only over HTTP, which is not secure at all. Enabling HTTPS is a must do. However, there's a small tweak needed for it to work at the AllowOverride option.
Tip: If you run into the issue where you have HTTPS enabled, but the logging in returns always the login screen with message 'undefined', follow the fix explained below.

Check if HTTPS is already enabled for your Apache installation:

root@raspi1:~# netstat -an | grep LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN

As you can see, there is nothing running on port 443 (HTTPS) yet, so we'll need to enable the HTTPS configuration for Apache.

Enable the default HTTPS (SSL) configuration for Apache:

1. Check if the SSL module is already enabled for Apache.

root@raspi1:~# ls -l /etc/apache2/mods-enabled/*ssl*
root@raspi1:~#

If nothing is returned, the module is not enabled yet and needs to be linked from /etc/apache2/mods-available/

2. Make a symbolic link for the SSL module.

root@raspi1:~# cd /etc/apache2/mods-enabled/
root@raspi1:~# ln -s ../mods-available/ssl.conf ssl.conf
root@raspi1:~# ln -s ../mods-available/ssl.load ssl.load

3. Make a symbolic link for the SSL config file.

root@raspi1:~# cd /etc/apache2/sites-enabled/
root@raspi1:~# ln -s ../sites-available/default-ssl 000-default-ssl

4. Change two lines in the config file.

        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinks
                #Changed None to All on 18/11/2016
                AllowOverride All
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                #Changed None to All on 18/11/2016
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

5. Restart your Apache now.

root@raspi1:~# /etc/init.d/apache2 restart

This tip came from here.

Error installing tftpd-hpa onto Raspian: action "start" failed

What is the issue?

When trying to install the tftpd-hpa package, the installation isn't completed succesfully and the daemon is not running or cannot be started.

root@raspberrypi:/srv/tftp# apt-get install tftpd-hpa
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  ffmpeg openbsd-inetd
Use 'apt-get autoremove' to remove them.
Suggested packages:
  syslinux-common
The following NEW packages will be installed:
  tftpd-hpa
0 upgraded, 1 newly installed, 0 to remove and 5 not upgraded.
Need to get 0 B/46.1 kB of archives.
After this operation, 142 kB of additional disk space will be used.
Preconfiguring packages ...
Selecting previously unselected package tftpd-hpa.
(Reading database ... 85095 files and directories currently installed.)
Unpacking tftpd-hpa (from .../tftpd-hpa_5.2-4_armhf.deb) ...
Processing triggers for man-db ...
Setting up tftpd-hpa (5.2-4) ...

tftpd-hpa directory (/srv/tftp) already exists, doing nothing.
[....] Starting HPA's tftpd: in.tftpdinvoke-rc.d: initscript tftpd-hpa, action "start" failed.
dpkg: error processing tftpd-hpa (--configure):
 subprocess installed post-installation script returned error exit status 71
Errors were encountered while processing:
 tftpd-hpa
E: Sub-process /usr/bin/dpkg returned an error code (1)

How to fix?

Edit the tftpd-hpa config file, which is normally located under /etc/default:
vi /etc/default/tftpd-hpa
Change the IP from 0.0.0.0 to the real IP of you tftpd-hpa server machine.
Add into the option parameter "--ipv4"

Force a re-installation of tftpd-hpa.

root@raspberrypi:/srv/tftp# apt-get install -f tftpd-hpa
Reading package lists... Done
Building dependency tree
Reading state information... Done
tftpd-hpa is already the newest version.
The following packages were automatically installed and are no longer required:
  ffmpeg openbsd-inetd
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 5 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue [Y/n]? Y
Setting up tftpd-hpa (5.2-4) ...
tftpd user (tftp) already exists, doing nothing.
tftpd-hpa directory (/srv/tftp) already exists, doing nothing.
[ ok ] Starting HPA's tftpd: in.tftpd.

Now tftpd-hpa is starting properly and by default listening onto UDP port 69.