When installing Interactive Brokers TWS on Linux, I encountered the following error after the installer unpacked the Java Runtime Environment (JRE):
library initialization failed - unable to allocate file descriptor table - out of memoryAborted
The solution was to increase the open file limit before running the installer:
$ ulimit -n 10000
$ ./tws-stable-linux-x64.sh
F5 VPN does not play well with split DNS configuration using systemd-resolved because it insists on trying to rewrite /etc/resolv.conf. The workaround is to make resolv.conf immutable, and configure the DNS settings for the tunnel manually. systemd-resolved does not have a mechanism for persistant per-interface configuration, and it relies on NetworkManager to configure each connection correctly. F5 VPN is not compatible with NetworkManager, and does not make it easy to configure it this way.
NetworkManager-dispatcher allows you to run scripts based on network events. In our case, we will use it to automatically add DNS configurations when the F5 VPN tunnel tun0 is up, and thus provide persistent configuration.
Here is the script:
#!/bin/bash
INTERFACE=$1
STATUS=$2
case "$STATUS" in
'up')
if [ "$INTERFACE" = "tun0" ]; then
# Add your search domains here
SEARCH_DOMAINS="~example.corp ~example.local"
resolvectl domain "$INTERFACE" $SEARCH_DOMAINS
resolvectl dns $INTERFACE 192.168.100.20 192.168.100.22
resolvectl dnsovertls tun0 no
fi
;;
esac
The script checks if the interface is tun0 and if the current action is up. If so, it uses resolvectl to configure search domains and local DNS servers. Lastly, DNS over TLS is disabled, as the corporate DNS servers do not support them.
To make this script work, install in the /etc/NetworkManager/dispatcher.d/ directory with the name f5-vpn. Make sure it’s executable and only writable by root. NetworkManager-dispatcher will run this script whenever a network interface goes up, automatically setting the DNS configurations for F5 VPN tunnel.
By default, the Power tab in GNOME’s Settings does not show the battery percentage for Bluetooth headphones like the Sony WH-1000XM3. However, you can enable this feature by activating the DBUS interface of Bluez, the Linux Bluetooth protocol stack. The DBUS interface is hidden behind the --experimental flag for the Bluez service. To enable it, follow these steps:
bluetooth service:$ sudo systemctl edit bluetooth
This command will create the file /etc/systemd/system/bluetooth.service.d/override.conf.
[Service]
ExecStart=
ExecStart=/usr/libexec/bluetooth/bluetoothd --experimental
Note that both ExecStart= lines are required.
These are the steps I took to migrate a Debian installation from an old computer to a new one. I took out the old SSD, and connected it via an external enclosure to the new computer, and booted via a live USB.
The next step is to copy over the entire disk from the old SSD to the new one. Because we will copy everything, even the partitions’ UUIDs will remain the same and no extra steps should be necessary apart from adjusting some partition sizes. Be very careful with the output and input devices. In my case the old SSD is connected as the external drive /dev/sdb and the new one is /dev/nvme0n1.
$ sudo dd if=/dev/sdb of=/dev/nvme0n1 bs=4K status=progress
Refresh the partition table:
$ sudo partprobe
Grow /dev/nvme0n1p3to fill the entire partition using gparted.
$ sudo cryptsetup --token-only open /dev/nvme0n1p3 new-root
$ sudo cryptsetup resize --token-only new-root
(you can omit --token-only if you don’t use a Yubikey to unlock the drive).
Mount the btrfs root file system and resize it:
$ sudo mount -t btrfs /dev/mapper/new-root /mnt
$ sudo btrfs filesystem resize max /mnt
Now you are ready to reboot into the new system.
Moving to a new SSD is also a good opportunity to rotate the master key of the LUKS encrypted root partition. This can be done while the disk is online and mounted, and takes some time.
The reencryption implementation doesn’t properly support FIDO2 keys for unlocking. We would have to delete those and re-register the keys afterwards. Select a key slot with a passphrase and pass it using the --key-slot parameter. You can check which key-slot is in use using cryptsetup luksDump
$ sudo cryptsetup reencrypt /dev/nvme0n1p3 --key-slot 1
Once done, re-enroll any FIDO2 keys you have by running the following command for each key:
$ sudo systemd-cryptenroll /dev/nvme0n1p3 --fido2-device=auto --fido2-with-client-pin=yes
Initially, I had problems with Secure Boot refusing to boot the new installation. They were resolved by reinstalling shim-signed and grub-efi-amd64-signed. Additionally, I had to enable “Allow Microsoft 3rd Party UEFI CA” in the Secure Boot settings of the UEFI:
GNOME 44 recently got released. Because Debian Bookworm is undergoing a freeze, GNOME 44 is not yet available in Debian Unstable. It’s very similar to the GNOME 40 situation 2 years ago. While the wait for the freeze to be over can take a long time, Debian already has (most) of the updated pacakges in the experimental, and we can update to GNOME 44 through it:
$ sudo apt install -t experimental baobab eog evince gdm3 gjs gnome-backgrounds gnome-calculator gnome-characters gnome-contacts gnome-control-center gnome-disk-utility gnome-font-viewer gnome-keyring gnome-logs gnome-menus gnome-online-accounts gnome-remote-desktop gnome-session gnome-settings-daemon gnome-shell gnome-shell-extensions gnome-software gnome-system-monitor gnome-text-editor gnome-user-docs mutter gnome-desktop3-data
$ sudo apt-mark auto baobab eog evince gdm3 gjs gnome-backgrounds gnome-calculator gnome-characters gnome-contacts gnome-control-center gnome-disk-utility gnome-font-viewer gnome-keyring gnome-logs gnome-menus gnome-online-accounts gnome-remote-desktop gnome-session gnome-settings-daemon gnome-shell gnome-shell-extensions gnome-software gnome-system-monitor gnome-text-editor gnome-user-docs mutter gnome-desktop3-data
In order to have AVIF support in Digikam in Debian, you need to install kimageformat-plugin.
$ sudo apt install qt5-avif-image-plugin kimageformat-plugins
Alternatively, similar support is offered via qt5-avif-image-plugin, but Debian recommends the kimageformat-plugin for general users.
Many corporate environments have internal DNS servers that are required to resolve internal resources. However, you might prefer a different DNS server for external resources, for example 1.1.1.1 or 8.8.8.8. This allows you to use more secure DNS features like DNS over TLS (DoT). The solution is to set up systemd-resolved as your DNS resolver, and configure it for split DNS resolving.
Starting with systemd 251, Debian ships systemd-resolved as a separate package. If it isn’t installed, go ahead and install it.
$ sudo apt install systemd-resolved
$ sudo systemctl enable --now systemd-resolved.service
Create the following configuration file under /etc/systemd/resolved.conf.d/99-split.conf:
[Resolve]
DNS=1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
Domains=~.
DNSOverTLS=opportunistic
Domains=~. gives priority to the global DNS (1.1.1.1 in our case) over the link-local DNS configurations which are pushed through DHCP (like internal DNS servers).
DNSOverTLS=opportunistic defaults to DNS over TLS but allows fallback to regular DNS. This is useful when corporate DNS doesn’t support DNS over TLS and you still want to resolve corporate internal domains.
Restart systemd-resolved to reload the configuration:
$ sudo systemctl restart systemd-resolved
The final step is to redirect programs relying on /etc/resolv.conf (possibly through the glibc API) to the systemd-resolved resolver. The recommended way according to the systemd-resolved man page is to symlink it to /run/systemd/resolv/stup-resolv.conf.
$ sudo ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
F5 VPN doesn’t play well with the above configuration. First, F5 VPN tries to overwrite the DNS configuration in /etc/resolv.conf, by removing the existing file and replacing it with its own (pushing corporate DNS server configuration through it). The solution is to prevent F5 VPN from deleting the /etc/resolv.conf, by setting it to immutable. However, we cannot chattr +i a symlink. We have to resort to copying the configuration statically, and then protect it.
$ sudo cp /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
$ sudo chattr +i /etc/resolv.conf
Finally, because now F5 VPN can’t update the DNS configuration, we would have to manually configure the corporate DNS servers and the search domains.
$ sudo resolvectl dns tun0 192.168.100.20 192.168.100.22
$ sudo resolvectl domain tun0 ~example.corp ~example.local
Update: See Automating DNS Configurations for F5 VPN Tunnel using Systemd-resolved and NetworkManager-dispatcher for a script that automates the configuration.
By default, Debian packages aren’t symbolized, resulting in unreadable stacktraces:
#0 0x00007fb9d7a3a774 in ?? ()
#1 0x00005574a4450ea0 in ?? ()
#2 0x00005574a42cea60 in ?? ()
#3 0x00005574a3f8bd20 in ?? ()
#4 0x00007ffe0d782200 in ?? ()
The first step is to determine the right package containing the debug symbols for your binary. This can be done using find-dbgsym-packages from the debian-goodies packages:
$ find-dbgsym-packages /usr/bin/gnome-control-center
Install the relevant *-dbgsym packages, for example:
$ sudo apt install gnome-control-center-dbgsym libglib2.0-0-dbgsym
And now you can have symbolized stacktrace:
#0 0x00007fb9d7a3a774 in g_type_check_instance_cast (type_instance=0x100000002, iface_type=93959409689392) at ../../../gobject/gtype.c:4122
#1 0x00005574a0d1382f in private_key_picker_helper (self=self@entry=0x5574a3f8bd20, filename=filename@entry=0x5574a42cea60 "*******************************************", changed=changed@entry=1)
at ../panels/network/wireless-security/eap-method-tls.c:252
#2 0x00005574a0d13a34 in private_key_picker_file_set_cb (chooser=<optimized out>, user_data=0x5574a3f8bd20) at ../panels/network/wireless-security/eap-method-tls.c:297
#3 0x00007fb9d7a173b0 in g_closure_invoke (closure=0x5574a4302fb0, return_value=return_value@entry=0x0, n_param_values=2, param_values=param_values@entry=0x7ffe0d782200, invocation_hint=invocation_hint@entry=0x7ffe0d782180)
at ../../../gobject/gclosure.c:832
#4 0x00007fb9d7a2a076 in signal_emit_unlocked_R (node=node@entry=0x5574a1335ba0, detail=detail@entry=1327, instance=instance@entry=0x5574a3f91350, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffe0d782200)
at ../../../gobject/gsignal.c:3796
#5 0x00007fb9d7a30bf5 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffe0d7823a0) at ../../../gobject/gsignal.c:3549
By default, Debian doesn’t create core dumps. This can be changed (for the current running terminal session) with
$ ulimit -c unlimited
You can create more sensible core dump names using:
sudo sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t
$ pip list --user --outdated --format=json | jq ".[].name" | xargs pip install --user --upgrade
pip list --user --outdated will list all user-installed packages that are outdated. We use jq to extract the package names from the output, and feed it to xargs.
If your LibreOffice UI looks ugly and not following your GNOME theme, you might be missing a package.
After installing the libreoffice-gnome package (which also pulled the libreoffice-gtk3 package), LibreOffice looked much better and the UI was properly themed.
