This guide will hopefully help you get AirPrint working on older HP LaserJet devices that do not natively support it.
On your Debian 10 server, install avahi-daemon (Bonjour) and CUPS (print queue) servers:
$ sudo apt install avahi-daemon cups
Add printer queue, replacing your.printer.hostname with host or IP of your printer, and set the description (-D) to whatever you want:
$ sudo lpadmin -p hp -D "HP LaserJet M1522nf MFP" -E -m drv:///sample.drv/laserjet.ppd -v socket://your.printer.hostname
Check if the sharing capability is enabled within CUPS and if not, enable it:
$ sudo cupsctl | grep share
_share_printers=0
$ sudo cupsctl --share-printers
Also enable sharing for the queue itself:
$ sudo lpadmin -p hp -o printer-is-shared=true
You can check the default settings for the printer using lpoptions. The defaults are displayed with an asterisk next to them:
$ lpoptions -d hp -l
PageSize/Media Size: *Letter Legal Executive Tabloid A3 A4 A5 B5 EnvISOB5 Env10 EnvC5 EnvDL EnvMonarch
Resolution/Resolution: 150dpi *300dpi 600dpi
InputSlot/Media Source: *Default Tray1 Tray2 Tray3 Tray4 Manual Envelope
Duplex/2-Sided Printing: *None DuplexNoTumble DuplexTumble
Option1/Duplexer: *False True
Here I have changed the paper size and default resolution systemwide:
$ sudo lpadmin -p hp -o PageSize=A4
$ sudo lpadmin -p hp -o Resolution=600dpi
You should now be able to see the mDNS entries using avahi-browse (in the avahi-utils package):
$ avahi-browse -at | grep -i hp
+ eth0 IPv6 HP LaserJet M1522nf MFP @ server UNIX Printer local
+ eth0 IPv4 HP LaserJet M1522nf MFP @ server UNIX Printer local
+ eth0 IPv6 HP LaserJet M1522nf MFP @ server Secure Internet Printer local
+ eth0 IPv4 HP LaserJet M1522nf MFP @ server Secure Internet Printer local
+ eth0 IPv6 HP LaserJet M1522nf MFP @ server Internet Printer local
+ eth0 IPv4 HP LaserJet M1522nf MFP @ server Internet Printer local
For fairly minimal effort, this setup seems to work quite well. Although printing is done via AppSocket/JetDirect, CUPS is smart enough to talk to the printer via SNMP to find out the printer status such as low toner or any errors. If it isn't already obvious, the Debian server will need to be on for the AirPrint function to work!
Tim Kent
Monday, 7 October 2019
Wednesday, 28 November 2018
Hardening Samba
This post details how you can set up your Samba server to be a bit more resilient than the defaults.
The Samba server security page gives information on using the hosts allow/deny directives, interface binding configuration, and keeping up-to-date, so I'm not going to mention those things here.
I am however going to jump into a few other directives.
First of all, there's no good reason to give out the server's version, so my server replies with "Samba".
I'm using the "standalone server" server role, so I can disable NetBIOS completely, and without NetBIOS and SMB1 there's no need to listen on anything other than TCP/445.
Here are smb.conf server directives to get you started with those changes:
[global]
server string = Samba
disable netbios = Yes
server min protocol = SMB2
smb ports = 445
server signing = required
In addition to the above, you should consider disabling anonymous authentication.
With anonymous authentication enabled (the default), anyone can specify a blank user and password to view shares and other information, and talk to IPC$:
user@client:~$ smbclient -m SMB2 -L server -U ''
Enter 's password:
Sharename Type Comment
--------- ---- -------
share Disk
IPC$ IPC IPC Service (Samba)
Connection to server failed (Error NT_STATUS_CONNECTION_REFUSED)
NetBIOS over TCP disabled -- no workgroup available
The Samba server security page gives information on using the hosts allow/deny directives, interface binding configuration, and keeping up-to-date, so I'm not going to mention those things here.
I am however going to jump into a few other directives.
First of all, there's no good reason to give out the server's version, so my server replies with "Samba".
I mandate SMB2 as the minimum required protocol, and enforce signing. I really recommend you do this and so does Microsoft. Without mandating signing you are leaving yourself open to man-in-the-middle attacks. These settings will work with clients on Windows 7 and newer, and any non-ancient Linux/macOS.
I'm using the "standalone server" server role, so I can disable NetBIOS completely, and without NetBIOS and SMB1 there's no need to listen on anything other than TCP/445.
Here are smb.conf server directives to get you started with those changes:
[global]
server string = Samba
disable netbios = Yes
server min protocol = SMB2
smb ports = 445
server signing = required
In addition to the above, you should consider disabling anonymous authentication.
With anonymous authentication enabled (the default), anyone can specify a blank user and password to view shares and other information, and talk to IPC$:
user@client:~$ smbclient -m SMB2 -L server -U ''
Enter 's password:
Sharename Type Comment
--------- ---- -------
share Disk
IPC$ IPC IPC Service (Samba)
Connection to server failed (Error NT_STATUS_CONNECTION_REFUSED)
NetBIOS over TCP disabled -- no workgroup available
To disable this, you can set restrict anonymous in smb.conf:
[global]
restrict anonymous = 2
Restart Samba:
admin@server:~$ sudo systemctl restart smbd
You'll now be denied if you use blank credentials:
user@client:~$ smbclient -m SMB2 -L server -U ''
Enter 's password:
tree connect failed: NT_STATUS_ACCESS_DENIED
One other thing I'll mention is my tendency to add a "valid users" line to each share, and whitelist just the users/groups requiring permission.
Thanks for reading!
Sunday, 25 November 2018
Electric bike build part 6
Continued from Electric bike build part 5.
My electric bike has almost hit 2,400km and only just now has required another re-torque of the motor. I haven't had any other issues other than a bit of rubbing from the 28mm tyres - it's really touch and go with this frame and I've been told the GP4000 tyres are fatter than advertised.
It looks like the rubber has been completely wiped out by motor movement:
A clamp came in handy to hold the motor in place while doing the re-torque:
Thread locker applied again to both rings:
I used the spanner through an old shirt to keep the alloy lock ring looking pretty:
I still think it's an awesome machine and a great way to commute! No regrets!
All I can think of is if I had to do it all over again I'd look at a bike with disc brakes and a bit more clearance for wider tyres so I can run lower pressures, but I'm in no rush to make the change.
My electric bike has almost hit 2,400km and only just now has required another re-torque of the motor. I haven't had any other issues other than a bit of rubbing from the 28mm tyres - it's really touch and go with this frame and I've been told the GP4000 tyres are fatter than advertised.
It looks like the rubber has been completely wiped out by motor movement:
A clamp came in handy to hold the motor in place while doing the re-torque:
Thread locker applied again to both rings:
I used the spanner through an old shirt to keep the alloy lock ring looking pretty:
I still think it's an awesome machine and a great way to commute! No regrets!
All I can think of is if I had to do it all over again I'd look at a bike with disc brakes and a bit more clearance for wider tyres so I can run lower pressures, but I'm in no rush to make the change.
Wednesday, 12 September 2018
Plex hardware accelerated transcoding within LXC
I run Plex Media Server within an LXC container on my NAS. The NAS itself is a QNAP TS-251+ but it is running Debian 9. I have all the functions I use separated into individual LXC containers.
Plex runs quite well considering the low powered Celeron J1900 processor, but it does tend to struggle with HD transcoding. I managed to get GPU assisted transcoding working this evening which appears to help considerably!
Here are the requirements:
https://support.plex.tv/articles/115002178853-using-hardware-accelerated-streaming/
Fortunately the Celeron J1900 supports Intel Quick Sync Video.
First of all I checked the host could see the DRI stuff:
tim@host:~$ journalctl
Jul 16 21:29:30 jupiter kernel: [drm] Initialized i915 1.6.0 20160919 for 0000:00:02.0 on minor 0
tim@host:~$ ls -l /dev/dri
total 0
crw-rw---- 1 root video 226, 0 Jul 16 21:29 card0
crw-rw---- 1 root video 226, 64 Jul 16 21:29 controlD64
crw-rw---- 1 root video 226, 128 Jul 16 21:29 renderD128
I then tried mapping the devices through to the container:
tim@host:~$ sudo vi /var/lib/lxc/plex/config
...
lxc.mount.entry = /dev/dri dev/dri none bind,create=dir 0 0
I restarted the container then installed the relevant driver and the vainfo program within it:
tim@plex:~$ sudo apt-get install i965-va-driver vainfo
Both the Plex user and my user were in the video group yet vainfo was just saying 'Abort' instead of giving any useful info. I did some further digging:
tim@plex:~$ strace vainfo
...
open("/dev/dri/renderD128", O_RDWR) = -1 EPERM (Operation not permitted)
open("/dev/dri/card0", O_RDWR) = -1 EPERM (Operation not permitted)
...
The container did not have permissions to talk to those devices.
I did a bit of reading on control groups and device numbers and came up with the following rule to allow the container to use any character device with a major number of 226 (Direct Rendering Infrastructure):
tim@host:~$ sudo vi /var/lib/lxc/plex/config
...
lxc.cgroup.devices.allow = c 226:* rw
lxc.mount.entry = /dev/dri dev/dri none bind,create=dir 0 0
After stopping and starting the container, I could now run vainfo successfully:
tim@plex:~$ vainfo
error: XDG_RUNTIME_DIR not set in the environment.
error: can't connect to X server!
libva info: VA-API version 0.39.4
libva info: va_getDriverName() returns 0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_0_39
libva info: va_openDriver() returns 0
vainfo: VA-API version: 0.39 (libva 1.7.3)
Plex runs quite well considering the low powered Celeron J1900 processor, but it does tend to struggle with HD transcoding. I managed to get GPU assisted transcoding working this evening which appears to help considerably!
Here are the requirements:
https://support.plex.tv/articles/115002178853-using-hardware-accelerated-streaming/
Fortunately the Celeron J1900 supports Intel Quick Sync Video.
First of all I checked the host could see the DRI stuff:
tim@host:~$ journalctl
Jul 16 21:29:30 jupiter kernel: [drm] Initialized i915 1.6.0 20160919 for 0000:00:02.0 on minor 0
tim@host:~$ ls -l /dev/dri
total 0
crw-rw---- 1 root video 226, 0 Jul 16 21:29 card0
crw-rw---- 1 root video 226, 64 Jul 16 21:29 controlD64
crw-rw---- 1 root video 226, 128 Jul 16 21:29 renderD128
I then tried mapping the devices through to the container:
tim@host:~$ sudo vi /var/lib/lxc/plex/config
...
lxc.mount.entry = /dev/dri dev/dri none bind,create=dir 0 0
I restarted the container then installed the relevant driver and the vainfo program within it:
tim@plex:~$ sudo apt-get install i965-va-driver vainfo
Both the Plex user and my user were in the video group yet vainfo was just saying 'Abort' instead of giving any useful info. I did some further digging:
tim@plex:~$ strace vainfo
...
open("/dev/dri/renderD128", O_RDWR) = -1 EPERM (Operation not permitted)
open("/dev/dri/card0", O_RDWR) = -1 EPERM (Operation not permitted)
...
The container did not have permissions to talk to those devices.
I did a bit of reading on control groups and device numbers and came up with the following rule to allow the container to use any character device with a major number of 226 (Direct Rendering Infrastructure):
tim@host:~$ sudo vi /var/lib/lxc/plex/config
...
lxc.cgroup.devices.allow = c 226:* rw
lxc.mount.entry = /dev/dri dev/dri none bind,create=dir 0 0
After stopping and starting the container, I could now run vainfo successfully:
tim@plex:~$ vainfo
error: XDG_RUNTIME_DIR not set in the environment.
error: can't connect to X server!
libva info: VA-API version 0.39.4
libva info: va_getDriverName() returns 0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_0_39
libva info: va_openDriver() returns 0
vainfo: VA-API version: 0.39 (libva 1.7.3)
vainfo: Driver version: Intel i965 driver for Intel(R) Bay Trail - 1.7.3
vainfo: Supported profile and entrypoints
VAProfileMPEG2Simple : VAEntrypointVLD
VAProfileMPEG2Simple : VAEntrypointEncSlice
VAProfileMPEG2Main : VAEntrypointVLD
VAProfileMPEG2Main : VAEntrypointEncSlice
VAProfileH264ConstrainedBaseline: VAEntrypointVLD
VAProfileH264ConstrainedBaseline: VAEntrypointEncSlice
VAProfileH264Main : VAEntrypointVLD
VAProfileH264Main : VAEntrypointEncSlice
VAProfileH264High : VAEntrypointVLD
VAProfileH264High : VAEntrypointEncSlice
VAProfileH264StereoHigh : VAEntrypointVLD
VAProfileVC1Simple : VAEntrypointVLD
VAProfileVC1Main : VAEntrypointVLD
VAProfileVC1Advanced : VAEntrypointVLD
VAProfileNone : VAEntrypointVideoProc
VAProfileJPEGBaseline : VAEntrypointVLD
Monday, 7 May 2018
Jenkins on Kali 2017.1
Here's a quick run through of getting the Jenkins Pipeline demos working on Kali 2017.1 for testing purposes.
tim@kali:~$ curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
If we try to use add-apt-respository we will get an error as Kali is not supported:
tim@kali:~$ sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian stretch stable"
aptsources.distro.NoDistroTemplateException: Error: could not find a distribution template for Kali/kali-rolling
We can instead manually add to /etc/apt/sources.list:
tim@kali:~$ sudo vi /etc/apt/sources.list
deb [arch=amd64] https://download.docker.com/linux/debian stretch stable
tim@kali:~$ sudo apt-get update
tim@kali:~$ sudo apt-get install docker-ce
tim@kali:~$ sudo adduser --disabled-password git
tim@kali:~$ sudo adduser --disabled-password jenkins
We want Jenkins to be able to utilise Docker without having to be root:
tim@kali:~$ sudo adduser jenkins docker
tim@kali:~$ sudo -u jenkins -i
jenkins@kali:~$ mkdir ~/jenkins && cd ~/jenkins
jenkins@kali:~/jenkins$ wget "http://mirrors.jenkins.io/war-stable/latest/jenkins.war"
jenkins@kali:~/jenkins$ java -jar jenkins.war --httpPort=8080
tim@kali:~$ sudo apt-get install git-core
tim@kali:~$ sudo systemctl start ssh
tim@kali:~$ sudo -u git -i
git@kali:~$ mkdir ~/.ssh ~/repo
git@kali:~$ chmod 0700 ~/.ssh
git@kali:~$ cd ~/repo
git@kali:~/repo$ git init --bare
tim@kali:~$ sudo ssh-keygen
tim@kali:~$ sudo -u jenkins ssh-keygen
tim@kali:~$ cat ~/.ssh/id_rsa.pub | sudo -u git tee -a /home/git/.ssh/authorized_keys
tim@kali:~$ sudo -u jenkins cat /home/jenkins/.ssh/id_rsa.pub | sudo -u git tee -a /home/git/.ssh/authorized_keys
tim@kali:~$ mkdir repo && cd repo
tim@kali:~/repo$ git init
tim@kali:~/repo$ vi Jenkinsfile
tim@kali:~/repo$ git add .
tim@kali:~/repo$ git commit
tim@kali:~/repo$ git remote add origin git@localhost:repo
tim@kali:~/repo$ git push --set-upstream origin master
You should now be able to successfully run the Pipeline demos here:
https://jenkins.io/doc/pipeline/tour/hello-world/
You can set the Git server in Jenkins as git@localhost:repo and it will work the same as a remote Git server (BitBucket etc).
As this is for testing purposes, if you reboot you'll have to start SSH and Jenkins again manually.
Install Docker
Add the Docker package certificate:tim@kali:~$ curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -
If we try to use add-apt-respository we will get an error as Kali is not supported:
tim@kali:~$ sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian stretch stable"
aptsources.distro.NoDistroTemplateException: Error: could not find a distribution template for Kali/kali-rolling
We can instead manually add to /etc/apt/sources.list:
tim@kali:~$ sudo vi /etc/apt/sources.list
deb [arch=amd64] https://download.docker.com/linux/debian stretch stable
tim@kali:~$ sudo apt-get update
tim@kali:~$ sudo apt-get install docker-ce
Create users for services
We will be using key authentication or sudo so no need for passwords on the service accounts:tim@kali:~$ sudo adduser --disabled-password git
tim@kali:~$ sudo adduser --disabled-password jenkins
We want Jenkins to be able to utilise Docker without having to be root:
tim@kali:~$ sudo adduser jenkins docker
Download and run Jenkins
When testing I prefer this method over the Debian package as it is all self-contained:tim@kali:~$ sudo -u jenkins -i
jenkins@kali:~$ mkdir ~/jenkins && cd ~/jenkins
jenkins@kali:~/jenkins$ wget "http://mirrors.jenkins.io/war-stable/latest/jenkins.war"
jenkins@kali:~/jenkins$ java -jar jenkins.war --httpPort=8080
Set up Git remote
This will set up a repo you can access over SSH:tim@kali:~$ sudo apt-get install git-core
tim@kali:~$ sudo systemctl start ssh
tim@kali:~$ sudo -u git -i
git@kali:~$ mkdir ~/.ssh ~/repo
git@kali:~$ chmod 0700 ~/.ssh
git@kali:~$ cd ~/repo
git@kali:~/repo$ git init --bare
Set up SSH keys
Create keys for your user and the Jenkins user and add to Git's authorized_keys file:tim@kali:~$ sudo ssh-keygen
tim@kali:~$ sudo -u jenkins ssh-keygen
tim@kali:~$ cat ~/.ssh/id_rsa.pub | sudo -u git tee -a /home/git/.ssh/authorized_keys
tim@kali:~$ sudo -u jenkins cat /home/jenkins/.ssh/id_rsa.pub | sudo -u git tee -a /home/git/.ssh/authorized_keys
Set up local Git repo
Push your test Jenkinsfile to the remote repo:tim@kali:~$ mkdir repo && cd repo
tim@kali:~/repo$ git init
tim@kali:~/repo$ vi Jenkinsfile
tim@kali:~/repo$ git add .
tim@kali:~/repo$ git commit
tim@kali:~/repo$ git remote add origin git@localhost:repo
tim@kali:~/repo$ git push --set-upstream origin master
You should now be able to successfully run the Pipeline demos here:
https://jenkins.io/doc/pipeline/tour/hello-world/
You can set the Git server in Jenkins as git@localhost:repo and it will work the same as a remote Git server (BitBucket etc).
As this is for testing purposes, if you reboot you'll have to start SSH and Jenkins again manually.
Tuesday, 1 August 2017
Solution to Error 0x80070714 when attempting to upgrade to Windows 10 version 1703 (Creators Update)
I was attempting to patch a Windows 10 Pro machine from version 1607 to 1703 (Creators Update), however the process kept failing with Error 0x80070714:
Feature update to Windows 10, version 1703 - Error 0x80070714
The solution was to stop the MSSQLSERVER service before kicking off the update:
Right-click the Start button (or press Windows+X) and choose "Command Prompt (Admin)" then type the following:
C:\WINDOWS\system32>net stop MSSQLSERVER
The SQL Server (MSSQLSERVER) service is stopping.
The SQL Server (MSSQLSERVER) service was stopped successfully.
Once the machine reboots after the update the service will be running again, so this shouldn't do any harm.
You may have other MSSQL instances with different service names, the same process applies.
Feature update to Windows 10, version 1703 - Error 0x80070714
The solution was to stop the MSSQLSERVER service before kicking off the update:
Right-click the Start button (or press Windows+X) and choose "Command Prompt (Admin)" then type the following:
C:\WINDOWS\system32>net stop MSSQLSERVER
The SQL Server (MSSQLSERVER) service is stopping.
The SQL Server (MSSQLSERVER) service was stopped successfully.
Once the machine reboots after the update the service will be running again, so this shouldn't do any harm.
You may have other MSSQL instances with different service names, the same process applies.
Monday, 10 July 2017
Down the OVA compatibility rabbit hole
I recently volunteered to create a B2R CTF for SecTalks_BNE. It was fairly simple to create the content within the machine, however I came across a few hurdles when trying to make the machine as portable as possible. I wanted it to be easily usable on VirtualBox as well as VMware Fusion, Player and Workstation.
Before embarking on this project I had foolishly assumed I could just create the VM in VirtualBox and then "Export Appliance..." to create a portable OVA. If only it were that simple!
The OVA files that were created by VirtualBox worked fine by other VirtualBox users, but VMware users were getting various levels of success; Fusion wouldn't play nice at all.
I've created this post so that I remember what to do again down the track, and as a side bonus hopefully someone else will benefit or learn from it!
The OVF (Open Virtualisation Format) specifies the configuration of the virtual machine. The disk images contain data held by the virtual drives.
After creating a few OVA files from ESXi, my testing concluded that VirtualBox happily accepted a VMware OVA but VMware had a hard time working with a VirtualBox OVA.
One solution would be to do all my development on ESXi, but I quite like using VirtualBox on my laptop!
I then unpacked said OVA, prepared the replacement disk image with VirtualBox and rolled my own OVA using a few commands.
The initial OVA contained the following:
$ tar xvf covfefe.ova
covfefe.ovf
covfefe.mf
disk-0.vmdk
To prepare the replacement disk-0.vmdk file, I ran through the steps in my earlier blog post and converted from VDI to VMDK with clonemedium (also mentioned in the same post).
After replacing the VMDK file, I edited the size entry in the OVF to reflect the new file:
<File ovf:href="disk-0.vmdk" ovf:id="file1" ovf:size="464093696"/>
Once I finished editing the OVF I had to create the correct checksums to use in the manifest file:
$ shasum covfefe.ovf disk-0.vmdk
249eef04df64f45a185e809e18fb285cadfcd6f0 covfefe.ovf
ae1718beb7d5eb7dfb5158718b0eceda812512a2 disk-0.vmdk
After the changes my manifest file looked like this:
$ cat covfefe.mf
SHA1 (covfefe.ovf)= 249eef04df64f45a185e809e18fb285cadfcd6f0
SHA1 (disk-0.vmdk)= ae1718beb7d5eb7dfb5158718b0eceda812512a2
I then reassembled the OVA file:
$ tar cf covfefe.ova covfefe.ovf covfefe.mf disk-0.vmdk
Just as a test I also did the assembly using OVF Tool as it did some extra checks while assembling:
$ /Applications/VMware\ OVF\ Tool/ovftool covfefe.ovf covfefe.ova
The OVA has worked flawlessly on everything I've tested it on so far which is VirtualBox 5.1.22, VMware ESXi 6.5, Fusion 8.5.8 and Player 6.0.1.
Before embarking on this project I had foolishly assumed I could just create the VM in VirtualBox and then "Export Appliance..." to create a portable OVA. If only it were that simple!
The OVA files that were created by VirtualBox worked fine by other VirtualBox users, but VMware users were getting various levels of success; Fusion wouldn't play nice at all.
I've created this post so that I remember what to do again down the track, and as a side bonus hopefully someone else will benefit or learn from it!
Let me explain some acronyms first
An OVA file is an Open Virtualisation Appliance. It's essentially a tarball containing an OVF, one or more disk images (usually VMDK files) and a manifest (checksum) file.The OVF (Open Virtualisation Format) specifies the configuration of the virtual machine. The disk images contain data held by the virtual drives.
Gathering test data
To get some VMware test data I dragged my old HP N54L out of the cupboard and installed ESXi 6.5 on it. The disk performance was horrendously slow until I disabled the problematic AHCI driver as per this blog.After creating a few OVA files from ESXi, my testing concluded that VirtualBox happily accepted a VMware OVA but VMware had a hard time working with a VirtualBox OVA.
My VirtualBox solution
I decided to keep things simple and use ESXi to generate the initial OVA. I chose to target VMware 4 to keep it compatible with pretty much everything. After this step ESXi was no longer required.I then unpacked said OVA, prepared the replacement disk image with VirtualBox and rolled my own OVA using a few commands.
The initial OVA contained the following:
$ tar xvf covfefe.ova
covfefe.ovf
covfefe.mf
disk-0.vmdk
To prepare the replacement disk-0.vmdk file, I ran through the steps in my earlier blog post and converted from VDI to VMDK with clonemedium (also mentioned in the same post).
After replacing the VMDK file, I edited the size entry in the OVF to reflect the new file:
<File ovf:href="disk-0.vmdk" ovf:id="file1" ovf:size="464093696"/>
Once I finished editing the OVF I had to create the correct checksums to use in the manifest file:
$ shasum covfefe.ovf disk-0.vmdk
249eef04df64f45a185e809e18fb285cadfcd6f0 covfefe.ovf
ae1718beb7d5eb7dfb5158718b0eceda812512a2 disk-0.vmdk
After the changes my manifest file looked like this:
$ cat covfefe.mf
SHA1 (covfefe.ovf)= 249eef04df64f45a185e809e18fb285cadfcd6f0
SHA1 (disk-0.vmdk)= ae1718beb7d5eb7dfb5158718b0eceda812512a2
I then reassembled the OVA file:
$ tar cf covfefe.ova covfefe.ovf covfefe.mf disk-0.vmdk
Just as a test I also did the assembly using OVF Tool as it did some extra checks while assembling:
$ /Applications/VMware\ OVF\ Tool/ovftool covfefe.ovf covfefe.ova
The OVA has worked flawlessly on everything I've tested it on so far which is VirtualBox 5.1.22, VMware ESXi 6.5, Fusion 8.5.8 and Player 6.0.1.
Subscribe to:
Posts (Atom)