A note before we begin, in all of the below I’m assuming you’re setting things up from scratch.

1) Log in to the Duo admin portal, go to Users => External Directories and set up a new one. It will ask you what connection to use, you’ll create a new one. It gives you an Integration key, Secret Key, and API Hostname you need to put into your Duo Authentication Proxy config file. You also need to have a user who can bind to LDAP and configure that in the same place. So this section in the INI-style config file ends up looking like (note that the service_account_username assignment breaks into 2 lines here, it is a single line without the backslash and newline in my actual config):

[cloud]
ikey=<integration_key>
skey=<secret_key>
api_host=<api_hostname>
service_account_username=uid=mybindaccount,cn=users,\
    cn=accounts,dc=mydomain,dc=com
service_account_password=<mybindaccount_password>

Now, restart the Duo Authentication Proxy service. Back on the Duo connection config page, give it the hostname of your FreeIPA server, and I used port 389. Specify the base DN, it would be “cn=accounts,dc=mydomain,dc=com” in this example. Authentication type is plain, and I used a STARTTLS Transport Type. On a FreeIPA-enabled machine, see /etc/ipa/ca.crt for the CA certificate – paste that into the “SSL CA Certs” box. Save the config, and your connection should be all set.

2) Now for the sync settings. The username attribute is “uid”, the Display Name attribute is “displayname”, and Email Address is “mail”. You can optionally add more attributes, but this is up to you, just the above was fine for me. Now’s when you’ll pick a group, an easy win is to just pick the group “ipausers” which is everyone. Click save on this config, and note that while it reports success in saving, the whole thing doesn’t work – the “ipausers” group wasn’t saved no matter how many times you try, so it “successfully” syncs 0 groups and 0 users, hardly useful. The reason is that Duo is looking for each entry to have a value named entryUUID, but FreeIPA uses an attribute named IPAUniqueID.

3) Patch the Duo Auth Proxy service to replace “entryUUID” strings with “IPAUniqueID”. The magic happens in the pkgs/duoauthproxy/duoauthproxy/modules/drpc_plugins/ldap_base.py file. At line 294, you need to patch any search filters:

  if filter_text != None:
    # print(“brosepatch filter before: ” + filter_text)
    filter_text = filter_text.replace(“entryuuid”, “ipauniqueid”)
    # print(“brosepatch filter after: ” + filter_text)

At line 307, you need to delete the “entryuuid” attribute from the list and add the “ipauniqueid” attribute:

  if “entryuuid” in attributes:
    # log.msg(“brosepatch: replacing entryuuid with ipauniqueid for query!”)
    attributes.remove(“entryuuid”)
    attributes.add(“ipauniqueid”)

And finally, at line 377, we need to swap the name of the value back before returning it to the Duo cloud:

  # log.msg(“brosepatch result before: “)
  # print(result)
  # log.msg(“brosepatch iterate over result and fix…”)
  for broseitem in result:
    if ‘ipauniqueid’ in broseitem:
      broseitem[‘entryuuid’] = broseitem.pop(‘ipauniqueid’)
  # log.msg(“brosepatch result after: “)
  # print(result)

4) Finish up. Recompile the Duo Auth Proxy with those patch changes, install it, and restart the service. You can see the changes happening in the logs if you uncommented the debug log/print statements. You can now go back to the Duo Admin web portal, maybe log out and back in to clear any cache, and now you will be able to select a group. I found that for some reason, I still could not select the “ipausers” group, but I could select any group that I created manually with the CLI “ipa” utility on the FreeIPA server. So, I simply did this:

[root@freeipaserver ~]# ipa group-add myorg
——————-
Added group “myorg”
——————-
…
[root@freeipaserver ~]# ipa group-add-member myorg
[member user]:
[member group]: ipausers
[member service]:
[member User ID override]:
Group name: myorg
GID: …
Member groups: ipausers
Indirect Member users: every, user, in, the, directory
————————-
Number of members added 1
————————-

I also had to modify the FreeIPA default permissions so that the binding account could read the things that were needed:

[root@freeipaserver ~]# ipa permission-mod \
    ‘System: Read Groups’ –includedattrs=entrydn
[root@freeipaserver ~]# ipa permission-mod \
    ‘System: Read User Standard Attributes’ –includedattrs=mail \
    –includedattrs=entrydn

That’s it! You can now set the Duo Admin Web Console to use the group “myorg” and any new users will automatically sync into Duo, and any deleted users will end up in Trash. I also enabled high-frequency syncing because I am impatient. Perfect!

Happy 2-factoring!

Filetype: IR signals file
Version: 1
#
name: Suspend_alarms
type: parsed
protocol: NECext
address: 82 E4 00 00
command: F3 12 00 00

That’s it! Load this onto a Flipper Zero (or your other infrared-capable device of choice), and enjoy the temporary reprieve all without standing up, super-helpful if your newborn is still attached to a CPAP. The NICU is stressful enough without constant alarm fatigue.

1) I bought a new (to me) house.

2) I bought a new (to me [seeing a pattern here?]) car.

3) I actually got a haircut, which happens about as frequently as I update this blog.

…and yes, that ponytail got donated to Pantene’s Beautiful Lengths program.

4) I got promoted at work. I no longer work in the Computer Science department, now I’m the Systems Manager of the Mathematics Department, Program for Applied & Computational Mathematics, and Annals of Mathematics (an affiliated periodic publication)

And yes that is Nash as in John Nash, of mathematical and theatrical fame (“A Beautiful Mind” with Russell Crowe was based on his life). I feel honored to be on the same board as him!

5) Last but certainly not least, I got engaged! I am set to be wed in the Princeton Chapel in October of this year.

But as I said, those are just reasons, not excuses. I will try and do better at updating this thing!

Step 1 for me was to just play with the core clock. I have my VRAM underclocked to 1/3 of the core clock – it is unneeded in bitcoin mining and running it fast only serves to create more heat. I nudged the core clock north, but hit a pretty hard wall around 816 MHz. I wasn’t going any further on this overclocking journey without applying a little more voltage to the GPU cores. However, all the overvolting tools for ATi are Windows-only! After extensive googling, I found a project that someone wrote to overvolt his/her Radeon 5850 – named [radeonvolt]. It didn’t quite work for me as-is, but after some hacking I was able to get the program to recognize both cores of each of my 5970’s, and change my core voltages successfully.

If you’re interested, click [here] to download a .patch file of my modifications. Otherwise, I will explain the few changes that needed to be made below.

1) Fix the card locating loop. Find the lines that look like this:

if(dev->device_class == PCI_CLASS_DISPLAY_VGA &&
dev->vendor_id == 0x1002 && dev->device_id == 0x6899) {

and change them to look like this:

if(dev->device_class == PCI_CLASS_DISPLAY_VGA ||
dev->device_class == PCI_CLASS_DISPLAY_OTHER) {

One GPU core registers as a VGA compatible controller, the other is just a “helper core” with no outputs, so it gets the DISPLAY_OTHER identifier. We also strip out the vendor and device ID checks – this allows us to attempt to probe the I2C bus of any video card detected. This appears safe still, I’ve tried the code with non-reference GPUs and nothing broke, the software properly reported it was incapable of modifying non-reference cards.

2) The radeon 5×70 cards, unlike the 5×50 cards (for which radeonvolt was originally written), use power profile slot #3 for high-performance, not slot #2. So, we just have a couple more changes to make. Find the line:

float voltage = vt1165_get_voltage(i2c, 2);

and change the “2” to a “3”:

float voltage = vt1165_get_voltage(i2c, 3);

additionally, make a similar change on this line:

vt1165_set_voltage(&i2c, 2, value);

…should of course read…

vt1165_set_voltage(&i2c, 3, value);

And that’s all, folks. Compile, use, and enjoy. I was able to push my core voltage to anything I wanted, but with great power comes great responsibility. Running my core at 1.1125 volts, I have now achieved a rock-stable 900 MHz core clock. Just be sure to keep an eye on the VRM temperatures!

[root@localhost ~]# radeonvolt
Device [6]: Device 689c
Current core voltage: 1.1125 V
Presets: 0.9500 / 1.0000 / 1.0375 / 1.1125 V
Core power draw: 70.55 A (78.49 W)
VRM temperatures: 83 / 89 / 84 C

Device [7]: Device 689c
Current core voltage: 1.1125 V
Presets: 0.9500 / 1.0000 / 1.0375 / 1.1125 V
Core power draw: 63.58 A (70.73 W)
VRM temperatures: 115 / 114 / 113 C

Device [14]: Device 689c
Current core voltage: 1.1125 V
Presets: 0.9500 / 1.0000 / 1.0375 / 1.1125 V
Core power draw: 67.06 A (74.61 W)
VRM temperatures: 87 / 89 / 89 C

Device [15]: Device 689c
Current core voltage: 1.1125 V
Presets: 0.9500 / 1.0000 / 1.0375 / 1.1125 V
Core power draw: 66.19 A (73.64 W)
VRM temperatures: 108 / 108 / 111 C

I think that qualifies as a “milky color”. Yikes. Ok, so time to start pulling the engine apart to get to the head gasket. After about 4 more hours of labor and a few smashed arm incidents (those head bolts are tight!), I finally got the head off, and saw this:

Now, a lot of this coolant got in there while I was taking the head off, so it’s really not as bad as it seems. But, notice that cylinder #1 (leftmost) is slightly more full than the others. After drying the water out, the problem became much more apparent:

Yikes again! And so was it really the gasket? I inspected the head and didn’t find any cracks. Then, taking a closer look at the gasket, I found the problem:

So long story short, it was another 5 hours of labor to get everything back together into good working order. I think the total job ran me about $285, which isn’t bad considering I did pretty much an entire upper engine rebuild. That price includes new head bolts (which you should always do – if you reuse, they can snap. If they snap, you’re done), two oil changes, new exhaust manifold, more coolant, and all the associated gaskets.

Photo of the lake behind my apartment, the water is supposed to stop a few feet short of that fence you see sticking up.

The crushed stone is supposed to be a dam all the way across the end of the lake, with probably a good 10-foot drop-off. As you can see, the water does no dropping. Houses past this dam had at least two feet of water against their walls.

River, errr, Route 1. This is the view from the Route 95 overpass. Looking north, there were a few cars that had gotten stuck. The water was halfway up their windshields.

Run “adb shell” on a computer connected to the droid to enter these commands.

mv /data/local/12m /data/local/12m.bak
ln -s /data /data/local/12m

Now, reboot the phone. When it comes back up, adb shell into it again and run:

rm /data/local/12m
mv /data/local/12m.bak /data/local/12m
mv /data/local.prop /data/local.prop.bak
echo ro.sys.atvc_allow_netmon_usb=0 > /data/local.prop
echo ro.sys.atvc_allow_netmon_ih=0 >> /data/local.prop
echo ro.sys.atvc_allow_res_core=0 >> /data/local.prop
echo ro.sys.atvc_allow_res_panic=0 >> /data/local.prop
echo ro.sys.atvc_allow_all_adb=1 >> /data/local.prop
echo ro.sys.atvc_allow_all_core=0 >> /data/local.prop
echo ro.sys.atvc_allow_efem=0 >> /data/local.prop
echo ro.sys.atvc_allow_bp_log=0 >> /data/local.prop
echo ro.sys.atvc_allow_ap_mot_log=0 >> /data/local.prop
echo ro.sys.atvc_allow_gki_log=0 >> /data/local.prop

Reboot the phone again. When it comes back up, adb to it a third time, but this time notice that you have a root prompt! Setting atvc_allow_all_adb to 1 disallows adb from dropping its root privileges. Now, to make this accessible to the device, run:

mount -o remount,rw /dev/block/system /system
cat /system/bin/sh > /system/xbin/su
chmod 4755 /system/xbin/su

Now, go into the market and search for the “superuser” application. Install the one with the jolly-rogerish logo, then run it and have it install its su binary. Once that’s done, we need to remove the su application we created, so in the adb shell you still have open, run:

rm /system/xbin/su
mount -o remount,ro /dev/block/system /system
sync

That’s it! You’re all set. Enjoy having root on the droid 3!

Basically, you’re going to need:
– Pandaboard
– 4+ gigabyte SD card (this is what I used, I’ll image a smaller card soon)

Features in the alpha version:
– Core system utilities
– Pandaboard wired and wireless network

Features planned for the beta version:
– Graphics
– Smaller SD card image