Steak Electronics 2019-2021 Book Released

The book is available for download (for free) from: https://steakelectronics.com/books/steakelectronics_2019_2021.pdf Music: http://steakelectronics.com/music/2020_infinite_day/ DISCLAIMER: With these two books I have mentioned drug use. I am going to add a preface to the books but for now, let it be said that drug use, especially over time (not just a one off) and as you get older, is more dangerous than I thought when I wrote this. Seriously, be careful out there. I’m on daily medication due to my prior drug use. You do NOT want to end up like me. I should’ve been 100% sober when I was 20 years old. My life is not easy and I would take some of it back. I am an example of failure. Learn from my mistakes. Less is more.
Cover for book

Steak Electronics 2018-2019 Book Released

The book is available for download (for free) from: https://steakelectronics.com/books/steakelectronics_2018_2019.pdf

If you are like me, and prefer a print copy (as reading books on a computer screen is painful. I recall Bill Watterson once said he preferred print books. He was right.) then you can buy it online from here: http://www.lulu.com/shop/henrik-wilkkom%C3%A9r/steak-electronics-2018-2019/paperback/product-24436049.html

Music: http://steakelectronics.com/music/2016_17_keyboard/

How to Learn Intermediate Level Electronics

Search ” ‘topic goes here’ Application Note” on the web.

Topics can be anything:
e.g. TVS Diode, Ferrite Bead, Reverse Voltage Protection.

Not all notes are well written. Search through and find the good ones.

Great way to keep yourself busy with a mobile while out.

EDIT: 2023/03. This one is really something. How to learn intermediate level diy/hacker/maker abilities: go to hackaday, watch all the embedded youtube videos, ignore everything else. Filter out videos that you think aren’t  relevant to your needs. Some stuff is less practical / more specialized.

Neotronics Digiflam 850 Flammable Gas Sensor

Pictures from the inside of a flammable gas sensor from 1980’s England. Elton John says that “when you’re made in England you are built to last”. Well, this device is made with a Lead Acid battery potted to the case, so this one is built to last… Until the battery fails.

Note the conformal coating over the main board (though not all boards). The device uses 74 logic, and quite a few different daughter boards connected to the main PCB. The battery feeds 8V into the main PCB. It is charged by an external PSU via the barrel jack on the side. There is minor visible corrosion from the battery leaking. Two 5V regulators on the back of the case. Well built, except for the battery. Fundamentally flawed – it was not meant to live beyond the life of the Lead Battery.

Mikrotik RB2011 OpenWRT Installation Procedure

RouterBoard RB2011 Install Tips Steak Electronics

\textbf{Mikrotik RB2011 Routerboard Install}
Contents
Contents
 1.  Overview
 2.  Procedure
   2.1.  Run DHCP server with TFTP boot enabled
   2.2.  Power off Mikrotik, hold reset, and power on
   2.3.  Backup existing Flash of Mikrotik (optional – recommended)
   2.4.  Sysupgrade the sysupgrade bin
 3.  Troubleshooting – Bad RAM ECC Errors
 4.  Pitfalls
   4.1.  Other Openwrt configs, beware!
   4.2.  Not all RB2011 have UART
 5.  References

1. Overview To install Openwrt on a Rack Mount server. One of the options is the Mikrotik RB2011 series of routers.

\textbf{EDIT: 11/28/19 Since this has been written, 19.01 RC has been released, and I would recommend people use that for the RB2011, as it should address issues with installation (SPI Flash write / RAM ECC errors covered in Troubleshooting section) which can occur on ‘some’ RB2011 models. }

\textbf{EDIT: 10/2020, Some of these models have a habit of marking their flash as bad blocks, making them unusable. For more details see openwrt rb2011 page. Also, these devices have Routerboot, which is proprietary…}

2. Procedure This paper will not be a record of my work (though it took about 3 nights to compile this info). What it will be is a guide for others, or myself to install Openwrt on this router in the future. Let’s begin.

The general process will be the following:
\begin{verbatim}
1.) Run dnsmasq command which will start a DHCP server with
TFTP boot enabled
2.) Power off RB2011, Hold reset button, and power on.
Continue holding reset button until you see the DNSMasq
window report it has sent the file.
3.) Login to the netboot version of Openwrt, and sysupgrade
to the 64M or 128M (huge) mikrotik image. (Depending on how many flash chips you have – 1 or 2).
\end{verbatim}
Sounds simple? It should be! Millions of hours of engineering and manpower have gone into this, it better damn well be. But don’t be surprised if something unexpected occurs. I will cover some troubleshooting as well.

2.1. Run DHCP server with TFTP boot enabled I tend to make a shell command for the dhcp server command. It’s just one command, and will do all the gymnastics for you. Here we go:

\begin{verbatim}
//
#/bin/bash
#ifconfig eth0 192.168.1.10 up
sudo dnsmasq -i eth0 –dhcp-range=192.168.1.100,192.168.1.200 \
–dhcp-boot=openwrt-ar71xx-mikrotik-vmlinux-initramfs.elf \
–enable-tftp –tftp-root=~/directory/where/file/is/ \
-d -u $USER -p0 -K –log-dhcp –bootp-dynamic
//
\end{verbatim}
NOTE: Beware, that the latex wp converter I’m using changes two dashes to one long dash… So e.g. log dhcp has two hyphens before it.
You can omit the ifconfig, and run it manually. Essentially, you must start an interface with a static ip at 192.168.1.0/24 network. Sometimes you will start getting connect: invalid argument errors when trying to run ping, or ssh, so when that happens, I simply
\\
\textbf{ifconfig eth0 0.0.0.0}

Then again init the interface with \textbf{ifconfig eth0 192.168.1.10 netmask 255.255.255.0}

You should be connected to Ethernet port 1 on the Mikrotik. Now, that’s all for part 1. Let’s reset it.

2.2. Power off Mikrotik, hold reset, and power on This section is self explanatory. The only things to note are the following:

Don’t need to hold reset when it’s on, then power off. No 30/30/30 crap here. Don’t need to wait that long. Simply power off, hold reset, then power on and hold for 20-30 seconds.

You can let go of reset when the TFTP boot says it sent the router file, but remain connected to Ethernet port 1, until you see the tftp boot print out the Openwrt hostname from the netbooted router. It takes a few seconds, but it will. After that you can plug into ethernet port 2,3,4 or anything besides 1.

2.3. Backup existing Flash of Mikrotik (optional – recommended) EDIT: backup didn’t work. Don’t bother. Ignore the below section.
You can always load another firmware file from TFTP / bootloader should something go wrong.

Next, login to the Openwrt. Make sure you login from ethernet 2 or 3 (but not 1).

Here’s an intermediate step. Navigate to the /tmp directory and backup the flash configuration.
\begin{verbatim}
cat /proc/mtd (review this, you want to copy the last two filesystems)
(they will either be /dev/mtdblock1+2 or /dev/mtdblock5+6)
(depending on your Mikrotik version.)

FAST WAY:
You can directly dd to your remote computer from the router.
dd if=/dev/mtd6 | ssh user@host dd of=/somewhere.img

That saves some steps. And yes, the mtd6 is the same size
and checksum as the mtdblock6, I checked. But you should double
check too.

EDIT: You can’t restore the previous Mikrotik OS with these images, though. Not sure why.

SLOW WAY:
mkdir /mnt/kernel /mnt/rootfs
(assuming it’s at mtd1)
mount -t jffs2 /dev/mtdblock1 /mnt/kernel
mount -t jffs2 /dev/mtdblock2 /mnt/rootfs
cd /mnt/kernel
tar czf /tmp/mikrotik-kernel.tar.gz
cd /mnt/rootfs
tar czf /tmp/mikrotik-rootfs.tar.gz

Finally, scp the two tar files to your local machine.

\end{verbatim}
2.4. Sysupgrade the sysupgrade bin To install on the RB2011, you should use the sysupgrade bin from the netbooted Openwrt. You should already be logged into the Netboot openwrt. At this point, scp the sysupgrade bin to the tmp folder. (If you don’t know if it’s 64M or huge, open up the device and look at the flash chips. There are either 1 or 2. 2 is huge, obviously.). Navigate to /tmp and then run
\\
\textbf{\#sysupgrade -filename-}

That should be it. Give it a few minutes to reboot, and if all goes well, you will have a functioning rack mount FOSS router. Good.

3. Troubleshooting – Bad RAM ECC Errors I’ve done this process on 3 different RB2011 routers. The first I used the 64M image, and it worked without issue. The 2nd, I tried the 64M image but it failed, so I repeated the netboot process, and used the large image. It worked from there.

On the 3rd router, it wouldn’t boot the image. I tried manually installing via flashing the rootfs, and vmlinuz images manually, from the netboot, but that didn’t work either. Finally, I connected a serial port (UART). [1] I connected Minicom and watched the Openwrt kernel attempt to boot. From the boot messages, I could clearly see what the problem was: Bad RAM (ECC Errors). So if the above steps don’t work, I recommend simply soldering a wire to the RX, wrapping a wire around the ground pin, and listening to the boot console.

You can always netboot again, if you flash the wrong image for some reason. The Mikrotik is good, in that the netboot functionality is easy to use. Well designed, I tip my hat to them. Just be careful not to write to the bootloader. Otherwise, there is also a labeled JTAG connector which might (possibly) work.

4. Pitfalls 4.1. Other Openwrt configs, beware! Don’t think you can upload a working configuration from a different piece of Openwrt hardware to this device. The ports in the /etc/config files may be different, and it might not boot. If you make a mistake, just netboot, then sysupgrade again. I will admit, I did this.

4.2. Not all RB2011 have UART If the ttl UART chip isn’t populated on your board, you won’t get serial. Some have it, some don’t…

5. References

https://openwrt.org/toh/mikrotik/rb2011

https://openwrt.org/toh/mikrotik/rb2011uias

https://openwrt.org/toh/mikrotik/common

EDIT: After installing this on 2/4/19, I found that some of them did not install without some changes. There is a forum thread on this, but for now you have to install from git master, for ‘some’ rb2011 models. In 19 release, the errors should be resolved, and the release file should just work. Installing from git is not difficult, and don’t be afraid. There are three settings you have to adjust in make menuconfig. the target architecture (ar71xx), the make (mikrotik) and that this is a Nand-large (if you have 2 flash) type. The rest of menuconfig can be left at defaults.

Here’s the copied and pasted instructions from https://forum.openwrt.org/t/building-and-installing-lede-image-from-source-on-mikrotik-rb433/7172/13

It covers everything, except that if you get warnings about missing dependencies, you must run a script in the openwrt directory. I believe it’s ./scripts/feeds. update -a

./scripts/feeds install -a

If you are unsure, search the forums.

I hope this can help someone,
leave me a message if there is something to correct.

something is taken from: https://wiki.openwrt.org/toh/mikrotik/rb433 18

Thanks
FMH

COMPILE FROM SOURCE

sudo apt install build-essential git zlib1g-dev

as non privileged user

cd ~; mkdir lede-project
git clone https://github.com/lede-project/source.git 5
cd source
make menuconfig

i made only this choiche
--- Target System (Atheros AR7xxx/AR9xxx)
--- Subtarget (Mikrotik devices with NAND/NOR flash)
--- Target Profile (MikroTik RouterBoard (64 MB NAND))

exit and save .config file

make

if something missing check the errors
when everything is finished
sudo mkdir /tftpboot
sudo cp bin/targets/ar71xx/mikrotik/lede-ar71xx-mikrotik-vmlinux-initramfs-lzma.elf /tftpboot/boot.elf
sudo cp bin/targets/ar71xx/mikrotiklede-ar71xx-mikrotik-nand-64m-squashfs-sysupgrade.bin

  1. All you need is Ground and an RX of the router (it’s near the power plug, marked on the pcb).

Adding Email Notifications to Tripwire with SSMTP

07/14/19

Contents
Contents
 1.  Overview
 2.  Steps
   2.1.  Configuring Tripwire
     2.1.1.  Devuan/Debian
   2.2.  Configuring SSMTP

EDIT: This guide is obsolete for Debian 10 based distributions. For those, you should use MSMTP. See https://wiki.zoneminder.com/Email

\vspace{0.2in}
This document is best read printed out on paper.
1. Overview Tripwire is intrusion detection software for GNU Linux \& BSD. Let’s document how to set it up on a server with SSMTP configured for email notifications. Tripwire isn’t too hard to setup, but I had to jump through a hoop for email notifications. Here I cover install, and how to get SSMTP working.
2. Steps 2.1. Configuring Tripwire First install Tripwire. This will depend on your package manager. Here is Debian/Devuan.
\begin{verbatim}
apt-get install tripwire mailutils ssmtp
\end{verbatim}
2.1.1. Devuan/Debian Devuan will prompt you for a few things in an ncurses gui. Answer all of the defaults (yes for a site key, yes for a user key, etc…). Record your password.
[1]
I use the same password for both.

\textbf{After install:}The goal when setting this up is to init, as little as possible. Each init is about 2-3 minutes, so time can be avoided, if you know what configs you need. Let’s first edit the configs as much as possible.

\begin{verbatim}
when whitelisting, this is what needs to be commented out in devuan jessie/ascii for /etc/tripwire/twpol.txt

Filename: /etc/rc.boot
Filename: /root/mail
Filename: /root/Mail
Filename: /root/.xsession-errors
Filename: /root/.xauth
Filename: /root/.tcshrc
Filename: /root/.sawfish
Filename: /root/.pinerc
Filename: /root/.mc
Filename: /root/.gnome_private
Filename: /root/.gnome-desktop
Filename: /root/.gnome
Filename: /root/.esd_auth
Filename: /root/.elm
Filename: /root/.cshrc
Filename: /root/.bash_profile
Filename: /root/.bash_logout
Filename: /root/.amandahosts
Filename: /root/.addressbook.lu
Filename: /root/.addressbook
Filename: /root/.Xresources
Filename: /root/.Xauthority
Filename: /root/.ICEauthority
Filename: /proc/6136/fd/3
Filename: /proc/6136/fdinfo/3
Filename: /proc/6136/task/6136/fd/3
Filename: /proc/6136/task/6136/fdinfo/3
\end{verbatim}
For proc, you simply comment out the whole directory. (you’ll see an entry in the file for /proc, put a \# before that). After twpol, we are not done. We also need to edit the email settings.

In /etc/tripwire/twcfg.txt we will change the following:
\begin{verbatim}
MAILMETHOD =SENDMAIL
MAILPROGRAM =/root/script.sh
\end{verbatim}
script.sh is just a script: (make sure it is executable with chmod +x[2])
\begin{verbatim}
#!/bin/bash
/usr/sbin/sendmail -s youremail@domain.com
\end{verbatim}

Finally, the last change we might make, will be for any special directories we want to watch. I put websites in the root at /sites/ so I will append the following to /etc/tripwire/twpol.txt
\begin{verbatim}
# Ruleset for Website
(
rulename = “Website Ruleset”,
severity= $(SIG_HI)
)
{
/sites/ -> $(SEC_CRIT);
}
\end{verbatim}

Now we will init, type
\begin{verbatim}
sudo tripwire –init
sudo twadmin -m P /etc/tripwire/twpol.txt
sudo tripwire –init
\end{verbatim}

to reconfigure twcfg.txt
run
\\
\textbf{/usr/sbin/twadmin –create-cfgfile -S site.key /etc/tripwire/twcfg.txt}

if you get:
\begin{verbatim}
root@site:~# /usr/sbin/twadmin –create-cfgfile -S site.key /etc/tripwire/twcfg.txt
# Error: File could not be opened.
# Filename: /root/site.key
# No such file or directory
# Exiting…
\end{verbatim}
You must cd to /etc/tripwire directory.

2.2. Configuring SSMTP

SSMTP is a program you configure once, and can reuse the configuration everywhere[3]. For starters, I’d recommend you install SSMTP according to this guide here:
\begin{verbatim}
https://wiki.zoneminder.com/How_to_get_ssmtp_working_with_Zoneminder
\end{verbatim}
This is a thorough guide that explains debugging. Some steps are superfluous (given that the instructions pertain to different software) but the general directions are sound. And afterwards sending an email is as easy as
\\
\\
\textbf{echo “Hello, World” \textbar mail -s “My email check” user@email.com}
\\
\\
This guide assumes you have configured SSMTP according to this guide correctly, tested it, and are able to mail from the command line. Once you’ve setup SSMTP once, you can reproduce this setup on other computers, simply by copying over the revaliases and ssmtp.conf of a valid configuration.

So let’s do that. Copy over revaliases, and ssmtp.conf. test the configuration from the command line using the above echo and mail. Once that works, test out tripwire.
\\
\\
\textbf{tripwire –test –email user@email.com}
\\
\\
Done.


  1. For a full walkthrough of this process see this URL:https://www.howtoforge.com/tutorial/how-to-monitor-and-detect-modified-files-using-tripwire-on-ubuntu-1604/ This process includes most, but not all of what you need to know.
  2. This script appears to be required in this setup.
  3. This is a strength of FOSS and let it remain that way.

How to remove solder bridges on a 0.5″ Pitch FPGA with 200+ Pins

In this video I describe some tips on fixing bridging from a small pitch FPGA, here a Xilinx Spartan 3, PG208 package. The largest non-BGA package available for this family.

I started with a toaster oven, and some solder paste, dispensed with a small syringe. From there I placed the IC carefully on top of the PCB, and put in the toaster until the solder reflowed. Once it was cooled, I noticed some bridges from using a little too much solder paste. This video explains how I cleaned up the solder bridges using some solder wick. It comes down to needing to tin the tip before each application of the wick. When it comes to tinning the tip, it’s not something that is required in all soldering, but here, in this scenario, it is required. It also helps to use fresh wick each time.

PITFALLS:

The kind of problems that you can run into when soldering a device like this may be the following:

  1. Don’t bother trying to solder this by hand with an iron. Just don’t. Use a toaster, and solder paste. You don’t need a fancy reflow controller, just stick the board in a toaster until the solder reflows. Set it to max temperature (I use broil). Don’t use the toaster for food. Next.
  2. Don’t put the solder paste on top of the IC pins. Put the solder paste down on the pads, and then put the IC on top of them. Doing the opposite will not work as well.
  3. Do make sure that you have soldermask between all the pins on your gerbers before sending out. That is a rookie mistake, to have a footprint made that somehow omitted or doesn’t include the solder mask. Without it, the bridges will happen more easily.
  4. Do use a good quality soldering iron. Consensus these days is that the entry level iron you should use is either the Hakko 888 or the Weller I have. Each runs about $100-150.
  5. Do double check your footprint pads are the right size. Don’t make the leads too long on high speed designs, or the capacitors / collectors won’t be able to dispense electricity to the IC fast enough.

Multiple Switches Can Slow a Network’s Internet Down

1. Overview

A question is, can multiple network switches, slow down either the network or the WAN. The answer is yes. Let’s discuss a working example today.

2. The Previous IT Guys

Today I was working at an office. They had a firewall connected to a Verizon FIOS modem. They had a gigabit [1]switch immediately downstream, and then a network cable ran about 50-75 feet to their office. Here they had another Gigabit switch, and then the cables went off to either computers or other switches. Let’s forget about what was downstream of that last switch except for the computers.

2.1. Internet Speeds

The internet speed from the two computers in the office was about 10Mbps down and roughly the same upload. However, I tested the speed directly from the IT closet, and found 100Mbps down and 100Mbps up. At this point, it was a simple case of following the signal path and seeing where things slowed down. At least, I knew that they should be getting 100/100Mbps.

2.2. The Tests

What I found is that as soon as I had two switches after the firewall [2]the speed would drop to 10/10. It was not dependent upon any brand of switch. I tried swapping from one other model that was available. The slowdown appeared to be switch independent. So in summary:

  • Firewall – computer – 100/100
  • Firewall – switch – computer – 100/100
  • Firewall – switch – 50 foot wire – computer – 100/100
  • Firewall – switch – 50 foot wire – Switch A- computer – 10/10
  • Firewall – switch – 50 foot wire – Switch B- computer – 10/10

What I did was remove the switch at the outside of the firewall. Now I had only

Firewall – 50 foot wire – Switch – Computer – 100/100




3. Additional Background

I’ve heard an IT person mention that he didn’t like multiple switches in network deployments, due to speed issues. On the other hand, I’ve setup Video Recording Networks with multiple switches all connecting serially to each other without issue. It seems that this is not a simple black and white issue. With the right hardware you may get away with it. Or if you avoid WAN access. In any case, the only way to know, is to test.

4. Conclusion

If you are going to put > 1 switches downstream of the firewall, make sure to double check the WAN speed tests from just after the firewall, to at the very last switch.


  1. Actually, all switches were gigabit, but it didn’t make a difference.
  2. which has its own internal switch

Remove Domain on Windows Server and IIS doesn’t work

I recently took down the domain from a server, and an application running on the same server’s IIS failed afterwards. One possible cause of this is due to the application running as a domain user. The solution:

In application pools of IIS manager, change domain\user to a local account.

Here, identity would have been one of Domain\user.

AutoSSH – a Reverse Proxy Alternative

This document is best read printed out on paper.
1
Overview
I recently added another apache server to an existing infrastructure, and
I wanted it to be accessible under a similar IP as another server. Due
to the complexity of the website, it was not possible to simply do a reverse
proxy without knowing the correct settings (e.g. X-Forwarded for). Instead,
AutoSSH was used. In the end, I accessed a new port on the existing IP.
2
Work Log
Ok, I’m going to get right to the configs that I used. You want the tool, you
don’t need to know all the details.
2.1
Crontab
Here is the crontab script I used. I put this in /etc/crontab, so it has root
after the times. I only use /etc/crontab, as it’s easier to manage.

* * * * * root pgrep autossh > /dev/null || \
/usr/local/bin/autosshzm/autosshzm.sh

A few notes about this. Pgrep will search for autossh. If it doesn’t find it,
then it will try the next command. (—— is an OR). Put the bash script
wherever you want.
2.2
Bash Script
This script is obviously what the crontab calls.

#!/bin/bash
logger ” /usr/local/bin/autosshzm script started.”
#source $HOME/.bash_profile #not needed.
source $HOME/.keychain/$HOSTNAME-sh
logger ” /usr/local/bin/autosshzm sourced.”
autossh
-L 0.0.0.0:2:localhost:80 -f user@ipaddress sleep 31536000
&> /var/log/autosshzm/autosshzm.log
1#autossh -M 0 -o “ServerAliveInterval 30” -o “ServerAliveCountMax 3”
-L 0.0.0.0:2:localhost:80 user@ipaddress &>
/var/log/autosshzm/autosshzm.log
logger “auto ssh ran”

Note that the second autossh does not work, as it’s missing the sleep and
the -f command. 1 In order for this to work, you’ll also need the following
commands:

apt-get install keychain autossh

There were some more setup steps required for keychain… From stackex-
change:

25
keychain
solves this in a painless way. It’s in the repos for Debian/Ubuntu:
sudo apt-get install keychain
and perhaps for many other distros (it looks like it originated
from Gentoo).
This program will start an ssh-agent if none is running, and
provide shell scripts that can be sourced and connect the current
shell to this particular ssh-agent.
For bash, with a private key named id_rsa, add the following to
your .profile:
keychain –nogui id_rsa
This will start an ssh-agent and add the id_rsa key on the first
login after reboot. If the key is passphrase-protected, it will
also ask for the passphrase. No need to use unprotected keys
anymore! For subsequent logins, it will recognize the agent
and not ask for a passphrase again.
Also, add the following as a last line of your .bashrc:
1
Figuring this kind of stuff out can take about an hour.
2. ~/.keychain/$HOSTNAME-sh
This will let the shell know where to reach the SSH agent managed
by keychain. Make sure that .bashrc is sourced from .profile.
However, it seems that cron jobs still don’t see this. As a
remedy, include the line above in the crontab, just before
your actual command:
* * * * * . ~/.keychain/$HOSTNAME-sh; your-actual-command

The only thing that I needed to do here was
keychain –nogui id rsa
The rest of it (notes about crontab) was not required.

3
What Did NOT Work
Here’s some things I tried that did not work.

  • https://github.com/obfusk/autossh-init – This init script, didn’t do
    much for me. Remember, I’m stuck with systemd in Ubuntu 19.04… 2
  • Reverse proxy with Apache – As I said, my website 3 was too complex,
    and I didn’t want to go down that rabbit hole.
  • Starting AutoSSH in rc.local. Didn’t work.

2
The scourge of deleting software history. Keep backwards compatibility at ALL COSTS, developers.
3
Some people might call it a web application. I will not.
3