Re: Re: Re: dnsmasq and SOA

[RODARY Jacques]

Sorry for my last post: I sent a draft mail instead of the corrected 
one.  Let's go back to my own concern: dnsmasq and soa, 
if you don't mind. Here is my dnsmasq.conf file: 
resolv-file=/etc/dnsmasqresolv.conf

interface=eno1
interface=wlp3s0
no-dhcp-interface=enp2s0

auth-zone=rodary.net

auth-soa=2018022800,root.ns.rodary.net,10800,3600,10800

dhcp-range=10.42.0.20,10.42.0.200,infinite

 As you guessed enp2s0 (eth0 now) is my INET interface.
 
Shouldn't I add a "auth-peer=217.70.177.40" line for AXFR to 
ns6.gandi.net? With all my stupid previous acts, I don't dare to try it, 
specially when it could affect outside hosts e.g. my registrar.

Jacques

Re: Re: dnsmasq and SOA

[RODARY Jacques]

 For the time being, my main concern is to keep my connection up! I did 
succeed, without succeeding for long. Each time I rebooted  I had no access to 
interness. Three
times (or more) I couldn't have a  full access including on my home wifi  
access point. I even reinstalled Stretch two times, before suspecting something 
else than my
dnmasq, NetworkManager etc...
It was difficult to find the guilty program, until I thought about 
Ivahi-daemon which didn't appear in the logs. Shouldn't I  suppress the Avahis 
pachages? As
soon as I know, I come back to my main concern, i.e. DNS,SOA...  Anyway Thanks 
you both Reco and Curt

Re: Re: dnsmasq and SOA

[RODARY Jacques]

I learnt about dnsmasq when I used Tor to see wiki, thanks for this 
hint. For now it works but I am not sure your help about auth-soa is all I need 
to get
notifying to the other name server. I just added this line: 

"auth-soa=2018022800,root.ns.rodary.net,10800,3600,10800" 
in /etc/dnsmasq.conf, and after restarting dnsmasq (systemctl restart 
dnsmaq.service) I get this result with "systemctl status dnsmaq.service: " 
dnsmasq.service - dnsmasq
- A lightweight DHCP and caching DNS server

 
févr. 28 23:52:33 ns dnsmasq[24452]: ignore le serveur de nom 88.170.1.143 - 
interface locale
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 217.70.177.40#53
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 212.27.40.240#53
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 212.27.40.241#53
févr. 28 23:52:33 ns dnsmasq[24452]: aucun serveur trouvé dans 
/run/dnsmasq/resolv.conf, va réessayer
févr. 28 23:52:33 ns dnsmasq[24452]: Lecture de /run/dnsmasq/resolv.conf
févr. 28 23:52:33 ns dnsmasq[24452]: ignore le serveur de nom 88.170.1.143 - 
interface locale
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 217.70.177.40#53
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 212.27.40.240#53
févr. 28 23:52:33 ns dnsmasq[24452]: utilise le serveur de nom 212.27.40.241#53"

First 88.170.1.14 is my main IP to the outside, is it local?  Second, before I 
added the refresh,retry, expire fields, supposed to have defaults values (said 
man 8
dnsmasq), I had another line in the output: 
"févr. 28 23:20:17 ns dnsmasq[24453]: Too few arguments."
Does this mean dnsmasq will notify the other name server (ns6.gandi.net,  
217.70.177.40#53) when needed? For now this server answers query about hosts I 
didn't put in
/etc/hosts? 
Anyway it works for the time present, and many thanks again.
Jacques
P.S.: Cookies are not my favorites, but I know some recipes you 
would like, I am sure!

dnsmasq and SOA

[RODARY Jacques]

I finally surrendered, and now use dnsmasq instead of bind. But
in my setup with named,  my box was Start Of Authority, and when there
was a change and reload of the zone files, the only other name server
was notified, before the TTL is over. How can I do that with dnsmasq?
If the dnsmasqHowto wiki is quite clear, but not very detailed, the
manpage is too detailed, and not clear to me. Thanks for your help.
Jacques

Re: Re: [partial resolution] Re: Problem withj dd

[Rodary Jacques]

1/ No the same removable device doesn't always receive the same /dev/sdX.If you 
unmount  it ( umount /dev/sdX) and plug it again, it can be called /dev/sdY (I 
suppose the kernel keeps tne name in memory for some time). 
2/ use "mount" without arguments., plug your flash drive and run "mount" again: 
the new /dev/sdX  (or /dev/sdXn) is your drive (or mounted partition). Unmount 
it with "umount /dev/sdX(n)" and run dd with  "dd if=input-image of=/dev/sdX 
[options]" without the partition number if there was one. All this as root of 
course.
Good luck. Jacques

CT-based firewall rules?

[Rodary Jacques]

When I reboot, what program  is responsible for  "CT-based  firewall rule" 
(dixit jounalctl). I would like to have my own firewall rules, and for now, I 
must flush those "CT-based  firewall rules" before  I set my owns.
Again it's not too important, since I don't reboot very often, but I would 
appreciate not to have to spend quite a lot of time to change default setup 
each time I reboot.
I already got rid of bind9.service (I have my own DNS config but I need named 
of course), Avahi-daemon package (I don't need multicast DNS).
I know the good solution would be to build my own packages with my own choices, 
but I haven't the necessary knowledge.
Jacques

Re: Re: BIND and iptables config

[Rodary Jacques]

Because when I did , witen iI just installed Jessie in April 2016, my 
mailbox which is dedicated to debian-user was flooded with useless or even 
stupid posts. Sorry for my fellow countrymen.
Salut. Jacques
 

Re: Re: USB key and lost space

[Rodary Jacques]

"To erase the ISO 9660 superblock of debian-9.3.0-amd64-netinst.iso do

  umount /dev/sde1
  dd if=/dev/zero bs=2048 seek=16 count=4 conv=notrunc of=/dev/sde

But first make sure that /dev/sde is indeed the medium you want to erase."
 I did that before the result is :

dd if=/dev/zero bs=2048 seek=16 count=4 conv=notrunc of=/dev/sde 

 Same answer with fdisk cfdisk ...
Sorry

Re: wiki

[Rodary Jacques]

Le lundi 19 février 2018, 08:12:57 CET Reco a écrit :
>   Hi.
> 
> On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> > > Even if it did, the firewall have not come into play.
> > > Since the user saw HTTP 403 it means that HTTPS connection was
> > > established successfully, and a front-end (or back-end) webserver gave
> > > 403 code, which was transferred to a user.
> > > 
> > > >  Is it a web browser bug?  Nobody knows!
> > I was using Opera  browser,so quick,  but I just tried with firefox, so 
> > slow, but both mozilla, and the result is the same when google search ( 
> > which I don't use with  Opera)  gives me a lot of choices , all with 403 
> > result. My  public IP, 88.170.1.143 is the one my provider ( 
> > free.fr=proxad.fr)  gave me.
> 
> As I wrote earlier - try Tor.
> It seems that your network subnet was banned at wiki.debian.org.
> 
> Reco
I finally dared to install Tor an it works! So I will use wiki t o 
understand why the  "reply to" link in the list doesn't copy the subject 
'Re.;Re: < suject> in Kmail, as it did in Jessie without any setup by me. 
Thank you all  for your time.
Jacques 

Re: wiki

[Rodary Jacques]

Le dimanche 18 février 2018, 21:47:59 CET Roberto C. Sánchez a écrit :
> On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> > what is  SNI?
> 
> https://en.wikipedia.org/wiki/Server_Name_Indication
> 
> Essentially, there was a time when you could not host more than one
> HTTPS-enabled site per IP address and port combination. This was a
> problem for virtual hosting configurations where the server name in the
> request was used to decide what content to serve. SNI allows for
> identifying the server associated with the request early in the
> connection so that a matching SSL certificate can be used for the
> connection. Or something along those lines.
> 
> Regards,
> 
> -Roberto
Reading all your posts, I realized that I didn't allow NEW connections 
by https (port 443) or by ssh (port 22) in my iptables setup. So I did but 
nothing changed neither with Opera, nor with Firefox.
So no wiki for me!  :-(

Re: wiki

[Rodary Jacques]

Le vendredi 16 février 2018, 19:53:44 CET Reco a écrit :
>   Hi.
> 
> On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> > On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > > 
> > > > Le vendredi 16 février 2018, 06:42:52 CET rhkra...@gmail.com a écrit :
> > > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > > > Why can't I access wikis from a Debian box:
> > > > > > Forbidden
> > > > > > You are not allowed to access this!
> > > > > > is the message I get.
> > > > >
> > > > > I think we need more information--which wiki are you having trouble
> > > > > with? (What is its URL?)
> > > >
> > > > I first had this message on  https://wiki.debian.org, then on various
> > > > problems.
> > > 
> > > Old but uptodate wheezy install here. firefox had no problems navigating 
> > > the site.
> > > Perhaps your http->S<- is defective somehow.
> > 
> > The original message was so incredibly vague that it could mean anything.
> > 
> > But.
> > 
> > If the actual complaint is "I get 403 Forbidden on https://wiki.debian.org;
> > then we need additional detail: what version of Debian the OP is using,
> > what browser, and any unusual aspects of the OP's network that could
> > be relevant (workplace firewall, China firewall, etc.).
> 
> My crystal ball says that OP is using home connection, and no, these
> details aren't needed. tcpdump/wireshark capture, combined with the SSL
> session key - that's what needed.
> Or someone from 11AS12322 willing to provide a temporary shell account.
> 
> E-mail headers say that e-mail came from 11AS12322 belonging to some
> French provider:
> 
> Received: from ns.rodary.net (unknown [88.170.1.143])
> by smtp5-g21.free.fr (Postfix) with ESMTP id 154405FF27
> for <debian-user@lists.debian.org>; Fri, 16 Feb 2018 02:42:15 +0100 
> (CET)
> 
> With MUA which is uncommon in dull enterprise world:
> 
> User-Agent: KMail/5.2.3 (Linux/4.9.0-5-amd64; KDE/5.28.0; x86_64; ; )
> 
> I believe we can exclude such possibilities as China Great Firewall
> (unless they installed it in France for some reason), or workplace SSL
> Bump (else OP won't see HTTP 403).
> 
> 
> > There have been several similar complaints in #debian IRC over the last
> > year or two, with random people coming in and saying that they get a
> > "403 Forbidden" on the Debian wiki, but the one thing they all have in
> > common is a LACK OF DETAIL.
> 
> Whose who know they way around don't have such problems. Whose who don't
> are unable to describe it. I see nothing unusual in this.
> 
> My suggestion to OP - try Tor, see if it works.
> 
> 
> > At this point nobody knows how to diagnose the problem, because nobody
> > who HAS the problem is willing or able to come forward and just say what
> > is happening and why.  Is it a DNS resolution error, in which they're
> > getting the wrong IP address?
> 
> No. Browsers do certificate validation, "wrong IP address" would be
> possible if the third party somehow produced a valid certificate for
> wiki.debian.org (you have to be a CA *or* the government to do this) and
> faked a DNS record (that's easy part).
> 
> > Does the wiki or its front-end web server have a firewall that
> > blacklists certain IP address ranges?
> 
> Even if it did, the firewall have not come into play.
> Since the user saw HTTP 403 it means that HTTPS connection was
> established successfully, and a front-end (or back-end) webserver gave
> 403 code, which was transferred to a user.
> 
> >  Is it a web browser bug?  Nobody knows!
I was using Opera  browser,so quick,  but I just tried with firefox, so slow, 
but both mozilla, and the result is the same when google search ( which I don't 
use with  Opera)  gives me a lot of choices , all with 403 result. My  public 
IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
> 
> Hardly. Of course OP could use some ancient toy browser that does not do
> SNI, 
what is  SNI?
> but wiki.debian.org provides a correct certificate even for
> *those*. It's easy to check with (openssl does not use SNI unless you
> ask for it):
> 
> openssl s_client -host wiki.debian.org -port 443
> 
> Reco
> 
Will my comments help?
Jacques

Re: USB key and lost space

[Rodary Jacques]

Le vendredi 16 février 2018, 12:03:56 CET Thomas Schmitt a écrit :
> Hi,
> 
> Rodary Jacques wrote:
> > I did subscribe  in april 2016,
> 
> The mail header X-Spam-Status in your mail to the list does not contain
> the test "LDOSUBSCRIBER". So currently your address roda...@free.fr is
> not subscribed.
> 
> Consider to subscribe again and also to Cc: the debian-user list with
> your replies.
> 
> 
> > Where am I supposed to find firmware.tar.gz. It may be a very stupid
> > question, I was used with .iso  image disks only.
> 
> Other people on debian-user probably have more experience with that.
> I have to google.
> For the current Debian release 9 "stretch" it is probably on
>   
> https://cdimage.debian.org/cdimage/unofficial/non-free/firmware/stretch/current/
> 
> 
> I wrote:
> > > So use /sbin/fdisk to create partition 3.
> 
> > I used fdisk, cfdisk and partitionprobe and it seems my Key is  quite
> > useless now
> 
> Which ISO image did you put onto the USB stick ?
> 
> Let's give current netinst a try:
> 
>   $ dd if=debian-9.3.0-amd64-netinst.iso of=/dev/sdc bs=1M
>   ...
>   $ /sbin/fdisk /dev/sdc
>   ...
>   Command (m for help): p
>   ...
>   Device Boot StartEnd Sectors  Size Id Type
>   /dev/sdc1  *0 593919  593920  290M  0 Empty
>   /dev/sdc23760   4591 832  416K ef EFI (FAT-12/16/32)
> 
>   Command (m for help): n
>   Partition type
>  p   primary (2 primary, 0 extended, 2 free)
>  e   extended (container for logical partitions)
>   Select (default p): p
>   Partition number (3,4, default 3): 3
>   First sector (593920-7864318, default 593920): 
>   Last sector, +sectors or +size{K,M,G,T,P} (593920-7864318, default 
> 7864318): 
> 
>   Created a new partition 3 of type 'Linux' and of size 3.5 GiB.
> 
>   Command (m for help): p
>   Disk /dev/sdc: 3.8 GiB, 4026531328 bytes, 7864319 sectors
>   Units: sectors of 1 * 512 = 512 bytes
>   Sector size (logical/physical): 512 bytes / 512 bytes
>   I/O size (minimum/optimal): 512 bytes / 512 bytes
>   Disklabel type: dos
>   Disk identifier: 0x0347fd41
> 
>   Device Boot  Start End Sectors  Size Id Type
>   /dev/sdc1  * 0  593919  593920  290M  0 Empty
>   /dev/sdc2 37604591 832  416K ef EFI (FAT-12/16/32)
>   /dev/sdc3   593920 7864318 7270399  3.5G 83 Linux
> 
> 
>   Command (m for help): w
>   The partition table has been altered.
>   Calling ioctl() to re-read partition table.
>   Re-reading the partition table failed.: Permission denied
> 
> The final error message comes because i did this as normal user, just
> having rw-permission to /dev/sdc.
> I unplug and replug the USB stick to let the kernel assess the new
> partitioning:
> 
>   $ ls /dev/sdc*
>   /dev/sdc  /dev/sdc1  /dev/sdc2  /dev/sdc3
> 
> 
> > I will try dd, very carefully. to erase this new partition I finally
> > created, and perhaps come back to you afterwards.
> 
> I would just copy the ISO again onto the USB stick base device 
> and then run fdisk.
> 
> 
> Have a nice day :)
> 
> Thomas
Saturday:
I don't quite know how, but with fdisk, cfdisk, parted,  partx and 
partprobe I now have a brand new key with 16 GB (or GiB),  the original size, 
without the iso file, type vfat (rw, nosuid, nodev, relatime, uid=1000, 
gid=1000, fmask=0022, dmask=0022, codepage=437, iocharset=ascii, 
shortname=mixed, showexec, utf8, flush,errors=remount-ro, uhelper=udisks2. I 
have three oher microSDHC to save!
Sunday:  That was yesterday! Two of the microSDHC cards didn't resist to my 
assaults. But the one with netinst iso (with the two partitions)  seem to be 
much harder. 
Tired of trying (fdisk cfdisk sfdisk parted failed with "read only 
disk"), I put the card in my camera to format it, successfully. 
On a Mac, it is now known as "NIKON D7100" and is read-write, as on the 
camera. But on my Debian and Fedora boxes, if it recognized as such also, it 
stays read only: 'wipefs /dev/sde' continue to read:
offset   type 

which was the old  situation, mount says "/dev/sde1 on /media/jr/NIKON D7100 
type vfat (ro, etc..." which is correct except for the ro! Same with the other 
tools.
How can I force the kernel to forget this 'read only' on the disk? 
Could it be because of the external card reader I use?
It is not really important, since I can use this card with my mac and 
to scan documents, but I like to understand.
Jacques

Re: Stretch net install on EeePC - unable to resolve mirror host address

[Rodary Jacques]

Le samedi 17 février 2018, 16:20:06 CET Roger Price a écrit :
> I am trying to net install stretch i386 on an EeePC using a wired connection. 
> I 
> chose my ISP as the mirror, but the installation hangs on "Configure the 
> packet 
> management tool (APT)" [french text reads "Configurer l'outil de gestion des 
> paquets (APT)"].
> 
> I checked on my regular box that stretch i386 is available at 
> debian.proxad.net
> 
>   rprice@maria ~ wget --no-verbose
> http://debian.proxad.net/debian/dists/stretch/Release -O - | grep -E
> '^(Suite|Codename|Architectures):'
>   Suite: stable
>   Codename: stretch
>   Architectures: amd64 arm64 armel armhf i386 mips mips64el mipsel ppc64el 
> s390x
> 
> but on the EeePC with Ctl-Alt-F3 I get
> 
>   ~ # wget --no-verbose
> http://debian.proxad.net/debian/dists/stretch/Release -O - | grep -E
> '^(Suite|Codename|Architectures):'
>   wget: unable to resolve host address 'debian.proxad.net'
> 
> Command « ip address » shows that the EeePC has been assigned the correct IP 
> address 10.218.0.100, and /etc/resolv.conf correctly points to the router as 
> the 
> DNS resolver:
> 
>   ~ # cat /etc/resolv.conf
>   search rogerprice.org
>   nameserver 10.218.0.1
> 
> I am using the same router and the same name server to post this message. Any 
> suggestion or hint for fixing the installation would be most welcome,
>
> Roger
I had this kind of problem with free (i.e. proxad) repository which isn't any 
more (bust was in 2016) on the mirror list, 
and had to replace it with  -not a ftp 
server- in /etc/apt/sources.list.
Salut. Jacques

Re: wiki

[Rodary Jacques]

Le vendredi 16 février 2018, 06:42:52 CET rhkra...@gmail.com a écrit :
> On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > Why can't I access wikis from a Debian box:
> > Forbidden
> > You are not allowed to access this!
> > is the message I get.
> 
> I think we need more information--which wiki are you having trouble with?  
> (What is its URL?)
I first had this message on  https://wiki.debian.org, then on various problems.
> Maybe you have to register and then login on that wiki.
and I was never asked to register before you mention it. 
Jacques 

Re: BIND and iptables config

[Rodary Jacques]

Le jeudi 15 février 2018, 11:44:36 CET Henning Follmann a écrit :
> On Thu, Feb 15, 2018 at 05:01:52PM +0100, Rodary Jacques wrote:
> > With NetworkManager, /etc/network/interfaces has only the loopbak 
> > interface, and I can't use wicd which can't deal with two wired interfaces. 
> > And, Henning Follmann, my English is too poor to explain clearly my setup 
> > which is the standard one when your ISP gives you one routable address and 
> > you want your home LAN to have access to internet.
> > Thanks for your interest anyway.
> > Jacques
> > 
> 
> Hello,
> no your english was good enough to describe your setup. And I would say
> that 90% of "us" have a form of "dialup" with on routable ip address and a
> NAT setup.
> First bind is not "standard" in this kind of situation and makes things
> overly complicated. I would recommend dnsmasq instead. It is much more
> staight forward for a NAT box to setup. It will also provide you with a
> dhcp server.
> And in your situation you also want to disable/avoid the NetworkManager. 
I told before that wiced can't deal with two wired interfaces.
> It is quite easy because evry device you list in /e/n/i 
i don't know ( with my poor English :-)) what is /e/n/i 
> will be
> automaticaaly ignored by the NetworkManager.
> And clearly because you have difficulties in setting this up doesn't make
> all of this a bug.
I don't find it normal to try to use interfaces before they are up! It's 
obvously not a bug, but it's just  telling  users they shouldn't  try to 
understand. When I fist tried Debian in april 2016, with Jessie, I read in the 
bind9 doc something like "there are some issues about changing bind9 
configuration, as future upgrade will loose your changes". without any more 
details. 
> Also I want to mention to setup a router with Red Hat or with debian is
> possible but there a distributions which are much more suited for this 
> purpose. 
I switched to Debian not to find it easier (Redhat wasn't) but because of 
safety and coherence.
But NetworkManager, which was on Fedora long before that on Debian, did not the 
stupid things it does with resolv.conf and interfaces.
> I personally like pfsense and opnsense. Both are based on BSD but
> they are excellent for SOHO routing. 
Thanks to Wikipedia, I understood SOHO :-D
> 
> -H
Have a good day (or night).
JR

Re: BIND and iptables config

[Rodary Jacques]

Le jeudi 15 février 2018, 11:44:36 CET Henning Follmann a écrit :
> On Thu, Feb 15, 2018 at 05:01:52PM +0100, Rodary Jacques wrote:
> > With NetworkManager, /etc/network/interfaces has only the loopbak 
> > interface, and I can't use wicd which can't deal with two wired interfaces. 
> > And, Henning Follmann, my English is too poor to explain clearly my setup 
> > which is the standard one when your ISP gives you one routable address and 
> > you want your home LAN to have access to internet.
> > Thanks for your interest anyway.
> > Jacques
> > 
> 
> Hello,
> no your english was good enough to describe your setup. And I would say
> that 90% of "us" have a form of "dialup" with on routable ip address and a
> NAT setup.
> First bind is not "standard" in this kind of situation and makes things
> overly complicated. I would recommend dnsmasq instead. It is much more
> staight forward for a NAT box to setup. It will also provide you with a
> dhcp server.
> And in your situation you also want to disable/avoid the NetworkManager. 
> It is quite easy because evry device you list in /e/n/i will be
> automaticaaly ignored by the NetworkManager.
> And clearly because you have difficulties in setting this up doesn't make
> all of this a bug.
> 
> Also I want to mention to setup a router with Red Hat or with debian is
> possible but there a distributions which are much more suited for this
> purpose. I personally like pfsense and opnsense. Both are based on BSD but
> they are excellent for SOHO routing. 
> 

I had quite enough  problems setting this config to try something else. Thank 
you again.
JR

wiki

[Rodary Jacques]

Why can't I access wikis from a Debian box:
Forbidden
You are not allowed to access this!
is the message I get.

Re: BIND and iptables config

[Rodary Jacques]

With NetworkManager, /etc/network/interfaces has only the loopbak interface, 
and I can't use wicd which can't deal with two wired interfaces. And, Henning 
Follmann, my English is too poor to explain clearly my setup which is the 
standard one when your ISP gives you one routable address and you want your 
home LAN to have access to internet.
Thanks for your interest anyway.
Jacques

USB key and lost space

[Rodary Jacques]

On  several USB keys used for installation (or try of) I copied iso files of 
more or less  MB, and the remaining space (of 15 or 31MB is inaccessible (non 
alloué in french). in 
https://www.debian.org/releases/stable/amd64/ch04s03.html.fr it is said you can 
recover this:
L'image hybride n'occupe pas toute la place sur la clé. Si vous n'avez qu'une 
seule clé ou si vous souhaitez mettre tout ce qui vous est nécessaire sur un 
seul périphérique, il peut être intéressant d'utiliser l'espace libre pour 
stocker d'autres fichiers, microprogrammes, paquets, etc.

"Pour cela, vous devez créer une deuxième partition FAT, monter la partition et 
y copier et décompresser le microprogramme. Par exemple :
# mount /dev/sdX2 /mnt
# cd /mnt
# tar zxvf /path/to/firmware.tar.gz
# cd /
# umount /mnt
Si vous avez copié le fichier mini.iso sur la clé, il n'est pas nécessaire de 
créer la deuxième partition car elle est déjà présente. Débrancher et 
rebrancher la clé rend les deux partitions visibles."

I dont know if this apply to what I need, and what I found on the net is either 
stupid=id or not usable on Linux. Someone has an answer?
 Jacques

BIND and iptables config

[Rodary Jacques]

I have my own DNS config t so that my home LAN can access internet (with SNAT) 
to "the" internet which I created under Redhat 7.2!  It did work on a Redhat  
box with Systemd, NetworkManager , and the bind9 RPM. On Debian the 
bind9.service tries to start when the net interfaces are not ready.But  
NetworkManager also tries to resolve DNS servers  still when the net interfaces 
are not ready; so the external servers can't be joined and /etc/resolv.conf ( a 
soft link to  /var/run/NetworkManager/resolv.conf) has no reference to wlan 
(man resolvconf, indicated in /lib/systemd/system/bind9-resolvconf.service as 
Docu never was on my system). So  I had to cheat with NetworkManager: I removed 
the link 
/etc/resolv.conf, and edited the original one (created during installation) 
with all my DNS servers ( the master server is on my box and can't be reached 
before BIND (4, 8 or 9) is activated) . I also had to create a new profile on 
my external interface with all the DNS servers.
All this done (two or three weeks), I can launch named with my own (chroot'ed) 
config, and then start netfilter and SNAT  
with my config.
I don't mind all this as long as I don't have to reboot, and cheat again.
Wouldn't it be a bug?
Cheers. Jacques

Re: Iptables at boot

[Rodary Jacques]

I was just going to give up , and I even installed shorewall, when my last 
attempt with my very old iptables config (from redhat 7.2) did work. I of 
course to still get rid of stupid systemd config, but I don't really care since 
my server is allways up!. Thank you anyway for your hints.
Jacques

wicd vs network-manager

[RODARY Jacques]

Hi
I got rid of  network-manager: it endlessly  came back to the config it got 
when I installed Stretch,  and couldn't even resolve the URL of the debian 
repositories. 
But I have a problem with wicd: it knows about my two wired interfaces, but 
doesn't allow me to configure a connection on one of them and another on the 
second one. Where are the interfaces declared? 
Jacques

iwlwifi and symbols table

[Rodary Jacques]

Hi
I just upgraded to Stretch. At boot I get a warning: " No 
symbols table" (actually it is in French: "pas de table des 
symboles"). Nevertheless everything works, except my 
access point: "modprobe iwlwifi.ko" can't find this 
module  in the kernel directory, but this module is there. 
I remember there was a problem with this module in 
Jessie, but I can't remember the solution. Please help.

iwlwifi and symbols table

[Rodary Jacques]

Hi
I just upgraded to Stretch. At boot I get a warning: " No 
symbols table" (actually it is in French: "pas de table des 
symboles"). Nevertheless everything works, except my 
access point: "modprobe iwlwifi.ko" can't find this 
module  in the kernel directory, but this module is there. 
I remember there was a problem with this module in 
Jessie, but I can't remember the solution. Please help.

Re: Re: Chromium jumps to any workspace it likes.......

[Rodary Jacques]

 As far as I remember, it has nothing to do with the OS, nor with the browser 
or the desktop manager but with the windows manager. In 1999 (perhaps 2000) 
when Gnome was to be loaded carefully one package at a time,  NextStep or 
Nautilus windows manager (I can't remember which, perhaps a third one) 
introduced fixed workspaces, as many as 64 possible ( it was really great to 
open 64 pictures in GIMP), and (later?) the possibility to choose a workspace 
for a given application, e.g workspace 2 for the default browser, 3 for the 
mail, etc... In 2006 (perhaps before) this was introduced in MacOs under the 
name of Spaces, also fixed. Then, in MacOS and Linux (which was first?) 
worspaces became dynamic, i.e created as needed, and then couldn't be assigned 
to a given application; it seems nevertheless that an application tries to go 
to its later place.
Happily enough, I never tried Windows (besides me, a poster says "This 
is 
an air conditioned room, don't open Windows®".

Re: Re: Chromium jumps to any workspace it likes.......

[Rodary Jacques]

Did I already told you about Opera 
:-D)

Re: Rebuilding system after aptitude

[Rodary Jacques]

May be a stupid question, as often: do you want a 
plugin in iceweasel and firefox, like flash, or a stand-
alone video reader, like Totem or VLC?
Jacques

Re: CUPS under jessie

[Rodary Jacques]

I may be completely wrong: I had a canon printer once, and 
canon had made a driver for Cups under MacOS but it doesn't 
matter. After an OS upgrade, the driver didn't work anymore 
and the driver used by Cups (gimp related if I remember well) 
wasn't as good, by far. Canon said they  didn't want/care to 
write a new one. I switched to HP.
Sorry if my post isn't relevant (is that correct in 
English ;-)). 
Jacques

Re: Re: Mailing-list configuration

[Rodary Jacques]

The whole sentence was: Mozilla 
isn't free and Google Chrome is :-D! and was 
of course ironic.
Jacques

Re: Re: Mailing-list configuration

[Rodary Jacques]

I used another post from the thread "Non-firefox browser" , 
which I quoted:
https://lists.debian.org/debian-user/2016/06/msg00437.html
so that nobody in this thread feels targeted ;-). Take a look at it.
Again, sorry for my *E*nglish.
Jacques
P.S.: In 2002 (or 2003), as I sent my usual "sorry for 
my english", a man  ended his answer with:  "sorry for my 
president":-D.

Re: Re: Mailing-list configuration

[Rodary Jacques]

Not using any MUA, just a browser (Opera, which  is BTW in the official  Debian 
list: 
https://wiki.debian.org/WebBrowsers, non-free but I don't know why as it is a 
Mozilla 
clone; Mozilla isn't free and Google Chrome is :-D), and I read the posts of 
the list in 
this browser (or in any other) e.g.:
   https://lists.debian.org/debian-user/2016/06/msg00437.html
where I read:
Reply to:
debian-user@lists.debian.org
Leon.37428 (on-list)
Leon.37428 (off-list)
So IMHO the list CoC doesn't seem to exclude any of the 3 types of answer ;-).
Cheers
 Jacques

Re: network managet and 10.42.0.1/24

[Rodary Jacques]

I had (and still partly have) the same questions. I know where to find the 
answers, but didn't dare 
to use them. 
--First "nmcli -p connection show --active" will show all your connections. Or 
me the access 
point has name (not id) "Hotspot" (I don't know if the name depends on the 
device and driver).
--Then "nmcli -p connection show --active Hotspot" gives all the details, 
including 802-11-
wireless.ssid (the hostname), 802-11-wireless.mode ap (access-point I 
guess),IP4.ADRESSE[1] 
(ip = 10.42.0.1/24, gw = 0.0.0.0), IP6.ADRESSE[1] (ip = 
fe80::7e5c:f8ff:fe8e:9473/64, gw = ::) 
and many other infos. 
--What I didn't dare to do was to try "nmcli connection edit (or modify) 
Hotspot". 
--What I did was to modify my DNS setup. In my master zone I added 10.42.0.1 as 
ip-address 
for my server (which now has 3 addresses, one for the outside, from my ISP, one 
not routable for 
my local network 192.168.xxx.1, and 10.42.0.1, not routable also). In the zone 
file I added also 
fixed addresses 10.42.0.xxx for some devices (e.g. a printer which has two 
addresses 
192.168.10.6 and 10.42.0.6; this allows wifi clients to use this printer. I  
also added a reverse 
zone 10.42.0.zone.
I can't remember how I managed to exclude the fixed addresses from dhcpd range 
to avoid 
conflicts but it works. Hope this will help.
Sorry for my English.
Jacques

Re: Re: [deb...@lionunicorn.co.uk: Re: Network manager (again) Re:]

[Rodary Jacques]

Thank you, I didn't know. In French (I was careful 
here) languages' names and peoples' nationalities 
don't take a capital letter. But towns' and countries' 
names do of course.
Jacques
P.S.:I still don't see where was the joke in my post, 
but never mind.

Re: Re: [deb...@lionunicorn.co.uk: Re: Network manager (again) Re:]

[Rodary Jacques]

Thanks for your comments I also use apt* commands, when necessary, but 
the point is that people don't seem to read thoroughly the threads they are 
answering to: I don't mind using wicd, I even tried it. But it also uses 
/etc/network/interfaces, and my questioning is about initramfs, ifaces 
drivers, /proc/net/dev, and $networking in insserv (not $network). And I 
would be very grateful to anyone who could answer to those questions 
(named-bind9, wifi access-point) not to the first answers. Thank you in 
advance, and again, sorry for my poor english (kspell still tells me to write 
*English* instead and nobody told me why, and this proves nobody looks at 
the first post in a thread :-D)
Cheers
Jacques 

Re: [deb...@lionunicorn.co.uk: Re: Network manager (again) Re:]

[Rodary Jacques]

Le vendredi 20 mai 2016 16:09:25, vous avez écrit :
> Hi, I thought you might only be subscribed to the French list
> and not this one, so you might have missed this.

> 
> Could we have a reference please for "said unstable by debian's package
> installer"? (I assume you're talking about the wicd packages, because
> someone wrote "Please note, an entry does not work with network-manager.
> Use wicd instead" in the thread called "WiFi Access Point".)

I find your post only today may 26. I read the warnings of synaptic about wicd. 
And now that I 
have learned things about systemd, insserv and them requiring to start 
networking (not network) 
as soon as the driver's modules are loaded, long before reading 
/etc/network/interfaces (BTW 
mine includes only lo)  I won't change anything more: It works! I start named  
in /etc/rc.local, not 
bind9 which definitely won't work, and  my wifi access point in gnome-nettool. 
And I don't halt 
my server. Not intellectually satisfying, but practical! 
Jacques
PS: my wifi problem came from firmware-iwlwifi being loaded much too late (7s 
after boot-start, 
when r8169 and e1000e for my NICs are loaded before 0.8s) probably because the 
version in 
early Jessie was broken, and replaced after installation (see 
https://wiki.debian.org/iwlwifi).
 

Re: /etc/init.d/networking does not start everything in /etc/network/interfaces

[Rodary Jacques]

I read quite a lot of the answers to your post, and I still think there is a 
problem, not 
linked to the kernel's interface name name. I have a wifi interface named 
*everywhere* 
wlan0. It isn't found  by network-pre.target, network-target or 
networking-service, I 
don't know which one. What I know is bind9 (named in fact) can't start, because 
/etc/insserv.conf asks for $network to start $named; after boot, when network 
is 
started there is no problem starting named by hand with: 
"named -u named -t /my-chroot-dir -c /etc/named.conf"
 but bind9.service doesn' start and tells me:
 Drop-In: /run/systemd/generator/bind9.service
└─50-insserv.conf-$named.conf
I suppose it's a bug, but as it works like this!! (See bind9-named post in 
debian-user-
french list
Jacques

Re: Network manager (again) Re:

[Rodary Jacques]

Le samedi 14 mai 2016, 06:47:11 Hans a écrit :
> Am Samstag, 14. Mai 2016, 05:27:06 schrieb Bhasker C V:
> 
> Hi,
> try wicd (vicd-ncurses, wicd-gtk, wicd-cli). It may fit your needs. And you
> can have entries in /etc/network/interfaces, so you can be already
> connected without any window-manager.
> 
> Good luck!
> 
> Hanspoint d'accès wifi
> 
> > Hi
> > 
> >   I am finding it difficult to settle on a good network manager which
> > 
> > can work for my case
> > 
> > 1. My home dir is luks/ext4 and mounted manually after logging in for
> > the first time
> > 2. My GUI is started after mounting my home dir and by manual startx only
> > 
> > I could never get my network manager to store passwords in the user dir.
> > I do not like the passwords stored in
> > /etc/NeworkManager/sytem-connections with plain passwords visible so
> > anybody can open them if they have physical access to the machine/disk
> > (usb live stick etc., )
> > 
> > If I pull up the properties of nm-applet and change the option to
> > "Store password only for this user", nm-applet does not connect since
> > the keyring is no automatically unlocked due to startx
> > 
> > Can anyone help me with fixing this network-manager so the passwords are
> > stored per-user in my luks home rather than /etc/...  OR tell me how to
> > enable nm-applet to automatically trigger opening gnome-keyring ?
I don't understand why you suggest using packages said unstable by debian's 
package installer? I 
had also such advice for my "point d'accès wifi" question.

Re: Network manager (again) Re:

[Rodary Jacques]

Le samedi 14 mai 2016, 06:47:11 Hans a écrit :
> Am Samstag, 14. Mai 2016, 05:27:06 schrieb Bhasker C V:
> 
> Hi,
> try wicd (vicd-ncurses, wicd-gtk, wicd-cli). It may fit your needs. And you
> can have entries in /etc/network/interfaces, so you can be already
> connected without any window-manager.
> 
> Good luck!
> 
> Hanspoint d'accès wifi
> 
> > Hi
> > 
> >   I am finding it difficult to settle on a good network manager which
> > 
> > can work for my case
> > 
> > 1. My home dir is luks/ext4 and mounted manually after logging in for
> > the first time
> > 2. My GUI is started after mounting my home dir and by manual startx only
> > 
> > I could never get my network manager to store passwords in the user dir.
> > I do not like the passwords stored in
> > /etc/NeworkManager/sytem-connections with plain passwords visible so
> > anybody can open them if they have physical access to the machine/disk
> > (usb live stick etc., )
> > 
> > If I pull up the properties of nm-applet and change the option to
> > "Store password only for this user", nm-applet does not connect since
> > the keyring is no automatically unlocked due to startx
> > 
> > Can anyone help me with fixing this network-manager so the passwords are
> > stored per-user in my luks home rather than /etc/...  OR tell me how to
> > enable nm-applet to automatically trigger opening gnome-keyring ?
I don't understand why you suggest using packages said unstable by debian's 
package installer? I 
had also such advice for my "point d'accès wifi" question.

Re: Libreoffice mail merge not working

[Rodary Jacques]

Le samedi 14 mai 2016, 08:28:42 Paolo Cavallini a écrit :
> Il 14/05/2016 00:28, Rodary Jacques ha scritto:
> > Try convert your docs in .doc (not readable in recent MsOffice), .docx
> > (not readable in old MsOffice :-) )or better in pdf, where the p stands
> > for portable, remember. Or best learn LaTex to generate wonderful PDF
> > docs.
> 
> Bonjour Jacques,
> thanks for your reply. However, I'm missing your point: I need to do a
> series of pdf from a Libreoffice doc, based on a db table, and I suspect
> this function is broken in Debian Sid. How converting to something else
> could help?
> All the best.
Sorry, I can't help you. But I suppose you know what you are doing, using an 
instable distribution 
to work on a db.
Very nice, your web site.

Re: Multiple live iso's on a single bootable flash drive?

[Rodary Jacques]

Le samedi 14 mai 2016, 06:59:27 Richard Owlett a écrit :
> On 5/3/2016 8:37 AM, Lisi Reisz wrote:
> > On Tuesday 03 May 2016 11:11:45 Richard Owlett wrote:
> >> I hope the result will be a document aimed at the beginner but
> >> not the picture book style that seems prevalent at that level.
> >> Much Linux documentation is written by experts for experts.
> > 
> > Or by "experts" for (those they consider) Noddies.  Power to your elbow!! 
> > I hope you will post or publish the result.
> > 
> > Lisi
> 
> It may have been already done. Replying to my "Creating a home
> network" thread mett mentioned a page of
> http://www.aboutdebian.com/index.htm . From a brief browse it
> looks good.
Look at "info dd". I am not an expert but I read the installation instructions 
and found this use of 
dd. 
See https://www.debian.org/CD/faq/index.en.html#write-usb
I should say that this should work:
"dd if=file1.iso of=/dev/sdx" 
where the x of sdx is *carefully chosen *to point to your USB stick;
"dd oflag=append if=file2.iso of=/dev/sdx" with the same x.
What I don't know is how to choose which iso file to boot from.
Sorry for my English.
Jacques 

bind9-named

[Rodary Jacques]

I need a named.conf and zone-files for my LAN and I choosed a Chroot config. So 
I created a user 
"named" and put all the files in the jail /var/chroot/named with named:named 
ownership. Named 
does start with:
"named -u named -t /var/chroot/named -c /etc/named.conf"
To get the status I run:
"rndc -c/etc/rndc.conf status"

(I don't know if the files used in these commands are those in the jail or the 
symlinks in /etc, but 
it works). To stop the daemon, I run:
 « rndc -c/etc/rndc.conf stop -p » which sends back the pid.
My question: 
I tried to put all those changes in bind9 scripts
/lib/systemd/system/bind9.service,/etc/init.d/bind9
and /etc/default/bind. I ran "systemctl daemon-reload" and "dpkg-reconfigure 
bind9". No way, 
bind9 always dies immediately after starting -and even sending notifies, with a 
mysterious (for 
me) message:
50-insserv.conf-$named.conf
I  am well aware that it isn't important, as my server is permanently up, but 
as always I would 
like to understand.
Thanks if someone can spend some time to explain, ans sorry for my poor 
English.
Jacques 
P.S.: Yet less important: why aspell kspell (I use kmail) or whatever, corrects 
me if I write english 
instead of English.

WiFi Access Point

[Rodary Jacques]

I have an Intel wifi card correctly configured for Jessie, thanks to 
https://wiki.debian.org/fr/iwlwifi. I only need the Hotspot Access point, 
but I can't start it at boot time, nor change  its name and the WPA 
password. I can only switch from "wifi active" state "to access point 
active" after boot. 
Is there a way to create a  script (a systemd service?) so that the access 
point, with name and  password I choose, is started at boot.
Sorry for my English 
P.S.: See also bind9-named question

Re: Re: point d'accès wifi

[Rodary Jacques]

Désolé mais personne n'a répondu à ma question : mon point 
d'accès fonctionne correctement, mais :
 -1- il n'est pas activé au démarrage.
 -2- je ne peux pas modifier le mot de passe
En fait, je crois que je dois créer un service de systemd, 
comme on pouvait le faire (difficilement) avec inetd puis xinetd (hé oui je 
suis vieux).
Je vais voir chez  debian-user (pas nécessairement french)
Merci à tous
Jacques

-Re: configuring softwarecollections.org repository on debian jessie

[Rodary Jacques]

Le jeudi 12 mai 2016, 21:55:24 Liam O'Toole a écrit :
> On 2016-05-12, soko.tica  wrote:
> > --001a1146456672df2d0532a72b01
> > Content-Type: text/plain; charset=UTF-8
> > 
> > Hello list,
> > 
> > I need to install a package (php54) on a VM running debian jessie (Here is
> > why https://www.virtualmin.com/documentation/web/multiplephp ). I have
> > managed to install rhscl-php54-epel-6-x86_64-1-2.noarch.rpm through alien
> > package, but don't know how to isntall
> > php54 php54-php-mysqlnd. Repo rhscl isn't in /etc/apt/sources.list but in
> > /etc/yum.repos.d/ and I wasn't able to find php54 php54-php-mysqlnd. Any
> > help will be appreciated. Thanks in advance.
> 
> You are trying to install Red Hat packages on a Debian OS. What's more,
> you are tring to install packages from Red Hat Software Collections,
> which require manipulation of their environment to run properly. You'd
> be much better off doing that on a CentOS machine.
> 
> Otherwise, prepare to enter a world of pain. :)
If alien (which is a Debian software, isn't it) says you can, why not? 
You just need to 
be careful, trying a fake install first (dpkg --noinstall --no-act). I switched 
to Debian for that kind 
of safety, being tired to note all my changes and go back painfully afterwards. 
I remember 
(1998-99) when I installed gnome-0.nn ten times! But I can't live without 
BSD-games ( try "cal 
09 1752" (even MacOsX has it) and "pom 2712" it's unforgettable) nor without 
xanim to read 
old Quicktime CDs from an USB stick! I don't think Debian needs worship!
Jacques

Re: Libreoffice mail merge not working

[Rodary Jacques]

Le vendredi 13 mai 2016, 08:31:55 Paolo Cavallini a écrit :
> Hi all,
> my Libreoffice fails to generate a series of document starting froma a
> template and a database. It used to work, but historically it has always
> been a fragile solution. For instance, I was never able to send the
> resulting document to a series of email addresses.
> I suspect this is due to Debian version using a different JVM from the
> official one (I assume if this would be an upstream issue this would
> have been noticed and probably fixed long ago).
> Is someone able to use this function?
> All the best, and thanks a lot.
Try convert your docs in .doc (not readable in recent MsOffice), .docx (not 
readable in old 
MsOffice :-) )or better in pdf, where the p stands for portable, remember. Or 
best learn LaTex 
to generate  wonderful PDF docs.
Regards
Jacques

Re: Anytime I touch a print function, get error but it works

[Rodary Jacques]

Le vendredi 13 mai 2016, 10:01:53 Gene Heskett a écrit :
> The system is wheezy, 32 bit except for the running kernel, all up to
> date but with quite a few added packages as my interests are best
> described as eclectic.
> 
> The error is:
> p11-kit: invalid config filename, will be ignored in the
> future: /etc/pkcs11/modules/gnome-keyring-module
> 
> There seems to be zero docs on this so called "p11-kit", but I can't
> purge it without destroying the system.
> 
> So it actually refers to /etc/pkcs11/modules/gnome-key-ring.
> 
> Does this have a reason to exist, and if so, what the heck is it?
> 
> And what dies if I blow it away by hand?
> 
> Thanks.
> 
> Cheers, Gene Heskett
Have a look at https://p11-glue.freedesktop.org/p11-kit.html. Does it help?
Jacques

Re: Netflix sous Debian

[Rodary Jacques]

Le vendredi 13 mai 2016, 11:15:16 Pierre Crescenzo a écrit :
> Bonjour,
> 
> J'utilise Debian en stable+testing. Y a-t-il une solution pas trop tirée
> par les cheveux pour voir (et entendre) du Netflix (quand on est abonné
> 
> :-)) sous Debian. J'ai essayé des solutions sous Chrome (chromium) ou
> 
> Firefox (firefox-esr) avec notamment PipeLight, mais il semble que depuis
> peu elles ne fonctionnent plus. Et HTML 5 de Netflix ainsi que
> google-chrome ont semble-t-il aussi du plomb dans l'aile. J'ai suivi pas
> mal d'autres pistes, en vain. Bref, je me suis perdu... Vous auriez une
> solution qui fonctionne actuellement et "pour de vrai". ;-) Merci !
> 
> Debianeries,
> 
> Pierre Crescenzo
>   mailto:pie...@crescenzo.nom.fr
>   http://www.crescenzo.nom.fr/
Achète un Mac :-) ! Je plaisante , bien sûr , je ne suis pas abonné à 
Netflix.
Jacques

Re: piratage des comptes web : YAHOO, GMAIL OUTLOOK

[Rodary Jacques]

Le jeudi 12 mai 2016, 14:18:57 debian-org a écrit :
> Bonjour,
> 
> Je ne doute pas que le message initial, de même que les suivants, soient
> envoyés de bonne foi mais les réactions sur la liste me semblent tout à
> fait appropriées.
> Le premier message est alarmiste et ne donne pas la moindre information
> vérifiable.
> Un site dont la seule activité avérée est de collecter des adresses
> email et qui ne donne pas vraiment d'informations vérifiables à côté, ça
> ne compte pas.
> 
> Avant de relayer ce type de message, il faut un minimum se renseigner,
> trouver des sources différentes et réellement fiables, avoir des dates,
> des faits...
> Une source connue ne prouve rien pour autant car rien n'assure qu'ils
> ont eux même fait le boulot correctement.
> Comment être certain que ce n'est pas un Hoax qui refait surface ? Sur
> un problème comme ça, je m'attendrais au moins à trouver une
> communication officielle de chacun des fournisseurs de service concernés.
> 
> Ce qui se voulait être un information dans le but d'aider n'aide en rien
> et cause plus de tords qu'autre chose.
> Si tu veux aider, fais d'abord le travail de vérification avant de
> relayer, ou non, ce genre de message.
> Tant qu'une annonce de ce type est vague, elle ne vaut rien et doit être
> ignorée.

Benjamin Bayart disait un jour à une responsable politique, que pour 
Google & Cie, la 
marchandise à vendre c'était nous. Donc même sans piratage, nos comptes mails 
web etc... sont 
diffusés. J'ai un compte gmail, que j'utilise le moins possible, pour éviter 
(non, limiter) les 
multiples spams ciblés.

Re: Chromium. Good Alternative for Chrome?

[Rodary Jacques]

> Le 12 mai 2016 à 03:57, Patrick Bartek  a écrit :
> 
> Now that Google Chrome support has ceased for Wheezy (and others), and
> since I have no plans to upgrade the OS for another 2 years when it
> reaches LTS EOL, would Chromium make a decent alternative? Is it stable
> enough for regular use?  I've never used it and opinions vary.
> Everything I've read says Chromium is "cutting edge." Are we talking
> "Unstable-like" to "Testing?" Or Fedora to Red Hat?
> 
> Any alternatives instead of Chromium?  I mainly desire
> stability, security and longevity.  Already have the most recent
> version of Firefox installed, but prefer it only as a back up.
> Iceweasel has been purged.
> 
> Or, maybe, I'll just continue to use the old, unsupported Chrome.

Give a try at Opera. I find it great.
Jacques