前面聊到 Homelab 设置，这个周末有点时间，就把前一个星期已经安装好的 Vaultwarden 软件给设置好。

前文说到，原来在工作中使用过一个密码系统，回想起来，应该是 LastPass。卸载、删除 LastPass 之后，也试过用 bitwarden，但是一直想最好在自家的机器上用，而不借助第三方。

前些天发现 Vaultwarden 这个软件兼容 Bitwarden 的后端接口，就是可以使用手机端的 bitwarden app。这样家人共享这个后端就容易多了。

再来倒叙一下。

安装

我是用 Proxmox 建了一个 Debian Linux 容器，建这个容器也很容易：Proxmox 社区有很多辅助脚本，这个 Vaultwarden 脚本可以帮助在 Proxmox 终端里直接完成 Vaultwarden 的安装。

Vaultwarden 是一个密码保管软件，系统安全至关重要。所以安装过程就直接设置了 HTTPS。这个 HTTPS 层用的是自签服务器证书，使用当然没有障碍，但是其本身有一定安全隐患。因此，第二步是自建一个私有的 TLS 证书系统……其实，证书系统应该预先完成……这个后面再细聊。

Vaultwarden 还支持 Docker 安装，所以，没有 Proxmox 的话，安装起来应该也不太难。

使用

在手机上打开 bitwarden，用户可以选择后端。你可以选用 bitwarden.com 或者 bitwarden.eu，第三个选项 Self-hosted 就是“自托管”。

这之后，bitwarden 的使用与连接 bitwarden.com 后端应该没有区别。

今天在家里忙碌了一天，还挺有一点成就感！

几个月前，在 Amazon 上买了一个 Beelink SER5 Max 迷你机，32GB 内存，500GB SSD。

用了一段时间，感觉性能还不错。于是 Prime Day 的时候又去买了一个 2TB SSD

一直想在家里做一个像样点儿的 Homelab，有了这个小盒子，这个设想可以实际操作一下了！

1. Proxmox 虚拟机环境

先在 2TB 的 SSD 上安装了 Proxmox 虚拟机环境。这是一个基于 Debian Linux 的虚拟机管理系统。

2. Windows 11 Pro 虚拟机

因为工作用的 Windows PC 无法访问中国网站，连中国银行网站都不行，我一直希望有一个自己的 Windows 系统，那样有一些与中国联系所需的软件，如腾讯会议，我可以有地方安装。所以这台迷你 PC 上原装的 Windows 11 Pro 我还要保留。

3. 笔记软件

希望安装一个笔记软件系统，不仅在家，还可以在外面使用。一圈儿研究下来，很多人推荐 Obsidian 这款。于是安装了 Sync-in 服务器，用它可以做 Obsidian 的后台。

4. 密码系统

原来在工作中使用过一个密码系统，后来那家公司出了一次数据泄露的大新闻，之后医院就解除了与这家公司的合同，停止了这款密码管理软件的使用。

同事有使用 Bitwarden，网上推荐这款软件的也不少。我搜了很久，找到 Vaultwarden 这款开源的版本。

安装这些系统，折腾 Windows 11 虚拟机花了最长时间……这就是我为什么喜欢开源软件的原因。

SSH is a secure shell, a remote access tool that Linux/UNIX users have been using for years and years. Many projects have attempted to get SSH onto Windows over the years, with various level of success. So I was thrilled when Microsoft finally seems to embrace it and made it a feature of Windows 10 and then 11.

Windows is such a confused and confusing beast for so long! One has to marvel at its monstrosity!

Back to OpenSSH on Windows. I recently got myself a Windows 11 mini PC. I normally just use Remote Desktop with it. But I want to use it for coding so I would like to get SSH working with a key instead of using password.

I thought that would be easy!

And I would be wrong!

Windows is dead set to deny connection using an SSH key!

It accepts my password. But when I put this in sshd_config:

PasswordAuthentication no

It simply responds with Permission denied (publickey).

I asked Microsoft Copilot about the error. It suggested that I should make sure that my public key is in the C:\Users\<target-username>\.ssh\authorized_keys file and make sure that it has proper permissions:

icacls "$env:USERPROFILE\.ssh\authorized_keys" /inheritance:r
icacls "$env:USERPROFILE\.ssh\authorized_keys" /grant "$env:USERNAME:F"

We went back and forth about icacls working differently in a PowerShell window vs. Command, verifying that the permissions were right, stopping and restarting sshd service numerous times, etc.. Nothing worked! On the client (Linux) side, ssh -vvv showed that various keys were presented to the server, none were accepted.

Copilot suggested creating a new pair of keys and ssh-copy-id the new public key to the remote host and test with that specifically. Didn't work!

Copilot suggested to debug with an interactive sshd.exe -ddd run in Windows. That got me some complaints about UNPROTECTED PRIVATE KEY FILE!. Now that seems to indicate that sshd may also have the same issue reading private host keys when starting as a service.

Copilot thought so, too. It said that this is the breakthrough we needed.

It told me to open up the Command Prompt as Administrator and ran these commands:

cd C:\ProgramData\ssh

:: Remove inheritance
icacls ssh_host_rsa_key /inheritance:r
icacls ssh_host_ecdsa_key /inheritance:r
icacls ssh_host_ed25519_key /inheritance:r

:: Remove all existing permissions
icacls ssh_host_rsa_key /remove:g Everyone
icacls ssh_host_ecdsa_key /remove:g Everyone
icacls ssh_host_ed25519_key /remove:g Everyone

:: Grant SYSTEM and Administrators full control
icacls ssh_host_rsa_key /grant SYSTEM:F
icacls ssh_host_rsa_key /grant Administrators:F

icacls ssh_host_ecdsa_key /grant SYSTEM:F
icacls ssh_host_ecdsa_key /grant Administrators:F

icacls ssh_host_ed25519_key /grant SYSTEM:F
icacls ssh_host_ed25519_key /grant Administrators:F

But sshd still complained about UNPROTECTED PRIVATE KEY FILE!.

Copilot gave more suggestions:

cd C:\ProgramData\ssh

:: Remove all existing permissions
icacls ssh_host_rsa_key /reset
icacls ssh_host_ecdsa_key /reset
icacls ssh_host_ed25519_key /reset

:: Remove inheritance
icacls ssh_host_rsa_key /inheritance:r
icacls ssh_host_ecdsa_key /inheritance:r
icacls ssh_host_ed25519_key /inheritance:r

:: Grant SYSTEM full control
icacls ssh_host_rsa_key /grant SYSTEM:F
icacls ssh_host_ecdsa_key /grant SYSTEM:F
icacls ssh_host_ed25519_key /grant SYSTEM:F

:: Grant Administrators full control
icacls ssh_host_rsa_key /grant Administrators:F
icacls ssh_host_ecdsa_key /grant Administrators:F
icacls ssh_host_ed25519_key /grant Administrators:F

We verified permissions:

icacls ssh_host_rsa_key
ssh_host_rsa_key BUILTIN\Administrators:(F)
                 NT AUTHORITY\SYSTEM:(F)

Successfully processed 1 files; Failed processing 0 files

At one point along the way, the icacls command complained that ssh_host_rsa_key: Access is denied.

And we did more:

takeown /F ssh_host_rsa_key
takeown /F ssh_host_ecdsa_key
takeown /F ssh_host_ed25519_key

Reset permissions:

icacls ssh_host_rsa_key /reset
icacls ssh_host_ecdsa_key /reset
icacls ssh_host_ed25519_key /reset

Remove inheritance:

icacls ssh_host_rsa_key /inheritance:r
icacls ssh_host_ecdsa_key /inheritance:r
icacls ssh_host_ed25519_key /inheritance:r

Grant Only SYSTEM and Administrators Full Control:

icacls ssh_host_rsa_key /grant "SYSTEM:F"
icacls ssh_host_rsa_key /grant "Administrators:F"

icacls ssh_host_ecdsa_key /grant "SYSTEM:F"
icacls ssh_host_ecdsa_key /grant "Administrators:F"

icacls ssh_host_ed25519_key /grant "SYSTEM:F"
icacls ssh_host_ed25519_key /grant "Administrators:F"

Now, sshd.exe -ddd no longer complained in Command Prompt. But the OpenSSH service would not start anymore.

I was frustrated enough at that point. I removed the OpenSSH feature from Windows. I found an OpenSSH Preview package with version 9.8.3.0. I tried that.

The OpenSSH Server service process would NOT start.

Uninstalled that. Put the regular OpsnSSH feature back in.

The OpenSSH Server service process would NOT start.

I gave up! Even Copilot is confused. I am going to try StackOverflow, SuperUser, or some other community.

[EDIT] 2025-09-28 -- Posted it to Superuser.

亲爱的安华家长和朋友：

冬去春来，万物复苏！为迎接春天的到来，展现密西根春天之美丽景色，在春暖花开之际，安华活动中心决定举办主题为“密西根的春天”摄影比赛。本次比赛旨在通过摄影作品展示密西根春天的自然魅力以及人们在春天中的生活与活动。我们诚邀安华社区的广大摄影爱好者积极参与，踊跃投稿，我们期待着您精彩的作品。

摄影展具体细则如下：

1. 主题为《密西根的春天》，作品需紧扣密西根春天的自然景色，城市风光，人物活动等等，拍摄时间不限， 但需注明拍摄地点。
2. 投稿作品一律为数码原创，JPEG格式，大小最好为8X10英寸，分辨率（resolution) 不小于200；
3. 投稿作品只限在色彩、锐度、饱和度、反差等方面进行调整，不接受用合成、添加、大幅度改变的“特创”作品,也不接受AI作品。
4. 每人投稿限量3张，投稿者应为作品的原创作者，并对该作品拥有独立、完整的著作权；投稿者还应保证其所报送的作品不侵犯第三人的包括著作权、肖像权、名誉权、隐私权等在内的任何权利；
5. 投搞者请用WORD文档提供作者的姓名、电话以及EMAIL， 并注明每幅作品的标题、拍摄时间、地点和简短主体文字说明；
6. 截稿日期为2025年6月31日。所有参赛作品将在网上展出，评选小组将根据创意与主题契合度，画面构图与拍摄技巧，作品的情感表达和艺术性以及参赛作品的独特视角与个人风格等从参赛的作品当中评选出获奖作品，进而给予奖励。颁奖时间预定在2025年10月初的安华中文学校的中秋晚会。
7. 奖项设置：
   • 一等奖1名 （奖状+奖品）
   • 二等奖3名 （奖状+奖品）
   • 三等奖5名 （奖状+奖品）
8. 稿件请送交： annhuacenter@gmail.com

安华活动中心

Recently, I have been dealing with an issue with rsyslog server, where it logs error messages with TLS connections. I posted a question on ServerFault but have not received any response for 10 days.

It is hard to debug TLS connection issue as application data is encrypted in the traffic. I tried tcpdump to capture some packets anyways.

Looking through the captured packets, it seems that the syslog client, in this case an EPIC server, may have dropped the TLS connection without properly closing it.

Checking this theory with ChatGPT - here is what may have been happening:

1. A party to a TCP connection should send a close_notify inside the TLS stream to properly close the connection;
2. TLS library receives data until end-of-stream (read returns 0 or error) OR a close_notify is processed.
3. If a close_notify was received before end-of-stream, the TLS library can report a clean shutdown; otherwise, it may report an error or truncated data.
4. If a peer closes its TCP write side without sending close_notify, your TLS library will report an unexpected EOF, truncated data, or similar error.

That seems to match the errors emitted by rsyslogd. For now, we're just going to chalk it up to that unless any further issues pop up. If I have time, I might dig into the rsyslog source code on GitHub.

I have been using rsyslog for many years now to provide a centralized logging service to the enterprise. Previously I have used syslog-ng. Since the Linux distributions used at work switched to rsyslog. I went along.

I have set up the syslog/rsyslog services and they just ran. For years, I just let them be. But as complexity grew in these services, I started to encounter problems. Thus this blog entry. I expect more to follow.

Rsyslog Configuration

First thing to discuss is the rsyslog configuration.

Traditionally, syslog configuration uses a legacy syntax. Both rsyslog and syslog-ng support those. The legacy syntax starts simple but it brings along some complexity of its own. Here is a few examples from Ubuntu:

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog

You can kind of guess what those lines mean.

Rsyslog, on the other hand, has a new RainerScript system for configuration, which I use quite extensively in work. More on that later.

Performance

Another learning experience for me is about rsyslog performance. It had worked wonderfully for me for years without looking under the hood...until something (or, a combination of things) happened.

Troubleshooting

Troubleshooting rsyslog issues is still new to me -- even though I have been using the software, but I have not actually run into many problems until recently. It is of interest to me to write down the experiences.

That's it for today. Have a nice weenend!

安华活动中心定于2025年3月29日为大家提供代办中国签证的服务。

详情请点击链接【2025-03 visa service】以及以下附件：

【附件一】COVA签证在线填表注意事项
【附件二】L、M、F字签证邀请函
【附件三】S和Q签赴华探亲邀请信
【附件四】where you stay
【附件五】在美国出生的中国血统儿童赴华签证
【附件六】annhuaform-202503
【附件七】Visa Compensation Checklist-new
【附件八】签证申请支持材料清单-updated
【附件九】委托书
【附件十】Q&A ……或参见本页后面的回复。️

地点：Crane Liberal Arts and Science Building, WCC

这次申请中国签证的程序为：

1. 在线填写申请表，提交后会获得一个申请号，和一份填好的申请表（PDF文件）；
   • 申请表网页打开后，问在什么地方申请签证，请选择：北美和芝加哥。
     • 同时请记住申请号，方便你找回没有填完的申请表。没有提交（Submit）的申请表可以随时修改，提交后就不能修改。
   • 注意：申请表链接也可在芝加哥总领馆网站上找到。
2. 请将申请表打印出，并签名（打印出文件的第一页和第八页）和要求的相关材料在3月29日送交我们。具体时间和地址请见第四项。大家打印时请注意，在打印机“page sizing & handing” 处，需选择类似于“Fit in Paper”,这样才能将你的申请完整地打印出。特别是第一页 （即确认页）的所有信息必须打印在同一张纸上。
3. 为了减少大家送申请材料时的等候时间，我们这次除了登记申请人信息外，还请大家预约你来送申请材料的时间段。请到 此 Signup Genie 网页进行时间段预约。
4. 进行时间段预约后，请进此 Google 表格进行安华签证服务登记。以便我们了解申请人数并做好相应的准备。
5. 送申请材料时，还请填写“annhuaform”（见附件六，交件时需要）。
6. 3 月 29 日是安娜堡公立学校的春假中，如果你不能在这一天递交申请材料，请联系安华签证小组成员向建鸣 (734) 358-8831 或张星钰 (734) 834-7308 安排 3 月 30 日或 31 日递交申请材料。

@ww9rivers@runtu.us Does this work?
@AHRP@runtu.us -- Is this visible?

Bought a 43" Hisense QD6 QLED TV from Costco around Christmas to use as a computer monitor. I work from home for the most part of the last few years since the COVID-19 pandemic. My work involves mostly running commands remotely in terminals, writing code using VS Code, reading / writing documents, and web browsing. I am used to a lot of browser tabs and windows, so having a large monitor makes those tasks easier.

Having used this TV as an external monitor on my laptop for a few weeks now, I like the crispy display of text, images, etc., but there are a few quirks (OK, problems) that really bother me.

First, this TV is really built as a TV, that doesn't seem to want to work as a monitor: It cuts off the HDMI interface to the PC whenever something happens, like when the PC goes into screen saver mode, or if you press the Home button on the TV remote, not to mention when the PC is powered off then comes back, or reboot.

When that happens, all windows open on this secondary monitor go over to the laptop screen. I would have to rearrange things. Then I have to do it again when I walk away to make some coffee, then again after lunch.

Besides that, the TV monitor somehow turns off the media control media control buttons on the USB keyboard made by Dell, which I use on the laptop while sitting at the desk and it have worked with other external HDMI monitors before.

Another issue is that the PC's Windows 10 sound system seems to get confused when the TV is used as an external monitor. System sound would be directed to the TV sometimes even though it has been on the internal sound system previously.

I wonder if these quirks have more to do with the fact that this TV is branded as a FireTV, which is an Amazon technology. So I am not sure if these quirks reflect more on Amazon's arrogance or bad implementation by the TV manufacturer.

I don't know my writing down these quirks would do anything. If possible, I would like to get this to people at Hisense, so maybe...just maybe we can get a firmware update or something so it can be more useful.

Fraud on the Internet is nothing new. But I believe I did have a new encounter yesterday.

While browsing in the Google app on my iPhone, I ran into an ad for the Samsung 990 Pro 2 PCIe 4.0 NVMe SSD that had a lowest price of $95. I was intrigued!

I clicked it...and again, that first entry looked interesting!

4TB!! For $95!! That's crazy!! Did someone make a typo?

The details look right. . . but why does the page has Adorama on it? I know that is a legitimate camera shop who do sell storage devices as well. But who is skxhnvn.shop?! That's not ADORAMA!

Oh, well. Looks like it's actually some entrepreneurial soul in Chengdu -- a lovely city in the Sichuan Province, China.

I have been receiving calls about package delivery, messages from strangers pretending to be a long lost acquaintance, This looks like a new one.

I guess I could report this to abuse@west.cn . . . but do they really care?

Yahoo! supports oAuth2. So I am trying to use the nodebb-plugin-sso-oauth2-multiple, which does not work yet.

I believe I have configured it correctly. However, when I try to use it to register an account, I get some JSON object containing a non-descriptive error message:

{
  "error":{
    "localizedMessage":"not found",
    "errorId":"NOT_FOUND",
    "message":"not found"
  }
}

Reported the issue on GitHub. No update yet. Probably need to ask in the NodeBB Community.

Just got the plugin updated from 1.4.1 to 1.4.2. Let's see what next.

Splunk provides CSV lookup file management functions on its web GUI, allowing new CSV files to be added in an app, deleted, or moved between apps.

However, it does not seem to allow the same functions to be performed through API functions.

It's REST API set has endpoints that allow a CSV file already in the staging area to be moved to an app so that it can be used as a lookup table. However, there is no way to upload a file into the staging area, which seems to be a ridiculous restriction -- although I can imagine that Splunk may have legitimate security concerns.

This seems to be a request that others have as well.

ERROR: The request could not be satisfied

(community.splunk.com)

ERROR: The request could not be satisfied

(community.splunk.com)

ERROR: The request could not be satisfied

(community.splunk.com)

接触 NodeBB 这个软件还不太久，感觉很不错。在这里做一些笔记，同时也可以分享。做这个软件的，是加拿大一家公司，他们把软件开源了，任何人都可以用这个软件。同时，这家公司也提供网站搭建服务，价格对一般企业来说很合适。

【……待更新】

今天安装了nodebb-plugin-embed 这个插件。

插件的文档声称支持以下这些媒体：

• Coub
• Twitch (video and channel)
• Vimeo
• Vine
• Youtube (short and normal URL)
• Framatube
• Blender PeerTube
• Dailymotion
• Soundcloud
• Mixcloud
• Spotify

详细的使用说明在 NodeBB Community 里。

这个插件与本站的 NodeBB 版本似乎还不兼容。目前先禁用……看看是否能尽快修复。

最终成功的，是这个插件 nodebb-plugin-link-preview:

下面是安华彩虹计划的一个 YouTube 视频：

这个网站是用 NodeBB 和 PostgreSQL 这两个开源软件搭建的。PostgreSQL 用来做后端的数据库，NodeBB 的角色是做前端和这个网站的服务……这是来这个网站用户所要关心的。

NodeBB 前端编辑文档的时候，用的是一种称为 Markdown 的文档格式。大家可以去看前面链接的这个网站、或者 Markdown 指南中文版、或者 Markdown 官方教程来学习这个格式的使用……实际上，可能也用不着：NodeBB 的编辑器还是挺容易用的。

做这个软件的是一个加拿大的小公司，他们在 YouTube 上有一个NodeBB 频道，看这些视频可能更容易些。

如我在开场白里所言，希望有人来使用这个网站。没有人用，这个网站就没什么意义。同时，也希望大家一起来 figure out 这个网站能干什么。我的想法，是用它来代替大家很多时候使用微信群所做的事：微信群有人数限制，微信占用手机存储资源，等等，这些缺陷用 NodeBB 这样的社交服务软件可以解决。

这个网站也会有一点试验性，NodeBB 软件本身一直在开发新的功能，在使用这个软件的过程中，感觉开发组在质量上还是控制得很不错。但是我无法保证在更新版本得时候永远都不会出错，这个时候，需要大家保持一点儿冷静……相信我，我会尽快恢复。

安华活动中心定于2024年3月24日为大家提供代办中国签证的服务。

详情请见【2024-03 visa service】以及以下附件：

1. 附件一：COVA签证在线填表注意事项
2. 附件二：L、M、F字签证邀请函
3. 附件三：S和Q签赴华探亲邀请信
4. 附件四：where you stay
5. 附件五：在美国出生的中国血统儿童赴华签证
6. 附件六：annhuaform-202403

Checklist: 你需要提交给中国领馆的申请材料包括：

1. 申请确认页和申请表：
   • 申请表确认页，请将申请表确认页打印出。请在最后签名和注明日期。（需交原件）
   • 申请表，请将申请表打印出，在“中华人民共和国签证申请表”第8页签名和注明日期。（需交原件）
     • 未成年申请人可由父母代签，格式为： 申请人姓名/父或母签名 （父或母代签）
2. 护照、过期的签证及其它证件：
   • 申请人护照（原件）及护照首页的复印件。
   • 如果你曾获得过中国签证/居留证，请提供最近一次签证/居留证的复印件
   • 如果你此次使用新护照，旧护照上曾有过中国签证/居留证，请提供旧护照原件及其首页的复印件和最近一次签证签证页/居留证的复印件。
   • 如果你曾拥有中国国籍，加人美国国籍后第一次申请中国签证，你还需提供入籍纸复印件一份，最后一本中国护照（原件）及其首页和延期页的复印件各两份。
   • 如果是第三国公民，居住在美国，请提供在美国合法居留的许可证明复印件。
3. 中国亲人的邀请信及邀请人身份证正反两面的复印件。每份申请各一份。如果你申请的是Q1签证，还请提供与邀请人亲属关系的证明。
4. 请提供 Where you stay 表， 并提供你居住地址的文件， 比如驾照或生活账单等的复印件。未成年人申请者的“Where You Stay Form”由家长代签， 同时提供家长驾照或生活账单复印件。
5. 如果你因故 （入藉，婚姻）而改名，新/旧护照或中/美护照上名字不一样，请提供法院的法院改名纸原件及复印件。
6. 未成年人申请者，除以上文件外，根据以下情况还请提供更多的文件。
   • 如果是第一次申请，还需提供出生证原件和1张复印件，父母美国护照原件和首页复印件或中国护照原件及首页复印件/美国绿卡原件和复印件。如果现在是美国公民，需要提供父母的入籍纸的复印件。
   • 如果不是第一次申请，请提供父母美国护照首页复印件或中国护照首页和绿卡复印件。

由【安华天地】微信群转发

各位安华中文学校社区的同学与家长，

安娜堡公立学校学区每年一度的 testing out 将于六月底举行，报名也将很快开始。 安华中文学校有合适的老师帮助孩子做生物（biology）备考准备。请抽空填写下列问卷， 预注册。我们希望知道大家的学习需求，以便组织提供相应的辅导及支持。 谢谢大家！

Ann-Hua Chinese School Administration

这个网站，和 Runtu.us，都是我（王伟）用 NodeBB 这个软件搭建起来的。现在还没想好这个网站用来做什么……欢迎注册试用、提出建议。

这个网站目前支持 Google 账号注册、登录。

本站将制定详细行为规则，请在试用期间遵守以下简单条款：

1. 尊重他人。
2. 不得发布违法、不雅资讯，包括文字、图片、音响、视频。

如有违反，或如有本站主不悦之行为者，本站主保留禁言、销号的权力。

欢迎！