Decode JWTs in bash

Today, it is once again time for one of those "let's document it" blog posts. Lately, I looked into one of the IBM Cloud security features, trusted profiles based on compute resources. I described how to turn your container into a trusted identity. For developing code locally, I needed to copy over files from the Kubernetes pods to my local machine, then decode JWT access tokens, all using the command line. Here is what I did.

flatpak: How to deal with unwanted package updates

Not all software is available as package for my Linux distribution. That's why I use flatpak for some applications. Recently, a new app version introduced a bug. It resulted in random crashes. So I looked into a way to get back to an older, more stable app version.

A simple nginx deployment on IBM Cloud Code Engine

HTML files as configmap in Code Engine

Over the weekend I deployed nginx on IBM Cloud Code Engine. It's nothing fancy or earth-moving. But I wanted to note down and share the steps with you on how to deploy this HTTP server and serve few static HTML pages. All is based on using the command line interface (CLI) and is done with few commands.

Password expiration and vacation planning

Ready for vacation: Passwords

The months of July and August are typical vacation times. Many people work with (at least mental) packing list to prepare for some time off. On my list are passwords. I can relax knowing that no password will expire when I am away. The reason is that for some systems it is a big hassle to reset expired password or accounts. Thus, I prepare accounts for vacation.

Wireshark with Lua on RHEL / CentOS

Wireshark with Lua-based dissector

What do you do on a rainy public holiday with COVID19 restrictions in place? Finally get Wireshark to work with Lua support to have custom dissectors. Dissectors are useful to turn binary garbage into readable TCP or UDP packet content. Lua is a scripting language and a supported way of adding dissectors in Wireshark. Unfortunately, the install package for Red Hat Enterprise Linux does not include Lua support. Compiling Wireshark on my RHEL 8.3 does not simply work because it requires Lua version 5.2 for my scripts to work. And RHEL either has version 5.3 or 5.1 which both are incompatible (long story). So, let's get going.

OBS on Linux: Green screen and virtual camera for video conferencing

OBS Studio: My monkey enjoys the beach

Similar to many of you, part of my work and hobbies consists of video conferencing. For some time now, I have been using OBS Studio (Open Broadcaster Software) to create a virtual camera on my Linux system. Recently, I had to upgrade my kernel. It required to recompile some file and reminded me that I wanted to blog about it. As usual, this is how I remember all the interesting stuff. So what is needed to create a virtual camera with OBS Studio and can you use a green screen for some beach feeling like shown?

Use alfaview on rpm-based Linux (Fedora, Red Hat, CentOs)

Recently, I tried to prepare for an alfaview session. alfaview is a video conferencing system and used by the university where I teach data security. Only earlier this year alfaview introduced Linux support, and only for Debian-based systems. My system is rpm-based (Red Hat Enterprise Linux / Fedora / CentOS), so what to do? A tool like alien did not work for me. Here is what I did to make alfaview run on my rpm-based Linux system.

Covid19 phone challenge: My old Nokia has Android now

My reliable Nokia phone

During these nasty times, you need a steady, reliable companion. It is my old Nokia phone (pictured). It takes phone calls, has an alarm and the current time. Moreover, it serves as projectile against all kinds of "obstacles". The only things missing are Db2 and a Linux terminal. Anyway, this was about to change. Today, I learned that finally (finally!) Android has arrived for this phone with the latest firmware upgrade.

Obtaining device metadata for FIDO / FIDO2 security devices

Zoo of FIDO2 security keys

Last year, I started my journey to passwordless logins. I bought my first FIDO2 USB security key. Then, I added the key as an alternative to time-based one-time passwords (TOTP) to my online accounts where possible. Over time, I got more FIDO devices and also enabled an IBM Cloud tutorial on end-to-end security for passwordless support. What I learned through the process is that sometimes device metadata is important. So today I am going to write about what it is and where / how to obtain it.

Quick notes on using FIDO2 security keys on Linux

Using FIDO2 keys for 2FA

Most of you know that I am using a Linux laptop. Thus, experimenting with FIDO2 hardware security keys as discussed in the earlier blog post requires some extra setup. But fortunately, most steps are documented somewhere and can be easily found. Here is my writeup for my own benefit...

Incorporate Git and IBM Cloud information into BASH command prompt

Many of you know that I love to use the command line. Because my day to day work includes interfacing IBM Cloud and GitHub, I have changed the BASH configuration to include related information into the command prompt. Here is what I did and how it looks like.

Bluemix: Where Python and Watson are in a Dialog

Right now I am working on a side project to hook up the Watson Dialog Service on Bluemix with dashDB and DB2. The idea is to dynamically feed data from DB2 into a conversation bot. To register and manage dialogs with the Watson Dialog Service, there is a web-based dialog tool available. But there is also a dialog API and a Python SDK for the Watson services available. So why not manage the dialogs from the command line...?

Converse with Watson from the Command Line

Here is a small overview of my Python client that helps to register, update, delete and list dialogs and that can even drive a dialog (converse with Watson) from the shell window on your machine. The code and for now some short documentation is available on GitHub as watson-dialog-client.

In order to use the tool, you need to have the Watson Dialog Service provisioned on IBM Bluemix. The service credentials need to be stored in a file config.json in the same directory as the tool "henriksDialog". The credentials look like shown here:

{
    "credentials": {
        "url": "https://gateway.watsonplatform.net/dialog/api",
        "password": "yourServicePassword",
        "username": "yourUserIDwhichIsALongString"
    }
}

The credentials are read by the tool to "chat" with the dialog service. The following commands are available:

• register a dialog by providing a new dialog name and the XML definition file
  "henriksDialog -r -dn dialogName -f definitionFile"
• update a dialog by identifying it by its ID and providing a definition file
  "henriksDialog -u -id dialogID -f definitionFile"
• delete a dialog identified by its ID
  "henriksDialog -d -id dialogID"
• list all registered dialogs
  "henriksDialog -l"
• converse, i.e., test out a registered dialog which is identified by its ID
  "henriksDialog -c -id dialogID"

Sample invocations and their output is available in the GitHub repository for this dialog tool. Let me know if something is missing or you had success chatting with Watson from the command line.

Dealing with DB2 Security and my Stupidity...

Today I wanted to test some options around encrypting DB2 backups and restoring encrypted database backups. I can report that the security features work, only my stupidity (or call it "vacation readiness") caused some delays.

In my previous blog entries I already showed you how to create an encrypted DB2 database using the new "native encryption" and how to rotate the master keys using built-in procedures. Next in my list to test was taking an encrypted database backup. It is pretty straight-forward, just call BACKUP DATABASE and add the ENCRYPT option:

[henrik@mymachine]$ db2 backup database enc1 encrypt

Backup successful. The timestamp for this backup image is : 20150504135739

Tuning your DB2 CLP environment: Customize appearance and editor

Tuning World Bodensee via Wikipedia

Over the last weekend, the annual Tuning World Bodensee was guest at the Messe Friedrichshafen (exhibition center and fair grounds). More than 100,000 people interested in car tuning traveled to Friedrichshafen. "Tuning" can be trying to get more performance out of engine or to customize the car to the personal style. With DB2, you can customize the command line processor to your personal style and preferences. Let's have a look at the available tuning options.

All the recent versions of DB2 provide three environment variables to tune the editing experience in the interactive DB2 CLP: DB2_CLP_EDITOR, DB2_HIST_SIZE, and DB2_CLPPROMPT. The first variable, DB2_CLP_EDITOR, is used to specify an external editor to be used for editing SQL statements. On my Linux system, I did the following:

export DB2_CLP_EDITOR=gedit

Now you can edit previous statements using the EDIT command. "EDIT 1" would call the editor with the first statement in the command history, "E 1" would do the same. To know which statements are available, use the HISTORY command or its short version "H". The maximum number of available commands is determined by the variable DB2_HIST_SIZE. It accepts numbers from 1 to 500.

export DB2_HIST_SIZE=100

To reduce the number of statements listed with the HISTORY commands, you can limit it: "H 10" would return the last 10 statements in history, "H R 5" would return the last five in reverse order. Instead of the option "R" you could also use the full word "REVERSE", e.g., "H REVERSE" or "HISTORY REVERSE". Editing commands is fun, but actually executing them is probably why they were edited. To execute a specific statement from the history, you can utilize RUNCMD. The short version is just "R" and a valid parameter would be the number corresponding to a "historic" statement.

Both RUNCMD and EDIT, if not invoked with a number, will pick the newest statement in history. Both also accept negative numbers with "-1" being the most recent statement.

What is left is to "decorate" the command line processor in your personal style. DB2_CLPPROMPT is used to modify the command prompt. It accepts different tokens and most characters. Here is my version which prints the current database name followed by "=> ":

export DB2_CLPPROMPT="DB: %d => "

Here is a small sample session with the bew prompt:

 DB:  => connect to hltest

   Database Connection Information

 Database server        = DB2/LINUXX8664 10.5.3
 SQL authorization ID   = HLOESER
 Local database alias   = HLTEST

DB: HLTEST => values 'Good Morning'

1         
------------
Good Morning

  1 record(s) selected.

DB: HLTEST => e -1
DB: HLTEST => values 'That''s it, good bye!'
Do you want to execute the above command ? (y/n) y

1                 
--------------------
That's it, good bye!

  1 record(s) selected.

DB: HLTEST => h r
4    h r
3    values 'That''s it, good bye!'
2    values 'Good Morning'
1    connect to hltest
DB: HLTEST =>

(DB2) Redbooks as eBooks (epub)

Do you like Redbooks, IBM's free technical publications, written by subject matter experts? Do you have an e-reader and like reading electronic books? The perfect combination of the two is to download the IBM Redbooks as electronic books in the EPUB format. It is supported on most e-readers and also can be converted to other formats.

As usual, the IBM Redbooks are free to download and free to use, but highly valuable. Here are some IBM Redbooks on DB2 which are available in the EPUB format:

• Unleashing DB2 10 for Linux, UNIX, and Windows 
• High Availability and Disaster Recovery Options for DB2 for Linux, UNIX, and Windows 
• DB2 Virtualization
• DB2 Workload Manager for Linux, UNIX, and Windows
• Oracle to DB2 Conversion Guide: Compatibility Made Easy
• MySQL to DB2 Conversion Guide
• IBM Optim Performance Manager for DB2 for Linux, UNIX, and Windows
• DB2 for z/OS Performance Topics 
• Security Functions of DB2 10 for z/OS 
• and several more by searching on the Redbooks page

How to communicate within your family (kids, significant other, DB2)...

Healthy families talk with each other. But (usually) I speak differently with my wife than with my kids. There is no manual on how to address everyone individually or how to conduct get heard by all of them. Fortunately, there is a guide for the DB2 family of products. And it has been updated recently.

When I give talks about the DB2 family I always mention that we strive to coordinate new features, learn from each other (yes, even mistakes), and try to speak the same language. Time travel queries (temporal data), row and column access control, the XML data type, binary XML, etc. are some of the more visible recent coordinated endeavors. Now the so-called SQL Reference for Cross-Platform Development has been updated to reflect new DB2 features. That page is very useful for some other reasons:

• It offers links to older versions of the SQL Reference for Cross-Platform Development.
• It has links to a lot of documentation for DB2 z/OS, DB2 for Linux, UNIX, and Windows, and for DB2 i.
• All versions combined, it has 10 years of best practices of application development.

That's all for now, I have to go prepare the dinner table. Some family discussion is about to start...

Quick answer: Yes, there is DB2 LUW on the mainframe under zLinux

One of the harder Google and Bing searches is to find out whether DB2 for Linux, UNIX, and Windows (DB2 LUW) is supported on a Linux system running on the mainframe (System z). Often only references to DB2 for z/OS or DB2 on Linux are found. Anyway, to answer a question that I got, DB2 for Linux is supported on the so-called zLinux and it might come to a surprise that you can choose between DB2 for z/OS (with a deep system integration) or DB2 for the distributed platform.

Experience: Switching the laptop from Windows to Linux

Recently I started to use a Linux-based laptop computer for work, after many years on Windows XP. Over the past years most of my private activities (on another machine) have already been on Linux, so the changes were not that big. However, there are different requirements for a private environment (emails, pictures, some games, some videos, some word processing)  than for a business environment. My new system is now running on Ubuntu 9.10, my private machine is still on an older Mandriva.

The actual move was quick and included copying over all my two data directories with all kinds of documents and the Lotus Notes databases. I also needed some selected configuration files, but overall I was up and running again after about an hour.

The first trouble I had was to (persistently!) configure a two-screen environment with my laptop on the right and the monitor on the left. The default is the monitor on the right side. Depending on the hardware in the machine there are different tools to solve that. Just using the Display Preferences works fine now (most of the time).

On Windows I was a big user of hibernation and tried to avoid rebooting the machine as long as possible (2 months or longer). Hibernation is supported on Linux/Ubuntu, too, but it takes significantly longer to revive the machine than on Windows. Overall, the felt one or two minutes more is ok since it is once a day. After logging in I most of the time run into the issue that both screens display the same. Using Control+Alt+F1 and then Control+Alt+F7 switches to the correct settings. It took me a while to figure out this workaround.

As a heavy user of MS Powerpoint and MS Word I feared the switch to Lotus Symphony and OpenOffice.org the most based on experiences with my private computer. For most documents the import filters are "ok", but sometimes macros or special formatting does not work.
The biggest shock was to try to give a presentation without a presenter mode which Powerpoint has. However, after some research I found out that there is a suitable presenter console extension which seems to be even more powerful than the one in Powerpoint.

After few weeks with the new machine and OS environment, I am mostly fine as the problems above are so far the only ones I ran into. For most software there are Linux versions or suitable replacements. My USB UMTS stick for mobile Internet works (mostly? some speed issues) fine out of the box, DB2 is available on Linux (big surprise here, right?), and Firefox and Flash (here that, A!) work as well. And for one Windows-based program I had to make use of wine.

Is it worth switching? So far I would say it is a definitive yes.