Quantum Spark 1570: dynamic object in the translated source column cannot be resolved. for more details see sk166457

Network, , , ,

When operating CheckPoint’s Quantum Spark 1570 and similar appliances, it is a common practice to port-forward services that should be exposed to the internet. One could create a “server”, lets say for WireGuard VPN on port 51820 and forward this specific port to one specific machine on the local network.

The Quantum Spark appliance will do the rest, like adding a firewall rule to actually allow the traffic. Et voila, you can connect to your WireGuard VPN.

However when using the dynamic NAT feature, which is the default, at some point your service, in my case WireGuard, could be blocked again. Specifically after restarting the appliance when using IPv4+IPv6.

Why is that? Dynamic NAT rules on the 1570 use Dynamic Objects (objects that reference the current IP of an interface). After reboot, especially with IPv6 auto-configuration (SLAAC/DHCPv6), the interface’s IPv6 address or prefix changed. NAT rules referencing the old dynamic object no longer match the new interface address. The firewall throws the SK166457 error.

Solution? Use a non-changing IPv6 network or set the NAT to static. Likely the NAT will be IPv4 only, so it is perfectly fine to statically bind to a single, external IPv4.

So far I had a mixed experience with CheckPoint and Quantum Spark devices. Sometimes things are overcomplicated. But the worst part: Pretty much all of CheckPoints Knowledge Base (also the sk166457 article) is behind a login wall. That would not pose a problem, but even after creating a private account, the information stays hidden to authorized personnel with some kind of special permission. Solutions therefore must be found manually. Thats bad…

GLKVM: Enter AMI-BIOS setup of connected device

Linux, , , , , ,

I recently got to use a GLKVM device to remote control a SFF computer that runs as a server. It features a normal mainboard with an AMI-BIOS. The default of the splash screen of the AMI-BIOS was 1 second.

After trying a couple times to enter the BIOS for WOL and other settings, I failed trying Esc, F1, F2, Del, F10, F11. None of them worked. Supposedly because the time to input was so short and the delay of the remote console just made finding the right moment even more difficult.

The solution I had not heard of before: Keep the right button pressed throughout the whole boot process until you entered the BIOS setup.

And that worked. I kept pressing F2 throughout the whole boot process and suddenly entered the BIOS setup successfully. Afterwards I changed the splash screen timeout from 1 to 5 and retried with a normal button press while the AMI BIOS splash screen kept waiting: Success. A normal short button press worked now due to the updated timeout.

clevis luks bind “Unable to fetch advertisement”

Linux, , , ,

Recently looking into automating LUKS encryption processes, I stumbled upon the the following problem: clevis luks bind returns “Unable to fetch advertisement”.

The error message tells all and nothing. I found that with clevis’ tooling chain, it can be difficult to pinpoint problems easily. After some time I figured that the shell I ran this on had http_proxy environment variables set and therefore the curl-command used in the clevis tooling chain was fetching via the configured http proxy, which denied the connection with a 403 Forbidden error.

It was so unclear because clevis did not output any such error (inside the tooling chain it runs “curl -sfg” which silences all output).

Therefore make sure that the requests can succeed. Make sure that the environment the “clevus luks bind” command runs from does not have any unintended environment variables set, such as http_proxy or https_proxy.

Run “clevis luks bind” as late-command in subiquity/autoinstall

Linux, , ,

There are different approaches and methods for implementing file system encryption on Linux servers, sometimes depending on the file system itself. LUKS is independent of the file system, forming a layer on the block device but under the file system.

Manual encryption is the standard, where the initramfs launches a small program for passphrase entry. To automate the whole thing, you can utilize your machine’s TPM 2.0 module.

Within production environments it may be feasible to combine TPM 2.0 with Clevis/Tang as fallback, where, when the TPM 2.0 gets reset due to a firmware-upgrade or user fault, there is a still automated fallback. If that one fails, there will always be the manual passphrase entry, but only as a absolute last resort.

Within production environments it is also common to deploy nodes automatically. One could rely for example on the Subiquity installer with autoinstall. For this several files are required, including a user-data file which contains most of the required instructions and data for an automated install. To incorporate the automated LUKS unlock with TPM 2.0 and Clevis/Tang, a couple of commands must be run in the installation process. autoinstall is extremely picky when it comes to escaping, hence this post with a working solution:

  late-commands:
    - apt-get -y install clevis clevis-tpm2 clevis-luks clevis-udisks2 clevis-systemd clevis-initramfs
    - printf "supersecret" | clevis luks bind -y -k - -d /dev/sda3 sss '{"t":1,"pins":{"tpm2":{},"tang":{"url":"http://tang01.local"}}}'

These two late commands are formatted and tested in the autoinstall of Ubuntu 24.04.

ThinkBook G13/G13s G4 IAP and similar microphones not working recently

Nicht kategorisiert

I just experienced a strange behaviour with the named ThinkBook’s, that affects G13 G4 books and similar devices. After an upgrade of “Elevoc AudioProcessingObject” to (in my case) 4.0.5.199 via Windows Update, the microphone just stopped working.

After finding a thread on reddit about this, I installed the latest 5.0.5.238, which also did not work. Scrolling through the thread revealed that a user had this exact problem even with the latest 5.0.5.238 version. Installing 5.0.5.234 manually via device manager fixed the problem immediately, even without a restart.

https://catalog.update.microsoft.com/Search.aspx?q=Elevoc

Shows the available packages as .cab. They can be extracted manually and then installed via the device manager. Downgrade works by uninstalling or downgrading to a previous version, then rolling forward as much as needed.

Problems with Ubuntu 24.04 in VirtualBox 7.0.20 VM on a Windows 10 host

Linux,

I recently had the bright idea to upgrade to Ubuntu 24.04 inside my Ubuntu VM that is running with VirtualBox 7.0.20 on Windows 10.

As you propably guessed: Its a catastrophy.

Not only is there problems with the vmwgfx driver that comes with newer kernels but also Xorg fallback mode is not working anymore. There was regular stack traces at boot that could be to some part fixed by enabling hpet mode.

It also shows regular boot delays or fully gets stuck related to systemd-resolved, oomd or timesyncd.

At this point I would like to show you possibilities to prevent these problems, but I got no advice more than the things mentioned above and disabling 3D acceleration in the settings + using the VMSVGA graphics mode.

I have also tried the VirtualBox 7.1 Beta 1, with no improvements.