C2 03 and C2 02 WARNING for buyers

Hi all nokia fans and sufferers ... Recently it has been brought to my attention that all the phones with sliders and clamshells have a belt installed behind the display to convey the information. I have been told that the high end models of nokia have a good quality belt installed in them which will last longer but the ones which are cheaper and cost less have a average sort of belt installed in them.... And as now all the phones are becoming touch with constant sliding the belt is prone to damage and if damaged then the phone will be technically useless.... My request to nokia tech's looking over the forums please look into this matter. Thanks and give me advice whether I should think about getting a touch and touch slider or candy bar version????
Join my movement to bring a change in NOKIA for good by supporting my FORUM
http://discussions.europe.nokia.com/t5/Eseries-and-Communicators/NOKIA-MODERATORS-ONLY/td-p/1318965

Well every slider phone will certainly have a ribbon so the life is limited as compare to straight phones. so before going for procurement of any slide phone this thing should be kept in mind. But this phone (Nokia C2-03) I would suggest never buy. It has basic functions missing those are available in any budget phone less than Rs 2500/- in market. It is very very uncomfortable to use. details are in "Nokia C2-03 lacking some basic options" chapter in this site.
I think a firmware/ software update is barely required to be provided by Nokia, otherwise this phone is not at all useful.

Similar Messages

Selection-Screen - Warning for similar screens with same info

Hi Gurus!
I have a small question regarding the screens. I have a program which splitting of the UWI's. This program has a selection screen for entry of the company code , plant and date and two radiobuttons to show incomplete ones and all lists. Now the problem is that when this report is used by 3 or 4 people in the department and if they are working on the same plant say 0311, everyone has this screen opened and can make changes without the other person knowing that the other person is also doing changes . I want to make something in the repot that will give a message that this screen is already opened for this particular plant (warning message) which will make the other ppl aware that someone is already working on that plant , not only that evben if a single person has two screens of it opened with similar plant , also it should give message as that its opened for that particular plant. Is it possible please.?
So like in here in my report I should be adding in something or what?
*&                  Module CHECK_INPUT INPUT                         *
*                      Field Input Check                               *
MODULE check_input INPUT.
DATA: lv_plant TYPE t001k-bukrs.
**** Checking For Plant Input.
IF dyn_plant IS INITIAL.
    MESSAGE e000 WITH text-002.
ELSE.
    SELECT SINGLE bwkey FROM t001k INTO t001k-bwkey
                  WHERE bwkey = dyn_plant.
    IF sy-subrc NE 0.
      MESSAGE e000 WITH text-019.
    ENDIF.
ENDIF.
Thanks
Aarav

I used the enqueue and dequeue function module in my program to dis-allow two or more people to work on the same screen with similar input of plant ,and I am getting the error message too on the first screen itself that "selected plant si used by another user", but the problem is that its not allowing me to get into it even when I am the first user, I wanted actually it to happen with the second user or if I open up another screen and try inputing same plant and try entering then it should give me the message but its giving me message in the first screen itself and locking , not allowing me to get in.
Kindly suggest what should I be doing to this happen in the second or thisrd ascreen and so on , but not on the frist screen.
I put the logical lock after the plant validation happens , but for teh first user it should allowing him to go through the screen and just give warning for other uses if they enter the same plant and try entering the screen.
Thanks
Aarav

Can I use Apple TV if I have time Warner cable service? I have the Twc bundle of cable wifi and phone. Thanks for your help!

Can I use Apple TV with time Warner cable? I have the Twc bundle of cable, phone and wifi. Thanks for your help!

Cullentra wrote:
...Wishing you a happy 2014!
...and you.

When trying to clear the history (Browsing and download history, cookies, form and search history, and cache) firefox freezes and sometimes Ill get a warning for an unresponsive script.

When trying to clear the history (Browsing and download history, cookies, form and search history, and cache) firefox freezes and sometimes Ill get a warning for an unresponsive script.
Using MacOSX 10.6.8 on Macbook Pro
Using Firefox 10.0.2

Try to exclude the cookies from the clear history settings and let the cookies expire at the end of the session instead.

I'm confused about sound on my iPad 2. I know it has speakers and it makes sounds for notifications, etc. But when I play the Time Warner TV app, there is no sound. Do I need to buy speakers or headphones?

I'm confused about sound on my iPad 2. I know it has speakers and it makes sounds for notifications, etc. But when I play the Time Warner TV app, there is no sound. Do I need to buy speakers or headphones?

Here is my situation, iPad 1 Time Warner app works fine with or without headphones, ipad2 I can unplug headphones and it works but when headphones are plugged in I can barely hear it even cranked up, my husbands ipad2 works fine with both so what that tells me is that there is something physically possibly programmed differently. It really makes no sense. I might just take my ipad2 back and swap it out. It is weird all the other sound through the iPad comes through on headphones and speakers fine. You are not alone with your time Warner app sound issues.

My sound keeps scrambling and blaring without warning before I either restart or stop music/videos for a while. It's without warning and happening on different programs. Is this happening to anyone else?

My sound keeps scrambling and blaring without warning before I either restart or stop music/videos for a while. It's without warning and happening on different programs. Is this happening to anyone else?
I thought about resetting the nvram/pram, but before I do that, I wanted to check here. It might not be the issue. My startup looks fine and the sound is great up until the discrete moment when it's suddenly scrambled and nonsense.

I did try a safe boot once before, which didn't stop the occurrences. I can try it again to make sure, and see if the problem stops happening.
Never installed extra audio or plug-ins, though.
It happened just once not long after I bought the mid-2013 MBA, which I think came with 10.8.4, but I assumed the noise was because I was moving the computer around on a surface that created static, since the noise stopped after I picked it up off the surface. However, that must have just been a coincidence, because it happens more frequently now without moving or touching anything.
Trying the safe-mode boot and restart, and testing it out for day or so to see if it happens again.

When closing Firefox windows, I would like a warning before the last window closes. The about:config settings do nothing. There is a warning for multiple tabs..

When closing Firefox windows, I would like a warning before the last window closes. The about:config settings do nothing. There is a warning for multiple tabs... why not for the last window? I do not use tabs... just windows... I have a mouse button programmed for that. It is really irritating to have to restart Firefox all the time and then open the history window because no warning was issued!

This is ridiculous. I've had this problems for years now and I'm finally walking away from Firefox. I use my keyboards more than my mouse, and how many times does your finger slip and hit Command Q instead of W. How come FF can't reset something as trivial as this? So many people are having problems with this?
Feels like FF has become too big, too slow and just not cooperative anymore. What a shame, I've been using Netscape/Firefox for 13 years. This is silly.

How to close a frozen warning: I am unable to close the "charicter boarders aren't supported and were removed" warning on my pages. Untill warning is closed I can not save my document. How can I get my document saved?

I have an unsaved document open in pages but can not save it because the, "charicter boarders aren't supported and were removed" warning is open and I can not close the warning. How can i get the warning to close so I can save my document? Can I save the document without closing the warning?

Probably not, but as you will have been unable to make any changes to the document with that warning window open, you're not going to lose anything by quitting (or force quitting) without saving. You'll still have the original document you were trying to import.
I would suggest attempting to open the document in one of the open source Office applications, LibreOffice, Apache OpenOffice, or NeoOffice, each available for download from the linked sites. Once open there, remove the attributes that are causing the warning, save the file (as an MS Word document), then try opening that version in Pages.
Regards,
Barry

HT1212 my daughter has a brand new ipod touch - never used - she entered a passcode then immediately forgot it and now she has tried to enter one too many times and ipod is locked for 1 hour - she has never synced with itunes HELP

my daughter has a brand new ipod touch - latest one - she started to input a passcode then didn't finish the process then turned off ipod. she turned it back on and it is asking for a passcode - she doesn't remember what she typed. Ipod is now disabled for one hour. Can we override the disable. How do we reset passcode when we don't klnow the original. It has never been synced to Itunes. I am completely lost.

If You Are Locked Out Or Have Forgotten Your Passcode
iTunes 10 for Mac- Update and restore software on iPod, iPhone, or iPad
iPhone, iPad, iPod touch: Wrong passcode results in red disabled screen
iOS- Understanding passcodes
     If you have forgotten your Restrictions code, then follow the instructions
     below but DO NOT restore any previous backup. If you do then you will
     simply be restoring the old Restrictions code you have forgotten. This
     same warning applies if you need to restore a clean system.
A Complete Guide to Restore or Recover Your iDevice (if You Forget Your Passcode)
If you need to restore your device or ff you cannot remember the passcode, then you will need to restore your device using the computer with which you last synced it. This allows you to reset your passcode and re-sync the data from the device (or restore from a backup). If you restore on a different computer that was never synced with the device, you will be able to unlock the device for use and remove the passcode, but your data will not be present. Refer to Updating and restoring iPhone, iPad and iPod touch software.
Try restoring the iOS device if backing up and erasing all content and settings doesn't resolve the issue. Using iTunes to restore iOS devices is part of standard isolation troubleshooting. Restoring your device will delete all data and content, including songs, videos, contacts, photos, and calendar information, and will restore all settings to their factory condition.
Before restoring your iOS device, Apple recommends that you either sync with iTunes to transfer any purchases you have made, or back up new data (data acquired after your last sync). If you have movie rentals on the device, see iTunes Store movie rental usage rights in the United States before restoring.
Follow these steps to restore your device:
     1. Verify that you are using the latest version of iTunes before attempting to update.
     2. Connect your device to your computer.
     3. Select your iPhone, iPad, or iPod touch when it appears in iTunes under Devices.
     4. Select the Summary tab.
     5. Select the Restore option.
     6. When prompted to back up your settings before restoring, select the Back Up
         option (see in the image below). If you have just backed up the device, it is not
         necessary to create another.
     7. Select the Restore option when iTunes prompts you (as long as you've backed up,
         you should not have to worry about restoring your iOS device).
     8. When the restore process has completed, the device restarts and displays the Apple
         logo while starting up:
           After a restore, the iOS device displays the "Connect to iTunes" screen. For updating
          to iOS 5 or later, follow the steps in the iOS Setup Assistant. For earlier versions of
          iOS, keep your device connected until the "Connect to iTunes" screen goes away or
          you see "iPhone is activated."
     9. The final step is to restore your device from a previous backup. If you do not have a
          backup to restore, then restore as New.

Warning for code that no longer exists

I got a compiler warning so I removed that line of code,
recompiled and the warning still shows up.
I tried restarting the Flex Builder and I am still getting
the warning for the line of code that does not exist any more. Is
there a way for me to clear this?
Thanks!
Dana

Did you try the 'clean' project option. I'm not sure what
that is
really for and when one really needs to use it, but it is the
first
thing I try when weirdness happens.

LC_NUMERIC and LC_TIME bash warning when logging into TTY

I recently re-installed Arch after bouncing around a few distributions, and ever since I completed the install, I've had the following error when logging in to the TTY (only there, never noticed it anywhere else). Specifically, the error reads:
-bash: warning: setlocale: LC_NUMERIC: cannot change locale ()
-bash: warning: setlocale: LC_NUMERIC: cannot change locale ()
-bash: warning: setlocale: LC_TIME: cannot change locale ()
-bash: warning: setlocale: LC_TIME: cannot change locale ()
Output of locale:
LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=
locale -a
C
en_US.utf8
POSIX
en_US.UTF-8 is also uncommented in locale.gen, and it's been generated. I haven't gotten any locale errors in any application I use, and it only appears before the prompt after logging in to a TTY screen. I've also not set those variables to anything else in /etc/profile, /etc/bash.bashrc, .profile/.bashrc. Logging into the root user instead of my user account does not result in the errors. Also, it seems from the error that the locales are being set to "", and I can't for the life of me figure out where it's coming from. I've searched the forums for similar problems, and most of these errors included warnings about files and folders not existing, which doesn't happen here, and were resolved by re-generating the locale (I've tried it, no change). The only one that came close was an old forum thread about guarddog generating a different set of locale's using incorrect locale definitions, which resulted in the same errors. If anyone has a suggestion as to how to fix this (or a handy trick for finding all files where locales are set), I'm open to them.
.bashrc:
# .bashrc (2013, Dec 11)
[ -z "$PS1" ] && return
# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
xterm-color) color_prompt=yes;;
esac
if [ -n "$force_color_prompt" ]; then
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
# We have color support; assume it's compliant with Ecma-48
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
# a case would tend to support setf rather than setaf.)
color_prompt=yes
else
color_prompt=
fi
fi
if [ "$color_prompt" = yes ]; then
PS1="\[\e[0;37m\]⮀\[\e[0;32m\]\u\[\e[0;36m\]@\[\e[0;32m\]\h\[\e[0;37m\]:\[\e[0;33m\] \W\[\e[0;37m\]\[\e[0;37m\]\$\[\e[0m\] "
else
PS1="\[\e[43m\]\[\e[31m\]\u\[\e[0;33m\]\[\e[46m\]⮀\[\e[34m\]\h\[\e[0;36m\]\[\e[47m\]⮀\[\e[33m\]\W\[\e[0;37m\]⮀\[\e[0m\] "
fi
unset color_prompt force_color_prompt
# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.
#if [ -f ~/.bash_aliases ]; then
# . ~/.bash_aliases
#fi
# enable color support of ls and also add handy aliases
if [ "$TERM" != "dumb" ] && [ -x /usr/bin/dircolors ]; then
eval "`dircolors -b`"
alias ls='ls --color=auto'
#alias dir='ls --color=auto --format=vertical'
#alias vdir='ls --color=auto --format=long'
#alias grep='grep --color=auto'
#alias fgrep='fgrep --color=auto'
#alias egrep='egrep --color=auto'
fi
##custom aliases
alias ls="ls -la --color=always --classify"
alias lh='\ls -a --classify | grep "\."'
alias halt="sudo shutdown -P now"
PATH=$PATH:$HOME/.rvm/bin:$HOME/.gem/ruby/2.0.0/bin # Add RVM to PATH for scripting
.profile:
# ~/.profile: executed by the command interpreter for login shells.
# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.
# the default umask is set in /etc/profile
#umask 022
# if running bash
if [ -n "$BASH_VERSION" ]; then
# include .bashrc if it exists
if [ -f "$HOME/.bashrc" ]; then
. "$HOME/.bashrc"
fi
fi
# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
PATH="$HOME/bin:$PATH"
fi
PATH="$PATH:/usr/local/sbin"
PATH="$PATH:/usr/local/bin"

An update:
I've tried explicitly exporting both variables with en_US.UTF-8 in my bashrc, which has resulted in no change whatsoever. Checking the value of these variables from my running system yields an empty return (i.e. the variables aren't set). Can someone let me know if these variables are set on their system? If they are, I'll see if I can set them manually and if that resolves the issue.

System encryption using LUKS and GPG encrypted keys for arch linux

Update: As of 2012-03-28, arch changed from gnupg 1.4 to 2.x which uses pinentry for the password dialog. The "etwo" hook described here doesn't work with gnupg 2. Either use the openssl hook below or use a statically compiled version of gnupg 1.4.
Update: As of 2012-12-19, the mkinitcpio is not called during boot, unless the "install" file for the hook contains "add_runscript". This resulted in an unbootable system for me. Also, the method name was changed from install () to build ().
Update: 2013-01-13: Updated the hook files using the corrections by Deth.
Note: This guide is a bit dated now, in particular the arch installation might be different now. But essentially, the approach stays the same. Please also take a look at the posts further down, specifically the alternative hooks that use openssl.
I always wanted to set up a fully encrypted arch linux server that uses gpg encrypted keyfiles on an external usb stick and luks for root filesystem encryption. I already did it once in gentoo using this guide. For arch, I had to play alot with initcpio hooks and after one day of experimentation, I finally got it working. I wrote a little guide for myself which I'm going to share here for anyone that might be interested. There might be better or easier ways, like I said this is just how I did it. I hope it might help someone else. Constructive feedback is always welcome
Intro
Using arch linux mkinitcpio's encrypt hook, one can easily use encrypted root partitions with LUKS. It's also possible to use key files stored on an external drive, like an usb stick. However, if someone steals your usb stick, he can just copy the key and potentially access the system. I wanted to have a little extra security by additionally encrypting the key file with gpg using a symmetric cipher and a passphrase.
Since the encrypt hook doesn't support this scenario, I created a modifed hook called “etwo” (silly name I know, it was the first thing that came to my mind). It will simply look if the key file has the extension .gpg and, if yes, use gpg to decrypt it, then pipe the result into cryptsetup.
Conventions
In this short guide, I use the following disk/partition names:
/dev/sda: is the hard disk that will contain an encrypted swap (/dev/sda1), /var (/dev/sda2) and root (/dev/sda3) partition.
/dev/sdb is the usb stick that will contain the gpg encrypted luks keys, the kernel and grub. It will have one partition /dev/sdb1 formatted with ext2.
/dev/mapper/root, /dev/mapper/swap and /dev/mapper/var will be the encrypted devices.
Credits
Thanks to the authors of SECURITY_System_Encryption_DM-Crypt_with_LUKS (gentoo wiki), System Encryption with LUKS (arch wiki), mkinitcpio (arch wiki) and Early Userspace in Arch Linux (/dev/brain0 blog)!
Guide
1. Boot the arch live cd
I had to use a newer testing version, because the 2010.05 cd came with a broken gpg. You can download one here: http://releng.archlinux.org/isos/. I chose the “core“ version. Go ahead and boot the live cd, but don't start the setup yet.
2. Set keymap
Use km to set your keymap. This is important for non-qwerty keyboards to avoid suprises with passphrases...
3. Wipe your discs
ATTENTION: this will DELETE everything on /dev/sda and /dev/sdb forever! Do not blame me for any lost data!
Before encrypting the hard disc, it has to be completely wiped and overwritten with random data. I used shred for this. Others use badblocks or dd with /dev/urandom. Either way, this will take a long time, depending on the size of your disc. I also wiped my usb stick just to be sure.
shred -v /dev/sda
shred -v /dev/sdb
4. Partitioning
Fire up fdisk and create the following partitions:
/dev/sda1, type linux swap.
/dev/sda2: type linux
/dev/sda3: type linux
/dev/sdb1, type linux
Of course you can choose a different layout, this is just how I did it. Keep in mind that only the root filesystem will be decrypted by the initcpio. The rest will be decypted during normal init boot using /etc/crypttab, the keys being somewhere on the root filesystem.
5. Format and mount the usb stick
Create an ext2 filesystem on /dev/sdb1:
mkfs.ext2 /dev/sdb1
mkdir /root/usb
mount /dev/sdb1 /root/usb
cd /root/usb # this will be our working directory for now.
Do not mount anything to /mnt, because the arch installer will use that directory later to mount the encrypted root filesystem.
6. Configure the network (if not already done automatically)
ifconfig eth0 192.168.0.2 netmask 255.255.255.0
route add default gw 192.168.0.1
echo "nameserver 192.168.0.1" >> /etc/resolv.conf
(this is just an example, your mileage may vary)
7. Install gnupg
pacman -Sy
pacman -S gnupg
Verify that gnupg works by launching gpg.
8. Create the keys
Just to be sure, make sure swap is off:
cat /proc/swaps
should return no entries.
Create gpg encrypted keys (remember, we're still in our working dir /root/usb):
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > root.gpg
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > var.gpg
Choose a strong password!!
Don't do this in two steps, e.g don't do dd to a file and then gpg on that file. The key should never be stored in plain text on an unencrypted device, except if that device is wiped on system restart (ramfs)!
Note that the default cipher for gpg is cast5, I just chose to use a different one.
9. Create the encrypted devices with cryptsetup
Create encrypted swap:
cryptsetup -c aes-cbc-essiv:sha256 -s 256 -h whirlpool -d /dev/urandom create swap /dev/sda1
You should see /dev/mapper/swap now. Don't format nor turn it on for now. This will be done by the arch installer.
Important: From the Cryptsetup 1.1.2 Release notes:
Cryptsetup can accept passphrase on stdin (standard input). Handling of new line (\n) character is defined by input specification:
if keyfile is specified as "-" (using --key-file=- or by positional argument in luksFormat and luksAddKey, like cat file | cryptsetup --key-file=- <action> ), input is processed
as normal binary file and no new line is interpreted.
if there is no key file specification (with default input from stdin pipe like echo passphrase | cryptsetup <action> ) input is processed as input from terminal, reading will
stop after new line is detected.
If I understand this correctly, since the randomly generated key can contain a newline early on, piping the key into cryptsetup without specifying --key-file=- could result in a big part of the key to be ignored by cryptsetup. Example: if the random key was "foo\nandsomemorebaratheendofthekey", piping it directly into cryptsetup without --key-file=- would result in cryptsetup using only "foo" as key which would have big security implications. We should therefor ALWAYS pipe the key into cryptsetup using --key-file=- which ignores newlines.
gpg -q -d root.gpg 2>/dev/null | cryptsetup -v -–key-file=- -c aes-cbc-essiv:sha256 -s 256 -h whirlpool luksFormat /dev/sda3
gpg -q -d var.gpg 2>/dev/null | cryptsetup -v –-key-file=- -c aes-cbc-essiv:sha256 -s 256 -h whirlpool -v luksFormat /dev/sda2
Check for any errors.
10. Open the luks devices
gpg -d root.gpg 2>/dev/null | cryptsetup -v –-key-file=- luksOpen /dev/sda3 root
gpg -d var.gpg 2>/dev/null | cryptsetup -v –-key-file=- luksOpen /dev/sda2 var
If you see /dev/mapper/root and /dev/mapper/var now, everything is ok.
11. Start the installer /arch/setup
Follow steps 1 to 3.
At step 4 (Prepare hard drive(s), select “3 – Manually Configure block devices, filesystems and mountpoints. Choose /dev/sdb1 (the usb stick) as /boot, /dev/mapper/swap for swap, /dev/mapper/root for / and /dev/mapper/var for /var.
Format all drives (choose “yes” when asked “do you want to have this filesystem (re)created”) EXCEPT for /dev/sdb1, choose “no”. Choose the correct filesystem for /dev/sdb1, ext2 in my case. Use swap for /dev/mapper/swap. For the rest, I chose ext4.
Select DONE to start formatting.
At step 5 (Select packages), select grub as boot loader. Select the base group. Add mkinitcpio.
Start step 6 (Install packages).
Go to step 7 (Configure System).
By sure to set the correct KEYMAP, LOCALE and TIMEZONE in /etc/rc.conf.
Edit /etc/fstab:
/dev/mapper/root / ext4 defaults 0 1
/dev/mapper/swap swap swap defaults 0 0
/dev/mapper/var /var ext4 defaults 0 1
# /dev/sdb1 /boot ext2 defaults 0 1
Configure the rest normally. When you're done, setup will launch mkinitcpio. We'll manually launch this again later.
Go to step 8 (install boot loader).
Be sure to change the kernel line in menu.lst:
kernel /vmlinuz26 root=/dev/mapper/root cryptdevice=/dev/sda3:root cryptkey=/dev/sdb1:ext2:/root.gpg
Don't forget the :root suffix in cryptdevice!
Also, my root line was set to (hd1,0). Had to change that to
root (hd0,0)
Install grub to /dev/sdb (the usb stick).
Now, we can exit the installer.
12. Install mkinitcpio with the etwo hook.
Create /mnt/lib/initcpio/hooks/etwo:
#!/usr/bin/ash
run_hook() {
/sbin/modprobe -a -q dm-crypt >/dev/null 2>&1
if [ -e "/sys/class/misc/device-mapper" ]; then
if [ ! -e "/dev/mapper/control" ]; then
/bin/mknod "/dev/mapper/control" c $(cat /sys/class/misc/device-mapper/dev | sed 's|:| |')
fi
[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
# Get keyfile if specified
ckeyfile="/crypto_keyfile"
usegpg="n"
if [ "x${cryptkey}" != "x" ]; then
ckdev="$(echo "${cryptkey}" | cut -d: -f1)"
ckarg1="$(echo "${cryptkey}" | cut -d: -f2)"
ckarg2="$(echo "${cryptkey}" | cut -d: -f3)"
if poll_device "${ckdev}" ${rootdelay}; then
case ${ckarg1} in
*[!0-9]*)
# Use a file on the device
# ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
if [ "${ckarg2#*.}" = "gpg" ]; then
ckeyfile="${ckeyfile}.gpg"
usegpg="y"
fi
mkdir /ckey
mount -r -t ${ckarg1} ${ckdev} /ckey
dd if=/ckey/${ckarg2} of=${ckeyfile} >/dev/null 2>&1
umount /ckey
# Read raw data from the block device
# ckarg1 is numeric: ckarg1=offset, ckarg2=length
dd if=${ckdev} of=${ckeyfile} bs=1 skip=${ckarg1} count=${ckarg2} >/dev/null 2>&1
esac
fi
[ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
fi
if [ -n "${cryptdevice}" ]; then
DEPRECATED_CRYPT=0
cryptdev="$(echo "${cryptdevice}" | cut -d: -f1)"
cryptname="$(echo "${cryptdevice}" | cut -d: -f2)"
else
DEPRECATED_CRYPT=1
cryptdev="${root}"
cryptname="root"
fi
warn_deprecated() {
echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
if poll_device "${cryptdev}" ${rootdelay}; then
if /sbin/cryptsetup isLuks ${cryptdev} >/dev/null 2>&1; then
[ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
dopassphrase=1
# If keyfile exists, try to use that
if [ -f ${ckeyfile} ]; then
if [ "${usegpg}" = "y" ]; then
# gpg tty fixup
if [ -e /dev/tty ]; then mv /dev/tty /dev/tty.backup; fi
cp -a /dev/console /dev/tty
while [ ! -e /dev/mapper/${cryptname} ];
do
sleep 2
/usr/bin/gpg -d "${ckeyfile}" 2>/dev/null | cryptsetup --key-file=- luksOpen ${cryptdev} ${cryptname} ${CSQUIET}
dopassphrase=0
done
rm /dev/tty
if [ -e /dev/tty.backup ]; then mv /dev/tty.backup /dev/tty; fi
else
if eval /sbin/cryptsetup --key-file ${ckeyfile} luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; then
dopassphrase=0
else
echo "Invalid keyfile. Reverting to passphrase."
fi
fi
fi
# Ask for a passphrase
if [ ${dopassphrase} -gt 0 ]; then
echo ""
echo "A password is required to access the ${cryptname} volume:"
#loop until we get a real password
while ! eval /sbin/cryptsetup luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; do
sleep 2;
done
fi
if [ -e "/dev/mapper/${cryptname}" ]; then
if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
export root="/dev/mapper/root"
fi
else
err "Password succeeded, but ${cryptname} creation failed, aborting..."
exit 1
fi
elif [ -n "${crypto}" ]; then
[ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
msg "Non-LUKS encrypted device found..."
if [ $# -ne 5 ]; then
err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
err "Non-LUKS decryption not attempted..."
return 1
fi
exe="/sbin/cryptsetup create ${cryptname} ${cryptdev}"
tmp=$(echo "${crypto}" | cut -d: -f1)
[ -n "${tmp}" ] && exe="${exe} --hash \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f2)
[ -n "${tmp}" ] && exe="${exe} --cipher \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f3)
[ -n "${tmp}" ] && exe="${exe} --key-size \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f4)
[ -n "${tmp}" ] && exe="${exe} --offset \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f5)
[ -n "${tmp}" ] && exe="${exe} --skip \"${tmp}\""
if [ -f ${ckeyfile} ]; then
exe="${exe} --key-file ${ckeyfile}"
else
exe="${exe} --verify-passphrase"
echo ""
echo "A password is required to access the ${cryptname} volume:"
fi
eval "${exe} ${CSQUIET}"
if [ $? -ne 0 ]; then
err "Non-LUKS device decryption failed. verify format: "
err " crypto=hash:cipher:keysize:offset:skip"
exit 1
fi
if [ -e "/dev/mapper/${cryptname}" ]; then
if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
export root="/dev/mapper/root"
fi
else
err "Password succeeded, but ${cryptname} creation failed, aborting..."
exit 1
fi
else
err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
fi
fi
rm -f ${ckeyfile}
fi
Create /mnt/lib/initcpio/install/etwo:
#!/bin/bash
build() {
local mod
add_module dm-crypt
if [[ $CRYPTO_MODULES ]]; then
for mod in $CRYPTO_MODULES; do
add_module "$mod"
done
else
add_all_modules '/crypto/'
fi
add_dir "/dev/mapper"
add_binary "cryptsetup"
add_binary "dmsetup"
add_binary "/usr/bin/gpg"
add_file "/usr/lib/udev/rules.d/10-dm.rules"
add_file "/usr/lib/udev/rules.d/13-dm-disk.rules"
add_file "/usr/lib/udev/rules.d/95-dm-notify.rules"
add_file "/usr/lib/initcpio/udev/11-dm-initramfs.rules" "/usr/lib/udev/rules.d/11-dm-initramfs.rules"
add_runscript
help ()
cat<<HELPEOF
This hook allows for an encrypted root device with support for gpg encrypted key files.
To use gpg, the key file must have the extension .gpg and you have to install gpg and add /usr/bin/gpg
to your BINARIES var in /etc/mkinitcpio.conf.
HELPEOF
Edit /mnt/etc/mkinitcpio.conf (only relevant sections displayed):
MODULES=”ext2 ext4” # not sure if this is really nessecary.
BINARIES=”/usr/bin/gpg” # this could probably be done in install/etwo...
HOOKS=”base udev usbinput keymap autodetect pata scsi sata usb etwo filesystems” # (usbinput is only needed if you have an usb keyboard)
Copy the initcpio stuff over to the live cd:
cp /mnt/lib/initcpio/hooks/etwo /lib/initcpio/hooks/
cp /mnt/lib/initcpio/install/etwo /lib/initcpio/install/
cp /mnt/etc/mkinitcpio.conf /etc/
Verify your LOCALE, KEYMAP and TIMEZONE in /etc/rc.conf!
Now reinstall the initcpio:
mkinitcpio -g /mnt/boot/kernel26.img
Make sure there were no errors and that all hooks were included.
13. Decrypt the "var" key to the encrypted root
mkdir /mnt/keys
chmod 500 /mnt/keys
gpg –output /mnt/keys/var -d /mnt/boot/var.gpg
chmod 400 /mnt/keys/var
14. Setup crypttab
Edit /mnt/etc/crypttab:
swap /dev/sda1 SWAP -c aes-cbc-essiv:sha256 -s 256 -h whirlpool
var /dev/sda2 /keys/var
15. Reboot
We're done, you may reboot. Make sure you select the usb stick as the boot device in your bios and hope for the best. . If it didn't work, play with grub's settings or boot from the live cd, mount your encrypted devices and check all settings. You might also have less trouble by using uuid's instead of device names. I chose device names to keep things as simple as possible, even though it's not the optimal way to do it.
Make backups of your data and your usb stick and do not forget your password(s)! Or you can say goodbye to your data forever...
Last edited by fabriceb (2013-01-15 22:36:23)

I'm trying to run my install script that is based on https://bbs.archlinux.org/viewtopic.php?id=129885
Decrypting the gpg key after grub works, but then "Devce root already exists." appears every second.
any idea ?
#!/bin/bash
# This script is designed to be run in conjunction with a UEFI boot using Archboot intall media.
# prereqs:
# EFI "BIOS" set to boot *only* from EFI
# successful EFI boot of Archboot USB
# mount /dev/sdb1 /src
set -o nounset
#set -o errexit
# Host specific configuration
# this whole script needs to be customized, particularly disk partitions
# and configuration, but this section contains global variables that
# are used during the system configuration phase for convenience
HOSTNAME=daniel
USERNAME=user
# Globals
# We don't need to set these here but they are used repeatedly throughout
# so it makes sense to reuse them and allow an easy, one-time change if we
# need to alter values such as the install target mount point.
INSTALL_TARGET="/install"
HR="--------------------------------------------------------------------------------"
PACMAN="pacman --noconfirm --config /tmp/pacman.conf"
TARGET_PACMAN="pacman --noconfirm --config /tmp/pacman.conf -r ${INSTALL_TARGET}"
CHROOT_PACMAN="pacman --noconfirm --cachedir /var/cache/pacman/pkg --config /tmp/pacman.conf -r ${INSTALL_TARGET}"
FILE_URL="file:///packages/core-$(uname -m)/pkg"
FTP_URL='ftp://mirrors.kernel.org/archlinux/$repo/os/$arch'
HTTP_URL='http://mirrors.kernel.org/archlinux/$repo/os/$arch'
# Functions
# I've avoided using functions in this script as they aren't required and
# I think it's more of a learning tool if you see the step-by-step
# procedures even with minor duplciations along the way, but I feel that
# these functions clarify the particular steps of setting values in config
# files.
SetValue () {
# EXAMPLE: SetValue VARIABLENAME '\"Quoted Value\"' /file/path
VALUENAME="$1" NEWVALUE="$2" FILEPATH="$3"
sed -i "s+^#\?$${VALUENAME}$=.*$+\1=${NEWVALUE}+" "${FILEPATH}"
CommentOutValue () {
VALUENAME="$1" FILEPATH="$2"
sed -i "s/^$${VALUENAME}.*$$/#\1/" "${FILEPATH}"
UncommentValue () {
VALUENAME="$1" FILEPATH="$2"
sed -i "s/^#$${VALUENAME}.*$$/\1/" "${FILEPATH}"
# Initialize
# Warn the user about impending doom, set up the network on eth0, mount
# the squashfs images (Archboot does this normally, we're just filling in
# the gaps resulting from the fact that we're doing a simple scripted
# install). We also create a temporary pacman.conf that looks for packages
# locally first before sourcing them from the network. It would be better
# to do either *all* local or *all* network but we can't for two reasons.
# 1. The Archboot installation image might have an out of date kernel
# (currently the case) which results in problems when chrooting
# into the install mount point to modprobe efivars. So we use the
# package snapshot on the Archboot media to ensure our kernel is
# the same as the one we booted with.
# 2. Ideally we'd source all local then, but some critical items,
# notably grub2-efi variants, aren't yet on the Archboot media.
# Warn
timer=9
echo -e "\n\nMAC WARNING: This script is not designed for APPLE MAC installs and will potentially misconfigure boot to your existing OS X installation. STOP NOW IF YOU ARE ON A MAC.\n\n"
echo -n "GENERAL WARNING: This procedure will completely format /dev/sda. Please cancel with ctrl-c to cancel within $timer seconds..."
while [[ $timer -gt 0 ]]
do
sleep 1
let timer-=1
echo -en "$timer seconds..."
done
echo "STARTING"
# Get Network
echo -n "Waiting for network address.."
#dhclient eth0
dhcpcd -p eth0
echo -n "Network address acquired."
# Mount packages squashfs images
umount "/packages/core-$(uname -m)"
umount "/packages/core-any"
rm -rf "/packages/core-$(uname -m)"
rm -rf "/packages/core-any"
mkdir -p "/packages/core-$(uname -m)"
mkdir -p "/packages/core-any"
modprobe -q loop
modprobe -q squashfs
mount -o ro,loop -t squashfs "/src/packages/archboot_packages_$(uname -m).squashfs" "/packages/core-$(uname -m)"
mount -o ro,loop -t squashfs "/src/packages/archboot_packages_any.squashfs" "/packages/core-any"
# Create temporary pacman.conf file
cat << PACMANEOF > /tmp/pacman.conf
[options]
Architecture = auto
CacheDir = ${INSTALL_TARGET}/var/cache/pacman/pkg
CacheDir = /packages/core-$(uname -m)/pkg
CacheDir = /packages/core-any/pkg
[core]
Server = ${FILE_URL}
Server = ${FTP_URL}
Server = ${HTTP_URL}
[extra]
Server = ${FILE_URL}
Server = ${FTP_URL}
Server = ${HTTP_URL}
#Uncomment to enable pacman -Sy yaourt
[archlinuxfr]
Server = http://repo.archlinux.fr/\$arch
PACMANEOF
# Prepare pacman
[[ ! -d "${INSTALL_TARGET}/var/cache/pacman/pkg" ]] && mkdir -m 755 -p "${INSTALL_TARGET}/var/cache/pacman/pkg"
[[ ! -d "${INSTALL_TARGET}/var/lib/pacman" ]] && mkdir -m 755 -p "${INSTALL_TARGET}/var/lib/pacman"
${PACMAN} -Sy
${TARGET_PACMAN} -Sy
# Install prereqs from network (not on archboot media)
echo -e "\nInstalling prereqs...\n$HR"
#sed -i "s/^#S/S/" /etc/pacman.d/mirrorlist # Uncomment all Server lines
UncommentValue S /etc/pacman.d/mirrorlist # Uncomment all Server lines
${PACMAN} --noconfirm -Sy gptfdisk btrfs-progs-unstable libusb-compat gnupg
# Configure Host
# Here we create three partitions:
# 1. efi and /boot (one partition does double duty)
# 2. swap
# 3. our encrypted root
# Note that all of these are on a GUID partition table scheme. This proves
# to be quite clean and simple since we're not doing anything with MBR
# boot partitions and the like.
echo -e "format\n"
# shred -v /dev/sda
# disk prep
sgdisk -Z /dev/sda # zap all on disk
#sgdisk -Z /dev/mmcb1k0 # zap all on sdcard
sgdisk -a 2048 -o /dev/sda # new gpt disk 2048 alignment
#sgdisk -a 2048 -o /dev/mmcb1k0
# create partitions
sgdisk -n 1:0:+200M /dev/sda # partition 1 (UEFI BOOT), default start block, 200MB
sgdisk -n 2:0:+4G /dev/sda # partition 2 (SWAP), default start block, 200MB
sgdisk -n 3:0:0 /dev/sda # partition 3, (LUKS), default start, remaining space
#sgdisk -n 1:0:1800M /dev/mmcb1k0 # root.gpg
# set partition types
sgdisk -t 1:ef00 /dev/sda
sgdisk -t 2:8200 /dev/sda
sgdisk -t 3:8300 /dev/sda
#sgdisk -t 1:0700 /dev/mmcb1k0
# label partitions
sgdisk -c 1:"UEFI Boot" /dev/sda
sgdisk -c 2:"Swap" /dev/sda
sgdisk -c 3:"LUKS" /dev/sda
#sgdisk -c 1:"Key" /dev/mmcb1k0
echo -e "create gpg file\n"
# create gpg file
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > /root/root.gpg
echo -e "format LUKS on root\n"
# format LUKS on root
gpg -q -d /root/root.gpg 2>/dev/null | cryptsetup -v --key-file=- -c aes-xts-plain -s 512 --hash sha512 luksFormat /dev/sda3
echo -e "open LUKS on root\n"
gpg -d /root/root.gpg 2>/dev/null | cryptsetup -v --key-file=- luksOpen /dev/sda3 root
# NOTE: make sure to add dm_crypt and aes_i586 to MODULES in rc.conf
# NOTE2: actually this isn't required since we're mounting an encrypted root and grub2/initramfs handles this before we even get to rc.conf
# make filesystems
# following swap related commands not used now that we're encrypting our swap partition
#mkswap /dev/sda2
#swapon /dev/sda2
#mkfs.ext4 /dev/sda3 # this is where we'd create an unencrypted root partition, but we're using luks instead
echo -e "\nCreating Filesystems...\n$HR"
# make filesystems
mkfs.ext4 /dev/mapper/root
mkfs.vfat -F32 /dev/sda1
#mkfs.vfat -F32 /dev/mmcb1k0p1
echo -e "mount targets\n"
# mount target
#mount /dev/sda3 ${INSTALL_TARGET} # this is where we'd mount the unencrypted root partition
mount /dev/mapper/root ${INSTALL_TARGET}
# mount target
mkdir ${INSTALL_TARGET}
# mkdir ${INSTALL_TARGET}/key
# mount -t vfat /dev/mmcb1k0p1 ${INSTALL_TARGET}/key
mkdir ${INSTALL_TARGET}/boot
mount -t vfat /dev/sda1 ${INSTALL_TARGET}/boot
# Install base, necessary utilities
mkdir -p ${INSTALL_TARGET}/var/lib/pacman
${TARGET_PACMAN} -Sy
${TARGET_PACMAN} -Su base
# curl could be installed later but we want it ready for rankmirrors
${TARGET_PACMAN} -S curl
${TARGET_PACMAN} -S libusb-compat gnupg
${TARGET_PACMAN} -R grub
rm -rf ${INSTALL_TARGET}/boot/grub
${TARGET_PACMAN} -S grub2-efi-x86_64
# Configure new system
SetValue HOSTNAME ${HOSTNAME} ${INSTALL_TARGET}/etc/rc.conf
sed -i "s/^$127\.0\.0\.1.*$$/\1 ${HOSTNAME}/" ${INSTALL_TARGET}/etc/hosts
SetValue CONSOLEFONT Lat2-Terminus16 ${INSTALL_TARGET}/etc/rc.conf
#following replaced due to netcfg
#SetValue interface eth0 ${INSTALL_TARGET}/etc/rc.conf
# write fstab
# You can use UUID's or whatever you want here, of course. This is just
# the simplest approach and as long as your drives aren't changing values
# randomly it should work fine.
cat > ${INSTALL_TARGET}/etc/fstab <<FSTAB_EOF
# /etc/fstab: static file system information
# <file system> <dir> <type> <options> <dump> <pass>
tmpfs /tmp tmpfs nodev,nosuid 0 0
/dev/sda1 /boot vfat defaults 0 0
/dev/mapper/cryptswap none swap defaults 0 0
/dev/mapper/root / ext4 defaults,noatime 0 1
FSTAB_EOF
# write etwo
mkdir -p /lib/initcpio/hooks/
mkdir -p /lib/initcpio/install/
cp /src/etwo_hooks /lib/initcpio/hooks/etwo
cp /src/etwo_install /lib/initcpio/install/etwo
mkdir -p ${INSTALL_TARGET}/lib/initcpio/hooks/
mkdir -p ${INSTALL_TARGET}/lib/initcpio/install/
cp /src/etwo_hooks ${INSTALL_TARGET}/lib/initcpio/hooks/etwo
cp /src/etwo_install ${INSTALL_TARGET}/lib/initcpio/install/etwo
# write crypttab
# encrypted swap (random passphrase on boot)
echo cryptswap /dev/sda2 SWAP "-c aes-xts-plain -h whirlpool -s 512" >> ${INSTALL_TARGET}/etc/crypttab
# copy configs we want to carry over to target from install environment
mv ${INSTALL_TARGET}/etc/resolv.conf ${INSTALL_TARGET}/etc/resolv.conf.orig
cp /etc/resolv.conf ${INSTALL_TARGET}/etc/resolv.conf
mkdir -p ${INSTALL_TARGET}/tmp
cp /tmp/pacman.conf ${INSTALL_TARGET}/tmp/pacman.conf
# mount proc, sys, dev in install root
mount -t proc proc ${INSTALL_TARGET}/proc
mount -t sysfs sys ${INSTALL_TARGET}/sys
mount -o bind /dev ${INSTALL_TARGET}/dev
echo -e "umount boot\n"
# we have to remount /boot from inside the chroot
umount ${INSTALL_TARGET}/boot
# Create install_efi script (to be run *after* chroot /install)
touch ${INSTALL_TARGET}/install_efi
chmod a+x ${INSTALL_TARGET}/install_efi
cat > ${INSTALL_TARGET}/install_efi <<EFI_EOF
# functions (these could be a library, but why overcomplicate things
SetValue () { VALUENAME="\$1" NEWVALUE="\$2" FILEPATH="\$3"; sed -i "s+^#\?$\${VALUENAME}$=.*\$+\1=\${NEWVALUE}+" "\${FILEPATH}"; }
CommentOutValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^$\${VALUENAME}.*$\$/#\1/" "\${FILEPATH}"; }
UncommentValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^#$\${VALUENAME}.*$\$/\1/" "\${FILEPATH}"; }
echo -e "mount boot\n"
# remount here or grub et al gets confused
mount -t vfat /dev/sda1 /boot
# mkinitcpio
# NOTE: intel_agp drm and i915 for intel graphics
SetValue MODULES '\\"dm_mod dm_crypt aes_x86_64 ext2 ext4 vfat intel_agp drm i915\\"' /etc/mkinitcpio.conf
SetValue HOOKS '\\"base udev pata scsi sata usb usbinput keymap consolefont etwo encrypt filesystems\\"' /etc/mkinitcpio.conf
SetValue BINARIES '\\"/usr/bin/gpg\\"' /etc/mkinitcpio.conf
mkinitcpio -p linux
# kernel modules for EFI install
modprobe efivars
modprobe dm-mod
# locale-gen
UncommentValue de_AT /etc/locale.gen
locale-gen
# install and configure grub2
# did this above
#${CHROOT_PACMAN} -Sy
#${CHROOT_PACMAN} -R grub
#rm -rf /boot/grub
#${CHROOT_PACMAN} -S grub2-efi-x86_64
# you can be surprisingly sloppy with the root value you give grub2 as a kernel option and
# even omit the cryptdevice altogether, though it will wag a finger at you for using
# a deprecated syntax, so we're using the correct form here
# NOTE: take out i915.modeset=1 unless you are on intel graphics
SetValue GRUB_CMDLINE_LINUX '\\"cryptdevice=/dev/sda3:root cryptkey=/dev/sda1:vfat:/root.gpg add_efi_memmap i915.i915_enable_rc6=1 i915.i915_enable_fbc=1 i915.lvds_downclock=1 pcie_aspm=force quiet\\"' /etc/default/grub
# set output to graphical
SetValue GRUB_TERMINAL_OUTPUT gfxterm /etc/default/grub
SetValue GRUB_GFXMODE 960x600x32,auto /etc/default/grub
SetValue GRUB_GFXPAYLOAD_LINUX keep /etc/default/grub # comment out this value if text only mode
# install the actual grub2. Note that despite our --boot-directory option we will still need to move
# the grub directory to /boot/grub during grub-mkconfig operations until grub2 gets patched (see below)
grub_efi_x86_64-install --bootloader-id=grub --no-floppy --recheck
# create our EFI boot entry
# bug in the HP bios firmware (F.08)
efibootmgr --create --gpt --disk /dev/sda --part 1 --write-signature --label "ARCH LINUX" --loader "\\\\grub\\\\grub.efi"
# copy font for grub2
cp /usr/share/grub/unicode.pf2 /boot/grub
# generate config file
grub-mkconfig -o /boot/grub/grub.cfg
exit
EFI_EOF
# Install EFI using script inside chroot
chroot ${INSTALL_TARGET} /install_efi
rm ${INSTALL_TARGET}/install_efi
# Post install steps
# anything you want to do post install. run the script automatically or
# manually
touch ${INSTALL_TARGET}/post_install
chmod a+x ${INSTALL_TARGET}/post_install
cat > ${INSTALL_TARGET}/post_install <<POST_EOF
set -o errexit
set -o nounset
# functions (these could be a library, but why overcomplicate things
SetValue () { VALUENAME="\$1" NEWVALUE="\$2" FILEPATH="\$3"; sed -i "s+^#\?$\${VALUENAME}$=.*\$+\1=\${NEWVALUE}+" "\${FILEPATH}"; }
CommentOutValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^$\${VALUENAME}.*$\$/#\1/" "\${FILEPATH}"; }
UncommentValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^#$\${VALUENAME}.*$\$/\1/" "\${FILEPATH}"; }
# root password
echo -e "${HR}\\nNew root user password\\n${HR}"
passwd
# add user
echo -e "${HR}\\nNew non-root user password (username:${USERNAME})\\n${HR}"
groupadd sudo
useradd -m -g users -G audio,lp,optical,storage,video,games,power,scanner,network,sudo,wheel -s /bin/bash ${USERNAME}
passwd ${USERNAME}
# mirror ranking
echo -e "${HR}\\nRanking Mirrors (this will take a while)\\n${HR}"
cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.orig
mv /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.all
sed -i "s/#S/S/" /etc/pacman.d/mirrorlist.all
rankmirrors -n 5 /etc/pacman.d/mirrorlist.all > /etc/pacman.d/mirrorlist
# temporary fix for locale.sh update conflict
mv /etc/profile.d/locale.sh /etc/profile.d/locale.sh.preupdate || true
# yaourt repo (add to target pacman, not tmp pacman.conf, for ongoing use)
echo -e "\\n[archlinuxfr]\\nServer = http://repo.archlinux.fr/\\\$arch" >> /etc/pacman.conf
echo -e "\\n[haskell]\\nServer = http://www.kiwilight.com/\\\$repo/\\\$arch" >> /etc/pacman.conf
# additional groups and utilities
pacman --noconfirm -Syu
pacman --noconfirm -S base-devel
pacman --noconfirm -S yaourt
# sudo
pacman --noconfirm -S sudo
cp /etc/sudoers /tmp/sudoers.edit
sed -i "s/#\s*$%wheel\s*ALL=(ALL)\s*ALL.*$$/\1/" /tmp/sudoers.edit
sed -i "s/#\s*$%sudo\s*ALL=(ALL)\s*ALL.*$$/\1/" /tmp/sudoers.edit
visudo -qcsf /tmp/sudoers.edit && cat /tmp/sudoers.edit > /etc/sudoers
# power
pacman --noconfirm -S acpi acpid acpitool cpufrequtils
yaourt --noconfirm -S powertop2
sed -i "/^DAEMONS/ s/)/ @acpid)/" /etc/rc.conf
sed -i "/^MODULES/ s/)/ acpi-cpufreq cpufreq_ondemand cpufreq_powersave coretemp)/" /etc/rc.conf
# following requires my acpi handler script
echo "/etc/acpi/handler.sh boot" > /etc/rc.local
# time
pacman --noconfirm -S ntp
sed -i "/^DAEMONS/ s/hwclock /!hwclock @ntpd /" /etc/rc.conf
# wireless (wpa supplicant should already be installed)
pacman --noconfirm -S iw wpa_supplicant rfkill
pacman --noconfirm -S netcfg wpa_actiond ifplugd
mv /etc/wpa_supplicant.conf /etc/wpa_supplicant.conf.orig
echo -e "ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=network\nupdate_config=1" > /etc/wpa_supplicant.conf
# make sure to copy /etc/network.d/examples/wireless-wpa-config to /etc/network.d/home and edit
sed -i "/^DAEMONS/ s/)/ @net-auto-wireless @net-auto-wired)/" /etc/rc.conf
sed -i "/^DAEMONS/ s/ network / /" /etc/rc.conf
echo -e "\nWIRELESS_INTERFACE=wlan0" >> /etc/rc.conf
echo -e "WIRED_INTERFACE=eth0" >> /etc/rc.conf
echo "options iwlagn led_mode=2" > /etc/modprobe.d/iwlagn.conf
# sound
pacman --noconfirm -S alsa-utils alsa-plugins
sed -i "/^DAEMONS/ s/)/ @alsa)/" /etc/rc.conf
mv /etc/asound.conf /etc/asound.conf.orig || true
#if alsamixer isn't working, try alsamixer -Dhw and speaker-test -Dhw -c 2
# video
pacman --noconfirm -S base-devel mesa mesa-demos
# x
#pacman --noconfirm -S xorg xorg-xinit xorg-utils xorg-server-utils xdotool xorg-xlsfonts
#yaourt --noconfirm -S xf86-input-wacom-git # NOT NEEDED? input-wacom-git
#TODO: cut down the install size
#pacman --noconfirm -S xorg-server xorg-xinit xorg-utils xorg-server-utils
# TODO: wacom
# environment/wm/etc.
#pacman --noconfirm -S xfce4 compiz ccsm
#pacman --noconfirm -S xcompmgr
#yaourt --noconfirm -S physlock unclutter
#pacman --noconfirm -S rxvt-unicode urxvt-url-select hsetroot
#pacman --noconfirm -S gtk2 #gtk3 # for taffybar?
#pacman --noconfirm -S ghc
# note: try installing alex and happy from cabal instead
#pacman --noconfirm -S haskell-platform haskell-hscolour
#yaourt --noconfirm -S xmonad-darcs xmonad-contrib-darcs xcompmgr
#yaourt --noconfirm -S xmobar-git
# TODO: edit xfce to use compiz
# TODO: xmonad, but deal with video tearing
# TODO: xmonad-darcs fails to install from AUR. haskell dependency hell.
# switching to cabal
# fonts
pacman --noconfirm -S terminus-font
yaourt --noconfirm -S webcore-fonts
yaourt --noconfirm -S fontforge libspiro
yaourt --noconfirm -S freetype2-git-infinality
# TODO: sed infinality and change to OSX or OSX2 mode
# and create the sym link from /etc/fonts/conf.avail to conf.d
# misc apps
#pacman --noconfirm -S htop openssh keychain bash-completion git vim
#pacman --noconfirm -S chromium flashplugin
#pacman --noconfirm -S scrot mypaint bc
#yaourt --noconfirm -S task-git stellarium googlecl
# TODO: argyll
POST_EOF
# Post install in chroot
#echo "chroot and run /post_install"
chroot /install /post_install
rm /install/post_install
# copy grub.efi file to the default HP EFI boot manager path
mkdir -p ${INSTALL_TARGET}/boot/EFI/Microsoft/BOOT/
mkdir -p ${INSTALL_TARGET}/boot/EFI/BOOT/
cp ${INSTALL_TARGET}/boot/grub/grub.efi ${INSTALL_TARGET}/boot/EFI/Microsoft/BOOT/bootmgfw.efi
cp ${INSTALL_TARGET}/boot/grub/grub.efi ${INSTALL_TARGET}/boot/EFI/BOOT/BOOTX64.EFI
cp /root/root.gpg ${INSTALL_TARGET}/boot/
# NOTES/TODO

Locked out of Apple ID AND lost Recovery Key for two-step verification

Hey guys,
Firstly, as the title implies, this is a double-whammy of a problem, and obviously, it is very much my fault. The reason I'm bothering to post this, however, is to find out if anyone else has had this issue and where they are at with it.
The story:
I set up two-step verification on my Apple ID about a year ago as I thought it was a good idea. I wrote the Recovery Key down as it told you to, and put it in a folder full of other important documents. In a epic mental lapse, however, I now remember later throwing out that folder, forgetting about my Recovery Key. Ya, that is my fault, I'm and idiot. Anyways...
Fast forward to a few days ago, and I all of a sudden received messages on all my devices saying that my Apple ID had been disabled for security reasons, and that I had to reset the account in order to regain access to it. Scary, but no problem, right? Well, after entering my Apple ID into iForgot.com, the first thing it asked me for was my Recovery Key. This is around the time I was banging my head against the wall in realization that I had thrown it away, but I was relieved to see the "Lost your Recovery Key?" option at the bottom of the screen. I was even more relieved to discover that I had what I needed to reset it: my current password and a trusted Apple device. The catch was that to reset it, I needed to log into my Apple ID to initiate it, which of course I couldn't do because it had been disabled, and the only way for me to disable it is, again, to enter in my Recovery Key. This effectively put me in and endless loop, without any apparent way of gaining accesses to my account. I did contact Apple about it, and I was ultimately told that the lock on my account was so tight, that not even Apple could gain access to it.
I understand that this level of security is probably the whole reason for the two-step verification in the first place, and I again concede that it was extremely foolish of me for forgetting about and discarding my Recovery Key, but a few things still don't make sense...
1. Why would they put a "Lost your Recovery Key?" link on the password recovery page when a password is needed to reset the Recovery Key itself?
2. As far as I can remember, Apple, in their briefing of how two-step verification works, did not bring up this scenario, which is probably relatively common. They DO mention that they can't help when you don't have access to two of the three necessary things for recovery, but they never brought up the apparent exception of if the account is disabled, in which case having two of the three things needed is not enough. I don't understand how they couldn't have mentioned this scenario.
3. Given the above thought, how could Apple not have some sort of special contingency for this type of situation? I profess my ignorance of how these types of systems are set up, but I would feel that there should be a special method for recovery in place if the account has been locked, and the owner is able to verify that they have the password and trusted devices.
I didn't mean to make it sound like a rant. I ADORE Apple, but this system seems like it's less than perfect.
Has anyone else ran into this issue? If so, is your situation similar to mine?
Thanks for any response!

Hey everyone.
It's been awhile, but I wanted to share with anyone who is interested some general knowledge about this issue that I have learned while communicating with Apple support. Unsurprisingly, the issue is still unresolved, and I am under the impression that it will remain that way, but I'm still trying to get in touch with one of the senior representatives I spoke with a while ago who seemed to think that there might be a solution, so I suppose there is still a chance that things could turn out for the better.
Here's the rundown:
Anytime you are unable to sign in to or access your account because of "security reasons", your account is under what is called a "DS Lockout".
A DS Lockout on an Apple ID can be triggered for a few reasons, such as when too many failed logins to the Apple ID (using an incorrect password) are attempted, or when a purchase is made that Apple believes to be fraudulent.
Under normal circumstances, a DS Lockout only lasts for 8 hours, after which the lock is lifted and access to the account by inputting the correct password is re-enabled.
This is where the catch for anybody who set up two-step verification is.
According to one of Apple's security representatives, IF you have two-step verification enabled upon being inflicted with a DS Lockout, the 8-hour lockout period is extended indefinitely as an additional security measure (a feature, I suppose). Therefore, the only way to regain access to the account is by resetting the password, as waiting for the lockout to expire is no longer an option. And of course, resetting your password, as stated by Apple, is one of the situations in which you need your Recovery Key. EVEN IF YOU KNOW WHAT THE ACCOUNT'S CURRENT PASSWORD IS, the lockout prevents you from being able to input it as a means of authentication. You MUST reset your password in order to regain access, and you MUST input your recovery key in order to reset your password.
So, that seems to be the gist of it. It does make sense, but here's my problem:
Upon setting up two-step verification, Apple does warn you of many things, but they do not make any mention of this specific scenario. Indeed, it is very much my fault for loosing my verification key, but the thing is, I’m human, I make mistakes, and I know that I will continue to do so. One of the reasons I chose to take the risk of setting up two-step verification is because Apple explicitly stated that as long as I had access to two of the three required "keys" -- my Recovery Key, my password, and at least one of my trusted Apple devices -- I would always be able to gain access to my account. In other words, as long as I didn’t screw up so bad as to loose access to two of my keys, I’d be okay. Obviously, there is a huge exception to this case that, again, is not mentioned anywhere, hence all the confusion. Had I know that it was possible that it could come down to me needing a single, specific key to regain access to my account, I probably would have opted out of two-step verification, recognizing that as a busy college student who's constantly reorganizing and dealing with tons of forms, worksheets, and other various documents, it's not as easy to hold on to a slip of paper as it might be for others. I'm hoping that at some point, Apple adds a big, red warning to the setup process which reads something like:
"In the event that your Apple ID is locked due to a detected security risk, your Recovery key will be necessary to regaining access to your account; knowing your password and/or having access to any of your trusted devices will no longer be enough."
I really do appreciate how seriously Apple takes its security, but I think that there is still room for improvement. This should start with more clearly and fully stating the conditions of its security measures, as well as having its customer support be more educated on these conditions (they themselves stated that they had never been trained on issues revolving around two-step verification). Protecting someone's private information is important, but so too is making every possible effort to ensure that customers can't easily loose access to all the content and services that they have spent much time and money building up and using.
As stated above, I'm still trying to get a hold of the Apple representative who initially assisted me, so if I have any additional updates, I'll be sure to reply to this thread. I hope that anyone who is going through the same issue, or is simply curious, finds this information to be useful.

How to scan my computer and external hard drives for pictures with out importing duplicates.

how do i scan my computer and external hard drives for pictures with out importing duplicates.

iPhoto doesn't scan anywhere. It imports files offered to it. If it spots a duplicate it will warn you.

ScriptSuite warning for result type of command

I have posted on another Tiger Forum & finally received a response after my second post there, had some directions about running Applejack and nothing since. So I am looking for someone to tell me what this means, and what I need to do to fix it. Please trust that I have spent more than 2 weeks searching, researching, and I am at a loss.
console.log:
Description: User events log
Size: 726 bytes
Last Modified: 9/26/07 9:21 PM
Location: /Library/Logs/Console/502/console.log
Recent Contents: Mac OS X Version 10.4.10 (Build 8R4061a)
2007-09-26 20:47:03 -0600
2007-09-26 20:51:19.120 Translator[274] Invoked to sync conduit com.apple.Safari for entityNames: com.apple.bookmarks.Folder,com.apple.bookmarks.Bookmark
Waiting for MirrorAgent to launch and respond to CFMessagePortCreateRemote(). [220]
2007-09-26 21:20:51.610 RealPlayer[294] .scriptSuite warning for result type of command 'GetPreference' in suite 'RealOnePlayer': the type NSString ('utxt') doesn't match the result Apple event code ('obj ').
2007-09-26 21:20:51.610 RealPlayer[294] .scriptSuite warning for result type of command 'GetStatistic' in suite 'RealOnePlayer': the type NSString ('utxt') doesn't match the result Apple event code ('obj ').
Thank you in advance,
Marge

this was not helpful-there is enough information on MirrorAgent through "Search" to keep me probing for a week, and then not clear what applies. I will close this out and look somewhere else.

C2 03 and C2 02 WARNING for buyers

Similar Messages

Maybe you are looking for