Setting up firewall rules for a LG TV

 

I have an LG TV that, by my own choice, does not have Internet access.

It is not disconnected from my network. It is connected to the LAN, uses my DNS server, and can communicate with whatever I decide to allow. I simply have a firewall rule preventing it from accessing the Internet.

My home infrastructure uses shadowcat4 as the router/firewall, a fanless mini PC with an Intel N95 and four Intel I226-V 2.5 Gb Ethernet interfaces. It runs Slackware-current and replaced my old shadowcat3 router.

The Internet connection comes through FTTH with the ONT in bridge mode. Shadowcat4 establishes the PPPoE connection directly and also runs nftables, OpenVPN, dnsmasq, dnscrypt-proxy, and a few other things.

The LAN is 192.168.111.0/24, shadowcat4 is 192.168.111.14, and the LG TV is 192.168.111.191.

The problem appeared because of a rather silly characteristic of the TV: if it completely loses electrical power, it loses its date and time. When power comes back, it may boot believing that it is sometime in 2022.

That by itself would not be a major problem, except that I use the TV's automatic power-on feature. I want it to turn itself on at 06:00, and obviously it needs to know what time it is for that to work.

With Internet access enabled, it recovered the correct time automatically. With Internet access blocked, it did not.

So the question became quite specific:

What is the absolute minimum Internet access the TV needs solely to recover its date and time?

First suspect: NTP

The first thing I thought of, and the first thing I discussed with ChatGPT during the troubleshooting process, was the obvious candidate: NTP.

If a device needs to know the time, one would expect UDP traffic to port 123.

Shadowcat4 already uses NTP and, in fact, during the tests another interesting problem showed up: NTP queries leaving through my PPPoE connection were receiving replies very inconsistently. We captured traffic on ppp0, verified the outgoing queries, and compared the results with another machine using a different ISP.

From that other connection, the same NTP servers responded quickly and consistently.

Everything pointed toward some behavior involving the ISP or the network path used by shadowcat4.

Interesting, but ultimately a false lead for the TV problem.

Capturing the LG's traffic after a cold boot revealed something much more important:

the TV was not attempting to use UDP/123 at all.

No NTP.

Instead, it was repeatedly trying to establish TCP connections to port 443.

Opening HTTPS as a test

The firewall uses nftables with a DROP policy. The LG was given a specific rule before the general LAN access rules:

ip saddr 192.168.111.191 oifname "ppp*" drop

As a test, we temporarily inserted an exception before that DROP rule allowing the TV to connect to any destination over TCP/443.

Then I performed a real cold boot: unplugged the TV from power, waited, and plugged it back in.

It started without the correct time.

With HTTPS allowed, it recovered the correct date and time.

That completely changed the direction of the investigation. We were no longer looking for an NTP server. Some LG service accessible over HTTPS was involved in recovering the time.

Using DNS as a guide

The TV uses dnsmasq on shadowcat4 as its DNS server, so I started logging its queries.

Several domains appeared:

lgtvonline.lge.com
BR7.nextlgsdp.com
AIC.tv.wiselg.com
aic-gfts.nextlgsdp.com
qt2-kic.lgtviot.com
aic.lgtviot.com
BR7.info.lgsmartad.com

The last one was particularly amusing because my HaGeZi blocklist causes:

BR7.info.lgsmartad.com

to return NXDOMAIN.

The TV recovered its time perfectly anyway.

So advertising was out of the picture.

The domain that started looking particularly interesting was:

BR7.nextlgsdp.com

dnsmasq was returning a set of addresses such as:

54.200.71.5
54.186.200.227
32.189.217.166
16.146.234.1
32.188.96.203
52.41.138.142
52.35.116.50
16.147.145.11

The set is not permanent: the addresses rotate and change over time.

Capturing the exact moment

For most of the testing I used tcpdump.

I recorded a complete capture:

tcpdump -ni eth0 -s0 -w /tmp/tv-br7.pcap host 192.168.111.191

Before opening the firewall, there was a succession of SYN packets from the TV toward HTTPS servers, but no replies because nftables was dropping them.

After enabling the exception, the first SYN/ACK appeared:

13:47:57.785790
52.35.116.50:443 -> 192.168.111.191
Flags [S.]

A few seconds later, connections started appearing from:

52.41.138.142:443

Both addresses were part of the set DNS had just returned for BR7.nextlgsdp.com.

The correlation was very strong, but it was still a correlation.

I wanted to prove that those HTTPS connections were actually intended for that hostname.

Enter tshark

Until this point, I did not have tshark installed on shadowcat4.

I installed Wireshark 4.6.8 using the SlackBuild available from SlackBuilds.org. I did not really need the Wireshark graphical interface; I only wanted tshark to analyze the pcap file I had already generated with tcpdump.

The useful part is that, although HTTPS encrypts the application data, the TLS ClientHello can contain the SNI identifying the server name the client wants to reach.

I ran:

tshark -r /tmp/tv-br7.pcap \
  -Y 'ip.src==192.168.111.191 && tls.handshake.extensions_server_name' \
  -T fields \
  -e frame.time \
  -e ip.dst \
  -e tls.handshake.extensions_server_name

And there it was:

2026-09-16T13:47:57.800548000-0300  52.35.116.50   br7.nextlgsdp.com
2026-09-16T13:48:02.134213000-0300  52.41.138.142  br7.nextlgsdp.com
2026-09-16T13:48:05.790571000-0300  52.41.138.142  br7.nextlgsdp.com
...

Case closed.

We no longer merely knew that those IP addresses had been returned by DNS for BR7.nextlgsdp.com: we now had the TV's own TLS ClientHello declaring through SNI that it wanted to talk to:

br7.nextlgsdp.com

The definitive test

We then performed the test that actually mattered.

The firewall was configured to block all Internet access from the TV except TCP/443 toward the eight addresses that BR7.nextlgsdp.com resolved to at that moment.

Then I performed another real cold boot by physically removing power from the TV.

The LG recovered the correct date and time.

During that test it had no access to the other services it had queried through DNS. It also could not access the advertising service blocked by HaGeZi.

So, for my practical purposes, the result was demonstrated:

the TV can remain without general Internet access and only needs HTTPS access to BR7.nextlgsdp.com to recover its date and time.

I am not claiming that TLS itself is being used as a time synchronization protocol. TLS does not normally provide system time that way. Some response or part of the LG service available over HTTPS is apparently what allows the TV to obtain the information it needs.

For my firewall, that distinction does not matter. I now know which traffic needs to be allowed.

The resulting nftables configuration

The important part of the forward chain now conceptually looks like this:

TV -> current BR7.nextlgsdp.com IPs:443   ACCEPT
TV -> Internet                            DROP
established,related                       ACCEPT
LAN -> Internet                           ACCEPT

In /etc/nftables.conf I have:

ip saddr 192.168.111.191 \
ip daddr { 54.200.71.5, 54.186.200.227, 32.189.217.166, 16.146.234.1, \
           32.188.96.203, 52.41.138.142, 52.35.116.50, 16.147.145.11 } \
oifname "ppp*" tcp dport 443 accept

ip saddr 192.168.111.191 oifname "ppp*" drop

The ordering is deliberate.

The exception must come before the TV's DROP rule, and both must come before established,related and the general LAN-to-PPPoE rule.

That way, even an already-established connection from the TV cannot bypass its specific policy.

The dynamic IP problem

Naturally, one final detail remained: those eight addresses are not permanent.

My dnsmasq is version 2.93, as packaged by Slackware-current:

Dnsmasq version 2.93

Interestingly, it recognizes the --nftset option, but the official binary was compiled with:

ipset no-nftset

I could rebuild dnsmasq with nftset support and create an elegant integration between DNS and a named nftables set.

But by this point I was thinking something along the lines of: one more spot isn't going to matter to the tiger.

Updating eight IP addresses once a day does not need to become an engineering project.

So, with ChatGPT's help, I created:

/root/bin/update-lg-tv.sh

The script:

1. queries the current A records for BR7.nextlgsdp.com using dig;

2. extracts the IP addresses currently allowed for 192.168.111.191:443 from nftables;

3. sorts both sets so DNS response ordering does not matter;

4. exits without doing anything if they match;

5. if they differ, updates the corresponding rule in /etc/nftables.conf;

6. validates the new configuration with nft -c;

7. saves a backup;

8. loads the new ruleset;

9. records what happened using logger.

There is also one important safety precaution: if dig returns no IPv4 addresses, the script changes nothing. A temporary DNS failure cannot cause a perfectly good whitelist to be replaced by an empty one.

Its first execution was exactly as boring as an administration script should be:

# /root/bin/update-lg-tv.sh
# echo $?
0

The DNS addresses matched the firewall addresses, so it did nothing.

The script can now simply be run once a day from cron. I do not need to chase DNS changes in real time: the only purpose of this exception is to let the TV recover its clock after completely losing electrical power.

As for organization, I prefer administration scripts to remain readable. If this logic grows, instead of accumulating embedded awk, sed, and subsidiary logic inside one large shell script, I will split it into small scripts under a directory such as:

/root/bin/lg-tv/
    update.sh
    get-dns-ips.sh
    get-nft-ips.sh
    update-nft-conf.sh

Not because Bash cannot do everything in one file, but because six months from now I want to be able to look at a script and immediately understand what it does.

What I liked about this experiment

The most interesting part of the whole exercise was the method.

We started with a perfectly reasonable hypothesis:

the TV needs NTP.

The evidence said otherwise.

Then we saw HTTPS.

We allowed only port 443 and verified that the TV recovered its clock.

We logged DNS queries to identify candidate services.

We reduced firewall access exclusively to the addresses belonging to one domain.

We repeated the cold boot.

It worked.

Finally, we used tshark on the packet capture to extract the TLS SNI and confirm that the connections actually getting through the firewall were going to br7.nextlgsdp.com.

The interaction with ChatGPT was particularly useful during this process, not because it could tell me in advance that "LG gets its time from this particular server," but precisely because it could not. We built hypotheses, designed tests to eliminate them, and looked at actual evidence coming from my own network.

Some paths led nowhere — the initial NTP investigation being the obvious example — but they were still useful because they eliminated possible explanations.

In the end, there was no need to trust LG documentation, Internet blocklists, or assumptions about what a Smart TV should be doing.

We watched its packets and proved what it was actually doing.

And shadowcat4 continues doing exactly what I wanted from the beginning:

the TV is connected to my network, but that does not mean it has permission to freely talk to the Internet.

slackware local mirror copy

a work in progress ...

to make sure it is working, first do a full slackpkg update. 

create /data/mirror

then run this script, adapt to your needs:

MIRROR_HOST="ftp.slackware-brasil.com.br"
MIRROR_DIR="/data/mirror"
BWLIMIT=0
RSYNC_OPTS="-avPH --bwlimit=$BWLIMIT --delete --delete-excluded --progress "

rsync $RSYNC_OPTS \
--exclude source \
$MIRROR_HOST::slackware/slackware64-current/ $MIRROR_DIR/slackware64-current
echo "Done!" 

create a vhost inside /etc/httpd/extra/http-vhosts.conf
run/restart httpd
update mirrors in /etc/slackpkg to point to the new virtual web host
run slackpkg update
should give no error

 

update:

my latest update.sh:
 

#!/bin/bash
logger inicio update
MIRROR_HOST="ftp.slackware-brasil.com.br"
MIRROR_DIR="/data/mirror"
BWLIMIT=0

RSYNC_OPTS="-aPH --bwlimit=$BWLIMIT --delete --delete-excluded "

/usr/bin/rsync $RSYNC_OPTS \
--exclude source \
$MIRROR_HOST::slackware/slackware64-current/ $MIRROR_DIR/slackware64-current
logger resultado rsync: $?

and the script to run the updates:

root@rudy2:~/bin# cat goupdate.sh  
#!/bin/bash
slackpkg update
echo listo
read
slackpkg upgrade slackpkg
slackpkg upgrade aaa_glibc-solibs
slackpkg install-new
slackpkg upgrade-all
slackpkg clean-system

The "read" was placed just in case there is no updates to do since slackpkg only report 0 on success

Script to reconnect wan via rc.inet1

My router is a Linux PC with 2 lan boards, one for local lan and the other directly connected to the ISP router (configured as bridge). Each time my ISP disconnects me for whatever reason I had to either reboot the computer or keep running rc.inet1 restart until the connection is made.

So, even if it doesn't happen often, at one point I got bored of it and decided to write an script to force the reconnection as soon as possible:

 #!/bin/bash
while true ; do
   clear
   ./rc.inet1 restart
   ping google.com -c 1
   if [ $? == 0 ]; then
      exit
   fi;
   sleep 30
done

 

Linux: [Draft] how files should be organizaded inside $home

as the title says, this is a draft made public.

what I intend to do here is to organize my thoughts on how scripts and files should be placed inside $HOME user directory, were $HOME refers to the proper /home/yourusername directory inside the Linux filesystem, so I will simply refer  to it as "~" . And by user I mean "normal non-root user", But some of these ideas can be used as root too, specially if you run scripts as root under cron and you don' t want other to take a look at them.

At first I came up with the idea of naming each script with a prefix, like convert.mp42mp3, which is not bad by itself since it makes you easier to remember what the command name should look like or even better, tab key can hint you which is the one you are looking for.

Having all scripts inside a director ~/bin is a good thing, but if if you end up with too many scripts like me, it could be annoying each time you do "ls" inside of it trying to find out what is the script you are looking for. Specially if you don't remember the name of it. PATH variable should also point to it, so each time you want to execute them from another directory you don't have to explicit mention the path of the script you want to invoke. To this end, ~/.bashrc_profile must contain a line like this:

export PATH=$PATH:~/bin:

So I guess ~/bin should contain mostly symbolic links to the proper scripts. Where to place the scripts then? inside directories under ~/bin. Each one of those directories names should represent a category under each script belongs.

Examples of names that comes to mind:

remotes (for SSH access to specific hosts, could be ssh too)
develop (if you are a developer)
cron for scripts that are run by cron. A good example could be one to update date and time using ntpdate, but you can do that inside cron as a one line.
os: scripts that does specific things on the operating system (???)

Some programs don' t need to be installed system-wide: if you plan to keep them updated, you can always decompress them under your home dir. Firefox is a glaring example of that.  What I do is to extract the x64 files under ~/usr/local then create a symlink to ~/usr/local/firefox/firefox. And to avoid any conflict with the system-wide Firefox install, what I do is to remove it.

bash script to kill a process based on partial name

why you might need this: because sometimes some processes can't simply terminated using the GUI. And after too many years typing ps -A | grep something then kill -9 the id, I decided to write a script to avoid having to type two commands.

Be warned, this will only kill the first process found with the lowest process ID.

it takes only one argument as the partial name to be looked upon the ps -A command.

#!/bin/bash
proc=$(ps -A |grep $1 | head -n 1)
if [ -z "$proc" ] ; then
   echo Error: no processes found with the given partial name!
   exit 1
fi
echo ps -A says:
echo $proc
procid=$( echo "$proc" |grep "[0-9]*" -o |head -n 1)

echo "kill? <Y/N>"
read answer
if [ "$answer" != "${answer#[Yy]}" ] ;then
    echo Yes
    kill -9 $procid
    echo Testing if the process is still alive ...
    isdead=$(ps -A |grep "$proc")
    [ -z "$isdead" ] && echo Process has been terminated! || echo process is still alive !?
else
    echo No!
fi

you can replace the question with the actual command but I don't recommend it.

Why we shouldn't use Windows

I have been using both Windows and Linux for more than two decades. I have seen both grow, and when I see notes like this I simply can't resist the temptation to comment about it. The article is written from this viewpoint: you are a lazy/sloppy computer user and you don't care about it or you aren't even aware of it. Or perhaps you have a lot of money to spare and you don't care throwing a lot of cash to Microsoft while getting headaches in return, just because everybody uses Windows. Ok, it's almost everybody. But I think you get my point.

So, I will go one by one telling you why the editor of the article is wrong.

1. Lack of Software:

It was true at the very beginning of the Linux world back in the 90's, for the simple reason Linux was new. But at the beginning of 2000, there was a lot of software which could help you do to common task. Netscape Navigator as web browser, StarOffice as a replacement of MS Office, XMMS as replacement of WinAmp, among others. Today, most of the important software are provided for several platforms and O/S. That is: unless it comes from Microsoft or it's something specific for the Windows platform like most games, but in my scale, games aren't listed as important.

The editor also mentions Wine, it is true that not all software can run under it (perhaps a 5% of them?), specially if its new, but I have been able to successfully able to run most of the software I wanted to run under Linux. Example comes to mind: Synergy (for sharing mouse/keyboard among different machines), MySQL Administrator, Lindo, Blackmagic ATEM control software, games like Diablo 2 and Lineage 2.

When a specific software for Windows does not run under Wine, if you start it from the console it may give you clues on what happened. usually the fix involves taking an DLL and placing it on the right directory. Still YMMV. As a side note, the funny thing is: under Windows, most of the time you will never get an idea of what exactly went wrong.

2. Software updates:

First off: ask yourself this question. Do you really need a software update?  There's an old saying which goes: if ain't broke, don't fix it.

If found myself many times downgrading software just because the newer version introduced bugs (probably as a consequence of not enough software testing). LibreOffice comes to mind. Version 5 re-introduced a bug fixed in early versions related with toolbars flashing like crazy.

Another related and relevant question for you to ask yourself: How far do you want to go in  learning how to properly use the tools you have? I ask this because I want you to be aware of this point: it's not the tool' s fault if you don't care about how to properly use it. Once you can consider yourself a master on the tool usage and if you are *really* in need of something else, then go ahead and take a peek at newer versions. But if you are the typical user who doesn't know what Ctrl-C and Ctrl-V does and you think you are satisfied it with it, then don' t bother.

A note about security: if the software you use is *very* insecure (all Windows version are, I don't care about Microsoft lies) then you should either find a replacement or make a decision to stick with it until the bomb explodes. But, at least, you have been warned.

3. Distributions:

Yeah, there's a huge tree of them. A relevant question is: So what? Each  one of these are targeted for specific user and need. I decided to stick with Slackware because its the most complete and more consistent over the years (and trust me, it's been over 20 years!).


But I have also tried others: Red Hat 7 and 8 (has been using it for some years until I came back to Slackware), Mandriva, Debian and the first one I ever used: SLS (which precedes Slackware).

Oh by the way, formally speaking, "DISTRIBUTIONS" are only a few of them (Slackware, Debian, Red Hat, Suse and another one I can't remember now). "META-DISTRIBUTIONS"  are based on "DISTRIBUTIONS". For example: Ubuntu is based on Debian.

4.Bugs:

Yeah, most software has at least 1 bug lurking. The problem with Windows is: it has too many of them, namely in the form of "features". Operating System should do what you want it to do, and I don't really care if you just want to delete the entire filesystem on your hard disk, a good one will allow you even if it wont boot anymore. On the other side and as I mentioned before, if you don't know what are you doing then it's not the tool fault.

I get really angry when Windows forbids me to delete a file because its  "protected" even with Administrator privileges (happened more than once to me while dealing with viruses).

5. Support.

Let's face it: you don't know whats happening. If you do, you can fix it yourself. But as you really don't, you have no choice and have to call in "the experts". I have earned some money and I still do. There's nothing wrong with that. I have invested too much time learning both Windows and Linux, so I consider at least fair to get paid for both my time and the time I have spent learning.

Which leads me to one conclusion: if you have a problem and you want to solve it, you can either invest money and save time, or invest time learning and save money, but you can't save both and solve the problem.

And talking about Linux: if you have an specific problem, most of the time you can get an proper answer simply by looking at linuxquestions.org.

If Windows were well made as they claim, it should not need any support. But since it does a lot of thing on your back  and they keep you as much in the dark as possible, at some point you end up needing help.

6. Drivers.

Just like point 1, this is totally outdated and false. A complete Linux distro should provide you with drivers for the most hardware around. Specific cases like Nvidia Cards might require downloading a file and execute it. But again, you will need to learn a bit.

7. Games.

Kinda true. But as I mentioned in point 1, some games run just fine under Linux. Mame has both versions for Windows and Linux and its quite fun. Software companies like ID develop both versions of their games.

Main problem with games is: developers usually use DirectX which is essentially a Microsoft library. If the Linux usage increases over the years, at some point they might have no choice but to take a took at alternatives like SDL which is a cross platform library for both Win and Linux.


8. Peripherals

Also false and same as Drivers. Most of the time I connect anything into my Linux, it works. Specially HP Printers, since HP has been doing Linux support since the 90's.

Still, you might into some hardware with doesn't have Linux drivers, usually someone else developed one for it. Just Google for it and read the instructions, just like you should under Windows.

9. Complicated:

this is the most stupid argument mentioned. Do I need to ask again the question I did in point 2? Look around you. The world IS complicated. Life IS complicated. Computers are not from outside of this world nor they came from the Heavens. Computers  are just TOOLS. If you want to take a look into Linux, your goal should be to get the results you want, no matter the cost.

Sure, the editor mentioned my case: I have over 20 years of Linux and yes, to me is a lot easier to deal with things than with Windows. But the results are far different. As a normal user under Linux I have control of everything going around. As an Administrator user under Windows I may have a sightly idea. That' s because I took the time to learn, both Windows and Linux, and I assure you, I have never been as satisfied with Windows as I had been with Linux.

10. Installing Linux is Hard.

Yeah, like everything I mentioned before, if you have read so far, you should realize its also false. Why? Because if you want to do it right, understanding how to properly install any operating system is not a trivial task. It forces you to learn a lot about a lot of things and leaving Linux alone in the middle is a fallacy.

Extras:

11. Privacy.

Since main Windows source code is not open for inspection, no-one can take a deep look to say "yes, it does respect your privacy". And trust me on this: over twenty years I have learned to don't believe anything Microsoft says.


Have you ever read a Microsoft User Agreement? If you don't I will summarize it to you: They are responsible for nothing and you can't blame them for anything that goes wrong.

So if they have a hidden Trojan horse embedded with the Operating System, all three letters agencies can take a peek on your files and your activities even if you think have nothing to hide.

Under Linux, any skilled user who noticed anything suspicious would investigate and spread the word about it like they did with SSH flaw and Bash vulnerability some years ago.

12. Cost

At the time of writting this, Wind 10 Pro version cost 200 u$s on USA which is a lot for most of the rest of the world.

Some Linux Distros may charge you for the media but esencially Linux is free.

If you have a lot of money to spare and don't care about learning, then my suggestion is: go Mac and follow a few rules: get to know your tool and don't update it unless you *really* need it. High chances are that you won't regret it.

Conclusion:

So, my conclusion is: There's no shortcuts to excellence and I honestly believe Linux is taking me to that path.

How to speed up ktorrent 4.3.1 startup

this fix is to address an specific problem with KTorrent startup, since some years ago started very slowly (about a minute) and then a popup appears complaining about a missing web file in maxmind.com

At first I tried to upgrade it but I found out newest version need a newer version of KDE. Since I decided to stick to Slackware 14.2 I had to look for alternatives.

So, here it is:

simply add a line at the end of  /etc/hosts with the following content:

0.0.0.1 geolite.maxmind.com

Close KTorrent if you have it open already then next time you start it  it will load up in a flash (It will show the popup again but this time with a different error).

PHP to UML

I wanted a tool to convert PHP classes to UML, but I also wanted to be able to modify the result.

As a (maybe positive) side effect I had to separate all PHP classes in a particular directory in order to avoid the tool to get confused with other scripts used to generate Javascript code among other things.


(this post may require some revisions)

grab php2xmi from

http://tech.motion-twin.com/php_php2xmi.html

sample script to run on project directory:

php2xmi \
--no-private \
--no-protected \
--output=/home/rudy/borrame/myresult.xmi \
`find src/class -name "*.php"`

add --path= if you need to include other project files

once you get the XMI file, you can import it with ArgoUML

http://argouml-downloads.tigris.org/argouml-0.34/

it wont generate the UML on the fly

network bonding on slackware 14.2

perhaps a first sloppy attempt I made to make bonding work in 14.2, based on this info

https://docs.slackware.com/howtos:misc:network_interace_bonding

inside /etc/rc.d/rc.M add (before rc.local section):

if [ -x /etc/rc.d/rc.bond ]; then
  . /etc/rc.d/rc.bond
fi

/etc/rc.d/rc.bond :

modprobe bonding

ip addr add 192.168.111.3/24 dev bond0
ip link set bond0 up


ip link set eth0 master bond0
ip link set eth1 master bond0

ifconfig eth0 up
ifconfig eth1 up

ip route add default via 192.168.111.13 dev bond0

chmod +x rc.bond and reboot

bash script to kill another script by pid file

the idea is to get the pid from a running script and save it to a file, so we can retrieve the id and kill the process. Also it should kill child processes

to create the file, during the script we must do (replace /home/mantener/var/run with another dir of your liking):

minombre=$(basename $0)
pidfile=/home/mantener/var/run/$minombre.pid
echo $$ >$pidfile

 
 and the script to make use of the pid file could be:

#!/bin/bash
pidfile=/home/mantener/var/run/$1.pid

if [ ! -f $pidfile ] ; then
   echo missing $pidfile !
   logger $0 missing $pidfile !
   exit -1
fi

cualpid=$(cat $pidfile)

# get child processes
resto=$(ps --ppid $cualpid -o pid --no-headers)

echo killing $1
kill -9 $cualpid

while IFS= read -r line ; do
    echo killing $line
    kill -9 $line
done <<< "$resto"

rm $pidfile

ffmpeg: converting m4a to mp3 script

to be able to do this, ffmpeg must be compiled with mp3 support.

#!/bin/bash
mkdir mp3
for file in *.m4a
   do ffmpeg -i "${file}" -vn -ar 44100 -ac 2 -ab 128k -f mp3 mp3/"${file/%m4a/mp3}"
done

zeroing a disk on linux using DD

WARNING: if you don't really understand what are you doing (even if you THINK you are), then start learning/reading first or asking someone who really understands linux BEFORE doing something stupid like erasing a wrong disk by mistake.

if you need to wipe the content of a hard disk (REPLACE /dev/sda with the appropiate device !):

dd if=/dev/zero of=/dev/sda bs=1M 

last parameter (block size) makes the process a lot faster

inotifywait example

edit: modified parameter "-n 1" to the "head" command

for this example I'm assuming text files:
to avoid confusions long lines are splitted with \

#!/bin/bash

if [ $# -ne 2 ]
    then
    echo "$0 <src dir> <dst dir>"
    exit
fi

clear

inotifywait $1 -qmre CLOSE_WRITE \
--format='%f' | while read WHICHONE ; do  
   if [ $? != 0 ]; then exit; fi;
   LINESELECTED=$(head -n 1 $WHICHONE | \
grep CONDITION)

if[ $LINESELECTED -eq 1 ] then
   cp $1/$WHICHONE $2
fi

done

geany plugins for 1.33

assuming:

• have geany 1.33 installed
• you want to use geany pluings for the same version
• you have downloaded and unpacked source distribution 
• you get an error while running ./configure under slackware64 14.2 similar linux flavor

if configure complains no "geany.pc", to solve this:

find /usr |grep "geany.pc"

take note where the "geany.pc" is located and append to PKG_CONFIG_PATH

ie if the file is located under /usr/local/lib/pkgconfig

export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig

then you can run ./configure again without errors

new install to-do list

this post is a work in progress:

after installing slackware, things to do besides the normal setup like configuring network card:

copy ssh keys from old install
copy /etc/sshd config?
copy .bashrc from old home install or the entire home directory
user groups review? (seems like its no longer needed under Slackware 14.2)
xorgsetup ? only if needed
compat32
libreoffice ?
wine?
firefox 40 (yes I stick to this version until Firefox can fix newer versions problems).


kde: fix nasty konsole prompt, edit Shell: /bin/bash -l

Installing PHP 7 from source

this post assumes you are familiar with Slackware 14.2 and have php 5.6 installed

1. Donwload php from sources, and extract it
2. inside the sources, create a script with this code or copy/paste on bash:
   

   #!/bin/bash
   ./configure \
       --with-config-file-path=/etc \
       --with-config-file-scan-dir=/etc \
       --enable-mbstring \
       --enable-zip \
       --enable-bcmath \
       --enable-pcntl \
       --enable-ftp \
       --enable-exif \
       --enable-calendar \
       --enable-sysvmsg \
       --enable-sysvsem \
       --enable-sysvshm \
       --enable-wddx \
       --enable-intl \
       --with-curl \
       --with-iconv \
       --with-gmp \
       --with-pspell \
       --with-gd \
       --with-jpeg-dir=/usr \
       --with-png-dir=/usr \
       --with-zlib-dir=/usr \
       --with-xpm-dir=/usr \
       --with-freetype-dir=/usr \
       --enable-gd-jis-conv \
       --with-openssl \
       --with-pdo-mysql=/usr \
       --with-gettext=/usr \
       --with-zlib=/usr \
       --with-bz2 \
       --with-apxs2=/usr/bin/apxs \
       --with-mysqli=/usr/bin/mysql_config \
       --with-ldap \
     --with-libdir=lib64

   edit: the long line from above as one line:
   ./configure --with-config-file-path=/etc --with-config-file-scan-dir=/etc --enable-mbstring --enable-zip --enable-bcmath --enable-pcntl --enable-ftp --enable-exif --enable-calendar --enable-sysvmsg --enable-sysvsem --enable-sysvshm --enable-wddx --enable-intl --with-curl --with-iconv --with-gmp --with-pspell --with-gd --with-jpeg-dir=/usr --with-png-dir=/usr --with-zlib-dir=/usr --with-xpm-dir=/usr --with-freetype-dir=/usr --enable-gd-jis-conv --with-openssl --with-pdo-mysql=/usr --with-gettext=/usr --with-zlib=/usr --with-bz2 --with-apxs2=/usr/bin/apxs --with-mysqli=/usr/bin/mysql_config --with-ldap --with-libdir=lib64
   
   
3. make
4. make test
5. su
6. make install
7. edit /etc/httpd/mod_php.ini and comment lib_php5.so line
8. rc.httpd restart

running ATEM Software Control under Slackware

while this blog has a foolproof method for ubuntu, I believe I took a shortcut and managed to make it work under wine32 because you don't really need to install it to make it work, just like old fashioned software. Besides: installing wine64 just to install ATEM and then install win32 to run it sound more like a hack than a "propper" solution.

In case you dont have it already installed wine:
http://www.slackware.com/~alien/slackbuilds/wine/

1) on a Win setup, make a copy/compressed file of ATEM Software control
2) copy/decompress it on a Slackware box

then cd to the "Blackmagic Design/Blackmagic ATEM Switchers" and do

$ regsvr32 BMDSwitcherAPI.dll 

because if you dont the software will complain for missing DLLs.

and then you can run it:

$ wine ATEM\ Software\ Control.exe

ffmpeg conversion from h265 to h264

some strange reason, lastest version of VLC doesn't work very well under Slackware. I got sick tired of it and decided to go back to 2.0.7. But a problem arise when I want to watch a video encoded with h265. So I ended up converting them to h264 using a simple command line.

#!/bin/bash

for file in *.mkv
        do ffmpeg  -n -i "${file}" -map 0 -c:a aac -c:s copy -c:v libx264 264/"${file}"
done

slackware 14.2 bashrc

Slackware 14.2 has many changes since version 14.0. So far the most annoying to me is the prompt under console and the ls colors.  So I figured I should copy/paste the definitions from 14.0 into a .bashrc

#!/bin/bash
export PATH=$PATH:/home/rudy/bin
export PS1='\u@\h:\w\$ '
export LS_COLORS='no=00:fi=00:di=01;34:ln=01;36:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.bat=01;32:*.BAT=01;32:*.btm=01;32:*.BTM=01;32:*.cmd=01;32:*.CMD=01;32:*.com=01;32:*.COM=01;32:*.dll=01;32:*.DLL=01;32:*.exe=01;32:*.EXE=01;32:*.7z=01;31:*.ace=01;31:*.ACE=01;31:*.arj=01;31:*.bz2=01;31:*.cpio=01;31:*.deb=01;31:*.dz=01;31:*.gz=01;31:*.jar=01;31:*.lzh=01;31:*.lzma=01;31:*.rar=01;31:*.RAR=01;31:*.rpm=01;31:*.rz=01;31:*.tar=01;31:*.taz=01;31:*.tb2=01;31:*.tbz2=01;31:*.tbz=01;31:*.tgz=01;31:*.tlz=01;31:*.trz=01;31:*.txz=01;31:*.tz=01;31:*.tz2=01;31:*.xz=01;31:*.z=01;31:*.Z=01;31:*.zip=01;31:*.ZIP=01;31:*.zoo=01;31:*.aac=01;35:*.AAC=01;35:*.anx=01;35:*.asf=01;35:*.ASF=01;35:*.au=01;35:*.axa=01;35:*.axv=01;35:*.avi=01;35:*.AVI=01;35:*.bmp=01;35:*.BMP=01;35:*.divx=01;35:*.DIVX=01;35:*.flac=01;35:*.FLAC=01;35:*.gif=01;35:*.GIF=01;35:*.jpg=01;35:*.JPG=01;35:*.jpeg=01;35:*.JPEG=01;35:*.m2a=01;35:*.M2A=01;35:*.m2v=01;35:*.M2V=01;35:*.m4a=01;35:*.M4A=01;35:*.m4p=01;35:*.M4P=01;35:*.m4v=01;35:*.M4V=01;35:*.mid=01;35:*.midi=01;35:*.mka=01;35:*.mkv=01;35:*.MKV=01;35:*.mov=01;35:*.MOV=01;35:*.mp3=01;35:*.MP3=01;35:*.mp4=01;35:*.MP4=01;35:*.mp4v=01;35:*.mpc=01;35:*.MPC=01;35:*.mpeg=01;35:*.MPEG=01;35:*.mpg=01;35:*.MPG=01;35:*.nuv=01;35:*.oga=01;35:*.ogv=01;35:*.ogx=01;35:*.ogg=01;35:*.OGG=01;35:*.pbm=01;35:*.pgm=01;35:*.png=01;35:*.PNG=01;35:*.ppm=01;35:*.qt=01;35:*.ra=01;35:*.RA=01;35:*.ram=01;35:*.RAM=01;35:*.rm=01;35:*.RM=01;35:*.spx=01;35:*.svg=01;35:*.svgz=01;35:*.tga=01;35:*.TGA=01;35:*.tif=01;35:*.TIF=01;35:*.tiff=01;35:*.TIFF=01;35:*.vob=01;35:*.VOB=01;35:*.wav=01;35:*.WAV=01;35:*.wma=01;35:*.WMA=01;35:*.wmv=01;35:*.WMV=01;35:*.xbm=01;35:*.xcf=01;35:*.xpm=01;35:*.xspf=01;35:*.xwd=01;35:*.XWD=01;35:*.xvid=01;35:'
export LS_OPTIONS='-F -b -T 0 --color=auto'
alias d='dir'
alias dir='/bin/ls $LS_OPTIONS --format=vertical'
alias ls='/bin/ls $LS_OPTIONS'
alias mc='. /usr/share/mc/bin/mc-wrapper.sh'
alias v='vdir'
alias vdir='/bin/ls $LS_OPTIONS --format=long'

MongoDB 3.2 on Slackware 14.0

Slackbuilds already have premade packages for MongoDB but the problem is, sometimes they are outdated. Some people might not want to upgrade their Slackware installation, and since I'm in such situation, here is my recipe

1. grab the aproppiate MongoDB from Slackbuilds to your version of Slackware. 
2. install it as usual with upgradepkg --install-new, but dont start it now
3. grab binaries from https://www.mongodb.com/download-center
4. unpack them
5. overwrite unpacked binaries in /usr/bin
6. and now you can start the server and restart Apache if needed