{"@attributes":{"version":"2.0"},"channel":{"title":"linuxgemini's space of text","link":"https:\/\/blog.linuxgemini.space\/","description":"I talk about software and more. Sometimes in English, bazen de T\u00fcrk\u00e7e.","pubDate":"Sun, 26 Jul 2026 15:11:43 +0000","item":[{"title":"Putting EJBCA behind a reverse proxy with a trusted TLS certificate","link":"https:\/\/blog.linuxgemini.space\/ejbca-with-reverse-proxy","description":"<![CDATA[So normally you'd deploy EJBCA internally. But what if you wanted to publicly use it for SCEP but not want to deploy the ManagementCA to user trust store?\n\nThat's when you'd put EJBCA behind a reverse proxy, but how?\n\n!--more--\n\nPrerequisites\n\nPrepare your own root CA: You'll need the keypair as a PKCS#12 file and the root CA certificate itself as a PEM file.\n\nPut the root CA certificate to somewhere the reverse proxy can access. \/opt\/rootca.pem would be an example. Make sure it is readable by everyone: chmod 644 \/opt\/rootca.pem\n\nDNS\n\nMake sure you've set up a (sub-)domain that points to your EJBCA server. For this blog post, I've chosen ejbca.example.com.\n\nProcedure\n\nWe'll go over bootstrapping EJBCA itself and the reverse proxy configuration.\n\nEJBCA\n\nBring up EJBCA using Keyfactor's own Docker Compose file with little modifications:\n\n---\nnetworks:\n  access-bridge:\n    driver: bridge\n  application-bridge:\n    driver: bridge\nservices:\n  ejbca-database:\n    containername: ejbca-database\n    image: \"library\/mariadb:latest\"\n    restart: unless-stopped\n    networks:\n      application-bridge\n    environment:\n      MYSQLROOTPASSWORD=foo123\n      MYSQLDATABASE=ejbca\n      MYSQLUSER=ejbca\n      MYSQLPASSWORD=ejbca\n    volumes:\n      .\/datadbdir:\/var\/lib\/mysql:rw\n  ejbca:\n    hostname: ejbca-node1\n    containername: ejbca\n    image: keyfactor\/ejbca-ce:latest\n    dependson:\n      ejbca-database\n    restart: unless-stopped\n    networks:\n      access-bridge\n      application-bridge\n    environment:\n      DATABASEJDBCURL=jdbc:mariadb:\/\/ejbca-database:3306\/ejbca?characterEncoding=UTF-8\n      LOGLEVELAPP=INFO\n      LOGLEVELSERVER=INFO\n      TLSSETUPENABLED=later\n      PROXYHTTPBIND=0.0.0.0\n    ports:\n      # Proxy port for the HTTP endpoint (normally 8080 when PROXYHTTPBIND is not set)\n      \"127.0.0.1:8081:8081\"\n      # Proxy port for the HTTPS endpoint, it is HTTP but has\n      # SSLCLIENTCERT header support to provide the\n      # equivalent of the regular HTTPS endpoint\n      # (normally 8443 when PROXYHTTPBIND is not set)\n      \"127.0.0.1:8082:8082\"\n\nAside from the addition of restart: unless-stopped, notice that the environment variables TLSSETUPENABLED is set to later and PROXYHTTPBIND is set to 0.0.0.0. These two makes few changes:\n\n  Disable generation of ManagementCA, you need to provide\/generate your own CA.\n  Make Wildfly (the application server) not listen on HTTPS but on two special HTTP proxy ports:\n    8081 for regular HTTP traffic, but with proxy header support\n    8082 for regular HTTPS traffic, but is HTTP with proxy port and SSLCLIENTCERT header support as a way for the reverse proxy to provide the client certificate from an mTLS handshake.\n\nReverse Proxy\n\nI chose NGINX for this, but you can choose any reverse proxy you want that supports mTLS with a different CA other than the one used for the web service.\n\nMake sure you don't have any firewall rules blocking the ports 80 and 443.\n\nsubiSince I am doing all this in Enterprise Linux, the config file structure is a bit different than the Debian packaging; so be wary.\/i\/sub\n\nAfter install, make a copy of \/etc\/nginx\/nginx.conf to a temporary place, you're going to use it later on: cp -a \/etc\/nginx\/nginx.conf \/tmp\/nginxprebootstrap.conf\n\nBootstrapping TLS with certbot\n\nSet the servername variable in the \/etc\/nginx\/nginx.conf file to the (sub-)domain you've chosen.\n\nMake sure to have the EPEL repository installed and enabled. Install certbot and its NGINX plugin (dnf install certbot python3-certbot-nginx).\n\nRegister your ACME account: certbot register --email youremail@example.com --no-eff-email --agree-tos\n\nObtain your TLS certificate and install it into NGINX automatically: certbot --nginx --domains ejbca.example.com --key-type rsa\n\nRe-configuring NGINX\n\nCopy back the config file from earlier: cp -af \/tmp\/nginxprebootstrap.conf \/etc\/nginx\/nginx.conf\n\nComment out the default server block that's below the line include \/etc\/nginx\/conf.d\/.conf; in \/etc\/nginx\/nginx.conf. It should look like this:\n\nA terminal screenshot showing the nano editor with the NGINX configuration being open.\n\nWe're going to create two files: \/etc\/nginx\/default.d\/proxy.conf and \/etc\/nginx\/conf.d\/ejbca.conf.\n\n\/etc\/nginx\/default.d\/proxy.conf:\nproxysetheader Host              $host;\nproxysetheader X-Real-IP         $remoteaddr;\nproxysetheader X-Forwarded-For   $proxyaddxforwardedfor;\nproxysetheader X-Forwarded-Proto $scheme;\nproxysetheader X-Forwarded-Host  $host;\nproxysetheader Connection        \"\";\n\nThe following virtual server configuration is somewhat translated from what Keyfactor documentation provides with Apache2, with a slight tweak of using regular HTTP instead of using AJP.\n\n\/etc\/nginx\/conf.d\/ejbca.conf:\nserver {\n    listen       80;\n    listen       [::]:80;\n    servername  ejbca.example.com;\n    root         \/usr\/share\/nginx\/html;\n\n    accesslog \/var\/log\/nginx\/ejbcahttpaccess.log combined;\n    errorlog  \/var\/log\/nginx\/ejbcahttperror.log  warn;\n\n    include \/etc\/nginx\/default.d\/proxy.conf;\n\n    # CRL Distribution Point\n    location = \/publicweb\/webdist\/certdist {\n        if ($argcmd = \"crl\") {\n            rewrite ^(.)$ \/ejbca$1 break;\n            proxypass http:\/\/127.0.0.1:8081;\n            break;\n        }\n        return 301 https:\/\/$host$requesturi;\n    }\n\n    # Healthcheck and OCSP\n    location \/publicweb\/status\/ {\n        rewrite ^(.)$ \/ejbca$1 break;\n        proxypass http:\/\/127.0.0.1:8081;\n    }\n\n    location \/ejbca\/ {\n        # Only the CRL\/OCSP\/healthcheck endpoints are allowed in the clear;\n        # any other request redirect to HTTPS.\n        if ($requesturi !~ ^\/ejbca\/(publicweb\/webdist\/certdist\\?.cmd=crl|publicweb\/status\/)) {\n            return 301 https:\/\/$host$requesturi;\n        }\n        proxypass http:\/\/127.0.0.1:8081;\n    }\n\n    location \/ {\n        return 301 https:\/\/$host$requesturi;\n    }\n}\n\nserver {\n    listen 443 ssl; # managed by Certbot\n    listen [::]:443 ssl ipv6only=on; # managed by Certbot\n    http2 on;\n    servername  ejbca.example.com;\n\n    root         \/usr\/share\/nginx\/html;\n\n    accesslog \/var\/log\/nginx\/ejbcahttpsaccess.log combined;\n    errorlog  \/var\/log\/nginx\/ejbcahttpserror.log  warn;\n\n    sslcertificate \/etc\/letsencrypt\/live\/ejbca.example.com\/fullchain.pem; # managed by Certbot\n    sslcertificatekey \/etc\/letsencrypt\/live\/ejbca.example.com\/privkey.pem; # managed by Certbot\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\n    ssldhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # managed by Certbot\n\n    sslclientcertificate    \/opt\/rootca.pem;\n    sslverifyclient         optional;\n    sslverifydepth          1;\n\n    location \/ejbca\/adminweb {\n        #if ($sslclientverify != SUCCESS) { return 403; } # uncomment after creating and installing your SuperAdmin certificate then remove the SuperAdmin public access policy.\n        proxypass http:\/\/127.0.0.1:8082;\n        include \/etc\/nginx\/default.d\/proxy.conf;\n        proxysetheader SSLCLIENTCERT $sslclientcert;\n    }\n    location \/adminweb {\n        #if ($sslclientverify != SUCCESS) { return 403; } # uncomment after creating and installing your SuperAdmin certificate then remove the SuperAdmin public access policy.\n        rewrite ^(.)$ \/ejbca$1 break;\n        proxypass http:\/\/127.0.0.1:8082;\n        include \/etc\/nginx\/default.d\/proxy.conf;\n        proxysetheader SSLCLIENTCERT $sslclientcert;\n    }\n\n    location \/ejbca\/ {\n        proxypass http:\/\/127.0.0.1:8082;\n        include \/etc\/nginx\/default.d\/proxy.conf;\n        proxysetheader SSLCLIENTCERT $sslclientcert;\n    }\n    location \/ {\n        rewrite ^(.)$ \/ejbca$1 break;\n        proxypass http:\/\/127.0.0.1:8082;\n        include \/etc\/nginx\/default.d\/proxy.conf;\n        proxysetheader SSLCLIENTCERT $sslclientcert;\n    }\n}\n\nMake sure to have these files readable by NGINX: chmod 644 \/etc\/nginx\/default.d\/proxy.conf \/etc\/nginx\/conf.d\/ejbca.conf\n\nTo make sure everything went okay, reboot the entire server.\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/ejbca-with-reverse-proxy","pubDate":"Tue, 21 Apr 2026 09:44:53 +0000"},{"title":"\"advanced firewall\" rules for RHEL licensing and updates","link":"https:\/\/blog.linuxgemini.space\/advanced-firewall-rules-for-rhel-licensing-and-updates","description":"<![CDATA[had a Fun experience at a customer environment where they have strict network limitations (+ have servers in rather spicy locations)!--more-- so i'll just cut to the chase:\n\nlicensing\n\nfor RHEL licensing, there's two places you have to allow:\n\nHost: subscription.rhn.redhat.com\n  Port: 443\n  Protocol: HTTPS \/ TLS \/ TCP\nHost: subscription.rhsm.redhat.com\n  Port: 443\n  Protocol: HTTPS \/ TLS \/ TCP\n\nyou probably noticed that i haven't given any IPs yet, there's a reason for that; i'll explain at the end.\n\npackage updates etc.\n\nHost: cdn.redhat.com\n  Port: 443\n  Protocol: HTTPS \/ TLS \/ TCP\nHost: .cdn.redhat.com\n  Port: 443\n  Protocol: HTTPS \/ TLS \/ TCP\n\nwhy the seperate wildcard? well,\n\nwhat happens when your host is in Russia, Belarus or China?\n\nfor Russia and Belarus; first off, your Red Hat account must not be in \"Export Hold\"; if you are, you're short of luck from the beginning.\n\nif your Red Hat account is not on \"Export Hold\" state, your requests to cdn.redhat.com from RU or BY will be magically redirected to ru-by-exceptions.cdn.redhat.com, no configuration change needed.\n\nfor China however, the entire RHEL stack goes through one place: china.cdn.redhat.com; this includes licensing as well (so double check your DNF\/YUM and subscription-manager configuration, see https:\/\/access.redhat.com\/solutions\/5090421 (login required*)).\n\nhence the wildcard.\n\nwhy no ip?\n\nother than licensing, everything Red Hat hosts use Akamai's CDN infrastructure. given that Akamai themselves don't directly provide IP lists of their CDN nodes, its somewhat hard to limit just per-IP.\n\nfor the global cdn.redhat.com endpoint, Red Hat does provide an IP list at https:\/\/access.redhat.com\/articles\/1525183 (no login required). JSON formatted version also available at https:\/\/access.redhat.com\/sites\/default\/files\/cdnredhatcom_cac.json.\n\nIPs of subdomains designated for Russia, Belarus and China are not provided, thus you always have to resort to SNI based filtering for these.\n\ni mean if you're using a palo alto firewall and you're doing IP based filtering, what's wrong with you\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/advanced-firewall-rules-for-rhel-licensing-and-updates","pubDate":"Thu, 02 Jan 2025 13:59:12 +0000"},{"title":"a registry file for new windows installations","link":"https:\/\/blog.linuxgemini.space\/a-registry-file-for-new-windows-installations","description":"<![CDATA[although i rarely (re-)install windows, these settings are quite handy to improve stability in certain situations.!--more--\n\nso here it is, written in .reg file syntax:\n\nWindows Registry Editor Version 5.00\n\n;; Revert the timeBeginPeriod change done in Win10-2004 (flag is only available in Win11+)\n;; https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/timeapi\/nf-timeapi-timebeginperiod#remarks\n;; https:\/\/randomascii.wordpress.com\/2020\/10\/04\/windows-timer-resolution-the-great-rule-change\/ (https:\/\/archive.li\/OrqYE)\n;;\n;; This fixes audio distortion issues that may come up on Virtual Machines (particularly old Windows versions) in VMware Workstation\n[HKEYLOCALMACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\kernel]\n\"GlobalTimerResolutionRequests\"=dword:00000001\n\n;; Disable co-installers (auto-installers) that may come with external devices\n[HKEYLOCALMACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer]\n\"DisableCoInstallers\"=dword:00000001\n\n;; Don't let Windows Explorer auto-determine the folder type such that it won't get hung\n[HKEYCURRENTUSER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\Bags\\AllFolders\\Shell]\n\"FolderType\"=\"NotSpecified\"\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/a-registry-file-for-new-windows-installations","pubDate":"Sat, 14 Dec 2024 03:57:24 +0000"},{"title":"desperate measures when you can't access your ubuntu server","link":"https:\/\/blog.linuxgemini.space\/desperate-measures-when-you-cant-access-your-ubuntu-server","description":"<![CDATA[okay let's say your server's networking just dies, you can access its serial and visual console...\n\n...but you don't know root\/user password(s). what would you do?!--more--\n\nwell, this is something a friend encountered with their two oracle cloud servers.\n\nas a prerequisite, you need to reset the root password. unless you run a hardened system image, this should be doable with changing the boot command line to initialize bash, rather than whatever initsystem the image uses. this has been documented many times.\n\nresetting the root password\n\nto do this; first you need to generate the remote console keys for the virtual instance from the oracle cloud console.\n\nthen, connect to the vnc console using the long command oracle gives you. (for windows, you need to install the putty suite tools because plink is required; oh and a vnc client.)\n\nthe command should open port 5900 for your vnc client to connect to the console proper.\n\nsend a ctrl-alt-del signal or issue a reset from the cloud console.\n\nhit esc right after texts above the tianocore logo shows up. hope that the grub menu appears. if it does, you can follow the many tutorials i linked above. if it doesn't, well, you're fucked.\n\nthe hail mary approach\n\n...not that fucked, though.\n\nif you hit esc early, you might've entered the uefi menu instead. for which instead of resetting you enter the boot menu to enter the efi shell. hit any key other than esc to drop into the shell itself.\n\ninitial screenshot of the efi shell\n\nrun type fs0:\\EFI\\ubuntu\\grub.cfg and note the value at the end of the line starting with search.\n\na printout of the grub configuration for the efi partition\n\nthe efi shell should give a crude editor to mess with the grub config, so run edit fs0:\\EFI\\ubuntu\\grub.cfg and add a space withinin the value of the configfile line. yes you're intentionally breaking grub here. by breaking the configline instruction; you're making grub partially set up to use the correct \/boot (or \/) partition.\n\nreboot again, you should drop to a regular grub shell this time.\n\nyou can use source (thepartition,younoted)\/boot\/grub\/grub.cfg to load the system environment but not execute it.\n\ninitial grub shell\n\nrun cat (thepartition,younoted)\/boot\/grub\/grub.cfg and note the boot and initrd lines, if you can see them.\n\nboot parameters from the actual grub configuration\n\nyou can then write those two lines by hand, but changing the ro to rw init=\/bin\/bash in the linux line like in the tutorials and removing the rest after that ro.\n\nthen run normal. you should be in bash in a moment. do the passwd trick (like in the tutorials) and then issue a ctrl-alt-del or a reset from the cloud console.\n\nsince you broke the config in the efi partition (esp) you will be dropped back into the grub shell, this time run configfile (thepartition,younoted)\/boot\/grub\/grub.cfg so that the system boots.\n\nthen just login with your new password, make sure that you run update-grub to fix the issues you created previously :p\n\ndouble check if its fixed by checking \/boot\/efi\/EFI\/ubuntu\/grub.cfg.\n\nexporting files when you don't have working virtual cloud network\n\ni don't know how can this happen @ oracle cloud but i've had first-hand experience, so yeah.\n\nwe wanted to export at least a home directory so we did something very cursed.\n\ntarball the folder, reconnect to the console using the text-serial endpoint instead of vnc while piping the output to a file, and run base64. \n\nit did take like 1-2 hours for 2 tarballs but it worked \/shrug\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/desperate-measures-when-you-cant-access-your-ubuntu-server","pubDate":"Sun, 07 Apr 2024 19:52:03 +0000"},{"title":"a tiny rant about SSL certificate deployment in web servers","link":"https:\/\/blog.linuxgemini.space\/a-tiny-rant-about-ssl-certificate-deployment-in-web-servers","description":"<![CDATA[did you know that you have to provide a full certificate trust chain for getting almost every web (or any SSL) client to use your website (or service) with TLS?\n\n...but you can still visit some websites with your browser that don't do this?!--more--\n\nyou probably didn't realize this unless you ran cURL on a website and got a nice little error like this:\n\n(sorry for the people at TUB\u0130TAK ULAKB\u0130M; i had to use a current example)\n\n~ \u276f curl -v https:\/\/ulakbim.tubitak.gov.tr\nTrying 193.140.74.21:443...\nConnected to ulakbim.tubitak.gov.tr (193.140.74.21) port 443\nALPN: curl offers h2,http\/1.1\nTLSv1.3 (OUT), TLS handshake, Client hello (1):\nCAfile: \/opt\/local\/share\/curl\/curl-ca-bundle.crt\nCApath: none\nTLSv1.3 (IN), TLS handshake, Server hello (2):\nTLSv1.2 (IN), TLS handshake, Certificate (11):\nTLSv1.2 (OUT), TLS alert, unknown CA (560):\nSSL certificate problem: unable to get local issuer certificate\nClosing connection\ncurl: (60) SSL certificate problem: unable to get local issuer certificate\nMore details here: https:\/\/curl.se\/docs\/sslcerts.html\n\ncurl failed to verify the legitimacy of the server and therefore could not\nestablish a secure connection to it. To learn more about this situation and\nhow to fix it, please visit the web page mentioned above.\n~ \u276f\n\nbut if i use msedge, the site loads just fine with TLS:\n\nScreenshot of ULAKB\u0130M's website, visited with Microsoft Edge.\n\nyou might (understandably) think \"did the root CA update and not in the trusted keystore?\", but the reality is a little bit different. the latter thought is true, but not in the way you'd expect.\n\nmost TLS certificates in the public web would have a chain like this (some exceptions apply, i won't talk about them here):\n\nChain of Trust\n\nessentially, a cert will point to its issuer until it hits a self-signed one.\n\nmany systems will include only the root CAs approved by CA\/Browser Forum sup(post-publication edit, thanks @mmerkel):\/sup the root store operator (usually the vendor) of the system.\n\nthis means that the information about intermediates don't exist unless the server gives information about it (the public keys of both the intermediate and root).\n\nwhen you misconfigure your webserver to use only the host certificate for the public key\/certificate, the public key\/certificate of the intermediate (and root) will be missing. the only thing available will be the issuer certificate serial and its metadata.\n\nbrowsers and some OSes like Android include trusted intermediates in their trusted keystore as well. this eliminates the requirement for the server to provide a full trust chain. this obviously create a false sensation of \"yeah this works fine\".\n\nbut when you check the server with a TLS client like OpenSSL's sclient, the issue comes clear:\n\n(again, sorry for the people at TUB\u0130TAK ULAKB\u0130M)\n\n~ \u276f openssl sclient -connect ulakbim.tubitak.gov.tr:443 -servername ulakbim.tubitak.gov.tr\nCONNECTED(00000005)\ndepth=0 C = TR, ST = KOCAELI, O = TUBITAK BILGEM, CN = .tubitak.gov.tr\nverify error:num=20:unable to get local issuer certificate\nverify return:1\ndepth=0 C = TR, ST = KOCAELI, O = TUBITAK BILGEM, CN = .tubitak.gov.tr\nverify error:num=21:unable to verify the first certificate\nverify return:1\ndepth=0 C = TR, ST = KOCAELI, O = TUBITAK BILGEM, CN = .tubitak.gov.tr\nverify return:1\n---\nCertificate chain\n 0 s:C = TR, ST = KOCAELI, O = TUBITAK BILGEM, CN = .tubitak.gov.tr\n   i:C = TR, L = Gebze - Kocaeli, O = Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK, OU = Kamu Sertifikasyon Merkezi - Kamu SM, CN = TUBITAK Kamu SM SSL Sertifika Hizmet Saglayicisi - Surum 1\n   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256\n   v:NotBefore: Jul 20 13:34:02 2023 GMT; NotAfter: Jul 20 13:34:02 2024 GMT\n---\nServer certificate\n-----BEGIN CERTIFICATE-----\n[output snipped]\n\nnow let's look at a properly configured server:\n\n~ \u276f openssl s_client -connect blog.linuxgemini.space:443 -servername blog.linuxgemini.space\nCONNECTED(00000005)\ndepth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1\nverify return:1\ndepth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1P5\nverify return:1\ndepth=0 CN = linuxgemini.space\nverify return:1\n---\nCertificate chain\n 0 s:CN = linuxgemini.space\n   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1P5\n   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256\n   v:NotBefore: Nov 21 06:59:19 2023 GMT; NotAfter: Feb 19 06:59:18 2024 GMT\n 1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1P5\n   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1\n   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256\n   v:NotBefore: Aug 13 00:00:42 2020 GMT; NotAfter: Sep 30 00:00:42 2027 GMT\n 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1\n   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA\n   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256\n   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT\n---\nServer certificate\n-----BEGIN CERTIFICATE-----\n[output snipped]\n\nyou can clearly see that a trust chain is delivered by the server to the client, which the client successfully verifies with its trusted keystore, because GTS Root R1 exists in the keystore. the chain from linuxgemini.space to GTS CA 1P5 to GTS Root R1 is properly documented and delivered by the server.\n\n(now you might ask why GlobalSign Root CA isn't sent, that's because both GlobalSign and Google Trust Services certificates are in the keystore, which makes that part of the chain redundant.)\n\nso in the end; what i want to say is \"please use fullchain.pem when you are deploying a server with TLS, you can make one if you don't have any. its just appending each pem file (cert, intermediate cert, root ca cert).\"\n\n---\n\ni had the idea to write this post when i was editing pages on bgp.tools.\n\nScreenshot of a Discord conversation between me and Ben Cartwright-Cox, about this topic while doing stuff with bgp.tools.\n\nsorry again for the infodump, ben.\n\n2024-08-08 edit: last year at CCC (37C3) ben made a great lightning talk about this topic, you can watch it at https:\/\/media.ccc.de\/v\/37c3-lightningtalks-58049-browsers-biggest-tls-mistake\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/a-tiny-rant-about-ssl-certificate-deployment-in-web-servers","pubDate":"Thu, 07 Dec 2023 16:21:46 +0000"},{"title":"G\u00fcmr\u00fck vergisini g\u00f6ndericinin \u00f6dedi\u011fi paketin normal usul g\u00fcmr\u00fc\u011fe girmesi e\u011flencesi","link":"https:\/\/blog.linuxgemini.space\/mclarenmerch-dhl-gumruk","description":"<![CDATA[Efendim hikaye ufaktan (traji)komik; olay McLaren F1 tak\u0131m\u0131n\u0131n Suzuka'da 2 podyum kapmas\u0131yla ba\u015fl\u0131yor.!--more--\n\nTabi tak\u0131m o kadar mutlu olacak ki merch ma\u011fazalar\u0131nda kullanabilece\u011finiz 2 g\u00fcn ge\u00e7erli bir indirim kodu duyuruyorlar:\n\nblockquote class=\"twitter-tweet\"p lang=\"en\" dir=\"ltr\"This one&#39;s for you, McLaren fans! \ud83c\udfc6 brbrThank you for your support. Thank you for sticking with us. \ud83e\udde1 Enjoy 60% off at the McLaren Store using the code: PODIUM60 \ud83d\udc47\/p&mdash; McLaren (@McLarenF1) a href=\"https:\/\/twitter.com\/McLarenF1\/status\/1705850283534733513?refsrc=twsrc%5Etfw\"September 24, 2023\/a\/blockquote script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"\/script\n\nE haliyle biz de aban\u0131yoruz biraz:\n\nMcLaren Store'dan sipari\u015f verdi\u011fime dair ekran g\u00f6r\u00fcnt\u00fcs\u00fc.\n\nEkranda \"Duties\"e 0 Lira yaz\u0131p 322.98 Vergi yaz\u0131nca kafama tak\u0131ld\u0131, \"g\u00fcmr\u00fck vergisini ben mi \u00f6deyece\u011fim\" diye.\n\nHemen g\u00f6nderim bilgi sayfas\u0131na bir daha bak\u0131yorum, daha \u00f6nce de okudu\u011fum paragraf\u0131 bir daha okuyorum kendime:\n\n  Please ensure that when placing an order that the country of shipping destination is selected correctly. This is to ensure no extra charges are applied at customs.\n\n\u0130\u00e7im biraz rahatl\u0131yor en az\u0131ndan vergiyi McLaren \u00f6deyecek diye. Kafamda da toplam \u00f6dedi\u011fim para o g\u00fcn\u00fcn kuruyla yakla\u015f\u0131k 97 Avro'ya geliyor diye de seviniyordum.\n\n---\n\nGel gelelim bu paket 18 Ekim'de \u00fclkeye gelsin, bir g\u00fczel de g\u00fcmr\u00fc\u011fe d\u00fc\u015fs\u00fcn, SMS'i de gelsin.\n\nDHL'i arad\u0131ktan sonra \u00f6\u011freniyorum ki bildirilen toplam de\u011fer 208 Pound (GBP) oldu\u011fundan (haliyle 150 Avro'yu a\u015f\u0131yor) standart g\u00fcmr\u00fc\u011fe tabi tutulacak. Diyorum \"ya ben buna bu kadar para vermedim nas\u0131l giriyor\", DHL de \"ilk muayenede b\u00f6yle \u00e7\u0131kt\u0131, bizim yapabilece\u011fimiz pek bir \u015fey yok\" diyorlar.\n\nTabi haliyle DHL bana se\u00e7eneklerimi sunuyor:\n  Paket DTPsup id=\"a1\"1\/sup oldu\u011fundan g\u00fcmr\u00fck kanunu uyar\u0131nca \u00fclkeye geldikten sonraki ilk 20 g\u00fcn i\u00e7inde fiziken verilmesi gereken belgeleri DHL Global Forwarding'e postalayarak \u00e7ekim i\u015flemlerini ba\u015flatmak ve beklemek.\n  \u00dclkeye geldikten sonraki ilk 14 g\u00fcn i\u00e7inde McLaren ile g\u00f6r\u00fc\u015f\u00fcp paketin iade s\u00fcrecini ba\u015flatmak.\n  Hi\u00e7bir \u015fey yapmay\u0131p paketin tasfiye edilmesine m\u00fcsaade etmek.\n\n\u0130lk se\u00e7ene\u011fi se\u00e7iyorum, bakal\u0131m ne olacak diye. Tabi UPS ile ya\u015fad\u0131\u011f\u0131m k\u0131yameti ya\u015famamay\u0131 umutluyorum burda.\n\n---\n\n24 Ekim'de DGF G\u00fcmr\u00fck M\u00fc\u015favirli\u011fi (DHL Global Forwarding'dir kendileri) bana e-posta at\u0131yor, \u015fu form ve belgeleri e-posta ile, paket TAREKS'e tabi oldu\u011fundan \u015fu belgelerin asl\u0131n\u0131_ posta ile g\u00f6ndermeniz gerekiyor diye (bu sayfa sonunda yaz\u0131yor hepsi). Fakat baz\u0131 belgelerin \u00f6rnekleri yok, misal TAREKS beyannamesi i\u00e7in gereken \u015fablon ve dilek\u00e7e.\n\n25 Ekim'de, ilgilenen arkada\u015f\u0131n telefonunu aray\u0131nca olay anla\u015f\u0131l\u0131yor: bana gelen e-postan\u0131n ekleri eksikmi\u015f.\n\nEkleri yollad\u0131ktan hemen sonra, gereken belgeleri \u00e7\u0131kar\u0131p, doldurup, imzalay\u0131p, taray\u0131p, derleyip toparlad\u0131ktan sonra noter yolunu tuttum.\n\nNoterde 10 dakika (ve 569 Lira) sonras\u0131nda noter yak\u0131ndaki PTT'ye gidip 62 Lira \u00f6dedikten sonra belgeleri postalad\u0131m. PTT, \u0130stanbul'da bir tuhaf \u00e7al\u0131\u015f\u0131yor. 6 g\u00fcn (4 i\u015f g\u00fcn\u00fc) s\u00fcrd\u00fc belgelerin varmas\u0131. Tersi olsa, Ankara'ya net 1 g\u00fcnde sorunsuz getiriyorlar.\n\n2 Kas\u0131m'da DGF'den ba\u015fka bir arkada\u015f i\u015flemlere ba\u015fland\u0131\u011f\u0131n\u0131, olas\u0131 geli\u015fmelerden haberdar edece\u011fini iletiyor. Tabi TAREKS i\u00e7in 500 Lira da buradan gitti (san\u0131r\u0131m duruma g\u00f6re bu paran\u0131n iadesini isteyebiliyorum, emin de\u011filim).\n\n5 g\u00fcn (3 i\u015f g\u00fcn\u00fc) sessizlikten sonra, 7 Kas\u0131m ak\u015fam\u0131nda, soruyorum bir geli\u015fme oldu mu diye. 8'inin sabah\u0131nda hemen cevap geliyor: \"d\u00fcn beyanatta bulunduk, \u00f6\u011fleye kadar dosya kapan\u0131r, \u00f6\u011fleden sonra \u00e7\u0131k\u0131\u015f veririz\" diye. Hakikaten de paket \u00f6\u011fleden sonra g\u00fcmr\u00fckten \u00e7\u0131kt\u0131.\n\nAha bug\u00fcn 9 Kas\u0131m, paket geldi. Paketin bi taraf\u0131n\u0131n etraf\u0131 \"\u0130ncelendi\" bant\u0131yla sar\u0131l\u0131 tabi. Neyse \u00fcr\u00fcnler sa\u011flam ama. Kargo irsaliyesinde DDP, kargo etiketinde DTP yazmas\u0131 da ekstra ironik ;)\n\n---\n\nBuraya kadar hep kibar davranan DHL (ve DGF) g\u00f6revlilerine te\u015fekk\u00fcr etmek istiyorum. E-posta ekinin eksik gelmesi sorunu d\u0131\u015f\u0131nda her \u015fey ak\u0131c\u0131 ger\u00e7ekle\u015fti. Bu kadar frictionless bir deneyim beklemiyordum \u015fahsen.\n\nDHL G\u00fcmr\u00fck Portal'\u0131na bakmad\u0131ysan\u0131z bi bak\u0131n derim: https:\/\/gumruk.dhl.com.tr\n\nKendi g\u00fcmr\u00fck rehberleri de \u015furada mevcut: https:\/\/gumruk.dhl.com.tr\/Content\/documents\/Gumruk%20Musteri%20Rehberi.pdf\n\n---\n\nDGF benden \u015fu belgeleri E-posta ile g\u00f6ndermemi istedi:\n\n  - Dolayl\u0131 Temsil Yetki Belgesi (insNoterden Tasdik Ettirilmez\/ins) - (Fatura \u00fczerindeki al\u0131c\u0131 taraf\u0131ndan doldurulmal\u0131 ve imzalanmal\u0131d\u0131r),\n  - \u0130thalat G\u00fcmr\u00fckleme Talimat\u0131 (Fatura \u00fczerindeki al\u0131c\u0131 taraf\u0131ndan doldurulmal\u0131 ve imzalanmal\u0131d\u0131r),\n  - Yurd\u0131\u015f\u0131na yap\u0131lan \u00f6demenin K.kart\u0131 ekstre g\u00f6r\u00fcn\u00fct\u00fcs\u00fc veya \u00f6demenin banka uygulamas\u0131 \u00fczerindeki ekran g\u00f6r\u00fcn\u00fct\u00fcs\u00fc,\n  - Order Details \u2013 Order \u0130nformation g\u00f6rselleri\n  - Kimlik Fotokopisi,\n\nDolayl\u0131 Temsil Yetki Belgesi ve \u0130thalat G\u00fcmr\u00fckleme Talimat\u0131 ekte olmas\u0131 gerekiyor.\n\nDGF benden \u015fu belgeleri paket TAREKS'e tabii oldu\u011fundan dolay\u0131 Posta ile ofislerine ula\u015ft\u0131rmam\u0131 istedi:\n\n  - Ger\u00e7ek Ki\u015fi Ad\u0131na Kay\u0131t Dilek\u00e7esi \u2013 \u0130sim Soyisim imzal\u0131\n  - Tareks Taah\u00fctnamesi \u2013 Noter Tasdikli ( Ge\u00e7erlilik tarihi minimum 1 sene olmak \u00fczere diledi\u011finiz tarihe kadar belirlenebilir. [isim gizlendi] ismi ve bilgileri sabit kalmal\u0131d\u0131r)\n  - \u0130mza Beyannemesi \u2013 Noter Tasdikli (noterden talep edilmelidir)\n  - Vergi M\u00fckellefiyet yaz\u0131s\u0131 \u2013 E Devlet https:\/\/dijital.gib.gov.tr\/portal\/mukellefiyet-borc-durum-yazilarim Dilek\u00e7elerim  M\u00fckellefiyet\/Bor\u00e7 Durum Yaz\u0131lar\u0131m  YEN\u0130 TALEP OLU\u015eTUR  M\u00fckellefiyet Yaz\u0131s\u0131 Talebi  Merkez Ad\u0131mlar\u0131n\u0131 takip ederek belge olu\u015fturulacakt\u0131r\n \n---\n\nb id=\"f1\"1\/b: Burada ufak bi durum var, Incoterms\u00ae 2020 ile ortal\u0131k kar\u0131\u015fm\u0131\u015f durumda. DHL, (anlad\u0131\u011f\u0131m kadar\u0131yla) T\u00fcrkiye'de bireysel al\u0131c\u0131lar ve\/veya g\u00f6ndericiler i\u00e7in \"basitle\u015ftirilmi\u015f\" DTP (Duty Taxes Paid) ve DTU (Duty Taxes Unpaid) terimlerini kullan\u0131yor. DHL, Hollanda'da da bu format\u0131 kullan\u0131yor. UPS, T\u00fcrkiye'de DDP (Delivery Duty Paid) ve DDU (Delivery Duty Unpaid) kullan\u0131yor diye hat\u0131rl\u0131yorum.\u21a9\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/mclarenmerch-dhl-gumruk","pubDate":"Thu, 09 Nov 2023 09:18:14 +0000"},{"title":"Microsoft'un Tuhaf Banka\/\u015eube\/\u0130l kodu format\u0131","link":"https:\/\/blog.linuxgemini.space\/microsoftun-tuhaf-banka-sube-il-kodu-formati","description":"<![CDATA[Microsoft Partner Center'a banka hesab\u0131n\u0131z\u0131 eklerken tuhaf bir havale kodu format\u0131 istiyor, h\u0131zl\u0131ca format\u0131 g\u00f6stereyim:!--more--\n\nHSBC Bank A.\u015e. - Ankara Bireysel \u015eubesi i\u00e7in kod a\u015fa\u011f\u0131dad\u0131r:\n012300060006\n\nFormat\u0131n ayr\u0131k hali \u015fu \u015fekilde:\n0123 00060 006\n\n0123 : Banka EFT kodu  (https:\/\/www.trbanka.com\/banka-eft-kodlari\/)\n00060: Banka \u015eube kodu (https:\/\/www.trbanka.com\/)\n006  : \u0130l Plaka kodu\n\nKodlar alan uzunlu\u011fundan k\u0131sa oldu\u011funda ba\u015f\u0131na 0 ekliyorsunuz:\n\n123 --  0123\n60  --  00060\n06  --  006 (Haliyle plaka kodlar\u0131m\u0131z XX format\u0131nda zaten.)\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/microsoftun-tuhaf-banka-sube-il-kodu-formati","pubDate":"Sat, 21 Oct 2023 20:26:46 +0000"},{"title":"Musings with Quectel EC25-EUX LTE Module","link":"https:\/\/blog.linuxgemini.space\/musings-with-quectel-ec25-eux-lte-module","description":"<![CDATA[So I wanted to add Cellular connectivity to my GL.iNet Slate AX but because of regulations here, I needed to source my LTE module locally.\n\n...After couple months, I finally did.!--more--\n\nAt first, I saw an EG25-G USB dongle from EXVIST on Amazon Turkey:\n\nScreenshot of Amazon Turkey, listing the EXVIST USB Dongle, containing the Quectel EG25-G chip.\n\nBut, I remembered the entire IMEI Allowlist shenanigans after it arrived to me. So I started to play with it carefully, considering that I might return it soon.\n\nThen I decided to look at EXVIST's own website, and found out that they sell configurable USB carrier board enclosures for Quectel mini-PCIe cards as well:\n\nScreenshot of EXVIST's website, showing their \"IoT Dongles\".\n\nYou might ask \"mini-PCIe and USB? What?\" and that's a valid question. Here's a fun tidbit, mini-PCIe spec actually has pins for direct USB 2.0 connection which Quectel actually markets this as an option on their product brochures.\n\nThe carrier board utilizes this and the other \"reserved\" pins for SIM card itself, here's a pinout from SixFab, where they also use USB D+ and D- pins (emphasis mine):\n\nA pinout of mini-PCIe head, marking USB DP and DM as red.\n\nI immediately jumped onto Amazon Turkey and yep, the bare carrier enclosure is available to buy:\n\nScreenshot of Amazon Turkey, listing the EXVIST USB carrier enclosure.\n\nIn the meantime, I looked at local e-commerce marketplaces other than Amazon, and I found an EC25-EUX on Trendyol:\n\nScreenshot of Trendyol, showing a listing of the Quectel EC25-EUX mini-PCIe module.\n\nTo be extra sure, I asked the seller if the IMEIs of the stock they have are registered and they said yes:\n\nScreenshot of Trendyol, showing the \"Questions to Seller\" portion of the EC25-EUX module listing.\n\nYou can guess that I immediately bought the module.\n\nI started the return procedure of the EG25-G dongle and sent it away. I got the EC25-EUX module next day and the carrier enclosure arrived a week later.\n\nFirst two cons:\n\n  The status LED is blue. It is very bright.\n  It has mounting flaps on the sides. If you want to carry this as an extension to your travel connectivity pack, you need to carefully Dremel out the flaps.\n\nNow, let's get to how the software stuff up to speed.\n\nI need to applaud EXVIST, because unlike Quectel themselves, they actually provide open documentation to do things:\n\nScreenshot of EXVIST's documentation page, which they use GitBook.\n\nYou can grab the drivers at https:\/\/docs.exvist.com\/dongle\/ts\/drivers.\n\nLooking at the tools page, you will see two tools:\n\n  Quectel's QCOM: It is a bulk configuration GUI tool which utilizes AT commands.\n  Quectel's QNavigator: It is a GUI tool to manage your module (also uses AT commands). It also contains QCOM as a separate window inside the app.\n\nBoth tools will document the AT commands issued.\n\nThere will be 4 interfaces coming up when you plug the module in (gonna be using Linux paths):\n\n  \/dev\/ttyUSB0: the \"DM\" interface, apparently its Qualcomm's QXDM. \n  \/dev\/ttyUSB1: the NMEA\/GNSS interface, which we don't use (because this is GPS, as you might have noticed).\n  \/dev\/ttyUSB2: the direct AT interface, you can manage your modem from this.\n  \/dev\/ttyUSB3: the AT modem interface, which Windows utilizes it as a network interface (It is the last COM port), so it is invisible. I assume Windows also does QMI from here, so you need to do the settings I mention below for proper Windows support as well.\n  \/dev\/cdc-wdm0: this is the direct QMI. It will use the (open-source) qmiwwan or the (proprietary) GobiNet driver.\n\nTo \"\"\"properly\"\"\" use your module on OpenWrt based systems (aka \"using the \/dev\/cdc-wdm0 interface\"), you need to have some prerequisites, which SixFab helpfully provides it:\n\n  Check if the modem is configured correctly by sending the AT+QCFG=\"usbnet\" command. It should return 0.\n  If the command result shows a digit other than 0 at the end, set the option to 0 by sending the AT+QCFG=\"usbnet\",0 command.\n  Wait for 10 seconds and reboot the module by sending the AT+CFUN=1,1 command.\n\nIf your system allows a protocol named \"QCI\" alongside \"QMI\", you can use that for your Quectel module.\n\nI'm still messing around with this, I hope I remember to update this post with further information (Written in 2023-09-27).\n\n2023-09-28 Update:\n\nLooking at OpenWrt Docs, I have found out what each usbnet settings mean:\n\nAT+QCFG=\"usbnet\"\t# check the current mode\nAT+QCFG=\"usbnet\",0\t# set QMI or RMNET mode\nAT+QCFG=\"usbnet\",1\t# set ECM mode\nAT+QCFG=\"usbnet\",2\t# set MBIM mode\nAT+QCFG=\"usbnet\",3\t# set RNDIS mode\n\nIt is weird that Quectel doesn't mention any of this in their own AT documentation. Apparently they do, its just in a separate file.\n\nTo make things extra spicy, my modem had this set to 3, which I don't know what that means. I have updated the list above.\n\n2023-10-02 Update:\n\nI've been trying to get the module work on macOS, but it seems like I won't be able to without modifying Apple's own support kexts.\n\nTo make sure the module actually gets loaded requires me to use AppleWWANSupport or AppleWWANSupport1 driver kexts, but they have their own vendor ID list, which needs to include Quectel's vendor ID. And they obviously don't.\n\n2023-11-01 Update:\n\nI've been testing the module with my GL.iNet Slate AX for more than a month at this point and with the usbnet mode set to 0 (QMI\/RMNET) the modem is pretty much plug and play:\n\nScreenshot of the GL.iNet Slate AX management interface.\n\n2025-01-26 Update:\n\n\"macOS support\" has been lingering in my head ever since I failed to get native support working. Then recently I stumbled upon Quectel staff responding to my request last year:\n\nBean Wang of Quectel responding: \"I think the macOS might support the ECM.\"\n\nSo it turns out ECM is called \"Ethernet Control Model\" and it is basically the modem emulating an USB ethernet card with a NAT'ed network connected.\n\nThis model is natively available on both macOS and Linux. Windows requires additional drivers.\n\nSetting it up is quite simple, run the following command through the AT interface (via a Windows or Linux device):\n\nAT+QCFG=\"usbnet\",1\n\nSixFab has a support document for their SIM service at https:\/\/docs.sixfab.com\/page\/cellular-internet-connection-in-ecm-mode\n\nWith this figured out, I replied to the Quectel forum post:\n\nMy reply forum post\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/musings-with-quectel-ec25-eux-lte-module","pubDate":"Wed, 27 Sep 2023 22:08:40 +0000"},{"title":"Dialplan of Turkey, adjusted for FreePBX","link":"https:\/\/blog.linuxgemini.space\/dialplan-of-turkey-adjusted-for-freepbx","description":"<![CDATA[(this was a private gist i authored 7 months ago, making it public to those who want)\n\nThe up-to-date plan is available on https:\/\/www.btk.gov.tr\/genel-numaralandirma-plani though Some Assembly Is Required\u2122\ufe0f\n\nThe pre-assembled version is available below.!--more--\n\nTa\u015f\u0131y\u0131c\u0131 se\u00e7im kodlar\u0131\nT\u00fcrk Telekom\u00fcnikasyon A.\u015e. ve STH i\u015fletmecileri ta\u015f\u0131y\u0131c\u0131 se\u00e7im kodlar\u0131\n10ZN\n\nK\u0131sa Numaralar\nKamu kurumlar\u0131na tahsisli k\u0131sa numaralar\n1ZX\n\nCo\u011frafi numaralar\nBat\u0131 Anadolu illeri co\u011frafi alan kodlar\u0131\n2XXXXXXXXX\n\nOrta Anadolu illeri co\u011frafi alan kodlar\u0131\n3XXXXXXXXX\n\nDo\u011fu Anadolu illeri co\u011frafi alan kodlar\u0131\n4XXXXXXXXX\n\nMobil numaralar\nTT Mobil \u0130leti\u015fim Hizmetleri A.\u015e.\u2019ye tahsisli alan kodlar\u0131\n50[15-7]XXXXXXX\n\nSM\u015eH i\u00e7in belirlenmi\u015f mobil numaralar\n510XXXXXXX\n516XXXXXXX\n561XXXXXXX\n\nT\u00fcrk Telekom\u00fcnikasyon A.\u015e.\u2019ye tahsisli \u00e7a\u011fr\u0131 hizmeti numaralar\u0131\n512XXXXXXX\n\nTurkcell \u0130leti\u015fim Hizmetleri A.\u015e.\u2019ye tahsisli alan kodlar\u0131\n53XXXXXXXX\n\nVodafone Telekom\u00fcnikasyon A.\u015e.\u2019ye tahsisli alan kodlar\u0131\n54XXXXXXXX\n\nTT Mobil \u0130leti\u015fim Hizmetleri A.\u015e.\u2019ye tahsisli alan kodlar\u0131\n55[1-59]XXXXXXX\n\nGlobalstar A.\u015e. \u2019ye tahsisli GMPCS mobil telefon hizmeti numaralar\u0131 (2110000-2120306, ve 4610000-4619999 aras\u0131ndaki 20.307 numara)\n592211XXXX\n5922120[0-2]XX\n592212030[0-6]\n592461XXXX\n\nTCDD \u2019ye tahsisli GSM-R numaralar\u0131 (8100000-8109999 aras\u0131ndaki 10.000 numara)\n594810XXXX\n\nCo\u011frafi Olmayan Numaralar\n\u00dccretsiz aran\u0131r numaralar\n800XXXXXXX\n\nSTH iki kademeli arama y\u00f6ntemi eri\u015fim numaralar\u0131\n811XXXXXXX\n\n\u0130SS hizmeti \u00e7evirmeli (dial-up) ba\u011flant\u0131 eri\u015fim numaralar\u0131\n822XXXXXXX\n\nKonumdan Ba\u011f\u0131ms\u0131z Numaralar\n850XXXXXXX\n\nKatma de\u011ferli hizmet numaralar\u0131 (\u00f6zel i\u00e7erikli ve cinsel i\u00e7erikli hizmetler d\u0131\u015f\u0131nda kalan hizmetler)\n888XXXXXXX\n\nKatma de\u011ferli hizmet numaralar\u0131 (\u00f6zel i\u00e7erikli hizmetler)\n898XXXXXXX\n\nKatma de\u011ferli hizmet numaralar\u0131 (cinsel i\u00e7erikli hizmetler)\n900XXXXXXX\n\nRehberlik Hizmeti Numaralar\u0131\n118ZX\n\n(out-of-plan) \u00d6zel Servis Numaralar\u0131 (444)\n444XXXX\n\n(out-of-plan) \u0130l \u0130\u00e7i Sabit Telefonlar\nXXXXXXX\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/dialplan-of-turkey-adjusted-for-freepbx","pubDate":"Sat, 15 Jul 2023 15:20:45 +0000"},{"title":"Yap\u0131 Kredi'den SIM blokesi kald\u0131rd\u0131ktan sonra sadece 3DS SMSleri gelmiyorsa...","link":"https:\/\/blog.linuxgemini.space\/ykb-3ds-sim-bloke","description":"<![CDATA[https:\/\/acs.yapikredi.com.tr\/TDSecureTroy\/enrollment \u00fczerinden bloke kald\u0131rma\/bilgi g\u00fcncelleme yapabilirsiniz.!--more--\n\nBir arkada\u015f\u0131m, m\u00fc\u015fteri hizmetleriyle yapt\u0131\u011f\u0131 k\u0131rk takla sonucunda bu sayfan\u0131n i\u00e7inde oldu\u011funu \u00f6\u011frendi.\n\nTabi fark etmek i\u00e7in yine detayl\u0131 okuman\u0131z gerekiyor.\n\nhr style=\"color:#9300ff;background-color:#9300ff\" \/hr\r\nbr\r\nsubsupCopyright 2018-2026, linuxgemini (\u0130lteri\u015f Ya\u011f\u0131ztegin Ero\u011flu). Any and all opinions listed here are my own and not representative of my employers; future, past and present.\/sup\/sub]]>","guid":"https:\/\/blog.linuxgemini.space\/ykb-3ds-sim-bloke","pubDate":"Sat, 15 Apr 2023 18:15:00 +0000"}]}}