OpenSUSE LeapMicro 6.2 and Traefik: Permission denied

 Running the latest opensuse LeapMicro 6.2 and suddenly Traefik logs have a lot of "Permission denied" errors? Initial searches may have you jumping through hoops for docker group changes, etc. But that won't fix it. LeapMicro 6.2 has a stricter SELinux policy which no amount user/group shenanigans will evade. Instead, do the following:

• install a SELinux suitable policy
• mount bind volumes with an SELinux label

That may sound daunting (and you probably should read up on the topic), but here is a straightforward step-by-step approach:

SELinux labels

Edit your docker-compose (or, docker run command) to mount /var/docker/docker.sock as "/var/docker/docker.sock:/var/docker/docker.sock:ro,Z"

1. This may be for the Traefik container itself or for a docker socket proxy container (recommended)
2. For Traefik's certificate management file mount you will need to do the same (e.g. "/opt/traefik/acme.json:/acme.json:Z")

SELinux policy

1. Start a clean LeapMicro instance

2. Temporarily set SELinux to Permissive mode (this will cause audit logs to be created, but no blocking will take place)

setenforce 0

3. Proceed to install necessary packages, etc (e.g. docker, docker-compose)

4. Copy across your deployment file (e.g. docker-compose.yml)

5. Start the container(s) 

(e.g. docker compose up -d, or docker run -d ...)

6. Test everything is running correctly

7. View the related audit logs generated (if using a socket proxy, the -c paramter might not be "traefik")

ausearch -c traefik --raw

7. Convert SELinux audit logs to an allow policy: 

ausearch -c traefik --raw | audit2allow -M traefik_allow

8. Install the policy

semodule -i traefik_allow.pp

9. Re-enable Enforcing mode

setenforce 1

10. Restart your containers and verify they are working well.

11. Reduce/automate

• copy the traefik_allow.pp file for importing the policy on other servers
• if the traefik_allow.pp file is no longer present, export the module into an file that can be copied off: semodule --cil -E traefik_allow

With a small once-off hassle, the audit utilities provided with SELinux  make it easy to not compromise security.

Troubleshooting NVIDIA issues on openSUSE

I just did an update...and now my system boots to a black screen, or the second screen won't work, etc. Sound familiar?

This is my list of items to review, and hopefuly narrow down the culprit or at least get resolution faster.

Try to manually start the graphical interface...

• init 5
• start-plasmawayland

Check if the services are running...and whether they print accurate data...

• systemctl status prime-select.service
• systemctl status switcheroo-control.service
• (one or the other should be running, not both)

• sudo prime-select get-current (this normally doesn't show accurate info in my experience)
• sudo prime-select get-boot
• switcherooctl list

Check /var/log/messages for (e.g. if using less, use /-key to search, and n/N to search next/previous)

• sddm
• nvidia
• prime

And then, most likely, reinstall the graphics drivers. Because kernel modules need to be reconfigured witht he new drivers, sometimes this has not happened properly at upgrade.

• Search all nvidia drivers and components:
• zypper se -si nvidia-*
• zypper rm nvidia-*
• zypper se -si nvidia*
• Here you can't just remove all. The kernel-firmware-nvidia package removal will want to remove all kernel firmware...not a good idea/
• zypper rm suse-prime
• ...for prime-select
• zypper rm switcheroo-control

• Remove third-party repos. The drivers should only come from NVIDIA or Updates repo.
• In once case the system had loaded some libraries from another repo, and this seemed to be the cause of the issues. The zypper search previously will help you see if other Repos are in use.

• Reboot
• Install the drivers
• zypper in nvidia-video-G06
• This will automatically install prime-select and switcheroo-control
• zypper in nvidia-driver-G06-kmp-default
• Found this was required separately, recently (Update August 2025)
• Reboot and hopefully all is working

(18-3-2026) Note on Leap 16.0: Found version 580.142-lp160.46.1 to be buggy. Recommend installing version 580.126.18-lp160.49.1 for the time being and lock the package. E.g.:

• zypper in nvidia-video-G06-580.126.18-lp160.49.1
• zypper in nvidia-driver-G06-kmp-default-580.126.18-lp160.49.1
• zypper al nvidia-video-G06
• zypper al nvidia-driver-G06-kmp-default
• zypper ll

openSUSE Leap Micro on Digital Ocean

openSUSE's Leap Micro is a transaction-based operating system, providing built-in protection against updates that might cause the Operating System to fail. This protection is achieved by creating file system snapshots (BTRFS) before updates are applied. Further,as the "Micro" part suggests, it is lightweight and  focused on container and virtualisation use cases.

Using DigitalOcean's Custom Images feature, we can import the qcow image. 

Start by visiting https://get.opensuse.org/leapmicro, go to Downloads and copy the download link for Preconfigured Image (qcow).

In your DigitalOcean dashboard, navigate to Backups & Snapshots, and click on the Custom Images tab.

In the pop-up, paste the URL copied from the openSUSE Micro download page. Click Next and provide a more friendly name for the image, as well as setting the Distribution to be Unknown and the datatcenter where the the image must reside.

Wait for the Pending to change, and your image is ready to become an appliance.

When creating the droplet, select your image from the Custom Images tab. Also, the droplet size will need to have at least 50GB disk size. Under Authentication, only SSH is supported.

Now you can create the droplet. 

Since the image is being setup with cloud-init, the JeOS run-once menu will not be displayed. Connect using SSH: either as sles@public-ip, or root@public-ip. The 'sles' user has full sudo rights.

A big benefit of Leap Micro is that it performs system updates automatically. If you want to install packages, use sudo transactional-update -n pkg in git (the -n great for scripting as it ensures zypper is run in non-interactive mode). Note that you will need to do a reboot as soon as possible afterwards so that the snapshot created since installing the applications is used on start up and marked as reliable.

You can also enable Combustion to have an easy to use web interface for managing the server. You can find the instructions to do so by opening the droplet's console. You will need to:

• Add a user for Combustion login, by running jeos-config user.
• Enable 2FA, by running jeos-config otp.
• Enabling the Combustion service with systemctl enable --now cockpit.service

There is a lot more to explore, and I recommend viewing the videos available from openSUSE. The last heads up is just that podman is provided in place of docker, by default. 

Build Custom Operating System with OpenSUSE Build Service (OBS)

Access OBS here: https://build.opensuse.org

Create an account if necessary, and login.

Navigate to "Your Home Project". This should display your default project page.

Once there, you should by default be on the Overview tab. The context-based menu will have the option to create a "New Image".

The next step is to choose a base template - either an ISO or a container. Browse to the bottom to be familiar with the options available. The JeOS (Just Enough OS) provides the base minimum to get a server up and running.

Once you have the image selected, scroll to the bottom of the screen to name your custom OS.

With a name inserted, you can click "Create appliance". Note that this creates the sub-project and base files. A default build will also be initiated, but we still want to do some customising.

After creating the appliance, you will be taken to the sub-project / appliance overview.

Under "Software", you can (1) choose the type of appliance files to be generated (VMware, Hyper-V, etc) and (2) add/remove software packages to be pre-installed.

Finding your image

From "Your Home Project", go to "Subprojects" to access the appliance.

Select your Custom OS under "Packages"

Once completed, you can "View Image" - where you can again edit the software packages and build types.

Adding software

When you are viewing your image, select the Software tab.

Under "Packages", select "Add package"

Start typing a package name to get the package search started.

Note that dependencies need to be manually specified. I normally run the base image as a virtual machine, and then with each zypper in package-name, note down the additional packages to be installed. These will need to be manually added in OBS.

Downloading images

After saving changes to build type or adding/removing software packages, a build is automatically scheduled. Follow it's status on the "Build results" box (you may need to click the "Refresh" button from time to time).

Click on the "images" hyperlink to view the appliance files.

Domain removal and CrowdStrike uninstall

Removing a server from a domain AFTER it has been removed from site is fairly simple - if you have the local Administrator password. If not, you will need to do the following:

• Download Windows ADK and add PE (link1, link2)
• Ensure the USB is not bigger than 32GB (link3)
• Create a WinPE bootable USB (link1)
• The idea is to replace the accessibility files with cmd.exe, so that you can run a command prompt without logging in.
• If osk.exe in link1 does not work as desired, you can try replacing sethc.exe. This requires tapping shift 5x once booted (link4)
• Once logged in and removed from the domain, remember to also reset group policy (link5)
• If struggling to leave the domain, use the following command (link6):

netdom remove computername /Domain:domain /UserD:user /PasswordD:* /Force

There are a lot of posts regarding users struggling to uninstall CrowdStrike's client (Falcon). And it is really designed in a way to make un-installation impossible if you do not have the token. But with a server no longer on a network, most Sys Admins will not share the token. And the CrowdStrike client will block your attempts to uninstall it via the Control Panel.

However, in safe mode the Crowdstrike client does not run. So it cannot block you. But you also do not have access to the Control Panel's "Programs". So:

1. Reboot in Safe Mode
2. Locate the Package Cache containing the CrowdStrike client MSI package
• C:\ProgramData\Package Cache\{looks - like - hexadecimal - strings }
• One of them contains CsAgent.LionLanner.msi (either explore each one or do a search)
3. Run privileged CMD (i.e., run as admin)
4. Enable the MSI service:
• REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"
• REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer" /VE /T REG_SZ /F /D "Service"
• net start msiserver
5. Change to the directory containing CsAgent.LionLanner.msi. You should be able to use TAB-complete:
• cd C:\ProgramData\Package Cache\{looks - like - hexadecimal - strings }
6. Uninstall CrowdStrike endpoint:
• msiexec.exe /x CsAgent.LionLanner.msi
7. Reboot in normal mode, an duse Control Panel's "Programs" to now uninstall CrowdStrike Windows Sensor.

Moral of the story: it is alot easier if IT uninstall their apps before the hardware is taken off-site.

openSUSE Leap 15.3 and NVIDIA graphics on Acer Nitro 5

I recently found that the HDMI port on my Acer Nitro 5 would not work when using openSUSE, but worked fine in Windows. This is really just a graphical walk through of what is posted at:

• https://en.opensuse.org/SDB:NVIDIA_drivers
• https://en.opensuse.org/SDB:NVIDIA_SUSE_Prime
• https://forums.opensuse.org/showthread.php/538877-optimus-laptop-and-leap-15-1-do-not-connect-to-external-hdmi-monitor/page3

Procedure

Confirm that multiversion is supported:

grep multiversion /etc/zypp/zypp.conf

You should see (or need to edit to change):

Next, add the NVIDIA repo:

zypper addrepo --refresh 'https://download.nvidia.com/opensuse/leap/$releasever' NVIDIA

Now we need to identify the correct graphics card model:

sudo lspci | grep VGA

You should see the standard graphcs controlle (e.g. Intel graphics), as well as the Nvidia graphics card. In this case, the GeForce RTX 3060.

Now for a bit of detective work. We need to identify the correct driver version, using Nvidia's driver search engine (link). Populate the search fields based on the model you have just positively identified using the previous step. For example:

From the output, you want the rather insignificant looking version:

Using the version information, we can search zypper for the correct driver:

sudo zypper se -s x11-video-nvidiaG0*

* 5 May 2023: The package names have subsequently changed for G06: 

To install, copy the name and do a normal zypper install. For example:

sudo zypper in x11-video-nvidiaG06 

sudo zypper in nvidia-video-G06

If you are using EFI and signed drivers, see the original links above for the extra steps.

Since this is on a laptop, we need to use the SUSE Prime tool to activate the Nvidia graphics as the chosen graphics. 

To activate the Nvidia graphics:

*21 March 2025: "prime" is being replaced with switcheroo-control. But in some cases prime-select is still being used.

sudo prime-select nvidia

And to switch back to Intel graphics:

sudo prime-select intel

You will have to logout, maybe even restart.

Re-installing (added 21 March 2025)

Recently I had an error "Failed to start NVIDIA Persistence Daemon", after updating my NVIDIA drivers to 570.133.07-lp156.33.1. A reinstall did the trick.

• Note the current installed drivers as reference: sudo zypper se -si nvidia-* >> nvidia.log
• Uninstall the NVIDIA drivers: sudo zypper rm nvidia-*
• (Also uninstall prime-select, switcheroo-control, bumblebee)
• Reboot
• Install the drivers (as above): sudo zypper in nvidia-video-G06
• Reboot

I did note, in my case, that nvidia-utils were not installed, and that their version was not compatible (yet) - possibly this was the cause of the error in the first place...

Final comments

• Enabling the Nvidia graphics got my HDMI output working
• I also found the overall temperature of my laptop was reduced when using the Nvidia graphics over the Intel graphics
• Another handy tool in nvidia-settings.

Quick and easy NTP server - Linux

 

When installing the MXONE, part of the setup requires testing the NTP server. This is a great way to ensure that the customer's site is truly prepared for all prerequisites. However, it can make advanced prep of systems - like SBN - really difficult. Here is an easy way to set your own Linux machine as an NTP server:

Edit /etc/chrony.conf. Below I have highlighted the entries that matter. Customise the allowed IPs to suit your purpose.

Next, remember to allow the NTP port (123 UDP) on your machine's firewall. On openSUSE using YaST:

References:

https://www.ibm.com/docs/en/db2/11.5?topic=suntp-setting-up-chrony-as-network-time-protocol-server-client-by-using-chronyd-linux

CPI docs of Mitel MXONE with Edge browser

Getting to view the CPI documentation for Mitel's MiVoice MXONE always has a challenge. My personal favourite is to just use a Python or Go web server. But here is a solution which works just as well, albeit less exotic:

1. Enable the "Internet Explorer mode button" in Edge by opening Edge's menu > Settings, and search "Internet explorer"

2.Following the link, and change the setting to "Allow":

3. Now right-click on Library Browser.htm and open with Edge.

4. The page will not open in the correct mode immediately. But from Edge's menu, select "Reload in Internet Explorer mode"

And now it should be working smooth. Follow the small pop-up's instructions to save the changes.

MVO400 OfficeSuite not connecting

 In this case, the client machine can:

• Reach the OIP webserver's page
• Reach the IIOP port (2809) and HTTP port (80) using telnet
• OfficeSuite still fails and says it cannot connect to the server

 

After much struggling, it was noticed that the host name on the server itself resolves to an IPv6 Link-Local address. Removing IPv6 support on the interface and a reboot of the OIP server resulted in a working connection.

Addendum: Sometimes it is not so simple to disable IPv6. This link helped: https://tweaks.com/windows/40099/how-to-properly-disable-ipv6/

Command line SIP access testing

 Using netcat or telnet it is possible to test whether a server can reach another SIP server (SIP trunks) or a SIP endpoint. Netcat is my preferred method:

nc -vz ip.ad.dr.es 5060

If the above command says "Connection refused", it does not automatically mean the port is closed. It may indicate that the SIP stack on the other end only supports UDP! In which case, you should also try:

nc -vuz ip.ad.dr.es 5060

If at this point you still get a "Connection refused", then indeed there may be a problem on the other end.

 How about SIP TLS (5061)? As per this link:

openssl s_client -connect 83.136.32.159:5061 -no_ssl2 -bugs

MS Teams on Linux: screen share and black window

With the latest MS Teams for linux, screen share just results in a black window with no way to exit!

To prevent this from happening:

#cd /usr/share/teams/resources/app.asar.unpacked/node_modules/slimcore/bin/
#sudo mv rect-overlay rect-overlay.old

Restart Teams and it should be working fine.

This link helped.

KDEConnect on Android 10

After an upgrade to Android 10, KDEConnect features have been impacted. The following issues are workarounds are documented here:

Clipboard share
Sharing the clipboard from Linux > Android works unhindered.
However, Android does not allow KDEConnect to monitor the clipboard.
Work around: selected text can be shared (you may need to copy to a note take, like in the case of WhatsApp) when highlighted. It will be pasted into a new text document on Linux.

File share
Android > Linux: open KDEConnect settings in Linux > Select paired device > Share and Receive > Configure : set path to store received files

Linux > Android: open KDEConnect in Android > Plugin settings > Share and Receive > Configure:
1. Customise destination directory = ticked
2. Press on "Destination Directory", from top right menu select "Show internal storage"
3. From left menu browse to destination folder and select "Allow Access To ..."

Mitel softphone one-way speech (InAttend, MiCollab) due to antivirus

Picking up audio issues like one-way speech or no speech? And probably you have the following working:

1. Can record a voice snippet fine using an audio recording program. So the device is working and drivers are good.
2. Tried analog line inputs and USB headsets.
3. Wireshark might only show RTP packets in one direction: but there is no firewall or routing involved (same subnet).

So here is the possible culprit: antivirus. Especially Kaspersky (or maybe that is the one I come across the most)

I am just posting this save someone a week or two of troubleshooting in the future...

OpenSUSE LEAP 15.2 and Broadcom WiFi

This is not new issue on this blog. OpenSUSE and Broadcom wireless seems to be a test of one's Linux mastery...and leaves one feeling very much the apprentice!

Here are the links to previous posts which saved my sanity on this latest install.
http://pabxtech.blogspot.com/2013/03/broadcom-wireless-drivers-for-opensuse.html
http://pabxtech.blogspot.com/2014/05/opensuse-131-broadcom-wireless-bcm432227.html

Before going on to the latest solution, it worth noting a frustrating symptom of the driver not working:

• The connection keeps on revolving but makes no progress
• Repeated prompts to re-enter the password, even though it is saved and not encrypted.

So here is the method that worked for me:

1. Add the Packman repo (see https://en.opensuse.org/Additional_package_repositories#Packman) by running the command: zypper ar -cfp 90 http://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Leap_15.2/ packman
2. Install the Broadcom driver:  sudo zypper in broadcom-wl
3. Next, run the b43 firmware install: sudo install_bcm43xx_firmware
4.  Reboot your machine

And now you should be able to surf the net without that 10m Ethernet cable. :)

VOIP recording in a mixed environment: VMware and HP switches

Setup

VMware virtual appliances:
Mitel MX-ONE Call Server
Mitel MiCCE Server
Datatex Amethyst Voice Recorder (2x NIC)

Physical network equipment:
1x Mitel Media Gateway Classic (MGU/2)
1x Mitel Media Gateway Lite (MGU/2)

Solution

Physical network ports on HP Switch
Create a designated mirror port (or two, for VM failover)
mirror 1 port A5

Enable mirroring of each port connected to the physical Media Gateways

interface B2

   monitor all both mirror 1

   monitor all both mirror 2   //if created two above

   name "mguA_mirror"

   exit

interface B3

   monitor all both mirror 1

   monitor all both mirror 2  //if created two above

   name "mguB_mirror"

   exit

VMware vSwitch
Create a new port group just for Recording

• Allow promiscuous mode
• Allow all VLAN [this is NOT the same as 0(None)]
• Add ESXi host's physical NICs connected to the mirror port(s) [A5 in example above]
• Edit appliances to use the new port group

!Note:

• All virtual appliances (MX-ONE and Amethyst recorder) need to be on same physical host!
• When spread across two different hosts, many packets were dropped / not present at the voice recorder.
• Tag the two appliances to cater for instances where they need to fail over to a different host, together.
• Port group settings: VLAN Set to ALL. Otherwise recordings may have one-way speech since the vSwitch will reject tagged traffic, thus inbound part of the conversation will be dropped if origin sits in a VLAN.
• Using two mirror destination ports will allow you to remove and test one at a time for troubleshooting

 

MVO400 scheduled events

Recently I was struggling to have a switched event move successfully back to position 1. Switching to positions 2 and 3 worked fine. In the end, as seen in the attached picture, when switching back to 1, I did not specify the Switch Group. Since then, all switching occurs automatically.

Server 2016 battling to run updates

The solution below works well when the graphical option is failing. In brief:

1. Run CMD as Admin
2. Run command SConfig
3. Choose option 6 [From this point on: read the screen]

https://www.zubairalexander.com/blog/solution-for-windows-update-error-0x800705b4/

Mitel MVO400 SIP trunk - editing the SIP headers

Need a custom From because you are not registering?
Setup SIP trunk to authenticate "With one account" (yes, even though you won't be authenticating)
At the bottom of the setup: SIP Accounts -> New -> Leave most options blank -> See Presentation -> Custom -> Add string value

SIP headers showing Route options, and this is causing issues?
Remove the tick from "Use as outbound proxy".


PPI header shows IP of Registrar and not local MVO400?
Disable PPI/PAI by PPI/PAI header content = Supressed

No angle brackets (<>) in the To: header?
According to the RFC (https://www.rfc-editor.org/rfc/rfc8217.txt, p.2), angle brackets are only needed if comma, semi-colon, etc is part of the URI.
A normal To: sip:12345678@10.23.45.67 is acceptable.

DBC 4422 Headset port activate

Environment: DBC 4422 being used as OMD with NOW2007 and MX-ONE

Challenge: by default, when the NOW Operator answers a call, the telephone device answers on speaker.

To set the default answer mode to Headset: once logged in and operational, press and hold the headset key until a beep is heard.

OpenSUSE Leap 15 not booting Windows 10 (UEFI, GRUB)

With a recent installation of Leap 15, somehow the EFI folder for Microsoft was wiped - or it was never in the correct location to start with.

The link below worked best - unfortunately you do need to use a Windows installation disk to get to the rescue option.

Just one point to be added: the  "\Microsoft\Boot\" folders were not present in the EFI partition and thus the "bcdboot c:\Windows /l en-US /s b: /f All" command failed.

Use mkdir to create the directories. All else should work.


https://www.tenforums.com/bsod-crashes-debugging/24959-bsod-boot-0xc0000034.html