↓ Skip to main content

Christoph Stoettner

I work at Vegard IT as a senior consultant, focusing on collaboration software, Kubernetes, security, and automation. I primarily work with HCL Connections, WebSphere Application Server, Kubernetes, Ansible, Terraform, and Linux.

My daily work occasionally leads to technical talks and blog articles, which I share here more or less regularly. You can find my presentations in the main menu under Public Speaking.

This is my private blog, all opinions are my own.

Link Collection #

I save links I want to read later or store because they are interesting in Linkding. If you’re interested in my shared links, check this link in your browser.

Why Is The Domain Name Stoeps?
#

This is a very old story and it started in school. Stoeps was just my nickname and I have kept it ever since.

Contact
#

  • PGP Key Fingerprint: 641C D2C7 4596 010D 5843 4863 7704 D09C E996 50FC
    Mail address: christoph.stoettner (at) stoeps.de
  • Signal
    • stoeps.13
  • Matrix
    • @stoeps:nope.chat
  • Threema
    • MBXU92A6

Copyright #

Credits
#

This blog is generated with Hugo and uses:

Guide to Reproducing and Logging JavaScript Issues: Persistent Console & HAR Capture (Edge, Chrome, Firefox)

·593 words·3 mins
Tools I Use Browser Developer Tools Firefox Chrome
HCL Connections heavily relies on HTML and JavaScript. When troubleshooting issues, administrators or support teams may struggle to reproduce problems. Providing console logs and HAR (HTTP Archive) files directly from your browser session can offer crucial insights, helping to diagnose and resolve issues more effectively.

Encrypt Customizer Traffic in HCL Connections Component Pack

·466 words·3 mins
HCL Connections IBM HTTPServer Proxypass Ingress Component Pack Hclcnx Hcl Connections
Warning The is just a proof of concept and shouldn’t be used in production! I still have some issues with redirects to the new hostname. In the series of encrypting network traffic within HCL Connections and Component Pack: Encrypt IHS Proxypass Traffic To Component Pack Securing Redis Traffic in HCL Connections with SSH Tunnels the customizer part is missing. In a default configuration (or when you install as documented), the traffic from IHS and NGINX that is forwarded to the customizer (mw-proxy) and Ingress is unencrypted.

Gatekeeper Flag FILES_ENABLE_CONTINUOUS_SCROLLING removed in Connections 8.0CR11

·311 words·2 mins
HCL Connections Hclcnx Files Gatekeeper 8.0CR11
Some years ago Connections Files changed the catalog view from paginated view to continuous scrolling. This had two caveats: On large monitors (4k for example) only 10-20 files appear and the trigger to start loading more files to complete the list is not working Feed icon (Feed for these Files) to copy the RSS feed URL is hard to get on large file catalogs (scrolling starts, and you can’t right-click to copy)

FrOSCon 20

·306 words·2 mins
Conference Linux Froscon Talk
This weekend I attended FrOSCon, an open source event in St. Augustin / Bonn, Germany. On Saturday around lunch time there was a new visitor record of 1200. I don’t know how many more came in the afternoon and on Sunday.

Encrypt IHS proxypass traffic to Component Pack

·837 words·4 mins
HCL Connections IBM HTTPServer Proxypass Ingress Component Pack Hclcnx Hcl Connections
I’m still working on encrypting all network traffic between Connections and Component Pack servers. This time I checked the Ingress-Nginx Controller - TLS/HTTPS documentation. The default configuration for connecting IHS with Component Pack uses the plain HTTP port 32080. All traffic like /social or the Tailored Experience wizard is routed from IHS to Kubernetes on port 32080. Our target is to encrypt the traffic on port 32443.

Managing External Dependencies with Chezmoi

·512 words·3 mins
Tools I Use Chezmoi Dotfiles Download
I use chezmoi for my dotfiles. To find out why and how to get started, check out my talk from Chemnitz Linux Days 2025. Within chezmoi, you can use the file .chezmoiexternal.toml to download archives or git repositories during updates. This is particularly useful for managing external dependencies. Let me walk you through some common use cases.

Job Requirements

·455 words·3 mins
Requirements for a new job (wishlist) # Hello, I’m not actively seeking new opportunities at this time.

Indefinitely growing homepage.sr_index_docs table and forgotten search nodes

·262 words·2 mins
HCL Connections Connections Sr_index_docs Homepage Index Search
The last weeks I had twice the issue of a huge homepage database with HCL Connections. Both systems weren’t installed by me, but I reviewed them. So I know this issues quite well since I faced it the first time years ago. This always happens when you migrate Connections environments side-by-side, and you forget to remove the old search nodes.

Disable PDF Export in HCL Connections 8

·204 words·1 min
HCL Connections Hcxt Icxt Ic360
I had some issues with PDF export functionality in HCL Connections the last weeks. The server became unresponsive multiple times due to high load from PDF exports. To quickly address the issue, the simplest solution is to disable the PDF export feature by configuring the icxt.pdfexport.access.requiredrole property in the Resource Environment Entries.

Automate screenshots of web pages with Eyewhitness

·718 words·4 mins
Tools I Use HCL Connections Automation Screenshots
This week, I investigated an issue with the advanced profiles search in HCL Connections. I had a system which did not show any results in the advanced search for the department number of Connections profiles. HCL support tried for three months to reproduce the issue, and the users missed the option to search for their teammates with the advanced profiles search.

Chemnitz Linux Days 2024

·103 words·1 min
Conference Linux Chemnitz
This year marked my inaugural attendance at the Chemnitz Linux Days. The experience was fantastic, and I had the pleasure of connecting with numerous intriguing individuals. Chemnitz Linux Days stands out as one of the premier events in the Linux and open-source community. With 3,200 attendees this year, participants had the opportunity to engage with a diverse array of topics through 94 talks and hands-on workshops.

Security Directory Integrator connecting to Active Directory LDAPS

·769 words·4 mins
HCL Connections Hcl Hclconnections Hclcnx Sdi Ad Tdi Ldaps
I had one Connections’ environment that I wanted to switch from OpenLDAP to Active Directory LDAP. The old OpenLDAP environment used LDAPS to connect, and so I assumed that the change was done quickly. The first step was to make a copy of the tdisol folder I used for OpenLDAP and start changing the configuration files for the new LDAP server.

Migrate MongoDB in HCL Connections Component Pack 8

·1333 words·7 mins
HCL Connections Hcl Hclconnections Hclcnx Mongodb
The official documentation, “Migrating data from MongoDB 3 to 5”, wants to dump the MongoDB databases in 3.6 and then restore this data into the newly deployed MongoDB 5. One issue with this process is that we can’t run the two MongoDB versions in parallel on Kubernetes because the provided helm charts and container for MongoDB 3.6 stop running after Kubernetes 1.21. On the other side, the helm chart providing MongoDB 5 can’t be installed on those old Kubernetes versions. So the process to update is:

Windows change display resolution with one click

·215 words·2 mins
Tools I Use Windows Tools Tiu
I spend the entire day working on a very sizable 4k UHD display, and I frequently ran into the problem of wanting to share my screen with participants in various collaboration tools. Then, viewers claim that my screen is too small on the remote displays due to the display resolution of 3840x2160 pixels.

Matrix Channel

·306 words·2 mins
Tools I Use Opensource Chat Matrix
The last months I played around with Matrix, a secure and open collaboration system. The protocol looks very promising, it allows hosting your own server and federate it to other systems. So like SMTP, all these matrix users can communicate to each other.

Update Elasticsearch certificates in Componentpack

·464 words·3 mins
HCL Connections Certificate Security Elasticsearch Documentation
Elasticsearch in HCL Connections Componentpack is secured with Searchguard and needs certificates to work properly. These certificates are generated by bootstrap during the initial container deployment with helm. These certificates are valid for 10 years (chain_ca.pem) or 2 years (elasticsearch*.pem) and stored in the Kubernetes secrets elasticsearch-secret, elasticsearch-7-secret. So when your HCL Connections deployment is running for 2 years, the certficates stop working.

Backup Elasticsearch Indices in Component Pack

·1226 words·6 mins
HCL Connections Elasticsearch Backup Metrics Hcl Connections
During a migration from Cognos Metrics to Elasticsearch Metrics, I had some issues with the index. So I wanted to create a backup of the already migrated data and start over from scratch. The official documentation has an article on the topic: Backing up and restoring data for Elasticsearch-based components, but I had to slightly adjust the commands to get a successful snapshot.

Fix some annoyances with Customizer

·403 words·2 mins
HCL Connections Customizer Connections Hclcnx
I created a git repository with some smaller CSS files to fix some annoyances within HCL Connections. I started with this to prevent Orient Me to load fonts from external URLs or Elasticsearch Metrics to break the UI on larger screens. These issues are solved after the last updates I got from support, but Blogs and Tailored Experience Wizard can be improved with some simple rules.

Dachnug49 in Constance

·232 words·2 mins
Conference Hcl Connections Hclcnx
The annual conference of DNUG took place in Constance from 22nd to 23rd of June 2022. I attended the HCL Connections Roadmap session given by Rene Schimmer and David Strachan. They showed the updates for version 8 and beyond.

Elasticsearch7 Update

·478 words·3 mins
HCL Connections ComponentPack Elasticsearch Update
CVE-2021-44228 was a very serious problem end of 2021, and we are still finding new occurrences, or security teams scan servers and find vulnerable log4j files. Don’t get me wrong most of these occurrences are not vulnerable any more, because the JVM is hardened like in the Elasticsearch 7 containers, or they use of the JVM parameter -Dlog4j2.formatMsgNoLookups=true.

KB: PushNotification broken after upgrading to CFix.65CR1.2201

·172 words·1 min
HCL Connections Hclcnx Pushnotification Cfix
Yesterday I updated a Connections environment to the latest CFix. In other environments I found that PushNotification Cluster was not started after the update, like described in the knowledge base document PushNotification broken after upgrading to CFix.65CR1.2201. In this update the application and cluster were running, but not working at all. Browser console.log showed the error: Error connecting to push auth sync service /servic/info: RequestError: Unable to load https://cnx-fqdn/push/service/info status: 500

Change the Connections editor on the fly

·256 words·2 mins
HCL Connections Hclcnx Editor Tiny
When I test topics with the different Connections editors (CKEditor, Textbox.io and TinyMCE), I always used multiple users in my test environment, installed the editor selector ear and then gave each of the test users a different editor. That’s easy with the different j2ee roles, but I always had to use multiple browsers or sandboxes to see them next to each other.

Patch Orient Me Container

·997 words·5 mins
HCL Connections Component Pack Orient Me Hcl Connections
I wrote about font loading from external CDN in the post Hiding The Create Community Button 2nd last year and hoped this is finally fixed for all Connections applications. A good summary on the reasons to not allow external font loading is Blocking Web Fonts for Speed and Privacy. So I checked with a Connections 7 deployment with the latest CFix (CFix.70.2112) deployed, if this is still an issue with Connections. In former Connections’ versions we found external fonts loaded in Orient Me (/social), Communities Catalog (/communities) and the Admin panel (/cnxadmin/).

Log4j how to find out if an application has it included

·933 words·5 mins
Security Log4shell Log4j Vulnerabilities Cve Cve-2021-44228
Update 2021-12-13 2021-12-15 Elasticsearch: Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 HCL: CVE-2021-44228 : Security Advisory IBM: Security Bulletin: Vulnerability in Apache Log4j affects WebSphere Application Server (CVE-2021-44228) Security Bulletin: HCL Connections Security Update for Apache Log4j 2 Vulnerability (CVE-2021-44228) CVE-2021-45046: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. So there is a fix for kc.war which updates the log4j 2.8 to 2.15, Elasticsearch in Component Pack has log4j 2.8 and 2.11 included but is not vulnerable because of additional security settings.

Connections Desktop Plugins Password Save Policy

·247 words·2 mins
HCL Connections Plugins Windows Registry Documentation
During the latest automated deployment of the HCL Connections Desktop Plug-ins for Microsoft™ Windows™, I had issues activating the Password Save Policy. We wanted to disable the option that users can save passwords. The documentation tells us, that the registry key HKLM\SOFTWARE\Wow6432Node\IBM\Social Connectors\Settings\Password Save Policy needs to be set to 1 to achieve this.

Create your first installation with Ansible

·1297 words·7 mins
Infrastructure Ansible Infrastructure Galaxy
In the post Create A Test Environment with Terraform and KVM I created the first three virtual machines, now we configure a DNS server so name resolution works as expected. Since HCL Connections started to add Kubernetes to the stack, we need to use proper name resolution instead of just editing /etc/hosts. That’s a bit of an effort, but in the end it is way easier than checking several hosts if the hosts file is uptodate.

Upload Files via IBM HTTPServer (mod_ibm_upload) to HCL Connections

·927 words·5 mins
HCL Connections Hcl Connections IHS IBM HTTP Server
The last days I analyzed an issue, that file uploads to HCL Connections via IBM HTTPServer stopped working on a fresh installed 6.5CR1. Today I configured a Connections 7 and tried with it. I think that the official documentation is old in some important parts for the upload configuration. First of all my IBM HTTPServer 8.5.5.18 is not 32-bit like the documentation tells us:

HCL Connections Newsletter v2 and Join Community requests

·448 words·3 mins
HCL Connections Hcl Connections Newsletter
Since IBM Connections 6.0CR4 we can use a new newsletter format which needs still (now with HCL Connections 7) be activated separately in LotusConnections-config/notification-config.xml. Today some users asked how they can add other users to their private communities (visible in Community catalog) without manually adding them. As we investigated the question I had a look at the old notification format.

Show Community Create Button only to users with role "community-creator"

·275 words·2 mins
HCL Connections Hcl Connections Communities Documentation
Since the update to the new HCL Connections Community Card-Based Overview (Connections 6.0 CR4) I search for a way to hide the button “Create Community” from users without the role “Community-Creator”. This was always possible in the earlier versions of Connections, but the button was shown always since the update. During the year I mostly forgot about it, but yesterday I opened a case with HCL Connections Support and got immediatly following answer:

Makefile to process all Asciidoctor files in a directory

·260 words·2 mins
Markup Asciidoctor Make
I write most of my documents (blog posts, documentation, recipes and so on) with Asciidoctor. Everything is organized in Git repositories. During GPN 19 (Gulaschprogrammiernacht) I showed how to build html and pdf with a Gitlab CI/CD pipeline. That’s quite handy, but lots of documents I build, I just need locally. So today I played with WSL2 and a Makefile to build all Asciidoctor files in a directory.

Update on the Touchpoint workaround (Updated)

·429 words·3 mins
HCL Connections Hcl Connections Touchpoint
Some weeks ago I wrote about an workaround to prevent TDI from deleting the touchpoint status in HCL Connections. During some research on TDI I found Mapping fields manually in the HCL Connections documentations. This document describes how to add additional fields to the TDI synchronisation. On point 11 I found something new for me. You can add additional fields and then add the content with an Javascript function for example.

Linkdump Week 44 / 2020

·242 words·2 mins
Linkdump 2020
Last week I didn’t find very useful links to read or articles to share. This week I read more books, so a recommendation for a book this week and two articles with awk basics. https://www.packtpub.com/product/the-kubernetes-workshop/9781838820756[The Kubernetes Workshop icon:external-link[], window=_blank]:: Still preparing for CKA, so I read a lot around Kubernetes. This book is brand new and the first chapters are already useful. I think it’s more detailled than the books I read about Kubernetes before.

Linkdump Week 42 / 2020

·270 words·2 mins
Linkdump 2020
https://mkaz.blog/working-with-vim/vimwiki/[VimWiki – Working with Vim – mkaz.blog icon:external-link[], window=_blank]:: I switched for daily notes and diary entries to Vimwiki. I like the fast access and combine it with gollum to display in the browser. In the article you find shortcuts and tipps for working with the todo function.

Linkdump Week 41 / 2020

·403 words·2 mins
Linkdump 2020
Another week is over, for a quite busy one. I’m still working on automating HCL Connections installation and think about creating pytests for these deployments. So here is the this weeks mix of my bookmarks, tools I used and articles I found interesting. https://wizardzines.com/comics/bash-errors/[BASH errorhandling - wizard zines icon:external-link[], window=_blank]:: Good intro on Bash errorhandling from Julia Evans

Linkdump Week 40 / 2020

·382 words·2 mins
Linkdump 2020 Hacktoberfest Intigriti Matrix Git
It is Linkdump time again. I fixed some things during the week, so my https://github.com/Shaarli/Shaarli[Shaarli instance] can use the API now. I do a lot of research and reading on mobile devices (tablet and phone). Now I can share important articles through https://stakali.toneiv.eu/[Stakali], add short notes and do followups on my other devices (tablet, computer). To automate the linkdump posts, I created a short https://gitlab.com/stoeps/shaarli2hugo[Python script to collect my saved bookmarks] (marked with the tag linkdump) and create an asccidoc document for my hugo instance. So I can do a quick review and post it.

Selfhost Shaarli

·431 words·3 mins
Tools I Use Selfhosting Shaarli Bookmarks Opensource
I use Shaarli since ages to collect links, notes and bookmarks. I worked a little bit on that collection and started to share some as public lists. On my mobile device I bought a license for Stakali, it fits perfectly into my workflows. I often search on my mobile and share the link through Stakali to my desktop. Stakali just needs the URL and the API Key of Shaarli, but I got errors. So I analyzed the source and app with:

Touchpoint in HCL Connections 6.5CR1

·481 words·3 mins
HCL Connections Hcl Connections Touchpoint
HCL included some additional apps with HCL Connections 6.5CR1. One of them is Touchpoint, which can be used to present users the “Terms and Conditions” (or Privacy and Guidelines) of the environment and some help creating their profile, network and become member of their first communities. Touchpoint writes some profile extension entries in the PEOPLEDB database in the table PROFILE_EXTENSIONS, most important:

DNUG Connections Day 2020

·444 words·3 mins
Conference DNUG Hcl Connections Kubernetes Container
This week I attended the DNUG Connections Day 2020 in Munich. First of all I need to thank the organization team which did a really good job (Thanks Andreas , Martti and Lara ). During the short breaks we had great conversations with parts of the HCL Developer team and other attendees. Update I completely forgot to mention Jörg Rafflenbeul ! He was responsible for beer steins, a great glass of quits jar, photos, videos and a ton more. Sorry Joerg and thank you!

Walkthrough: Vulnhub - DC: 1

·881 words·5 mins
Walkthrough Vulnhub Linux Walkthrough
Link to Vulnhub DC Challenges Original Description DC-1 is a purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing. It was designed to be a challenge for beginners, but just how easy it is will depend on your skills and knowledge, and your ability to learn.

Automate hugo

·736 words·4 mins
Markup Hugo Blog
Mid 2018 I switched my blog from Wordpress to Hugo. Main reason was performance and that I can use Asciidoctor to write the posts. What happened the last 18 months? I stayed with the theme I selected 2018, but I tweaked it a little bit. So I added lunr to implement searching, changed all scripts and fonts from CDN to local (privacy and tracking), updated Bootstrap 3 to 4. Working with Bootstrap was quite fun, I haven’t done a lot of HTML or CSS the last years, but the grid and css classes from Bootstrap are working without checking each change on all browsers and are responsive.

Linkdump 1/2019

·303 words·2 mins
Linkdump Linkdump Reading
First linkdump 2019, it was a busy year until now, with a lot of new topics and tools. Here is a short list of posts and articles I have read the last weeks. A quite interesting tool (basic css) for quick web pages: kognise/water.css