twisla/roro9stack
Public Access
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Releases 25 Activity

Shell: tls, ntp and netstat (#90)
CI / build (pull_request) Successful in 1m49s
Details
Site / build (pull_request) Successful in 10s
Details

Browse Source 
The rest of the issue's list. tls makes a handshake that checks nothing,
then says the certificate in words: who it is for, who signed it, until
when, and whether this device's roots and the name asked for accept it,
with the reason when they don't. ntp compares a time server's clock with
the device's. netstat lists what listens and what is connected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT
This commit is contained in:
twisla
2026-10-08 02:54:59 +02:00
co-authored by Claude Opus 5.5
parent 9b6457d1ec
commit 9808013fc0
12 changed files with 395 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/content/howto/network-check.md
+30
View File
@@ -41,6 +41,36 @@ Open the [Shell](/guide/shell/) and go down this list. Each step says what a goo
6. **`traceroute <host>`**: where does it stop? The last router that answers is the last one that works.
7. **`tls <host>`**: a secure connection fails ("TLS error")? This shows the certificate and the verdict:
```
tls: git.twis.la:443 answered in 709 ms
tls: for git.twis.la, by YE2
tls: valid 2026-09-15 to 2026-12-14, 67 days left
tls: this device trusts it
```
"NOT trusted here" comes with the reason: **expired**, **not for that name**, or **not signed by a root this device has**. The last is normal for a Gemini capsule, which signs its own certificate, and a problem for an update server. It needs about 70 KB of free memory: close IRC first if it says so.
8. **`ntp`**: is the clock right? A clock that is wrong by more than a few minutes breaks secure connections and the VPN.
```
ntp: pool.ntp.org (195.72.61.39), stratum 2, 50 ms away
ntp: this clock is right, to 0.1 s
```
## What is the device itself offering?
`netstat` lists what it listens on, and who is connected:
```
netstat: tcp 3232 listens (updates)
netstat: tcp 2323 listens (Debug Console)
netstat: tcp 172.16.42.25:2323 - 172.16.42.249:51858
```
The update port is always there (updates are signed). The Debug Console and sharing appear only while you have them on.
## With the VPN up
- `ifconfig` shows the `vpn` line, and "default route" on it if everything goes through.