I apologize for inadvertently password protecting last night’s article about Nagios, Parent Hosts and traceroute on the
Internet. Somehow, my Iceweasel has the firm opinion to enter my Blog’s admin password in all form fields
labeled “password” on blog.zugschlus.de, and the article entry form happens to have one like that. And last
night, I forgot to delete it. Sorry.
Thanks to mika for making me aware of that.
Hello, please use https://joker.com/goto/support/ for all support inquiries. Regards, your Joker.com teamThis is complete and utter bullshit [2]. If a company is going to mail me, I expect to be able to mail them. I have a mail client; it manages communication the way I want it to, and runs my preferred editor to compose messages (which is, in fact, how I am writing this very blog post). I am sick of dicking around on JavaScript-requiring web forms that all work differently and typing in postage-stamp-sized little textareas. Anything I do type in them is lost, because unlike my email client, web forms don't save sent messages unless the authors feel like letting you have a Cc:. When a company forces me to do this, I take it as a sign of disrespect. I tolerate a web browser [3] for reading pages; "applications" are universally painful [4]. One of the things I used to like about Joker was the PGP mail interface. AFAIK, they have not killed it (I didn't bother to check), but with automatic "we don't want to listen to you unless you inconvenience yourself" bounces like this, what's the point? I surmise that there is, or was, some smart person there who understood how (and more to the point, why) to hook a pseudo-mailbox up to a software system, and that they have been overridden by someone in management who realized it's much easier to have dime-a-dozen webmonkeys hook a form up to the same system since 90% of users just don't care (and even people who do notice and dislike this, but are not as inflamed as I, have come to expect it because everyone else refuses mail, so, y'know, pick yr battles son, etc.). Not the sort of culture I put faith my in. The irony of it all was that I was registering this domain to run a service I had decided to create specifically because of another site refusing mail and directing me to an even lamer web form. That would take incoming mail and, you know... process it with software. Suffice it to say, I am no longer going to be their customer. In deciding who to use instead, I figured I'd do a survey of where the domains in that "Subscription" column [5] on Planet Debian were registered, but... WHOIS is basically useless. Every server just returns free text, formatted differently by (apparently) every implementation under the sun. Cheaply parsing something out from .com/.org/.net is possible, but InterNIC kindly blacklists your IP after making more than a few requests in a few minutes. I guess I'm just gonna go with Gandi (but other suggestions would be welcome). In somewhat unrelated developments, I went to nic.at to update my nameservers for Where the Bus At? last week. There was no authentication or anything on the request form, so I just filled it in and sent it off. I got some automatic mail saying I need to print out a PDF, sign it, and fax it internationally. Annoying, and hardly as secure as mailing them with PGP, but whatever. But then, also yesterday, I got another mail saying the update was complete (lo and behold, it was). I am now somewhat concerned about the security of my domain: it seems like anyone can come by and put something in the form and if I'm not around to notice the courtesy mail and ask that they stop the request, it'll eventually go through, no questions asked. I have not yet written them to figure out what the deal is, though. Kinda burned out. I guess I didn't really have high hopes for dealing directly with a ccTLD registrar (this was the first time I've done it... I can't believe I blew 60 on a cutesy domain name) rather than a reseller who competes in a market, but then, I go and google "domain registrar" and look at all the AdWords dollars spent trying to compete with GoDaddy [6] and just kind of want to put my head in my hands. On DJB's DNS pages there's this bit about setting up a domain. It doesn't say "How to (buy register whatever) a domain name". It says, "How to receive a delegation from .com". Which is of course, how it works. And what I want to buy. I don't want "parking" or even gratis nameservers. Just a delegation from .com. Please. No AdWords came up when I googled for that phrase to copy the link. Sometimes I guess markets just sink to the bottom. Anyway. I feel like there's a free-software angle here. My continuing irrational hatred of using other people's forms, web-based mailing-list substitutes, nameservers, etc. stems not so much from their suckage but from the fact that there is no longer any software there, in front of me, for the four freedoms to possibly apply to. Being able to run your mail reader for any purpose doesn't win you much if no one uses mail. I don't really know what to do about this.
| [1] | It was only twelve dollars! If I go to hipster market or some other place with brand-new POS systems they don't even make me sign a paper slip for less than $20 or so. But this is the sort of thing dreamed up by people who think good security is setting a cookie to denote that I've answered "what was your first dog's name" or whatever. IF YOU WANT TO BREAK INTO MY BANK ACCOUNTS: I've set the answer to every single one of these questions to "security theater". Easy to remember. |
| [2] | Not to mention a glaringly RESTless URI. |
| [3] | Also, as a rule I normally try not to have anything up on my desktop that I can't close and re-open at any time, thanks to screen, MPD, emacsclient, actually using my browser's bookmark function and resisting the lure of tab-bar.js, etc. Web browsers are supposed to suck at preserving state; HTTP is stateless. See also here (and for further reading on that in the Haskell world, check out Yi. I'm hoping to switch to it someday). |
| [4] | Debbugs, for example, may not have the slickest interface, but if I want to do flags, labels, archiving, threading, or whatever, I can; I'm not at the mercy of some front-end web developer. But we've all heard this litany before. |
| [5] | Thanks, Hpricot! |
| [6] | Even if GoDaddy's customer service were completely hacker-friendly, I would not use them, because their president Hates America. |
I have uploaded barry package to Debian some hours ago. It is still waiting for NEW processing, so if you want it you will have to download sources from Debian git repo, and compile the package yourself. It has just been accepted into the archive.
Barry is a GPL program that will allow you to charge your Blackberry through the USB port, to make backup copies of your device databases, manage contacts and use your BB as a modem.
So if you have a BlackBerry device, you can also enjoy it in Debian.
Update 26/10/2008: Barry has just been accepted into the archive, so you can get it in every Sid repository mirror. Thanks!
I haven’t been blogging this election at all recently — there are enough folks out there saying just about everything that should be said (and lots that shouldn’t), but I couldn’t let this little tidbit slip by without mention.Via the TaxProf blog:
Today my 5 years old laptop gave me some filesystem problem after running apt-get update, which resulted in some corrupted packages, among them libc6, with the result of my system becoming non-functional. So I needed a recovery CD to be able to mount read-only root partition.
I had around an Ubuntu 8.04 Hardy Heron LTS, so I used it to run its included LiveCD and recover from there. At the same time I was curious about it, as I hadn’t had chance to test it before. One of the things that surprised me most was that Compiz was enabled by default. After a second thinking that this was going to be a problem, making the system unusable (remember, a 5 years old laptop, and I had checked myself compiz some time ago with a catastrophic result), I started to meve windoes, jump from one virtual desktop to other, and minimiza and maximize windows without a problem. The work that had been made amazed me!
So, some fsck and apt-get commands after, I managed to reboot on my Debian system, and I installed compiz. The result: my system goes faster using compiz, with a bunch of effects enabled than running plain metacity window manager. I have a also installed some compiz fusion plugins, and they are running without a glitch and with an incredible speed. Obviously, I have not chosen full quality, but it is enough to show effects in an efficient way.
I have improved my user experience and system speed at the same time… Once again Linux shows that it can get the best of old hardware. Good work, guys!
Not much to say. Just that I am back, now with a mixed English-Spanish blog. I will try to keep entries written in Spanish out of syndicated feed on Planet Debian, but I won’t promise that some entry can slip. It has been long since I had no blog, so it will be a new challenge to try to update it somehow regularly.
Regarding my Debian work, I have to admit that I have become mostly a ‘package and upload’ guy. I don’t have enough spare time to devote to other tasks, so I will mostly try to keep my packages as clean as I can.
Not much to say. Just that I am back, now with a mixed English-Spanish blog. I will try to keep entries written in Spanish out of syndicated feed on Planet Debian, but I won’t promise that some entry can slip. It has been long since I had no blog, so it will be a new challenge to try to update it somehow regularly.
Regarding my Debian work, I have to admit that I have become mostly a ‘package and upload’ guy. I don’t have enough spare time to devote to other tasks, so I will mostly try to keep my packages as clean as I can.
Yesterday I attended a lecture by professor D.J. Bernstein, best known for his products like qmail, owner of one of the coolest domain names in the world and for his often controversial but always interesting visions.
His talk focused on why the majority of internet traffic still is not encrypted. We protect our email passwords but the 95% of other things we do is completely unprotected from a sniffer. He then narrowed it down to DNS. The problems with DNSSEC are evident and it's still a question of whether it will ever be implemented (after 15 years the design is still in flux, let alone that it's properly implemented or actually used).
On a more constructive side he presented his own solution: DNSCurve: using elliptic curve cryptography to not only sign but also encrypt DNS traffic, and do so on the fly rather than the cumbersome precomputation approach of DNSSEC. Bernstein shows that the extra cost of on the fly cryptography is, even for root servers, very minor compared to the costs of the entire system, but it does significantly reduce the administrative burden compared to DNSSEC. As usual he has made an interesting case, a worthwhile read.
Our friend Jaap is besides a mathematical researcher also an aviator. Last weekend he took Erik, Judith and me on a flight from Hoogeveen (EHHO) in Drenthe to the island of Ameland (EHAL). It's a really nice experience to plan the flight on the map, fly over land, the Waddensea and the North Sea, hear the radio communications; and the check-in was a lot more relaxed compared to EHAM (Schiphol). On the other hand the on-board catering left something to be desired.
Ever since my former desktop machine gsa died and
I started using only laptops at home, I noticed a need for a home
server for storing all my MP3s, holiday pictures, games, and backups
of my other machines. And I also want a filtering web proxy at home
again.
Current situation
Currently my Norhtec MicroClient Jr. “c2” with it’s 120 GB 2.5"
harddisk does some of these jobs (mostly storage and backup), but it
neither has the disk space nor the performance to do all the things I
want.
For storage I once bought a TheCus
N4100, the big brother of the popular and officially Debian
supported N2100.
Unfortunately there are a few things different than in the N2100 (NIC
without MAC) which makes it much more difficult to get Debian on
it and the original firmware doesn’t support NFS at all. *grmpf* I had hints from others who managed to
get Debian on this NAS, but I didn’t find the time and leisure to
really dig into cross-compiling kernels. (Although with the
new 1.3.06 firmware, so called modules became possible also for the
N4100 and a SSH
module has been posted with which a Debian chroot could be
installed and the required kernel build on the machine itself.)
I though wasn’t very angry when the N4100+ came out shortly after I bought the N4100, because the
N4100+ was no more an ARM based device but had a Celeron processor
inside instead. And a NAS which is built on average PC hardware wasn’t
as appealing as some device based on some more exotic architecture
mainly used in embedded devices. :-)
The Mini-ITX Appeal
This view changed rapidly, when Raffzahn showed me a few Mini-ITX boards and cases. I
surfed around on Mini-ITX.com store and stumbled upon the
NAS-like ES34069 case from Chenbro featuring four S-ATA hotswap 3.5"
slots, a slim-line CD-ROM drive slot, a SD card reader, and enough
space for an additional 2.5" hard disk and a low profile Mini-ITX
board.
Additionally, the VIA EPIA SN series of Mini-ITX boards sports 4 S-ATA ports and
either a passively cooled 1 GHz C7 processor or an actively cooled 1.8
GHz C7 processor. That should be enough power for a small
multi-purpose home server while still keep the power consumption low.
And I’m not the only one having this idea, Mini-ITX.com suggests this
combination and Chenbro officially supports the VIA EPIA SN
boards.
Additionally, Debian 5.0 Lenny seems to run fine on the SN series, only lm-sensors seems to have problems with SN18000G and SN10000EG
(but not SN18000 and SN10000E).
So when the Chenbro ES34069 case showed up in digitec’s online shop, I
ordered one there and a VIA EPIA SN18000G board at Brack. I didn’t
order any disks since for data storage I plan to use the four Samsung
400 GB 3.5" S-ATA disks I bought for the N4100, and for the
system I plant to use the 2.5" disk I initially bought for my
MicroClient JrSX “c1”, but then continued to use it only with the CF
card. Not yet sure, if I’ll also equip the slim-line optical drive
slot, too.
The case took several weeks to deliver and the mainboard hasn’t
arrived yet. Instead I got an e-mail from Brack that VIA products are
currently very difficult to get in Switzerland. Reason is said to be
that VIA tries to channel the distribution of their products to a
single distributor. (Sounds somehow similar to what Apple tried with
the iPhone and failed.)
Mini-ITX boards and power consumption
So I now have a nice case without a board. There aren’t that many
Mini-ITX boards out there sporting 4 S-ATA ports. One which cleary stood out was the new Intel DG45FC Mini-ITX board with LGA775 socket. (In Switzerland
neither available at Brack nor at digitec, but e.g. at PCP.) But
reading the specs of this board it was also clear that it wasn’t
thought for NAS systems but high-performance HTPCs — the focus
seems to be on multimedia performance which a NAS doesn’t need.
Its newer sister, the Intel DQ45EK Mini-ITX board is focussed more on office and business PCs
than on multimedia. But Intels remote adminstration is not really
a plus for me (don’t need it, I’ve got SSH ;-) and it’ neither cheaper
than the DG45FC nor has it significantly lower power-consuption.
Despite the 120W power-supply there are people who already combined
the Chenbro ES34069 with the Intel DG45FC or DQ45EK board, e.g. one of the administrators of the German NAS-Portal forums
built such a machine and this German guy who wants to build a Windows Home Server
based on such a combination. At least the NAS-Portal administrator
found out that the board consumes so much power that together with the
4 S-ATA disks the included 120W power supply doesn’t suffice and the
system is not stable in this configuration. Trusted Reviews review of the DG45FC explains why: It’s one of
the first Mini-ITX board not following the MoDT idea, has a desktop
chipset instead a mobile chipset and therefore hasn’t all of the
power-saving features of those mobile chipsets.
But it’s easy to see anyway: Most of the CPUs supported by the DG45FC
and DQ45EK boards have a TDP of 65W. Offically the processor cooler
delivered with the case supports processors with up to 65W, but 65W is
already more than the half of what the power supply delivers and
according to the Trusted Reviews review, the board itself consumes
another 35W itself. So for the four 3.5" S-ATA disks —
which are usually not as economical as notebook disks — about
20W are left. This can’t work! The guy from NAS-Portal.org plans to
solve the problem by using a universal 180W notebook power supply
instead of the original one.
In comparison to the 100W of the both Intel boards, VIA’s SN18000G
consumes only 26W (the fanless SN10000EG even only 22W) and that’s
board and processor! That’s about ¼ of what the Intel board
consumes. Imagine the difference between having a 100W light bulb
(suffices for a whole small room) shining 365 days a year compared to
a 25W light bulb (often used in bedside lamps) in a year.
Other Mini-ITX mainboards with 4x S-ATA include the following ones:
extremely restrictive BIOSand
poor fan control. (Another Review at TweakTown)
less than 100Wand a low TCO. But 100W are still too much for the 120W PSU. (German review at MiniTechNet)
A common way to debug a network server is to use 'telnet' or 'nc' to
connect to the server and issue some commands in the protocol to verify
whether everything is working correctly. That obviously only works for
ASCII protocols (as opposed to binary protocols), and it obviously also
only works if you're not using any encryption.
But that doesn't mean you can't test an encrypted protocol in a
similar way, thanks to openssl's s_client:
wouter@country:~$ openssl s_client -host samba.grep.be -port 443
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify return:1
---
Certificate chain
0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDXDCCAsWgAwIBAgIJAITRhiXp+37JMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5ncmVwLmJlMR0wGwYJKoZI
hvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTAeFw0wNTA1MjEwOTMwMDFaFw0xNTA1MTkw
OTMwMDFaMH0xCzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQH
EwhNZWNoZWxlbjEUMBIGA1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5n
cmVwLmJlMR0wGwYJKoZIhvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAsGTECq0VXyw09Zcg/OBijP1LALMh9InyU0Ebe2HH
NEQ605mfyjAENG8rKxrjOQyZzD25K5Oh56/F+clMNtKAfs6OuA2NygD1/y4w7Gcq
1kXhsM1MOIOBdtXAFi9s9i5ZATAgmDRIzuKZ6c2YJxJfyVbU+Pthr6L1SFftEdfb
L7MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUtUK7aapBDaCoSFRWTf1wRauCmdowgbAG
A1UdIwSBqDCBpYAUtUK7aapBDaCoSFRWTf1wRauCmdqhgYGkfzB9MQswCQYDVQQG
EwJCRTEQMA4GA1UECBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNV
BAoTC05peFN5cyBCVkJBMRQwEgYDVQQDEwtzdm4uZ3JlcC5iZTEdMBsGCSqGSIb3
DQEJARYOd291dGVyQGdyZXAuYmWCCQCE0YYl6ft+yTAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4GBADGkLc+CWWbfpBpY2+Pmknsz01CK8P5qCX3XBt4OtZLZ
NYKdrqleYq7r7H8PHJbTTiGOv9L56B84QPGwAzGxw/GzblrqR67iIo8e5reGbvXl
s1TFqKyvoXy9LJoGecMwjznAEulw9cYcFz+VuV5xnYPyJMLWk4Bo9WCVKGuAqVdw
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1428 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: 65E69139622D06B9D284AEDFBFC1969FE14E826FAD01FB45E51F1020B4CEA42C
Session-ID-ctx:
Master-Key: 606553D558AF15491FEF6FD1A523E16D2E40A8A005A358DF9A756A21FC05DFAF2C9985ABE109DCD29DD5D77BE6BC5C4F
Key-Arg : None
Start Time: 1222001082
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
HEAD / HTTP/1.1
Host: svn.grep.be
User-Agent: openssl s_client
Connection: close
HTTP/1.1 404 Not Found
Date: Sun, 21 Sep 2008 12:44:55 GMT
Server: Apache/2.2.3 (Debian) mod_auth_kerb/5.3 DAV/2 SVN/1.4.2 PHP/5.2.0-8+etch11 mod_ssl/2.2.3 OpenSSL/0.9.8c
Connection: close
Content-Type: text/html; charset=iso-8859-1
closed
wouter@country:~$
As you can see, we connect to an HTTPS server, get to see what the
server's certificate looks like, issue some commands, and the server
responds properly. It also works for (some) protocols who work in a
STARTTLS kind of way:
wouter@country:~$ openssl s_client -host samba.grep.be -port 587 -starttls smtp
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify return:1
---
Certificate chain
0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDBDCCAm2gAwIBAgIJAK53w+1YhWocMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFjAUBgNVBAMTDXNhbWJhLmdyZXAuYmUwHhcNMDgw
OTIwMTYyMjI3WhcNMDkwOTIwMTYyMjI3WjBgMQswCQYDVQQGEwJCRTEQMA4GA1UE
CBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNVBAoTC05peFN5cyBC
VkJBMRYwFAYDVQQDEw1zYW1iYS5ncmVwLmJlMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQCee+Ibci3atTgoJqUU7cK13oD/E1IV2lKcvdviJBtr4rd1aRWfxcvD
PS00jRXGJ9AAM+EO2iuZv0Z5NFQkcF3Yia0yj6hvjQvlev1OWxaWuvWhRRLV/013
JL8cIrKYrlHqgHow60cgUt7kfSxq9kjkMTWLsGdqlE+Q7eelMN94tQIDAQABo4HF
MIHCMB0GA1UdDgQWBBT9N54b/zoiUNl2GnWYbDf6YeixgTCBkgYDVR0jBIGKMIGH
gBT9N54b/zoiUNl2GnWYbDf6YeixgaFkpGIwYDELMAkGA1UEBhMCQkUxEDAOBgNV
BAgTB0FudHdlcnAxETAPBgNVBAcTCE1lY2hlbGVuMRQwEgYDVQQKEwtOaXhTeXMg
QlZCQTEWMBQGA1UEAxMNc2FtYmEuZ3JlcC5iZYIJAK53w+1YhWocMAwGA1UdEwQF
MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAAnMdbAgLRJ3xWOBlqNjLDzGWAEzOJUHo
5R9ljMFPwt1WdjRy7L96ETdc0AquQsW31AJsDJDf+Ls4zka+++DrVWk4kCOC0FOO
40ar0WUfdOtuusdIFLDfHJgbzp0mBu125VBZ651Db99IX+0BuJLdtb8fz2LOOe8b
eN7obSZTguM=
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1707 bytes and written 351 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : DHE-RSA-AES256-SHA
Session-ID: 6D28368494A3879054143C7C6B926C9BDCDBA20F1E099BF4BA7E76FCF357FD55
Session-ID-ctx:
Master-Key: B246EA50357EAA6C335B50B67AE8CE41635EBCA6EFF7EFCE082225C4EFF5CFBB2E50C07D8320E0EFCBFABDCDF8A9A851
Key-Arg : None
Start Time: 1222000892
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
250 HELP
quit
221 samba.grep.be closing connection
closed
wouter@country:~$
OpenSSL here connects to the server, issues a proper EHLO command,
does STARTTLS, and then gives me the same data as it did for the HTTPS
connection.
Isn't that nice.
... might be due to a bug in Sun Java 6. Try upgrading to
Java 6
Update 10 release candidate (also known as 'beta') or using a different
Java VM such as IBMs or GNU. Worked for me.Bug
reported in Feb 2008 and
Bug
reported in Oct 2008 at Sun (note: they are marked as 'fix delivered'
but that includes beta releases such as the 6u10RC linked above.
The biggest competitor to our telephone service, BT, increase their connection charge to 7p per call tomorrow (16 September 2008) for many customers (thanks to MSE for the news).
However, our telephone service’s basic prices remain 4.7p per call for up to 1 hour (then 1.175p/minute) for Evening & Weekend Local and National calls and 2.94p/minute Daytime Local and National Calls, with no set-up charge.
BT’s prices for 1471, 1571, ringback, alarm calls and 3-way calling are also increasing. What are they playing at? It says these price rises are “in order to stay competitive”. Huh? Increased competition but still raising prices - it’s almost like they want to stay competitive by not having any customers who read their bills! I guess then they’ll be able to charge what they like, pretty much. 5 per call, anyone? And Phorm would get through pretty easy if they only have negligent customers…
People frequently ask me what I am doing typing on my Palm right before logging in one of my remote systems. The answer is quite simple: generating my next password . People always seem puzzled by that answer Maybe I am just too old to have had only telnet sessions available to remote connections (that was the time before SSH took over)... or maybe I am just too paranoid regarding the access to my systems Anyway, I like One Time Passwords, and here is an article I can refer to when I get asked again ;-)
One Time Passwords are just that: passwords that are good for one time use. They never repeat and once used you can throw it away securely. They were quite common when the authentication was done in clear text (so that any man-in-the-middle could steal your passwords), back in the r-tools age (rcp, rsh, rlogin, rexec, etc). After the SSH-related tools took over, providing easy tunneling and remote access, MITM attacks were of much concern, so OTPs became less relevant. What a shame, for they even have a couple of standards for those!
But there s still room for OTPs Question: Is it easier to deploy a MITM attack or a keylogger? That s right We are always connecting to our remote systems in public terminals (well at least I am right now typing from the hospital computer), and a keylogger is so easily installed in one of those terminals, even remotely, that no one would ever get close to deploy a refined MITM attack just to steal someone s password. One would just install a keylogger! All the security SSH provides would just be gone by then. That s why I use SSH to connect to my remote machines, but use OTPs to authenticate myself.
It s so easy to deploy it. In Debian you ll find packages opie-server and libpam-opie and those are the only things you ll need on the server side (besides SSH, obviously). OPIE means One-time Passwords In Everything , and combined with PAM, one can really use it everywhere.
After installing it, you ll have to generate the password file for your account:
spectra@home:~$ opiepasswd -c
Adding spectra:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID spectra OTP key is 499 ho6484
HAVE COOK LOLA AIRY NEIL ROAM
# /etc/pam.d/ssh
auth required pam_env.so
auth required pam_env.so envfile=/etc/default/locale
auth required pam_opie.so
ChallengeResponseAuthentication yes
spectra@hospital:~$ ssh home
otp-md5 498 ho6484 ext, Response:
spectra@home:~$
spectra@home:~$ opiekey -n 10 498 ho6484
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
489: CALM INTO WEEK APS LOON VIE
490: HASH GYM RAID GOSH HOYT DUAL
491: BELL GIN RIFT HELM GUY BUNK
492: HEBE OBOE SUP LEG LULU LANG
493: HOYT JOT ASK JOG GIBE BETH
494: NASH MOOT HIND YEAH YAP CARL
495: MATE OF BARD LAVA LEAK AHOY
496: TAB BAG KEY GILT AVID VEAL
497: MOLE FORM NIB LEER ROSS HAVE
498: SING WERE OVEN SOD VEIN NIBS
function FindProxyForURL(url, host)
var google = /https?:\/\/([^/]*\.)?google\.[a-z]*($ \/)/;
var tor = /https?:\/\/([^/]*)\.(exit onion)($ \/)/;
if (google.test(url))
if (shExpMatch(url, "*.google.com/mail*"))
return "DIRECT";
return "PROXY 127.0.0.1:8118";
if (tor.test(url))
return "PROXY 127.0.0.1:8118";
if (shExpMatch(host, "config.privoxy.org"))
return "PROXY 127.0.0.1:8118";
return "DIRECT";
and point your browser to it.+client-header-filter hide-tor-exit-notation .exit +filter js-events +crunch-all-cookies .google./(search blogsearch scholar images)And don't forget to reload privoxy.
For the last few days I’ve been in the city Badajoz in region Extremadura of Spain at the FAI developer meeting. Check out the Linex Euronews Video at youtube to get a short impression of Linux in the region.
Lessions learnt:
Next.