DIASPORA* as a blog I'm testing out DIASPORA* , the open-source social network, as a blogging platform. Apologies to those who see bad output on Planet Debian - I'm working on the issues as you read. It is possible to add comments to a post : it just requires a Diaspora account (on the post page, log in and create an account. This is on my home "pod", running on an old server at home, so don't be suprised at the speed). Failing that, my Debian email is available, mckinstry at debian.org.

Dear Lazyweb, I'm building a #debian package, CDAT. The latest version 6.0.alpha uses CMAKE to build, rather than configure. The trouble is that CMake doesn't build. It doesn't even fail. $ mkdir build $ cd build $ cmake .. ()-- Configuring done -- Generating done -- Build files have been written to: /home/amckinstry/deb-packages /cdat/cdat-6.0.alpha/build $ make $ The problem is, 'make' does nothing. A Makefile is generated by CMake, which calls cmake which calls make again on ./CMakeFiles/Makefile2 ... which does nothing useful. Apparently the CMake is supposed to put useful stuff in there, but doesn't. What puts stuff into Makefile2, and where should I pick up the bugs trail? (It would appear I also have issues with DIASPORA*'s Markdown over RSS to fix ...)

#### Debugging CMake issues #### Dear Lazyweb, I'm building a #debian package, [CDAT](http://bugs.debian.org/584637). The latest version 6.0.alpha uses CMAKE to build, rather than configure. The trouble is that CMake doesn't build. It doesn't even fail. $ mkdir build $ cd build $ cmake .. <lots of output, ending in ...> ()-- Configuring done -- Generating done -- Build files have been written to: /home/amckinstry/deb-packages /cdat/cdat-6.0.alpha/build $ make $ The problem is, 'make' does nothing. A Makefile is generated by CMake, which calls cmake which calls make again on ./CMakeFiles/Makefile2 ... which does nothing useful. Apparently the CMake is *supposed* to put useful stuff in there, but doesn't. *What* puts stuff into Makefile2, and where should I pick up the bugs trail?

Manipulating meshes and lights is nice, but sometimes we want to manipulate the good old pixels, in particular for post-processing effects such as blur. But how can we do that in OpenGL? In this new OpenGL wikibook tutorial, we'll explore a solution: render to a texture through a framebuffer object! http://en.wikibooks.org/wiki/OpenGL_Programming/Post-Processing For our first effect, we'll implement the wave system previewed a few days ago in the video capture tutorial.

Jean-Yves Lefort s link-monitor-applet, an applet for the GNOME panel, is a great tool for those with often-changing and possibly unreliable network connection. It allows me to see, at one glance, whether I can reach the router, the internet and/or my VPN. Furthermore, the latency display tells me whether there is a point in working over SSH right now. I often observe other people, e.g. on conferences, to stare for a while at a non-loading web page, then fire up a terminal window and run random ping commands, while I immediately see that the network is down and can relax. Unfortunately, Jean-Yves seems to have stopped working on link-monitor-applet and does not reply to bug reports. This was not a big deal as long as I could use the last released version with minor patches of mine, but now gnome-panel 3 is coming up and all applets need porting to GTK3. Yesterday and today I worked on that, and got it so far that the applet is fully functional, although the visual styling is not perfect yet, because I m not sure how to do what Jean-Yves did with GtkStyle and GdkGC now with GtkStyleContext and Cairo. The code is in the gnome3 branch of my git repository.
For this issue, and any further maintenance work, I m looking for someone who is willing to take upstream responsibility for link-monitor-applet, e.g. making sure it works with the latest GNOME (well, GNOME in fallback mode) and that bug reports are handled. The code base is not too big, and both the non-standard build system and the gob-enhanced C code are fine to work with. I ll still be happy to serve as the maintainer of the Debian package of link-monitor-applet.

Flattr this post

Terah and I went to the Greek island Rhodes recently. This is the second in a series about it. I am one to enjoy history. There is something deeply, well, connecting, about standing in an old place. There is a timeless quality to it a feeling of being connected to so many people of the past, and yet still being connected to change, visible in things such as weathering of stones. To gaze at pottery that s 300 years old, walk past 700-year-old walls, or pass through what remains of the grand portico of an ancient temple to Athena stirs a feeling I can barely explain, of timelessness. Although Rhodes doesn t have the famous Greek sites such as the Parthenon or Delphi, I can t help but wonder why the Rhodes sites aren t better known. They were incredible and it is hard to condense all that we saw into a short blog post. I have to start with the medieval Rhodes Old Town. We got off the bus a few blocks from it one bright morning, and our first task was to find a gate across the moat. Oh yes, A GATE ACROSS THE MOAT. It s a dry moat, and that bridge off in the distance is the gate we were headed to. Outside of the outer wall is a nice quiet walking area. The moat and walls completely surround Old Town and, for the most part, date back about 500 years. The round stones you see on that picture, we were told, were likely surplus from catapults and other projectile weapons. Cross one line of walls and you come to another, with original canons still present. The Knights Hospitaller of St. John, which held Rhodes for a few centuries until the Ottomans captured it, sure knew how to build to impress. The gate we happened to use was Amboise, the Grand Master s Gate. Right there is the stunningly rebuilt landmark Palace of the Grand Master. It is absolutely impossible for any photograph to begin to do this building justice. Between its imported Greek and Roman floors, to the grand nature of everything in it, and the archaeological museum in one corner, it was a fitting start to a visit to Old Town. Here s one of the main staircases. Just near the Palace is quiet courtyard with an old door. Pass through that door and suddenly you re in the midst of the busy Old Town. And among the landmarks in Old Town, the most prominent is Ippoton, the Avenue of the Knights. Along this avenue are the buildings built by the various nationalities of knights, many of which are historical sites in their own. Taken together, it is quite clear why Rhodes is said to be one of the world s best-preserved medieval cities. Down at the other end of Ippoton is the Knights Hospital, which is now part of the archaeological museum. Step off the Avenue a few blocks and you get to some quieter narrow streets just as old, in many cases. On Sunday morning, we were able to visit Mount Filerimos. In contrast to the busy Rhodes, Filerimos had an air of quiet and still to it. It was the site of a monastery, two historic churches, and a landmark Italian cross on the mountaintop. We arrived, and begin our visit with a walk up the quiet stone path. When we got to the top, we walked past this peaceful church. As we walked past the outside, we heard the beautiful music of chant from indoors. We got to step in and listen to mass for a few minutes. In typical fashion, directly in front of the church are two much older sites: one, the ruins of a temple to Athena, and the other a 4th-century Christian bapistery. Rhodes is a popular tourist destination, and of course we saw plenty of popular sites (such as the grandmaster s palace). Filerimos had a few tourists too, but not as many. I frequently like to operate on the plan of going wherever all the tourists aren t. And so, on Filerimos, that meant seeing what was behind the monastery. It started with this peaceful tree-lined path. And the deserted, but intentionally open, gate led to the remains of a Byzantine fortress, which had been a staging area for both the Knights and the Ottomans before their campaigns to capture Rhodes. It also provided incredible views of the surrounding countryside. The first historic site we had visited on our trip was the Acropolis of Lindos, parts of which are 2300 years old. Here s a view of the mountain from the rooftop of the Kalypso, our favorite restaurant in Lindos. The columns of the temple to Athena Lindia are visible, and of course so are the walls. The road up to the acropolis is accessible only on foot or by donkey. It is apparently the only road that has ever been used to get to the acropolis. Here is the partially-restored grand portico to the temple. There s an old Christian church (4th century, if memory serves) at the Acropolis too. The Acropolis makes some pretty good use of natural defenses too. Here s a view from one level of it. There s a manmade wall up there at the very top. And, of course, the beautiful Aegean always in the background. There are lots of cats on Rhodes. Here is a kitten napping at the top of the Lindos Acropolis: Lindos itself is a beautiful town. Here s one of the quieter streets: Notice the pebble steps leading into the houses those intricate pieces of artwork are all over. This post won t be complete without the story of our visit to the Acropolis of Rhodes. We walked there from Old Town. At the Acropolis, there are the remains of a temple to Apollo, an ancient theater, and an ancient stadium where qualifying matches for the Olympics were held. As we got closer to the area, we were repeatedly passed by people dressed in uniforms of various types. And as we got there, we joined a stream of people entering the area. The ancient stadium had apparently thousands of people in it, country names were being read off over the loudspeakers, policemen wielding machine guns were standing by, and we had absolutely no idea what was going on. At this point, you can appreciate the difference between Terah and me. Terah thought that we have no idea what is happening, she was tired from the walk, and so thought we should just leave. I thought that we have no idea what is happening, which is a great reason to stay. So Terah opted to sit and read a bit under some trees while I explored. Here s a view of the stadium as it was emptying out, seen from the theater: I explored the temple and theater, and eventually we were ready to head back. We knew there was a bus back to the New Market (from where we could get a bus back to our hotel), but didn t know where the bus stop was. The obvious place to ask were the policemen, which I thought I would do. Terah thought she would just stay sitting under the trees, on the grounds that the policemen nearest us were all carrying machine guns and perhaps wouldn t like to be disturbed. This led to my cryptic tweet:

Only ONE of us is the kind of person that goes up to guys with machine guns to ask what s happening. Me to Terah today

They told me that it was the preparations for the opening ceremony for a global shooting contest, and also gave me directions to the bus stop.

It has been a while since I last ranted about the Deutsche Bahn, our national train service monopoly. Out of necessity, I ve since become one of their frequent travellers. Together with the spiffy, silver card, I received a pamphlet, in which the advantages of frequent travellers are listed. When I compare those advantages to what was promised, I cannot help but notice quite a few differences to my disadvantage. Since I refused to believe that the Deutsche Bahn could be this stupid, I double-checked with the service hotline, and I now have the information to report:

1. While the website promises free access to DB lounges for two , the pamphlet clarifies this: free access to DB lounges for you and your partner, provided each of you owns a first-class, long-distance ticket. What they left out: Oh, you don t need the frequent traveller status for that, the ticket suffices. Or, put differently: the frequent traveller status does not give you any access to the lounges. False advertising, anyone?
2. The pamphlet explains that there are special seat areas reserved for frequent travellers. However, one must not be a frequent traveller to use them. So should I expect people to prompt me to show my card or clear my seat. And should I be expected to prompt people to flash the card or leave? Not feasible, anyone?
3. I am told that I get priority treatment at the counter, except there is only one counter (in Munich), usually with a line of people for 1st-class and frequent travellers. All other travellers get delegated to 12 counters by an efficient number system, which means one is better off picking a number and standing in line. The other day, a lady came and flashed her frequent traveller card, expecting people to make way, but obviously noone did. Did they actually think about this, anyone?

I don t need to go into detail on the other benefits : they claim that there is special, reserved parking, but that s probably only on paper. They claim reductions in hotels and rental cars, but probably limited to availability, they claim exclusive events, but those are likely the ones noone goes to anyway. And they claim a service hotline, but it s a premium-rate number. So all in all, Deutsche Bahn have once again managed to disappoint. The frequent traveller card does not give any benefits. It rather makes me regret having spent so much money on this company. Scratch frequent traveller , make it repeat idiot . NP: Steven Wilson: Grace for Drowning

Last weekend Dennis M. Ritchie, creator of the C Programming Language, the UNIX Operating System, The Plan 9 Operating System and many other key contributions to computing, passed away due an extended illness. I learned about it yesterday trough Rob Pike, former dmr s colleague and friend. I m writing this post to honor him and his legacy. While I ve seen people mourn his departure, I ve also noticed most technical people don t really understand why his work is important for today s computing, so I m here to give a refresh. Since I m good with visual tools (mindmaps) I ve made one to describe the extension of dmr s contribution to the world. You can get a glimpse of how this is important. The main topics are their key contributions, the sub-topics are the current technologies that were built upon dmr s work. Click on the image to see a larger resolution version.

The C Programming Language

Best said here Let not make the final statement and not a single newspaper cares " into a reality. PS: Do check out Against Nostalgia, a great jab at Jobs.

This was written by Tom Dailey, and I ve lightly edited it:

In 1965, I was stationed at the Fleet Anti-Submarine Warfare Center in San Diego. I was a Radioman 2nd. Class in the USN, at the time. One evening, at our radio club station (W6DCM different license holder, now), I called CQ and got UA KKC (it s no longer around), with Ivan at the mic. After a time of the usual signal reports and such, we asked what each did in their lives I said that I was US Navy radio operator. He answered that HE ALSO was a Navy radio operator in the Soviet navy. Then we discovered that his station was at the SUBMARINE base at Vladivostok, and I of course was his DIRECT opponent. Yes we really DID laugh at that, and I shall never forget what he said (that I heartily agreed with): Thomas, isn t it shame that we re supposed to hate each other? Yes, Ivan, it is someday we ll share a vodka, da? Da , he replied.

We re often told we should hate people. Messages I have heard on the media over the last 10 years have said we ought to hate illegal immigrants, CEOs, radical Muslims, the French, Iranians, Mexicans, presidents, UN diplomats, climate scientists, oil company employees, Chinese people, conservatives, liberals, religious people, atheists, and oh yes, still Russians. But I get to choose who to hate, and in fact, I choose NO HATE. Not only does it keep my stress level way lower, but it also lets me enjoy life more, and makes the world a better place. We can all talk to people in other countries and with other backgrounds and viewpoints so easily thanks to the Internet. Sadly we rarely have very deep online conversations to the point of getting to know people. For whatever reason, ham radio lends itself to that better. Even better: visit other places. I wonder how many people that say they hate some group of people have visited them and made an effort to make a connection? It is, after all, really hard to hate someone that is kind to you. Perhaps they re afraid to let go of their hate. Think also about this: for whom is it convenient if you hate people? There is usually a reason that hatred is stoked, and it doesn t usually lead to good things for individual people. Tom W0EAJ added:

I actually tried to locate him and the station, but both appear to have vanished. Ivan (his name was pronounced Eee-von) could have, it occured to me later, gotten into trouble for saying such things. I think both of us realized AT THE TIME, what an astounding counterpoint each of us was to the other. Proof that if it were left up to the simple little guys like us, and not to the politicians, we might actually pull off living in peace.

The issue This morning (while I was running late for an appointement) I had a very weird stuff happening on my Thinkpad T61 laptop. Since I recently offered myself a shiny Thinkpad x201s, I have to admit I don't use much my T61 anymore. But this morning I had to print a page (for this appointement) and, as I didn't yet configured my printer on the x201s, I went to the T61. But I noticed that the network was down. I've tried quickly on wireless but, bad luck, my current wifi setup selects the channel automatically and it prefers choosing channels which aren't available in the US. Guess what, my T61 comes from the US and has those channels completely disabled, so no wireless available either. The investigation I first tried to

modprobe -r e1000e
modprobe e1000e to see if it fixed the problem, but it didn't. Worse, the interface disappeared and never reappeared. I tried to reboot but it didn't fix the problem, the link was still down. Running really late, I put the file on a usb key and printed it from the powerbook and postponed the fix for later. Now, this evening, I tried to investigate a bit more. Symptoms weren't only that the nic wasn't working, but there was a high load on the system (1-2 at idle), unresponsiveness every second or so, and watching top I could see spikes of high cpu usage for the kworker kernel thread. Typing that on google you can find a lot of people running on this issue, usually starting around kernel 2.6.36 or 2.6.37. Now, I might have upgraded the kernel recently to 3.0.0-4, but that didn't look related since the problem first appeared when the laptop was up and running. And I tried to reboot under 2.6.39, 2.6.38 and even 2.6.32 and the problem was still present. Each time, unloading the module would fix the problem, but loading it again wouldn't make the interface reappear. People advised to boot with pcie_ports=compat but that didn't do anything. I tried to boot without intel_iommu=force (disable Intel Vt-d) and pcie_aspm (Active State Power Management) but nothing either. Considering a userland issue, I've tried to boot a grml live distro (always keep a grml.iso in your /boot, extlinux-update will even put it in your menu automatically), and the problem was still present. So not a Debian kernel issue, not a userland issue, only thing left was the laptop. I didn't update the Bios recently, so I wondered exactly what could be the problem. I started to feel a little bad, since I still really like that laptop, and that I already decided to lend it to my sister since her own T61 is sitting with a dead system board in my shelf. I know she might have some negative waves, but she was not even landed when the problem first appear. The fix Then I had a flash. It's not mystery that I'm used to break network cards, and I had the bright idea to shutdown the laptop, disconnect AC and battery, then let it idle a bit. I even tried the secret Thinkpad power button code but I think it's unrelated. Then I re-plugged the battery, booted to grml and the issue was gone. I rebooted on the standard Debian and the link was up, network was working. So what happenned? The (tentative) explanation My guess is that, somehow, the network card firmware has an issue and choked on something (a network frame or an attack exactly like the one we demonstrated on ASF firmware). In fact, no, I don't think it's the e1000e firmware. My T61 comes with Intel vPro, which includes AMT (Active Management Technology), a remote management solution a bit like ASF but more advanced. As far as I know, AMT firmware always runs, even when it's disabled, it's just completely idle. Idle, but in this case I think it choked on something, and a reboot isn't enough to restart the AMT firmware. But a real hard reset without any power seems to do the trick. What next? Well, a part of me is pretty scared, but another is just bored. I mean, we know about that, that's exactly the kind of issue we are warning people of. I have no idea what exactly happened, and there's no way I'll be able to reproduce that, but I'm pretty sure it's something lying at a pretty low level in the platform, and which can severely disable your workstation. Now if it happens again I won't lose too much time on this. TL;DR: helping other people In case you came here because you searched on google terms like kworker cpu usage , e1000e, interrupts, it might be a good idea to first reboot on a live CD to eliminate installation issues, then shutdown the laptop, remove the battery and let it few seconds idle. This might be enough to reset something inside and fix the situation.

#### [WATER FRACTIONS IN EXTRASOLAR PLANETESIMALS](http://arxiv.org/PS_cache/arxiv/pdf/1110/1110.1774v1.pdf) #### Jura & Xu, Arxiv.org. #exoplanets, #water, #phd > Abstract: With the goal of using externally-polluted white dwarfs to investigate the water fractions of extrasolar planetesimals, we assemble from the literature a sample that we estimate to be more than 60% complete of DB white dwarfs warmer than 13,000 K, more luminous than 3 10 3 L and within 80 pc of the Sun. When considering all the stars together, we find the summed mass accretion rate of heavy atoms exceeds that of hydrogen by over a factor of 1000. If so, this sub-population of extrasolar asteroids treated as an ensemble has little water and is at least a factor of 20 drier than CI chondrites, the most primitive meteorites. In contrast, while an apparent excess of oxygen in a single DB can be interpreted as evidence that the accreted material originated in a water-rich parent body, we show that at least in some cases, there can be sufficient uncertainties in the time history of the accretion rate that such an argument may be ambiguous. Regardless of the difficulty associated with interpreting the results from an individual object, our analysis of the population of polluted DBs provides indirect observational support for the theoretical view that a snow line is important in disks where rocky planetesimals form. Ok, so we now have a way of estimating how wet planetary systems *were*, at the time they fell into the white dwarf star. Not very representative of the time they before the planet got roasted to a crisp by the stars Red Giant stage, however. Recovering the hydrogenation state of serpentinized minerals might be possible and useful.

Dear Lazyweb . I ran into a very strange issue with MySQL authentication. The initial situation is as follows:
Two MySQL servers, let s name them a0.my.do.main and a1.my.do.main. Their my.cnf configuration is identical except for the server_id (equals 1 on a0 and 2 on a1).
Since I wanted to set up a master< ->master replication, I created a user repl@%.my.do.main on a0, then shut down the mysql server on both hosts, copied over the mysql database on the filesystem layer (i.e. rsync of the data directory), then started mysql on both hosts again. So far, so good, both servers came up nicely, and local (unix socket) login as a root user worked fine as expected. However: Logging in via TCP socket only works from a1 (to both a0 and a1). Logging in via TCP socket from a0 doesn t work to either host. I also created a test user sven @ %.my.do.main (I also tried with @ % ) which has all privileges.
Here is what the commands output:

sven@a0 ~ > mysql -u sven -ptestpass -h a0.my.do.main
ERROR 1045 (28000): Access denied for user 'sven'@'a0.my.do.main' (using password: YES)
sven@a0 ~ > mysql -u sven -ptestpass -h a1.my.do.main
ERROR 1045 (28000): Access denied for user 'sven'@'a0.my.do.main' (using password: YES) sven@a1 ~ > mysql -u sven -ptestpass -h a0.my.do.main
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 32
Server version: 5.0.77-log Source distribution Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> Bye
sven@a1 ~ > mysql -u sven -ptestpass -h a1.my.do.main
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 24
Server version: 5.0.77-log Source distribution Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql>
All packages on both machines are up to date (CentOS5 with all updates available). The server variables shown with show variables also seem identical (except for the hostname and the server id). Besides, it looks more like a client problem to me than a server problem. Last datapoint: If I define the mysql user sven with an explicit host (a0.my.do.main and a1.my.do.main) instead of a wildcard, everything works nicely, from and to both hosts. So, dear lazyweb: Does anyone have an idea what might be causing this issue? Update: Due to some comments, let me add a few points of information:

1. flush hosts doesn t help. Host resolution looks OK, according to documentation, the hostname in the error message is what the server things is right, not what the client specified, and that documentation seems to be consistent with my experiences.
2. The db and user tables look as expected. And I m quite sure they are not the issue here, as I can connect from other hosts that match the host pattern.
3. There is no ~/.my.cnf on either host
4. Copying the database files on the filesystem layer is one of the documented ways of initializing the database on the slave for replication. Anyway, I had the same issue when trying to set up the database on the slave by loading a dump.
5. DNS looks fine, both forward and reverse mappings, both servers use the same DNS server.
6. IPv6 is not involved, it is disabled on these servers

Thanks for the hint at serverfault.com, I will try that if I don t get sufficient info here. Update 2 Another strange data point:
When I disable the (non-privileged) anonymous access user in the mysql.user table (i.e. drop the rows with user= "), everything works as expected from both servers. However, why does it work from one host (client) to both DBs if the anonymous access is allowed (with no privileges except for being able to see that the test and mysql databases exist), but not from the other host (client)? It really looks like an issue on the client side, but I still don t get what exactly goes wrong.

Greetings real ale fans, This most exciting time of year is almost upon us again. Yes, it's the Nottingham Robin Hood Beer Festival! This year I have followed in the footsteps of Alex and Karen and decided to trawl through the list of over 900 beers so that I can best sample the delights on offer. My selection is here. I'm attending on both the Thursday and Saturday, so there's plenty of time for me to sample a reasonable number of different ales. Beer aficionados, I'd welcome suggestions for alternative beers to try, if you'd recommend any of them. I promise to update the list after. I might even be tempted by the ciders, perries and wines. Generally I tend to prefer paler ales, but I also quite like a mild given half the chance. See you on the other side! (Image by Ant & Carrie Coleman, cc-by-nd 2.0)

It s been a while since I ve written about Moonshot. A lot has gone on; we ve been too busy doing to be busy blogging. However there s something that s happened recently that s so cool I had to take a moment to discuss it. Padl Software, the same people (well person) who brought us LDAP support to replace NIS and the first Active Directory clone, has now produced a GSS-EAP Security Service Provider. That s software that implements the Moonshot protocol and plugs it into the standard Windows security infrastructure. This is neat because it allows you to use GSS-EAP with unmodified Windows applications like Internet Explorer and Outlook/Exchange. Obviously, this will be great for Moonshot. However, I think the positive affects are more far-reaching than that. Luke has demonstrated that we can evolve the Windows security infrastructure without waiting for Microsoft to lead the way. For those of us working in the enterprise security space, that s huge. We can innovate and bring our innovation to Windows. In terms of getting acceptance in important user communities, getting funding for work, and making a practical difference, that s a big deal. This code is still in the early stages. Padl has not decided how the code will be made available. We don t know if it will be under an open-source license yet. Luke, naturally wants to get paid for his work. However if this code does get released under an open-source license, it will be very valuable. That will give all of us who are looking for a starting point for security innovations a starting point for bringing our innovations to Windows. Some in the open-source community will argue that we shouldn t work on improving Windows: if the open-source platforms have features Windows does not, then it may drive people to open-source. Especially for enterprise infrastructure, it tends not to work that way. You need broad cross-platform support to drive new technology. However, it does mean that we can take control of the evolution of our infrastructure; even for Windows there is no requirement that a single vendor controls what is possible.

No, my blog isn't dead, and neither is me. It's just that way too many things happened since this year's debconf that got me a bit off tracks. I managed to do daily business like keeping my packages in shape and the backports queue low, and that was mostly it. No clue if that will change anytime soon, but I guess I would like to keep you updated with an event where you can meet me next week: There will be the Global 2000 Birthday Party going on in the WUK on Thursday 20th, so if you happen to be in Vienna at that time, drop by and enjoy some great bands. ... which brings me to one of the local bands from Vienna: Heinz aus Wien. They are around for well over 10 years now and are still rocking quite well. Here are some examples of their songs, like always:

• Wir sind immer noch: A sort of love song for this great town, Vienna.
• Lieb im Prinzip: A very pithy song about relationships.
• Ich hab mit Tocotronic Bier getrunken: Quite funny song from their early days, and interestingly, people regularly claim that it was done by a different band ...

Like always, enjoy!

/music permanent link Comments: 0 Flattr this

Poor Sarah. Cat dramas always seem to befall us when she's in Australia. It looks as if Smudge has managed to escape the house. Being at work all day, it took me 24 hours to notice. Our friend Helen came over on Sunday night. Smudge was definitely around then, because she was climbing all over Liam. Helen used the downstairs bathroom before she went home, and I remember her having to shoo Smudge out because she was in there. I'm pretty sure she went home after that. If my memory serves, she saw herself out and I was in the kitchen cleaning up, so my current theory is that she escaped when Helen left. On Monday night, I had a lengthy video call with Sarah, who was at my parent's place setting up their new Mac Mini. I didn't realise until after that, when I was about to go to bed, that I hadn't been harassed by Smudge all evening. So I searched the house that night, and couldn't find her. Liam had already gone to bed for the night, so I hoped she was stuck in his room, and went to bed too. This morning, Liam and I both searched the house, and the immediate surrounds, without any luck. I called the Palo Alto Animal Services (I got the dispatch because the shelter hadn't opened yet), emailed the local neighbourhood association, and went to work. I called Palo Alto Animal Services again later in the day to report her missing to the shelter itself, and Betty-Ann there recognised my accent and name and asked me if I was Sarah's husband (Sarah used to volunteer there a lot, and we adopted Smudge from there), so they're now keeping a look out. Smudge is micro chipped, but wasn't wearing a collar. She's allowed in the back yard, because it's totally enclosed and can't escape, so she shouldn't be totally freaked out by being outdoors. Whenever she does escape out the front door, she usually makes a beeline to the right, which is mostly enclosed, but she can certainly get out of the complex. Unfortunately she often doesn't come when called, so for all I know she's in some obscure location 10 metres from the front door and I can't see her. My main concerns are that we're only two blocks from Highway 101, so if she does stray too far, she could get into serious trouble, and I'm also a bit worried about raccoons giving her grief. I spent some time tonight putting up posters in the immediate area and poking around bushes. I've left the two humane cat traps that we have out by the front door with some cat food in them, in the hope that she's roaming around and will walk into one of them. Oh and the other big concern I have is that Halloween is coming up. Shelters tend not to adopt out black cats around Halloween because bad things can happen to them. So now we wait. I'm really hoping she turns up safe and sound, soon.

I have recently been working on some code for NetSurf which builds up an output buffer by repeatedly calling snprintf(); No great shock there, well understood trivial pattern that has been used repeatedly for ages. Gosh I feel silly now, in fact I was so convinced I was right I wrote a program to "prove" it.

I have several backup servers that run the excellent rsnapshot software, which uses Secure Shell (SSH) for remote access. The SSH private key of the backup server can be a weak link in the overall security. To see how it can be a problem, consider if someone breaks into your backup server and manages to copy your SSH private key, they will now have the ability to login to all machines that you take backups off (and that should be all of your machines, right?). The traditional way to mitigate SSH private key theft is by password protecting the private key. This works poorly in an unattended server environment because either the decryption password needs to be stored in disk (where the attacker can read it) or the decrypted private key has to be available in decrypted form in memory (where attacker can read it). A better way to deal with the problem is to move the SSH private key to a smartcard. The idea is that the private key cannot be copied by an attacker who roots your backup server. (Careful readers may have spotted a flaw here, and I need to explain one weakness with my solution: an attacker will still be able to login to all your systems by going through your backup server, however it will require an open inbound network connection to your backup server and the attacker will never know what your private key is. What this does is to allow you to more easily do damage control by removing the smartcard from the backup server.) In this writeup, I ll explain how to accomplish all this on a Debian/Ubuntu-system using a OpenPGP smartcard, a Gemalto USB Shell Token v2 with gpg-agent/scdaemon from GnuPG together with OpenSSH.


First we need to install some packages. The goal is to configure OpenSSH to talk to the gpg-agent which will start and talk to scdaemon which in turn talks to pcscd which talks to the smart card reader. For some strange reason, the scdaemon binary is shipped with GnuPG s S/MIME interface in the gpgsm package.

# apt-get install pcscd gnupg-agent gpgsm

The above command should install and start pcscd and if all works well, you should be able to check the status of the smartcard using GnuPG.

# gpg --card-status

You need to initialize the smartcard and generate a private key on it, again using GnuPG. If you trust GnuPG more than the smartcard to generate a good private key, you may generate the private key using GnuPG and then move it onto the smartcard (hint: use the keytocard command). Make sure you don t leave a copy of the private key on the same machine!

# gpg --card-edit
gpg: detected reader  Gemalto GemPC Key 00 00'
...
gpg/card> admin
Admin commands are allowed
gpg/card> name
Cardholder's surname:
Cardholder's given name: host.example.org
gpg: 3 Admin PIN attempts remaining before card is permanently locked
Please enter the Admin PIN
gpg: gpg-agent is not available in this session
gpg/card> lang
Language preferences: en
gpg/card> generate
Make off-card backup of encryption key? (Y/n) n
Please enter the PIN
What keysize do you want for the Signature key? (2048)
What keysize do you want for the Encryption key? (2048)
What keysize do you want for the Authentication key? (2048)
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: host.example.org
Email address:
Comment:
You selected this USER-ID:
    "host.example.org"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: existing key will be replaced
gpg: please wait while key is being generated ...
gpg: key generation completed (33 seconds)
gpg: signatures created so far: 0
gpg: existing key will be replaced
gpg: please wait while key is being generated ...
gpg: key generation completed (18 seconds)
gpg: signatures created so far: 1
gpg: signatures created so far: 2
gpg: existing key will be replaced
gpg: please wait while key is being generated ...
gpg: key generation completed (23 seconds)
gpg: signatures created so far: 3
gpg: signatures created so far: 4
gpg: key 12345678 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
pub   2048R/12345678 2011-09-19
      Key fingerprint = 1234 5678 1234 5678 1234  5678 1234 5678 1234 5678
uid                  host.example.org
sub   2048R/23456789 2011-09-19
sub   2048R/34567890 2011-09-19
gpg/card> quit
#

Now for the interesting part. OpenSSH talks to an agent for private key handling, and GnuPG s gpg-agent supports this protocol when the --enable-ssh-support parameter is given. During startup, gpg-agent will print some environment variables that needs to be set when ssh is run. Normally gpg-agent is invoked by the Xsession.d login scripts, so that the environment variables are inherited by all your processes. However, for an unattended machine without any normal login process, we need to write a script to start gpg-agent. First do these manual steps, to confirm that everything works.

# gpg-agent --daemon --enable-ssh-support > /var/run/gpg-agent-info.env
# . /var/run/gpg-agent-info.env
# ssh-add -L
ssh-rsa AAAAB3N... cardno:000500000BD8
#

If the final step printed a SSH public id, the (sometimes) tricky part in getting the hardware to work is (hopefully) complete. What remains is to script things so that gpg-agent is started on boot and to make sure that your backup scripts has the proper environment variables before launching whatever processes will launch ssh. Further, since we will be running unattended, we need a mechanism to unlock the smartcard using a PIN interactively once on each boot of the machine. I prefer manually entering the PIN on every boot over having the PIN stored in a file on the disk. I will use the /etc/rc.local mechanism to start gpg-agent, like this:

# cat> /etc/rc.local
#!/bin/sh -e
exec gpg-agent --daemon --enable-ssh-support \
    --pinentry-program /usr/local/sbin/pinentry-unattended \
    --write-env-file /var/run/gpg-agent-info.env
^D

The astute reader will now ask what /usr/local/sbin/pinentry-unattended is and why it is needed. Now here is the situation. scdaemon will normally query the user for a PIN using a tool called pinentry which reads and write to the user s TTY directly. This won t work in unattended mode, so we want the scdaemon to signal failure here unless we are actually unlocking the smartcard manually. Here is the entire script:

#!/bin/sh
# /usr/local/sbin/pinentry-unattended -- by Simon Josefsson
if test x"$PINENTRY_USER_DATA" = xinteractive; then
    exec pinentry "$@"
fi
exit 1

What remains is a script to unlock the smartcard by providing the PIN. This is typically invoked manually if the server has restarted for some reason. Don t worry, any ssh sessions invoked by cron until you have managed to unlock the smartcard will fail with an authentication error it won t hang waiting for a PIN to be entered.

#!/bin/sh
# /usr/local/sbin/unlock-smartcard -- by Simon Josefsson.
. /var/run/gpg-agent-info.env; export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID
gpg-connect-agent 'scd killscd' /bye > /dev/null
while ! gpg-connect-agent 'scd serialno' /bye   grep -q SERIALNO; do
    sleep 1
done
PINENTRY_USER_DATA=interactive
export PINENTRY_USER_DATA
checkpin

And the script checkpin is as follows:

#!/bin/sh
# /usr/local/sbin/checkpin -- by Simon Josefsson.
id= gpg-connect-agent 'scd serialno' /bye   head -1   cut -d\  -f3 
gpg-connect-agent "scd checkpin $id" /bye   grep -q OK

At this point, you should have everything configured and installed. Don t forget to chmod +x the scripts. The typical use-pattern is as follows. After the machine has been started, gpg-agent is running but the smartcard is not unlocked with the PIN. You need to manually login to the machine and run unlock-smartcard and enter the PIN. In the script that runs the backup jobs, invoked via cron, make sure that the first line of the scripts reads (assuming Bourne shell script syntax):

. /var/run/gpg-agent-info.env; export GPG_AGENT_INFO SSH_AUTH_SOCK SSH_AGENT_PID

To avoid needlessly attempting ssh connections if the smartcard is not unlocked, your backup script can also call the checkpin code and abort if it doesn t return true.

checkpin   exit 1

Some final words about debugging. A basic command to run to check that the GnuPG side is working is gpg --card-status, it should print some information about the smartcard if successful. To check that the SSH agent part is working, use ssh-add -L. If you get error messages, try killing the scdaemon process by running killall -9 scdaemon and let gpg-agent respawn a new scdaemon process. That s it! If you like my writeup, please flattr it.