Unpacking the new FreeRunner I got myself a FreeRunner. Here are some notes from the first few days: Available operating systems The FreeRunner comes with the Om 2007.2 distribution: it works for basic phone things, and it has an opkg package manager that you can use to install all sort of extra software. Only issue: the SMS application was rather unstable with my SIM card. I then tried Om 2008.8, which is a major new redesign, partly based on Qtopia. It's definitely more advanced on how it looks, with smooth animations all around, but I did not manage to get the GSM part to work, because I did not manage to get it to ask for a PIN. I then tried plain Qtopia and I got what looks and feels like a properly working mobile phone. The only issue that it has is that I did not manage to make it suspend, so battery life is much shorter than it could be. Apparently, this should improve as kernel 2.6.26 reaches the phone. I kept Qtopia installed in the phone flash as a "stable" phone system. And finally, Debian. Debian is based on the freesmartphone.org software stack, which is an attempt to create a UI agnostic DBUS frontend to the hardware that supports multiple applications running on top of it. It is a young project, but it can already drive a mobile phone in a useful way. It has a demo interface that is basically a showcase of what is implemented in the DBUS frontend, but does most of the basic things you need from a mobile phone, including taking and making phone calls. And then it has Debian behind, all of it. I need to buy a bigger microsd card. Tips and tricks Flashing things

1. apt-get install dfu-util
2. Start the Freerunner bios/bootloader, by holding down Power and then pressing AUX (standard bootloader), or by holding down AUX and then pressing Power (factory, unbrickable, read only fail safe bootloader).
3. dfu-util -l shows you a list of devices it can access. If you see more than once, you need to specify in all dfu-util commands which one you want, using -d USBID. In my case, I have to always use dfu-util -d 0x1d50:0x5119
4. To flash the kernel: dfu-util -a kernel -R -D /path/to/uImage
5. To flash the root file system: dfu-util -a rootfs -R -D rootfs_filename.jffs2
6. To flash the bootloader: dfu-util -a u-boot -R -D uboot_filename.bin
7. To flash the u-boot configuration: dfu-util -a u-boot_env -D env.new

You can also download all of these things from the FreeRunner by using -U instead of -D. Networking via USB All of the distributions I tried, by default configure the USB as a gadget with ethernet over usb. You can form a lan with it using the cdc_ether module, and you will find your phone preconfigured as 192.168.0.202 expecting to find a gateway at 192.168.0.200. I made myself this script to start and stop networking with the phone:

#!/bin/sh
case "$1" in
    start)
        iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE -s 192.168.0.200/29
        ifconfig usb0 192.168.0.200 netmask 255.255.255.248
        /etc/init.d/dnsmasq start
        echo 1 > /proc/sys/net/ipv4/ip_forward
        ;;
    stop)
        echo 0 > /proc/sys/net/ipv4/ip_forward
        /etc/init.d/dnsmasq stop
        iptables -t nat -F POSTROUTING
        ifconfig usb0 down
        ;;
esac

Besides doing masquerading, it also brings up dnsmasq so that the phone can always find a DNS together with the router. Another useful trick is to configure the phone to share the approx cache with the laptop:

deb http://192.168.0.200:9999/debian unstable main
deb http://192.168.0.200:9999/debian experimental main
deb http://pkg-fso.alioth.debian.org/debian unstable main

So yes, my laptop can now be turned into a phone charger with networking, DNS and apt cache services. I shall look into hooking that script into dbus to have it run automatically when the phone is plugged and unplugged. Changing the ringtone in Debian In case you don't like the default ringtone, this is how to change it:

1. vi /usr/share/python-support/fso-frameworkd/framework/subsystems/oeventd/receiver.py
2. look for def _play( self ):
3. change the codec in decoder = gst.element_factory_make, if needed. The list of available plugins is on the gstreamer website.
4. change the path in filesrc.set_property
5. /etc/init.d/fso-frameworkd restart and maybe /etc/init.d/zhone-session restart

Yes, the ringtone is currently hardcoded, but it does say it's a prototype after all. Or, if you prefer, it's fully configurable and the configuration can be found in /usr/share/python-support/fso-frameworkd. Configuring the bootloader You can connect to the u-boot bootloader via a serial terminal on /dev/ttyACM0. Type help and you will find that it can do a lot of things. The OpenMoko wiki has pages on the bootloader itself, its commands and the environment. The environment is the configuration of the bootloader, similar somehow to /boot/grub/menu.lst. Unlike grub, you can edit the environment from within the bootloader and then save it using the saveenv command. What I did:

1. A boot entry for Debian, with the kernel on an ext2 partition instead of fat: setenv menu_3 Boot from microSD (FAT+ext2): setenv bootargs \$ bootargs_base rootfstype=ext2 root=/dev/mmcblk0p2 rootdelay=5 \$ mtdparts ro\; mmcinit\; fatload mmc 1 0x32000000 \$ sd_image_name \; bootm 0x32000000
2. Stay in the bootloader until a choice has been made: setenv bootdelay -1
3. Don't power down the bootloader when idle: setenv boot_menu_timeout 99999
4. Always show the menu at boot: setenv stop_in_menu yes
5. saveenv

So now my phone dual boots, and I can choose if I want a more reliable phone now (Qtopia) or if I want to play with my future phone (Debian). Configuring ssh for two host keys on the same host Minor issue, but annoying: since both QTopia and Debian show up on 192.168.0.202, ssh will complain about changed host keys. Here is how to configure ssh to avoid the problem (in ~/.ssh/config):

Host debian
HostName 192.168.0.202
User root
HostKeyAlias debian
Host qtopia
HostName 192.168.0.202
User root
HostKeyAlias qtopia

According to a recent article, 6 Common Website Mistakes That Cost Money are:

1. JavaScript or other crawler-unfriendly navigation that may impede indexing

This one is best avoided at design-time, by including Web Content Accessibility Guidelines 1.0 Level A in the design brief, but if you’ve ended up with JavaScript-based navigation on your site (check by doing “View Source” and searching for the code for your home page link and so on - if you can find it, then it’s probably not javascript) and it’s based on some template system, a webmaster can probably do a whole-site edit to put the navigation links in the page properly - or at least add a useful <noscript> tag.

2. Navigation that buries important pages within the site architecture.

The structure of the website’s files and the structure of the link menus do not need to match, so if there’s a page that you feel is important, get your webmaster to add it to the navigation links across the whole site.

3. Duplicate “pages” getting indexed under multiple URLs.

This usually happens for one of two reasons: one is inappropriately-parked domains, which is mistake 6 below and often fairly easy to fix; the other is a misbehaving web application, which you’ll need to get a programmer to fix. You can do a simple test of your web application by starting at your homepage and following links to a particular page; then open a new browser window and try to reach the same page by different links (or a site search) and compare the address bars (the bit of your browser showing http://) - do they match? If not, you’ve got this problem.

4. No keyword phrase focus in the content or conversely, keyword phrase stuffing

You can use a good word-counter on the text to see how common different keywords and keyphrases, or use the “webmaster tools” section of some search engines to see what they’re focusing on. Keyword-stuffing can be fairly easy to see. If you “View Source” on a page and there’s a large block of keyword-intensive text somewhere in it that doesn’t appear it when viewed in a browser, then it’s probably stuffing. Many sites regard stuffing as a sort of spam, so you don’t want to be found doing this. To fix these problems, rewrite the page text appropriately.

5. An optimized home page, but that’s it

Repeat your checks from problem 4 on a few pages other than the home page to discover whether you suffer from this. Also, see whether your website statistics show search engine visitors arriving at a variety of different pages (these are sometimes called “Entry Page” statistics).

6. Additional domains owned by the company are not properly redirected

If you usually use .co.uk, but you also have a .com domain, try visiting a random page on your website, then click in the address bar and replace the .co.uk with .com - what happens? If the page is Not Found, then your domains aren’t properly redirected and you need a Redirect adding to the second one. If the page displays but the address doesn’t change itself back, then your domains are probably pointing at the same webspace but aren’t properly redirected, which will mean you’re probably making mistake 3 above. Usually, the simplest way to fix this is with a conditional redirect. On Apache webservers, you can add a .htaccess file containing something like:-

RewriteEngine On
RewriteCond % HTTP_HOST  !^www\.yourdomain\.co\.uk$ [NC]
RewriteRule (.*) http://www.yourdomain.co.uk/$1 [R=permanent,L]

That even works on BT Business web hosting, by the way. If it doesn’t work, try asking your web hosting provider to enable mod_rewrite for you or ask them to suggest how to achieve the same result.

The above list of mistakes was published on Search Engine Land last week. The correction methods are all things used by my webmaster cooperative.

I’ve had little time in the four years I’ve lived in Roslindale to get involved in community volunteer efforts. My wife Rachele, however, has devoted several years to efforts such as the Roslindale Community Center, Roslindale Village Main Streets, and Roslindale Clean and Green. She has served as chair of both RCC and one of the RVMS committees. Over the past few months, I’ve been disappointed to see the RCC board endure repeated senseless attacks by a perhaps overzealous community member, Walter Michalik, who has effectively paralyzed the organization. I have nothing personal against this guy, but I thought I could do my part here by publishing an example of an email he broadcast to the committee, which I think is embarrassing enough on its own merits to need no editorializing from me, except to say any email that starts with “just so you won’t be surprised when the IRS launches its investigation” can be neither productive nor taken seriously. The context is a response to an announcement sent out pursuant to the Community Centers By-Laws scheduling a special meeting to discuss the recent upheaval on the Council. There’s no reason this should not be in the public record:

Rachele Just so you won’t be surprised when the IRS launches its investigation, be advised that YOU DO NOT HAVE THE AUTHORITY TO CALL FOR A SPECIAL MEETING. The By Laws do not allow the President/Chair to call for a Special meeting - that right is reserved for the MEMBERS to have a power over a hostile or non-performing President/Chair. It was created by a Membership wary of annimosity within its ranks in order to protect itself from falling into a useless dysfunctional body. That’s why our By Laws require the majority of the membership request it through the Chair and not the other way around. So you screwed that up too. Your continuous violation of rules and laws have proven beyond a doubt that this current Roslindale Community Center Council has violated the trust behind its IRS-designated not-for-profit status. The failures are on so many significant levels over 6 months it is readily apparent that the Roslindale Community is better served without a Community Center Council. There is no longer any excuse to allow the residents of Roslindale to be denied the services they deserve that you and the officers have no idea how to deliver. Because that’s what you are supposed to do - serve the residents of Roslindale and not preseide over a self-serving board. You’ve taken us from dysfunctional to non-functional over the past 60 days. You and your officers have already driven away our Archdale partners and now the merger is off. Congratulations. You got what you wanted. You and the officers have withheld information from the Members of the Council imposing gag orders along the way and in more than one instance spreading lies within this community. There are so very many lapses on your part and the rest of the officers that it is very apparent that the Roslindale Community Center exists IN SPITE OF the Roslindale Community Center Council - not because of it. It would be far better indeed, if the Center were run without the Council. What have you done in 6 months? All you do is avoid the work of leadership. Please, just gracefully step aside and let a real leader emerge - or dissolve the Council and let the Center run itself under BCYF before the IRS makes that happen. Of course this is my stated opinion. You can choose not to belive it. You can huddle with a group of self-serving officers and invent excuses or change the agenda away from the message and continue with your ad hominem attacks against the messenger. I’m thick-skinned. Feelings aren’t important to me - services to residents are important to me. While I have, in fact, enjoyed the confidences of others within this community and their true displesure with this Council, I will produce that to the appropriate authorities as I see fit along with the Bill of Particulars I have produced with documentation for all charges. As a founder of the Roslindale Community Center Council I can no longer support you or the officers as any legitimate authority in this community.

Technorati Tags: Boston, Roslindale, Walter Michalik

Share This

Some interesting two days have just passed. I took the airplane from Mar del Plata to Buenos Aires on the 17th, slept one night in a hostel on a mattress that felt like stone, and went to the 'Circulo del Officieles de la Mar' (or some such, I don't know spanish) where I had to give a talk. The oral feedback I've gotten so far indicates that people did appreciate it, which is good. I had originally planned to do some sightseeing in Buenos Aires after my talk, but me being tired and not immediately finding anyone else to go with me changed those plans. Instead, I just stayed at the C.O.M., where we played some Mao. Amongst other things. About an hour before I left the place, Holger Levsen gave me a tripod, with the request to take it with me to Belgium, and keep it until FOSDEM. As that would also give me the use of an tripod, and being the photography hobbyist that I am, I was too happy to oblige. There was just one problem: the suitcase that contained my luggage already had a bulge from here to tokio, so adding it was a no-no. No problem, I thought. I'll just keep it in my carry-on luggage. There's some space left there, and I certainly didn't have 5kg of carry-on luggage yet. Problem solved. The 'security' in EZE is a joke; the security officer doesn't even look at the screen while X-raying my luggage. Well done. So I fly from EZE to MAD on the first, 11-and-a-half-hour leg of my flight. Madrid Barajas is a crazy airport, with its own private metro. Somewhere between gates R-something (where IB6844 from EZE arrived) and J40 (where the flight to BRU will depart from), we need to go through a security checkpoint. Strange, since I hadn't had to do that on my way in from BRU to EZE; but of course you have no choice, so I comply. As I've gotten used to by now, what with the mess of cabling in my laptop bag and the other metal objects there, I get a baggage check. The security officer who goes through my very messy bag asks me to open the bag containing the tripod, so he can see it. He then promptly decides that it is a "sharp" object, and that it is "not acceptible". Here the fun begins. Of course, trying to argue with a security guard isn't the best idea if you want to be allowed on any flight, ever, so I don't even try that. I ask him 'can I check that in, instead?' and he tells me how to go back, to the exit, and to the departures hall where I can have that little tripod get checked in. So I go there. The lady at the check-in desk tells me that she cannot check the tripod in, because the flight has already been closed and I'm too late. I tell her I'm from a connecting flight, and that I can't help that. She says she knows. So I ask her what my other options are. She tells me I could try to get on the next flight to Brussels, which is at 20:00 (rather than the 16:20 flight that I was booked on). I consider that an acceptable compromise, so ask her how to get that done, and she refers me to the ticket sales desk, some 10 meters to my left. Unfortunately, the 20:00 flight turns out to be completely booked, and there are no other flights on the same day. The best alternative he can give me is a flight to Amsterdam at 19:20, which would cost 'a little more'. I ask him 'how much more'. He starts looking up things in his computer, and after a few minutes tells me that he cannot refund my ticket for the 16:20 flight and that a flight to amsterdam would cost me 429. At this point I get somewhat angry, and tell him that this is not acceptable. He refers me to the customer service desk right across. The lady at the customer service desk is friendly, but firm: she cannot help me. Either I leave the tripod behind, or I pay whatever the ticket service asks me—she takes my word that it is 429, because she cannot check it, and cannot change it, either. I get more agitated, and ask to see the supervisor. She points me to a lady a little across who can 'call' the supervisor. At this point it is 15:55 As I reach that lady, apparently someone else had just asked for the same thing, and starts arguing with a guy in black uniform, who appears to be the supervisor, about the fact that he's got more than 30kg of luggage which he isn't allowed to take along with him. Dude, not a single airline will let you do that, no matter how much you argue. I let them argue for about 10 minutes, all the while nervously looking at my watch, but then I interrupt with 'please, I don't have much time left before my flight leaves'. That gets his attention. In our two-minute conversation, the guy in black backs up everything the other three people have told me, adding that '429 is reasonable; your luggage is already on the flight, and it will cost Iberia a lot of money to delay the flight and get it off'. I curse. He also seems surprised at the notion that I'm not allowed to take a tripod in my carry-on luggage. Hmm. Figuring I have nothing to loose, I curse one more time, and make a run for it. When I reach the security checkpoint, I ask to be allowed to skip the queue in front of it, on the grounds that I have only 15 minutes left before my flight leaves. Mind you, this is not the same security checkpoint as the one where I was rejected about an hour earlier; this is the security checkpoint between the departures hall and the secure area, whereas the other security checkpoint was one between two different terminals. I am granted my request, and quickly throw everything in the X-ray boxes. They need to go through my bag again. I help them, showing where everything conspicuous is, and opening my flute box so they know what's in there. He looks at everything, and signals that I can move on. Hang on, I think. This can't be right. 'Okay,' I ask? 'Yes,' he says. I run for the nearest info desk, show them my boarding pass, and tell them 'please, my flight leaves in 10 minutes, can you tell me where to go?' They are quick and efficient. Gate J40. I make a run for it again, and just make it in time. Of course, I could forget about my plans of finding a power outlet, plugging in my cell phone and calling my parents, but that's not a big deal—there's a train station at Brussels Airport. So what have we learned? Security on airports is random, arbitrary, non-standardized, and utterly stupid. Items that pose no danger at all—plastic bottles containing more than 100ml of water, small quantities of yoghurt that are over 100grammes but not over 100ml, tripods—are not allowed, while on the other hand I've occasionally gotten through security carrying knives and tools that are clearly forbidden by the rules. We've also learned that the rules very much depend on the particular person checking you. If you're refused for an item that is not a knife or a gun or something else similarly problematic, it may help to just find a different security checkpoint and try again. It's not as if they make any sense, anyway.

When you have a server on the Internet, you get lots of "brute force" attacks on the SSH daemon, trying plausible logins with a variety of passwords. Even with good passwords, these attacks might eventually succeed (and they're annoying even when they don't), so you want to thwart them. One way is to use fail2ban, a script that monitors the failed connections, and sets up firewall rules (for instance) blocking further connections from the attacking IP addresses. It's good, but it fills your logs with messages about IPs getting banned and unbanned after a while. And you're still at risk that the multiple connections crash the SSH daemon, or trigger a bug in it, or whatever. A second layer of protection can be to block all SSH connection attempts except when they come from known IP addresses, but that doesn't work when you're away from home, and you're locked out. Been there, done that. So, some wise people have devised a trick called "port-knocking". It's similar to only opening the door to people who use a special knock (think "That's all, folks"): the firewall stays closed, but it opens a tiny targeted hole to some IP addresses for a limited length of time, based on a secret handshake. The window for attack is therefore very small, and the SSH daemon stays idle most of the time. And you can still log on your hosted server when you're attending conferences. There are a variety of implementations for this concept. Some could be web-based (you need to submit the right password to a web page), some could use other services or a dedicated daemon. But when I started investigating port-knocking, I wanted something simple, preferably with no dependencies on a daemon that would need to be exposed to the net and potentially crash. I found an article on the Debian Administration website, but I wasn't entirely satisfied with it. The principles appealed to me (netfilter-only, secret handshake in the form of opening connections to secret ports), though, so I evolved it into my own implementation, which I proudly present to you today. The goals of this implementation were:

• flexibility;
• robustness;
• resistance to replay attacks;
• no dependency on user-land daemons;
• simple, easily auditable code;
• must not be a pain in the neck to use.

The bulk of the work therefore stays in the kernel's netfilter (that's for robustness and no user-land dependency), but the control interface is integrated with the usual firewalling script. Resistance to replay attacks is achieved by choosing hard-to-predict ports. So if someone snoops the wireless while I'm at a conference and catches my secret handshake, it'll only be valid for a short period of time, hopefully short enough to prevent dictionary attacks. The handshake is therefore calculated as a function of the current date and time, with an added secret seed. The following shell function calculates 5 port numbers within a given range (requires dc to be installed, for big-integer arithmetic):

calc_knock_ports ()  
    secret=$1
    bottomport=$2
    topport=$3
    nbports=$(( $topport - $bottomport + 1 ))
    hash=$(TZ=UTC date +%Y-%m-%d-%H-$secret   md5sum   awk ' print $1 '   tr a-z A-Z)
    num=$(echo 16i $hash f   dc)
    pk_port1=$(echo $num $nbports 0 ^ / $nbports % $bottomport + f   dc)
    pk_port2=$(echo $num $nbports 1 ^ / $nbports % $bottomport + f   dc)
    pk_port3=$(echo $num $nbports 2 ^ / $nbports % $bottomport + f   dc)
    pk_port4=$(echo $num $nbports 3 ^ / $nbports % $bottomport + f   dc)
    pk_port5=$(echo $num $nbports 4 ^ / $nbports % $bottomport + f   dc)
 

Okay. So this function calculates ports, now what? Now we're going to define a few chains by which netfilter will store states of IP addresses as they progress through the handshake:

setup_portknocking_tables ()  
    iptables -N portknock_into_phase1
    iptables -A portknock_into_phase1 -m recent --name PK_PHASE1 --set
    # iptables -A portknock_into_phase1 -j LOG --log-level notice --log-prefix "INTO PK_PHASE1: "
    iptables -N portknock_into_phase2
    iptables -A portknock_into_phase2 -m recent --name PK_PHASE1 --remove
    iptables -A portknock_into_phase2 -m recent --name PK_PHASE2 --set
    # iptables -A portknock_into_phase2 -j LOG --log-level notice --log-prefix "INTO PK_PHASE2: "
    iptables -N portknock_into_phase3
    iptables -A portknock_into_phase3 -m recent --name PK_PHASE2 --remove
    iptables -A portknock_into_phase3 -m recent --name PK_PHASE3 --set
    # iptables -A portknock_into_phase3 -j LOG --log-level notice --log-prefix "INTO PK_PHASE3: "                     
    iptables -N portknock_into_phase4
    iptables -A portknock_into_phase4 -m recent --name PK_PHASE3 --remove
    iptables -A portknock_into_phase4 -m recent --name PK_PHASE4 --set
    # iptables -A portknock_into_phase4 -j LOG --log-level notice --log-prefix "INTO PK_PHASE4: "
    iptables -N portknock_into_phase5
    iptables -A portknock_into_phase5 -m recent --name PK_PHASE4 --remove
    iptables -A portknock_into_phase5 -m recent --name PK_PHASE5 --set
    iptables -A portknock_into_phase5 -m recent --name PK_ESTABLISHED --set
    # iptables -A portknock_into_phase5 -j LOG --log-level notice --log-prefix "INTO PK_PHASE5: "
    iptables -N portknock_accept
    iptables -A portknock_accept -m limit -j LOG --log-level notice --log-prefix "ACCEPTED AFTER PORTKNOCKING: "
    # iptables -A portknock_accept -m recent --name PK_PHASE5 --remove
    iptables -A portknock_accept -j ACCEPT
    iptables -N portknocking
 

These chains use the recent module, which seems to be commonly available in standard kernels. You'll notice how, as one packet goes through these rules, its originating IP address moves from one set of "recent" addresses to the next. But no logic exists yet to make the packet actually go through these rules, so here comes the glue:

refresh_portknocking ()  
    calc_knock_ports f00b4r 10000 10999
    iptables -F portknocking
    iptables -A portknocking -p tcp --dport $pk_port1 -m state --state NEW                                                 -j portknock_into_phase1
    iptables -A portknocking -p tcp --dport $pk_port2 -m state --state NEW -m recent --rcheck --name PK_PHASE1 --seconds 5 -j portknock_into_phase2
    iptables -A portknocking -p tcp --dport $pk_port3 -m state --state NEW -m recent --rcheck --name PK_PHASE2 --seconds 5 -j portknock_into_phase3
    iptables -A portknocking -p tcp --dport $pk_port4 -m state --state NEW -m recent --rcheck --name PK_PHASE3 --seconds 5 -j portknock_into_phase4
    iptables -A portknocking -p tcp --dport $pk_port5 -m state --state NEW -m recent --rcheck --name PK_PHASE4 --seconds 5 -j portknock_into_phase5
    # echo clear > /proc/net/ipt_recent/PK_DONE
    echo clear > /proc/net/ipt_recent/PK_PHASE1
    echo clear > /proc/net/ipt_recent/PK_PHASE2
    echo clear > /proc/net/ipt_recent/PK_PHASE3
    echo clear > /proc/net/ipt_recent/PK_PHASE4
    echo clear > /proc/net/ipt_recent/PK_PHASE5
 

Right. This function adds rules to the portknocking chain. A packet injected into this ruleset will, depending on its destination port and whether its source IP address has already been seen, end up in one of the PK_PHASE* sets. All we have to do now is therefore to send some packets to this portknocking chain, and use the port-knocking sets to decide whether to accept incoming connections or not:

iptables -A INPUT -j portknocking
iptables -A INPUT -m recent --rcheck --seconds 5 --name PK_PHASE5 -m state --state NEW -p tcp --dport ssh -j portknock_accept

This example only mentions accepting incoming SSH connections, but it's in no way a limitation: a server of mine uses similar rules to DNAT certain ports to internal IP addresses. And there we have it for the server part: incoming SSH connections are usually ignored (well, handled by the rest of the firewall script, but let's assume that it drops these packets by default), but if one IP address knows the appropriate ports and sends a connection attempt to them in order, then it'll be able to open SSH connections for a little while after that. Of course, it's going to be boring if one has to send these packets by hand, but it can be easily automated by a script. Here's a ~/bin/portknock.sh I have:

#! /bin/sh
host=$1
port=$2
calc_knock_ports ()  
[...]
 
calc_knock_ports f00b4r 10000 10999
for i in $pk_port1 $pk_port2 $pk_port3 $pk_port4 $pk_port5 ; do
    nc -w 1 $host $i < /dev/null > /dev/null 2>&1
done
nc $host $port

It's designed to be called with two parameters, a host and a port, and it needs netcat in addition to dc. Why the last line, I hear you cry? Because then I can just add the following lines to my ~/.ssh/config:

Host blahblah
  IdentityFile foobar
  ProxyCommand /home/roland/bin/portknock.sh %h %p

...and SSH will automagically tunnel its network socket through the script, which will in turn happily tunnel that through netcat after completing the secret handshake. And when I type ssh myserver on my laptop, interesting stuff happens behind the scenes, and a special, just-for-me hole is opened in the server firewall, just for the few seconds I need to establish the SSH session (packets belonging to established TCP sockets are allowed by the firewall's connection tracking). Note: This article is deliberately short on details and ready-to-run scripts. Firstly because firewall scripts vary wildly so any script would have to be adapted anyway, but mostly because security is best handled with one's brain switched on. Fiddling with a firewall can easily open gaping holes or lock everyone out. So please make sure you understand what goes on before blindly pasting stuff into your own setup. Some of the lines that are commented out may also be of interest, and were left as an exercise for the reader. Other lines were not included, and are also left as a rather important exercise to the reader; note in particular how the netfilter rules as currently established do not mitigate the replay attacks...

So something Bdale came up with this morning at breakfast (and during his talk too, apparently, which I didn't attend) was this idea of a "hardware compatibility test"): a bootable image that hardware vendors could run to see whether their hardware would run Debian. Apparently all the other vendors have it, too, and the lack of it may be one of the main reasons why Debian isn't currently supported by a whole lot of hardware vendors yet. Such a test wouldn't have to do all that much; just boot the machine (if it can) with the kernel that would be used for the installer and the system that is eventually installed; then run through a check of the available hardware, and finally come up with some kind of score that tells the vendor whether their hardware is supported at all, or if not, what they could do to improve the score. It seemed to me (and to Mark Hymers, who was seated to my left) that this is something that could be done fairly easily with a slightly modified version of debian-installer. It would be okay if there was a different version for every Debian release we do; and I tend to think it's not even going to be a problem if the first time we don't make the release, but release such a test slighty after the release of Debian. Having such a test would certainly give hardware vendors an incentive to improve their Debian support, especially if it's a simple thing that they can have some summer student do over all their hardware who'd then store the results in a database of sorts. Or so. Additionally, if we do this right, we could diversify between 'a wireless driver that will probably work if you load ndiswrapper or something similar' (which would get a score that tells them 'yes, it will run Debian', but no perfect score) and 'a wireless driver that works with free drivers and no additional firmware required' (which would get a perfect score if there's nothing more). By doing this, we would put Debian's collective driving force behind a move to better and more Linux-friendly hardware, which can only be a good thing. Bdale seems to thing this could be an industry-changing thing, and I can't think of a reason why it wouldn't work. Except for one: I'm not sure I'll have the time to work on this myself; and even if I would be sure of that, it's not going to be something that I can do all by myself -- other people would have to run the test on their hardware and communicate the results. So here's a request: is anyone else interested in this kind of thing? It doesn't sound like something too complicated; and given my business, it surely is something I have a personal interest in, so I will try to make time for it. But I can't do it alone...

Since 2005, the talks at Debconf have been recorded on video, to be
published online. Beginning in 2006, talks have also been streamed
live. One of the goals is to get recordings in high quality online
immediately, with little or no post-production work. The video
switcher dvswitch, realized in software, and a disk-based recording
workflow is bringing us closer to that goal. Tape is still used as
backup in case of failures, but we expect those to become rarer as
the system matures. A large part of the post production work is
restoring failed recordings.

Dvswitch was developed by Ben Hutchings just in time for the Debconf7
in Edinburgh. It enabled a multi-camera live production using cheap
cameras and modest laptops. The laptops relays DV streams over
TCP/IP. This avoids any degradation due to long cable stretches, and
makes cabling cheap and convenient. The output is DV straight from
the cameras, producing a very crisp master video.

Dvswitch works with sources and sinks. The sources send video from a
file or a firewire port to a listening instance of dvswitch, which can
run on a remote machine.
dvswitch listens to several sources and displays a scaled down black
and white preview image of each one. One of the sources is displayed
at full resolution in colour; this is the outgoing stream, which is
sent to the listening sinks. Each sink may send the stream to disk or
to an encoder for live streaming. It is common to do both; store the
raw master to disk, and forward the master to an encoder, and
subsequently to a streaming server.

While dvswitch saves us a bundle in hardware, the video team is still
heavy on manpower. Remotely operated cameras would help, and we are
still looking for affordable solutions that work well on Linux.


The talk will cover the hardware, software and manpower required for
a typical dvswitch usecase. Some caveats and challenges regarding
sound, lighting and rigging will be discussed. A live demonstration
of dvswitch in use will be given. We would also like to offer
rehearsal sessions with the demo rig for those who are interested.Full event details

Since 2005, the talks at Debconf have been recorded on video, to be
published online. Beginning in 2006, talks have also been streamed
live. One of the goals is to get recordings in high quality online
immediately, with little or no post-production work. The video
switcher dvswitch, realized in software, and a disk-based recording
workflow is bringing us closer to that goal. Tape is still used as
backup in case of failures, but we expect those to become rarer as
the system matures. A large part of the post production work is
restoring failed recordings.

Dvswitch was developed by Ben Hutchings just in time for the Debconf7
in Edinburgh. It enabled a multi-camera live production using cheap
cameras and modest laptops. The laptops relays DV streams over
TCP/IP. This avoids any degradation due to long cable stretches, and
makes cabling cheap and convenient. The output is DV straight from
the cameras, producing a very crisp master video.

Dvswitch works with sources and sinks. The sources send video from a
file or a firewire port to a listening instance of dvswitch, which can
run on a remote machine.
dvswitch listens to several sources and displays a scaled down black
and white preview image of each one. One of the sources is displayed
at full resolution in colour; this is the outgoing stream, which is
sent to the listening sinks. Each sink may send the stream to disk or
to an encoder for live streaming. It is common to do both; store the
raw master to disk, and forward the master to an encoder, and
subsequently to a streaming server.

While dvswitch saves us a bundle in hardware, the video team is still
heavy on manpower. Remotely operated cameras would help, and we are
still looking for affordable solutions that work well on Linux.


The talk will cover the hardware, software and manpower required for
a typical dvswitch usecase. Some caveats and challenges regarding
sound, lighting and rigging will be discussed. A live demonstration
of dvswitch in use will be given. We would also like to offer
rehearsal sessions with the demo rig for those who are interested.Full event details

Like last year, we have a feedback system available again. If you attended an event during DebConf and want to give feedback on it, including free-form text to the presenter, this is your chance! As an attendee To give feedback please look at the schedule and select the event you want to comment on. You will notice a box saying Did you attend this event? Give Feedback, follow its link and fill out the form. As a speaker If you want to see what feedback your event got, please log in to the submission system and select the event you want to know more about. You will see a tab named Feedback, behind which you can find all the newly-written love letters.

Not the plastic kind, the squishy furry kinda that need to GET THE HELL OUT OF MY HOUSE.

GRRR

Yesterday was visit 4? 5? from the exterminators. We got them to lay more traps. And this morning (I love my son dearly. Especially the opportunity to cuddle him to sleep at 4am. *sigh* I'm actually mostly serious. I've only been able to hold him for a few weeks now, and weaning means that I'm getting to do a lot more with him that only auzure_skies could do before. And how long will a child let himself be cuddled to sleep? This is just mixing poorly with the jetlag from the recent trip) I had the joy of watching the mouse run out from beside where one trap is, and behind the couch where another trap is, triggering neither of them.

What I really need is a flame thrower and a forgiving insurance company.

GRRR

Somehow (thankfully) I've managed to avoid much to do with backups in my career as a sysadmin. It's always been someone else's responsibility, that's been fine by me. For some reason, I've been more paranoid lately, and with all of the crazy shit I've been doing to daedalus, I wanted to have a backup, just in case. Maybe it's old age. So a while ago, I went and had a stab at setting up Amanda, since pretty much whenever I've been near a bunch of sysadmins and someone asks for a recommendation on what to use, "Amanda" is the answer. I jumped through all of the hoops to have caesar be the backup server, and daedalus be a client. I set up a virtual tape library on caesar. I think I then lost interest for a while, until I was going to upgrade daedalus to Etch, and I wanted to have a successful backup first. I had the holding disk and the virtual tape library on the same filesystem, and it was nice and big, yet I kept running into this error about insufficient space. "dump larger than available tape space" was the complaint. I tried making the filesystem larger. I tried adding more virtual tapes. Nothing would placate it. After another round of Googling, I discovered that the problem was because Amanda would only only span a maximum of four tapes, and the filesystem I was trying to backup was way bigger than that. So I told it to use up to 10 tapes in a run (runtapes 10) and then lo and behold, I got a successful backup out of the sucker. So that was mostly all good, but occasionally a backup would fail, or fail once an succeed on a retry, because tar exited non-zero, with "file changed as we read it". I did some more Googling tonight, and discovered this Amanda/GNU tar compatibility matrix. It turns out that the version of tar and the version of Amanda shipped in Debian Etch aren't compatible with each other. Suck! Oh wait, they're maintained by the same person! Argh! So aside from the occasional backup failing due to a file being written to at the time of the backup, it's working fairly well. My DSL link isn't the fastest, so a full backup of daedalus can take over 48 hours to complete, but I'm not paying for inbound bandwidth at home, so it's not a big deal. I initially thought that to do a restore, I'd have to run amrecover on daedalus, and then I'd have to stream the contents of multiple tapes back to it at the appalling uplink speed of my DSL connection, but fortunately amrecover has a sethost command, so I can restore just the files I need on another machine local to caesar at LAN speeds, and just transfer the files I restore to daedalus. So that's all pretty neat. I quite like the FTP-client-like interface of amrecover. It's cool how you can use setdate and just go back in time. I had the opportunity to do a test restore recently when one of my users nuked his Maildir directory by accident. Unfortunately I was unable to recover the needed files in that case, and I'm not entirely sure what the problem was, so there's some more testing to be done before I'll be fully confident that I can rely on it. There's a lot of configuration options available as well, and I think I got the config I'm currently using from a template or something, so there's probably a fair bit of tweaking I can do. Oh, and I'm constantly reminded of this quote from a previous life, where technical details bubbled too far up non-technical management:

"Who is Amanda, and what is her role in the backups?"

One of the things I've wanted to do since I discovered that Caltrain (and the VTA light rail) are well-equipped to take bikes, was go for an outing further afield on our bikes using one of these methods of public transport. So we finally got around to doing that yesterday, when we threw our bikes on the train, and BART, and went for a ride around Golden Gate Park. The grand plan was to bike to the Caltrain station, take Caltrain to Milbrae, BART to downtown, then bike from there to the park, and then catch an afternoon showing of The Dark Knight in IMAX at the Metreon, then bike back to the BART station, and reverse the whole thing. We had a minor hiccup in that Sarah had just gotten her bike back from a friend she'd lent it to, and as we were about to head to the Caltrain station, discovered that it a broken spoke. She managed to extract the spoke and we got to the station with a couple of minutes to spare. It turned out that Mike's Bikes were fairly close to the BART station, so we stopped in there on way to the park, and they were able to fix the spoke on the spot in 20 minutes for the princely sum of $21. Unfortunately the weather was pretty typical summer San Francisco weather, and it was quite cold and foggy. It didn't get any better as we got closer to the park (and the coast), so the ride around the park itself wasn't terribly exciting. The hill we had to get over (Hayes Street) was a bit of a slog. On the way back we saw the filming of a Japanese Nissan commercial (complete with right-hand drive car). I'd done some research into bike parking beforehand, and found that all of the parking garages are required to provide bicycle parking, and there's a pretty comprehensive list. So we parked our bikes in the Moscone Center garage, which was about a block from the Metreon, and went and caught the movie. The Dark Knight was really good. Very... dark. I really liked Ledger's portrayal of the Joker, much better than the original. I wonder if they'll just keep re-imagining the Batman movies over and over? There was pretty good continuity from Batman Begins. I thought the voice of Batman was a bit ridiculous though, at least initially. You kind of got used to it after a while. Anyway, we got back to the parking garage, and some lowlife had cut through the cable lock that we'd used to lock our bikes to each other and the rack, and stolen Sarah's bike! Annoyed does not begin to describe it. We trundled off the seven or eight blocks to the Hall of Justice to file a report. The SFPD weren't the least bit interested, really. The somewhat astounding thing was the bike racks were right behind the cashier's office, and there was video surveillance, and someone still managed to just walk right in, cut the cable, and walk out with the bike. We checked with the duty manager, and he reviewed the video footage and said they have footage of him walking in and then walking out with the bike. So hopefully the police will get hold that. We have to see if we can dredge up the purchase documentation for the bike and see if the serial number is recorded. I have no idea if we'll ever see the bike again. Our renter's insurance may cover it, but I suspect the deductible won't make it worth our while to make a claim. I have to say (and it's not like it's a recent discovery or anything) that the Bay Area's public transportation is a joke. It cost us $32 to go from Mountain View to Downtown San Francisco, via Caltrain and then BART. Our Prius takes about 11 gallons at worst, and with gas prices being at say $4.30 a gallon, that's about $47 a tank. We get about 400 miles out of a tank usually, and it's vaguely 40 miles from home to the guts of Golden Gate Park. So it's cheaper, and faster to drive to San Francisco than it is to use a bicycle and public transport. Particularly when you factor in the risk of theft of your bicycle. Our next bike lock will be one of those fancy Kevlar ones.

When I gave a Revealing Errors talk at Lug Radio Live USA, I had the misfortune of being up against Robert Love's talk on Android which many people at the conference wanted to see -- myself included! One person who showed up to my talk anyway was Allison Randall. She was apparently entertained enough to invite me to give a short version of the talk as one of the keynote presentations at OSCON 2008! In the talk, I covered the ideas behind my Revealing Errors project and quickly walked through a few examples that showcase what I'm trying to do. I'm happy with the result: a couple thousand people showed up for the talk despite the fact that it was at 8:45 AM after the biggest "party night" of the conference! For those that missed it for whatever reason, you can watch a video recording that O'Reilly made and that I've embedded below. A larger version of the Flash video as well as a QuickTime version is over on blip.tv and I've created an OGG Theora version for all my freedom loving readers.

This past weekend, I took my Canon EF 24-105mm f/4L lens to take some indoor pictures. I had been using it previously to take outdoor pictures, and had used my polarizer, and left it on the lens when I was done. So this weekend, I tried taking it off, and couldn’t. That’s the first time this had happened to me. I wasn’t sure what to do. Fortunately for me, before I did anything too extreme, Adam suggested I get a filter wrench. So I headed over to Wolf Camera to get one. Wolf didn’t have one, so I asked where I could get one, and they suggested someone else who also didn’t have one, but they suggested Keeble & Shuchat Photography, who I had been to before. They did have wrenches, but not in the size that I needed. They suggested I just bring the lens to their repair department, which I did. Fifteen minutes later, the filter still wasn’t off the lens, and they had given up. My lens is now on its way to Canon USA for a repair, and hopefully I’ll get both parts back, separated, and in usable condition. They estimated the cost would be somewhere between two and three hundred dollars. I guess that’s what happens when a lens that costs $1000 and a filter that costs $100 decide to misbehave in tandem. And I was hoping the repair would be a simple $5 filter wrench!

One of the things of getting too much mail is that you will get swamped in it, sometimes to the level of not even managing to figure out there's been replies on your blog for the past several weeks. Oops. Apparently quite a number of people answered to my blog post about the belgian government issues, and I only found out right before leaving for Argentina. They're now all accepted from moderation, but that doesn't mean I can't follow up on them anymore. Most of them just agree with what I have to say, or posit another opinion (which is fine), but some clearly show a misunderstanding of what I was trying to say. So, since I don't want to appear as one posting gibberish, allow me to clarify:

"I could say that some other things about the past deb cle also puzzle me, such as the insistence of some people to get an unconditional split of BHV, thereby destroying all chances of even remotely reaching a compromise." You are saying that you would accept giving in to the demands of the Francophones that the Flemish give up territory. (Think about it, what century are they from? In what other country does one community demand the enlargement of its territory as an exchange for fixing a situation which the constitutional court has ruled to be illegal?)

Thanks for asking, but no, I'm not saying that. Let's be clear about this: there's a huge difference between a position that says "we need to split BHV, period" on the one hand, and "we need to give territory to the francophone community" on the other. It should be perfectly possible to, say, have the flemish community come up with some benefit to the francophone community in some respect somewhere that does not include "giving territory to the south of france"; but apparently the "negotiators" think not. To quote just one example: at some point Reinders (MR) suggested that a federal election circle be created to replace BHV, so that francophone politicians could still be elected in flanders, but also the other way around. This proposal was however killed by flemish politicians before the press as "not even negotiable" without even having discussed it. This, and other similar examples, I do not understand. After all, the fact that the constitutional court has ruled the current situation to be illegal does not change anything about the fact that this is still a request from the Flemish part of the country, and not from the Francophones; anyone telling you anything else is simply lying. There's nothing wrong with wanting something and being declared correct in court, of course; but there is something wrong with wanting that unconditionally. Unless you won a war, that is. And then still. Of course, not caring about much of the definitions of many political parties and not being a politician in any way, I ticked off someone who just happens to be a member of one of the parties I don't even like in the first place. Amedee, in case it matters: I didn't call CD&V a "Catholic" party to imply anything, but simply because I'm blissfully ignorant of the difference between Catholic and Christian. And happily so, too, given the CD&V's current behaviour. Oh, and the SP.A is not my favourite party; it's just that they seemed to be the more sensible of the lot during the last elections' campaigns. What's really my favourite party isn't something I'll tell you (or anyone), though.

Thank you, Ted Lemon and Paul Vixie for the ISC DHCP server and client! My days would be so boring without them. I revel in your wisdom, experience, and sheer genius when I get behind some of the design decisions you made when writing those pieces of software. My current favourite is the hook integration into dhclient-script(8). Read what the manpage has to say about it:

[ ] the client script checks for the presence of an executable /etc/dhcp3/dhclient-enter-hooks script, and if present, it invokes the script inline, using the Bourne shell . command. The entire environment documented under OPERATION is available to this script, which may modify the environment if needed to change the behaviour of the script.

Hooks which can modify the environment and thus influence all other hooks that follow, as well as the script which applies the network configuration dhclient obtained to the local machine! Yay! Genius! You are my heroes. NP: Pluto: Pipeline under the Ocean

Sami, it's really not that bad. There are, as you say, many variables to modify the behaviour of several programs. What you seem to have missed, though, is that there are really only four types of variables:

LANGUAGE

This is a GNU-specific extension which allows you to set fallbacks on different languages than "C" (which is locale-speak for "disable translation completely"). It somewhat overrides LC_ALL, but then at the same time it doesn't. Pretty strange thing, this variable. See "info gettext" and search for LANGUAGE if you want the ugly details.

LC_ALL

This variable exists to (temporarily) override any locale-related variable; for instance, when you want to file a bugreport in grep and you want to make sure you don't get any output that might be unintelligible for the developer, you could run LC_ALL=C grep --broken-parameter to temporarily disable locales. Using LC_ALL completely and utterly overrides anything else, so you probably don't want to set it in the general case.

LC_NUMERIC, LC_PAPER, LC_MESSAGES,...

These variable are meant to be used to divert from the defaults. For instance, as in your case, a user may want to have messages in en_US but have dates and papersizes etc be as is common in fi_FI. In that case, you'd set the default to fi_FI but set LC_MESSAGES (which specifies the language in which messages are set) to en_US. Or you might be a Dutch-speaking Belgian guy living in the US. You'd set the default to nl_BE.utf-8; but since A4 paper isn't easy to come by where you live, you'd set LC_PAPER to en_US.

LANG

This variable is used for "the default". If you haven't specified LC_ALL, nor the other relevant LC_* variable, then the value of LANG is used for whatever you're trying to do.

So what you really want to do is to set LANG to be fi_FI.utf-8, but have LC_MESSAGES be either en_US or, perhaps, C. This should give you english messages, but finnish conventions for date and number formats. Do note, though, that this is only the theory. It may be the case that some software is broken and doesn't look at the correct LC_* variable. If that happens to be true for some software you've seen, just file a bug...