On 22nd of October 2004 an event called OS04 took place in Seifenfabrik Graz/Austria and it marked the first official release of the Grml project. Grml was initially started by myself in 2003 I registered the domain on September 16, 2003 (so technically it would be 11 years already :)). It started with a boot-disk, first created by hand and then based on yard. On 4th of October 2004 we had a first presentation of grml 0.09 Codename Bughunter at Kunstlabor in Graz. I managed to talk a good friend and fellow student Martin Hecher into joining me. Soon after Michael Gebetsroither and Andreas Gredler joined and throughout the upcoming years further team members (Nico Golde, Daniel K. Gebhart, Mario Lang, Gerfried Fuchs, Matthias Kopfermann, Wolfgang Scheicher, Julius Plenz, Tobias Klauser, Marcel Wichern, Alexander Wirt, Timo Boettcher, Ulrich Dangel, Frank Terbeck, Alexander Steinb ck, Christian Hofstaedtler) and contributors (Hermann Thomas, Andreas Krennmair, Sven Guckes, Jogi Hofm ller, Moritz Augsburger, ) joined our efforts. Back in those days most efforts went into hardware detection, loading and setting up the according drivers and configurations, packaging software and fighting bugs with lots of reboots (working on our custom /linuxrc for the initrd wasn t always fun). Throughout the years virtualization became more broadly available, which is especially great for most of the testing you need to do when working on your own (meta) distribution. Once upon a time udev became available and solved most of the hardware detection issues for us. Nowadays X.org doesn t even need a xorg.conf file anymore (at least by default). We have to acknowledge that Linux grew up over the years quite a bit (and I m wondering how we ll look back at the systemd discussions in a few years). By having Debian Developers within the team we managed to push quite some work of us back to Debian (the distribution Grml was and still is based on), years before the Debian Derivatives initiative appeared. We never stopped contributing to Debian though and we also still benefit from the Debian Derivatives initiative, like sharing issues and ideas on DebConf meetings. On 28th of May 2009 I myself became an official Debian Developer. Over the years we moved from private self-hosted infrastructure to company-sponsored systems, migrated from Subversion (brr) to Mercurial (2006) to Git (2008). Our Zsh-related work became widely known as grml-zshrc. jenkins.grml.org managed to become a continuous integration/deployment/delivery home e.g. for the dpkg, fai, initramfs-tools, screen and zsh Debian packages. The underlying software for creating Debian packages in a CI/CD way became its own project known as jenkins-debian-glue in August 2011. In 2006 I started grml-debootstrap, which grew into a reliable method for installing plain Debian (nowadays even supporting installation as VM, and one of my customers does tens of deployments per day with grml-debootstrap in a fully automated fashion). So one of the biggest achievements of Grml is from my point of view that it managed to grow several active and successful sub-projects under its umbrella. Nowadays the Grml team consists of 3 Debian Developers Alexander Wirt (formorer), Evgeni Golov (Zhenech) and myself. We couldn t talk Frank Terbeck (ft) into becoming a DM/DD (yet?), but he s an active part of our Grml team nonetheless and does a terrific job with maintaining grml-zshrc as well as helping out in Debian s Zsh packaging (and being a Zsh upstream committer at the same time makes all of that even better :)). My personal conclusion for 10 years of Grml? Back in the days when I was a student Grml was my main personal pet and hobby. Grml grew into an open source project which wasn t known just in Graz/Austria, but especially throughout the German system administration scene. Since 2008 I m working self-employed and mainly working on open source stuff, so I m kind of living a dream, which I didn t even have when I started with Grml in 2003. Nowadays with running my own business and having my own family it s getting harder for me to consider it still a hobby though, instead it s more integrated and part of my business which I personally consider both good and bad at the same time (for various reasons). Thanks so much to anyone of you, who was (and possibly still is) part of the Grml journey! Let s hope for another 10 successful years! Thanks to Max Amanshauser and Christian Hofstaedtler for reading drafts of this.

Wooohoo, we finally released squeeze! Many thanks to everyone who worked on this the past 2 years and also it's nice to see the new "corporate" design going live!

At the beginning of DebCamp, Zack started the RCBC the Release Critical Bug squashing Contest. Two weeks later not only DebConf10 is over but we also have results for the RCBC:

In summary: It was a huge success, we managed to fix

• 139 RC bugs in testing/unstable
• 79 RC bugs in stable

And the winners are:

• Stable: Gerfried Fuchs (77 bugs)
• Testing/unstable: 1. Moritz M hlenhoff (32 bugs), 2. Nico Golde (17 bugs), 3. Alexander Reichle-Schmehl (16 bugs)

All details can be found at http://wiki.debconf.org/wiki/DebConf10/RCBC.

The winners who haven't collected their prizes at the closing ceremony will get them be snail mail.

Finally let me thank

• our donors of the prizes
• Micah and Zack for initiating the contest
• Mehdi for being my co-judge
• all participants who hugely improved Debian in the last two weeks

fail2ban is used by many people to prevent certain types of DoS attacks. I use it myself to reduce trackback spam a little bit.

While this tool becomes quite handy in such situations it is also not generally recommend because you can shoot yourself in the foot. If one of the used filters has a bug and results in incorrect parsing your fail2ban installation might end up banning arbitrary IP addresses or even your own IP range (not even mentioning IP spoofing).
There existed at least two bugs of this kind to my knowledge and since regex might not always be easy I'm sure there will be more in the future.

Since I didn't want to look for a specific regex bug in one of the filters I thought about IP spoofing again and looked at fail2bans filters. What I needed was a filter processing log entries of a service listening on a UDP socket as TCP/IP spoofing over the internet doesn't really work well these days. Finding such a filter would mean an instant win situation. To my surprise there is such a filter: config/filter.d/named.conf

This filter is used to parse log entries consisting of denied DNS queries produced by bind. Interestingly there is even an article at debian-administration describing how to setup fail2ban to mitigate a DNS DDoS attack. This is of course a bad idea and I have no idea why this filter is shipped in a default fail2ban installation. DoSing abritary IP addresses with this filter in use becomes as easy as firing up scapy and querying the server with a forged source IP:

>>> send(IP(dst="81.169.172.197",src="xx.46.63.71")/UDP()/DNS(rd=1,qd=DNSQR(qname="foao.modprobe.de")))
.
Sent 1 packets.

This ends up as:
May 26 22:32:22 modprobe named[30245]: client xx.46.63.71#53: query 'foao.modprobe.de/A/IN' denied

in the bind logs which in turn results in:
2010-05-26 22:32:05,551 fail2ban.actions: WARNING [named-refused] Ban xx.46.63.71

In this example the spoofed IP was xx.46.63.71 which is not under my control.

Mission statement: don't use fail2ban unless you really want to shoot yourself in the foot or know pretty well what you're doing

Two weeks ago I got myself a nokia n900 phone which is running maemo 5. So far I am quite happy with it, given that my previous phone was a sony erricsson p1i which is pretty crappy.
I've taken some notes about my experiences:

• under normal use the battery lasts for ~ 2 days, if I'm using 3G the whole day I need to recharge it daily though


• the terminal has a bug which results in the enter key not working under some conditions, ctrl-m works as a workaround though


• playing normal dvdrips in mplayer is absolutely no problem without downscaling, 720p doesn't perform though


• I somehow managed that my screen flipped and I wasn't able to flip it back, only a reboot solved that


• It is not clear to me which tools you will find in the list of installable packages and which are only visible with apt-cache search. I also managed to end up with a doubled launch icon in my application list for some application


• the termininal is not usable anymore after an ncurses program crashed, "reset" doesnt help either


• wireless uses less battery than umts, way less


• the back button in the browser is per default opening a fancy eyecandy browse history which is slow, so I mostly use backspace to browse back


• there is lots of useful tools in the extras-devel repository, e.g. I can control my mpd via mmpc from the phone which is great



• importing contacts works flawlessly, also merging existing contacts works as expected


• jabber (including xmpp calls) are integrated in the contacts information (you can merge a jabber uid into an existing contact)


• i've no idea yet what the internal video player is, but i wasn't able to play a non downscaled XviD file with it, mplayer does play it fine


• freely placeable widgets are awesome


• it's is really userfriendly and no geeky linux user phone


• i would prefer not having busybox per default, i can install bash but the libc is still from busybox which implies world readable password hashes in /etc/passwd, so no other user accounts on my mobile


• is there disk encryption available?


• n900fly can't cause any good


• gps with nokia maps is ok and I find it pretty usable even if a google maps client would be nice as well


• the mp3 mplayer sucks unless you have tagged your music properly, you can't just play some folder without having a playlist for it


• mplayer as an alternative from the console is no real alternative either, if you don't redirect its output to /dev/null it gets stuck in a loop when the display blanks,


• app manager locks dpkg lock even if you just list available programs, no idea why this is needed and no idea how aptitude and synaptic are doing this


• is there a good todo manager which comes with a widget listing todos?


• is it possible to install armel debian packages without having a debian chroot?


• sms are nicely organized per contact in an instant messaging fashion


• the builtin accelerator works nice and you can automatically flip the screen when you want to dial a number, sometimes happens by accident though


• the multiuser support works awesome and you get a nice overview of open applications in a compos fashion, it may be wise to have not 40 applications open though


• the list of processes is already huge (like 160 processes running in the background)


• i haven't checked out the sdk yet but I will do that soon as I need e.g. newsbeuter for RSS


• hardware feels robust, arm cortex a8 is imho a very good processor, RAM could be more (the phone is heavily swapping)


• you can not yet use the phone as a wireless access point without building your own kernel images, some people seem to be working on this


• you can manipulate all kinds of stuff through the sysfs, including the phone led and the vibration


• wireless certificates are sometimes shown to be invalid but there there is no details button, you can click only "done"

Those are the things I came up with while using the phone. The calling functionality and everything which is only phone related really works fine and the sound quality while talking to someone on the phone is also really good. So far I am really happy with the phone and I can only recommend it. I hope I'll have some time to port some applications to maemo soon.

A lot of people used to configure their ssh servers to listen to a port different from 22 to prevent their logs getting filled with login attempts by script kiddies. I just stumbled over sslh which is a very nice alternative to that in case you have a webserver running which supports ssl. sslh is also a good choice if you are behind a corporate firewall and ssh is filtered while SSL is probably not (and this is simpler than tunneling).

The idea is pretty simple but cool. The daemon listens on port 443 and depending on whether the client has written something into the socket (SSL) or not (SSH) after connecting the daemon "forwards" the connection to the listening service running on the same host. In case of SSL/HTTPS the client will send a request after the handshake and in case of ssh it won't. Pretty simple. I just did a quick test on one of my hosts and it seems to work great. The tool is written in C, consists of < 500 SLOC and the code looks clean to me. If you're using Debian you can just apt-get install it.

Lenny well supported We re pleased that Lenny released with good support for the Eee PC and are now turning our efforts to make Squeeze even better, while continuing to provide support for our Lenny user base. The standard Lenny installer can install Debian on all models of Eee and our custom installer provides the ability to install over wireless for almost every model (more about this later) from a very small image. The latter continues to be our recommended install method, since in addition to being wireless-ready, the custom installer also handles a few other small eee-specific configuration chores to make as much as possible just work right after the install. Solid mainstream support We ve made good on our promise to make Debian work on the Eee PC, not a derivative, many of which use a custom kernel instead of the stock kernel as we do and use a special desktop instead of our users favourites. While we agree that some intriguing things can be done in these areas, it is no substitute for mainstream support. Our users are better served by a solid foundation than specialised modifications that limit their choices. We want them to be able to enjoy the freedom to mold Debian, the universal OS, into whatever suits them best. Squeeze support started Work is well underway on supporting all Eee models in Squeeze. For months, several team members have been experimenting with new kernels, producing support for them in eeepc-acpi-scripts. The current release of this key package (version 1.1.0) supports Linux 2.6.29 and contains enhancements for wifi, sound hotkeys, bluetooth, external displays and OSD. Squeeze will support wired & wifi on all current models With the appearance of 2.6.29 in Sid, all ethernet and wifi cards used in all models of Eee today are supportable without the need for out-of-kernel or non-free drivers. Madwifi is replaced by the free ath5k driver, the non-free rt2860 package is replaced by mainstream kernel support, (though it still requires non-free firmware provided separately,) rtl8187se is included, making it possible now for us to support the model 701SD, and ath9k is included, making full support for newer models such as the 1000HE possible. Lenny backports and live demo All of these changes can be enjoyed today by Lenny users. Just add Daniel Baumann s Lenny kernel backport repository and then install the 2.6.29 kernel and an updated acpid. See our upgrade howto for details. You can try a small (less than 256M) demo of this configuration by downloading beta 2 of our Live USB image. Accessibility Late last year, we discussed how to make it easier for the blind to install Debian unassisted on their Eee PCs. As it was a simple change, we now include brltty in the custom installer, but we understand that some users also need software synthesized text-to-speech, something for which there is no support yet in the standard Debian-installer. We understand this isn t an easy thing to fix, but hope someone will rise to the challenge. Growing team of developers We welcome Darren Salt and Raphael Geissert to the team this year. Both have been actively making contributions to the eeepc-acpi-scripts package over the past months, fixing some outstanding bugs and readying it to handle changes in more recent kernel releases. Moved eeepc.debian.net to new hosting Nico Golde, who hosted eeepc.debian.net for the first year development, has turned his focus to other areas of Debian. Glenn Saberton has stepped in to provide a new home for it. We thank them both for their efforts and for a smooth, uneventful transition from one host to the other. Size of user community Speaking of the move, earlier this year, Glenn shared with us some interesting archive traffic statistics that give us a rough idea how many users we have. For the months of December and January, after factoring out bot hits, we were seeing about 300,000 hits from 15,000 unique users per month. The site handles roughly 60G of traffic per month, most of that from thousands of downloads of our custom installer image. It s hard to draw any firm conclusions about the size of our user base from these stats, as many users may be on dynamic IP numbers, inflating the numbers, but we can conservatively say we have at least 5000 users. Other interesting statistics are that we have anywhere up to 80 users at any given time on our irc channel and over 250 users on the mailing list. Help wanted The Asus Eee PC line continues to expand, with 24 models listed so far. It is a challenge to keep up support for all of them. We re encouraged to see Asus choose a new b/g/n wifi chipset for their 1002HA that is supported by a DFSG free driver ath9k in this case. It appears that the new Atom N280-based 1000HE uses the same chipset as well (though be careful: I know of at least one user who bought a 1000HE in Argentina expecting it to have this chipset and was disappointed to find it had the Ralink chipset instead, we guess because of availability). If this trend continues, we ll be that much closer to our goal of full support for Squeeze main. As it stands, we re already as close as we can get given the state of rt2860 and no prospect on the horizon for replacing the non-free firmware. If you would like to help us out in any way, whether by testing, debugging, patching, or improving our documentation, get in touch with our team. We rely on your feedback to keep Lenny in good shape and work towards making Squeeze even better for all users of Debian on the Eee PC.

Yay, newsbeuter 2.0 was just released! I am way too lazy to summarize all the new features and bugfixes, It's just to many of them. Here is the changelog:

Added more flexible dialog handling
Improved position handling in article list (fixes #112; thanks to Isaac Good)
Fixed a lot of bugs (#102, #111, #117, #130, #131).
Added ability to specify a list of OPML URLs when using OPML as URL source.
Added config option "keep-articles-days" to optionally keep articles only for a limited number of days.
Added config option "bookmark-interactive" to indicate that the configured bookmarking command is interactive.
Don't display authentication information in URLs (fixes #121).
Replaced mrss with new RSS/Atom parser.
Added ability to search for text from the article view.
Added basic support for Yahoo Media RSS.
Made article view pager configurable.
Improved HTML rendering of links and underlined and bold text.
Added ":source" commandline command to (re)load configuration files.
Implemented "pipe-to" key to pipe articles to external commands.
Implemented backtick evaluation for configuration files.
Extended filter language with "between" operator.
Added "age" attribute for articles to filter them for relative age (in days).
Extended "set" commandline command to toggle boolean variables and reset configuration variables of all types to their default.
Added ability to configure local files as feeds.
Added a "random-unread" key to go to a random unread article.
When opening articles from a search result dialog, make search phrase stand out in article view.
Persist commandline and search history.
Implemented commandline completion.
Improved help dialog so that it now shows unbound functions.
Added ability to sort feed list and article list by interactively choosing the sort method.
Improved and extended conditional HTTP download handling.

The full release annoucement by ak is available on: http://newsbeuter.wordpress.com/2009/04/21/newsbeuter-20-released/

Also just uploaded the package to Debian unstable.

Congratulations to Steve, the new and old Debian project leader!

Check out the details on: http://www.debian.org/vote/2009/vote_001.

ssh is one of the programs I didn't really every read the manpage of (only to lookup stuff which I already knew is possible but forgot how). However there are some nice features you miss if you don't. Besides ControlMaster I just stumbled over another feature.

It is possible to add port forwarding on the fly without the need to open a new terminal and ssh connection.
ssh provides some escape characters to do some stuff in your current connection.
In the default setup the basic escape character is ~ (you can specify this by using EscapeChar in your configuration).

If you follow this by # character (and thus type ~#) you get a list of all forwarded connections.
Using ~C you can open an internal ssh shell that enables you to add and remove local/remote port forwardingsSome other more or less usefull escape sequences, have a look at man 1 ssh -> ESCAPE CHARACTERS

ssh is one of the programs I didn't really every read the manpage of. However there are some nice features you miss if you don't. Besides ControlMaster I just stumbled over another feature.

It is possible to add port forwarding on the fly without the need to open a new terminal and ssh connection.
ssh provides some escape characters to do some stuff in your current connection.
In the default setup the basic escape character is ~ (you can specify this by using EscapeChar in your configuration).

If you follow this by # character (and thus type ~#) you get a list of all forwarded connections.
Using ~C you can open an internal ssh shell that enables you to add and remove local/remote port forwardingsSome other more or less usefull escape sequences, have a look at man 1 ssh ->> ESCAPE CHARACTERS

Due to private issues with my page collecting debian.net domain names this service is no longer available.
I created a wiki page on http://wiki.debian.org/DebianNetDomains and redirect to this site.
Please contribute to the list and add your own registered aliases as this service was quite useful for a bunch of people.

Since quite some time I am exporting a list of all registered debian.net domains from our LDAP directory.
It is available at: http://people.debian.org/~nion/net-domains.html.

Reading that Neil didn't know about manpages.d.n and there is currently no easy way to get new interesting domains I thought I'd add an RSS feed to get informed about changes.
It is available at: http://people.debian.org/~nion/net-domains.rss

The feed is quite big though as it includes all aliases that are currently set.

While some people think that Googles new open source webbrowser Chrome is a great example of code reuse I think the opposite is true. He found at least 25 open source libraries used by the browser. So far this is not a problem but what is a problem is that it embeds all of them in the upstream source tarball instead of depending on the system-wide copies. I know that it might be problematic if people have to install 25 libraries on their own (they could provide static builds though) but for distributors this is just a nightmare if security issues pop-up in one of the used libraries (famous libraries who had issues in the past: webkit, libpng, libjpeg, libxml, ...).

In this case the distributors can't just fix the security issue in the shared library and all applications using it are fixed, no they also have to fix all the copies in software like Chrome. Same if you installed Chrome from source, if a security issue pops out in one of the embedded libs you have to go and install a new Chrome version. Google also needs to additionally maintain upstream and security fixes in their embedded code copies but I guess they have enough manpower to do so.

I didn't yet look at the Chrome source code but I hope it has at least a way to link against the system-wide copies without patching the makefiles.

Say Hi to Squeeze, the Debian version that will be released after Lenny (and of course when it's ready)!

Finally the pwnie award nominations are out, a bit late though.

Of course we also got our nomination for the infamous openssl issue in the Most Epic FAIL category as well as one nomination for Luciano for the discovery of this in the Mass0wnage section :/

I nominated Wonderware (I wrote about that before) in the Lamest vendor response category, looks like it has been accepted.

wordpress also got its place in the Mass0wnage category:

An unbelievable number of WordPress vulnerabilities (CVE-2008-*)

Discovered by: everybody who cared to look

It seems like hardly a week goes by without a new vulnerability in WordPress or one of its many plugins. Many of them are actively being exploited to own popular WordPress blogs and use them to serve spam or client-side exploits to unsuspecting visitors. The popularity of WordPress combined with the abysmal security practices of WordPress plugin developers places the entire Internet at risk and is worty of a nomination.

138 reported vulnerabilities since 2004 referring to MITRE, shocking!

I usually don't blog about uploads to the Debian archive but since I don't know any similar software in Debian I do in this case.
nitrogen is a wallpaper selection and setting tool with both a graphical (with image preview) and text based frontend to set wallpapers and restore them later.
That's nothing special, there are some tools doing that.
But nitrogen also provides great multihead and xinerama support and is the only tool in the archive I know that is able to set different wallpapers to different monitors!

From the description:

nitrogen is a graphical wallpaper utility that can be used in two
modes, browser and recall.
Some of the things to look for in nitrogen are:
.
- Multihead and Xinerama support (setting different wallpapers for each monitor)
- Recall mode to restore wallpapers via startup script
- Uses freedesktop.org standard for thumbnails
- Can set GNOME background
- Command line set modes for script usage
- Inotify monitoring of browsed directories

Check it out

I just uploaded openbox-3.4.7-2 to Debian unstable and wrote a patch that enables to set next or prev to the monitor attribute of the MoveResizeTo action. Without this patch you need to explicitly set a monitor number you want to send a window to but can't just toggle a window from one workspace to the other with one keybinding or to move it to the next/prev if you have 3 or more monitors. So if you use openbox with a xinerama setup it would be nice if you could test that and report bugs in case of errors.

A keybinding for that could like like:

I just uploaded openbox-3.4.7-2 to Debian unstable and wrote a patch that enables to set next or prev to the monitor attribute of the MoveResizeTo action. Without this patch you need to explicitly set a monitor number you want to send a window to but can't just toggle a window from one workspace to the other with one keybinding or to move it to the next/prev if you have 3 or more monitors. So if you use openbox with a xinerama setup it would be nice if you could test that and report bugs in case of errors.

A keybinding for that could like like:

Since my DAM rejection earlier this year I’ve been trying to cut down on Debian work. Unsurprisingly (and perhaps surprisingly to some) I fealt a bit emotionally drained and demotivated from defending myself and working with debian security. Lately I have been working with new maintainer Andrea De Iacovo and I am very pleased with his work on Wordpress. Wordpress takes most of my time, like the beautiful day of Saturday yesterday. :) Unfortunately Andrea has had problems finding a sponsor, though a Wordpress security release expedited matters and got Nico Golde’s upload powers into action. :) So if you’re a DD and you use Wordpress, please help out Andrea. Before I get unsubscribed from Debian Planet, I thought I should pimp my:

• Debian tips and tricks site – the current 400-odd tips are in the public domain so please rip them, update them or add some!
• The fantastic Web kiosk distribution Webconverger based on Debian Live, which also has a blog

Both based on ikiwiki. ;) Anyway, I am still around of course. Met some great people in the Debian community and sadly some pretty pedantic unfriendly ones too. Final suggestion for DDs: Revoke your GPG keys more often and go to less key signing parties. :P