Selasa, 31 Mei 2011

Weekend Project: Pre-Loading Maps for Open Source Navigation Apps

Map-based navigation: it's one of the killer apps for any mobile platform. The only sticking point is getting the maps. Downloading map tiles on the fly is the default solution for most navigation apps, but pre-loading makes more sense when it's possible. Unfortunately, open source navigation apps have earned a reputation for clunky and awkward map-loading interfaces. This weekend, let's look at a simpler method, so you can get on the road quicker.


Sure, whenever you have solid data coverage and a cheap-but-fast mobile plan, you can stream maps on-demand — but even then your download speed can to a crawl at just the wrong moment. Plus, you can forget about streaming maps if you're traveling to the back woods or headed overseas with a pre-paid SIM. Pre-loading map sets bypasses the entire problem, plus for many apps it allows you to calculate routes while offline as well.


The problem is that the open source apps make pre-loading into a colossal pain. Some provide a pre-loading interface that falls flat — such as by requiring you to manually enter unformatted latitude and longitude coordinates for the corner points, by not allowing you to see which maps it already has stored, or by attempting to download every zoom level in the database. Others simply have no pre-loading interface at all, requiring manual configuration file editing to point the app towards the right storage directory.


If you had unlimited disk space, you could always grab the entire OpenStreetMap global data set, but for all practical purposes the way most people will operate is to keep a small set of maps on their device at any one time — home, the destination city for a particular trip, and so forth.


Complicating matters slightly is the fact that different navigation apps utilize different map sources. If you're hiking cross-country, you probably want a topographic map, so OSM's street map source isn't going to be any good, regardless of how easy it is to partition off the relevant boundary lines and download tiles. If you use more than one app then typically you double the amount of work involved, since most navigation apps have their own package format and directory structure — even when dealing with the same map source.


We can simplify the process by using the Java application Mobile Atlas Creator (or MOBAC for short). MOBAC includes a web map renderer on which you can select the region of which you're interested in generating an offline map source, plus controls that let you configure zoom level and other options. Whenever you have your "atlas" (which is MOBAC's term for each individual offline map bundle) configured, you can have MOBAC batch-download the tiles and properly configure them for the navigation device of your choice.


You can download MOBAC from the project's site on SourceForge.net. For most users, all you will need to do is grab the .jar package linked to under "Download" on the home page. It requires Java 1.6 or newer, which is standard fare for Linux. The developer recommends you also download the latest build of Java Advanced Imaging from Sun (or presumably, Oracle), although this is optional. A subset of mapping applications also require the Sqlite database; the Download section links to the appropriate Java library.


The current release of MOBAC is version 1.9 beta 5, which officially supports 28 different navigation and mapping apps. There are others that use a compatible format, but don't make the main list. Most are turn-by-turn mobile navigation aids like AndNav, OsmAnd, and Osmdroid, but off-road utilities like Mobile Trail Exporer, specialty apps like Nokia Sports Tracker, and GPS-logging apps are supported as well — including those for dedicated GPS hardware like Magellan and Garmin units.


After you've downloaded the requisite files, cd into the resulting directory and launch MOBAC with ./start.sh &. The left-hand window pane holds a series of expandable settings docks; click on the arrow in each dock's title bar to see its content. The right-hand pane is for GPX data, which is a different enough use case that we don't have time to discuss it. In the center is the map view widget.


The atlas-building process is a bit quirky, but you will soon get the hang of it. The "Map source" selection dock on the left lets you choose which map is displayed in the map view. "Atlas Content" further down displays the map components you have selected so far. By default, MOBAC starts a new atlas project named "Unnamed atlas" at startup. You can work on more than one at a time — use the "New" button to create one. Just keep an eye on which atlas project is selected as you work: every time you make a selection on the map view, you can click the "Add selection" button to add it to the currently chosen atlas project.


In the map view widget, the right mouse button acts as a "grab" controller, with which you can pan and scroll the map view. The left mouse button allows you to draw a selection rectangle onto the map. The scroll wheel zooms in and out. When you have selected the region you want to save, go to the "Zoom Levels" dock and check which levels you want to download. There is some trial-and-error involved, but if you're new you can learn a lot by visiting OSM's web renderer and watching the zoom level there. You probably don't need more than two or three levels; it simply depends on the detail level you want.


What makes MOBAC exceptionally useful, however, is that you don't have to stop at one selection rectangle or one map source. You can add multiple cities (at a high zoom level) and a large swatch of highway (at a lower zoom level) all to one atlas. You can also grab OSM street data and OSM public transport or hiking maps, and merge them all into a single atlas.


When you have all of your selections made, choose "Convert atlas format" from the "Atlas" menu. This dialog lets you select the output format of your maps. The README file (which is also accessible through the Help menu) describes which format is required for each of the supported apps. For other apps, you need to look online for documentation (Mappero, for example, uses the "OSMTracker tile storage" format, which seems to be popular among the open source apps, although AndNav has its own). If you installed the Java Advanced Imaging package mentioned earlier, you can select some custom tile processing options (such as reducing the color data to save space), but it's not required. When you're ready, click "Create atlas" and MOBAC will download all of the tiles in your atlas selections, convert them, and package them for use on your device.


At this point, all that remains is to copy your freshly-minted atlas to your mobile device. Here the process varies from app to app. Start by clicking the "Open Atlas Folder" button in MOBAC's "success" dialog. Each atlas project you've built will be saved in one location, so you can maintain a local library. Whether you can simply drag-and-drop an atlas folder from your hard disk to a USB-attached device, or whether you need to navigate inside it and drag the sub-folders independently depends on the app. Start by consulting the README file; if you don't find instructions there, go to the MOBAC wiki, which maintains pages on the subject — often linked to real-world how-to guides.


You may have noticed that there is a long list of map sources rambling down the sidebar of the MOBAC homepage, but that I have only discussed using OSM-based data sets. That is because Robert, MOBAC's lead developer, recently made a change to the application that disabled most of the commercial and proprietary map sources. As he explains on the forum, he did not do this because the map data was licensed in a manner incompatible with MOBAC's GPLv2 , but because the terms of use for a handful of the more litigious map providers explicitly forbid so-called "bulk" downloads through their APIs.


Whether your personal usage of MOBAC constitutes a "bulk" request depends on how much you select, but Robert did not feel like working it all out individually. Instead, he disabled the problematic services, and now says he will re-enable any of them for which a clearly-expressed deal can be reached. He is asking MOBAC users to contact map service providers rather than doing the deal-making himself.


I have grave doubts as to whether that third-party negotiation technique will work, but in the meantime I don't mind: OSM works everywhere I have traveled, and it is explicitly free. You can read more about the map source setup process in the same thread, including how to add map sources that are free but don't offer any TOS at all (or simply don't respond to inquiries). It's important to notice, however, that a web map source has to meet some technical requirements in order to function. The MOBAC site has a list of map sources that are incompatible, and a tool to help you determine if a new source meets the requirements.


It only takes a few seconds for MOBAC to download and convert hefty map collections if you have a reasonably fast Internet connection. Doing so once might be a slight convenience when compared to making a single custom map set, but what makes MOBAC worth keeping around is how it simplifies the process on a repeating basis.


As mentioned above, you can save your old atlases for later re-use; MOBAC can also be configured to freshen already-downloaded tiles so that updates to the map are added to your existing atlas. It also allows you to bookmark map views, so that you can quickly re-visit settings; this is especially useful as you are getting used to what your preferred zoom levels are for different types of transport. In addition, MOBAC excels because of its support for multiple map layers. How uninteresting would it be if you had to choose between street maps or public transport, but not both?


Open source navigation apps have come a long way in a short period of time, particularly on Android, but they all still have room to improve in the area of offline map support. It is an understandable afterthought if you are the developer, where offline and online maps are such very different features. Which is why it's such a good thing MOBAC is available to bridge the gap.


View the original article here

VBoxHeadless - Running Virtual Machines With VirtualBox 4.0 On A Headless Ubuntu 11.04 Server

This guide explains how you can run virtual machines with VirtualBox 4.0 on a headless Ubuntu 11.04 server. Normally you use the VirtualBox GUI to manage your virtual machines, but a server does not have a desktop environment. Fortunately, VirtualBox comes with a tool called VBoxHeadless that allows you to connect to the virtual machines over a remote desktop connection, so there's no need for the VirtualBox GUI.


I do not issue any guarantee that this will work for you!


I have tested this on an Ubuntu 11.04 server (host system) with the IP address 192.168.0.100 where I'm logged in as a normal user (user name administrator in this example) instead of as root.


To install VirtualBox 4.0 on our Ubuntu 11.04 server, we open /etc/apt/sources.list...

sudo vi /etc/apt/sources.list


... and add the following line to it:

[...]deb http://download.virtualbox.org/virtualbox/debian natty contrib

Then we download the VirtualBox public key...

wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | sudo apt-key add -


... and update our package database:

sudo apt-get update


Afterwards, we install VirtualBox 4.0 as follows:

sudo apt-get install linux-headers-$(uname -r) build-essential virtualbox-4.0 dkms


(The dkms package ensures that the VirtualBox host kernel modules are properly updated if the Linux kernel version changes.)


Starting with version 4.0, VirtualBox has introduced so called "extension packs" and has outsourced some functionality like remote desktop connection support (VRDP) that was part of VirtualBox packages before version 4.0 into these extension packs. Because we need remote desktop connections to control our virtual machines, we need to install the appropriate extension pack now. Go to http://www.virtualbox.org/wiki/Downloads, and you will find a link to the following extension pack:

VirtualBox 4.0.6 Oracle VM VirtualBox Extension Pack
Support for USB 2.0 devices, VirtualBox RDP and PXE boot for Intel cards.


Download and install the extension pack as follows:

cd /tmp
wget http://download.virtualbox.org/virtualbox/4.0.6/Oracle_VM_VirtualBox_Extension_Pack-4.0.6-71344.vbox-extpack
sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-4.0.6-71344.vbox-extpack


(Make sure you grab the latest version from the VirtualBox web site.)


(Make sure you run the last command with sudo - sudo VBoxManage extpack install ... - because otherwise you will get an error like this:

administrator@server1:/tmp$ VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-4.0.6-71344.vbox-extpack
0%...
Progress state: NS_ERROR_FAILURE
VBoxManage: error: Failed to install "/tmp/Oracle_VM_VirtualBox_Extension_Pack-4.0.6-71344.vbox-extpack": The installer failed with exit code 127: Error creating textual authentication agent: Error opening current controlling terminal for the process (`/dev/tty'): No such device or address
administrator@server1:/tmp$


)


Now we must add the user that will run VirtualBox (administrator in this example) to the vboxusers group:

sudo adduser administrator vboxusers


VirtualBox is now installed and ready to be used.


To create a VM on the command line, we can use the VBoxManage command. See

VBoxManage --help


for a list of available switches and (highly recommended!) take a look at http://www.virtualbox.org/manual/ch08.html.


I will now create an Ubuntu 11.04 Server VM with 512MB memory and a 10GB hard drive from the Ubuntu 11.04 Server iso image (which I have stored in /home/ubuntu-11.04-server-amd64.iso):

VBoxManage createvm --name "Ubuntu 11.04 Server" --register
VBoxManage modifyvm "Ubuntu 11.04 Server" --memory 512 --acpi on --boot1 dvd --nic1 bridged --bridgeadapter1 eth0
VBoxManage createhd --filename Ubuntu_11_04_Server.vdi --size 10000
VBoxManage storagectl "Ubuntu 11.04 Server" --name "IDE Controller" --add ide
VBoxManage storageattach "Ubuntu 11.04 Server" --storagectl "IDE Controller" --port 0 --device 0 --type hdd --medium Ubuntu_11_04_Server.vdi
VBoxManage storageattach "Ubuntu 11.04 Server" --storagectl "IDE Controller" --port 1 --device 0 --type dvddrive --medium /home/ubuntu-11.04-server-amd64.iso


Let's assume you have a VM called examplevm that you want to reuse on this host. On the old host, you should have a directory Machines/examplevm in the VirtualBox directory; Machines/examplevm should contain the examplevm.xml file. Copy the examplevm directory (including the examplevm.xml file) to your new Machines directory (if your user name is administrator, this is /home/administrator/.VirtualBox/Machines - the result should be /home/administrator/.VirtualBox/Machines/examplevm/examplevm.xml).


In addition to that copy the examplevm.vdi file from the old VDI directory to the new one (e.g. /home/administrator/.VirtualBox/VDI/examplevm.vdi).


Afterwards, you must register the imported VM:

VBoxManage registervm Machines/examplevm/examplevm.xml


Regardless of if you create a new VM or import an old one, you can start it with the command:

VBoxHeadless --startvm "Ubuntu 11.04 Server"


(Replace Ubuntu 11.04 Server with the name of your VM.)


VBoxHeadless will start the VM and a VRDP (VirtualBox Remote Desktop Protocol) server which allows you to see the VM's output remotely on another machine.


To stop a VM, run

VBoxManage controlvm "Ubuntu 11.04 Server" poweroff


To pause a VM, run

VBoxManage controlvm "Ubuntu 11.04 Server" pause


To reset a VM, run

VBoxManage controlvm "Ubuntu 11.04 Server" reset


To learn more about VBoxHeadless, take a look at

VBoxHeadless --help


and at http://www.virtualbox.org/manual/ch07.html#vboxheadless.

VBoxHeadless - Running Virtual Machines With VirtualBox 4.0 On A Headless Ubuntu 11.04 Server - Page 2

View the original article here

What Every C Programmer Should Know About Undefined Behavior #3/3

The final segment of the LLVM blog's series on undefined behavior is up. "In this article, we look at the challenges that compilers face in providing warnings about these gotchas, and talk about some of the features and tools that LLVM and Clang provide to help get the performance wins while taking away some of the surprise."


busy

View the original article here

Zentyal As A Gateway: The Perfect Setup

Zentyal is the Linux Small Business Server, it lets you manage all your network services through one single platform. It's a Network Gateway, as well as an Infrastructure, UTM (Unified Threat Manager), Office and Communications Server. All these features are fully integrated and easy to configure, it truly helps to save system administrators time.


In this tutorial you will see how to set up a Zentyal Server to act as a gateway in a very common scenario. Zentyal will provide basic network infrastructure, load balancing between two Internet providers, firewall and HTTP proxy caching and content filtering. All these steps are well explained in the Zentyal Documentation, which is a really recommended reading. The following example network layout is used:


Zentyal runs on top of Ubuntu Server so it will work on the same hardware. You can take a look at the Ubuntu-certified hardware page for more information. There are two ways to install Zentyal:

Using Zentyal installer that you can download from the project website. This is the recommended choice, it includes all package dependencies for offline install and also makes some custom configuration.Install on top of a working Ubuntu Server, you can find detailed info and URL for the repository in the Zentyal Installation Guide.

 If you install Zentyal using the installer you will see this screen when booting from CD-ROM and a couple of wizards will guide you through the process. You can choose default settings in all of them.

Zentyal provides a web administration interface, after the installation a Firefox browser will show up giving you access to it (you can also access Zentyal from any client browser typing: https://zentyal_server_ip). User and password are the same you entered during installation.


Now you can select the desired packages to install, for this tutorial you should install the Gateway package. Later DHCP and DNS modules will also be installed by using the Software Management module.


After this step all the necessary packages are installed, now setup will guide you through configuration wizards for installed modules, in this case Network and Users. We can skip network configuration for now, so if you start this tutorial from an already installed Zentyal you can still follow it.

Zentyal Server is now installed. By following the next steps you will configure each module.

As shown in the scenario, you have to configure three network interfaces, two external routers and one for the internal network. Zentyal will balance traffic between the two Internet connections.


Go to Network -> Interfaces and configure each interface by introducing its IP and netmask. Don't forget to mark external interfaces because Zentyal uses this info in firewall rules. In the next image you can see configuration for one of the external interfaces and the internal one.


Now you have to set up both gateways in the gateways table (Network -> Gateways):

Go to Network -> Balance Traffic to enable load balancing between the gateways.

Zentyal As A Gateway: The Perfect Setup - Page 2

View the original article here

What's Coming Up For GNOME 3.2?

Last week marked the end of the feature proposal for GNOME 3.2, for the first major update to the GNOME3 desktop. The GNOME 3.2 release schedule has the final release set for the end of September. In this article is a list of some of the features that were brought up for GNOME 3.2...


View the original article here

Fedora 14 Samba Standalone Server With tdbsam Backend

This tutorial explains the installation of a Samba fileserver on Fedora 14 and how to configure it to share files over the SMB protocol as well as how to add users. Samba is configured as a standalone server, not as a domain controller. In the resulting setup, every user has his own home directory accessible via the SMB protocol and all users have a shared directory with read-/write access.


I do not issue any guarantee that this will work for you!


I'm using a Fedora 14 system here with the hostname server1.example.com and the IP address 192.168.0.100.


Please make sure that SELinux is disabled as shown in chapter 5 of this tutorial: The Perfect Server - Fedora 14 x86_64 [ISPConfig 2] - Page 3


Connect to your server on the shell and install the Samba packages:

yum install cups-libs samba samba-common


Edit the smb.conf file:

vi /etc/samba/smb.conf


Make sure you see the following lines in the [global] section:

[...]# ----------------------- Standalone Server Options ------------------------## security = the mode Samba runs in. This can be set to user, share# (deprecated), or server (deprecated).## passdb backend = the backend used to store user information in. New# installations should use either tdbsam or ldapsam. No additional configuration# is required for tdbsam. The "smbpasswd" utility is available for backwards# compatibility.# security = user passdb backend = tdbsam[...]

This enables Linux system users to log in to the Samba server.


Then create the system startup links for Samba and start it:

chkconfig --levels 235 smb on
/etc/init.d/smb start


Now I will add a share that is accessible by all users.


Create the directory for sharing the files and change the group to the users group:

mkdir -p /home/shares/allusers
chown -R root:users /home/shares/allusers/
chmod -R ug+rwx,o+rx-w /home/shares/allusers/


At the end of the file /etc/samba/smb.conf add the following lines:

vi /etc/samba/smb.conf

[...][allusers] comment = All Users path = /home/shares/allusers valid users = @users force group = users create mask = 0660 directory mask = 0771 writable = yes

If you want all users to be able to read and write to their home directories via Samba, add the following lines to /etc/samba/smb.conf (make sure you comment out or remove the other [homes] section in the smb.conf file!):

[...][homes] comment = Home Directories browseable = no valid users = %S writable = yes create mask = 0700 directory mask = 0700

Now we restart Samba:

/etc/init.d/smb restart


In this example, I will add a user named tom. You can add as many users as you need in the same way, just replace the username tom with the desired username in the commands.

useradd tom -m -G users


Set a password for tom in the Linux system user database. If the user tom should not be able to log into the Linux system, skip this step.

passwd tom


-> Enter the password for the new user.


Now add the user to the Samba user database:

smbpasswd -a tom


-> Enter the password for the new user.


Now you should be able to log in from your Windows workstation with the file explorer (address is \\192.168.0.100 or \\192.168.0.100\tom for tom's home directory) using the username tom and the chosen password and store files on the Linux server either in tom's home directory or in the public shared directory.



View the original article here

What's New in Linux 2.6.39: Ding Dong, the Big Kernel Lock is Dead

Linus Torvalds has released the 2.6.39 kernel. This release brings new features, new drivers, and one big accomplishment: Ridding the Linux kernel of the Big Kernel Lock.


The Big Kernel Lock was almost removed in the 2.6.37 kernel. That is, the kernel could be built without it — but some of the code was still there.


With the 2.6.39 kernel, the BKL is finally gone with a patch from Arnd Bergmann. This has been a long-running saga, and LWN has some good coverage of what the BKL is (or was) and the effort to get rid of it. Why the effort to get rid of it? The short answer is that the BKL was behind some performance issues and latencies that you really don't want.


But what else is in the new kernel? Plenty.


One thing you'll find in any new kernel is support for new hardware, and 2.6.39 doesn't disappoint. As LWN details, you get support for lots of laptop special keys (Dell's All-in-One series, for example) and a number of hardware controllers from Texas Instruments and ST-Ericsson. Lots of devices under Video4Linux as well.


This release also provides support for some USB 3.0 hubs — which means that Linux users should be enjoying USB 3.0 devices in the not-too-distant future.


Naturally, the kernel also includes a number of improvements to existing drivers and features. A biggie for many users will be the driver for Intel's GMA500, a graphics device in many netbooks that has been a bit of a problem for Linux users. You'll also find improvements in Nouveau for Nvidia chipsets, and support for AMD's Cayman video cards and chipsets.


But it's not all just about hardware. The 2.6.39 kernel marks the introduction of user namespaces, which provide more fine-grained control over privileges that a process can have. Namespaces provide "containers" for processes that keeps them walled off from the rest of the system (which can protect the process and/or the system). User namespaces allow unprivileged users to create a namespace, rather than having the namespace created by the system administrator.


This release also adds support for IP sets to the Linux kernel. IP sets aren't entirely new, but they weren't part of the mainline kernel previously. What is ipset? Basically, it allows creation of iptables rules that deal with a set (hence the name) of ports or IP addresses without having to have a rule for each address or port. Just using iptables, for example, you'd create a rule to block or reject packets from a single address or network — but using ipsets you could generate a rule that looks at an ipset table and deals with all the ports or addresses appropriately. (Look for a Linux.com tutorial on ipsets soon.)


Another interesting feature in 2.6.39 is the pstore filesystem, which creates a filesystem for platform-specific storage. This might be used to store a small amount of data when a system crashes, for examination later. Or it might be used to store other data across reboots. We'll see where they go with that — it could be very interesting.


It's worth noting that kernel development is not always flawless. In this case, there are some regressions in the Sandy Bridge code.


This is not great, but it's also not the end of the world. Why? Very few users get their kernel directly from kernel.org — it's not as if the minute that the kernel is released it gets pushed to every user. Some kernels aren't widely used at all. Other kernels tend to be used by several major distributions and get widespread usage — as well as continued attention and support from the kernel folks. See our piece on understanding the stable Linux kernel for more on that.


So, the new kernel has a few bugs to work out. They'll be worked out in short order, and the vast majority of users are unlikely to ever notice.


With the 2.6.39 kernel out, the merge window for the next kernel is now open. What's the merge window, some of you may wonder? After each kernel is released, there's a period of time (two weeks) that lots of patches are put in for the next version — in other words, this is the time when new features, big fixes, and so on are put into the kernel for the developers to work on. The rest of the kernel development cycle is testing and fixing bugs and regressions that creep in due to the patches that are merged.


The merge window for the next kernel (2.6.40) may be shorter than the usual 14 days. Torvalds will be attending LinuxCon Japan and he warns "if I get the feeling that I've merged 'enough', I might just make it easier for myself and cut it two days short and release before I leave on Memorial Day (which for the non-US based of you is May 30th this year)."


What's expected in 2.6.40? It's always hard to say with certainty, but it may be a small release, comparatively. Expect work towards cleaning up the ARM-related code in the Linux kernel for sure. LWN has an excellent piece on rationalizing the ARM tree for those who are interested in the nitty gritty details of kernel development.


There's also talk of Nvidia Optimus support coming in 2.6.40. If you're not a hardware geek that translates loosely into support for hybrid graphics for laptops that offer two Graphics Processing Units (GPUs) — in this case an Nvidia and Intel graphics card. This is useful for machines that you want to save power when on the road, but have a (more) powerful video card when the laptop is plugged in. There's much more to it, of course, than just switching between video output — and making it seamless (without requiring an X restart, for example) takes quite a bit of work.


There's plenty more on the way as well, and we'll have an update when 2.6.40 is released. If recent releases are any indication, the 2.6.40 release should be available in late July or early August.


View the original article here

How To Upgrade From Fedora 14 To Fedora 15 (Desktop & Server)

This article describes how you can upgrade your Fedora 14 system to Fedora 15. The upgrade procedure works for both desktop and server installations.


I do not issue any guarantee that this will work for you!


The commands in this article must be executed with root privileges. Open a terminal (on a Fedora 14 desktop, go to Applications > System Tools > Terminal) and log in as root, or if you log in with a regular user, type

su


to become root.


Please make sure that the system that you want to upgrade has more than 600 MB of RAM - otherwise the system might hang when it tries to reboot with the following message (leaving you with an unusable system):

Trying to unpack rootfs image as initramfs...


First we must upgrade the rpm package:

yum update rpm


Then we install the latest updates:

yum -y update


Next we clean the yum cache:

yum clean all


If you notice that a new kernel got installed during yum -y update, you should reboot the system now:

reboot


(After the reboot, log in as root again, either directly or with the help of

su


)


Now we come to the upgrade process. We can do this with preupgrade (preupgrade will also take care of your RPMFusion packages).


Install preupgrade...

yum install preupgrade


... and call it like this:

preupgrade


The preupgrade wizard will then start on your desktop. Select Fedora 15 (Lovelock). Afterwards the system is being prepared for the upgrade.


At the end, click on the Reboot Now button.


During the reboot, the upgrade is being performed. This can take quite a long time, so please be patient.


Afterwards, you can log into your new Fedora 15 desktop.


First we must upgrade the rpm package:

yum update rpm


Then we install the latest updates:

yum -y update


Next we clean the yum cache:

yum clean all


If you notice that a new kernel got installed during yum -y update, you should reboot the system now:

reboot


(After the reboot, log in as root again, either directly or with the help of

su


)


Now we come to the upgrade process. We can do this with preupgrade.


Install preupgrade...

yum install preupgrade


... and call it like this:

preupgrade-cli


It will show you a list of releases that you can upgrade to. If all goes well, it should show something like Fedora 15 (Lovelock) in the list:

[root@server1 ~]# preupgrade-cli
Loaded plugins: blacklist, langpacks, whiteout
No plugin match for: rpm-warm-cache
No plugin match for: remove-with-leaves
No plugin match for: auto-update-debuginfo
Adding en_US to language list
Loaded plugins: langpacks, presto, refresh-packagekit
Adding en_US to language list
please give a release to try to pre-upgrade to
valid entries include:
"Fedora 15 (Lovelock)"
[root@server1 ~]#


To upgrade, append the release string to the preupgrade-cli command:

preupgrade-cli "Fedora 15 (Lovelock)"


Preupgrade will also take care of your RPMFusion packages, so all you have to do after preupgrade has finished is to reboot:

reboot


During the reboot, the upgrade is being performed. This can take quite a long time, so please be patient. Afterwards, you can log into your new Fedora 15 server.



View the original article here

WordPress 3.1.4 Gets Clickjacking Protection

The open source WordPress blogging application is being updated to version 3.1.3 this week adding multiple security fixes and improvements.


View the original article here

How To Use FreeRADIUS With LinOTP 2 To Do Two Factor Authentication With One Time Passwords

This howto will guide you to set up RADIUS authentication with the LinOTP 2 Community Edition. LinOTP is a one time password backend that enables you to do two factor authentication with a broad variety of different hardware devices, software tokens and SMS.

While the Enterprise Edition comes with a C module for the FreeRADIUS Server, the Community Edition, that is licensed under the AGPLv3 does not. Nevertheless, LinOTP provides very simple WEB APIs that makes it easy to talk to LinOTP in many different ways. There is also an API to do authentication, i.e. to ask the LinOTP server if a given one time password for a certain user is valid. This is the URL

https://yourServer/validate/check?user=....&pass=....

or 

https://yourServer/validate/simplecheck?user=...&pass=...

You can take a look at the complete API here.

The simple LinOTP API and some nice module of the FreeRADIUS make it easy to hack a simple solution for OTP via RADIUS. You could use the module rlm_exec to execute an external program but I'd rather use the module rlm_perl and add my limited perl knowlege ;-)

The documentation of the rlm_perl module can be found here. It has a simple example, that we need to adapt only in the function authenticate. This is the point, where we need to talk to the LinOTP server (with the above URL) and repond according the the LinOTP feedback.

So the perl module in a pre-beta ;-) will look like this:

##  This program is free software; you can redistribute it and/or modify#  it under the terms of the GNU General Public License as published by#  the Free Software Foundation; either version 2 of the License, or#  (at your option) any later version.##  This program is distributed in the hope that it will be useful,#  but WITHOUT ANY WARRANTY; without even the implied warranty of#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the#  GNU General Public License for more details.##  You should have received a copy of the GNU General Public License#  along with this program; if not, write to the Free Software#  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA##  Copyright 2002  The FreeRADIUS server project#  Copyright 2002  Boian Jordanov #  Copyright 2011  linotp project ## Based on the Example code for use with rlm_perl##=head1 NAMEfreeradius_perl - Perl module for use with FreeRADIUS rlm_perl, to authenticate against  LinOTP  http://www.linotp.org=head1 SYNOPSIS   use with freeradius:        Configure rlm_perl to work with LinOTP:   in /etc/freeradius/users     set:     DEFAULT Auth-type := perl  in /etc/freeradius/modules/perl     point     perl {         module =   to this file  in /etc/freeradius/sites-enabled/  set  authenticate{    perl    [....]=head1 DESCRIPTIONThis module enables freeradius to authenticate using LinOTP.   TODO:      * checking of server certificate=head2 Methods   * authenticate=head1 AUTHORCornelius Koelbel (cornelius.koelbel@lsexperts.de)=head1 COPYRIGHTCopyright 2011 This library is free software; you can redistribute it under the GPLv2.=head1 SEE ALSOperl(1).=cutuse strict;use LWP 5.64;# use ...# This is very important ! Without this script will not get the filled  hashesh from main.use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK $URL);use Data::Dumper;$URL = "https://localhost/validate/simplecheck";# This is hash wich hold original request from radius#my %RAD_REQUEST;# In this hash you add values that will be returned to NAS.#my %RAD_REPLY;#This is for check items#my %RAD_CHECK;## This the remapping of return values#       use constant    RLM_MODULE_REJECT=>    0;#  /* immediately reject the request */       use constant    RLM_MODULE_FAIL=>      1;#  /* module failed, don't reply */       use constant    RLM_MODULE_OK=>        2;#  /* the module is OK, continue */       use constant    RLM_MODULE_HANDLED=>   3;#  /* the module handled the request, so stop. */       use constant    RLM_MODULE_INVALID=>   4;#  /* the module considers the request invalid. */       use constant    RLM_MODULE_USERLOCK=>  5;#  /* reject the request (user is locked out) */       use constant    RLM_MODULE_NOTFOUND=>  6;#  /* user not found */       use constant    RLM_MODULE_NOOP=>      7;#  /* module succeeded without doing anything */       use constant    RLM_MODULE_UPDATED=>   8;#  /* OK (pairs modified) */       use constant    RLM_MODULE_NUMCODES=>  9;#  /* How many return codes there are */# Function to handle authorizesub authorize {       # For debugging purposes only#       &log_request_attributes;       # Here's where your authorization code comes       # You can call another function from here:       &test_call;       return RLM_MODULE_OK;}# Function to handle authenticatesub authenticate {       # For debugging purposes only#       &log_request_attributes;        my $ua = LWP::UserAgent->new();    my $req = HTTP::Request->new(GET => $URL . "?user=" .        $RAD_REQUEST{'User-Name'} . "&pass=" .         $RAD_REQUEST{'User-Password'} );    my $response = $ua->request( $req );    die "Error at $URL\n ", $response->status_line, "\n Aborting"      unless $response->is_success;          if($response->content =~ m/:\-\)/i) {               return RLM_MODULE_OK;      } else {        $RAD_REPLY{'Reply-Message'} = "LinOTP server denied access!";               return RLM_MODULE_REJECT;    }}# Function to handle preacctsub preacct {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle accountingsub accounting {       # For debugging purposes only#       &log_request_attributes;       # You can call another subroutine from here       &test_call;       return RLM_MODULE_OK;}# Function to handle checksimulsub checksimul {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle pre_proxysub pre_proxy {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle post_proxysub post_proxy {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle post_authsub post_auth {       # For debugging purposes only#       &log_request_attributes;       return RLM_MODULE_OK;}# Function to handle xlatsub xlat {       # For debugging purposes only#       &log_request_attributes;       # Loads some external perl and evaluate it       my ($filename,$a,$b,$c,$d) = @_;       &radiusd::radlog(1, "From xlat $filename ");       &radiusd::radlog(1,"From xlat $a $b $c $d ");       local *FH;       open FH, $filename or die "open '$filename' $!";       local($/) = undef;       my $sub = ;       close FH;       my $eval = qq{ sub handler{ $sub;} };       eval $eval;       eval {main->handler;};}# Function to handle detachsub detach {       # For debugging purposes only#       &log_request_attributes;       # Do some logging.       &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done.");} ## Some functions that can be called from other functions#sub test_call {       # Some code goes here}sub log_request_attributes {       # This shouldn't be done in production environments!       # This is only meant for debugging!       for (keys %RAD_REQUEST) {               &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}");       }}1;

You will need to configure some FreeRADIUS files and also adapt the $URL in the  perl module itself.

Please note, that this is an easy and simple way, to get RADIUS running. There are some things missing, error handling logging would be nice, what about redundancy, the SSL certificate is not checked!

Nevertheless it shows how easy it is to integrate LinOTP into your environment using its simple API.



View the original article here

X.Org Server 1.10.2 Brings A Bunch Of Bug-Fixes

Apple's Jeremy Huddleston has just released X.Org Server 1.10.2. This second point release was set to be released yesterday, but then there was fear of a regression causing a delay (turns out it's no longer reproducible), so now we have a holiday weekend release of xorg-server 1.10.2...


View the original article here

Senin, 30 Mei 2011

Importing iptables Configurations Into Firewall Builder

Firewall Builder is a firewall configuration and management GUI that supports configuring a wide range of firewalls from a single application. Supported firewalls include Linux iptables, BSD pf, Cisco ASA/PIX, Cisco router access lists and many more. The complete list of supported platforms along with downloadable binary packages and soure code can be found at http://www.fwbuilder.org.


Import of existing iptables configurations was greatly improved in the recently released Firewall Builder V4.2. Features like object de-duplication and expanded rules recognition make it even easier to get started using Firewall Builder to manage your iptables configurations.


For this tutorial we are going to import a very basic iptables configuration from a firewall that matches the diagram shown below.


 Firewall Builder imports iptables configs in the format of iptables-save. Script iptables-save is part of the standard iptables install and should be present on all Linux distribution. Usually this script is installed in /sbin/.


When you run this script, it dumps the current iptables configuration to stdout. It reads iptables rules directly form the kernel rather than from some file, so what it dumps is what is really working right now. To import this into Firewall Builder, run the script to save the configuration to a file:

iptables-save > linux-1.conf


As you can see in the output below, the example linux-1.conf iptables configuration is very simple with only a few filter rules and one nat rule.

# Completed on Mon Apr 11 21:23:33 2011
# Generated by iptables-save v1.4.4 on Mon Apr 11 21:23:33 2011
*filter
:INPUT DROP [145:17050]
:FORWARD DROP [0:0]
:OUTPUT DROP [1724:72408]
:LOGDROP - [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -s 10.10.10.0/24 -d 10.10.10.1/32 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o eth0 -s 10.10.10.0/24 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A FORWARD -o eth0 -s 10.10.10.0/24 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A FORWARD -j LOGDROP
-A LOGDROP -j LOG
-A LOGDROP -j DROP
COMMIT
# Completed on Mon Apr 11 21:23:33 2011
# Generated by iptables-save v1.4.4 on Mon Apr 11 21:23:33 2011
*nat
:PREROUTING ACCEPT [165114:22904965]
:OUTPUT ACCEPT [20:1160]
:POSTROUTING ACCEPT [20:1160]
-A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Apr 11 21:23:33 2011


If you are running Firewall Builder on a different system than the one that is running iptables copy the file linux-1.conf from the firewall to the system where Firewall Builder is running.


Launch the Import wizard by selecting the File -> Import Firewall menu item.


Click Browse to find the file named linux-1.conf.


Click the Continue button to move to the next step of the import process.


The next window shows a preview of the configuration file that will be imported and the type of firewall that Firewall Builder has detected it to be.


Next you need to enter a name for the firewall. This is the name that will be used in Firewall Builder to refer to the firewall after it is imported. When you click the Commit button the configuration data will be read.


By default, Firewall Builder attempts to detect if there are items, like IP addresses, used in the rules that match existing items in the object tree. If there is a match the existing item is used, if there is no match a new object is created. This feature can be disabled by unchecking the box next to "Find and use existing objects" which will result in objects being created for evry item used in the imported rules regardless of whether it already exists in the object tree or not.


After the import is complete, Firewall Builder displays a log showing all the actions that were taken during the import. Warning messages are displayed in blue font and error messages are displayed in red.


The program tries to interpret the configuration file rule by rule and recreates the equivalent rule in Firewall Builder. Note that rules imported into Firewall Builder may not always be optimized since features like defining multiple source and/or destinations are supported by Firewall Builder, but not by iptables.


The progress window displays warning and error messages, if any, as well as some diagnostics that shows network and service objects created in the process.


As you can see from the import process log, Firewall Builder detected that there are rules in the iptables configuration that allow RELATED and ESTABLISHED traffic through the firewall. This behavior can be controlled by a setting in Firewall Builder, so a warning message is shown.


Click the Done button to complete the firewall import. Next we will go through some common post-import actions.

Importing iptables Configurations Into Firewall Builder - Page 2

View the original article here

Linux Mainline Contains All the Xen Code Bits for Dom0 and DomU Support

After a relatively long road traveled with a few bumps along the way, as of yesterday, Linus's mainline tree (2.6.39+) contains literally every component needed for Linux to run both as a management domain kernel(Dom0) and a guest(DomU)...


More at Wim Coekaerts' Oracle blog



busy

View the original article here

Version 1.2 Of The ISPConfig 3 Manual (Date: 05/04/2011) Available

The good news first: the updated ISPConfig 3 Manual (version 1.2 for ISPConfig 3.0.3.3) is finally available (in PDF format).


On 308 pages, it covers the concept behind ISPConfig (admin, resellers, clients), explains how to install and update ISPConfig 3, includes a reference for all forms and form fields in ISPConfig together with examples of valid inputs, and provides tutorials for the most common tasks in ISPConfig 3. It also lines out how to make your server more secure and comes with a troubleshooting section at the end.


Version 1.2 for ISPConfig 3.0.3.3 (Date: 05/04/2011)
Author: Falko Timme
308 pages


Now the bad news: we can't offer it for free. But it will be available for as low as 5 EUR per copy - we think this price is more than fair for a manual with more than 300 pages.

Download Through Your HowtoForge Subscription (A HowtoForge subscription costs 5 EUR for one month or 25 EUR for six months.)(A single copy costs 5 EUR; you will receive an email with a download link that is active for ten days. Please note that this option does not include any updates!)Added internal links to the manual.Added chapter 5.25 "How Can I Access SquirrelMail From My Web Sites?"Added description (+ new screenshot) for the "Monitor keyword" field in chapter 4.9.2.4 Interface Config (Misc tab).Added QR code for making it easy to install the ISPConfig Monitor App for Android.Do not delete the /var/www/ispconfig symlink when switching the ISPConfig interface to php-fcgi.Fixed typo in chapter 5.18.

 We don't want to bore you with long explanations, so here are the facts:

We hope that this will allow us to employ an additional full-time ISPConfig developer who can disburden the core team. This would accelerate ISPConfig development a lot and also allow us to provide more support for ISPConfig users.


Yes.


You can download it either through an active HowtoForge subscription, or you can buy a single copy.


Downloading through a HowtoForge subscription has the advantage that you get updates of the manual for free as long as you are a subscriber, while if you buy a single copy, no updates are included (i.e., you would have to pay again for new versions of the manual).


A HowtoForge subscription costs 5 EUR for one month or 25 EUR for six months.


If you want to download a single copy of the ISPConfig 3 manual, this costs you 5 EUR which is equal to buying a one-month HowtoForge subscription.

Download Through Your HowtoForge Subscription (A HowtoForge subscription costs 5 EUR for one month or 25 EUR for six months.)(A single copy costs 5 EUR; you will receive an email with a download link that is active for ten days. Please note that this option does not include any updates!)

The ISPConfig 3 manual is protected by copyright. No part of the manual may be reproduced, adapted, translated, or made available to a third party in any form by any process (electronic or otherwise) without the written specific consent of projektfarm GmbH. You may keep backup copies of the manual in digital or printed form for your personal use. All rights reserved.


This means it is not allowed to redistribute the ISPConfig 3 manual in any form (for example by offering it as a download on your web site). Your copy of the ISPConfig 3 manual will be personalized with your real name (or HowtoForge username) and email address.


If you are an ISP and need multiple copies (e.g. for your clients), please contact us (info@projektfarm.de), and we will find a solution.


1 Conventions Used In This Manual
1.1 Commands
1.2 Contents Of Files
1.3 File Names, Protocol Names, System Specifications, Technical Specifications, User Names, Etc.
1.4 Highlighting


2 ISPConfig Users - Admin, Resellers, And Clients
2.1 Summary
2.1.1 admin
2.1.2 Resellers
2.1.3 Clients


3 Installation & Updating
3.1 Single Server Setup
3.2 Multiserver Setup
3.2.1 Installing A Multiserver Setup With Dedicated Web, Email, DNS And MySQL Database Servers On Debian 5.0 With ISPConfig 3
3.2.1.1 Installing The Five Debian Base Systems
3.2.1.2 Installing The Web Server
3.2.1.3 Installing The Mail Server
3.2.1.4 Installing The MySQL Database Server
3.2.1.5 Installing The Primary DNS Server
3.2.1.6 Installing The Secondary DNS Server
3.2.1.7 Adjust The Server Settings In ISPConfig


  3.3 Mirror Setup
3.3.1 Installing A Web, Email And MySQL Database Cluster On Debian 5.0 With ISPConfig 3
3.3.1.1 Setting Up The Two Base Systems
3.3.1.2 Installing The Two Servers
3.3.1.3 Installing ISPConfig On The First (Master) Server
3.3.1.4 Installing ISPConfig 3 On The Second Server
3.3.1.5 Configure Replication In ISPConfig
3.3.1.6 Additional Notes


  3.4 Updating
3.4.1 Creating A Backup
3.4.2 Command Line Update


4 Reference
4.1 Tabs
4.2 Login
4.3 Home
4.4 Tools
4.4.1 User Settings
4.4.1.1 Password and Language


  4.5 Client
4.5.1 Clients
4.5.1.1 Add Client
4.5.1.2 Edit Client
4.5.1.3 Edit Client-Templates
4.5.2 Resellers
4.5.2.1 Add Reseller
4.5.2.2 Edit Reseller


  4.6 Sites
4.6.1 Websites
4.6.1.1 Website
4.6.1.2 Subdomain for website
4.6.1.3 Aliasdomain for website
4.6.2 FTP
4.6.2.1 FTP-User
4.6.3 Shell
4.6.3.1 Shell-User
4.6.4 WebDAV
4.6.4.1 WebDAV User
4.6.5 Database
4.6.5.1 Database
4.6.6 Cron
4.6.6.1 Cron Jobs
4.6.7 Statistics
4.6.7.1 Web traffic
4.6.7.2 Website quota (Harddisk)


  4.7 Email
4.7.1 Email Accounts
4.7.1.1 Domain
4.7.1.2 Domain Alias
4.7.1.3 Email Mailbox
4.7.1.4 Email Alias
4.7.1.5 Email Forward
4.7.1.6 Email Catchall
4.7.1.7 Email Routing
4.7.2 Spamfilter
4.7.2.1 Whitelist
4.7.2.2 Blacklist
4.7.2.3 User / Domain
4.7.2.4 Policy
4.7.3 Fetchmail
4.7.3.1 Fetchmail
4.7.4 Statistics
4.7.4.1 Mailbox traffic
4.7.5 Global Filters
4.7.5.1 Postfix Whitelist
4.7.5.2 Postfix Blacklist
4.7.5.3 Content Filter
4.7.5.4 Relay Recipients


  4.8 DNS
4.8.1 DNS Wizard
4.8.1.1 Add DNS Zone
4.8.1.2 Templates
4.8.2 DNS
4.8.2.1 Zones
4.8.3 Secondary DNS
4.8.3.1 Secondary Zones


  4.9 System
4.9.1 CP Users
4.9.1.1 Add user
4.9.1.2 Edit user
4.9.2 System
4.9.2.1 Server Services
4.9.2.2 Server Config
4.9.2.3 Server IP addresses
4.9.2.4 Interface Config
4.9.3 Firewall
4.9.3.1 Firewall
4.9.4 Software
4.9.4.1 Repositories
4.9.4.2 Packages
4.9.4.3 Updates
4.9.5 Language Editor
4.9.5.1 Languages
4.9.5.2 New Language
4.9.5.3 Merge
4.9.5.4 Export
4.9.5.5 Import
4.9.6 Remote Users
4.9.6.1 Add user
4.9.6.2 Edit user
4.9.7 Remote Actions
4.9.7.1 Do OS-Update
4.9.7.2 Do ISPConfig-Update


  4.10 Monitor
4.10.1 System State (All Servers)
4.10.1.1 Show Overview
4.10.1.2 Show System-Log
4.10.1.3 Show Jobqueue
4.10.2 Server to Monitor
4.10.3 Hardware Information
4.10.3.1 Show CPU Info
4.10.4 Server State
4.10.4.1 Show Overview
4.10.4.2 Show Update State
4.10.4.3 Show RAID State
4.10.4.4 Show Server Load
4.10.4.5 Show Disk Usage
4.10.4.6 Show Memory Usage
4.10.4.7 Show Services
4.10.4.8 Show OpenVz VE BeanCounter
4.10.5 Logfiles
4.10.5.1 Show Mail Queue
4.10.5.2 Show Mail Log
4.10.5.3 Show Mail Warn-Log
4.10.5.4 Show Mail Error-Log
4.10.5.5 Show System-Log
4.10.5.6 Show ISPC Cron-Log
4.10.5.7 Show Freshclam-Log
4.10.5.8 Show Clamav-Log
4.10.5.9 Show RKHunter-Log
4.10.5.10 Show fail2ban-Log


  4.11 Help
4.11.1 Support
4.11.1.1 Send message
4.11.1.2 View messages
4.11.2 About ISPConfig
4.11.2.1 Version


  4.12 Domains
4.12.1 Domains
4.12.1.1 Domains


5 Howtos
5.1 How Do I Create A Reseller?
5.2 How Do I Create A Client?
5.3 How Do I Create A Web Site?
5.4 How Do I Create An SSL Web Site?
5.4.1 How Do I Import An Existing SSL Certificate Into A Web Site That Was Created Later In ISPConfig?
5.5 How Do I Redirect My Web Site To Another Web Site Or To A Specific Directory On The Server?
5.6 How Do I Create An FTP Account So That I Can Upload Files To My Web Site?
5.7 How Can I Use Perl/CGI Scripts With My Web Site?
5.8 How Do I Create An Email Account?
5.9 How Do I Activate The Spamfilter/Virus Scanner For An Email Account?
5.10 How Do I Blacklist/Whitelist Email Addresses In The Spamfilter?
5.11 How Do I Fetch Emails From A Remote Server With ISPConfig And Put The Emails In A Local Email Account?
5.12 How Do I Create A DNS Zone?
5.13 How Do I Create A Secondary DNS Zone?
5.14 How Do I Create A Mirror?
5.15 How Do I Split Up Services Between Multiple Servers?
5.16 How Do I Unblock An IP Address That Got Blocked By fail2ban?
5.17 How Do I Create A Subdomain And Redirect It To A Different Folder/Web Site?
5.18 How Do I Manually Configure New IP Addresses On My System?
5.19 How To Build A PureFTPd Debian Package For OpenVZ Virtual Machines (Without Capabilities Enabled)
5.20 How To Display Hidden Files With PureFTPd On Debian And Ubuntu Linux
5.21 PureFTPd Does Not Show More Than 2,000 Files On Debian And Ubuntu
5.22 How To Speed Up Logins In PureFTPd On Debian Or Ubuntu Linux By Disabling Name Resolving
5.23 How To Enable Verbose Logging In PureFTPd On Debian And Ubuntu Linux
5.24 How To Enable FTPS For PureFTPd On Debian And Ubuntu Linux
5.25 How Can I Access SquirrelMail From My Web Sites?


6 Security Considerations
6.1 How Do I Disable Certain PHP Functions?
6.2 Enabling SSL For The ISPConfig Web Interface
6.3 Using SuExec For The ISPConfig Web Interface
6.4 What Are Secure Settings For Web Sites Created Through ISPConfig?
6.5 How Do I Make fail2ban Monitor Additional Services?
6.5.1 PureFTPd
6.5.2 SASL
6.5.3 Courier
6.5.4 Dovecot


7 Troubleshooting
7.1 How Do I Find Out What Is Wrong If ISPConfig Does Not Work?


 

View the original article here

A PC Emulator in Javascript - Run Linux In Your Web Browser

Fabrice Bellard has developed a PC emulator (Virtual machine) using Javascript that runs a version of Linux in your web browser.

You can run a variety of Linux commands in the emulator. Since its initial release on May 16 2011, this project has seen some feature additions namely - a clipboard to exchange data between the VM and the host, and support for Opera and Internet Explorer apart from Firefox.

The clipboard is seen as /dev/clipboard in the emulator. You can use this clipboard to easily transfer data from your host machine to the virtual machine (and vice versa) as explained in the FAQ.

Do check it out. It is really a cool demonstration of the power of Javascript.


View the original article here

Book - Configuring IPCop Firewalls

IPCop is a powerful, open source, Linux based firewall distribution for primarily Small Office Or Home (SOHO) networks, although it can be used in larger networks. It provides most of the features that you would expect a modern firewall to have, and what is most important is that it sets this all up for you in a highly automated and simplified way.

This book is an easy introduction to this popular application.


View the original article here

Cover Thumbnailer - How to install in Ubuntu Linux

Cover Thumbnailer is a small Python script which displays music/video album covers in Nautilus in place of ordinary icons of folders, preview of pictures in a folder and more.

It is similar to what you see in Microsoft Windows 7 where the folder shows a preview of the pictures contained in it.

This is for Ubuntu users running v 9.10 Karmic, v 10.04 Lucid and v 10.10 Maverick .

Open your terminal and enter the following set of commands :

$ sudo add-apt-repository ppa:flozz/flozz$ sudo apt-get update$ sudo apt-get install cover-thumbnailer
Once Cover Thumbnailer has been installed, you will have to restart Nautilus by running the following command. $ nautilus -q
Now the specified folders containing music files will display the respective album cover / mosaic of covers.

If you are using another Linux distribution, you can download the source code from the Cover Thumbnailer website, compile it, and install it on your machine.

Cover Thumbnailer program will store a cache of cropped images of albums in a  hidden folder named .thumbnails/ in your home directory. The .thumbnails/ directory is a cache directory created by GNOME when you browse through your folders in Nautilus. It contains thumbnail pictures of images you have previously viewed.

And when you visit a particular music folder, the thumbnail of the respective album is shown on top of the folder.


You can access the Cover Thumbnailer preferences via GNOME Menu > System > Preferences > Cover Thumbnailer. Here you can specify more folders that can avail of Cover Thumbnailer's services and set many other options such as clearing the thumbnail cache and more.


Here is how the folders looks after you install cover thumbnailer program in Ubuntu. Cover Thumbnailer in action in Nautilus

View the original article here

Fedora 15 Released - Featuring Virgin Pure GNOME 3

Fedora 15 has been released. If you have a special affinity towards GNOME 3, then you should give Fedora 15 a try. It is robust, secure, and user friendly. Following are some of the main features of Fedora 15.

GNOME 3 including the new GNOME 3 shellKDE 4.6 with the improved Plasma workspace, enhanced core applications, and greater memory efficiency.XFCE 4.8 with a new panel, Thunar enhancements and more.Virtualization improvements including Spice support in virt-manager and support for Xen hosts.Better compression of live images allowing more applications to be provided on a CD.System and session management via systemd, providing more consistent configuration and improved boot performance. Running Fedora 15 on your machine demands modest requirements. Your machine should have a min of  386 MB RAM (512 MB - 1 GB preferred). 400 MHz Pentium Pro or better processor, and 10 GB of hard disk space for storage.

Fedora also comes with comprehensive documentation on every aspect of the OS that the end user might encounter which is a big plus.

There are several flavors of Fedora 15. And you can download them from Fedoraproject.org. 


View the original article here

Minggu, 29 Mei 2011

How To Generate an SSL Certificate For Your Website

If you run a website which you need to serve via SSL, then this article is for you. The procedure for making your website SSL ready is quite simple. It involves -

Generating a private key.Generating a Certificate Signing Request (CSR).Getting the CSR signed by a certificate authority - Verisign, Go Daddy, Thawt etc. (Be ready to shell out some money here).Uploading the private key, the CSR, and the certificate to your website.Configuring the SSL version of your site. And finally ...Enabling the SSL for your website.
ScoutApp has a nice article that explains the above steps in detail. Check it out.

View the original article here

Meet The Rugged Smartphone, The CASIO G’zOne Commando

What comes to your mind when you hear the word “commando”? It’s something to do with the military, isn’t it? Just today, a new smartphone has been added to the wide array of Android devices that surely meets military standards. Casio, together with Verizon Wireless, has introduced the Casio G’zOne Commando, a mobile office with high security specs for protected corporate email, Wi-Fi for high-speed Web access, XT9 and T9 trace input for well-organized typing and snap-out menu for customized access to high-use applications.

The Casio G’zOne Commando is built to endure the most extreme conditions and can simply transition from work to play thanks to its advanced G’zGEAR software. As the definitive outdoor gizmo in mobile devices, G’zGEAR functions in eight modes (Earth Compass, Walking Counter, Adventure Training, Trip Memory, Tides, Thermometer, Sun / Moon, Star Gazer) to boost the vigorous, spirited lifestyle. With the support of its Triple Sensor technology, it can make use of direction, acceleration and temperature; G’zGEAR allows adventurers to execute at their fullest potential.

Check out these cool specs of the Casio G’zOne Commando:

Android™ 2.2Meets Military Standards 810G for Immersion, Rain, Shock and Dust Resistant, Vibration, Salt, Fog, Humidity, Solar Radiation, Altitude, Low and High Temperature Storage5-megapixel camera with auto-focus, still photo, video capture, LED lightHigh-security encryption for corporate emailWi-Fi 802.11 b/g/n connectivityStereo Bluetooth™VZ Navigator® for GPS and audible turn-by-turn directionsMobile Hotspot capable-share 3G connection with up to five Wi-Fi-enabled devices

The CASIO G’zOne Commando will be available online at Verizon Wireless’ website on April 28 for $199.99 with a new two-year customer agreement.

The CASIO G’zOne Commando is being touted as a rugged smartphone. How about you guys? What can you say about the CASIO G’zOne Commando?

Source: AndroidCentral




View the original article here

Openfiler 2.99 Active/Passive With Corosync, Pacemaker And DRBD

Openfiler is a Linux based NAS/SAN Application which can deliver storage over nfs/smb/iscsi and ftp. It has a web interface over that you can control these services. This howto is based on the latest version of openfiler at this date, you can download it from the official homepage http://www.openfiler.com/.

Thanks to the Openfiler team that made this howto possible.

hostname: filer01eth0: 10.10.11.101eth1: 10.10.50.101500MB Meta partition4GB+ Data partitionhostname: filer02eth0: 10.10.11.102eth1: 10.10.50.102500MB Meta partition4GB+ Data partition

virtualip: 10.10.11.105 ( don't use on any adapter, we will make this later with corosync )

root@filer01 ~# nano /etc/hosts

Add:

10.10.50.102filer02root@filer01 ~# nano /etc/hosts

On filer02 add:

10.10.50.101filer01root@filer01 ~# ssh-keygen -t dsa

Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_dsa.
Your public key has been saved in /root/.ssh/id_dsa.pub.
The key fingerprint is:

Do the same on filer02.

root@filer02 ~# ssh-keygen -t dsa

Then exchange the files:

root@filer01 ~# scp ~/.ssh/id_dsa.pub root@filer02:~/.ssh/authorized_keys

root@filer02 ~# scp ~/.ssh/id_dsa.pub root@filer01:~/.ssh/authorized_keys

And now you can exchange files between the nodes without entering a password.

Before we can actually start the cluster we have to prepaire both systems and let the data and meta partition sync before it can be used by corosync/pacemaker as the first cluster config will start drbd and take over the control of this service. So we prepaire our partitions this time before we do the actual cluster configuration as we did in openfiler 2.3.

Edit /etc/drbd.conf:

# You can find an example in /usr/share/doc/drbd.../drbd.conf.exampleinclude "drbd.d/global_common.conf":#include "drbd.d/*.res";resource meta { on filer01 { device /dev/drbd0; disk /dev/sdb1; address 10.10.50.101:7788; meta-disk internal; } on filer02 { device /dev/drbd0; disk /dev/sdb1; address 10.10.50.102:7788; meta-disk internal; }}resource data { on filer01 { device /dev/drbd1; disk /dev/sdb2; address 10.10.50.101:7789; meta-disk internal; } on filer02 { device /dev/drbd1; disk /dev/sdb2; address 10.10.50.102:7789; meta-disk internal; }}

After that create the meta-data on it:

root@filer01 ~# drbdadm create-md meta
root@filer01 ~# drbdadm create-md data

root@filer02 ~# drbdadm create-md meta
root@filer02 ~# drbdadm create-md data

Now you can start up drbd with:

service drbd start

on both nodes.

Make one node primary:

root@filer01 ~# drbdsetup /dev/drbd0 primary -o
root@filer01 ~# drbdsetup /dev/drbd1 primary -o

root@filer01 ~# mkfs.ext3 /dev/drbd0

root@filer01 ~# service openfiler stop

root@filer01 ~# mkdir /meta
root@filer01 ~# mount /dev/drbd0 /meta
root@filer01 ~# mv /opt/openfiler/ /opt/openfiler.local
root@filer01 ~# mkdir /meta/opt
root@filer01 ~# cp -a /opt/openfiler.local /meta/opt/openfiler
root@filer01 ~# ln -s /meta/opt/openfiler /opt/openfiler
root@filer01 ~# rm /meta/opt/openfiler/sbin/openfiler
root@filer01 ~# ln -s /usr/sbin/httpd /meta/opt/openfiler/sbin/openfiler
root@filer01 ~# rm /meta/opt/openfiler/etc/rsync.xml
root@filer01 ~# ln -s /opt/openfiler.local/etc/rsync.xml /meta/opt/openfiler/etc/
root@filer01 ~# mkdir -p /meta/etc/httpd/conf.d

root@filer01 ~# service nfslock stop
root@filer01 ~# service nfs stop
root@filer01 ~# service rpcidmapd stop
root@filer01 ~# umount -a -t rpc-pipefs
root@filer01 ~# mkdir /meta/etc
root@filer01 ~# mv /etc/samba/ /meta/etc/
root@filer01 ~# ln -s /meta/etc/samba/ /etc/samba
root@filer01 ~# mkdir -p /meta/var/spool
root@filer01 ~# mv /var/spool/samba/ /meta/var/spool/
root@filer01 ~# ln -s /meta/var/spool/samba/ /var/spool/samba
root@filer01 ~# mkdir -p /meta/var/lib
root@filer01 ~# mv /var/lib/nfs/ /meta/var/lib/
root@filer01 ~# ln -s /meta/var/lib/nfs/ /var/lib/nfs
root@filer01 ~# mv /etc/exports /meta/etc/
root@filer01 ~# ln -s /meta/etc/exports /etc/exports
root@filer01 ~# mv /etc/ietd.conf /meta/etc/
root@filer01 ~# ln -s /meta/etc/ietd.conf /etc/ietd.conf
root@filer01 ~# mv /etc/initiators.allow /meta/etc/
root@filer01 ~# ln -s /meta/etc/initiators.allow /etc/initiators.allow
root@filer01 ~# mv /etc/initiators.deny /meta/etc/
root@filer01 ~# ln -s /meta/etc/initiators.deny /etc/initiators.deny
root@filer01 ~# mv /etc/proftpd /meta/etc/
root@filer01 ~# ln -s /meta/etc/proftpd/ /etc/proftpd

root@filer01 ~# rm /opt/openfiler/etc/httpd/modules
root@filer01 ~# ln -s /usr/lib64/httpd/modules /opt/openfiler/etc/httpd/modules

Now do a restart and see if Openfiler can still run:

root@filer01 ~# service openfiler restart

service openfiler stop
mkdir /meta
mv /opt/openfiler/ /opt/openfiler.local
ln -s /meta/opt/openfiler /opt/openfiler

service nfslock stop
service nfs stop
service rpcidmapd stop
umount -a -t rpc-pipefs
rm -rf /etc/samba/
ln -s /meta/etc/samba/ /etc/samba
rm -rf /var/spool/samba/
ln -s /meta/var/spool/samba/ /var/spool/samba
rm -rf /var/lib/nfs/
ln -s /meta/var/lib/nfs/ /var/lib/nfs
rm -rf /etc/exports
ln -s /meta/etc/exports /etc/exports
rm /etc/ietd.conf
ln -s /meta/etc/ietd.conf /etc/ietd.conf
rm /etc/initiators.allow
ln -s /meta/etc/initiators.allow /etc/initiators.allow
rm /etc/initiators.deny
ln -s /meta/etc/initiators.deny /etc/initiators.deny
rm -rf /etc/proftpd
ln -s /meta/etc/proftpd/ /etc/proftpd

Change the lvm filter from:

filter = [ "a/.*/" ]

to

filter = [ "a|drbd[0-9]|", "r|.*|" ]

After that we can create the actual used stuff:

root@filer01 ~# pvcreate /dev/drbd1
root@filer01 ~# vgcreate data /dev/drbd1
root@filer01 ~# lvcreate -L 400M -n filer data

root@filer01~# corosync-keygen

( Press the real keyboard instead of pressing keys in an ssh terminal. )

Copy the authkey file to the other node and change the fileaccess:

root@filer01~# scp /etc/corosync/authkey root@filer02:/etc/corosync/authkey
root@filer02~# chmod 400 /etc/corosync/authkey

root@filer01~# vi /etc/corosync/service.d/pcmk

service { # Load the Pacemaker Cluster Resource Manager name: pacemaker ver: 0 }root@filer01~# scp /etc/corosync/service.d/pcmk root@filer02:/etc/corosync/service.d/pcmk

root@filer01~# vi /etc/corosync/corosync.conf

# Please read the corosync.conf.5 manual pagecompatibility: whitetanktotem { version: 2 secauth: off threads: 0 interface { ringnumber: 0 bindnetaddr: 10.10.50.0 mcastaddr: 226.94.1.1 mcastport: 5405 ttl: 1 }}logging { fileline: off to_stderr: no to_logfile: yes to_syslog: yes logfile: /var/log/cluster/corosync.log debug: off timestamp: on logger_subsys { subsys: AMF debug: off }}amf { mode: disabled}root@filer01~# scp /etc/corosync/corosync.conf root@filer02:/etc/corosync/corosync.conf

Openfiler 2.99 Active/Passive With Corosync, Pacemaker And DRBD - Page 2

View the original article here

Qt Goes To School - Free Training Course Material For Teachers

Nokia's Qt team has unveiled a new initiative - namely to build awareness about Qt - the library that is the building block of KDE - among students and academia.

Choosing an appropriate library for your software is a significant first step to developing your product.


And Qt is a good choice for the simple reason that it is a cross-platform application and UI framework for developing once, and deploying across Windows, Mac, Linux/X11, embedded Linux, Windows CE, Symbian and Maemo without rewriting the source code.

Currently, Qt in Education Course Material page has around around 10 lectures that cover the basics of Qt in addition to some special topics. The idea is to provide the teachers the necessary tools - such as PowerPoint slides, notes, exercises etc which will make their job a lot easier in teaching Qt to their students.


The lectures lasting 90 minutes each consist of notes for the teacher and exercises for the students. And the lecture is provided in multiple formats such as Microsoft PPT files, OpenOffice.org Odp, and PDF.


You can download all the lectures together at once (45 MB download) or download individual lectures.


View the original article here

XFCE 4.8 has been released

XFCE is a lightweight desktop environment that aims to be fast and low on system resources. Nearly after a 2 years hiatus, XFCE has released version 4.8. A number of new features have made their way into XFCE ver 4.8. Some of them being the ability to browse remote shares using a variety of protocols, a redesign of the XFCE panel thus improving positioning, transparency, item and launcher management, a new menu plugin to view directories, improved keyboard layout selection, and more.
The XFCE 4.8 development cycle also saw a serious release strategy formed after the "Xfce Release and Development Model" developed at the Ubuntu Desktop Summit in May 2009.

Take a full feature tour of XFCE 4.8 and view the changelog to know more.


View the original article here

Jumat, 27 Mei 2011

Fargo: A Scheme-like Programming Langauge That Runs on Node.js

Developer James Coglan has created Fargo, a small experimental programming language for a asynchronous systems in JavaScript. It works in both Node.js and in browsers. Fargo is a modified version of Scheme, a dialect of LISP.


View the original article here

OpenGL ES Support For QEMU Emulator

One of the items brought up this week at UDS Budapest was about providing OpenGL / OpenGL ES support for QEMU guests. The need for OpenGL ES 2.0 support in QEMU guests has come up since it's used in emulating Maemo / MeeGo for development environments. This would also make it possible to use Canonical's Unity desktop in a virtualized environment...


View the original article here

As Chrome OS Rolls Out, Questions Loom

Thursday, 12 May 2011 00:00 OStatic

In conjunction with the Google I/O conference this week, Google held its launch event for the long awaited Chrome OS, the company's cloud-centric operating system. Among the announcements, Google said it is working with Samsung and Acer on Chrome OS laptops that will be available June 15, and Google will be pushing subscription plans for using its cloud services and cloud-based apps with the laptops. Google co-founder Sergey Brin was quoted as saying that Microsoft's Windows OS is "torturing users," but while nearly everything that Google rolls out meets with a full volume of welcome, there are many questions to ask about the company's Chrome OS strategy.


busy

View the original article here

Distribution Release: SimplyMEPIS 11.04

SimplyMEPIS 11.0, a new version of the user-friendly, Debian-based distribution featuring the KDE desktop, has been released: "Warren Woodford is pleased to announce the release of SimplyMEPIS 11, the latest version of the renowned SimplyMEPIS Linux operating system that is designed to be easy to install, easy to....


View the original article here

Kamis, 26 Mei 2011

Why We Need an Open Wireless Movement

Yesterday Peter Eckersly posted at eff.org about the EFF's coming Open Wireless Movement. Here's what he had to say:


If you sometimes find yourself needing an open wireless network in order to check your email from a car, a street corner, or a park, you may have noticed that they're getting harder to find.

busy

View the original article here

Quanta Building E Ink-Based Android Tablet for Amazon?

Quanta has received OEM orders from Amazon.com to build its much-rumored Android tablet, expected to sell in quantities of 700,000 to 800,000 units per month, DigiTimes claims. The tablet is said to use Fringe Field Switching display technology from E Ink -- presumably a version of E Ink's Triton color e-reader display....


View the original article here

How To Upgrade Ubuntu 10.10 (Maverick Meerkat) To 11.04 (Natty Narwhal) (Desktop & Server)

Version 1.0
Author: Falko Timme
Follow me on Twitter
Last edited 04/28/2011


The new Ubuntu 11.04 (Natty Narwhal) has just been released. This guide shows how you can upgrade your Ubuntu 10.10 desktop and server installations to Ubuntu 11.04.


This document comes without warranty of any kind! I do not issue any guarantee that this will work for you!


Start the Update Manager (System > Administration > Update Manager):


The Update Manager should show that a new distribution release (11.04) is available. Click on the Upgrade button to start the distribution upgrade:


 A window with the release notes for 11.04 comes up. Click on Upgrade again:

 The upgrade tool is now being downloaded. Afterwards, type in your password:

 The upgrade is being prepared:

 Click on Start Upgrade to finally begin with the upgrade process:

 The upgrade packages are now being downloaded...

 ... and installed. This can take some time, so please be patient.

 At the end of the upgrade process, you should remove obsolete packages:

 

The system needs to be rebooted to complete the upgrade, therefore click on Restart Now:


 When you log in, Ubuntu 11.04 will by default start the new Unity desktop which requires that your hardware supports 3D acceleration. If it doesn't, you can choose the Ubuntu Classic desktop at the login screen instead:

 After the reboot, you can use your new Ubuntu 11.04 desktop (because I used a virtual machine for this tutorial, the system has no 3D support, that's why you see the Ubuntu Classic desktop in the screenshot below):

 ow To Upgrade Ubuntu 10.10 (Maverick Meerkat) To 11.04 (Natty Narwhal) (Desktop & Server) - Page 2

View the original article here

digiKam 2.0.0 Approaches with New Beta

While the final version of digiKam 2.0.0 has been pushed back to late July, the latest beta shows progress towards its completion with a new export tool and fixes for features added in earlier betas


View the original article here

How To Secure Your Ubuntu 10.10 Desktop With LinOTP 2

This howto will guide you to set up a LinOTP standalone one time password authentication backend on your Linux machine. This enables you to add two factor authentication with one time passwords to your desktop login.

LinOTP is a modular OTP (one time password) solution, that supports many different OTP tokens. LinOTP is written in python, based on pylons and apache. It comes as open source licensed under the AGPLv3. Additional functionalities, maintenance and support can be licensed in an Enterprise Edition.

This howto should run on Ubuntu 10.10 and Debian Squeeze.

You can either download the necessary packages from the LinOTP website or you can add the online repository to your repositories and install them with apt-get.

This Howto will use the second way to install the software.

First you need to add the GPG key, that was used to sign the packages:

wget http://linotp.org/apt/LSE\ LinOTP2\ Packaging\ linotp2@lsexperts.de\ \(0xF86258E5\)\ pub.as
sudo apt-key add http://linotp.org/apt/LSE\ LinOTP2\ Packaging\ linotp2@lsexperts.de\ \(0xF86258E5\)\ pub.asc

Then add the repository to your system:

sudo add-apt-repository "deb http://linotp.org/apt/ubuntu lucid linotp2ce"

Now you can install the LinOTP server, the management client and the PAM module:

sudo apt-get install linotp linotpuseridresolver libpam-linotp linotpadminclientce

When installing the linotp package you are asked several questions:

Do you want to run LinOTP 2 via Apache2? -> Yes
Enter admin password for the new LinOTP admin account. -> think of one
Do you want to create a self signed ceritficate? -> Yes
What SQL database do you want to use for the token database? -> Mysql
database hostname: -> localhost
Name of Token database -> LinOTP2
database user -> linotp2
database users password: -> think of one
Enter MySQL root password
Do you want to create the tables: -> yes

During the installation the encryption key /etc/linotp2/encKey will be created. Be sure to also enter the MySQL root password, so the database will be created, too.

Now you got two possibilities to manage the LinOTP server and OTP tokens. You can either use the command line client linotpadmin.py or the web interface located at

https://localhost/manage

Please note: If you got and "internal server error" take a look at /var/log/apache2/error.log. It could be, that the access rights of the directory /var/log/linotp are not right. Also the whole directory /etc/linotp2 needs to be owned by the user linotp.

LinOTP reads users by so called UserIdResolvers. The APGLv3 version comes with the PasswdUserIdResolver, that can be used to read users from flat files like the /etc/passwd. You can also create a new file that contains the users, as long as you stick to the passwd format.

The Enterprise Edition also provides Resolvers for users located in LDAP and SQL databases.

You may use the management web ui or the command line client to setup your LinOTP server. You need to configure a UserIdResolver and a default realm. You may do this by issuing the following commands:

linotpadm.py --url=https://localhost --admin=admin --command=setresolver --resolver=defaultPW --rtype=FILE --rf_file=/etc/passwd

That reads the users from the /etc/passwd file. You will get a JSON feedback like this:

{ u'status': True,....}

Now you need to add this resolver to your default realm:

linotpadm.py --url=https://localhost --admin=admin --command=setrealm --realm=defrealm --resolver=useridresolver.PasswdIdResolver.IdResolver.defaultPW
linotpadm.py --url=https://localhost --admin=admin --command=setdefaultrealm --realm=defrealm

You can either check it in the web ui or issue the command:

linotpadm.py --url=https://localhost --admin=admin --command=listuser

You should see the list of your users. Now you are ready to assign tokens to your user.

You may want to enroll an OTP token, now. In this example we enroll an motp token (you could also enroll an OATH Token or a Google authenticator) on our mobile phone. Download the app from http://motp.sourceforge.net and install it on your phone. You may initialize the token by entering 0000 as PIN on the phone. An init-secret will be displayed.

linotpadm.py --url=https://localhost --admin=admin --command=inittoken --user=cornelius --type=motp --otpkey=860e2e9bf9d50665 --serial=1 --otppin=1234

This means, that you generated an mOTP token that gets assigned to the user "cornelius". The otpkey is the init-secret that was displayed on your phone. You may choose a serial (serial number) as you like to. The otppin is the PIN you will enter on the phone to generate an otp value.

Optionally you may set an OTP PIN, which is a fixed password part, that you need to enter in front (depending on the parameter PrependPIN) of the OTP value:

linotpadm.py --url=https://localhost --admin=admin --command=set --pin=Password --serial=1

Alternatively you can use the management web interface, to enroll the token.

Now you are ready to generate your first OTP value! Go to the portal site:

https://localhost/auth/index

and enter your username and as password the OTP PIN you set and the otp value you generated with your phone. If you fail to authenticate, you might mistyped the init secret or the time of your phone might be out of sync.

Now we will setup PAM to enable you to authenticate to your desktop. The security module /lib/security/pam_linotp.so was installed to your system. You may now set up otp authentication. We choose to do it modular:

cp /etc/pam.d/common-auth /etc/pam.d/common-linotp

In /etc/pam.d/common-linotp change the line:

auth [success=1 default=ignore] pam_unix.so nullok_secure

to

auth [success=1 default=ignore] pam_linotp.so debug nosslhostnameverify nosslcertverify url=https://localhost/validate/simplecheck realm=defrealm resConf=defaultPW

Please note, that when using "debug" option, many many information - also the password! - will be written to the auth.log.

You may now use the common-linotp in any PAM configuration instead of common-auth, where you like to. I.e. you may change the line in /etc/pam.d/gdm:

@include common-auth

to

@include common-linotp

Now you will need to authenticate with OTP to your Gnome desktop! Note that you will also need to change /etc/pam.d/gnome-screensaver if you also want to unlock the desktop using OTP. You will not be asked for "Password" anymore but for "Your OTP".

If you fail to authenticate you may also take a look into /var/log/auth.log.



View the original article here

Red Hat Summit & JBoss World 2012 Dates Confirmed

Open source solutions vendor Red Hat has announced the dates for its eighth annual Red Hat Summit and JBoss World. The 2012 events will take place in Boston at the Hynes Convention Center


View the original article here

How To Install VMware Tools On pfsense (FreeBSD)

This tutorial shows how to install VMware Tools onto pfsense v1.2.3 which is operated by the FreeBSD OS. It took me days to figure out how to do it, especially with lack of a complete guide in the Internet.

To install such a system you will need the following:

Download the pfsense VMware appliance here: http://doc.pfsense.org/index.php/VMwareAppliance
Download and Install:
1. VMware vCenter Converter Standalone Client
2. VMware vSphere Client
(How to download and install, please follow other guides)

Do not just upload the pfsense*.vmx or vmdk into the vmware datastore, use vCenter Converter instead, otherwise your pfsense-VM won't boot after you create snapshot. And I suppose you have configured the pfsense-VM, and successfully made an Internet connection.

First, we need to install "perl" and "compat6x-i386" onto the system prior VMware Tools installation, just like other linux. But there are many catches through the path... and this guide solved all these and goes straight to the result.

--> press "8" and go to the Shell of pfsense.

We need to update the FTP path for pkg_add command, otherwise the package won't fetch (coz the pfsense FreeBSD is not so updated to FreeBSD FTP)!

setenv PACKAGEROOT "ftp://ftp.freebsd.org"

setenv PACKAGESITE "ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.4-release/Latest/"

Start installing packages:

pkg_add -v -r perl

pkg_add -v -r compat6x-i386

Go to VMware vsphere client, and start "Install VMware Tools" onto the pfsense-VM, as usual, we need to mount the CD-ROM in order to get the VMware Tools executable.

First, we create some tmp folders first for VMware Tools:

cd /

mkdir tmp2

mkdir tmpp

Mounting the CD-ROM to tmp2:

mount_cd9660 /dev/acd0 /tmp2

cd /tmp2

Copy the VMware Tools to tmpp, then extract the package:

cp vmware-freebsd-tools.tar.gz /tmpp

cd /tmpp

tar -zxvf vmware-freebsd-tools.tar.gz

cd vmware-tools-distrib/

Then, here is the catch, before executing the installation, we need to link the compat6x files to the proper directory for VMware Tools to find, otherwise it just doesn't work!

ln -s /usr/local/lib/compat/libm.so.4 /lib

ln -s /usr/local/lib/compat/libc.so.6 /lib

ln -s /usr/local/lib/compat/libthr.so.2 /lib

Then, start the installation, make sure you are under /vmware-tools-distrib.

chmod +x vmware-install.pl bin/vmware-config-tools.pl bin/vmware-uninstall-tools.pl

./vmware-install.pl

As usual, keep pressing "Enter", and it should work with "Enjoy" message. If so, start cleaning up and reboot:

cd /

rm -r /tmpp/

rmdir tmpp

shutdown -r now

If you get a "You are under attack" note along the way, it properly is due to the mounted CD-ROM drive, if so, press "Ctrl+Alt+Insert" to reboot the VM and start over. After all these, you should have an "OK" message in VMware vsphere client.

So, enjoy!



View the original article here

Linux Signage PC Enables Programmable Waiting-Room Content

Jayex announced a Linux-based digital signage computer aimed primarily at waiting-room applications. Available with multimedia and client call software, the & Web Media M4& is built around a dual-core Intel Atom D510 clocked at 1.66GHz and offers 1GB of RAM, 250GB of storage, HDMI and VGA ports, as well as Wi-Fi, Ethernet, and USB connectivity, says the company....


View the original article here

How To Create Remote API Scripts For ISPConfig 3

This guide will walk through the instructions on how to create an API script to create an ftp user in ISPConfig 3. It will give you the knowledge to develop scripts for any function available in ISPConfig 3.

So let's look at the script we will be analyzing.

The first place you start when creating an API script is at the function. The function is the part of the code that adds the ftp user to the databases.

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

As you can see from the code above site_ftp_user_add is the function to add an ftp user. All the functions have names like this so you will never wonder what it does. In order to find out all functions that are available you need to look at /usr/local/ispconfig/interface/lib/classes/remoting.inc.php.

It will look like this:

?//* Add a recordpublic function sites_ftp_user_add($session_id, $client_id, $params) {if(!$this->checkPerm($session_id, 'sites_ftp_user_add')) {$this->server->fault('permission_denied', 'You do not have the permissions to access this function.');return false;}return $this->insertQuery('../sites/form/ftp_user.tform.php',$client_id,$params);}

Alright so we know from the line that says,

public function sites_ftp_user_add($session_id…

that there is a function called sites_ftp_user_add.

Let's look at the entire line where the function will reside in our new script.

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

Let's break this line down so you know what you need to change to adjust this to any function.

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

The $domain_id is a variable that you will not need to change as the variable is not used in the execution of the function. 

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

$client-> is a variable you should never change, so do not mess with it.

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

As stated above this is the function and will change depending on the task you wish the script to do.

$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params_ftp);

This section can change depending on the function. From the /usr/local/ispconfig/interface/lib/classes/remoting.inc.php you will see the line

public function sites_ftp_user_add($session_id, $client_id, $params)

This is where you will get what needs to go after the function.

Above the function line you will see the creation of the function's array. This is where the information that will be used to create the ftp user is given.

$params = array( 'server_id'=> '1','parent_domain_id'=> $domain_id,'username'=> $myusername,'password'=> $mypassword,'quota_size'=> '-1','active'=> 'y','uid'=> 'web'.$domain_id,'gid'=> 'client'.$client_id,'dir'=> '/var/www/clients/client'.$client_id.'/web'.$domain_id,'quota_files'=> '100','ul_ratio'=> '-1','dl_ratio'=> '200','ul_bandwidth'=> '-1','dl_bandwidth'=> '100',);

This will always start with

$variable = array (

but we do not know what information we need to type in with every function without looking it up.

Going back to /usr/local/ispconfig/interface/lib/classes/remoting.inc.php you will look up the function being used:

?//* Add a recordpublic function sites_ftp_user_add($session_id, $client_id, $params) {if(!$this->checkPerm($session_id, 'sites_ftp_user_add')) {$this->server->fault('permission_denied', 'You do not have the permissions to access this function.');return false;}return $this->insertQuery('../sites/form/ftp_user.tform.php',$client_id,$params);}

This is telling up what file has the array information needed. Now let's use our find command:

sudo find / -name ftp_user.tform.php

And open up the document. Should look like:

'password' => array ('datatype'=> 'VARCHAR','formtype'=> 'PASSWORD','encryption' => 'CRYPT','default'=> '','value'=> '','width'=> '30','maxlength'=> '255'),'quota_size' => array ('datatype'=> 'INTEGER','formtype'=> 'TEXT','validators'=> array ( 0 => array ('type'=> 'NOTEMPTY','errmsg'=> 'quota_size_error_empty'),1 => array ('type'=> 'REGEX','regex' => '/^(\-1|[0-9]{1,10})$/','errmsg'=> 'quota_size_error_regex'),

As you can see I am showing two examples that would be transformed to

'password' => 'yourpassword'

and

'quota_size' => 'quota size'

Using everything we have learned so far we can create:

$params = array( 'server_id'=> '1','parent_domain_id'=> $domain_id,'username'=> $myusername,'password'=> $mypassword,'quota_size'=> '-1','active'=> 'y','uid'=> 'web'.$domain_id,'gid'=> 'client'.$client_id,'dir'=> '/var/www/clients/client'.$client_id.'/web'.$domain_id,'quota_files'=> '100','ul_ratio'=> '-1','dl_ratio'=> '200','ul_bandwidth'=> '-1','dl_bandwidth'=> '100',);$domain_id = $client->sites_ftp_user_add($session_id, $client_id, $params);

Not too much farther to go. All we need to do now is have our shell user log in and log out. Make sure you have created a shell user in ISPConfig Control panel by going to the Sites tab and then click Shell User on the left.

Here is the beginning of the script to log into Soap.

$username = 'yourusername';$password = 'yourpassword';/*$soap_location = 'http://localhost:8080/ispconfig3/interface/web/remote/index.php';$soap_uri = 'http://localhost:8080/ispconfig3/interface/web/remote/';*/$soap_location = 'http://localhost:8080/remote/index.php';$soap_uri = 'http://localhost:8080/remote/';

You should put your Shell User where it says "yourusername", and ?the password in "yourpassword." You should also put in your soap?location and uri, but more than likely you will not have to change this.

$client = new SoapClient(null, array('location' => $soap_location, 'uri' => $soap_uri));try { //* Login to the remote server if($session_id = $client->login($username,$password)) { echo 'Logged into remote serversucessfully. The SessionID is '.$session_id.'
';

No changes are needed to this section unless you want to change

echo 'Logged into remote server sucessfully. The SessionID is '.$session_id.'
';

to ouput a different message.

End the script with the following to log out. Nothing has to be changed in the last section.

//* Logoutif($client->logout($session_id)) {echo "FTP Created";}} catch (SoapFault $e) {die('SOAP Error: '.$e->getMessage());echo "Please contact the server administator";}?>;

View the original article here