onemoretech

And so it goes ... onemoretech is moving!

2007-09-13T23:50:00.001-04:00

The new URL will be eldapo.lembobrothers.com.

I've migrated the content of this site over to the new domain, importing it into a new WordPress instance there. From past experience I know there are going to be some formatting issues, especially with displaying large blocks of code. There are about 72 posts on this blog right now, so it's going to take time to clear everything up. Meanwhile, all new posts are going to be at the new location, so I hope to see you there.

ISO Refuses to Adopt Microsoft Office Open XML

2007-09-05T10:25:00.000-04:00

From the New York Times:

Microsoft is Rebuffed by Standards Body

Microsoft’s bid to extend its dominance in digital documents to the new field of open-format documents was unexpectedly rebuffed today when a global technical panel refused to designate its Office Open XML as an international standard.
* * *“I think many countries simply resisted what they considered undue pressure from Microsoft,” said Pieter Hintjens, president of the Foundation for a Free Information Infrastructure, a Brussels group that opposed Microsoft’s request. “In Europe our standards processes are sophisticated and Microsoft simply lobbied too hard.”
* * *Mr. Hintjens said Microsoft will have a hard time winning over countries that opposed its standards bid because to do so, Microsoft would be forced to officially put into the public domain the secret coding for many of its proprietary document formats that already dominate the global market, like those in its Office software suite.

No worry, Microsoft, you already own the U.S. market - where we have no standards, thanks to clueless IT executives and corrupt politicians.

News Flash: SCO LOST

2007-09-05T07:56:00.000-04:00

The nitty gritty details from Groklaw.

Once again, the headline from El Reg is priceless:

Novell owns Unix copyrights after all: Judge tells SCO to find its checkbook

It's all over now, except for what will certainly be months or even years of motions to reconsider, applications for trial de novo, motions for stays and appeals up through the Federal court system -- until SCO runs out of money (or it's partner in slime, Microsoft, cuts it's losses and shuts off the tap).

Someone have a beer for me (hypertension sucks).

Pentagon Got Hacked by the PLA: Join the Club, Bob

2007-09-04T15:53:00.000-04:00

It's now being reported that the Chinese military hacked the Pentagon's e-mail in June.

One article describes the technological equivalent of a wrestling match between "their" cyberguys and "ours".

My favorite take on all this comes from, unsurprisingly, The Register:

Pentagon: Chinese military hacked us (We'll need a whole bunch of expensive stuff).

Big deal. Join the club (Secretary of Defense) Bob (Gates)!

First, this isn't the first time we've heard this kind of thing. In 2005, Time Magazine published an article entitled The Invasion of the Chinese, about a PLA intrusion into Department of Energy systems. Of course, in that instance the guy who threw down the flag on the PLA got summarily bashed by Uncle Sam.

The pattern of attack described in the earlier 2004 incident and in the more recent acknowledgement (Clarion call? Alarm bell? Fear-mongering to fatten the next appropriations bill?) seem nearly identical.

The amazing part is that you'd think the Pentagon would find the whole experience humiliating, in that it exposes the ineffectiveness, ineptitude, of their electronic defenses. Of course this is the same organization that couldn't even defend it's own headquarters on 9-11 from a successful attack by an unarmed, subsonic, aircraft. As in so many things, they appear to have no shame in this either.

Not that I've had any experience with any effort by systems originating on a People's Liberation Army network "footprinting" and then penetrating my home network, but if I did it surely would have caused me to be embarrassed.

Now if the PLA were to have done something like that, I would have been surprised to discover that they did it using machines that were so easy to track back to their publicly known network addresses that my 7 year-old son could have found them.

Again, if such an expoit took place, they did it with a straight shot at my server through an open port on my firewall, using an incredibly well-known vulnerability in UNIX systems that only an unhardened, or an ineptly hardened, system would have succumbed to. The other professionally humiliating detail was that I discovered the breach (er, assuming there was a breach) completely by accident and only did my forensic work long after they'd had their fun.

So, if this kind of thing had happened the system logs, once checked, clearly showed the origin of the dozens of connection attempts, and a couple of successful connects, by a remote system that a little backtracking through DNS revealed to becoming from a subnet owned by the PLA. Tracking that down took less than an hour.

No hacking of foreign systems was required to do the detective work described above. It was all done with traceroute, dig and a few queries on the World Wide Web. Nothing fancy, and certainly insufficient to constitute evidence in any court of law.

Ironically, a couple of rules on my router to deny access to anything coming from one of the subnets controlled by the PLA would have effectively blocked the whole effort. My home router is a $59 Linksys device. I'm guessing that the U.S. Department of Defense uses equipment that's somewhat more sophisticated and configurable than that.

I wonder if this most recent intrusion was done though a system located on network publicly known to be controlled by the Chinese government? Would the brain trust at DOD be so negligent as to not block access from addresses on such networks? Something tells me that if they were, we're not going to know about it for awhile.

You know what? I'd say the PLA has done us all a service here, by putting the spotlight on our government's weaknesses. In fact, I'd encourage them to keep it up. Given what contractors usually charge to conduct penetration tests, we're getting a good workout at a bargain price. After all, with all the U.S. debt they own, the Chinese have a vested interest in the continued good health of our economy, at least. Maybe shaving a few hundred billion dollars wasted on an failed defense establishment would improve the "bottom line" enough to give them (the Chinese) some significantly better return on their investment -- not to mention on ours (the American people).

Man, you can't make this stuff up.

P.S. Of course, even back a couple of years ago I was running Linux on all my systems, while both DOE and DOD have a preponderance of Windows boxes. Not that Windows (more particularly, MS Exchange, which is what I'm guessing is the e-mail server product most recently compromised -- all so Bob and "crew" can use their Blackberrys) can't be hardened (see the NSA's Security Configuration Guides page, which you'd never find through the main site navigation if you didn't know what you were looking for -- thank God for Google), it just takes alot more skill and effort than hardening a UNIX box -- which kind of blows the whole "Windows is better because it doesn't require expensive, highly trained, technical resources to be effective in even the most demanding environments" mantra that Microsoft has been chanting for 20 years.

BIG P.P.S. The intruders into my system (if an intrusion occured) didn't hurt anything, nor do they seem to have been interested in stealing any files they might have seen. There were no config changes or file transfers during their time on my machine. From what I can tell, their sole interest seemed to be in achieving the breach itself, and they didn't stick around long after.

Oracle 11g Insecure due to "Stupid" Developer Mistakes

2007-09-04T11:37:00.001-04:00

Oops. I mean, "stupid mistakes made by developers".

Here's the scoop from that leader in corporate IT communications, ComputerWorld:

Expert finds 'stupid' vulnerabilities in Oracle 11g

Most of the above article lays out what the quoted db security expert says are "stupid" vulnerabilities in Oracle's latest database product that result from mistakes by it's developers. While calling on the one hand for Oracle to better educate it's developers to avoid these kinds of mistakes, he also goes on to say that there are some vulnerabilities that are related to Oracle's underlying architecture. What's striking here is that nowhere in the article do we get any idea of just what those architectural deficiencies are. Pretty amazing failure to report some really important (maybe critical) facts for what's supposed to be a technology saavy computer trade publication. Is it that the reporter was too stupid or too lazy to ask the right questions (and comprehend the answers), or just a case of an overzealous editor cutting real news to get an additional column inch for advertising?

The more interesting part of the article comes at the end though, where the horrorific costs of patching are described. Of course the reporter doesn't mention that these costs exist for almost every software product, including operating systems. The little aside about how much work this involves on the vendor side is a nice touch, leading me (not the reporter, apparently, unless this question was also cut by the editor) to ask: "How many problems go unresolved because of the cost resolving them would represent to [insert name of vendor here]?"

Hey Larry, how's that offshoring of all your development work turning out anyway?

doing x over telnet with RedHat

2007-08-28T11:10:00.000-04:00

Yes, I know how insecure X over telnet is. But sometimes interoperability trumps enhanced security, so the following is offered for those times when you just have to use telnet to run X apps remotely on a RedHat box.

Freeing up X over telnet on RedHat/Fedora is actually pretty simple, if you know the trick.

What you need to do is make a change in the system's gdm configuation. The easiest way to do this is run gdmsetup and click on the "Remote" tab. Go to the drop-down menu for "Style" and pick something, anything, other than "Remote Login Disabled". You can also do this from the command line by going to /etc/gdm/custom.conf and adding "Enable=true" under the "[xdmcp]" section of the file.

Oh, yeah, also remmember to enable telnetd on the remote server (it's not installed by default). Even if you've installed the legacy server packages you still need to go to /etc/xinetd.d/telnet and change "disable" to "no" and restart xinetd.

more aix annoyances: ssh -X doesn't work

2007-08-28T10:39:00.000-04:00

subtitle: "Screw IBM and the horse that it rode in on!"

Like Sun Solaris, IBM AIX apparently implements it's own weird build and defaults for ssh that prevents using the "ssh -X" trick to get seamless access to X apps on remote servers from working. OK, so RedHat for it's part has by default locked down Gnome and XWindows so that you can't do X into or out of a RedHat (or Fedora) box using telnet with the old "xhost +" and "export DISPLAY=xxx.xxx.xxx.xxx:0.0" trick either (well, there is a workaround, see a future post for the details).

So there. We're even. No interoperability between UNIX systems supposedly all using the same open source components.

More bullsh*t to deal with. Thanks Big Blue. I hope you choke on your own patchsets.

from linux to aix: terminal tricks

2007-08-28T09:48:00.000-04:00

Had to go up to one of our AIX boxes today and needed to create a local account for myself and get added to a couple of groups.

Of course, IBM, being IBM, is not satisfied with the tried and true useradd (or adduser), groupadd, and usermod utilities ubiquitous throughout the UNIX world.

No, with AIX you need to use "smit", a/k/a "smitty", a curses based tool that uses arrow and function keys for navigation and execution. Kind of like Oracle forms without Jinitiator.

Anyway, the default config of gnome-terminal and xterm worked OK to launch smit, but most of the function keys were unavailable (well, in gnome-terminal using some of them were already mapped to gnome features).

Searched around the Internets and found ... nothing. Well, not nothing exactly -- just alot of dead ends that didn't work. Along the way I found a post somewhere that mentioned the "old function keys". Knowing xterm as intimately as I do from my FreeBSD days, I immediately popped an xterm session and did a Control-LeftClick on the xterm window with my mouse and clicked on "Old Function-Keys". Then I logged into the AIX box, su'd to root and launched smitty. Voila! All the function keys now worked! No need to use any Escape or Control combinations or anything.

Xterm is such an awesome tool, proving that just because something more than 30 years old can still get it done. Kind of like me.

Sun Changing Symbol to JAVA: The Fallout Begins

2007-08-24T14:22:00.000-04:00

Yesterday, Jonathan Schwartz announced in his blog that the company would be changing it's stock ticker symbol to JAVA. You can read the blog post for the details. I came across this particularly insightful rant in the comments and think it deserves to be republished in full.

Jonathan, if you are committed to Sun's success, I have a simple recipe: Fire California.

The whole state.

Seriously. Sun in California is a filter that catches and keeps people who can't get a job with better prospects at one of the legions of startups that grow like weeds in the silicon valley. It is the most astonishing center of incompetence on the planet. The economics are such that it can't be fixed. Please put it out of its misery.

We have extraordinary engineers in other locales where we can hire the best and the brightest. As long as the least capable group of employees wields ultimate decision-making power, we waste most of our most competent employees' best work.

Fire the lawyers who send cease-and-desist letters to companies that redistribute OpenSolaris and have the common-sense to use the word Solaris and thus enhance our own brand at no cost to us. Fire the corporate marketing dips**ts who blow a million on ads for developer tools in the Wall Street Journal. Fire the branding dips**ts who wouldn't know a brand if it bit them on the ass and are more concerned about turf than making this company a success. Fire the directors who need to pee on the furniture like incontinent poodles to make it *their* furniture and think the way to do that is by renaming our products (for the 20th time) and have no conception of how that destroys adoption and brand recognition.

Really, if you want evidence that Sun is a filter that aggregates, collects and cultivates incompetence, there is no better evidence than our own corporate marketing. People don't start out this pathologically inept - this level of dysfunctionality has to be carefully bred and cultivated.

And this whole boomerang thing...I'll try to be gracious and avoid naming names, but what the hell are we doing bringing back the very people who drove this company into the ground in the first place? Boomerang indeed. The only question is whose neck the boomerang ends up wrapped around.

Heck, trace my IP address and it can be my neck. Big deal...

I work for Sun. In California. I'm putting my money where my mouth is (or vice versa). Fire me. Please. Just promise me that the dips**t menagerie we've built here will go with me.

I own far too much Sun stock. If you take my advice, I lose my job. Ironic that I'm sure being fired would increase the chances I retire fat and happy, isn't it?

A friend of mine in the VC business once told me the secret to the silicon valley's sucess was "we don't penalize failure." But that doesn't mean we should nurture and cherish it.

Do I actually want to get fired? No. But I want to work for a company I can respect. And there is a lot of rot right at the heart of this one. It's not evil, its not malice, it's unchallenged people living up to low expectations.

Posted by A Sun Employee on August 24, 2007 at 01:55 AM PDT #

nvidia 6200TC on Fedora Core 6

2007-08-23T02:45:00.000-04:00

I've been running the proprietary Nvidia Linux driver for awhile now, but recently had a couple of programs crash on me (taking my X session with them). One of those apps was Google Earth, whose forums all pointed the finger at the video driver.

No surprise there. What I was experiencing was pretty obviously a driver issue. I've got a Nvidia 6200TC in my main workstation, which replaced the shipping ATI 600X card almost a year ago when I gave up trying to get ATI's proprietary drivers to work correctly with CentOS 4.

After doing some tweaking on xorg.conf and failing to see any change, I decided to try de-installing the proprietary Nvidia driver and go back to the open source x.org nv driver for X11. After backing up my existing xorg.conf, I ran the Nvidia installer with the "--uninstall" switch and removed the driver and it's companion kernel module. I then rebooted and when X failed to start, allowed the the system to automatically configure.

Although I got everything working again and was able to start Google Earth, my graphics were really S-L-O-W. Doing a glxinfo revealed that direct rendering was not on, and glxgears was running at tortoise-like speed. Google Earth was almost unusable because of the time it took to render each change.

A few hours later, after alot of Googling around for advice on these kinds of issues, I decided to try installing the proprietary Nvidia driver from the RPMForge repository, called nvidia-x11-drv. On my first attempt, X failed to start after reboot because yum had grabbed an old version of dkms from the related Dries repository. I "retired" dries.repo, removed both the nvidia driver and dkms, and then installed the latest dkms from RPMForge. Then I rebooted the machine for good measure. Once it was back up (with the restored X desktop), I then re-installed the nvidia driver package from RPMForge and rebooted.

When the machine finally came back up, voila! After running some checks using glxinfo and xvinfo, I was satisfied that I was indeed running the latest proprietary driver from Nvidia, which supports not only direct rendering, but also 3D graphics.

Google Earth now ran splendidly, which it should, given the 6200TC 's 400 MHz GeForce VPU gives and 512 Mb effective RAM (256 Mb on board, the rest from shared memory). Of course glxgears reported "only" 2300 fps, but I could live with that.

The nice thing about loading the driver from yum is that the next time the kernel changes RPMForge should already have a new package with an updated kernel module ready to go. Now I need to go to bed so I can get up for work in 4 hours.

Using a Regex to Filter a String Value

2007-08-20T16:57:00.000-04:00

Recently I had to filter a user ID value to clean it up. The problem was that whitespace, tabs and all kinds of other non-visible stuff was getting into the data as a result of poor validation on the application used to do the data entry. This was preventing us from reading the "letter followed by 6 digits" ID (e.g. "Z123456") as required. I used a regular expression match to get the job done. Here's my code (the variable $uid has already received the raw value):


for ($uid) {

  m/([A-Z]\d{6})/i;

  $uid = $1;
}

Notice the use of the [A-Z] character class for the leading letter and the \d metacharacter for digits, along with the range qualifier {n} on the number of digits. The /i tells the regex engine to make a case-insensitive match.

To filter out all non-alpha characters in a less elegant way, you can use a simple search and replace operation, like this:

for($string) {
    s/\D//g;
}

Which will result in $string containing only digits. This is the method I now use for filtering out formatting characters (as well as stray whitespace, tabs and other such annoyances) from telephone numbers. In Perl, the \D metacharacter indicates all non-digit characters, while it's little brother, \d, represents only a digit character. The /g indicates the regex engine should do a "greedy" match. In such a match operation, the regex engine doesn't stop with the first matched character, but keeps going to the end of the string until it has found every matching characters.

a honeypot for liars

2007-08-19T16:55:00.000-04:00

After seeing a bunch of news articles about Virgil Griffith's (name intentionally split to help Virgil in his "quest to become the #1 hit on google for query 'virgil'") WikiScanner, I decided to go up and give it a try for myself.

This thing is amazing! While I've always known about the content management features of Wikipedia, having deployed the MediaWiki software a few times, Virgil's tool really makes it easy to see who's doing what to the Internet's largest compendium of community authored content.

While alot of the commentary has focused on the bad actors involved and their presumptive institutional affiliations (derived from their connections through some very secure private networks), it occurred to me that another way of looking at this is that Wikipedia may well be one of the most prominent "honeypots" for liars on the Internet. Although most of those who contribute to the site have good intentions, and the non-controversial content is generally trustworthy, many of the more sensational entries seem to have attracted quite a number of people who don't seem to have any qualms about breaking the Ninth Commandment.

So in addition to being a readily accessible source of valuable educational information on all sorts of topics, Wikipedia can now also serve as a sort of moral barometer for the staff at various government and private organizations. A double public service that deserves the support of all those who value the truth.

widescreen madness: why i won't be buying a laptop this year

2007-08-19T10:41:00.000-04:00

Here's the deal. I'm a sysadmin. I use my laptop for sysadmin work. I rarely watch movies on it, and when I do I almost never watch them full screen.

Widescreen displays may be better for multimedia PC's, but for business, and especially tech, work they're not only unnecessary but can really be annoying. With a widescreen when I do an ls -l or tail a logfile I get nearly 1/2 as many lines before I've got to go backscrolling in the display. Thanks, but no thanks, to that. Oh, and all you webmasters out there who've worked so hard at making each of your pages take up only a single screen: time to get back to work.

Of course what this is really about is laptop manufacturers pulling a fast one on consumers. LCD's are expensive to make. By going to a wide screen format, they can still claim the screen is the same diagonal size while actually delivering fewer square inches in screen real estate. That's less for the consumer and more to the bottom line.

Anyway, widescreens just don't work for me, and since all the major laptop manufacturers now offer nothing else in their reasonably prices models, I won't be buying a laptop this year.

That's around $600 - $800 of revenue Dell, HP, Toshiba, et. al. won't be getting from 'ol eldapo this year. Sorry guys. You're busted.

P.S. For those of you out there who run Linux, one of the quick fixes for issues with getting widescreens to work on our favorite O/S is to configure X-Windows to do 1280x800 resolution, which for some of us is something of a step down from the 1280x1024 we usually run at. Nothing like "widescreen performance"!

when tinkering pays off

2007-08-15T09:17:00.000-04:00

This actually isn't primarily a story about me, but about a colleague.

Yesterday I got a call from the assistant to our General Counsel who conferenced me in with one of the members of the Board of Directors. Well, not just "one" of the board members. Around my company this guy is an icon, and for good reason. During a particularly rough period of our history he stepped up and provided the leadership needed to save the company.

Anyway, it seems he was having trouble logging into one of our web sites. I got the call because whenever a login is involved people immediately assume it's a single sign-on issue, or a problem with the user's entry in a directory.

So I tried logging in with his credentials from both my Windows laptop and my Linux desktop, using both IE and Firefox (Firefox only on Linux, of course). No problem.

Then he tells me he's running MacOS X and Apple's Safari browser.

Now I'm a former FreeBSD hacker. Specifically, a former FreeBSD desktop hacker. Although I've never run MacOS or Safari, I'm actually inclined to favor them over Windows, at least. I've also spent almost 20 years (and early mornings) studying and testing operating systems and applications on my own time that I'll never be asked to support in my day job. My oldest friend is a Mac devotee who jumped for joy when Apple finally released the FreeBSD-based MacOS X.

Unfortunately this didn't come though in our conversation. I sputtered something like "Oh, well, since we don't support Mac ... don't have any Macs in house ... the only way anyone would know anything is if they run it at home for their personal use ..."

God, did I really say that? I'm sure I came off as a typical O/S snob and now feel terrible about it.

After our first conversation, the board member called me back to say he'd tried Firefox and was able to access the site. I promised to continue looking into the problem he was having with Safari, now WAY outside my area of responsibility, and, more importantly, expertise.

I blasted an e-mail call for help to a friend in the desktop engineering group and finally found out that our webmaster ran Macs at home and was willing to help. Now this particular webmaster is not only one of the nicest people you'd want to meet, but also an extremely talented web developer who knows enough about the web tier that he could easily be a sysadmin. He's also one of those guys who has seemingly infinite curiosity about how stuff works. In retrospect, it shouldn't have surprised me that he was also a Mac user.

This morning I contacted the GC's assistant and asked her to get them together. I'm sure our webmaster is going to be able to nail the problem, using skills he's developed on his own time and which he could never have gotten our company to pay for training on.

But isn't that the way it almost always is?

Net::SSH::Perl and Remote Ops

2007-08-14T09:09:00.000-04:00

Because I work in a widely distributed environment it's sometimes necessary to connect to a bunch of boxes and perform some operation that can only be done in the shell, like run top, to see what's what or do some more serious system configuration work (moving files around, for example. I used to do this with the Net::Telnet Perl module, but since alot of our new servers don't run telnetd for security reasons, I've begun to work with ssh. There are two basic options in Perl, the Net::SSH module that actually uses the ssh binaries on your client, or Net::SSH::Perl which is a true object-oriented solution that does not use those binaries. Both are available on CPAN.

From a recent install onto one of my CentOS boxes using yum, here are the dependancies for Net::SSH::Perl (packages come courtesy of RPMforge):


Installing:
 perl-Net-SSH-Perl       noarch     1.30-2.el5.rf    rpmforge          193 k
Installing for dependencies:
 perl-Class-Loader       noarch     2.03-1.2.el5.rf  rpmforge          9.7 k
 perl-Convert-ASCII-Armour  noarch     1.4-1.2.el5.rf   rpmforge           11 k
 perl-Convert-PEM        noarch     0.07-1.2.el5.rf  rpmforge           19 k
 perl-Crypt-CBC          noarch     2.22-1.el5.rf    rpmforge           26 k
 perl-Crypt-DES          i386       2.05-3.2.el5.rf  rpmforge           37 k
 perl-Crypt-DH           noarch     0.06-1.2.el5.rf  rpmforge           11 k
 perl-Crypt-DSA          noarch     0.14-1.el5.rf    rpmforge           35 k
 perl-Crypt-IDEA         i386       1.08-1.el5.rf    rpmforge           32 k
 perl-Crypt-Primes       i386       0.50-1.2.el5.rf  rpmforge           33 k
 perl-Crypt-RSA          noarch     1.58-1.el5.rf    rpmforge           70 k
 perl-Crypt-Random       noarch     1.25-1.2.el5.rf  rpmforge           16 k
 perl-Data-Buffer        noarch     0.04-1.2.el5.rf  rpmforge           13 k
 perl-Digest-MD2         i386       2.03-1.2.el5.rf  rpmforge           41 k
 perl-Math-GMP           i386       2.04-1.2.el5.rf  rpmforge           53 k
 perl-Math-Pari          i386       2.010706-1.el5.rf  rpmforge          3.2 M
 perl-Sort-Versions      noarch     1.5-1.2.el5.rf   rpmforge          8.9 k
 perl-Tie-EncryptedHash  noarch     1.21-1.2.el5.rf  rpmforge           15 k

Of the above, the one that usually gives me the most trouble when compiling from source is Math::Pari, which is why I'm so grateful that this module is available in Fedora/CentOS Extras.

The key to using Net::SSH or Net::SSH::Perl effectively for automation is to carefully plan out what you want to do, and where you want to do it. Whatever system account(s) you decide to use will need to have it's RSA (or DSA) certificate distributed to the corresponding home directory .ssh/authorized_keys file on every box you need to connect to. With Net::SSH::Perl differences between ssh versions are usually not critical. Because Net::SSH relies on the system ssh binaries, "nonstandard" compilations of those binaries (e.g. in Solaris 9) may make them incompatible.

P.S. Getting Net::SSH::Perl compiled on Solaris is not worth the trouble. If you're on Solaris, use Net::SSH instead, along with the Sun Freeware ssh package, or compile ssh and sshd from source and configure according to the doc so sshd will start on boot. Unfortunately version conflicts abound in the Sun free package collection (openssl in particular), and sometimes it's not easy or even possible to "upgrade" to the latest code because of that. On Solaris 8 and before I almost always compile everything from source as a result. Beginning with Solaris 9 native packages for alot of open source stuff are available, but they (ssh, for example) sometimes get compiled with options that defeat attempts at interoperability. So for Solaris users the only thing I can say is caveat emptor, "let the buyer beware". Maybe someday Sun will put up a yum repository for it's packages and updates, but I'm not holding my breath. Open source doesn't just provide freedom to users, it can have a liberating effect for vendors as well. Too bad most of the commercial ISV's out there haven't figured that out yet.

making home movie dvds with dvdstyler

2007-08-12T23:49:00.000-04:00

DVD Styler is a GUI front end for dvdauthor, an open source program used to make DVDs from home video.

There's a nice screenshot-rich (but very simple) tutorial about using DVD Styler on the PCLinux OS site.

This software has some nice features, like a drag-and-drop interface for adding video and sound files, as well as free-form placement of menu buttons. I haven't really fully explored what it can do, being intent on producing a few long-overdue videos for the grandparents.

All I need now is a good video editor to use in cutting some of my less effective footage.

how many files in directory and below?

2007-08-09T15:13:00.000-04:00

To count the number of files in a directory and it's subdirectories, do this:


find . -type f | wc -l

Enjoy.

tech politics: Is Open Document Format "Inevitable"?

2007-08-04T10:19:00.000-04:00

In 1999, a scientist wanted to look at some data from soil samples collected on Mars in 1975 by the Viking lander. He wanted to test a theory about detecting the existence of Martian bacteria and microbes–in other words, finding life on Mars. The scientist thought he would find what he needed on a NASA website somewhere, but it wasn’t that easy. The original data had been misplaced, and when the huge magnetic tapes that stored the data were found, they were “in a format so old that the programmers who knew it had died.” Someone finally found a ream of paper printouts propping a door open and humanity’s understanding of the universe expanded a bit more.

From T. Colin Dowd, ODF: The Inevitable Format in Red Hat Magazine, 7 July 2007.

This is a nice article. It makes the technical and social (as in "for the good of society") case for the adoption of Open Document Format ("ODF") as the global standard for document encoding. It also takes direct aim at the forces that are hindering widespread adoption, notably the "fear, uncertainty and doubt" that "has emanated from one source, on whose proprietary formats most of the world’s documents currently reside." That source is, clearly, Microsoft Corporation, although it is never named in the article.

Of course, Microsoft is aided, as the article points out, by the clueless leaders of these government agencies and business organizations who since the early 1990's have written all those checks for copies of Microsoft Office that "inevitably" led to the company's formats becoming the de facto "standard".

The Open Document Alliance has provided a framework for government and business to make a course correction and put their information technology document encoding practices on the right path for the future.

Unfortunately, there is nothing right now that indicates that the adoption of ODF is "inevitable". In fact, as is pointed out on the ODA site, Massachussetts, the first state government to announce it's intent to go to a more open format, now appears to be buckling under to pressure to further solidify Microsoft's proprietary "standard".

Back when I was a young lawyer, one of my much more seasoned supervisors gave me this sage advice, which I have since striven to follow, even after retiring from the practice:

Never make someone else's malpractice your own.

It is a proverb I would highly recommend to policy makers regarding the future of document encoding.

transcode for converting .avi to .mpeg

2007-08-02T01:47:00.000-04:00

The transcode utility is what you need if you want to convert standard avi video files to a flavor of mpeg. The following comes from the Authoring PC Media to DVD tutorial on the project site.

First, when converting an avi file for use on a DVD, you'll want to split the content into separate video and audio files. In the case of a DVD for playback in the U.S. the encoding will be NTSC. Here's an example given in the tutorial for how to convert a file called "matrix.avi":


transcode -i matrix.avi \
           -y ffmpeg \
           --export_prof dvd-ntsc \
           --export_asr 2 \
           -o matrix \
           -D0 \
           -s2 \
           -m matrix.ac3 \
           -J modfps=clonetype=3 \
           --export_fps 29.97

This will result in two files, matrix.m2v and matrix.ac3, containing video and audio content, respectively. The aspect ratio will be 4:3 (standard TV). To encode video at 16:9 (widescreen TV), use export_asr 3 instead. You might also want to use the "-Y" switch to set the top and bottom margins (the syntax would be -Y -32,0,-32,0 for letterboxing 32 characters high). I use 4:3 so that the resulting video will be compatible with Grandpa's TV.

If you have more than one video file, you'd process each separately (you can combine multiple avi files into a one big file using avimerge, but there are limits to what both encoders, and most DVD players, can work with -- see my previous post on combining avi files). Keep in mind that video quality degrades with each of these encoding and merging operations. There are tricks to minimize such degradation, but at the cost of a significant delay in processing.

To combine multiple video and audio files into one DVD-ready mpg file, use mplex. Again, from the transcode tutorial (where 3 original avi files, "matrix", "outtakes" and "thx" are used as examples):


mplex -f8 -o matrix_dvd.mpg matrix.m2v matrix.ac3
mplex -f8 -o outtakes_dvd.mpg outtakes.m2v outtakes.ac3
mplex -f8 -o thx_dvd.mpg thx.m2v thx.ac3

combining .avi files

2007-08-02T01:38:00.000-04:00

Some more notes from my efforts to create some home movie DVD's.

This one requires avimerge, one of the neat utilities that comes from the Transcode Project.

To combine two or more .avi files, use the following syntax:

avimerge -o combined.avi -i first.avi second.avi

It's that simple. Remmember to put the individual .avi files after the "-i" switch (for "input") in the order you'd like the video to appear in the final, combined, .avi file.

Note: Tricks like using cat to combine multiple .avi files didn't work for me.

recursively grep files

2007-07-26T22:23:00.000-04:00

From Gary Utz, just a one liner to recursively grep on any machine equipped with find, xargs and grep. I use it to search through Apache conf files (which you can get for your Windows system by downloading and installing Cygwin).

find . -name *.conf|xargs grep 'string you're looking for'

my first pc - the kaypro 1

2007-07-21T01:14:00.000-04:00

The Commodore 128 I got in 1985 doesn't count, although it's ability to "dual boot" into CP/M was the incentive to start looking for a "real computer". By 1987 I had left my government job and was in private practice in New York, just starting work on my Master's degree. There was an ad in "Computer Shopper" for this Kaypro 1, a CP/M "portable" that turned out to be the last produced by the company. I don't remmember what I paid for it, but it wasn't much. All of my papers in grad school were written on that system, using a text editor called VDE and a typsetting program called TeX. In 1988 I wrote my one and only hardware driver on this machine, in Z-80 assembler, for an Ampro daisywheel printer.

strip comments from a file

2007-07-02T12:19:00.000-04:00

Another oldie but goodie from Gary Utz:

#!/usr/bin/perl -w
 
$infile = $ARGV[0];
$outfile = $ARGV[1];
 
open I, $infile or die("\nCannot open input file $!\n");
@file = <I>;
close(I);
 
foreach $line(@file) {
  $firstchar = substr($line,0,1);
  $firsttwo = substr($line,0,2);
 
  if ($firsttwo ne "#!" && $firstchar eq "#") { next; }
  elsif ($firstchar eq "\n") { next; }
 
  else {push @output, $line; }
}
 
 open O, "> $outfile" or die("\nCannot open output file $!\n");
 print O @output;
 close(O);

remove spaces in a file

2007-07-02T12:18:00.000-04:00

Here's another one from my colleague, engineer Gary Utz. With this one-liner you can strip all the blank lines out of a file. Very useful.
perl -pi -e 's/^(\s)*$//'

replace spaces in a file with underscores

2007-07-02T12:16:00.001-04:00

Helpful for making those Windoze to UNIX transitions:

#!/usr/bin/perl -w
use File::Path;
@files = glob( "*" );
foreach $files (@files){
    $old = $files;
    $files =~ s/\s/_/g;
    rename( $old, $files);
}

who says perl isn't a text editor?

2007-07-02T12:12:00.000-04:00

This works every, and any, where:
perl -pi -e 's/existing_text/replacing_text/g' filename
You can simply use an asterisk ("*") in place of "filename" to hit every file in a directory (although I don't recommend it -- 9 times out of 10 you'll be sorry you did). Using the -pi.bak switch will create a backup of the original file in the process.

When you come across the need to match on forward slashes (such as when you're search and replacing URL strings), simply escape the each forward slash with a backslash (\/).

There's a good article on this at Cool Computing.

Phil Cam in Action

2007-06-20T20:34:00.000-04:00

Just snapped this today off the infamous "philcam". This is pretty much what those who know about the site (which is alot of folks at our New York and Colorado headquarters) see when they dial it up on our internal network. As I said on my personal blog earlier today, not a very pretty sight. My neighbors in the local branch sometimes have fun with it too.

How I set this up is described in an earlier article on this blog. The stuff that's whited-out (including the URL for my internal site) are obscured for security reasons. Hey, what do you expect? I am in system security, after all.

Me, my minicam and Linux

2007-06-13T23:58:00.000-04:00

Finally got the SIIG Firewire card today. Popped it in and restarted the new Fedora 6 box.

Ran dmesg and saw:


ieee1394: Initialized config rom entry `ip1394'
ohci1394: fw-host0: OHCI-1394 1.0 (PCI): IRQ=[19]  MMIO=[ecefe800-ecefefff]  Max Packet=[2048]  IR/IT contexts=[4/8]
ieee1394: Host added: ID:BUS[0-00:1023]  GUID[0001080038024d39]
ieee1394: Node added: ID:BUS[0-01:1023]  GUID[08004601035d5e58]
ieee1394: raw1394: /dev/raw1394 device initialized
WARNING: The dv1394 driver is unsupported and will be removed from Linux soon. Use raw1394 instead.
ieee1394: Node suspended: ID:BUS[0-01:1023]  GUID[08004601035d5e58]
ieee1394: Node changed: 0-01:1023 -> 0-00:1023
ieee1394: Node resumed: ID:BUS[0-00:1023]  GUID[08004601035d5e58]
ieee1394: Node changed: 0-00:1023 -> 0-01:1023

Output of lsmod:


dv1394                 22821  0
raw1394                30789  4
ohci1394               37489  1 dv1394
ieee1394              294809  3 dv1394,raw1394,ohci1394

OK. OK. So I jumped the gun. Plugged in the camera and turned it on.

First issue was, what do I use to grab the 3 hours of mini tape I've got?

Already knew that kino was a little flaky (well, alot flaky -- very prone to crashing), at least on Red Hat.

Finally decided to use dvgrab. Simple, straighforward. No GUI to mess with.

Start pulling video off the first tape, run:

dvgrab --autosplit tape1_

Boom. Starts echoing back to me:


"tape1_001.avi":   136.78 MB 1154 frames timecode 00:00:38.15 date 2006.09.18 13:08:54
"tape1_002.avi":    34.61 MB 292 frames timecode 00:00:48.07 date 2006.09.18 13:09:19
"tape1_003.avi":    99.21 MB 837 frames timecode 00:01:16.06 date 2006.09.18 13:10:04

Well, you get the idea. Still running as I write this. Plan to let it wind out overnight. Tommorrow I'll begin looking at how to run all this video through an editor and put together some nice, topical, movies. After that it's on to figuring out how to build my own DVD with menus fit for sending to grandpa.

For now, time for lights out.

The Virtual AGC

2007-06-12T18:32:00.000-04:00

The Virtual AGC simulates the operations of the Apollo Guidance Computer in software. Being home sick the last few days, I've been challenged to do more with my (few) waking hours (real bad virus, maybe flu -- definitely takes you down a few notches) than just watching TV.

So I came across Ron Burkey's site and downloaded his (still) incomplete AGC emulator, which includes a graphical representation of the original Apollo DSKY data entry pad.

I've been running through a few of the simulation tests since. Haven't got to anything really meaningful, but for a Cold War era kid like me this is a real thrill.

Starplot

2007-06-10T10:17:00.000-04:00

Back when I was in law school I discovered the "Whole Earth Catalog" (2nd edition, entitled "The Next Whole Earth Catalog"). Well, actually I was introduced to it by an upperclassman. To this day I've carried with me two things from that book. The first is the memory of an article entitled "The Stillman Zero Maintenance Theory", that appeared alongside an entry for Joe Troise's book Drive it till it drops: how to keep your car running forever!. Basically, Stillman's "theory" was that you find the biggest, ugliest, gas-guzzler you can find (in 1980 this would have been something like a 1968 Plymouth Fury) and, so long as it passes some minimal safety tests (one I remmember involved taking the car up to about 60 MPH and then slamming on the brakes -- it the pedal didn't completely sink to the floor you were in), buy it and then do nothing to maintain it. No tuneups, no oil changes, nothing.

The other thing I took away was an introduction to astronomer Guy Ottewell's Astronomical Calendar and related publications. The most fascinating of these was the Astronomical Companion, an oversize format paperback that provided an ever expanding 3-D view out from Earth of it's stellar neighborhood.

I spent hours looking at those 3D views of the other star systems around us, and always wished there was a software program that could provide a similar perpective.

Well, StarPlot is such a program, whose source is available for compiling on Linux and "Linux-like" systems.

StarPlot uses the GTK toolkit, and so you'll need the appropriate development libraries to build it. When I compiled it last, I did a "./configure prefix=/opt/starplot" to keep all the code in one directory. Here's my "starplot.desktop", that I dropped into /usr/share/applications.


[Desktop Entry]
Name=Starplot
Comment=3D Star Mapping
Exec=/opt/starplot/bin/starplot
Icon=/opt/starplot/share/starplot/starplot1e.png
Terminal=false
Type=Application
Version=0.95.4
Actions=Full;
Categories=Application;Astronomy;X-Red-Hat-Extra;
Encoding=UTF-8

The application icon is a user contribution copied off the StarPlot home page.
After building and installing, I chowned /opt/starplot so that my "user" group had ownership and chmod'ed to give the group write permissions.

Using StarPlot is pretty intuitive. You can load (or merge) additional star catalogs like one that contains stars with planets. I loaded the Gliese catalog in order to locate GL581. There are tools included to convert generic star catalog files to the .star format used by StarPlot. Another great piece of open source astronomy software.

Building XEphem on Fedora 6

2007-06-10T09:17:00.000-04:00

XEphem is a full-featured astronomical epehemeris program for Linux and Linux-like systems (e.g. FreeBSD and it's non-free cousin, Mac OSX). While there are prebuilt rpms out there, none are available for the latest version (3.7.2), and those that are require enough customization to make them work that it is easier just to compile from source.

Here's my own build and configure recipe.

Download and unarchive the source tarball from http://www.clearskyinstitute.com/xephem/.

Drill down to the GUI/xephem directory and (for Linux) run "make MOTIF=../../linux86".

Create a directory called /opt/xephem and copy the newly compiled "xephem" binary to it. Then cp -R the other directories that the INSTALL file indicates to this same directory.

Create a shell script called "xephem.sh" in /opt/xephem with the lines:#!/bin/bash cd /opt/xephem ./xephem
Create a soft link from this shell script to /usr/bin/xephem.

Use chown to set ownership on "staff" or other common user group for allowing people to write to shared directories, and then chmod g+w.

For each user who will use the program, create a ~/.xephem directory and a XEphem file under it containing the line "XEphem.ShareDir: /opt/xephem".

To get a menu item in Gnome, create the file /usr/share/applications/xephem.desktop and give it the following content:[Desktop Entry] Name=XEphem Comment=Astronomical Ephemeris Exec=xephem Icon=/opt/xephem/auxil/logo.gif Terminal=false Type=Application Version=3.7.2 Actions=Full; Categories=Application;Astronomy;X-Red-Hat-Extra; Encoding=UTF-8

Run xephem and set it to your default location, click update and then save.

It's the Hardware, Stupid!

2007-06-07T19:45:00.000-04:00

Trying to track down the cause of my Firewire problems, I came across this blog post.

The output of dmesg on my machine matched his:


ieee1394: Initialized config rom entry `ip1394'
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]
ohci1394: fw-host0: OHCI-1394 1.1 (PCI): IRQ=[18]  MMIO=[ecefe000-ecefe7ff]  Max Packet=[2048]  IR/IT contexts=[11/32]
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]

The result from lsmod was less promising:


ohci1394               37489  0 
ieee1394              294809  1 ohci1394

Doing a modprobe on raw1394, dv1394 and ohci1394 garnered this changed result:


dv1394                 22821  0 
raw1394                30789  0 
ohci1394               37489  1 dv1394
ieee1394              294809  3 dv1394,raw1394,ohci1394

So far so good, I was tracking the author's experience closely. Running dmesg again, I now got:


ieee1394: Initialized config rom entry `ip1394'
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]
ohci1394: fw-host0: OHCI-1394 1.1 (PCI): IRQ=[18]  MMIO=[ecefe000-ecefe7ff]  Max Packet=[2048]  IR/IT contexts=[11/32]
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]
ohci1394: fw-host0: Get PHY Reg timeout [0x00000080/0x00000000/100]
ieee1394: raw1394: /dev/raw1394 device initialized
WARNING: The dv1394 driver is unsupported and will be removed from Linux soon. Use raw1394 instead.

At this point I knew. It was my hardware. Specifically my IEEE1394 PCI card. It had to be. Over a decade of experience in computers told me that was the answer.

A cheap, $12 card, made in some sweatshop in China, had cost me a week's worth of late nights.

The moral of the story? Hardware fails. It's a physical law. As my middle brother used to say, heat is the greatest enemy of electronics -- and computers run awful hot compared to other appliances.

I could go down to the local computer shop and get a replacement card, but I already know they're only going to have the same low cost card that just failed on me. So instead I'm going up on Newegg and order something slightly more expensive made by SIIG (a company whose components went into the first PCs I built for hire back in the late 80's). Right now, however, I'm going upstairs to power down the machine and remove the faulty card.

Script to check on an Oracle DB

2007-06-07T17:12:00.000-04:00

Just a simple shell script that uses tnsping to check if a remote db is listening.
$ORACLE_HOME and $ORACLE_SID are hardcoded (there are fancier scripts around that go out to parse oratab and tnsnames.ora, which is particularly useful when you want to ping more than one instance).


#!/bin/bash
ORACLE_HOME=/u01/app/oracle/product/10.2.0/client
ORACLE_SID=testdb
RESULT=`$ORACLE_HOME/bin/tnsping $ORACLE_SID|grep -q OK`
if [ $? -eq 0 ]; then
echo "db is up"
else
echo "db is down"
fi

Fedora 6 Tips & Tricks

2007-06-07T14:52:00.000-04:00

Fedora 6 Tips & Tricks is a great page by Gregory Gulik that's just packed with information on customizing the configuration this distribution. It's going on my links list for sure.

x3270 configuration

2007-06-07T01:46:00.000-04:00

A big shoutout to my colleagues out there who were among the pioneers of Linux on the S/390 (the Marist College distribution). Here is my .x3270pro file, which I shamelessly ripped off from here. Essential software for running all those TSO sessions required to get the "iron penguin" properly configured:

! x3270 profile
! This file overrides xrdb and .Xdefaults.
! To skip reading this file, set NOX3270PRO in the environment.
! Put together by Carey Evans, 1997-1998.
! This file is in the public domain.

x3270.keymap.5250: \
 MetaF1:  PF(1)\n\
 ShiftF1:  PF(13)\n\
 ShiftF2:  PF(14)\n\
 ShiftF3:  PF(15)\n\
 ShiftF4:  PF(16)\n\
 ShiftF5:  PF(17)\n\
 ShiftF6:  PF(18)\n\
 ShiftF7:  PF(19)\n\
 ShiftF8:  PF(20)\n\
 ShiftF9:  PF(21)\n\
 ShiftF10:  PF(22)\n\
 ShiftF11:  PF(23)\n\
 ShiftF12:  PF(24)\n\
 F1:  PA(1) PF(1)\n\
 F2:  PA(1) PF(2)\n\
 F3:  PA(1) PF(3)\n\
 F4:  PA(1) PF(4)\n\
 F5:  PA(1) PF(5)\n\
 F6:  PA(1) PF(6)\n\
 F7:  PA(1) PF(7)\n\
 F8:  PA(1) PF(8)\n\
 F9:  PA(1) PF(9)\n\
 F10:  PA(1) PF(10)\n\
 F11:  PA(1) PF(11)\n\
 F12:  PA(1) PF(12)\n\
 Return:  EraseEOF() Tab()\n\
 ShiftInsert: Dup()\n\
 Insert:  ToggleInsert()\n\
 KP_Insert:  ToggleInsert()\n\
 ShiftHome:  PF(5)\n\
 End:  FieldEnd()\n\
 Control_L:  Reset() PF(10)\n\
 Control_R:  Enter()\n\
 ShiftEscape: PF(11)\n\
 Escape:  PF(9)\n\
 Pause:  PF(11)\n\
 Print:  PF(4)\n\
 Prior:  PF(7)\n\
 Next:  PF(8)\n\
 Scroll_Lock: PF(1)\n\
 KP_Enter:  Enter()\n

! model (-model)
x3270.model: 2
! keymap (-keymap)
x3270.keymap: alt,5250
! charset (-charset)
x3270.charset: us-intl
! toggles (-set, -clear)
x3270.blankFill: true

! File updated Fri Jun 17 21:26:10 2005 by x3270 v3.3.2p1 Wed Jul  7 11:09:00 EDT 2004 root
! emulator font  (-efont)
x3270.emulatorFont: 3270-20

wireless networking with ndiswrapper

2007-06-07T01:19:00.000-04:00

The house laptop (a Dell Inspiron 1200) just got an upgrade to Fedora Core 6, so I had to once again set up wireless networking on it. My prefered route is to use ndiswrapper, because it supports so many different cards. Basically I followed the instructions found on the project's web site. The steps were simple:

Install the kernel source rpm for the running kernel (for CentOS this would be something like kernel-devel-2.6.9-42.0.3.EL.i686.rpm, you usually can get by doing a "yum install kernel-devel"). If installing from a downloaded rpm file, use "rpm -ivh ".
Download and unarchive the ndiswrapper source tar.gz to /usr/src/redhat/SOURCES.
Change directory into the unarchived ndiswrapper directory under SOURCES and make an rpm using make rpm.
Install the rpm (found in /usr/src/redhat/RPMS).
Download and unarchive the D-Link driver for the card (in my case a DWL-G650C b/g device).
Install the desire driver with ndiswrapper -i DRIVER.INF from within the unarchived driver directory.
Do a modprobe ndiswrapper.
Edit modprobe.conf to include the following lines:
options ndiswrapper if_name=wlan0 alias wlan0 ndiswrapper
Create a ifcfg-wlan0 (see example below) and a keys-wlan0 file (containing the line KEY: xxxxxxxxxxxxxxxxxxxxxx) to hold your config and credentials for WEP authentication.
Restart the network and take the laptop for a walk around the house.


Following is a copy of my ifcfg-wlan0 file:
# Atheros Communications, Inc. AR5212 802.11abg NIC 
DEVICE=wlan0
ONBOOT=yes
BOOTPROTO=dhcp
TYPE=Wireless
MODE=Managed
ESSID=mynetworkessid
RATE=Auto
NETMASK=
DHCP_HOSTNAME=
IPADDR=
DOMAIN=
HWADDR=
CHANNEL=1
USERCTL=no
IPV6INIT=no
PEERDNS=yes



Red Hat Summit
2007-06-06T11:18:00.000-04:00
Here are the Summit Highlights from this year's meeting in San Diego.


liberation fonts
2007-06-06T10:56:00.000-04:00
These are really good. Still not a 100% replacement for the old Microsoft core fonts (here is a recent link to an rpm for those), but a nice set of quality fonts that look great in Firefox.

Thanks to Red Hat for the gift.


VMware Server on Fedora Core 6
2007-06-06T09:22:00.000-04:00
Ran into a little trouble installing VMware Server on Fedora Core 6 last night. Especially annoying because I had a limited time to get it done before going down to put the kids to bed.

There's apparently an issue with the latest Fedora Core 6 kernel (you've got to wonder if Red Hat is having a problem with kernel maintainence lately, see my earlier post on the show-stopper bug I experienced with Fedora 7) that prevents the vmware-config.pl script from compiling the module it needs to run the software.

This is not the same bug that was discussed here, and that fix does not work.

I finally found the answer on the VMware Workstation Forum in a post entitled "Error on rebuild after kernel upgrade, 2.6.20-1.2952.fc6". Note: As of 22 Aug 2007 the referenced patch is at v113, and the location it can be found at has been updated in the link below.

The latest "vmware-any-any-update" patch that provides the workaround discussed above is found here. Just run the enclosed runme.pl script instead of the shipping vmware-config.pl (runme.pl executes vmware-config.pl after applying the requisite patches). All Fedora users owe the patch author, Petr Vandrovec (userID "petr" on the VMWare Server Forum), a debt of gratitude for providing this free service to all of us.


Trouble among the hats
2007-06-04T22:10:00.000-04:00
My effort to migrate to Fedora 7 isn't going well. Apparently the machine I'm running is subject to a bug in the shipping kernel that still hasn't been fixed.

Under "Common Issues" for this first release under the new community rules, there's this glaring acknowledgement:

Dell Dual Core Systems
Bug 241249 - Some Dell laptops with Intel dual-core CPUs (Core Duo, Core 2 Duo, Pentium Dual Core) may require the maxcpus=1 option at installation boot time.

Except, from the notes appended to the initial bug report, it's not just dual core Dell laptops, but also desktops, made within the last 2 years. My Dell E510n, which was made just last year, has a 1.83 GHz Pentium D 820 (Smithfield) and is a pretty generic desktop. In fact, it was built to run an open source O/S -- it shipped with FreeDOS.

Wading through all the comments, some of which characteristically include disparaging remarks about the processors involved that are extremely unhelpful from an engineering point of view, I found several proposed workarounds, none of which worked for me.

(Still no acknowledgement of other annoyances, like the latest Adobe Acrobat acroread script failing to work on anything after Red Hat Enterprise 4/Fedora 5)

As a result of all this I decided to rebuild my machine with Fedora 6 instead, which went very smoothly. Of course I'll keep checking in on bugzilla to see what, if any, progress is made fixing the Dell dual core CPU issue. Ironically, my free copies of the install discs for Ubuntu 7.04 i386 and x86_64 just arrived. Timing is everything. Still, I think I'll put those Ubuntu disks someplace where I can get to them quickly. Just in case. Being a sysadmin means ALWAYS having a Plan B.


Back to Fedora -- for Firewire!
2007-06-04T11:10:00.000-04:00

It's been a long, fun trip with CentOS on the desktop. But all good things must come to an end. In the next week I'm going to move my personal workstation at home to Fedora 7. It's not that CentOS doesn't provide the best, most rock-solid server environment in the world (next to their Upstream OS Provider). It's the devices. A specific Firewire device in particular.

This has been a difficult decision because I migrated off Fedora a few years ago to get away from the exhausting pace of new releases that the developers maintain. Rebuilding up to a new major version every 6 months was just not my idea of fun. And then there were the dependancy failures that inevitably resulted when someone forgot to dot an "i" or cross a "t" when releasing an upgrade package that touched a few dozen other packages. That's OK for a development distro, which is what the developers keep reminding us is what Fedora is. For someone who spends most of his day wrestling enterprise software into submission, howerver, it was a little too much.

But I need good, reliable, Firewire support. I really do.

You see, in addition to being a full-time tech, I'm also a full-time dad to a couple of very active kids. That's why I bought a nice new Sony DV cam last summer. When I was on CentOS 4 I was able to use a combination of the latest centosplus kernel and hours of Googling to get the right configuration to allow me to download taped video onto my workstation for editing. Since getting up on CentOS 5 I've tried the same procedure again, although there still is no release version of centosplus and I've had to make due with test. Although it worked for a day, it suddenly just quit. Although lsmod shows the ieee1394 and ohci1394 modules loaded, none of my software like kino can see the camera or it's output.



So, in the hopes that the newly re-engineered Firewire stack in Fedora 7 will do the trick, I'm migrating off CentOS and back onto Fedora. I've already added a second, real big, hard disk to the box, and moved all the stuff I want to save onto it. All that's left is to tar up etc, home and var just in case I missed something. Then the fun will begin.

Hopefully this will be the last rebuild I'll need to do for awhile. I've already done 3 in the last couple of months, from CentOS 4 to CentOS 5 x86_64 and then to CentOS 5 x86. Just need to be careful about not running an open-ended "yum update".


Palm Foleo
2007-06-01T02:13:00.000-04:00
The new Palm Foleo was just announced the other day.



Specs aren't all that detailed yet, but it's supposed to have a 10" screen, a web browser and a GUI e-mail app. It's being billed as a "mobile companion", but if I can run a terminal on it and the battery life is better than a laptop, I'd buy one in a second.

Four things in it's favor:
"Just right" sized screen and keyboard. 10" is small enough to still be portable, but big enough to let you get useful stuff done;

Rumor has it that it runs a Linux variant. That means it could run Linux, which means that systems guys like me can learn to expand it's capabilities (like by adding a terminal app).

Industry standard wireless networking. No info yet on whether it can handle WPA, or what protocls it uses (please, please, let it be a/b/g!).

Specs released so far say no hard disk (flash memory?), and works up to 5 hours on a charge. For something with no moving parts that's actually a little disappointing, because you know vendors never actually achieve the battery life they claim.

Although Palm is playing it safe by marketing it to the gadget-loving executives and executive wannabes who are their customer base, it has real potential as a no-nonsense laptop replacement for 24x7 sysadmins like me. For now, I've put myself on the mailing list for when they actually ship.


Let's get a real database
2007-05-30T12:23:00.000-04:00
Another cross post from eldapo, on the folly of trying to fill open source-sized shoes with proprietary-made feet.


nvidia on linux gamma correction
2007-05-29T15:31:00.000-04:00
This is another of those "so that others might not suffer as I did" posts.

Some time ago I swapped out the ATI cards that came with our Dell desktops at home with new ones from Nvidia. Although the performance specs on these cards are similar, the main reason for the switch was improved stability as a result of better quality drivers from Nvidia. This is especially true for Linux.

With the move up to CentOS 5 on my main workstation I've been working with the xorg generic "nv" driver for the last few weeks. Last night I finally decided to install the proprietary Nvidia driver, mostly because the contrast on my Dell flat panel was annoying me to no end.

Installation of the latest binary package went smoothly, but when I fired up the Nvidia config tool (nvidia-settings), I could not find the panel to adjust brightness, contrast or gamma.

Over the next few hours, until around 2 AM, I kept at it. Googling around to no avail. Then I noticed that xvinfo was returning squat, which mean that xv wasn't loading. Since the xorg.conf that anaconda built during the original CentOS setup was pretty sparse (it only had "Load glx").

Anyway, I discovered that by adding "Load extmod" xv came up and at the same time the controls for brightness, contrast and gamma now magically appeared in the Nvidia gui. I also put in Load lines for dbe, type1 and freetype.


Eldapo Speaks: An IT Infrastructure for the Rest of Us
2007-05-29T12:07:00.000-04:00
A cross post from eldapo. Here's the link.


My Certificate Authority
2007-05-28T15:00:00.000-04:00
In Red Hat/CentOS 5 the developers finally adopted the convention in later Fedora releases of moving /usr/share/ssl to /etc/pki/tls. For at least 2 years I've been making by own /etc/ssl/CA and /etc/ssl/certs to store my CA root and host-wide certificates. With the recent change, I'm now going to use /etc/pki/CA and /etc/pki/tls/certs for this purpose.

To make this as easy as possible, I edited /etc/pki/tls/openssl.cnf to set dir to "/etc/pki/CA" and default_days to "1825" (so my certs expire in 5 years instead of 1). I also filled out some of the other default info like countryName, etc. to avoid repetitive typing.

For some unknown reason, I really like using the little CA script that's been standard with openssl distributions, which is now /etc/pki/tls/misc/CA.

To create my CA, I just issued a /etc/pki/tls/misc/CA -newca and answered the questions. My passphrase was a pretty long string I can remmember, and I set the commonName to the something like "My Company Authority" (this value is what gets dispayed as the name of your authority in Mozilla and other browsers, so you want to make it obvious).

Once I had my new CA in place, it was time to start cutting some certificates. To do this I first changed to the directory where I wanted to store my certificates and keys, /etc/pki/tls/certs.

This is a two step process, first make a certificate request:

/etc/pki/tls/misc/CA -newreq

In answering the questions, for commonName I give the hostname for the machine or virtual host that will use the cert. I also gave a short password (like, "secret") for the certificate key (you'll see why a little further on). This will create two new files, "newreq.pem" (the request file) and "newkey.pem" (a key file).

Next, sign the the certificate:

/etc/pki/tls/CA -sign

Which creates the certificate file, by default called "newcert.pem".

Most Open Source software doesn't provide a way to feed the key's password during automatic startup. When starting Apache or OpenLDAP manually you'll be prompted for that password, which the server needs to decrypt the key before starting up. To get around this, a decrypted version of the key can be used.

To create a decrypted version of the key, all you have to do is issue a:

openssl rsa -in newkey.pem -out hostkey.pem

Which will decrypt the "newkey.pem" made by CA and create a new, decrypted, version called "hostkey.pem". When configuring software that uses the certificate and key files, use the decrypted key file to allow services to start up without prompting for a key password.


favorite firefox extensions
2007-05-25T18:52:00.000-04:00
Everyone knows to get Adobe Flash, Acrobat and Real Media's RealPlayer.

Here's a short list of the Firefox extensions I put on all my machines:

LiveHTTPHeaders
Wizz News Reader (RSS)
Total Validator



Get these from the Firefox Add-ons page.


network attached storage -- almost
2007-05-24T09:00:00.000-04:00
Was looking at various products that provide at least a pseudo Network Attached Storage (NAS) capability for home users. Not really much to write home about. They're all pretty expensive, and limited, in their own way. Absolute worst of the lot is from one of my favorite companies, Western Digital. Apparently they decided to go with a proprietary Windows client for making connections to their devices. Too bad.

There was one promising entry, however. The Hammer Storage MyShare. The model I was looking at, the HN1200-500 gives you 500 Gb for less than $300 on NewEgg.

In researching the device I found out that it's basically a headless Linux box using an ARM processor. Here are the specs. With this device you can attach using any one or all of the following standard protocols: HTTP, HTTPS, CIFS, NFS, FTP, SMB. The system can also be managed from a platform-independant web interface. These features put Hammer's offerings (they also have a 1 Tb model) way out ahead of all the competition.

In the end, I decided to go for a relatively cheap 2nd 250 Gb drive for my main workstation. The major need for more storage right now comes from video editing activity, which requires huge amounts of disk before the final product is completed. For that kind of work another local drive, accessed directly over the hardware bus, is the right choice.


ssh authorized_keys problems
2007-05-24T08:53:00.000-04:00
A post from "Pyx", verbatim, that bears reading:

Note to self: whenever you have problems with SSH authorized_keys not working, check the permissions on the directories and files. Here are some quick instructions for getting SSH authorized_keys working on a new host:

ssh to the remote host and:

mkdir .ssh
chmod 700 .ssh

Back on the local machine:

cat .ssh/id_dsa.pub | ssh remotehost "cat > .ssh/authorized_keys; chmod 600 .ssh/authorized_keys"

Posted by Donovan at 10:27:43



retreat from 64-bit
2007-05-23T21:02:00.000-04:00
Reinstalled 32-bit CentOS over the weekend after a series of hardware-related problems that I suspect may be related to issues with the 64-bit versions of the hardware drivers I was running. This is all tied up with usb and cdrom (ATA - IDE) drive detection and how Nautilus handles insertion "events" for removable media (keep in mind that even the 32-bit version of cdrecord is currently somewhat broken, "-scanbus" no longer works under the newer kernels). Although I can't prove it, I think there may be something flaky about things in a 64-bit environment. Since returning to the 32-bit version of the OS, I have not experienced these difficulties.


mounting usb hard drive formatted ntfs
2007-05-18T20:06:00.000-04:00
Got myself into this jam when I set perms on my Western Digital "My Book" portable usb hard drive.

Out of the box, the "My Book" comes formatted FAT32, which Linux can read and write to. My CentOS workstation recognizes and automounts the drive using Nautilus in my nonpriviledged user session. An ls -l shows the disk as being owned by me, the session user.

Under these circumstances in is A VERY BAD THING (TM) to try and impose ext3 permissions on any disk file. Basically it hoses the disk formatting and makes it unwritable either in Linux or Windows. Me, I did a "chown -R me:me *" at the disk root, followed by a "chmod -R ugo+rw *". Real smart.

Because I had alot of data on the disk I though I'd try my luck at converting it to NTFS from a Widows machine. As I expected, the filesystem was repaired, but now the disk was coming up "Read-Only" when mounted by Nautilus. A simple umount and then mount as root didn't fix the problem (I created a directory called /media/usbdisk to mount /dev/sdb1 on).

Then I read up on the ntfs-3g driver. 

mount -t ntfs-3g /dev/sdb1 /media/usbdisk -o force

I did get this error message:

$LogFile indicates unclean shutdown (0, 1)
WARNING: Forced mount, reset $LogFile.
WARNING: Deficient Linux kernel detected. Some driver features are
         not available (swap file on NTFS, boot from NTFS by LILO), and
         unmount is not safe unless it's made sure the ntfs-3g process
         naturally terminates after calling 'umount'. If you wish this
         message to disappear then you should upgrade to at least kernel
         version 2.6.20, or request help from your distribution to fix
         the kernel problem. The below web page has more information:
         http://ntfs-3g.org/support.html#fuse26


But when I checked, the disk was now fully writable by root.

While this was an oh-so-fun exercise, my plan is to backup the usb disk and then wipe it clean by restoring it's original FAT32 formatting. The moral of the story is to always 
read the directions" -- of course in this case there were no directions because WD refuses to acknowledge the existence of the Linux operating system. Well, now you've been warned.


No X after upgrade/install of Red Hat/CentOS 5
2007-05-14T09:07:00.000-04:00
Since I've had this problem on a couple of machines, and wasted alot of time searching for an answer, I thought I'd "share the wealth" here.

Problem: After upgrading or doing a fresh install of Red Hat or CentOS 5, on the first reboot after configuration you're facing a back screen instead of the expected graphical login. You can log in OK, but try and do a "startx" to fire up the GUI and you'll be told a session is already running.

In this case believe it. There is an X session there, the one owned by gdm, the graphical login. If you log out and then do an Alt-F7 you can switch to it and use the graphical login as before.

Why is this happening? I actually have no idea. Part of why I have no idea is that neither the Red Hat nor CentOS teams have to date acknowledged there is a problem. You'll search in vain for any kind of official word on this condition.

Solution: Who knows? Probably a mistake in either an init script or the ordering of the startup sequence. I'm just a mechanic, not an architect. Someone way smarter than me will need to figure that out. For now, see below for the workaround I found on a couple of the lists.

Workaround: Edit /etc/grub.conf (that's not the real location, just the symlink, but don't worry about that now) and remove the argument "rhgb quiet" from the bootloader line. As a result rhgb won't load and you'll get the graphical login on reboot.


Taking the Plunge in 64-bit Desktop Computing
2007-05-05T20:33:00.000-04:00
The 64-bit processor is the holy grail of desktop computing. This weekend I finally took the plunge and rebuilt my home workstation with CentOS 5 x86_64.

One thing I discovered right away was that a 64-bit OS on an Intel x86_64 processor does in fact run faster. Performance was perceptably better than with my previous 32-bit build using CentOS 4.4 for i386.

Then came the bad news. While the desktop systems using either AMD or Intel x86_64 chips have been out for a few years, there are still no web browser plugins available for Adobe Reader, Flash, Real Player or Sun Java on 64-bit Intel (Sun does have a 64-bit plugin for Solaris).

The programmers over at mozdev.org have come out with some wrapper code that allows you to run the 32-bit plugins for Adobe (Reader, Flash) and Real software in Firefox. Unfortunately, this doesn't work for Java. The alternative of using Blackdown's 64-bit rebuild of the JRE 1.4.2 plugin works OK, although I did crash the browser on a couple of test sites and some Java animation didn't work on others.

When I originally switched from a Windows to a Unix desktop, I had to learn new ways to do familiar things because much of the software I'd used on Windows was simply not available for Linux. In many cases I found that the open source software and the different procedures it required were more actually easier and more efficient than the proprietary product I'd left behind. There is indeed a difference between using a product like tetex and one like PageMaker for typesetting and page composition. After using it for half a decade, I have found the former more to my liking.

Now that I've made the switch to 64-bit processing, it's likely I'll find similar workarounds for things like reading PDF's, rendering web page animation and playing multimedia files.

Update: I've found at least one purportedly 64-bit machine that I couldn't install x86_64 CentOS (and therefore Red Hat) on. That's the Dell GX620 I have on my desk at work. It's an older Prescott with Hyperthreading (not dual core like the Smithfields I run at home). While the Intel specs say it should be able to run 64-bit OS's, and it does install, once the config is complete it continually crashes.


webcam_server
2007-05-03T17:13:00.000-04:00
I work at some distance from my company's corporate headquarters in New York. Although they try to get me to come up for a visit from time to time, for some of my co-workers this just isn't enough to satisfy their curiosity, nay, need, to see what I look like from day to day. As a result, early on I set up "Phil Cam" on my work desktop. An old Creative USB webcam provided the hardware. For the software  I downloaded and installed the open source webcam_server software written by Mike Morrison.

Installation is pretty straightforward. I basically followed the doc that came with the package, with a couple of differences for my own CentOS Linux environment.

Basically all you have to do is run the webcam_server binary, which sets up a listener on port 8888 for a web page that invokes the included Java applet (called "applet.jar").

Here's the APPLET code that needs to be embedded in the web page:

< code = "WebCamApplet.class" archive="applet.jar" width = "320" height = "240">
< name="URL" value="http://myserver.mydomain.com:8888">
< name="FPS" value="1">
< name="width" value="320">
< name="height" value="240">
< /APPLET >

The Java applet, supporting classes, jpegs and index.html pages are kept in /var/www/html/philcam.

Because this runs on my desktop at work, I wanted to run it as a daemon. To make that happen I moved the webcam_server binary from /usr/local/bin to /usr/sbin and then deployed the following RHEL init script:

#!/bin/bash
#
# webcam_server  This shell script takes care of starting and stopping
#   the Webcam Server Application
#
# chkconfig: 2345 99 40
# description: Webcam Server is an application for streaming video
# processname: webcam_server
# pidfile: /var/run/webcam_server.pid

# Source function library
if [ -f /etc/init.d/functions ] ; then
. /etc/init.d/functions
elif [ -f /etc/rc.d/init.d/functions ] ; then
. /etc/rc.d/init.d/functions
else
exit 0
fi

RETVAL=0
WCARGS=" -s -l /var/log/webcam_server.log"

start() {
echo -n $"Starting Webcam Server: "
daemon webcam_server $WCARGS
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && touch /var/lock/subsys/webcam_server || \
RETVAL=1
return $RETVAL
}

stop() {
echo -n $"Stopping Webcam Server: "
killproc webcam_server
RETVAL=$?
echo
[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/webcam_server
echo ""
return $RETVAL
}



Installing Java on RHEL with Alternatives
2007-05-02T14:16:00.000-04:00
The Alternatives system is a powerful tool for configuring third party software on Fedora Core. This article describes how to use it to install Sun's Java SDK on a workstation or server.

Download the latest J2SDK for Linux (I prefer the rpm for Red Hat) from Sun and install (rpm -Uvh for the rpm package, tar xzf for the tar.gz). I now put it in Sun's preferred default location, /usr/java/jdk-1.5.0_x. Once installed I symlink from the latest version to /usr/java/jdk. By doing this I can avoid having to peform the procedure that follows again with each new version of Java.

Once this is done, execute the following commands to actually register this as the version of Java to use:

/usr/sbin/alternatives --install /usr/bin/java java \
     /usr/java/jdk/bin/java 301

/usr/sbin/alternatives --config java

On that last command, be sure to select the actual copy of (or symlink to) the Java version you want to use. Make sure the path given is correct for your system. Repeat this for the javac command.

Finally, set the environment for everyone on the machine by creating a java.sh script in /etc/profile.d:

#!/bin/sh
export JAVA_HOME=/usr/java/jdk
export JRE_HOME=$JAVA_HOME/jre
export J2RE_HOME=$JAVA_HOME/jre
export PATH=$JAVA_HOME/bin:$JRE_HOME/bin:$J2RE_HOME/bin:$PATH

Now you can go and manually symlink the Mozilla plugin so that it will be loaded when your browser starts.


Burning CD's from the command-line in Linux
2007-05-02T09:50:00.000-04:00
Only posting this here so I don't have to Google for the procedure after senility kicks in (taken from my original personal web site):

As an old DOS hacker, I sometimes find things get done quicker from the command line. In the case of burning CDs or DVDs on Fedora 3, cdrecord is my tool of choice.

Make an ISO image

There are a couple of ways to do this.

To copy an existing disk, do this:

dd if=/dev/hdc of=cdrom.iso bs=2048

To make your own iso, do this:

mkisofs -o /tmp/cdrom.iso -J -r -v -V /tmp/content

Where "/tmp/content" is a folder containing the files and/or folders you want on the CD.

Test the iso

Test the resulting iso by mounting it:

Create a mountpoint (e.g. "/mnt/loop") and then:

mount -t iso9660 -o loop=/dev/loop0 /tmp/cdrom.iso /mnt/loop

Find your recorder

To find out where on the bus your recorder resides (you need this to use cdrecord):

cdrecord -scanbus

If you have an IDE burner and its connected to the second controller on the board, you should get a response that ends with something like:

scsibus1:
        1,0,0   100) 'PLEXTOR ' 'CD-R   PX-W5224A' '1.01' Removable CD-ROM
        1,1,0   101) *
        1,2,0   102) *
        1,3,0   103) *
        1,4,0   104) *
        1,5,0   105) *
        1,6,0   106) *
        1,7,0   107) *

The key info here is the "1,0,0" which indicates the drive location. If you've got a SATA
hard disk, that your system considers a SCSI device, your IDE burner will show up as "0,0,0".

This command does not work in CentOS/RedHat 5, and apparently other newer distributions. As of yet U haven't found any satisfactory explaination as to why.

Burn the iso

To have the drive burn your iso image (here we'll call it "cdrom.iso"):

cdrecord -v dev=ATA:1,0,0 -eject -speed=8 cdrom.iso

The ":ATA" flag lets the program know this is an ATA, not a SCSI, drive. I usually add "-eject" so I'll know when the burn is done. The "-speed" switch is optional, I use it more out of habit than anything else (slower burns are sometimes less error-prone).



Red Hat Enterprise and Xerox WorkCentres
2007-05-01T14:43:00.000-04:00
My company purchased a boatload of Xerox WorkCentres of various models some time ago and recently completed deployment to all the sales branches throughout the U.S., including the one outside Raleigh where I work. Since my primary desktop runs CentOS 4.4, it was only a matter of time before I saw the need to get at least one printer configured for my machine. Today, giving in to my inherent laziness, I decided to set up a second one that sits closer to me.

These are networked printers, of course. Instead of using the IPP protocol, which wasn't enabled by default by our deskop support team (who were only concerned with making sure the Windows 2003 Server and Windows XP desktops worked), I make my connections using HP JetDirect emulation.

I started out by using Red Hat's printconf-gui tool to create a plain vanilla "Generic Postscript" printer named appropriately for what it was, set up as a JetDirect device using port 9100. Once this was done, I needed the right .ppd file (Postscript Printer Description), a standard used by printer manufacturers.

For the WorkCentre Pro 232 that I was working with, what I needed was the latest "Printer Model Package" from Xerox's "Support and Drivers" section. In my case this was a file named PrinterPkgXPXX_2005_06_06.tar, that untarred to a directory of the same name and contained a subdirectory called "ppd". By simply copying the right .ppd, xr_WorkCentrePro232.ppd and copying it to /usr/share/cups/model/xerox, I was then able to import it using printconf-gui's "Action ... Import PPD". 

After restarting the cups daemon (printconf-gui prompts to do this), I was able to print a test document to verify it was working.

Note: I intentionally didn't provide hyperlinks to the Xerox support pages and the file discussed here, since the company's site appears to be generated out of a database, increasing the likelihood that any links du jour may not work on the reader's visit to the site -- which kind of defeats the whole purpose of a hyperlink.


Cloning a VMWare Guest on the free VMWare Server
2007-04-30T10:51:00.000-04:00
The free VMWare Server, unlike it's heavyweight cousin, VMWare Infrastructure Suite, doesn't include a facility for cloning guests. A copy guest function does exist in the nonfree VMWare Workstation, but this has been left out of all the free products. For those of us who began working with VMWare before even the fee-based products had this feature, the following simple method continues to work:
Create a new folder, named for the new copy;

Copy the files from the original guest into this folder;

Remove any .WRITELOCK files in the new folder, and rename the .vmx file for the new vm guest;

Run the following command to rename the disk folders in the new folder:

vmware-vdiskmanager -n [OLDVMNAME].vmdk [NEWVMNAME].vmdk

Edit the new .vmx file and change the value for "scsi0:0.fileName" to reflect the NEWVMNAME, you might also want to conform the value for "displayName" to match the new name;

Go out and enjoy a cup of coffee with the time you just saved.

That's it!


Waiting for centosplus
2007-04-28T13:12:00.000-04:00
The old Dell laptop has been performing very well since being upgraded to CentOS 5. It's still a pig on power consumption, or maybe it's just that I made a huge mistake in getting it with the standard instead of the hi-capacity battery. I've been waiting for release of a centosplus kernel for 5 before upgrading my workstation at home, mostly because I need FireWire (IEEE1394) support to interface with the tape side of our minicam (a Sony). Supposedly the first issue of that kernel has been completed and should be available on the mirrors any day now.
 
It's a mark of how spoiled I've become since switching to CentOS a couple of years ago. Back in the bad old days I would routinely spend hours rebuilding the stock kernel from source to get whatever additional device support I needed. Nowadays I wait for someone else to do it and just download their package. Another indicator is my irrational annoyance whenever I have to do an update on one of the Red Hat Enterprise boxes at work. With CentOS I can install a system and issue a "yum update" in relatively rapid succession. For the RHEL environment we need to first procure a subscription, which takes some time with our internal corporate bureaucracy, and then register the system after it's installed. I can buy time by downloading and mounting the latest respin disks, but even with RHEL 4.4 there are by now a staggering number of packages needed to bring a system up to date -- not the least of which is the latest tzdata covering the new DST (Daylight Savings Time) rules. RHEL 5 isn't as bad, but as of the date I'm writing this there isn't ANY commercial software certified to run on it -- leastways nothing from any of the major ISV's (Independant Software Vendors) we use (Oracle, CA, IBM, etc.).

So here I am, sitting out on the back porch typing this article in between visits to my favorite CentOS mirror.

Well, at least it's a nice warm, sunny, afternoon in North Carolina.


udevd[408]: add_to_rules: unknown key 'AT
TRS{idProduct}' Error on CentOS 5 Bootup
2007-04-21T11:22:00.000-04:00
Ever since I upgraded the one laptop to CentOS 5, I've been getting  this annoying error on bootup:

udevd[408]: add_to_rules: unknown key 'ATTRS{idProduct}'

Finally found the cause. It was kino. Specifically /etc/udev/rules.d/kino.rules, which got installed when I originally setup kino back before the CentOS 5 upgrade. Here's a related post from a Fresh RPMS mail list.

Deleting the file cleared the error.

I used kino to do video editing on my main workstation, which has the necessary firewire (IEEE 1394) port. Although the laptop isn't equipped to firewire, I like to have kino there so I can do some off line editing.


Adobe Acrobat Reader on CentOS 5
2007-04-14T21:35:00.000-04:00
CentOS 5 was released yesterday. Went over to my favorite mirror last night and used Bittorrent to download the DVD. Got working on installing it on our Dell Inspiron 1200 laptop this morning, mostly because under previous versions of RedHat Enterprise/CentOS important stuff like hibernation never worked right -- something you really need on a low end laptop like this, since even running the most agressive power saving settings under Windows you only get 2 hours on the battery.

Used the upgrade option, something I've only ever trusted Red Hat to get right. For the most part things went smoothly. I did have to reinstall ndiswrapper (allows use of Windows wireless card drivers on Linux) because of the new kernel. I also had to reconfigure VMWare for the same reason. The post-install updates were pretty extensive for a new release, but at least half the upgraded packages were for 3rd party apps I'd originally installed from RPMForge.

Surprisingly, the most aggravating bump in the road was Adobe Acrobat Reader. With CentOS 4, I'd been using the latest version (7.0.9) installed from the rpm package without incident. After installing CentOS 5 it acroread just stopped working. Reinstalling the package from tar.gz, I found that acroread returned a "expr: syntax error" ad infinitum. Googling around, I found a bunch of references to this from Fedora 6 users, but surprisingly nothing at all on the Red Hat Knowledgebase. The answer came in a series of questions and replies around a post in the Adobe user forum from Gaurav Khurana:

 A workaround to run acroread on Fedora Core 6 is to edit the file < ReaderRoot>/bin/acroread and replace the following line (line-no 644):

check_gtk_ver_and_set_lib_path "$MIN_GTK_VERSION"

with

# check_gtk_ver_and_set_lib_path "$MIN_GTK_VERSION"


That post was dated December 21, 2006.

The complete solution is to edit the acroread script by:
Adding "export GTK_IM_MODULE=xim" to the top; and

Commenting line 644 (beginning "check_gtk_ver ...")

You've got to wonder why both Adobe and RedHat have failed to publish so much as a notification since then -- let alone a patch. It's not like we won't notice eventually. I pity the poor admin that does a mass upgrade of his orgs Red Hat workstations and discovers this problem the hard way, first thing the Monday morning after.


More About Me
2007-04-06T10:28:00.000-04:00
A little more detail on who I am and where I am in the tech world.

Technology is a second career for me, by choice. Before learning how to pull DRAM or edit files with vi, I spent 12 years as a trial lawyer both in government and private practice. That experience taught me the importance of paying attention to detail, and how to learn most of what I need to know from self-study. Although I did pretty well at the bar, the work became all-consuming for me. As one of my mentors used to say, "the law is a jealous mistress". The search for a more balanced existence put me on the road that eventually led to Microsoft school, where I began learning how to be a tech professional.

For the last 7 years I've concentrated on directory services and identity management. Prior to that I worked mostly in desktop support and engineering. I have a technical blog on things LDAP at eldapo.blogspot.com, where I try to share some of what I've learned in my efforts to master the business of directory systems administration. I hope some people find it a useful resource.

In addition to some vendor certifications and my law degree, I've also done graduate work in history -- for the non-digital side of my brain.

Education

B.A., Humanities. State University of New York (1979)
J.D., Law. Rutgers University School of Law (1982)
M.A., History. Long Island University (1989)

Current Assignments

Information Systems Engineer, a Fortune 500 Company.
Morrisville, N.C.

Technical Lead on:

   * Global Directory Architecture
   * Web Applications Hosting
   * Desktop Engineering

Associate engineer on:

   * Oracle ERP
   * Netegrity SiteMinder

Areas of Interest:

   * Directory services design and maintenance
   * Enterprise applications for Open Source software
   * UNIX/Windows Integration and Interoperability

Certifications:

   * Red Hat Certified Technician
   * Microsoft Certified Systems Engineer (Expired)


'Setup cannot copy the file staxmem.dll'
2007-03-30T14:58:00.000-04:00
Living in a cross-platform world can be frustrating.

I got this error when trying to install IIS (Internet Information Server) on my Windows XP SP2 company laptop.

A quick lookup on Microsoft TechNet revealed the answer, Article ID 894351. Turns out my problem was the the local group policy database on my machine was corrupted. This was apparently collateral damage resulting from having the SP2 (Service Pack 2) update installed.

Repairing the GP database was pretty easy. Here are the steps I took:
Restart system in Safe Mode.

Open a command prompt and run

     esenutl /p c:\windows\security\database\secedit.sdb

You should get a return that ends with something like "...Integrity Check Successful". If you do, you're good.

Restart Windows into normal mode.

If repairing fails, then you need to follow the instructions in the article that describe how to rebuild the security database. This is a multi-step procedure that needs to be done in Safe Mode, so make sure you print out the article before beginning!


Oracle DB Init Script for Red Hat
2007-03-29T10:20:00.000-04:00
Here it is, taken from my old personal web site:

/etc/init.d/oracle
#!/bin/bash
#
# chkconfig: 35 95 1
# description: init script to start/stop oracle database 10g, TNS listener
#
#
# match these values to your environment:
export ORACLE_BASE=/u01/db/oracle
export ORACLE_HOME=/u01/db/oracle/product/10.2.0
export PATH=$ORACLE_HOME/bin:$PATH
export LD_LIBRARY_PATH=$ORACLE_HOME/lib:$LD_LIBRARY_PATH
export ORACLE_SID=orcl1
export ORACLE_USER=oracle

# see how we are called:
case $1 in
    start)
    echo "Starting Oracle database ..."
    su - "$ORACLE_USER" << EOO
    lsnrctl start
    sqlplus /nolog << EOS
    connect / as sysdba
    startup
EOS
EOO
    ;;

    stop)
    echo "Stopping Oracle database ..."
    su - "$ORACLE_USER" << EOO
    sqlplus /nolog << EOS
    connect / as sysdba
    shutdown
EOS
    lsnrctl stop
EOO
    ;;

    *)
    echo "Usage: $0 {start|stop}"
    ;;
esac


Remmmeber to use "chkconfig add" to register this script, and "chkconfig on" to enable it.


DST Update
2007-03-29T09:27:00.000-04:00
Mongolia has abolished Daylight Savings Time.

See the Red Hat errata update, RHEA-2007:0128-3.

There are also changes for Nunavut/Resolute, Cuba and Turkey in there.

"Daylight Savings Time Change: The Tech Full Employment Opportunity of 2007"

I wonder if this will require another gigabyte patch from Oracle.

(I wish I was joking about that last one)


Oracle Database 10g Install and Upgrade
2007-03-28T23:06:00.000-04:00
Just a few random notes on my second or third time installing and upgrading the latest Oracle Database 10g distro from Oracle (I'm currently working my way through the Oracle-approved self-study book for the OCA test, "Oracle Database 10g OCP Certification All-In-One Exam Guide").

This was all done in a CentOS 4.4 VMWare Server guest, running on CentOS 4.4 itself. Prior to beginning  "yum update" was run on the guest to make sure all the latest updates were applied. I went with a "Custom Install, during which the full X-Windows, Gnome Desktop, and Legacy Development package groups were selected during installation of the OS, to make sure the prerequisites were there for running Oracle's gui installer. You also need to check off sysstat in the System Admin group, as it is not installed by default. Use the standard "Server" install and you're going to waste alot of time installing these packages individually.

The latest download available from Oracle Technology Network is 10.2.0.1, which a couple of months ago would have been just fine for me. The DST issue changed that. The "recommended" DST patch for the database proper is for 10.2.0.3, thus requiring that the shipping version get upgraded.

So here's what I did:

Got the "Quick Installation Guide for Linux x86", and prepped my platform by making required kernel parameter changes (all via sysctl.conf and sysctl command). Also installed a couple of required packages that were not already on the machine.

Downloaded 10.2.0.1 for Linux on x86, 10201_database_linux32.zip, as well as patches. Unzipped the main file, cd to root of "database" folder and executed "./runInstaller" in X session to install database.

Note: If installing on an "unsupported" system like CentOS, you'll need to execute "./runInstaller -ignoreSysPrereqs".

Installed database. Followed the old Optimum Flexible Architecture (OFA) standard (oraInventory in /u01/db/oracle/oraInventory, ORACLE_HOME in /u01/db/oracle/product/10.2.0, ORACLE_SID orcl1, etc. -- the new standard would make it something like /u01/app/oracle/product/10.2.0/db1, I guess).

Set up oracle user environment, for me that was adding lines to export $ORACLE_BASE, $ORACLE_HOME, $ORACLE_SID, $JAVA_HOME (defined as $ORACLE_HOME/jdk), $PATH and $LD_LIBRARY_PATH to user oracle's .bash_profile, and then re-logging back in to make sure it took.

Kept listener up, stopped database (normally would stop dbconsole first, but it failed to start on initial install because of Java DST issue).

Applied OVM patch, p5865568_10201_GENERIC.zip AFTER READING THE DIRECTIONS. Then, required by the directions, ran "startup migrate" to compile in changes to the db tables. Restarted database and console (dbconsole now started OK).

Stopped console and then database. Installed patch, p5632264_10203_LINUX.zip, to bring the database up to 10.2.0.3 level. This was a BIG patch. Almost a gig. Actually created a "Disk1" folder from which I ran a new "runInstaller" command. First upgraded oraInventory to latest version, then moved on to updating all the product files.

Stop console and db. Ran Upgrade Assistant as directed by the doc. This was another interactive gui like runInstaller, took a long time to complete.

Finally applied patch p5337014_10203_LINUX.zip, to settle remaining DST issues (stop console and db before executing "opatch apply").

Restarted the db and console.

Set up init script for db and used chkconfig to enable it.


Watching RTSP Streams on Linux
2007-03-23T10:03:00.000-04:00
Real Time Streaming Protocol is an open Internet standard for streaming video programming. It is used by C-SPAN to deliver free streams of it's public service programming and is supported by both the open source Helix Community and free commercial Real Players.

The Firefox and Mozilla browsers are not always configured to play RTSP as shipped in most Linux distributions. Configuring Mozilla/Firefox to handle this protocol involves typing "about:config" in the address bar and adding a new handler directive by right-clicking on any one of the existing parameters and selecting "new --> string" and then typing "network.protocol-handler.app.rtsp". Once this is entered, the full path to the Helix or Real Player binary is entered in the next value window (e.g. "/usr/bin/realplay").



Oracle Instantclient and DBD::Oracle
2007-03-16T16:43:00.000-04:00
Note: I cleaned this up a bit from the original, mostly making sure that the path information was consistent. For awhile I used to install this in /usr/lib/oracle, but that was insane. From a "where is my third-party software" perspective /opt/oracle makes so much more sense!

This is basically a cut-and-paste from my old personal website. Had to use this today, so I thought I'd share it here. NOTE: I'm back to using the .zip files from Oracle now, after trying the rpms for a month or two. Problem is that most stuff, like PHP's OCA module and Perl's DBD::Oracle, don't compile easily with the filesystem layout Oracle chose for the rpms. Just another example of how hard it is to change a "standard" once you've let it out into the wild.

Getting all the pieces in place to use DBD::Oracle can be a real pain. Since Oracle released it's "Instant Client" this was supposed to have gotten easier, and over time, it has. The procedure set out here has been used to successfully compile and install DBD::Oracle on both Red Hat Enterprise 3 and 4 using Oracle Instant Client version 10.2.0.3 (which is the latest as of this writing).

This procedure uses the latest Makefile.PL (in DBD-Oracle-1.19) from the Pythian Group, who have taken over maintenance of DBD::Oracle from Tim Bunce.

To begin, download the Instant Client zip files for Linux from Oracle.

These are the files you'll need:
instantclient-basic-linux32-[version].zip
instantclient-sqlplus-linux32-[version].zip
instantclient-sdk-linux32-[version].zip

Extract these files into /opt/oracle. This will create a subdirectory with a name like "instantclient_10_2". The binaries and library files will be in the root, while the headers will be under instantclient_10_2/sdk/include.

Now it's time to configure the environment. Do the following:

Use ldconfig to register the libraries. As root, go into /etc/ld.so.conf and add a line with the full path to those libraries - /opt/oracle/instantclient_10_2. Next run /sbin/ldconfig. Use "/sbin/ldconfig -p" to verify the libraries are now in the current cache.

Create a file called oracle.sh in /etc/profile.d to set the global environment to include the requisite Oracle environment for each user. Enter the following lines into it:
#!/bin/bash
# Oracle environment
export ORACLE_HOME=/opt/oracle/instantclient_10_2
export TNS_ADMIN=/opt/oracle/instantclient_10_2

Log out and then back in and confirm that the enviroment has been set correctly by doing an echo $ORACLE_HOME and echo $TNS_ADMIN.

Create a symlink in PATH to sqlplus, thus:
ln -s /opt/oracle/instantclient_10_2/sqlplus /usr/bin/sqlplus

Test sqlplus against your favorite Oracle database. While all environments differ, make sure to follow the following syntax when invoking the utility (I use a tnsnames.ora file on my network, and these examples reflect that):
sqlplus [username]/[userpass]@[tnsentry]
To connect without a tnsnames file, do this:
sqlplus [username]/[userpass]@//[servername]:[port]/[servicename]

You should get connected. To verify you're actually in, issue a PS SQL command, like "SHOW ALL" to see the server environment.

Get the DBD::Oracle tarball from CPAN.

Unarchive the tarball

Execute the Makefile.PL with "perl Makefile.PL"

Do an "make" and "make install"

That's it. You're done!


Red Hat 5 Released
2007-03-15T01:09:00.000-04:00
Not Red Hat Linux 5 (which was released in 1997), but Red Hat Enterprise Linux (RHEL) 5, released today. Shortly after watching the launch webcast, I went up to Red Hat and plunked down $80 for my own personal basic RHEL 5 Desktop subscription. Took about an hour for my sub to be recognized by Red Hat Network, but I got "pending" access right away and so could immediately start downloading the isos. Had to abort after a half hour because of the crummy bandwidth into the branch office I work out of. I later continued the download when I got home, where my local cable company consistently delivers a megabits-speed connection.

What I'm really looking forward to is finally getting a chance to work with a production-ready installation of xen virtualization. Both at work and home I've used VMWare extensively to build out whole test networks on a single box. It will be interesting to see how an open source xen, integrated into RHEL, fares.


Tech Links Dump
2007-03-08T12:10:00.000-05:00
Here's my most often-used list of tech links:

LDAP

LDAP RFC's and Controls
Fedora Directory Project
phpLDAPAdmin LDAP Browser
LDAP v3 Result Codes
IETF LDAP Revision (v3) Working Group
RFC2251: LDAP Protocol v3
OpenLDAP Administrator's Guide
Perl-LDAP Home Page
Perl-LDAP Google Group
Netscape LDAP SDK for C
Netscape Java SDK for LDAP
iPlanet 5.1 Directory Server Docs
Oracle by Example: Identity Management
Oracle Identity Management (OTN Site)
Oracle Identity Management Solutions
Oracle Identity Management Resource Library
Oracle Identity Management 10g Product Doc
LDAP Browser-Editor
Virtual Identity Dialog (Mark Wilcox's Blog)
cn=Directory Manager Blog
eldapo's Blog
Robbie Allen's Scripting Page

DEVELOPMENT

W3C HTML 4.01 Specs
Cascading Style Sheets (CSS)
Dynamic Drive, DHTML Resources
Perl CPAN Archive
PHP: The Missing RPMS
PHP Manual
The Java Tutorial
SourceForge Main Page
The PHP Scalability Myth
PHP Scales
On the Security of PHP, Part I
On the Security of PHP, Part II
PHP Security, Part I
PHP Security, Part II
PHP Security Consortium
Essential PHP Security Companion Site
PHP Security Wiki
Top 7 PHP Security Blunders
Recommended PHP Reading List
Making the Case for PHP at Yahoo
The J2EE Guy Still Doesn't Get PHP
Digg PHP's Scalability and Performance
Signs You're A Crappy Programmer
Peterned, web markup, scripting, etc.

APPLICATIONS

Apache 2.0 Docs
MySQL Reference
CVS - Concurrent Versions System
OpenSSL Examples
OpenSSL PKCS#12 FAQ
OpenSSL Command Line Howto
Creating an Oracle 10g AS database manually
Oracle 10g AS Automatic Startup/Shutdown
Burleson Consulting Oracle Articles
Become a Oracle Apps DBA
Oracle DBA Tips: Oracle 10g Release 1 on CentOS
Oracle FAQ Script and Code Exchange
An Introduction to DBD::Oracle
ORACLE-BASE

SYSTEMS

Linux Documentation Project
Fedora Project
CentOS
CentOS Extras
Fresh RPMS
DAG RPM Package Repository
Red Hat Introduction to System Administration
Red Hat Knowledgebase
Optimal Use of Fonts on Linux
Sun Freeware
FreeBSD Handbook
Linux Kernel Archives
Serial ATA (SATA) on Linux
Online PDP-8 Home Page
Solaris 8 Packages by Install Type
Solaris 2.x FAQ
Gregory Gulik's Quick Linux Tips
MJM Wired ;) Resources

REFERENCE

Unicode Code Charts
ISO 8859 Character Sets
PC Keyboard Layouts
Country Codes
Language Codes
World Clock
Category 5 Cabling Tutorial


Why this blog?
2007-03-08T11:47:00.000-05:00
Because I need someplace to post stuff that doesn't belong on Eldapo, my blog about things LDAP.

I've got some static pages up on my personal site, but maintaining them is getting to be a drag. So now I'm going to try to use this blog to post what I usually put up there.

Will try to keep this pretty technical. Don't think anyone's really interested in my views on anything else.

onemoretech

And so it goes ... onemoretech is moving!

ISO Refuses to Adopt Microsoft Office Open XML

News Flash: SCO LOST

Pentagon Got Hacked by the PLA: Join the Club, Bob

Oracle 11g Insecure due to "Stupid" Developer Mistakes

doing x over telnet with RedHat

more aix annoyances: ssh -X doesn't work

from linux to aix: terminal tricks

Sun Changing Symbol to JAVA: The Fallout Begins

nvidia 6200TC on Fedora Core 6

Using a Regex to Filter a String Value

a honeypot for liars

widescreen madness: why i won't be buying a laptop this year

when tinkering pays off

Net::SSH::Perl and Remote Ops

making home movie dvds with dvdstyler

how many files in directory and below?

tech politics: Is Open Document Format "Inevitable"?

transcode for converting .avi to .mpeg

combining .avi files

recursively grep files

my first pc - the kaypro 1

strip comments from a file

remove spaces in a file

replace spaces in a file with underscores

who says perl isn't a text editor?

Phil Cam in Action

Me, my minicam and Linux

The Virtual AGC

Starplot

Building XEphem on Fedora 6

It's the Hardware, Stupid!

Script to check on an Oracle DB

Fedora 6 Tips & Tricks

x3270 configuration

wireless networking with ndiswrapper

Red Hat Summit

liberation fonts

VMware Server on Fedora Core 6

Trouble among the hats

Back to Fedora -- for Firewire!

Palm Foleo

Let's get a real database

nvidia on linux gamma correction

Eldapo Speaks: An IT Infrastructure for the Rest of Us

My Certificate Authority

favorite firefox extensions

network attached storage -- almost

ssh authorized_keys problems

retreat from 64-bit

mounting usb hard drive formatted ntfs

No X after upgrade/install of Red Hat/CentOS 5

Taking the Plunge in 64-bit Desktop Computing

webcam_server

Installing Java on RHEL with Alternatives

Burning CD's from the command-line in Linux

Red Hat Enterprise and Xerox WorkCentres

Cloning a VMWare Guest on the free VMWare Server

Waiting for centosplus

udevd[408]: add_to_rules: unknown key 'AT TRS{idProduct}' Error on CentOS 5 Bootup

Adobe Acrobat Reader on CentOS 5

More About Me

'Setup cannot copy the file staxmem.dll'

Oracle DB Init Script for Red Hat

DST Update

Oracle Database 10g Install and Upgrade

Watching RTSP Streams on Linux

Oracle Instantclient and DBD::Oracle

Red Hat 5 Released

Tech Links Dump

Why this blog?