Me: Mr. CEO, how much are we paying to lease these computers, buy the OS licenses and pay tech support to maintain them each month?

CEO: Well, about $4,000 per month.

Me: You do realize that you may as well be burning that money, right? We could be saving every dime of that.

CEO: (extremely skeptical) Oh yeah? How’s that (with a tone of, “Yep, I’ve heard all this before, but I’ll humor you.”)?

Me: Well, dump the leases, buy towers for $40 a hit, I’ll install openSUSE Linux on them, and get our proprietary Windows software running on it. What else do they need?

CEO: A calculator.

Me: Done.

Me: Oh, I can also set up and manage our connection router so that we have dynamic and static DHCP working as we need it to so the servers still work just like they do now.

CEO: You mean that we can support our entire infrastructure in-house with open-source software and save all of the lease and support money?

Me: That was my opening premise, yes.

CEO: Can we have it done by this weekend?

Me: Oh, we can also replace the entire proprietary phone system for which we are paying monthly service fees, as well. Are we leasing the phones we are using?

CEO: Wait, you’re saying we can do the same thing with our phone system?

Me: Let me check…

Me: Yes.

CEO: Well, let’s get the VP of Operations and the Operations Manager and your programmer in here, and see if this makes sense from a company-wide perspective.

A few hours later…

Everyone: So when can we start?

So yesterday, I put the very first Linux box out on the sales floor with one of the sales guys loaded with Firefox, a calculator, and our Windows software running (surprisingly stably) under wine.

The first of a company-wide movement to the marvelous world of Linux and all its benefits. With all the Linux migrations, I’m fairly excited to be doing one of my own.

Should you wish to take a stab at a free home phone line, you will need a Google Voice number, PBX in a Flash, and an extra computer (a machine that is a decade old will work perfectly). I was even going to put it on my openWRT router (thanks Steve), but decided against it.

The tutorial on how to set it up is found here: Introducing the Orgasmatron V, Google Voice Edition

A couple of things that I couldn’t find in that tutorial but are required:

• You will need to have ports 10001 to 20000 forwarded from your router to your asterisk machine. I just set my asterisk box as the DMZ machine.
• Also, edit a file called /etc/asterisk/sip_nat.conf. You will need to put your external IP address in there, along with your local subnet.

Not doing those things caused me several undesireable problems.

I used twinkle as my softphone. Since my desktop from where I am making the phone calls is on the same subnet as my asterisk machine, I used the internal ip of the PBX in a Flash box to configure twinkle.

The call quality seemed to be at least 90% or more of what a regular phone call is. Some people could not tell that I was not on a regular landline or cell phone.

Anyway, take a look at it, see what you think. Instead of using a softphone, you can also purchase sip phones that will work with your PBX in a Flash system.

As you may or may not know, openSUSE’s YaST tool has a number of modules. Well, when you open YaST, and you click on something like “Software Management”, it really just runs another command in the background, as many gui-based apps do. When you specifically click on that exact option in YaST, the command “yast2 sw_single &” is executed.

However, this must be executed as root.

Sure would be nice to put that in our quick launch bar so we can skip having to open two windows when we could just go straight to the one we want because we already know the command required to summon it.

Except that we are not logged in as privileged users. Hhmm. Is there a solution?

Apologies for the anti-climactic introduction because logic screams that if there was not a solution, I wouldn’t be writing this entry. Sorry, best I could muster this morning.

The solution is that you create a shortcut button in the panel of whatever desktop environment/windows manager you use. Add your favorite icon that means “Manage software in YaST.” As the commandline, you put in the following:

xdg-su -c "/sbin/yast2 sw_single"

Click on your shortcut button. It should prompt for the root password. Upon entering the correct password, direct access to the Software Management module is granted.

With the excellent openSUSE Build Service available, I find myself there often. Many times I am looking for more recent versions of packages than what are available from the repositories I have loaded into my machine. Once the packages are found, I usually just grab the repository that they are in and load that into YAST.

For example, let’s say we’re looking for pidgin. Using YaST or zypper, we do a search, and find that we have version 2.6.2 available to us. However, with the openSUSE Build Service, we see that 2.6.3 is available. We’ll just grab the repo for it, which is located directly above the 1-click install button. Right-click on it, select “Copy Link Location.” You have the repo in your clipboard.

Then, we can use zypper to load our repository into YaST, set it to autorefresh, and then refresh it. Then, when we search for pidgin again, 2.6.3 shows up rather than 2.6.2. It’s a quick, easy way to collect and save reliable repositories that have newer packages in them.

To add a repo, then set it to autorefresh, then refresh it takes three, semi-lengthy commands, for example:

[1049][root@laptop:~]$ zypper addrepo "http://download.opensuse.org/repositories/GNOME:/Apps/openSUSE_11.2" "Gnome Apps"

Then:

[1049][root@laptop:~]$ zypper modifyrepo -r "Gnome Apps"

Then:

[1049][root@laptop:~]$ zypper refresh "Gnome Apps"

Rather than type all that out every time, I threw a quick script together that I call ‘repoadd’ (don’t forget to run chmod +x on it to make it executable) to save me all the agony:

#!/bin/sh
# $1 is the repo, i.e. http://download.opensuse.org/repositories/GNOME:/Apps/openSUSE_11.2
# $2 is the name you wish to give it, i.e. "Gnome Apps"
zypper addrepo "$1" "$2"
zypper modifyrepo -r "$2"
zypper refresh "$2"

Now, instead of having to type that all out every time, you can just run:

[1049][root@laptop:~]$ repoadd "http://download.opensuse.org/repositories/GNOME:/Apps/openSUSE_11.2" "Gnome Apps"

Of course, 1-Click Install does essentially the same thing. I just thought I’d explore and share this different way of going through that process. You never know when those alternative ways of doing things can save your hide.

Excerpt:

“When Novell and Microsoft signed a deal to support Windows and Linux in the enterprise, it caused a furore. Three years on, the deal shows that Microsoft really does acknowledge the value of Linux in the enterprise – at least that’s the view from the OpenSUSE community.”

“Novell was the first company to get Microsoft to acknowledge Linux as a contender in the market – and the effect of that has been under-rated,” says Brockmeier. “Do you remember the way Microsoft used to talk about Linux? In that dismissive fashion?”

“Once you get to the point where Microsoft feels the need to deliver Linux to its customers, you have a huge tacit acknowledgement that Linux is suitable for the enterprise,” he says. “That’s an enormous thing that I don’t think Novell has gotten enough credit for.”

Read the rest of “Microsoft ‘Has Acknowledged The Enterprise Role Of Linux’“

Any reactions to this article? I mean the world hasn’t exploded yet. However, Microsoft does have a reputation which makes many people not trust them or their motives.

What do you all think after reading that article?

Excerpt:

“The battle between Linux and Windows will most likely rage on for years to come. I can foresee that even when all things migrate to the cloud, users in both camps will still be screaming the virtues of their favorite operating system. And, of course, I will be one of those campers (and I can bet you know just which camp I’ll be in). But being in that camp does not preclude me from seeing the benefits and strengths of the Windows operating system.”

1. Compiz
2. Multi-user
3. Log files
4. Centralized application installation
5. Cron
6. Regular release cycle
7. Root user
8. Pricing
9. Installed applications
10. Hardware detection

Read all of “10 Linux features Windows should have by default“

Inevitably, there will be what we call ’showstopper’ bugs in distribution releases. When this happens, in the vast majority of cases, those responsible for the distro get fixes out immediately. There has been some complaints lately about why Ubuntu should take a closer look at their quick release schedule. Take a look at these articles: “Early adopters bloodied by Ubuntu’s Karmic Koala” and “‘Ubuntu Needs a Longer Release Schedule!’” Whoa, now. Not pickin’ on Ubuntu. Fedora had one in its 12 release in November, as well: “Unpriviledged users could install packages.” Not good. OpenSUSE isn’t immune either. In the release of 10.1, the package manager was horribly broken.

Seems like we could tolerate such ’showstopper’ bugs once in awhile. But to have this many complaints about excessively-problematic releases of one particular distribution release after release seems a little off to me:

• Is Ubuntu broken?
• Tech-no-media blogger asks, ‘Is Ubuntu broken?’
• How to Fix broken Ubuntu Feisty Fawn
• Idea #15033: Don’t release 9.04 with broken major-hardware support
• Hey Ubuntu, Stop Making Linux Look Bad
• Advice Against Upgrading Ubuntu 9.04 to 9.10

Seems like I’m not being objective here, doesn’t it? Maybe I’m trying to get people not to use Ubuntu, or give Ubuntu a pounding. Nope, merely observing numerical data.

What data?

First, let me explain something: An LTS release is generally accepted to mean “a fairly rock-solid release.” The nonLTS releases are interim releases for those who want bleeding edge. By definition, they should have more bugs in them.

Secondly, these numbers might be taken with a grain of salt, as they did come from a support forum. How many people log into a support forum to say that everything worked perfectly? Probably not as many people as had problems.

With that said, let’s look at the numbers:

Make an objective judgment of that for yourself. The LTS release had at least a 30% failure rate. Nearly the same failure rate as the nonLTS releases. The flawless upgrades and installs were nearly always lower than the number of seriously problematic installs/upgrades. Well, weren’t they? Where did these numbers come from? this spreadsheet, to which ubuntuforums.org linked.

One or two problematic distribution releases is forgivable. But an apparent failure rate of 1/3 on every release?

Mr. Shuttleworth… bro… ease up a little. Implement some improved testing or quality assurance policies or something. You have an incredible user base. Every time you release, you are seemingly causing measurable aggravation for about a third of your users. Each person that experiences a failed Ubuntu install/upgrade incorrectly attributes the problems to Linux in general. Try and help the Linux community out — not by sheer numbers, but by quality, polished installs and upgrades. Spread the joy. With all your resources, surely you can make some progress here.

While I applaud Canonical’s success in helping Linux become widespread, they also seem to be giving Linux a black eye amongst would-be Linux users.

And please, if you are one of the third that has a marvelous experience with Ubuntu, don’t shoot the messenger. I’m merely sharing data.

Excerpt:

In this post I will collect all commands which SHOULD NEVER be executed in Linux. Any of them will cause data loss or corruption, can freeze or hang up running system.

NEVER RUN THESE COMMANDS IN LINUX BOX CLI!

Even if somebody advises you in forum/im to do it.

1. Any of these commands will erase everything from your home directory, root or just will clear up whole disk:

• sudo rm -rf /
• rm -rf .*
• dd if=/dev/zero of=/dev/sda
• mkfs.ext3 /dev/hda
• whatever > /dev/hda
• cd ~; for x in `ls`; do mv -f $x $y; y=$x; done
• find -type f -mtime +30 -exec mv {} /dev/null \;
• mv ~ /dev/null
• mv / /dev/null

Read the rest of the “13 Linux lethal commands.”

“I am a home grown American citizen, 53, registered Democrat all my life. Before the last presidential election I registered as a Republican because I no longer felt the Democratic Party represents my views or works to pursue issues important to me. Now I no longer feel the Republican Party represents my views or works to pursue issues important to me. The fact is I no longer feel any political party or representative in Washington represents my views or works to pursue the issues important to me. Instead, we are burdened with Congressional Dukes and Duchesses who think they know better than the citizens they are supposed to represent.
There must be someone. Please tell me who you are. Please stand up and tell me that you are there and that you’re willing to fight for our Constitution as it was written. Please stand up now.
You might ask yourself what my views and issues are that I would feel so horribly disenfranchised by both major political parties. What kind of nut-job am I? Well, these briefly are the views and issues for which I seek representation:
One, illegal immigration. I want you to stop coddling illegal immigrants and secure our borders. Close the underground tunnels. Stop the violence and the trafficking in drugs and people. No amnesty, not again. Been there, done that, no resolution. P.S., I’m not a racist. This is not to be confused with legal immigration.
Two, the STIMULUS bill. I want it repealed and I want no further funding supplied to it. We told you No, but you did it anyway. I want the remaining unfunded 95% repealed. Freeze, repeal.
Three: Czars. I want the circumvention of our constitutional checks and balances stopped immediately. Fire the czars. No more czars. Government officials answer to the process, not to the president. Stop trampling on our Constitution, and honor it.
Four, cap and trade. The debate on global warming is not over. There are many conflicting opinions and it is too soon for this radical legislation. Quit throwing our nation into politically-correct quicksand.
Five, universal healthcare. I will not be rushed into another expensive decision that will burden me, my children, and grandchildren. Don’t you dare try to pass this in the middle of the night without even reading it. Slow down! Fix only what is broken — we have the best health care system in the world — and test any new program in one or two states first.
Six, growing government control. I want states rights and sovereignty fully restored. I want less government in my life, not more. More is not better! Shrink it down. Mind your own business. You have enough to take care of with your real [Constitutional] obligations. Why don’t you start there.
Seven, ACORN. I do not want ACORN and its affiliates in charge of our 2010 census. I want them investigated. I also do not want mandatory escrow fees contributed to them every time on every real estate deal that closes — how did they pull that one off? Stop the funding to ACORN and its affiliates pending impartial audits and investigations. I do not trust them with taking the census with our taxpayer money. I don’t trust them with any of our taxpayer money. Face up to the allegations against them and get it resolved before taxpayers get any more involved with them. If it walks like a duck and talks like a duck, hello. Stop protecting your political buddies. You work for us, the people. Investigate.
Eight, redistribution of wealth. No, no, no. I work for my money. It is mine. I have always worked for people with more money than I have because they gave me jobs — and that is the only redistribution of wealth that I will support. I never got a job from a poor person! Why do you want me to hate my employers? And what do you have against shareholders making a profit?
Nine, charitable contributions. Although I never got a job from a poor person, I have helped many in need. Charity belongs in our local communities, where we know our needs best and can use our local talent and our local resources. Butt out, please. We want to do it ourselves.
Ten, corporate bailouts. Knock it off. Every company must sink or swim like the rest of us. If there are hard times ahead, we’ll be better off just getting into it and letting the strong survive. Quick and painful. (Have you ever ripped off a Band-Aid?) We will pull together. Great things happen in America under great hardship. Give us the chance to innovate. We cannot disappoint you more than you have disappointed us.
Eleven, transparency and accountability. How about it? No, really, how about it? Let’s have it. Let’s say we give the buzzwords a rest and have some straight honest talk. Please stop trying to manipulate and appease me with clever wording. I am not the idiot you obviously take me for. Stop sneaking around and meeting in back rooms making deals with your friends. It will only be a prelude to your criminal investigation. Stop hiding things from me.
Twelve, unprecedented quick spending. Stop it now. Take a breath. Listen to the people. Slow down and get some input from nonpoliticians and experts on the subject. Stop making everything an emergency. Stop speed-reading our bills into law. I am not an activist. I am not a community organizer. Nor am I a terrorist, a militant or a violent person. I am a parent and a grandparent. I work. I’m busy. I am busy, and I am tired. I thought we elected competent people to take care of the business of government so that we could work, raise our families, pay our bills, have a little recreation, complain about taxes, endure our hardships, pursue our personal goals, cut our lawn, wash our cars on the weekends and be responsible contributing members of society and teach our children to be the same all while living in the home of the free and land of the brave.
I entrusted you with upholding the Constitution. I believed in the checks and balances to keep from getting far off course. What happened? You are very far off course. Do you really think I find humor in the hiring of a speed reader to unintelligently ramble all through a bill that you signed into law without knowing what it contained? I do not. It is a mockery of the responsibility I have entrusted to you. It is a slap in the face. I am not laughing at your arrogance. Why is it that I feel as if you would not trust me to make a single decision about my own life and how I would live it but you should expect that I should trust you with the debt that you have laid on all of us and our children. We did not want the TARP bill. We said no. We would repeal it if we could. I am sure that we still cannot. There is needless urgency and recklessness in all of your recent spending of our tax dollars.
From my perspective, it seems that all of you have gone insane. I also know that I am far from alone in these feelings. Do you honestly feel that your current pursuits have merit to patriotic Americans? We want it to stop. We want to put the brakes on everything that is being rushed by us and forced upon us. We want our voice back. You have forced us to put our lives on hold to straighten out the mess that you are making. We will have to give up our vacations, our time spent with our children, any relaxation time we may have had and money we cannot afford to spend on bringing our concerns to Washington . Our president often knows all the right buzzwords like unsustainable. Well, no kidding. How many tens of thousands of dollars did the focus group cost to come up with that word? We don’t want your overpriced words. Stop treating us like we’re morons.
We want all of you to stop focusing on your reelection and do the job we want done, not the job you want done or the job your party wants done. You work for us and at this rate I guarantee you not for long because we are coming. We will be heard and we will be represented.. You think we’re so busy with our lives that we will never come for you? We are the formerly silent majority, all of us who quietly work, pay taxes, obey the law, vote, save money, keep our noses to the grindstone… and we are now looking at you.
You have awakened us, the patriotic freedom spirit so strong and so powerful that it had been sleeping too long. You have pushed us too far. Our numbers are great. They may surprise you. For every one of us who will be there, there will be hundreds more that could not come. Unlike you, we have their trust. We will represent them honestly, rest assured. They will be at the polls on voting day to usher you out of office.
We have canceled vacations. We will use our last few dollars saved. We will find the representation among us and a grassroots campaign will flourish. We didn’t ask for this fight. But the gloves are coming off. We do not come in violence, but we are angry. You will represent us or you will be replaced with someone who will. There are candidates among us who will rise like a Phoenix from the ashes that you have made of our constitution.
Democrat, Republican, independent, libertarian. Understand this. We don’t care. Political parties are meaningless to us. Patriotic Americans are willing to do right by us and our Constitution, and that is all that matters to us now. We are going to fire all of you who abuse power and seek more. It is not your power. It is ours and we want it back. We entrusted you with it and you abused it. You are dishonorable. You are dishonest. As Americans we are ashamed of you. You have brought shame to us. If you are not representing the wants and needs of your constituency loudly and consistently, in spite of the objections of your party, you will be fired. Did you hear? We no longer care about your political parties. You need to be loyal to us, not to them.. Because we will get you fired and they will not save you.
If you do or can represent me, my issues, my views, please stand up. Make your identity known. You need to make some noise about it. Speak up. I need to know who you are. If you do not speak up, you will be herded out with the rest of the sheep and we will replace the whole damn congress if need be one by one. We are coming. Are we coming for you? Who do you represent? What do you represent? Listen. Because we are coming. We the people are coming.”

Maybe this has nothing to do with Linux. In some way, down the road, eventually, It may. Nonetheless, I fully love it.

Not original, but classic, nonetheless

1) No known species of reindeer can fly, but there are 300,000 species of organisms yet to be classified, and while most of these are insects and germs, this does not completely rule out flying reindeer which only Santa has ever seen.

2) There are 2 billion children (defined as persons under 18) in the world; However, since Santa doesn’t appear to handle Muslim, Hindu, Jewish, or Buddhist children, that reduces the workload down to 15% of the original total – 378 million according to the Population Reference Bureau. At an average census rate of 3.5 children per household, that’s only 91.8 million homes. One presumes that there is at least one good child in each.

3) Santa has 31 hours of Christmas to work with, thanks to the different time zones and the rotation of the earth, assuming he travels east to west. This works out to 822.6 visits per second. That is to say that for each Christian household with good children, Santa has 1/1000th of a second to park, hop out of the sleigh, jump down the chiminey, fill the stockings, distribute the remaining presents under the tree, eat whatever snacks have been left, get back up the chiminey, get back into the sleigh, and move on to the next house. Assuming that each of these 91.8 million stops are evenly distributed around the earth (which we know to be false but will accept for the purpose of these calculations), we are talking about .78 miles per household, a total trip of 75.5 million miles, not counting stops to do what most of us must do at least once every 31 hours, plus eating, etc. This means that Santa’s sleigh is moving at 650 miles per second, 3000 times the speed of sound. For purposes of comparison, the fastest man-made vehicle, the Ulysses space probe, moves at a poky 27.4 miles per second. A conventional reindeer can run 15 miles per hour at the most.

4) The payload on the sleigh add another interesting element. Assuming that each child gets nothing more than a medium-size set of Lego building blocks about two pounds), the sleigh is carrying 321,300 tons, not counting Santa, who is invariably described as overweight. On land, conventional reindeer can pull no more than 300 pounds. Even granting that flying reindeer exist (see point 1), can fly very quickly (see point 2), and can pull ten times the normal amount, we cannot do the job with eight, or even nine, reindeer. We would need 214,200 reindeer. This increases the payload – not counting the weight of the sleigh – to 353,430 tons. Again, for comparision, this is four times the weight of the Queen Elizabeth II (Queen Elizabeth II the ship that is).

5) 353,000 tons travelling at 650 miles per second creates enormous air resistance. This would heat the reindeer up in the same fashion as a spacecraft re-entering the earth’s atmosphere. The lead pair of reindeer would absorb 14.3 quintillion joules of energy. Per second. Each. In short, they would burst into flame almost instantaneously, exposing the reindeer behind them, and creating deafening sonic booms in their wake. The entire reindeer team would be vaporized within .00426 seconds. Santa, meanwhile, would be subjected to forces 17,500 times greater than normal gravity. A 250-pound Santa (which seems slim) would be pinned to the back of his sleigh by 4,315,015 pounds of force.

In conclusion, if Santa ever did deliver presents on Christmas Eve, he’s dead now.

However, in the world of server administration, paranoia is an asset. How else could someone get in? How can I prevent that? How can I be notified?

One magnificent contribution to the security of Linux servers the world over is called fail2ban. Why should you care?

From the Fail2ban main page:

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

So basically, it gives the finger to those mean people who are trying to brute-force your ssh server. And it blocks them at the packet level with iptables. No iptables knowledge necessary. (Though if you want a quickie, take a look at this short “Iptables for Linux” intro).

For openSUSE users, check to see if you have it available using zypper:

[1049][root@laptop:~]$ zypper search fail2ban

If you find it, use zypper install fail2ban to get it on your box.

If you have trouble getting it installed, follow the seriously excellent advice on the fail2ban download page.

When you get it installed, as root, edit your /etc/fail2ban/jail.conf file.

Put your ip addresses in the ignoreip list so you don’t lock yourself out.

bantime is in seconds. 1 hour is 3,600 seconds. 24 hours is 86400. I put in at least 24 hours. Do what works for you.

maxretry is how many tries a user gets before they’re blocked for bantime seconds. 3 to 5 chances seems more than generous.

Now to set up the notification.

In the same file, look for the section called [ssh-iptables]. Change this section so it looks like this:

[ssh-iptables]

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=notrealemail@suseblog.com, sender=fail2ban@suseblog.com]
logpath  = /var/log/messages
maxretry = 3

If you don’t want the ‘whois’ info, take out the ‘-whois’ from the sendmail part. Change the dest email to your own, and set the sender to whatever you want. Maxretry will override the default that you set further up. In logpath, put in the system log, or wherever your sshd logs stuff. Mine happens to be what you see there.

When it’s set up as you like, save and quit.

Now, fire that bad fool up:

[1607][root@mail:/etc/fail2ban]$ fail2ban-client start
2009-11-27 16:07:46,554 fail2ban.server : INFO   Starting Fail2ban v0.8.4
2009-11-27 16:07:46,555 fail2ban.server : INFO   Starting in daemon mode
[1607][root@mail:/etc/fail2ban]$

To make it run when the machine restarts, use chkconfig:

[1607][root@mail:/etc/fail2ban]$ chkconfig -a fail2ban
fail2ban                  0:off  1:off  2:off  3:on   4:off  5:on   6:off
[1610][root@mail:/etc/fail2ban]$ 

Within at least a few hours, you should get notifications. Or, you can have someone try and brute force your box and see if their IP gets banned.

If you read through jail.conf, you’ll see that fail2ban can do loads more than I’ve covered here. But if you want a little more armor on ssh, your biggest target, slap fail2ban on your box.

A simple, clean Linux wallpaper to let the world know, but without shouting.

 

If you’d like to see more really nice Linux Wallpapers, take a look at my Wallpaper gallery.

Here is a really cool wallpaper to help you remember CLI commands and what they do. Nice and useful for those times where your brain fails you.