How To Document

Howto setup your free domain name in Blogger - Part 2

2010-06-21T08:25:00.000+08:00

Last time I posted a tutorial about to setup your-free-domain.co.cc, if you don't have any of this free domain name account, you can get it by using this search form to find out which name you like, after that proceed to registering your new account.

This domain is free to use for personal purpose but they will charge you for business at minimum price at $3 per domain name, but if you make a donation to them about $5, you can have around 100 domain name, normal account will get about 4 domain only.

After completing How to setup your free domain name in Blogger - Part 1 process, to make your free domain working with Blogger all you need to do now is login to your Blogger account and start doing the next procedure.

If you feel uncomfortable with image size, you can maximize it by click the maximize button located on the top left corner of the images .

Wokeyy.. let's do it... :P

Step 01
At your Dashboard click at "Setting" link on your Blog.

Step 02
At the navigation menu "Setting" tab, click the sub menu "Publishing".

Step 03
Then you will see the "Custom Domain" link, click on it.

Step 04
Then you will see the "Switch to advanced settings", for more infos, if you don't have any domain yet, you can purchase it through Blogger.

Step 05
Key in your domain name in the text box, remember that you should include the "www" subdomain before your top level domain name, otherwise Blogger will reject your request if you put naked domain name e.g. kitablinux.co.cc. By the way if you like to use a different subdomain like blog.kitablinux.co.cc, you can do it by adding up first the CNAME at your co.cc domain hosting.

After that key in the "Word Verification" text and click "SAVE SETTING" button.

Step 06
After doing all the above successfully, now you need to redirect your domain name, click the checkbox to redirect your domain, but please make sure first that you already Create 'A' NAME records for your naked domain as I did mention in the Part 1 of this tutorial, if not you should check for it first or your redirection won't work at all.

Enter your "Word Verification" in the textbox and click SAVE SETTING button to proceed, after completing all the steps above now try to view your domain either using full web address with subdomain e.g. "http://www.kitablinux.co.cc" or naked domain e.g. "http://kitablinux.co.cc".

Related Article : How to setup your free domain name in Blogger - Part 1

p/s: currently I am working with another tutorial about setting a domain to use with google apps(mail/sites/blogger)+web hosting, yaa dude you can use one single domain name for multipurpose, don't waste it, make fortune or wheel of fortune.. weeee...... chow cinchau....

Linksys Power Over Ethernet Adapter Injector

2010-05-28T05:31:00.002+08:00

This is a survival guide to save your "buck" if you had a same problem like me in dealing with broken UTP cable on Linksys Power Over Ethernet Adapter Injector and beside you dont have any other POE appliances such as manageable switch to providing power supply over ethernet for your Linksys WAP54GPE Acess Point.

My actual problem is :

the UTP cable on POE Adapter is not working to transmit data via it own UTP cable, to buy a new one it cost about $25-$60 buck(RM80 - RM200), but why spending when you can still use the POE Adapter as power supply, except for the broken UTP cable on the POE Adapter.
the current UTP installed with Linksys WAP54GPE with RJ45 PCB Socket attached on it is not working too.

the power is there but not the network connection

My Solution :
Splitting 1 UTP cable into POE connector and networking cable. At the first end of the UTP cable clamped as normal straight cable, and the second end we split it one as data cable and the other as power supply cable. So pins 1,2,3 and 6 will be connected to the switch.

See the pins out diagram

The Table

First RJ45 Pin #	Wire Color	100Base-TX Signal	2nd and 3rd RJ45 Pin #	Wire Color	100Base-TX Signal
1	White/Orange	Transmit+	1 (2nd RJ45)	White/Green	Transmit+
2	Orange	Transmit-	2 (2nd RJ45)	Green	Transmit-
3	White/Green	Receive+	3 (2nd RJ45)	White/Orange	Receive+
4	Blue	Unused	6 (2nd RJ45)	Blue	Receive-
5	White/Blue	Unused	4 (3rd RJ45)	White/Blue	BI_D3+**
6	Green	Receive-	5 (3rd RJ45)	Green	BI_D3-**
7	White/Brown	Unused	7 (3rd RJ45)	White/Brown	BI_D4+**
8	Brown	Unused	8 (3rd RJ45)	Brown	BI_D4-**

like this one

We see that the TX (transmitter) pins are connected to the corresponding RX (receiver) pins, plus to plus and minus to minus. You can also see that both the blue and brown wire pairs on pins 4, 5, 7, and 8 are not used in either standard, but actually it was used as power transmiter between the POE Adapter and WAP54GPE Access Point.

What you may not realize is that, these same pins 4, 5, 7, and 8 can be used as data or network cable as well if we going to split one UTP cable to be connected to two NIC on the same computer system such as linux pc based router/firewall, so for pins 4,5,7 and 8 are used as power supply pins.

And the result

Now the LAN connection is ON

WAP54GPE is "ON THE AIR"
hehe.. now I can browse the internet using my Sony Ericsson G705 again =P

PS3MAGIC

2010-01-28T05:01:00.002+08:00

To people who want to install Linux on PS3 but can't get started..

Everywhere People Are Raving About This Amazing Product, Over 143,532 People Have Already Installed LINUX On Their PS3 Using PS3Magic - Now You Can Too..

Take all the frustration out of your time and install Linux or Windows in your PS3 quickly and easily with this Brand New Software Guide - PS3Magic! Install YellowDog or Ubuntu Linux on Your PS3 Effortlessly even If you Have No Technical Know-How about the PS3

PlayStation3 - The Most Powerful Gaming Console in the Planet

Generally Gaming consoles are designed so that foreign systems can't run on them, but PS3 goes in the total opposite direction, allowing an experienced Linux user to personalize their system. Most gaming systems are "locked" so that other systems can't be run, so PS3 is unconventional in allowing this.

What's really cool about the Playstation 3 is that - it's the same processor used in some of the high end IBM systems. That means you can use the PS3 as a Fun, Game Playing console as well as the front end of super computing systems for larger performance like ,Game development, Internet programs, Open Office, Movies and other type of functionality we have in our Desktops.The only thing you can't do on the PS3 is run accelerated graphics.

Benefits Of Using Linux Operating System on PS3

PS3 comes with it's own operating system that enables you to surf through it's interface and play games on your PS3. In addition to the games you can also run an entire Linux Operating system.

Linux operating system will allow you to play Movies, MP3, PC applications, development tools, Internet programs, web browsers - most applications that are found in usual Desktop PCs.

Use your Play Station like a PC, with a keyboard and mouse. Not all PC programs will run on the PS3
Run your own operating system. This is a boon to those who want to personalize their system
Run Office suites - like Open Office or Microsoft Office
Run MAME and other kinds of emulators. This means you can play all your favorite games from yesteryear on your brand new shiny Play Station 3 - like SNES, Sega.
Play different types of media, such as DVDs, ROMs and CDs . Running Linux, you can watch movies or listen to music on your PS3
Never have an Unplayable file again

Use the internet with Advanced web browsers like Firefox, Opera, Internet Explorer

Enjoy over 2000 Software applications to make your life as easy as Desktop PC

Install Windows through Emulators

Connect to network shares. This feature allows you to save and retrieve files on another server, thus saving your memory

Which Linux is Best for PS3?

There are six Linux operating systems that are compatible with the PS3, but YellowDog Linux was specially built for the PS3 and it's the most compatible Linux Operating system for the PS3. The other Linux OS like Ubuntu, Fodera, Kubuntu can also be installed but my personal recommendation is YellowDog and Ubuntu.

Yellow Dog Linux is specially customized for the PS3 and was released for only PS3 users. YDL has over 2200 programs and accessories that will give you the ultimate experience of a Desktop PC.

Ubuntu is an operating system built by a worldwide team of expert developers. It contains all the applications you need: a web browser, office suite, media apps, instant messaging and much more.

Fedora is not a good option for the PS3 right now as it doesn't have the required optimization and runs slower than Ubuntu and YDl.

Edubuntu - is packaged for education so that is the concentration I guess ( I haven't tried it so I cant offer any useful comments on that)

Kubuntu - uses KDE which looks closer to windows in terms of default color and menu apps. It also offers more options to configure your programs and Desktop.

Xubuntu uses XFCE which is good for older computers, computers with limited resources in terms of ram or storage but is also good on new computer if you want a lean system.

The best Linux would be YellowDog and Ubuntu.

Yellow Dog Linux(YDL 6.2) - With the latest Yellow dog 6.2 which is 100% bug free and compatible with the PS3, this is the best choice of Linux. YellowDog looks slightly geeky though but it gives you complete experience of operating a Home PC. You can use your mouse, Keyword, external Hard drive and do a whole lot more with YDL.

YellowDog offers over 2000 applications to make life easier - the most any Linux offers at the moment.Yellowdog Linux was developed specially for the PS3 Operating system to carry out most PC tasks.

PS3 can be a movie player, MP3 player, watch Home videos. Yellow dog over 2000 applications - everything from Web browsers, Open office, DVD players, Chat, Microsoft Office compatible suite, Email clients, Games practically everything you need on a Desktop PC... Games, Graphics, Office suites, Accessories, Internet Programs, Programming tools.

Ubuntu Linux 8.10 - Ubuntu on the other hand is easier to use with a much better feel and look but it is not as optimized for the PS3 as YellowDog. Though major applications like Movie players, MP3, browsers are available in Ubuntu but it lacks the Development and programming tools which of course many of us don't need. If you are more keen on having a graphically appealing Operating System then Ubuntu is the way to go. PS3Magic will help you install Yellowdog and Ubuntu both at the same time - you can switch operating system while powering on your PS3 and experience both if needed.

What PS3Magic Does?

If you are still struggling to install Linux your PS3 and feel deceived by all the How-To guides and Softwares available on the net - well all I can say is this It's Not Your Fault. I know how confusing they all are. On this page you are going to discover how to choose the right Linux for your PS3 and how to install it without all the technical hassles.
PS3Magic will do just that.

	PS3Magic is an easy to use software guide that takes away all the guesswork and helps you to install Linux in your PS3 effortlessly. With PS3Magic you can install Yellowdog Linux(up to latest 6.2) and also Ubuntu Linux.
	Doing so allows you to Play Movies, Music and most other type of multimedia file formats which your PS3 usually doesn't support. Never have an unplayable file again!
	Run Windows with Yellow Dog Linux or Ubuntu Linux - according to your preference. PS3Magic has also been updated to install Windows. If you are not familiar with Linux Operating system, then our product will also help you install and Run Windows in your PS3 seamlessly.
	Receive free lifetime updates and support with the latest features available for your PS3.

"Run PC applications like Office Suites, Web Browsers, Instant Messengers, Email Clients, Accessories, Internet Programs and Development Tools Effortlessly on Your PS3!"

NO Technical Knowledge required

NO Hardware Modification Required

NO Voiding Your Original Warranty

NO Safety Threat

All Major Credit Cards, Paypal and Online Checks Accepted!
Order 24 Hours a Day, 7 Days a Week - Even If It's 3 in the Morning!
Instant Access - Instant

Order with confidence, you are covered with 60 Moneyback Guarantee

See what some of our customers are saying..

"PS3Magic is Quick, Easy and Simply Superb!!! Two thumbs up" Jim F, NZ

"Revolutionary software - takes away all the fuss of going through the troublesome installation process. Highly recommended to people like me - who is not so tech savvy! Great Job" - John Andrews, CA

"Off the edge impressive tool, solves a lot of problem at one go. 10 on 10" Jim F, UK

"Hi Guys, just wanted to let you that I found PS3Magic really useful. It's worth the purchase as it saved us a lot of time in sending away our console for Linux modification. Thanks - David Frew

"Simply Brilliant!! Would let my readers on my blog know about your software soon" - Ronnie Bussey

"Beat PS3 at their own game - super easy way to install Linux in your PS3 - I would recommend PS3Magic to anyone trying to install Linux in their console" - Marry Evans

"Well I have installed windows successfully with PS3Magic - I have been surfing the net on my television these days lol - PS3Magic is recommended to anyone trying to use their PS3 to it's full potential" - Adam Stone

"Thanks Lee, PS3Magic is worth it. Initially I was reluctant to purchase PS3Magic and thought that I could do it myself with free tools available on he net. repeatedly failing to do so - I decided to try PS3Magic! To my surprise PS3magic was brilliant in installing Linux and unlocking all the other features of my PS3! "
Thanks and regards - Ben Nanev

"I must say PS3Magic is a amazing little product which makes Linux Installation a breeze. I have successfully installed Linux in less than a hour after downloading PS3Magic" - John Silburn

Most frequently asked questions

1. How Does PS3Magic Work ?

A : Our reference is a complete solution, it comes with a guide plus Softwares in order to make the process a cake walk. All you have to do is download PS3Magic and follow the simple step by step instructions.

All secured download links are provided in a pdf document so that you can just read through the guide and have your PS3 ready in no time just by clicking on the links provided within. The full process takes about 45 minutes to 2 Hours depending on your internet download speed.

2. Why do I need PS3Magic ?

A : PS3Magic is a revolutionary software guide which helps you install Linux and Windows easily without the usual lengthy complicated installation procedures.

3. Payment and Delivery ?

A : PS3Magic is a downloadable product you will get access to the software, guide and the bonus pack instantly after successful payment. You can pay by Credit card or by your PayPal account. We use PayPal as our payment processor as they have a reputable buyer protection policy and secure SSL server.

4. Will PS3Magic void my original warranty ?

A : This is the main purpose of using PS3Magic as your Linux Installer as this is the only method by which your warranty remains intact.

5. Can I use PS3Magic to play downloaded games, videos and music from the internet ?

A : Yes, of course! This is the whole purpose of installing the Linux Operating System on your PS3.

6. Can Linux be removed later?

A : Yes, Linux can easily and safely be removed from your console. You can uninstall everything that you would be installing from our guides to restore your PS3 back to its original state.

7. Will PS3Magic hamper my usual PS3 gaming experience?

A : No, you will still be able to use your PS3 as usual along with the added advantages of having an OS to use various other features.

8. Is PS3Magic easy to use?

A : PS3Magic is definitely the easiest solution available to you. It makes the entire process an One-Click process and gets your desired OS installed in a breeze.

The guide is written in easy to follow English, if for any reason you can't understand our support is always there to help you.

9. Can I update my PS3 with PS3Magic installed ?

A : Yes you can, Sony updates will not affect PS3Magic.

10. How many PS3s can I use PS3Magic on?

A : Unlimited. There is no restriction, you can use Ps3Magic on unlimited consoles, infact once you have all the minimum requirements in handy it will be much faster on other consoles.

10. Do you guarantee that PS3Magic will work on my PS3 ?

A : Yes absolutely. We are so confident that you will be satisfied with PS3Magic that we are offering a 30 Day No Questions asked 100% Moneyback Guarantee. That means, if by any chance you are not completely happy with your purchase simply email us and we would happily reverse your payment.

11. What if my PS3 is located in Europe or Japan?

A : PS3Magic will work for any PS3 through out the world. There are no Limitations to geographic production.

12. What if my PS3 is imported or relocated from another country?

A : PS3Magic can be installed in any relocated or Imported PS3 console irrespective of the country manufactured or being played in.

With our complete PS3 solution you can instantly install Linux ( Ubuntu or Yellow Dog) and also Windows in a snap. You can run most Desktop PC applications after installing PS3Magic - allowing you to play more types of games, music, movies and other software applications to make your PS3 far more entertaining and productive.

Remember with our complete PS3 unlock solution, you are also covered with our Iron Clad 60 Day Moneyback guarantee. If you are not completely thrilled with PS3Magic, simply let us know and we will refund your entire payment immediately. You have nothing to lose and everything to gain as the risk is completely on us.

PS : I don't want to put any pressure on you but on a later date you'll have to pay $57 only for the PS3Magic software without any Bonus! Last time we had launched PS3Magic, 15,000 copies were sold out in less than two months and we had to shut down. This time we're limiting to only 3000 copies before we take it down for ever. Hurry and Act Now and experience an all new PS3 within the next 1 hour.

This site and the products and services offered on this site are not associated, affiliated, endorsed, or sponsored by Sony, nor have they been reviewed tested or certified by Sony.

How to setup your free domain name in Blogger - Part 2

2010-01-16T09:41:00.001+08:00

Step 02
At the navigation menu "Setting" tab, click the sub menu "Publishing".

Step 03
Then you will see the "Custom Domain" link, click on it.

Step 04
Then you will see the "Switch to advanced settings", for more infos, if you don't have any domain yet, you can purchase it through Blogger.

After that key in the "Word Verification" text and click "SAVE SETTING" button.

Enter your "Word Verification" in the textbox and click SAVE SETTING button to proceed, after completing all the steps above now try to view your domain either using full web address with subdomain e.g. "http://www.kitablinux.co.cc" or naked domain e.g. "http://kitablinux.co.cc".

Source : http://www.keghahpalo.co.cc/2009/12/howto-setup-your-free-domain-name-in.html

Related Article : How to setup your free domain name in Blogger - Part 1

p/s: currently I am working with another tutorial about setting a domain to use with google apps(mail/sites/blogger)+web hosting, yaa dude you can use one single domain name for multipurpose, don't waste it, make fortune or wheel of fortune.. weeee...... chow cinchau....

Clonezilla HOWTO: Quick and Dirty Setup

2010-01-01T06:07:00.000+08:00

Although I am quite familiar with DRBL, since I was running an experiment about Linux Diskess Gaming Server and Client last year at local exhibition (you can read about it here : http://www.osscc.org/2009/12/diskless-linux-gaming-terminal-using.html ), but this tutorial down here is quite easy and simple to follow it. So enjoy your reading.

Since I wrote the post ‘Clonezilla‘ in January, our blog has been getting a lot of hits, apparently from people looking for advice on how to set up Clonezilla. This is understandable, since DRBL (of which Clonezilla is just a piece) is a complex piece of work, with loads of possibilities. So I decided to write up a small HOWTO, a quick and dirty method of getting Clonezilla up and running.

Before I go on, a bit of a disclaimer: Following the instructions below may not provide you with results that fit your particular needs. If you have specific and detailed requirements, see the DRBL documentation. If you would like to hire LightCube Solutions to provide assistance in setting up a Clonezilla solution for your organization, send an email to info@lightcubesolutions.com.

The Steps

1. Install Linux

You’ll need a Linux machine to run your Clonezilla services. These instructions were successfully tested on Ubuntu 9.04 and 9.10 and Debian 5. DRBL will also run on Fedora.

2. Install DRBL

First off, open up a Terminal. In Ubuntu and Debian, this is located in ‘Applications -> Accessories -> Terminal’. If you have sudo configured, you can change to super-user access by typing:

sudo -i

Otherwise, use the root password with the following:

su -

Next, add DRBL’s GPG key to your system:

wget http://drbl.sourceforge.net/GPG-KEY-DRBL

apt-key add GPG-KEY-DRBL

Update your apt configuration so that you can install software from the DRBL guys:

cp /etc/apt/sources.list{,.bak}
echo "deb http://drbl.sourceforge.net/drbl-core drbl stable" \
  >> /etc/apt/sources.list

Finally, install DRBL:

apt-get update

apt-get install drbl

3. Configure a Network Alias

DRBL requires that you have two network interfaces. We can get around this by adding a virtual interface:

cat >> /etc/network/interfaces << "EOF"
auto eth0:1
iface eth0:1 inet static
   address 192.168.222.1
   netmask 255.255.255.0
EOF
ifup eth0:1

To verify that you have set up the alias properly, type:

ip addr show eth0 | grep eth0:1

You should see something like this:
inet 192.168.222.1/24 brd 192.168.222.255 scope global eth0:1

4. Configure Your New DRBL Server

Run the following two interactive commands (note that this will require an internet connection and may take some time):

/opt/drbl/sbin/drblsrv -i
/opt/drbl/sbin/drblpush -i

Congratulations! That’s it, you have a DRBL/Clonezilla server ready to create and deploy custom images. All you need to do to start cloning is run:

/opt/drbl/sbin/dcs

Then, boot up your client machines using PXE. See, that wasn’t too painful…

Source : http://www.lightcubesolutions.com/blog/?p=33

How to setup your free domain name in Blogger - Part 1

2009-12-20T08:31:00.000+08:00

I have a friend who was asking for my help on how to set up her freedomain.co.cc domain to change her blogspot.com subdoamin that was hosted with blogger.

It is so simple and quite easy actually, because all the guides was writen at co.cc it self, and what you need to do is follow it exactly as it shown.

But for now let me show you from the guides it self.

How to setup Blogger for my domain?

Pre-Requirements Before you start configure your domain name for blogger.

blogger.com Account (of course you must have an account first, it's more easily if you already has a gmail account, but if you dont, register with gmail.com. co.cc
domain name (this tutorial is going to use co.cc for an example, click here to get your free domain name).
you will get a message to setup your domain after completing submit the registration form, as shown as the picture below.
If you has a domain name registered with co.cc, please follow the steps below :

Co.cc → Log-in your account →Domain Settings → Select domain → Click "Set up" box → Zone Records → Add record as below

Step 01.
Register your own domain here http://www.co.cc

Step 02.
Click the "Set up" button to proceed

Step 03.
If you already has a domain name registred with co.cc, select which one of your domain name you want to set up, but from now as new comer just click the "Set up" button to proceed

Step 04.
Click the radio button to add your "Zone Records"

Step 05.
Key in your zone records, make sure your type in the www.beforeyourdomain.co.cc in the "Host" textbox, click the Type droplist buttong then key in "ghs.google.com" in the "Value" box then click "Set up" button.

after that you will the result as show below.

Step 06.
Click on the "Setup" link at the right above sidebard then you will see your domain status allowed, Walaaahhh... your are now ready to rock Blogger setting with How to setup your free domain name in Blogger - Part 2

Blogger setting with How to setup your free domain name in Blogger - Part 2

To Bypass Transperent proxy for local Intranet

2009-12-20T06:44:00.000+08:00

By satishap

Created 2008-05-21 06:43

Dear All,
We have setup Squid proxy server in transparent mode so that every user is forced to browse the internet through squid proxy on 3128 port.

Configuration is follows
1) Squid and Firewall configured on same box on 172.18.0.51.
2) Done all necessary setting required for Transparent Proxy.
also it is working file.

But my problem is that we have local intranet server on 172.21.0.4:80

In normal case without Transperent proxy manually assingning proxy address in Internet explorer proxy setting and clicking bypass proxy for local address we able to access intranet, but with Transperent proxy we r not able to access the same becuase which I suppose that all request is redirected to 3128 port( transperent proxy feature).

therefore We want to bypass transpernet proxy for local intranet so that
we can able to access 172.21.0.4 : 80 port. I thinks there must be iptable
rule which enables this, can anybody tell me how this is to done.

Source URL: http://www.linuxjournal.com/content/bypass-transperent-proxy-local-intranet

Links:
[1] http://www.linuxjournal.com/content/dns-server
[2] http://www.linuxjournal.com/content/photo-gallery-software

How to Install Chromium (Google chrome) in Ubuntu using deb package

2009-12-06T07:06:00.000+08:00

We have already discussed how to install google chrome using wine .Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. The Chromium codebase is the basis for Google’s Chrome browser.
First you can use this tutorial to install chromium in Ubuntu using PPAs and after that you can try any one of the following methods.

First you need to download .deb package from here using the following command
wget http://media.codeweavers.com/pub/crossover/chromium/cxchromium_0.9.0-1_i386.deb
Now you have cxchromium_0.9.0-1_i386.deb package install this package using the following command
sudo dpkg -i cxchromium_0.9.0-1_i386.deb

Using Ubuntu PPA
First you need edit /etc/apt/sources.list file

gksudo gedit /etc/apt/sources.list

Add the following two lines for Ubuntu 9.04 (Jaunty) Users

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main

For ubuntu 9.10 (Karmic) Users add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

save and exit the file
Now add the GPG key using the following command
sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xfbef0d696de1c72ba5a835fe5a9bf3bb4e5e17b5
or For karmic users use the following command

sudo add-apt-key ppa:chromium-daily/ppa

Update source list

sudo apt-get update

Install chromium browser using the following command

sudo apt-get install chromium-browser

#
This will complete the installation
If you want to open chromium go to Applications->CrossOver Chromium->Chromium
Chromium web browser in action

Source : http://www.ubuntugeek.com/how-to-install-chromium-google-chrome-in-ubuntu-using-deb-package.html

Tutorial: A simple embedded Linux system

2009-11-29T12:46:00.001+08:00

By Jonathan Angel
2009-03-23

Foreword -- This article begins a series of tutorials on embedded Linux system development contributed by noted ARM Linux kernel hackers Vincent Sanders and Daniel Silverstone. In the initial installment, the Simtec engineers describe how embedded devices differ from other computers, and how to build "the most basic system possible."

Papers in the series have been contributed to LinuxDevices by Simtec Electronics, a 20-year-old U.K.-based company specializing in embedded hardware and software services, with special expertise in ARM Linux.

Other papers in the series (will) include:

Building a simple embedded system (this paper)
Building an embedded Linux system with a web server
Building an embedded Linux web kiosk
Building an ARM-based embedded Linux web kiosk
Improving an embedded Linux system
Deploying embedded Linux systems

Enjoy . . . !

Simple Embedded Linux System
by Vincent Sanders and Daniel Silverstone

Introduction

Constructing an embedded system with Linux is often seen as a complex undertaking. This article is the first in a series which will show the fundamental aspects of constructing such systems and enable the reader to apply this knowledge to their specific situation.

This first article covers the construction of the most basic system possible, which will provide a command shell on the console. Along with the rest of the series, it assumes a basic understanding of a Linux-based operating system. While discussing concepts and general approaches, these concepts are demonstrated with extensive practical examples. All the practical examples are based upon a Debian- or Ubuntu-based distribution.

What is an embedded system?

The term "Embedded System" has been applied to such a large number of systems that its meaning has become somewhat ill-defined. The term has been applied to everything from 4-bit microcontroller systems to huge industrial control systems.

The context in which we are using the term here is to refer to systems where the user is limited to a specific range of interaction with a limited number of applications (typically one). Thus, from the whole spectrum of applications which a general purpose computer can run, a very narrow selection is made by the creator of the embedded system software.

It should be realized that the limits of interaction with a system may involve hardware as well as software. For example, if a system is limited to a keypad with only the digits 0 to 9, user interaction will be more constrained than if the user had access to a full 102-key keyboard.

In addition to the limiting of user interaction, there may also be limits on the system resources available. Such limits are typically imposed by a system's cost, size, or environment. However, wherever possible, these limits should be arrived at with as much knowledge of the system requirements as possible. Many projects fail unnecessarily because an arbitrary limit has been set which makes a workable solution unachievable. An example of this would be the selection of a system's main memory size before the application's memory requirements have been determined.

What do you want to achieve?

A project must have a clearly defined goal.

This may be viewed as a statement of the obvious, but it bears repeating as for some unfortunately inexplicable reason, embedded systems seem to suffer from poorly-defined goals.

An "embedded" project, like any other, should have a clear statement of what must be achieved to be declared a success. The project brief must contain all the requirements, as well as a list of "desirable properties." It is essential that the two should not be confused; e.g., if the product must fit inside a 100mm by 80mm enclosure, that is a requirement. However, a statement that the lowest cost should be achieved is a desirable item, whereas a fixed upper cost would be a requirement.

If information necessary to formulate a requirement is not known, then it should be kept as a "desirable item" couched in terms of that unknown information. It may be possible that once that information is determined, a requirement can be added.

It is, again, self-evident that any project plan must be flexible enough to cope with changes to requirements, but it must be appreciated that such changes may have a huge impact on the whole project and, indeed, may invalidate central decisions which have already been made.

General IT project management is outside the scope of this article. Fortunately there exist many good references on this topic.

Requirements which might be added to a project brief based on the assumptions of this article are:

The system software will be based upon a Linux kernel.
The system software will use standard Unix-like tools and layout.

The implications of these statements mean the chosen hardware should have a Linux kernel port available, and must have sufficient resources to run the chosen programs.

Another important consideration is what kind of OS the project warrants. For example, if you have a project requirement of in-field updates, then you may want to use a full OS with package management, such as Debian GNU/Linux or Fedora. Such a requirement would, however, imply a need for a non-flash-based storage medium such as a hard disc for storing the OS, as these kinds of systems are typically very large (even in minimal installations), and not designed with the constraints of flash-based storage in mind. However, given that additional wrinkle, using an extant operating system can reduce software development costs significantly.

Anatomy of a Linux-based system

Much has been written on how Linux-based systems are put together; however a brief review is in order, to ensure that basic concepts are understood.

To be strictly correct the term "Linux" refers only to the kernel. Various arguments have been made as to whether the kernel constitutes an operating system (OS) in its entirety, or whether the term should refer to the whole assemblage of software that makes up the system. We use the latter interpretation here.

The general steps when any modern computer is turned on or reset is:

The CPU (or designated boot CPU on multi-core/processor systems) initializes its internal hardware state, loads microcode etc.
The CPU commences execution of the initial boot code, e.g., the BIOS on x86 or the boot-loader on ARM.
The boot code loads and executes the kernel. However, it is worth noting that x86 systems generally use the BIOS to load an intermediate loader such as GRUB or syslinux, which then fetches and starts the kernel.
The kernel configures the hardware and executes the init process.
The init process executes other processes to get all the required software running.

The kernel's role in the system is to provide a generic interface to programs, and arbitrate access to resources. Each program running on the system is called a process. Each operates as if it were the only process running. The kernel completely insulates a program from the implementation details of physical memory layout, peripheral access, networking, etc.

The first process executed is special in that it is not expected to exit, and is expected to perform some basic housekeeping tasks to keep a system running. Except in very specific circumstances, this process is provided by a program named /sbin/init. The init process typically starts a shell script at boot to execute additional programs.

Some projects have chosen to run their primary application as the init process. While this is possible, it is not recommended, as such a program is exceptionally difficult to debug and control. A programming bug in the application halts the system, and there is no way to debug the issue.

One feature of almost all Unix-like systems is the shell, an interactive command parser. Most common shells have the Bourne shell syntax.

A simple beginning

We shall now consider creating a minimal system. The approach taken here requires no additional hardware beyond the host PC, and the absolute minimum of additional software.

As already mentioned, these examples assume a Debian or Ubuntu host system. To use the QEMU emulator for testing, the host system must be supported by QEMU as a target. An example where this might not be the case is where the target system is x86-64, which QEMU does not support.

To ease construction of the examples, we will use the kernel's initramfs support. An initramfs is a gzip-compressed cpio archive of a file system. It is unpacked into a RAM disk at kernel initialization. A slight difference to normal system start-up is that while the first process executed must still be called init, it must be in the root of the file system. We will use the /init script to create some symbolic links and device nodes before executing the more-typical /sbin/init program.

This example system will use a program called Busybox, which provides a large number of utilities in a single executable, including a shell and an init process. Busybox is used extensively to build embedded systems of many types.

The busybox-static package is required to obtain pre-built copy of the Busybox binary and the qemu package is required to test the constructed images. These may be obtained by executing:

$ sudo apt-get install busybox-static qemu

As mentioned, our initramfs-based approach requires a small /init script. This configures some basic device nodes and directories, mounts the special /sys and /proc file systems, and starts the processing of hotplug events using mdev.

#!/bin/sh

# Create all the busybox symbolic links
/bin/busybox --install -s

# Create base directories
[ -d /dev ] || mkdir -m 0755 /dev
[ -d /root ] || mkdir --mode=0700 /root
[ -d /sys ] || mkdir /sys
[ -d /proc ] || mkdir /proc
[ -d /tmp ] || mkdir /tmp
mkdir -p /var/lock

# Mount essential filesystems
mount -t sysfs none /sys -onodev,noexec,nosuid
mount -t proc none /proc -onodev,noexec,nosuid

# Create essential filesystem nodes
mknod /dev/zero c 1 5
mknod /dev/null c 1 3

mknod /dev/tty c 5 0
mknod /dev/console c 5 1
mknod /dev/ptmx c 5 2

mknod /dev/tty0 c 4 0
mknod /dev/tty1 c 4 1

echo "/sbin/mdev" > /proc/sys/kernel/hotplug

echo "Creating devices"
/sbin/mdev -s

exec /sbin/init

To construct the cpio archive, the following commands should be executed in a shell. Note, however, that INITSCRIPT should be replaced with the location of the above script.

$ mkdir simple
$ cd simple
$ mkdir -p bin sbin usr/bin usr/sbin
$ cp /bin/busybox bin/busybox
$ ln -s busybox bin/sh
$ cp INITSCRIPT init
$ chmod a+x init
$ find . | cpio --quiet -o -H newc | gzip >../simple.gz
$ cd ..

To test the constructed image use a command like:

$ qemu -kernel /boot/vmlinuz-2.6.26-1-686 -initrd simple.gz \
             -append "root=/dev/ram" /dev/zero

This should present a QEMU window where the OS you just constructed boots and displays the message "Please press Enter to activate this console." Press enter and you should be presented with an interactive shell from which you can experiment with the commands Busybox provides. This environment is executing entirely from a RAM disc and is completely volatile. As such, any changes you make will not persist when the emulator is stopped.

Booting a real system

Starting the image under emulation proves the image ought to work on a real system, but there is no substitute for testing on real hardware. The syslinux package allows us to construct bootable systems for standard PCs on DOS-formatted storage.

A suitable medium should be chosen to boot from, e.g., a DOS-formatted floppy disk or a DOS-formatted USB stick. The DOS partition of the USB stick must be marked bootable. Some USB sticks might need repartitioning and reformatting with the Linux tools in order to work correctly.

The syslinux program should be run on the device /dev/fd0 for a floppy disk, or something similar to /dev/sdx1 for a USB stick. Care must be taken, as selecting the wrong device name might overwrite your host system's hard drive.

The target device should then be mounted and the kernel and the simple.gz file copied on.

The syslinux loader can be configured using a file called syslinux.cfg which would look something like:

default simple
timeout 100
prompt 1

label simple
  kernel vmlinuz
  append initrd=simple root=/dev/ram

The complete command sequence to perform these actions, substituting file locations as appropriate, is:

$ sudo syslinux -s /dev/sdd1
$ sudo mount -t vfat -o shortname=mixed  /dev/sdd1 /mnt/
$ cd /mnt
$ sudo cp /boot/vmlinuz-2.6.26-1-686 VMLINUZ
$ sudo cp simple.gz SIMPLE
$ sudo cp syslinux.cfg SYSLINUX.CFG
$ cd /mnt
$ sudo umount /mnt

The device may now be removed and booted on an appropriate PC. The PC should boot the image and present a prompt exactly the same way the emulator did.

What's next?

This first step, while simple, provides a complete OS, and demonstrates that constructing an embedded system can be a straightforward process.

The next step is to expand this simple example to encompass a specific application, which will be covered in the next article.

This article is copyrighted 2009, Simtec Electronics, and reproduced here with permission.

About the authors

Vincent Sanders is the senior software engineer at Simtec Electronics. He has extensive experience in the computer industry, having worked on projects from large fault-tolerant systems through accounting software to programmable logic systems. He is an active developer for numerous open source projects, including the Linux kernel, and is also a Debian developer.

Daniel Silverstone is a software engineer at Simtec Electronics, and has experience in architecting robust systems. He develops software for a large number of open source projects, contributes to the Linux kernel, and is both an Ubuntu and Debian developer.

Source : http://www.linuxfordevices.com/c/a/Linux-For-Devices-Articles/Tutorial-A-simple-embedded-Linux-system/

69 Free or Open Source Tools For Students

2009-11-29T09:41:00.000+08:00

January 22nd, 2009

By Jill Gordon

Bookmark this on Delicious Many Open Source software projects were either started in colleges or started by recent college graduates. Whether it’s a coincidence or not, a lot of the available open source software is ideal for college students.

Free and Open Source Software Tools for Students

With the widespread use of the Internet and the growth of web-based applications, there are also a lot of hybrid forms of software available – free software with APIs (Application Programmer Interfaces) but not truly open source. The following list covers some of the best free and open source software from an average student’s perspective. (The list is arranged by software category, with recommended applications and the occasional short list of alternative or supplemental apps.)

1. Web browser.

If you’re currently in school, you probably can’t imagine a time when there was no Internet. Now, it’s probably an intrinsic part of your studies. So you need a good browser. Recommended: Mozilla Firefox. This is hands down one of the best web browsers available regardless of what your major is. There are many hundreds of useful addons for writing, researching, design and web development as well. Alternatives: Google Chrome, Opera, Safari.

2. Research

There’s no one software tool that will satisy all your research needs, but start with some of the following

Ottobib for research paper bibliographies.
Google Reader for subscribing to your favorite web feeds.
Spreeder to help you do all your reading faster.
Dictionary.com to look up definitions.
SpellJax to make sure you’re speling is grate.
Google Video and even YouTube for some learning via web video.

3. Learning and Brainstorming

Research is useless if you’re not actually learning anything. An ideal way to learn new material is by using concept mapping or mind mapping – which are similar but not exactly the same. Recommended: XMind and FreeMind. Alternatives: Mindomo, Mindmeister, Cmap, Comapping. (Comapping offers real-time mind map editing from multiple users, which is ideal for virtual team brainstorming.)

4. Communications: Email and IM/ Chat

These two subcategories are the mainstay of Internet-based communication. Both give you advantages over a phone communication, including the ability to attach information and especially to respond in your own good time. Recommended email client: Thunderbird. Alternative: GMail. If you want to combine your email client with newsgroups, IRC, a web browser and HTML editing, try Mozilla SeaMonkey for an "all-in-one Internet application suite." Recommended Chat/IM client: Adium (Mac OS X) or Pidgin (Windows, Mac). Both allow you to manage multiple chat accounts from different networks. Alternative: Meebo, for a web-based interface to manage multiple accounts.

5. Collaboration Tools

Collaboration goes beyond project management software such as GanttProject and into chat combined with real-time document browsing and editing, amongst other features. Recommended: Campfire. (Has both free and paid options.) Alternatives: Scriblink (web blackboard) and Skype (VoIP, chat and filesharing). Skype allows you to have an IM or voice chat with one or more classmates while simultaneously passing files to each other.

6. Visualization, Graphics and Diagramming Tools

This is a fairly broad category that includes vector and raster graphics editors, 3D graphics programs, and diagramming tools. Recommendations: Inkscape, Gimp, Blender, Gliffy.

7. Document Editing and Management

There probably aren’t many students who don’t have to write a term paper or essay. This is pretty much a given for most students. When it’s time to aggregate all that research you’ve done in the library (or online), you have numerous software options for writing and producing a finished paper. Recommended: OpenOffice suite, which includes a word processor, spreadsheet and presentation tool, is compatible with MS Office. Get all your assignments done, manage your finances in the spreadsheet. And it even converts documents to Adobe PDF format for when you have to submit term papers. Alternatives: Google Docs + Spreadsheets, Zoho. Supplemental: PDF Creator to produce a finished document that you can email or upload to your class’ teaching assistant.

8. Presentation Tools

If you need alternatives to MS PowerPoint, pick from either OpenOffice or ZohoShow presentation tools, or embed your presentations into a web page with SlideShare.

9. FTP/ File Transfer/ File Storage

Need to share those documents and presentations with your study/ project team? You can FTP (upload) to a team website or use a filesharing service. Recommended FTP: FileZilla. Alternatives: FireFTP (runs in the Firefox browser as an addon). Filesharing: There are far too many services to make a recommendation. However, if you have a Google Mail (GMail) account, you can save files online by attaching them to a draft email. (Note: Some filetypes may not be allowed.)

10. Productivity and Task Management

There is a huge market for productivity and task management software, and an accordingly large number of applications and subcategories to fill the niche. This includes to-do lists, calendaring and hybrid forms for both mobile and non-mobile platforms. Recommended: Google Calendar, Remember the Milk, Tada List. Supplemental: Jott, if you want to manage tasks from your phone.

11. Mathematics and Modeling

Mathematica and MathCad are great packages, but besides the expense, they’re often more than the average student needs. Open source software will probably suit you unless you’re planning graduate studies. Recommended: Gnu Octave. Alternatives: Sage Math, Mathway, Open Source Physics, POV-Ray (and additional modeling addons).

12. Programming/ Coding/ Web Development

If you don’t already know it, the Linux operating system is the breeding ground of an immense number of open source projects – having taken the mantle from its predecessor UNIX. If you want to take full advantage of the numerous open source coding tools, you might have to install Linux on your computer. (Or you can install the cygwin environment for MS Windows, but you miss out on a lot of true Linux features.) Even if you don’t want to/ can’t use Linux, you have a number of options for coding and web development: Perl, PHP, Python, Ruby and Ruby on Rails – all of which are good for relatively fast prototyping of code. If you need an open source IDE (Integrated Development Environment) for code development and testing, try Eclipse, which has components that cover Java and many of the languages above. If you’re using Java only, you can also try Ingres Cafe. If you want a multi-platform web authoring tool comparable to FrontPage or Dreamweaver, try NVu. Finally, Microsoft’s Dreamspark program also allows students to download and use their developer and design tools for no charge.

13. Blogging, Microblogging, Content Management, Info Repositories

Start a blog, make it popular by publishing great articles about your topic of study, drive traffic with Twitter and Facebook, make money in click ads, affiliate ads, or even tutoring (possibly via Skype). Okay, that’s a bit oversimplified, but if you’re good at blogging and find your niche, you might be able to pay some or all of your WordPress. Alternative: Drupal, wiki software. Microblogging: Twitter.

14. Forums/ Social Networks

Need a custom social network for team/ class/ department projects? BuddyPress gives you that ability by installing over a WordPress Multi-User (WPMU) installation. Alternative: BBPress or Vanilla forums.

15. Personal Finance

You might be a starving student but you probably still have to manage your finances. If you’re comfortable using the web for such private information, then you have a number of options – some of which let you pay your bills online. (Most options below are either free or have a free component or trial.) Recommended: Wesabe. Alternatives: DimeWise, Mint, Moneytrackin’.
__________________________________________
Source : http://www.onlinecollege.org/2009/01/22/free-or-open-source-tools-for-students/

Set Up Your Computer for Remote Desktop

2009-11-27T20:10:00.000+08:00

Enable Your Computer as the Host

Updated: August 25, 2004

You must first enable the Remote Desktop feature on your office computer so that you can control it remotely from another computer. You must be logged on as an administrator or a member of the Administrators group to enable Remote Desktop on your Windows XP Professional-based computer.

To setup your office computer to use Remote Desktop

1.	Open the System folder in Control Panel. Click Start, point to Settings, click Control Panel, and then double-click the System icon.
2.	On the Remote tab, select the Allow users to connect remotely to this computer check box, as shown below.
3.	Ensure that you have the proper permissions to connect to your computer remotely, and click OK.
4.	Leave your computer running and connected to the company network with Internet access. Lock your computer, and leave your office.

Note If you're running Windows XP Service Pack 2 (SP2) and you enable Remote Desktop, Windows Firewall will be automatically configured to allow Remote Desktop connections to your computer. However, Remote Desktop will not work if you have Windows Firewall configured to allow no exceptions. To allow exceptions in Windows Firewall, in the control panel open the Security Center, click Windows Firewall and clear the check box next to Don't allow exceptions.

Paranoid Penguin - Building a Secure Squid Web Proxy, Part I

2009-11-27T11:36:00.000+08:00

By Mick Bauer

Created 2009-04-01 01:00

Consider the venerable Web proxy—back when the Internet was new to most of us, setting up a Web proxy was a convenient way to grant users of an otherwise non-Internet-connected network access to the World Wide Web. The proxy also provided a convenient point to log outbound Web requests, to maintain whitelists of allowed sites or blacklists of forbidden sites and to enforce an extra layer of authentication in cases where some, but not all, of your users had Internet privileges.
Nowadays, of course, Internet access is ubiquitous. The eclipsing of proprietary LAN protocols by TCP/IP, combined with the technique of Network Address Translation (NAT), has made it easy to grant direct access from “internal” corporate and organizational networks to Internet sites. So the whole idea of a Web proxy is sort of obsolete, right?
Actually, no.
After last month's editorial, we return to technical matters—specifically, to the venerable but assuredly not obsolete Web proxy. This month, I describe, in depth, the security benefits of proxying your outbound Web traffic, and some architectural and design considerations involved with doing so. In subsequent columns, I'll show you how to build a secure Web proxy using Squid, the most popular open-source Web proxy package, plus a couple of adjunct programs that add key security functionality to Squid.

What Exactly Is a Web Proxy?

The last time I discussed proxies in this space was in my December 2002 article “Configuring and Using an FTP Proxy”. (Where does the time go?) A quick definition, therefore, is in order.
The concept of a Web proxy is simple. Rather than allowing client systems to interact directly with Web servers, a Web proxy impersonates the server to the client, while simultaneously opening a second connection to the Web server on the client's behalf and impersonating the client to that server. This is illustrated in Figure 1.

[1]

Figure 1. How Web Proxies Work

Because Web proxies have been so common for so long, all major Web browsers can be configured to communicate directly through Web proxies in a “proxy-aware” fashion. Alternatively, many Web proxies support “transparent” operation, in which Web clients are unaware of the proxy's presence, but their traffic is diverted to the proxy via firewall rules or router policies.

Why Proxy?

Just because nowadays it's easy to interconnect TCP/IP networks directly doesn't mean you always should. If a nasty worm infects systems on your internal network, do you want to deal with the ramifications of the infection spreading outward, for example, to some critical business partner with whom your users communicate over the Internet?
In many organizations, network engineers take it for granted that all connected systems will use a “default route” that provides a path out to the Internet. In other organizations, however, it's considered much less risky to direct all Web traffic out through a controlled Web proxy to which routes are internally published and to use no default route whatsoever at the LAN level.
This has the effect of allowing users to reach the Internet via the Web proxy—that is, to surf the Web—but not to use the Internet for non-Web applications, such as IRC, on-line gaming and so forth. It follows that what end users can't do, neither can whatever malware that manages to infect their systems.
Obviously, this technique works only if you've got other types of gateways for the non-Web traffic you need to route outward, or if the only outbound Internet traffic you need to deal with is Web traffic. My point is, a Web proxy can be a very useful tool in controlling outbound Internet traffic.
What if your organization is in a regulated industry, in which it's sometimes necessary to track some users' Web access? You can do that on your firewall, of course, but generally speaking, it's a bad idea to make a firewall log more than you have to for forensics purposes. This is because logging is I/O-intensive, and too much of it can impact negatively the firewall's ability to fulfill its primary function, assessing and dealing with network transactions. (Accordingly, it's common practice mainly to log “deny/reject” actions on firewalls and not to log “allowed” traffic except when troubleshooting.)
A Web proxy, therefore, provides a better place to capture and record logs of Web activity than on firewalls or network devices.
Another important security function of Web proxies is blacklisting. This is an unpleasant topic—if I didn't believe in personal choice and freedom, I wouldn't have been writing about open-source software since 2000—but the fact is that many organizations have legitimate, often critical, reasons for restricting their users' Web access.
A blacklist is a list of forbidden URLs and name domains. A good blacklist allows you to choose from different categories of URLs to block, such as social networking, sports, pornography, known spyware-propagators and so on. Note that not all blacklist categories necessarily involve restricting personal freedom per se; some blacklists provide categories of “known evil” sites that, regardless of whatever content they're actually advertising, are known to try to infect users with spyware or adware, or otherwise attack unsuspecting visitors.
And, I think a lot of Web site visitors do tend to be unsuspecting. The classic malware vector is the e-mail attachment—an image or executable binary that you trick the recipient into double-clicking on. But, what if you could execute code on users' systems without having to trick them into doing anything but visit a Web page?
In the post-Web 2.0 world, Web pages nearly always contain some sort of executable code (Java, JavaScript, ActiveX, .NET, PHP and so on), and even if your victim is running the best antivirus software with the latest signatures, it won't examine any of that code, let alone identify evil behavior in it. So, sure enough, the “hostile Web site” has become the cutting edge in malware propagation and identity theft.
Phishing Web sites typically depend on DNS redirection (usually through cache poisoning), which involves redirecting a legitimate URL to an attacker's IP address rather than that site's real IP, so they're difficult to protect against in URL or domain blacklists. (At any rate, none of the free blacklists I've looked at include a phishing category.) Spyware, however, is a common blacklist category, and a good blacklist contains thousands of sites known to propagate client-side code you almost certainly don't want executed on your users' systems.
Obviously, no URL blacklist ever can cover more than a tiny fraction of the actual number of hostile Web sites active at any given moment. The real solution to the problem of hostile Web sites is some combination of client/endpoint security controls, better Web browser and operating system design, and in advancing the antivirus software industry beyond its reliance on virus signatures (hashes of known evil files), which it's been stuck on for decades.
Nevertheless, at this very early stage in our awareness of and ability to mitigate this type of risk, blacklists add some measure of protection where presently there's very little else. So, regardless of whether you need to restrict user activity per se (blocking access to porn and so forth), a blacklist with a well-maintained spyware category may be all the justification you need to add blacklisting capabilities to your Web proxy. SquidGuard can be used to add blacklists to the Squid Web proxy.

Just How Intelligent Is a Web Proxy?

You should be aware of two important limitations in Web proxies. First, Web proxies generally aren't very smart about detecting evil Web content. Pretty much anything in the payloads of RFC-compliant HTTP and HTTP packets will be copied verbatim from client-proxy transactions to proxy-server transactions, and vice versa.
Blacklists can somewhat reduce the chance of your users visiting evil sites in the first place, and content filters can check for inappropriate content and perhaps for viruses. But, hostile-Web-content attacks, such as invisible iframes that tell an attacker's evil Web application which sites you've visited, typically will not be detected or blocked by Squid or other mainstream Web proxies.
Note that enforcing RFC compliance is nothing to sneeze at. It constitutes a type of input validation that could mitigate the risk of certain types of buffer-overflow (and other unexpected server response) attacks. But nonetheless, it's true that many, many types of server-side evil can be perpetrated well within the bounds of RFC-compliant HTTP messages.
Second, encrypted HTTPS (SSL or TLS) sessions aren't truly proxied. They're tunneled through the Web proxy. The contents of HTTPS sessions are, in practical terms, completely opaque to the Web proxy.

If you're serious about blocking access to sites that are inappropriate for your users, blacklisting is an admittedly primitive approach. Therefore, in addition to blacklists, it makes sense to do some sort of content filtering as well—that is, automated inspection of actual Web content (in practice, mainly text) to determine its nature and manage it accordingly. DansGuardian is an open-source Web content filter that even has antivirus capabilities.
What if you need to limit use of your Web proxy, but for some reason, can't use a simple source-IP-address-based Access Control List (ACL)? One way to do this is by having your Web proxy authenticate users. Squid supports authentication via a number of methods, including LDAP, SMB and PAM. However, I'm probably not going to cover Web proxy authentication here any time soon—802.1x is a better way to authenticate users and devices at the network level.
Route-limiting, logging, blacklisting and authenticating are all security functions of Web proxies. I'd be remiss, however, not to mention the main reason many organizations deploy Web proxies, even though it isn't directly security-related—performance. By caching commonly accessed files and Web sites, a Web proxy can reduce an organization's Internet bandwidth usage significantly, while simultaneously speeding up end-users' sessions.
Fast and effective caching is, in fact, the primary design goal for Squid, which is why some of the features I've discussed here require add-on utilities for Squid (for example, blacklisting requires SquidGuard).

Web Proxy Architecture

Suppose you find all of this very convincing and want to use a Web proxy to enforce blacklists and conserve Internet bandwidth. Where in your network topology should the proxy go?
Unlike a firewall, a Web proxy doesn't need to be, nor should it be, placed “in-line” as a choke point between your LAN and your Internet's uplink, although it is a good idea to place it in a DMZ network. If you have no default route, you can force all Web traffic to exit via the proxy by a combination of firewall rules, router ACLs and end-user Web browser configuration settings. Consider the network shown in Figure 2.

[2]

Figure 2. Web Proxy Architecture

In Figure 2, Firewall 1 allows all outbound traffic to reach TCP port 3128 on the proxy in the DMZ. It does not allow any outbound traffic directly from the LAN to the Internet. It passes only packets explicitly addressed to the proxy. Firewall 2 allows all outbound traffic on TCP 80 and 443 from the proxy (and only from the proxy) to the entire Internet.
Because the proxy is connected to a switch or router in the DMZ, if some emergency occurs in which the proxy malfunctions but outbound Web traffic must still be passed, a simple firewall rule change can accommodate this. The proxy is only a logical control point, not a physical one.
Note also that this architecture could work with transparent proxying as well, if Firewall 1 is configured to redirect all outbound Web transactions to the Web proxy, and Firewall 2 is configured to redirect all inbound replies to Web transactions to the proxy.
You may be wondering, why does the Web proxy need to reside in a DMZ? Technically, it doesn't. You could put it on your LAN and have essentially identical rules on Firewalls 1 and 2 that allow outbound Web transactions only if they originate from the proxy.
But, what if some server-side attacker somehow manages to get at your Web proxy via some sort of “reverse-channel” attack that, for example, uses an unusually large HTTP response to execute a buffer-overflow attack against Squid? If the Web proxy is in a DMZ, the attacker will be able to attack systems on your LAN only through additional reverse-channel attacks that somehow exploit user-initiated outbound connections, because Firewall 1 allows no DMZ-originated, inbound transactions. It allows only LAN-originated, outbound transactions.
In contrast, if the Web proxy resides on your LAN, the attacker needs to get lucky with a reverse-channel attack only once and can scan for and execute more conventional attacks against your internal systems. For this reason, I think Web proxies are ideally situated in DMZ networks, although I acknowledge that the probability of a well-configured, well-patched Squid server being compromised via firewall-restricted Web transactions is probably low.

Yet to Come in This Series

I've explained (at a high level) how Web proxies work, described some of their security benefits and shown how they might fit into one's perimeter network architecture. What, exactly, will we be doing in subsequent articles?
First, we'll obtain and install Squid and create a basic configuration file. Next, we'll “harden” Squid so that only our intended users can proxy connections through it.
Once all that is working, we'll add SquidGuard for blacklisting, and DansGuardian for content filtering. I'll at least give pointers on using other add-on tools for Squid administration, log analysis and other useful functions.
Next month, therefore, we'll roll up our sleeves and plunge right in to the guts of Squid configuration and administration. Until then, be safe!

Resources

“Configuring and Using an FTP Proxy” by Mick Bauer, LJ, December 2002: www.linuxjournal.com/article/6333 [3]
The Squid home page, where you can obtain the latest source code and binaries for Squid: www.squid-cache.org [4]
The Squid User's Guide: www.deckle.co.za/squid-users-guide/Main_Page [5]
The SquidGuard home page—SquidGuard allows you to enforce blacklists with Squid: www.squidguard.org [6]
The DansGuardian home page, a free content-filtering engine that can be used in conjunction with Squid: dansguardian.org [7]

Mick Bauer (darth.elmo@wiremonkeys.org [8]) is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.

Source URL: http://www.linuxjournal.com/article/10407

Making wireless work in Ubuntu

2009-11-21T08:27:00.002+08:00

Simply click on the Network-Manager icon to see all available wireless networks, and click on the network to connect to it. If wireless authentication is needed, be it WEP, WPA, or 802.1x, a network-manager dialog will pop up asking for your authentication details.

If network manager does not solve the problem, the first step should be to see which driver your wireless card needs. Do a search for your card on Google and in the Ubuntu Forums to find out which driver you need. Many of the drivers are already included in Ubuntu, but some newer drivers may not be present.

Next, you need to find out if the driver is loaded. As an example, if you have an Intel Centrino and it uses the ipw2200 driver, run this command:

sudo lsmod | grep ipw2200

Replace ipw2200 with the relevant driver for your card. If you get some lines returned, the driver is loaded and working. If nothing is returned, your card is either not supported or the driver is not included in Ubuntu. You should refer to the Ubuntu Forums for further support.

With the card identified, you now need to get connected. The easiest way to do this is to select System -> Administration -> Networking. Inside this tool you should see an icon for your wireless card. Select it and click the Properties button. Add the name of the wireless network and a password if applicable. If you are using a normal password such as s3cr3tpass, select Plain (ASCII) from the Key type box. If you are entering the long numeric password, use the Hexedecimal option. If you don't have a password on your wireless network, leave the Key type and WEP key boxes empty.

If you are automatically assigned an IP address, use the Configuration box to select DHCP. Otherwise, select Static IP Address, and enter the details of your network in the boxes.
For more information, see the Ubuntu wiki.

Using WPA
To use WPA, you need a supported card. Such cards are listed on the WPA Supplicant Web site. Common drivers that support WPA include ipw2200, ipw2100, and madwifi.

To use WPA (Wi-Fi Protected Access) with wireless cards in Ubuntu, the wpasupplicant package must be installed. After installing it, edit /etc/wpa_supplicant.conf. Networks are configured by adding network blocks to the configuration file. Each network block can also be assigned a priority so if both networks are seen, the higher priority network is chosen. Examples for common network configurations can be found in /usr/share/doc/wpasupplicant/examples/wpa_supplicant.conf.gz.

Some configurations require certificates that should be available from the network administrator. WPA Supplicant can also configure your wireless card to use unencrypted networks, as noted in the example file. After writing the file, edit /etc/default/wpasupplicant and change the ENABLED, DRIVER, and INTERFACE options. The DRIVER option should match the type of wireless device being used. Available drivers can be viewed by typing:

wpa_supplicant -help

To start the Supplicant run:

/etc/init.d/wpasupplicant start

Lastly, wpasupplicant should be added to STOP_SERVICES in /etc/default/ acpi-support to ensure it functions properly after a system suspend or hibernation.

To check if the connection is working, run:

sudo wpa_cli

This command gives information on the current connection along with scrolling logs to indicate the current status. By default wpa_cli must be run as root. Status will show what network the wireless card is currently connected to and parameters about the link. Scan causes the supplicant to look for a new access point while scan_results will display what access points are locally accessible to the machine. As soon as the supplicant authenticates, ifplugd should start the interface with ifup, and networking will be available shortly. If it seems that the supplicant is not working it may be that a different driver must be selected in the /etc/defaults/wpasupplicant configuration file. Also, some cards cannot operate in a mixed TKIP/CCMP (types of encryption) mode. If it appears the PTK listed in the log from wpa_cli is CCMP but that the GTK is TKIP, setting the pairwise and group entries of a network configuration block to TKIP may fix the issue.

By Benjamin Mako Hill, Jono Bacon, Ivan Krstic. David J. Murphy, Jonathan Jesse, Peter Savage, Corey Burger
This article is excerpted from the newly published book The Official Ubuntu Book . © Copyright Pearson Education. All rights reserved.

More Fun With Bash Quoting

2009-11-20T14:39:00.000+08:00

By Mitch Frazier

Created 2009-11-19 11:52

I've written about bash quoting [1] before, and yes, it's about as exciting as watching paint dry or listening to the corn grow. It can also be extremely frustrating when it doesn't do what you want, case in point: trying to script the updating of a field in a mysql table when the field to be changed contains quote characters.
Let's imagine we have a simple table with the following data and we would like to change the name field:

+----+----------------------+---------------------+
| id | name                 | create_date         |
+----+----------------------+---------------------+
|  1 | name 'with' "quotes" | 2009-11-19 08:48:59 |
+----+----------------------+---------------------+

Your first script might look something like this:

#!/bin/bash

USERNAME=${USERNAME:-user}
PASSWORD=${PASSWORD:-pwd}

mysql_cmd="mysql -u $USERNAME -p$PASSWORD test"

# Remove mysql header line.
function remove_header()
{
    shift
    echo $*
}

id=1
name=$(remove_header $($mysql_cmd -e "SELECT name FROM atable WHERE id='$id'"))

new_name="$name and more"
echo mysql -e "UPDATE atable SET name='$new_name' WHERE id='$id'"
$mysql_cmd -e "UPDATE atable SET name='$new_name' WHERE id='$id'"

# vim: tabstop=4: shiftwidth=4: noexpandtab:
# kate: tab-width 4; indent-width 4; replace-tabs false;

And when you run it, it will puke something like this:

$ bash badfix.sh
mysql -e UPDATE atable SET name='name 'with' quotes and more' WHERE id='1'
ERROR 1064 (42000) at line 1:
    You have an error in your SQL syntax;
    check the manual that corresponds to your MySQL server version
    for the right syntax to use near 'with' quotes and more' WHERE id='1''
    at line 1

Note, the function at the top (remove_header) removes the header line from the mysql output so that we don't get the name of the field included in the data.
We all know the solution here: we need to escape the quotes in the value so that both bash and mysql are happy. However, this turns out to be easier said than done, and perhaps I missed the obvious, but after numerous attempts (on more than one occasion) the following finally did the trick:

#!/bin/bash

USERNAME=${USERNAME:-user}
PASSWORD=${PASSWORD:-pwd}

mysql_cmd="mysql -u $USERNAME -p$PASSWORD test"

# Remove mysql header line.
function remove_header()
{
    shift
    echo $*
}

# Quote any quotes in a mysql value.
function fix_quotes()
{
    local  val="$*"
    if [[ "$val" =~ .*\'.* ]]; then #'
        echo "String contains single quotes: $val" >&2
        #val="${val//'/\\\\'}"
        val=$(sed -e "s/'/' \"'\" '/g" <<<"$val")
        echo New Value: "$val" >&2
    fi
    echo "$val"
}



id=1
name=$(remove_header $($mysql_cmd -e "SELECT name FROM atable WHERE id='$id'"))

fixed_name="$(fix_quotes "$name") and more"
echo mysql -e "UPDATE atable SET name='$fixed_name' WHERE id='$id'"
$mysql_cmd -e "UPDATE atable SET name='$fixed_name' WHERE id='$id'"

# vim: tabstop=4: shiftwidth=4: noexpandtab:
# kate: tab-width 4; indent-width 4; replace-tabs false;

The fix_quotes function only checks for single quotes since our mysql value is contained in single quotes:

$mysql_cmd -e "UPDATE atable SET name='$fixed_name' WHERE id='$id'"
#                                     ^           ^

As you would expect, we don't need to escape double quotes inside single quotes for mysql. However, if we wanted to use a literal value in our SQL command we would need to escape double quotes since our SQL command is contained inside double quotes:

$mysql_cmd -e "UPDATE atable SET name='quoted \"value\"' WHERE id='$id'"
#             ^                                                        ^

We need to escape them in this case for bash's benefit and not for mysql: bash will "remove" the backslashes before passing the command to mysql.
One of my initial attempts (which you can see commented out in the code) was to try to change the value directly using a bash assignment statement. I tried to change each single quote to an escaped single quote:

val="${val//'/\\\\'}"

Interestingly, this does not modify the string at all, a result that I don't quite understand. I tried a similar thing using sed and that also did not work. The solution that finally worked is based on the fact that mysql, like C++, concatenates adjacent strings into a single string. So, I change (using sed) all single quotes inside the string into the sequence: single-quote, space, double-quote, single-quote, double-quote, space, single-quote. You may notice that the double quotes are escaped, but that's for escaping within the sed command, those don't make it into the value that's passed to mysql.

val=$(sed -e "s/'/' \"'\" '/g" <<<"$val")

Running this final version does the trick:

$ bash fix.sh
String contains single quotes: name 'with' \"quotes\"
New Value: name ' "'" 'with' "'" ' \"quotes\"
mysql -e UPDATE atable SET name='name ' "'" 'with' "'" ' \"quotes\" and more' WHERE id='1'

and you can see the result in the table.

+----+-------------------------------+---------------------+
| id | name                          | create_date         |
+----+-------------------------------+---------------------+
|  1 | name 'with' "quotes" and more | 2009-11-19 08:48:59 |
+----+-------------------------------+---------------------+

Have we had enough quoting yet????
__________________________
Mitch Frazier is an Associate Editor for Linux Journal and the Web Editor for linuxjournal.com.

Source URL: http://www.linuxjournal.com/content/more-fun-bash-quoting

Links:
[1] http://www.linuxjournal.com/content/bash-quoting

Tech Tip: Find Directories Over a Certain Size

2009-11-18T13:35:00.001+08:00

By Da A Feng

Created 2009-11-17 10:16

It's fairly simple to find large files on your system using commands such as find, but if you're looking for directories over a certain size find won't help you. The Perl script presented here can help you track down those explosively large directories.

The script prints those directories under a given path whose size is above a certain threshold. It also allows you to exclude directories that match a certain pattern from consideration. The command accepts the following options:

-d - Specifies the base directory to search.
-t - Specifies the threshold in megabytes (eg 100 == 100MB).
-x - Specifies the patterns to ignore (glob patterns).

The following examples show how it can be used:

$ ./file.pl -d ../../ -t 100 -x '{pr*,jd*,tp*,sim*}'
165,/export/home/fengd/CMS/apache-tomcat-6.0.13/logs
274,/export/home/fengd/CMS/apache-tomcat-6.0.13
318,/export/home/fengd/CMS
400,/export/home/fengd/apache-tomcat-6.0.13/bin
417,/export/home/fengd/apache-tomcat-6.0.13
909,/export/home/fengd
909,total

$ ./file.pl -d ../../ -t 100 -x simulator*
178,/export/home/fengd/CMS/apache-tomcat-6.0.13/logs
289,/export/home/fengd/CMS/apache-tomcat-6.0.13
333,/export/home/fengd/CMS
400,/export/home/fengd/apache-tomcat-6.0.13/bin
422,/export/home/fengd/apache-tomcat-6.0.13
757,/export/home/fengd/project/cpp/fileTrans
766,/export/home/fengd/project/cpp
334,/export/home/fengd/project/log/tmp
492,/export/home/fengd/project/log
391,/export/home/fengd/project/store/array
391,/export/home/fengd/project/store
1755,/export/home/fengd/project
133,/export/home/fengd/tptp/config
200,/export/home/fengd/tptp
105,/export/home/fengd/jdk
2994,/export/home/fengd
2994,total

The source code for the command follows:

#!/usr/bin/perl -w
use Getopt::Std;
use Cwd 'abs_path';
my %dir;
getopt("dtx",\%dir);

if(!defined $dir{d}){
 print "Usage: program -d dir [-t threshhold] [-x exclude pattern]\n";
 exit 1;
}

if(!defined $dir{t}){
 $dir{t}=1000;
}

my $f=abs_path($dir{d});
my $cmd="du -m -c $f";

if(defined $dir{x}){
      $cmd=$cmd." --exclude=$dir{x}";
}

my $line=`$cmd`;
while($line=~/(\d+)\s+([^\r\n]+)\r?\n/g){
 if($1>$dir{t}){
  print $1.",".$2."\n";
 }
}

The script uses the du command to get size information. The exclude patterns are passed directly to the du command. It then processes the output from du and prints out those directories that are greater than the threshold.
__________________________

Attachment	Size
file_pl.txt [1]	478 bytes

Source URL: http://www.linuxjournal.com/content/tech-tip-find-directories-over-certain-size

OSS Cyber Cafe POS Software

2007-05-07T00:57:00.000+08:00

There are plenty of OSS Free Cyber Cafe Management System or Point Of Sales software for your Linux/Unix Bases Internet Cyber Cafe. I'd use it before and I already implement it on several cyber cafe's that i had setup, and several of it I just discovered.

Cybera - Cyber cafe administration
Cybera is an Internet cafe administration system. It works with prepaid cards or client accounts or in a post paid Self Service mode. Features include workstation control, user rights lockdown, accounting, stats and screen replication for CAI.
Visit Website | Download

Kfemate - The Open Source Cyber Coffee System
kfemate is pronunced in spanish (kfe=Coffee- mate= of "Checkmate in Chess"). With Kfemate you can admin your own Cyber-Cafe or Cyber, this Software is great, Easy of use, Secure, Fast, use MySQL, unlimited Pc's, Portable, and Open Source. (Currently only Spanish)
Visit Website | Download

Anahaw Internet Cafe Timer
Anahaw Internet Cafe Timer is an internet cafe administration program. Basic function include client shutdown,logoff, restart and monitoring. It can handle up to 16 workstation. The server can be used also as stand alone (client need not be connected).
Visit Website | Download

Dharma Internet Cafe Management
A cross platform (Linux, Win32, Mac OsX) client-server internet cafe system written in RealBasic. Features include timing/billing, client management, membership, point of sale and reports. This project aim to ease administration of an internet cafe.
Visit Website | Download

CCL - Cafe Con Leche
Cafe Con Leche (CCL) are a crossplataform library (libccl) to make programs to manage internet cafes and program that does just that using libccl. This one I've use it greatly with LTSP, all you need is to configure your LTSP Client to be able running LOCAL APPS.
Visit Website | Download

PlayBilling - Web Based
PlayBilling is a webbased billing system for internet cafe and wireless hotspot provider mostly written in Java featured with: tariff management, prepaid, postpaid and discounts, user management and extensive reporting system
Visit Website | Download

BNC - Blue NetCafe Timer
BNCTimer is a client/server software,It's a simple timer that you can control via a panel. It used in a cybercafe/internet cafe .
Visit Website | Download

ZybaCafe
ZybaCafe (formerly DireqCafe) is a full featured and complete Internet cafe management suite with support for multiple-platform clients. Thin-client Linux, fat-client Linux, and Windows are officially maintained. Extension is easily done through plugins.
Visit Website | Download

OutKafe
OutKafe is a next-generation Internet cafe management suite. It was forked from ZybaCafe with the aim of ultimately replacing all proprietary parts with completely free components. It includes a server-side administration suite as well as clients for managing time control on machines. A powerful plugin architecture allows for easy extensibility and integration with other tools such as accounting packages and CRM systems.
Visit Website | Download

Zeiberbude
Zeiberbude is a point of sales program for cyber-cafes. Its features include an independent timer for each computer in the cafe, user accounts for easier identification, drag 'n' drop of user information from one computer to another (if the user switch machines), and support for entering and billing for supplemental cost items (drinks, snacks, etc.). It also includes a configuration wizard to set cafe rates, including standard rates (per hour, half-hour and quater-hour), Happy Hour rates (start time, end time and cost allocations with the standard rate), club member rates, etc.
Visit Website | Download

CybOrg - Cyber Cafe Organizer
The Cybercafe Organizer (CybOrg) is a point of sales and administration system for Internet cafes (cyber cafes). It has a Web-based interface and is written in Perl using Template Toolkit and a RDBMS. It uses a client to block workstations, and is intended to be used on a (possibly Linux) server with Win32/Linux clients.It also provides a script to be used as the Active Desktop on Windows clients to display station's status.
Visit Website | Download

OpenKiosk
OpenKiosk is a multi-platform kiosk management system for public terminals and kiosks. X11 and Windows clients are currently supported. Whether you are an Internet Cafe operator or a librarian, Openkiosk can make your life easier.
Visit Website | Download

The Defination Of OSS Cyber Cafe

2007-04-18T06:38:00.001+08:00

In my country Malaysia, there was a trend when entrepreneur open up a cyber cafe, normally most of cyber cafe in Malaysia is a internet gaming center, but before we go more on OSS Cyber Cafe Defination, it is better to know what is the defination of internet cafe, cyber cafe, internet gaming center, and internet centre.

A short brief about cyber cafe or internet cafe.

Internet Cafe or Cyber Cafe is a terms for a place where people pay to get connected to the internet and using computer to get their jobs done using the most common end user software like word processing, spreadsheet, presentation, send or read emails, printing, scanning, or chatting and gaming, and they can order their meal and eat there, it is a place where people hang out with their offline and online friends.

The OSS Cyber Cafe is not the terms for the above one eventhough it is a cyber cafe but in a different concept meaning of cyber cafe technology.

The basic points of OSS Cyber Cafe is, it has all the important thing as the konvensional cyber cafe should be but it was builded totally with the Open Source Software Technology. Today cyber cafe is the most important thing as a library in country, the needs of information in every aspect of living is must, but too many reliablelity on Microsoft platform is a bad habit of spreading the technology to the society.

People should be advice to learns different computer or desktop platform other then M$ Windows, and one of the best starting place is to setup an OSS Cyber Cafe with the main objective to educate peoples to using the OSS technologies.

My Kubuntu LTSP+CCLFOX Screen Shot

2007-04-16T01:54:00.001+08:00

After a week I've test LTSP 5 on my Kubuntu 6.10 IBM server, I decide to upload the screen shot here, and I hope that someone who ever done this before could share her/his experiences on doing the same thing as I did.

And I've use Student Control Panel to start the cclcfox client, I know that i should be able to start the cclcfox client automatically but this for test purpose and I still have a week to delivery it to my client Residence Inn Cherating and I still looking for a better POS or cyber cafe management system.

Kubuntu 6.10 LTSP with CCLFOX:

The LTSP CLIENT with CCLCFOX Screen Lock, sorry for unclear photos.

Requirement For OSS Cyber Cafe

2007-04-14T15:48:00.001+08:00

Every conventional internet cafe has its' own and different requirement, but this is the basic requirement for every OSS Cyber Cafes.

This is the most basic requirement for an OSS Cyber Cafe requirement as a reference. However, to build up and OSS Gaming Center is a different special requirement from the basic OSS Cyber Cafe. And the best way to market the OSS technology and to show up the capabilities of OSS is by promoting the LTSP as the premium Cyber Cafe Operating System.

Hardware needed

1. 10 to 20 x Client PCs
2. 1 x PC to control Clients a.k.a Server
3. 1 x 24 ports Switch
4. 1 x Modem with built-in Router because it is easier to have modem with built-in router (broadband modem).
5. 1 x Printer - any brand
6. 1 x Scanner - any brand
7. 20 x USB extender (If only the USB ports are in the back)
8. A small casing could be the best as LTS Client System Box.

Stand Alone Client PCs x 10 to 20 units
Minimum specification to run internet applications, office applications and games. It is important to have the same specification on all the clients system to minimum maintenance job.

1. Processor - at least Pentium 4
2. 40GB Hard Disk Drive
3. 256MB RAM Memory
4. Monitor - 15" or 17" or 21"!
5. Motherboard - Good brand with Integrated sound and VGA but separated AGP card is the best!
6. Keyboard & Mouse - Any good brand keyboard and mouse with scroll.
7. Speaker or Headphone with Microphone
8. 100Mbps Network Card
9. CDRW Drive (optional)
10. Web Cam (optional)

Server PC x 1 units
Not so important, at least can run cyber cafe management software is good enough. But more number of clients means higher specification needed.

1. Processor - at least Pentium 4
2. 20 - 40GB Hard Disk Drive
3. 256MB RAM Memory
4. Monitor - 15" or LCD Monitor
5. Motherboard - Good brand with Integrated sound and VGA
6. Keyboard & Mouse - Any good brand keyboard and mouse with scroll.
7. 100Mbps Network Card
9. CDRW or DVDRW Drive (optional)
10. Web Cam (optional)

LTSP Client Workstation Unit

Minimum specification to run cyber cafe or internet cafe using all over Open Source Software for internet applications, office applications and games. For a better maintenance it is important to have the same specification on all the clients system to minimum maintenance job.

1. Processor - at least Pentium 4
2. With or without hard disk (minimun 20GB Hard Disk Drive)
3. 256MB RAM Memory
4. Monitor - 15" or 17" or 21"!
5. Built in Motherboard - Good is better but cheap brand with Integrated sound and VGA but separated AGP card would be nice.
6. Keyboard & Mouse - Any good brand keyboard and mouse with scroll.
7. Speaker or Headphone with Microphone
8. 100Mbps Network Card
9. CDRW Drive (optional)
10. Web Cam (optional)

Softwares in Clients
Most needed application by customers. It is important to have the same applications on all the clients system to minimum maintenance job.

1. Operating System - Kubuntu or OpenSuSe
2. Office Suite - OpenOffice.org Koffice
3. Browser - Konqueror, FireFox or Mozilla
4. Adobe Reader
5. File Compressor
6. Real Player - Xine, Totem
7. Media Player - XMMS, GXine, Kaffeine and Amarok
8. Messenger - Kopete, Gaim, Skype
9. Anti Virus - (Optional)
10. CD Burning Utility - K3b (optional)

Softwares in Server
Preferably the same with clients, because it is easier to troubleshoot problem if something happen.

1. Operating System - Recommended to use Kubuntu/Ubuntu or OpenSuSE
2. Office Suite - Ms Office or OpenOffice.org
3. Browser - Konqueror, FireFox or Mozilla
4. Adobe Reader
5. File Compressor - Ark
6. QuickTime
7. Media Player - XMMS, GXine, Kaffeine and Amarok
8. Messenger - Kopete, Gaim, Skype
10. CD Burning Utility - K3b (optional)
11. Internet Cafe Management Software - CCL

Games to Choose
If you run Window Client, these are the most wanted games in the Internet Cafe or Gaming Center.

1. Half-Life, Half-Life2
2. Conter Strike
3. Need For Speed Underground 1 & 2
4. Warcraft 3
5. Doom 3
6. Everquest2
7. Galaxy LightSpeed
8. Halo for PC
9. Star Wars Galaxies
10. Battlefield 1942
11. Secret Weapons and Vietnam
12. Rise of Nations
13. Home World 2
14. Solider of Fortune
15. City of Heroes
16. Final Fantasy XI
17. Command and Conquer
18. Midtown Madness 1 & 2
19. Bass Fishing
20. House of the Dead 1 & 2

MangoNetCC and LTSP What For?!!

2007-04-14T11:29:00.000+08:00

The main purpose I create this blog, because I hope one day I could share my experiences about building linux cyber cafe shop lot, currently I got several complete projects in setup a Linux Terminal Server for a cyber cafe purpose in my country.

In 2003 I've setup one LTSP server for to be used by eight lts client and using Zeiberbude as the Point Of Sales System for Resident Inn Cherating in Pahang. After several years, RIC asked me to redesign and restructure again their LTSP and their Business Center, and for this time I was replacing the Point Of Sales System by using CCLFOX instead of Zeiberbude with LOCALDEV enable, but before that successful of localdev, I had a pain of configuring it (localdev), and i don't know why it's when wrong and why it wont detect the local media of the client.

And I wait for a month for the updates of LTSP 4.1/4.2 and then all my problem solve. But I still not satisfy for the point of sales system, I am looking for a better POS system, I'd try Outkafe but I couldn't find what I want from the system, and for now the only cyber cafe management system that could suit with my need is CCLFOX this one was great, and I hope I could study more about cclfox and ltsp manager, because I've found that both of these software is very useful to be as the perfect cybercafe management system. And guys.. If any of you out there got an experiences about cyber cafe with linux... Please Let Me Know And We Share With All Who's Really Need For IT..

Configuring and Using an FTP Proxy

2002-12-04T06:27:00.000+08:00

By Mick Bauer

Created 2002-12-01 02:00

Running a public FTP site securely can be difficult. Taking full advantage of the security features supported by your FTP server application of choice can be a chore, and even then there's a good chance that sooner or later vulnerabilities will come to light making all that work for naught. So what else can you do?

One important technique is to run an FTP proxy on your firewall. Whereas the standard Netfilter code in the Linux kernel only inspects packets, an FTP proxy lets your firewall act as an intermediary in all FTP transactions. This increases your protection against buffer overflows and many other kinds of FTP attacks. It also allows you to restrict which FTP commands are executed by FTP clients.
This month I explain how to run SuSE's free (and non-SuSE-Linux-specific) Proxy-Suite FTP proxy on your Linux firewall, adding transparent but strong protection to all your FTP transactions.

Getting and Installing proxy-suite

If you run SuSE Linux, you can install the package proxy-suite, which installs a binary copy of ftp-proxy along with its configuration file and startup script. If you wish to use ftp-proxy as a transparent proxy, or if you want ftp-proxy to perform LDAP authentication, you'll need the latest version (1.9 as of this writing).

To run the latest version or use ftp-proxy on non-SuSE distributions, your best bet is to compile it yourself from source code, available at ftp.suse.com/pub/projects/proxy-suite/src [1].

Building from Source

Complete instructions on building and installing ftp-proxy are provided in the file INSTALL. By default, the configure script will check for libwrap, libldap and whether your system supports regular expressions. On my Red Hat 7.3 system, libwrap was present but caused a compile-time error, so I disabled libwrap like this:

# ./configure --without-libwrap

and ftp-proxy compiled properly. However, this wasn't necessary when I compiled ftp-proxy on my SuSE 7.1 system (obviously, SuSE's and Red Hat's libwrap packages differ).

After building ftp-proxy and installing it and its documentation, you'll probably want a startup script for your new proxy. Included with ftp-proxy's source (in the directory ftp-proxy/) is a sample script, rc.script, which is explained in the accompanying file rc.script.txt.

On SuSE systems, you simply can copy rc.script to /etc/init.d and optionally create a symbolic link to it from /usr/sbin. Rename the script /etc/init.d/ftp-proxy, and name the symbolic link /usr/sbin/rcftp-proxy. If you run SuSE 7.x, you'll also need to add this line to /etc/rc.config:

START_FTP_PROXY="yes"

For non-SuSE distributions, the example rc.script will need to be heavily tweaked, because much of it is
SuSE-specific. Look at other scripts in your distribution's init.d directory for examples. Once you've figured out how, I strongly encourage you to send your hacked script to Marius Tomaschewski (mt@suse.de [2]), one of the major contributors to FTP-Proxy, so others may benefit from your brilliance.

Configuring ftp-proxy

Once you've installed ftp-proxy from source or from a SuSE package, it's time to configure it. Most configurable parameters are kept in /etc/proxy-suite/ftp-proxy.conf (or, if you installed from source, in /usr/local/etc/proxy-suite/ftp-proxy.conf). Before diving into ftp-proxy.conf, however, you've got a couple of odds and ends to attend to.

First, you need a new, unprivileged user account for the proxy dæmon to use. On my system I created such a user, ftpproxy, like this:

bash-# useradd -u 65500 -g nogroup -d
/var/ftp-proxy/rundir -s /bin/false ftpproxy

No one should log in as this user, so be sure also to put an asterisk in the password field of the proxy user's line in /etc/shadow:

ftpproxy:*:12345:0:99999:7:0::

Next, you'll need to build a chroot jail in which ftp-proxy's child processes can work. For SuSE users this is easy; ftp-proxy's startup script will do this for you if invoked with the chroot command:

bash-# /etc/init.d/ftp-proxy chroot

Even if you don't run SuSE, it's fairly simple to reverse engineer the example script (the rc.script mentioned earlier) to figure out how to do this. The long and short of it is that the customary ftp-proxy chroot jail is /var/ftp-proxy/rundir, and it should contain copies of the libraries and files ftp-proxy uses, plus its own dev/log special file to which your local syslog dæmon can listen. To point your syslog dæmon to the chrooted log device, simply add an -a parameter to its startup script so that syslog is started:

syslog -a /var/ftp-proxy/rundir/dev/log

On SuSE systems the customary way to do this is in /etc/rc.config via the SYSLOGD_PARAMS variable. You can specify multiple -a statements if, for example, you're also receiving logs from a chrooted named.
Firewall Primers [3]

ftp-proxy.conf

And now, finally, it's time to configure your proxy dæmon. As I mentioned, this is done in the file ftp-proxy.conf, which resides either in /etc/proxy-suite or in /usr/local/etc/proxy-suite. You may be confused or annoyed by SuSE's use of the term “suite” to refer to a single application. Hopefully, additional proxies will be completed soon, and if they're as useful as ftp-proxy, I, for one, will forgive them for this minor conceit.

The quickest way to explain this file is to list a brief example and dissect it (see Listing 1).
Listing 1. ftp-proxy.conf [4]

The first parameter, ServerType, determines whether to run ftp-proxy as a standalone dæmon or from inetd. Although I've been calling it a dæmon, ftp-proxy can be run either way. I personally avoid running inetd or even xinetd on my public servers, because that way I don't need to disable the unnecessary things that tend to get run by default, and because of the performance benefit of running things as dæmons. If your needs are different, you can set ServerType to inetd (which also works if you run xinetd rather than inetd).

User and Group, obviously enough, determine the UID and GID under which ftp-proxy runs after initialization. It's a good idea to set these to an unprivileged UID and GID in order to lessen the consequences of an attacker somehow hijacking an ftp-proxy process.

LogDestination specifies where ftp-proxy should send log messages. This can be either dæmon (the local syslog facility), a file or a pipe. LogLevel determines the quantity of information to be logged; for most users the default of INF is best, but DBG (the maximum setting) is useful for troubleshooting.
PidFile tells ftp-proxy where to store the process ID of its master process. This is used by the startup script when it's invoked with the stop command and upon system halt. It isn't used, however, if ftp-proxy is run in inetd mode.

ServerRoot specifies the path to ftp-proxy's chroot jail. Leave it commented out if you don't want to run ftp-proxy chrooted (see the “Problem with 1.9 and chroot” Sidebar).
Problems with 1.9 and chroot [5]

Transparent Proxying

The next three commands in Listing 1 are important. They determine whether your proxy will be transparent. In most situations, a transparent proxy is preferable. End users won't need to configure their FTP client software to explicitly support the proxy. To achieve this, ftp-proxy works in conjunction with the kernel's Netfilter code, which redirects FTP packets to your proxy dæmon rather then sending them to the host to which they're actually addressed.

When ftp-proxy receives FTP client packets that have been redirected in this way, it uses their destination IP as the destination of the new FTP connection it initiates to the desired FTP server. The parameter DestinationAddress specifies the default destination to use.

If you want to allow users to use the proxy non-transparently, i.e., by initiating their FTP sessions directly to the proxy, set the parameter AllowMagicUser to “yes”, but I do not recommend doing so if your proxy is to be used by external users, as in the case of a public FTP. AllowMagicUser will cause your proxy to act as an open proxy that external users may use to connect to other, external FTP servers, possibly for the purpose of attacking them.

If you've configured Netfilter to accept connections to the proxy from trusted (internal) users only, however, and you set AllowMagicUser to “yes”, users will be able to specify their FTP destination by attaching it to their user name with an @ sign, e.g., mick@ftp.wiremonkeys.org. AllowMagicUser may be used regardless of whether AllowTransProxy is set to yes or no. But note that if it's set to no and AllowMagicUser is too, all FTP sessions will use DestinationAddress.

Other parameters include MaxClientsString and DestinationTransferMode. See the ftp-proxy.conf(8) man page for the complete list and for more information on the ones we've covered here.

Configuring Netfilter for Transparent Proxying

For transparent proxying to work you need to use iptables to redirect FTP packets to the local proxy (i.e., you need to run Netfilter on your proxy host, which this article assumes you're doing), and of course, you'll need rules allowing FTP connections to and from the proxy. You will not, however, need any rules in the FORWARD chain.

First, you'll need to load several modules for your Linux 2.4 firewall to support transparent proxying: ipt_conntrack_ftp and ip_nat_ftp are required for FTP connection tracking; ipt_REDIRECT is required for the REDIRECT rule target. Most distributions' stock 2.4 kernels include these modules.
Once the modules are loaded, you can add firewall rules like these to your Netfilter startup script

(Listing 2).

Listing 2. iptables: Commands for Transparent FTP Proxying [6]

The first two commands of Listing 2, instruct the firewall to redirect all packets received on its external and internal interfaces (eth2 and eth0, respectively) that have a destination port of TCP 21 (the FTP server port). Note that these packets won't be rewritten (mangled) in any way; they'll simply be redirected to the local FTP proxy dæmon.

The third and fourth commands in Listing 2 tell the firewall to accept all incoming packets sent to TCP port 21 of the public FTP server (where the variable PUBLIC_FTP contains its IP address) and all incoming FTP packets sent by internal users (where the variable INTERNAL_HOSTS contains an IP range in CIDR notation, e.g., 192.168.99.0/24). Per the first two lines, any packets matching lines three and four will be diverted to the local proxy.

The fifth and sixth lines in Listing 2 allow the local ftp-proxy dæmon to initiate proxied FTP connections to the specified public FTP server and to external FTP servers (i.e., hosts reachable from its external Ethernet interface, in this example, eth2).

The lines in Listing 2 do not form a self-contained Netfilter rulebase. They represent the lines you could add to an existing script already properly configured for NAT, etc., and already containing definitions for the variables PUBLIC_FTP and INTERNAL_HOSTS. It's good practice to use custom variables like this to make your rules more readable.

Restricting FTP Commands

Now we return to ftp-proxy.conf (Listing 1) and one of ftp-proxy's most important features: ValidCommands. This is a comma-delimited list of FTP commands the proxy will allow. The list may span multiple lines if you end each line (except for the last) with a backslash (\). In the ValidCommands statement at the bottom of Listing 1, ftp-proxy has been configured to allow FTP directory navigation commands (PWD, CWD, CDUP) and FTP read commands (LIST, NLST, RETR), plus some additional administrative commands such as MODE, PORT and PASV.

Space does not permit me to explain all of these in depth, other than to say that these aren't end-user FTP client commands; they're FTP protocol commands as specified in RFC 959 (see ftp.isi.edu/in-notes/rfc959.txt [7]). These are the commands that FTP client and server applications use with each other. See Table 1 for a summary.

Table 1. FTP Commands Specified by RFC 959 [8]

One limitation of ftp-proxy is that it isn't possible to set different command restrictions for external users than for internal users. Be careful, therefore, with ValidCommands. If your internal users need to send files to FTP servers, you won't be able to restrict the STOR or STOU commands (i.e., you'll need to include them in ValidCommands), which means you'll need to make sure your read-only public FTP server is itself configured to disregard them.

That isn't such a bad thing. Regardless of how ftp-proxy is configured, you still need to configure your FTP servers to protect themselves as much as possible.

Conclusion

An FTP proxy adds an important layer of security between the bad guys and your public FTP servers. I've shown you the basics of setting up a transparent FTP proxy using SuSE's proxy-suite, but it supports many other worthwhile features we haven't covered here. See the Resources section for pointers to additional information. Good luck!

Resources [9]

Mick Bauer (mick@visi.com [10]) is a network security consultant for Upstream Solutions, Inc., based in Minneapolis, Minnesota. He is the author of the upcoming O'Reilly book Building Secure Servers with Linux, composer of the “Network Engineering Polka” and a proud parent (of children).

Source URL: http://www.linuxjournal.com/article/6333

Deploying the Squid proxy server on Linux

2001-03-04T06:29:00.000+08:00

By Ian Spare

Created 2001-03-01 02:00

To provide Internet access for users in the SAS Institute Europe, Middle East and Africa (EMEA), a number of proxy servers have been installed both at the country office level and centrally at SAS European Headquarters in Heidelberg, Germany.

These servers run the Squid proxy server software; this software is available under the GNU general public license. In brief, Squid provides for caching and/or forwarding requests for internet objects such as the data available via HTTP, FTP and gopher protocols. Web browsers can then use the local Squid cache server as a proxy HTTP server, reducing access time as well as bandwidth consumption. Squid keeps these objects in RAM or on local disk. Squid servers can be installed in hierarchies to allow central servers to build large caches of data available for servers lower in the hierarchy.

Squid has been in use for some time around SAS EMEA and is performing very well; the software is extremely stable and is delivering seamless access to the Internet for connected clients.

The original proxy servers were installed on HP workstations running release 10.20 of HPUX and Squid version 2.1. This was run on a mix of hardware but typically HP9000/720 workstations with 64MB of memory and about 4GB of disk. This configuration is difficult to support; the hardware has reached an age where failures are becoming common and the increased use of the Internet coupled with growth in the offices has left the configuration under-powered. Our main problem of late has been disk space management; the increased access patterns have left our existing log areas looking undersized at 100MB and our actual cache directories are looking rather small at 2GB.

As a result, we began researching some alternatives in order to maintain the service. Since we were happy with the Squid software itself, and we already had a good understanding of the configurations, we decided to continue using Squid but to review the hardware base.

Since Squid is an open-source project and well supported under Linux, it seemed a good idea to explore the possibility of using a Linux-based solution using a standard SAS EMEA Intel PC. This configuration is a Dell desktop PC with 256MB of RAM, 500MHz Intel Pentium and internal 20GB IDE disk. As Dell has a relationship with Red Hat, it made sense to their distribution. Also, SAS has recently released versions of the SAS product in partnership with Red Hat.

Architecture

The original architecture in SAS EMEA used three central parent Squid caches with direct access to the Internet and child Squid servers in many of the country offices. Some of the smaller countries' operations still connect to the central headquarter caches, and we felt that using less expensive hardware would give us the opportunity to install proxies in these offices. Further, in many of the country operations the SAS presence is split among several offices connected via WAN links; again the less expensive hardware gives us the opportunity to install proxies in these offices. These deployments should improve the response times for web traffic and hopefully reduce the overhead on our WAN links.
Finally, we had some reservations about the resilience and availability of the original infrastructure, and we felt that with revised client and server configurations we could improve the service level of our internal customers.

Our new architecture is not much altered in principle; we still have three central servers, but they now run Linux. We are deploying more child proxies, and we require a three-level hierarchy in some offices. For example, some countries have satellite offices that only connect to the SAS Intranet via a single WAN link to the country headquarters; in these cases we will install proxies at the satellite office with a preferred parent cache in the country headquarters rather than European headquarters.

A new addition to our architecture has been the Trend Interscan Virus Wall product for HTTP virus-scanning. We have installed three virus scanning systems also running Red Hat Linux; these systems are positioned behind the current Squid parent caches, providing a virus-scanning layer between the Squid cache hierarchy and the external Internet. Since the virus scanners are simply pass-through in nature, we simply configure our top-level Squid servers to “round-robin” between them.

Installation

The original HP-UX servers were installed by duplicating a disk image from a known configuration. This was a totally unsatisfactory method for several reasons, not the least of which was that it was difficult to make provisions for maintenance of this image for patches or version updates for Squid, etc.
Our goal was a scripted and automated installation that could be performed quickly by local office staff. We have been pleased with the implementation of this concept, and it has some useful benefits with regard to recovery and configuration management (see below).

We produced a KickStart configuration to build machines for us. KickStart is a tool from Red Hat to automate system installations. Basically we can tell the install how to partition a disk, which packages (RPMs) to install and include some local configuration steps via shell commands. Our KickStart configuration is placed on a floppy disk along with normal Linux boot utilities, and we instruct the KickStart to perform installation from a CD.

This means that for a new proxy server we can arrange shipment of a PC that looks similar to our expected hardware configuration and ship a CD and floppy disk for the remote office to complete the configuration.

The installation process has been automated with three exceptions: users will be prompted for the hostname, IP information and the keyboard type (some of our offices use different keyboards for the local language). The KickStart hard-codes all other choices; for example the installation language is always English, the choice of packages are always the same and the disk always partitions in the same way.

The basic installation from placing the disk in the drive until the reboot with a freshly installed OS takes under ten minutes. This is much quicker than we could do and a huge decrease in the time it would take to perform a HP-UX installation. This obviously has some implications for our backup and recovery procedures (see below).

Configuration Maintenance

We have the usual problems with running our systems: configuration files need updating, software needs upgrading, log files need rotating and processes need monitoring. In the past a seriously inconsistent set of shell scripts and cron jobs had been used, or more normally, configurations had been allowed to diverge. We had replaced some of these with rdist jobs but this was not wholly adequate, so we looked around for another tool.

The best tool seemed to be cfengine. This allows us to build a common definition of tools and configuration at a central location and then distribute it to all our servers. Implementing cfengine has been highly successful, although it does require some careful planning of the configuration structure and a fairly careful reading of the documentation.

Some of the files we distribute are completely standard, and we can simply have cfengine send them “as is” to the target system. However, some are based on a common template and need alterations for each system. A good example of this would be the main Squid configuration file. In this case we ship a template via cfengine and a small script that knows how to make the transformation. We use the feature in cfengine that allows commands to be run after the receipt of a file so this shell script is run and then Squid is signalled to re-read the configuration file. This way we can keep a centrally controlled and coordinated configuration and know with certainty the status of a remote system.

In turn, our cfengine configuration is built on a local NIS map we maintain; this NIS map simply indexes host names against capabilities. For example, the keyword SQUID-CHILD is used to flag that a machine is a second-level proxy as opposed to SQUID-MASTER. This NIS map is processed to produce classes for use in cfengine; the end result of this is that configuration information is stored centrally, not on each server.

More problematic for us has been maintenance of the installed software. We are running a system largely built around Red Hat 6.2 but since installing some of the proxies, Red Hat released updates that we required. Typically security issues are a priority. We also have some locally derived RPMs, and use a later version of Squid with some options Red Hat does not include, and we use a locally built version of the gated routing dæmon that includes support for some additional routing protocols. Finally, we have some RPMs that were never in the Red Hat distribution.

The obvious step to take was to build an FTP server for updates. We have used the built-in FTP server on a Network Appliance Filer that also contains our distributions from Red Hat. We have an FTP mirror job that pulls the latest updates from a Red Hat mirror site. Our FTP server also has a tree for our local RRMs.

It's taken some time to get the process of updating RPMs correct and we're still not totally happy. The best tool we have currently is autorpm. This is configured to look at our FTP server and automatically install Red Hat updates, ignoring those RPMs we didn't install to start with, and to install or update all RPMs inside our local tree.

Our problem here is that autorpm cannot deal with some circular dependencies contained in some RPMs. It's easy to manually resolve this, but we would prefer to automate this process. This seems less the fault of autorpm and more a problem with the actual RPMs.

Back to Installation

This problem with the RPMs has also had an impact on our installation procedures. We were very happy with the installation time being under ten minutes, and it only took a few minutes to apply our old rdist updates for files. Now though, it was taking over ten minutes to apply the RPM updates on some sites and it was a manual process requiring logging in to the system to complete. This was pretty critical for the Squid software where our Squid configuration file requires the newer version of Squid.

We also had an issue with the install itself now; there was no way that an install could complete locally without this intervention from us if we had updated some of the software. This was a fairly important issue for us. There are occasions when some type of failure is experienced at a remote office and, we are not available. In these situations we would like to remotely access the office to simply reinstall their proxy server, possibly on new hardware. This only works if we do not need to intervene in the process.

As a result, we went back and reconsidered one of the initial assumptions—we'd said that we would ship only standard Red Hat CDs and use KickStart, cfengine and autorpm to customize them. We now decided to produce our own Linux distribution largely based on the Red Hat distribution, but including our new and updated RPMs and some configuration files. The idea now was that the initial install would produce a working proxy and then our scheduled, automated jobs would come along later and tidy up any small problems.

Producing our own distribution has been pretty successful; we can produce our distribution from a new Red Hat release in about one to two days. We take the basic Red Hat distribution and remove many of the RPMs from the tree. This is not a very scientific process: we do not remove every RPM, only the ones taking up the most space. We then add our own RPMs to the tree, modify the various control structures in the tree and cut a CD.

Since our new media contains cfengine and autorpm, we can configure the post-install steps of the KickStart process to run these processes on the first boot after install. This should bring our new machine quickly up to date with our current configuration.

However, when we moved to Red Hat 6.2 we hit an interesting issue with KickStart: the new version does not necessarily prompt the user for IP addresses and other network information when they are not present in the KickStart file during an install from CD-ROM. A careful reading of the slightly updated documentation suggests this was deliberate on the part of Red Hat, but was a major headache for us. Ultimately, we rewrote the section of code in the Anaconda installer to restore the original behavior.

Backup and Recovery

We looked at the various backup and recovery options and decided to use the simplest backup procedure available; namely we do not back up the machines. When we looked at the proxies it was apparent that only the log data and the cache structures were unique to any machine. The log data is periodically copied to a central location for analysis and the cache, while valuable, can be cleared and rebuilt over time.

The Linux proxies we have deployed so far have had no major service interruptions or hardware problems, but if we do have problems, we propose to reinstall the remote system. In the case of hardware failure, we expect most remote offices will be able to find a spare PC and repeat the installation.

As a result, not only are we not taking backups, but we do not need to make any provision for resilient hardware or technologies for mirroring, etc. In fact, using specialized hardware would reduce our availability and resilience since we would not have spare hardware at the remote office to make a replacement, whereas we have many standard desktop PCs of a sufficiently similar configuration that our KickStart procedure will work on them.

We expect that in the event of a failure the remote office can recover the service in around 20 minutes, given that a PC is available. We have made some effort with the client browser configuration to make this transparent to the desktop user. This gives us a highly available solution.

Client Considerations

The old proxy configuration relied on the clients being configured to use a named proxy server explicitly. For the sites where more than one proxy server was available, the hostname used for the proxy server was in a domain managed by lbnamed. The version in use had been modified slightly but was still unsuitable for our use. lbnamed used rpc.rstatd to get loading information from machines in a pool, and then depending on the weighting, lbnamed will return different hosts, thus creating some limited load balancing. In practice this does not distribute effectively although it has the useful feature that if a machine is unreachable it will be removed from the pool. Unfortunately, this useful feature is undermined by the fact that only load is used (in the basic Perl version) to weight hosts. If our Squid server dæmon dies the load on the machine tends to to be reduced, which can leave a machine where a failure has occurred at the top of the pool. There is an implementation in C that can look at other factors apart from load but some experimentation with this was not fruitful. Our overall impression was that, as previously installed, this was more successful than a standard DNS round-robin would have been.

Our testing was performed against our three new Linux proxy servers, and one factor we noted was that response time could be improved if we sent the HTTP query to the machine most likely to have the object in cache; of course this seems a fairly obvious but not immediately useful observation.
In fact, the idea of intelligently selecting the cache to query is a fairly simple thing to achieve using the Proxy Auto Configuration (PAC) file feature supported by most mainstream browsers. This basically entails having a web server somewhere that can return a proxy PAC script.

Our task was made doubly easy because someone had already produced some sample code for PAC files that balanced queries across several servers. We took as our base the work done at Sharp on a “Super Proxy Script” using URL hashing. This is a simple but ingenious idea that hashes the URL being requested and then returns a proxy to use. This is statistically random in terms of load distribution over large numbers of URLs, but repeated queries for the same URL will always return the same proxy. We also make use of the ability in the PAC script to return an array of proxy servers; the effect is that if the first named proxy fails then queries by the client are routed seamlessly to the next proxy in the list.

At the headquarter sites, we return arrays based on two or three proxy servers depending on the campus location. For sites where only a single proxy is available, we do not use URL hashing and only return a pair of proxies, namely the local proxy server and a central server for fallback.

The use of this central fallback for remote users is the feature that gives us the most resilience. Should a remote proxy fail the remote clients for that proxy will detect the failure and use the central host, the clients will check every 30 minutes (MSIE and Netscape) to determine if the original server is active and return to using it if it is.

In fact, since we have some clients using Microsoft Internet Explorer version 5.0, we name the proxy.pac script as wpad.dat. This allows “unconfigured” IE5 clients to locate the wpad.dat file automatically using the WPAD method of searching for a URL of the form http://wpad.local.domain/wpad.dat.The use of WPAD is not particularly critical to us but it is a useful feature. Reviewing the logs during implementation suggests that we may be saving our help desk some calls from mobile users who would otherwise have required help setting their proxy manually when visiting other offices.

Currently we use Apache web servers to return the PAC scripts, and the Apache runs either on the local proxy host or another locally available web server. It is possible that using one of the stripped-down web servers, for example, several are implemented in Perl, may be more secure and represent less overhead. We have not explored this approach yet.

Our WPAD servers currently have multiple address records in DNS so in the event of a single WPAD server failing, we have some resilience. For sites with only a single WPAD server, we rely on new client sessions using previously cached settings.

There is a small flaw in this approach where remote sites have multiple proxies: the URL hashing carefully selects which local proxy to use but then the proxy simply round-robins the query over the three central systems. We could use some of the facility of Squid to exchange cache digests so the local proxy would forward requests to the central server most likely to generate a hit, but in practice the cost in bandwidth on the WAN links makes this ineffective. Instead we let the round-robin query any central server and then have the central servers use cache digest exchange to generate a hit if possible.

Upgrades

We anticipate that we will want to keep our proxy servers up to date with a reasonably current Red Hat version. While we will rely on cfengine and autorpm to make the small alterations in configuration, we do not expect that upgrading the entire OS over the network is really feasible for us.

So, instead, we intend to ship our fresh installation to the remote office and have them carry out a new install if we want to upgrade. We expect this will occur about three or four times a year possibly. Because we have such a clean installation process and tight control over configurations, there's little penalty for making such frequent upgrades. Since the remote office would retain the previous media, regression to an earlier version should also be fairly straightforward.

We are very eager to take these frequent updates as we experience many problems on the HP-UX proxies directly related to lack of software and patch updates. For example, we see HP-UX problems occur for which patches are available, and have an old version of Squid and many tools we try to run since old versions of Perl are available.

An upgrade can be done during a normal business day for a remote office, and for the ten or 20 minutes downtime the clients will simply fall back to the central standby servers, or for sites with multiple servers, they use their own local fall back servers.

Monitoring

For planning purposes the most useful data is a historical view of the activity the cache is seeing. We gather this data using MRTG (Multi Router Traffic Grapher) and the built-in SNMP agent in Squid. This has been a little awkward to configure, but we are able to create some useful graphs of the performance of the proxies. We collect many metrics from the proxies that are available from an internal web page. We have some code that generates an index page of all servers by walking our NIS map of hosts (see above); this code also includes a thumbnail of some key metrics. We are particularly interested to see the trends for cache hit and cache miss times as well to track any overall growth in requests.
We also use the Calamaris tool (see Resources) to produce snapshots of the status of the proxies and some analysis of the logs.

We also have a copy of the HP OpenView network management products. Currently we are using this to monitor the status of the machines only, but we plan to customize it to monitor the health of the remote Squid software to simply alert us if the software fails.

We have also started to use cfengine running from cron every five minutes to check the health of various processes and to attempt an automatic restart.

Additionally, we deliver Internet usage reports to the local offices. Currently we collate the logs into an SAS dataset and use SAS reporting tools to produce reports, but we also have products like SAS IT Service Vision and SAS WebHound that are able to produce similar analysis of traffic. These are powerful tools, and we can use them to provide a much fuller analysis of the data.

We have been pleased with the stability and performance of our Linux solution. There's no doubt that the reduced hardware costs are allowing us to install proxies in locations where previously it was not cost effective to build more resilience for other locations. Since our new configuration is more resilient and, by and large, better configured than the previous one, we have less problems than with the old proxies.
The worst problem we have seen operationally so far has been file system corruption. We have had a remote proxy suffer a power failure and then fail to boot because of file system problems. As an interim measure we have amended the startup code to be more tolerant of these failures, but a more long-term solution may be to use one of the log-based file systems that are becoming available.

We are beginning to see that more local links to ISPs are being deployed in our offices. As a result we will need to fine-tune our configuration to support HTTP virus scanning at an office level and direct access from the proxy to the Internet. In practice this will simply mean adding some tasks to cfengine and autorpm to install and configure the new modules.

Since we now have a procedure to produce our own Linux distribution media, it is likely we will review a more generic Linux deployment internally. This will occur to some extent anyway now that SAS products are available on Linux; we hope producing standard distributions for internal use will give us some loose configuration control. We will likely consider what other functions might usefully run on Linux; for example, we may move some DNS/BIND functions to Linux.
Resources [1]

Ian Spare is a consultant currently working for the SAS Institute in Germany. He prefers to spend his time snowboarding or on skis but, when not on the snow, manages to support and manage a mix of UNIX and Linux systems around Europe, the Middle East and Africa. He has no children but does have three dependent cats to support.

Source URL: http://www.linuxjournal.com/article/4408

Links:
[1] http://www.linuxjournal.com/files/linuxjournal.com/linuxjournal/articles/044/4408/4408s1.html