OTRS as a product is pretty cool and full of features, unfortunately from a technical aspect it’s pretty much of an unaesthetic “Perl hack” that’s, especially when you should try to integrate it into your existing environments and make it talk to your RADIUS or directly to your LDAP. Here, I would like to describe the basic configuration to get the latter working without any troubles.

Everything actually starts within the $OTRSHOME/Kernel/Config.pm. After you’ve set up your Apache to get you displayed the /otrs/index.pl and /otrs/customer.pl you’ll need to start hacking Perl in OTRS’ “config file”.
Let’s say, that we would want to authenticate against LDAP. And maybe not only for the agents (the people using index.pl) but also for the customers. So, let’s assume that we’re having a LDAP-tree containing our Base (“dc=something,dc=com”) and our “Users” OU (“ou=Users,dc=something,dc=com”). Also, we have a “Groups” OU (“ou=Groups,dc=something,dc=com”). I think that’s probably the most common built-up, regardless what names the OUs actually have.

Now, first of all, we need to know what user we could use to authenticate on our LDAP later and get the information we need. Here, I’m assuming it’s “cn=admin,dc=something,dc=com”. Let’s begin with the configuration for getting the agents authenticated:

    $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
    $Self->{'AuthModule::LDAP::Host'} = 'localhost';
    $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=something,dc=com';
    $Self->{'AuthModule::LDAP::UID'} = 'uid';
    $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsagent,ou=Groups,dc=something,dc=com';
    $Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
    $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
    $Self->{'AuthModule::LDAP::Params'} = {
        port => 389,
        timeout => 120,
        async => 0,
        version => 3,
    };

The configuration should be pretty self-describing, though let’s sum it up: We’re connecting to the LDAP host “localhost” (since we probably tunnel the SSH port to the OTRS machine or have it running directly on that one – else you’d just need to specify another hostname/IP. BEWARE: When using an external LDAP with no tunnel you should use LDAPS!) and use our BaseDN. We define the user-id field being named “uid”, just like the user-attribute we’re going to look-up and we’ll be using the memberUid as access-attribute. Wait. memberUid? I lost you, right?

In this configuration, we’re also using a GroupDN that actually lets us “filter” which of our users might be allowed to use the OTRS as agents. For this, we’re accessing the group “otrsagent” within our “Groups”-OU and lookig up the memberUids.
At last but not least, the actual LDAP parameters like the port for example.

Now, you can test your login by browsing to your index.pl and enter the credentials of an LDAP-user being in your otrsagent-group. You should now be possible to authenticate. Nothing more. You won’t be able to login to your OTRS yet. Why? It’s simple: OTRS uses LDAP only for authentication but initially copies the user-data from LDAP into its own database backend. Therefor we need to set up the “AuthSyncModule”.

This module allows us to tell OTRS that we’d like to have our user data being synchronized with the LDAP database. Let’s take a look at the actual configuration:

    $Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';
    $Self->{'AuthSyncModule::LDAP::Host'} = 'ldap://localhost/';
    $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=something, dc=com';
    $Self->{'AuthSyncModule::LDAP::UID'} = 'uid';
    $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'UID';
    $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'memberUid';
    $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'cn=admin,dc=something,dc=com';
    $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'swordfish';

    $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
        UserFirstname => 'givenName',
        UserLastname  => 'sn',
        UserEmail     => 'mail',
    };
    $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [
        'users',
    ];

Again, from top to bottom: We tell OTRS what LDAP host, what BaseDN, what UID/UserAttr/AccessAttr, what search user and what password to use. Then, we need to define what’s needed to be synchronized. Here, we only sync the most important data: First name, last name and e-mail. Note: Without the mail entry this won’t work!
After that, we define what OTRS-groups the user should initially be in.

Now you should be able to authenticate and login with your LDAP user.

Next, customer authentication.

The customer authentication needs to be configured separately and also starts with basic LDAP information:

    $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
    $Self->{'Customer::AuthModule::LDAP::Host'} = 'localhost';
    $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=something,dc=com';
    $Self->{'Customer::AuthModule::LDAP::UID'} = 'uid';
    $Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'cn=otrscustomer,ou=Groups,dc=something,dc=com';
    $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
    $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
    $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=admin,dc=something,dc=com';
    $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'swordfish';
    $Self->{'Customer::AuthModule::LDAP::Params'} = {
        port => 389,
        timeout => 120,
        async => 0,
        version => 3,
    };

I think I don’t need to comment this section once again. Next:

    $Self->{CustomerUser} = {
      Name => 'LDAP Datasource',
      Module => 'Kernel::System::CustomerUser::LDAP',
      Params => {
         Host => 'localhost',
         BaseDN => 'dc=something,dc=com',
         SSCOPE => 'sub',
         UserDN => 'cn=admin,dc=something,dc=com',
         UserPW => 'swordfish',
         Params => {
            port => 389,
            timeout => 120,
            async => 0,
            version => 3,
         },
      },
      CustomerKey => 'uid',
      CustomerID => 'mail',
      CustomerUserListFields => ['sn', 'cn', 'mail'],
      CustomerUserSearchFields => ['uid', 'cn', 'sn', 'mail'],
CustomerUserSearchPrefix => '',
       CustomerUserSearchSuffix => '*',
       CustomerUserSearchListLimit => 250,
       CustomerUserPostMasterSearchFields => ['mail'],
       CustomerUserNameFields => ['givenname', 'sn'],
       CustomerUserExcludePrimaryCustomerID => 0,
       AdminSetPreferences => 0,
       Map => [
           [ 'UserSalutation', 'Title',      'title',           1, 0, 'var', '', 0 ],
           [ 'UserFirstname',  'Firstname',  'cn',              1, 1, 'var', '', 0 ],
           [ 'UserLastname',   'Lastname',   'sn',              1, 1, 'var', '', 0 ],
           [ 'UserLogin',      'Username',   'uid',             1, 1, 'var', '', 0 ],
           [ 'UserEmail',      'Email',      'mail',            1, 1, 'var', '', 0 ],
           [ 'UserCustomerID', 'CustomerID', 'mail',            0, 1, 'var', '', 0 ],
           [ 'UserPhone',      'Phone',      'telephonenumber', 1, 0, 'var', '', 0 ],
           [ 'UserAddress',    'Address',    'postaladdress',   1, 0, 'var', '', 0 ],
           [ 'UserComment',    'Comment',    'description',     1, 0, 'var', '', 0 ],
       ],
    };

This is theoretically the same we’ve also set up for the agents and will let OTRS synchronize the customer data into its own database. I think the whole mapping should be pretty clear when read carefully, so I’m not going to explain every setting in detail.

However, after you’ve hacked together your basic configuration in this kinda way, also the customer.pl authentication should be working against your LDAP.

There’s one more thing that’s left to be mentioned. When you authenticate your agents against the LDAP, OTRS will try to authenticate root@localhost against it – what probably won’t work anymore then. Of course, you won’t need to go without an administrative user now. Simply pick one of your LDAP users, add him to the otrsagent group, log in to the web-interface and then adding an entry into the group_user table of OTRS’ database, containing the user_id of your LDAP user (get it from the “users” table) and the group_id “1″, with the permission_key “rw” and the permission_value “1″. After that, the user should have administrative rights.

And the next time, I’ll show you how to build an automatic back-scratcher using a wall, some glue and a cat. Enjoy!

First of all, we defined our scenario. Let’s assume that we’d like to have a cluster of two servers, both running the latest CentOS (5.4), both up-to-date, both using the very same partitioning and both using DRBD and GFS(2). On most SuSE or Debian systems, the installation would be pretty straight-forward: You install the base system, set up the DRBD, format it with some OCFS and make Heartbeat monitor everything. So far so good. On RHEL/CentOS it seems to work a bit different, due to the different tools they’re using. When installing the installation-group “Cluster Storage” for example, yum fetches packages named openais and cman – tools you’ve probably never heard of, when you come form the Debian corner (as I do). But before I describe those in detail, let’s just configure our plain base-installation.

What do we need to do first? What’s one of the most important things on two systems that should run “symmetrically” and have the very same data available, with every change that’s being made every second? Exactly, the time would be one of those things. We need to assure that both systems use the very same time. Mostly, you’ll be using some x86_64 hardware for such setups, where the problems start: On 64-bit hardware, the timekeeping with TSC doesn’t run that perfect, which is why we should just deactivate it and leave HPET do its job alone. After installing ntpd we need to open our grub.conf and add the notsc option to our kernels. It should looks something like this:

===================================================================
RCS file: /etc/grub.conf,v
retrieving revision 1.1
diff -u -r1.1 /etc/grub.conf
— /etc/grub.conf 2009/11/13 13:30:26 1.1
+++ /etc/grub.conf 2009/11/13 13:32:26
@@ -13,9 +13,9 @@
hiddenmenu
title CentOS (2.6.18-164.6.1.el5)
root (hd0,0)
- kernel /vmlinuz-2.6.18-164.6.1.el5 ro root=LABEL=/
+ kernel /vmlinuz-2.6.18-164.6.1.el5 ro root=LABEL=/ notsc
initrd /initrd-2.6.18-164.6.1.el5.img
title CentOS (2.6.18-164.el5)
root (hd0,0)
- kernel /vmlinuz-2.6.18-164.el5 ro root=LABEL=/
+ kernel /vmlinuz-2.6.18-164.el5 ro root=LABEL=/ notsc
initrd /initrd-2.6.18-164.el5.img

Now, we can shutdown the ntpd and set its drift-file to 0.000. After that, simply reboot and check the dmesg for the HPET-lines and of course also check the time on both systems to be identically.

Now, what else should we configure until we start building our actual cluster? Probably, we should take a look into the system-config-securitylevel-tui tool. Depending on what environment you plan your cluster to run in, you either want to open each port by port manually in the firewall and configure your SELinux to allow CMAN/OpenAIS and DRBD to work properly – or you simply turn of those “toys” and configure the network-segment to be secure by itself. It depends to you and I’m not going to write how to reconfigure the firewall or your SELinux-environment. For my tests, I simply turned both off. Especially the combination of CMAN/OpenAIS and SELinux can become pretty tricky, when SELinux runs in any other mode than “Disabled”.

Now, let’s finally please our inner kid and install some software:

# yum groupinstall “Cluster Storage”
…
# yum install drbd83 kmod-drbd83
…

I’ve chosen to use drbd83 since it’s the next stable release and already obsoletes drbd82 in CentOS 5.4 – and drbd is simply just too old. Of course, upgrades might become tricky when using explicitly versioned packages, but on DRBD it’s always a bit tricky, since there could be configuration changes which would have to be implemented manually on future versions.

However, now let’s create the infamous and poorly documented /etc/cluster/cluster.conf. For testing, we could simply use something like this:

<?xml version=”1.0″?>
<cluster alias=”cluster-setup” config_version=”1″ name=”cluster-setup”>
<rm log_level=”4″/>
<fence_daemon clean_start=”1″ post_fail_delay=”0″ post_join_delay=”3″/>
<clusternodes>
<clusternode name=”server-1.cross” nodeid=”1″ votes=”1″>
<fence>
<method name=”2″>
<device name=”LastResortNode01″/>
</method>
</fence>
</clusternode>
<clusternode name=”server-2.cross” nodeid=”2″ votes=”1″>
<fence>
<method name=”2″>
<device name=”LastResortNode02″/>
</method>
</fence>
</clusternode>
</clusternodes>
<cman expected_votes=”1″ two_node=”1″/>
<fencedevices>
<fencedevice agent=”fence_manual” name=”LastResortNode01″ nodename=”server-1.cross”/>
<fencedevice agent=”fence_manual” name=”LastResortNode02″ nodename=”server-2.cross”/>
</fencedevices>
<rm/>
<totem consensus=”4800″ join=”60″ token=”10000″ token_retransmits_before_loss_const=”20″/>
</cluster>

Configuring OpenAIS this way isn’t actually the best way… it’s not even “good”. But for testing (and understanding how stuff works) it should be enough. Those rules expect manual intervention when one of the two server should become unavailable and needs to be brought back into the cluster.

The domain “.cross” is expected to be a hostname.domainname entry within the /etc/hosts of each server and defines the direct cross-cable-connection from one server to another. We need this connection to shrink down network latency and provide a way for OpenAIS and (in this example) also DRBD to directly communicate with each other. A better setup would be to set the heartbeat on top of a serial-line, since it would be most fault-tolerant.

Okay, next. What’s left? Exactly, the actual DRBD – so let’s set it up:

global { usage-count yes; }
common { syncer { rate 100M; } }
resource the-disk {
protocol C;
startup {
wfc-timeout 20;
degr-wfc-timeout 10;
# become-primary-on both; # Uncomment this only after tested!
}
net {
cram-hmac-alg sha1;
shared-secret “i4m501337″;
allow-two-primaries;
}
on server-1 {
device /dev/drbd1;
disk /dev/sdb;
address 10.100.0.1:7789;
meta-disk internal;
}
on server-2 {
device /dev/drbd1;
disk /dev/sdb;
address 10.100.0.2:7789;
meta-disk internal;
}
disk {
fencing resource-and-stonith;
}
handlers {
#outdate-peer “/sbin/handler”;
}
}

This configuration defines our two servers and tells DRBD to use /dev/sdb on both for the actual data. Our meta-disk will be internal and with address we defined – guess what? – the IP addresses of our two servers. Those are the .cross-domain addresses!

Next, we initialize our meta-disks (on both nodes), set our generation identifier, start the actual DRBD service and check the roles it currently runs in:

# drbdadm create-md the-disk
…
# drbdadm — 6::::1 set-gi the-disk
…
# service drbd start
…
# drbdadm role all
Secondary/Secondary

If all those steps succeed, we can try to promote both nodes to primary:

# drbdadm primary all
# drbdadm role all
Primary/Primary

And if this now worked out properly, we can enable the automatic promotion from within our drbd.conf:

# rcsdiff -u /etc/drbd.conf
===================================================================
RCS file: /etc/drbd.conf,v
retrieving revision 1.2
diff -u -r1.2 /etc/drbd.conf
— /etc/drbd.conf 2009/11/13 10:34:23 1.2
+++ /etc/drbd.conf 2009/11/13 15:16:26
@@ -9,7 +9,7 @@
startup {
wfc-timeout 20;
degr-wfc-timeout 10;
- # become-primary-on both; # Uncomment this only after tested!
+ become-primary-on both; # Uncomment this only after tested!
}
net {
cram-hmac-alg sha1;

Great. So we’re set up now? Nope. We’re not. Next, we need to change DRBDs boot order in order for it to work properly with the GFS auto-mounting on boot:

# rcsdiff -u /etc/init.d/drbd
===================================================================
RCS file: /etc/init.d/drbd,v
retrieving revision 1.1
diff -u -r1.1 /etc/init.d/drbd
— /etc/init.d/drbd 2009/11/13 10:57:15 1.1
+++ /etc/init.d/drbd 2009/11/13 10:58:15
@@ -1,6 +1,6 @@
#!/bin/bash
#
-# chkconfig: 345 70 08
+# chkconfig: 345 22 75
# description: Loads and unloads the drbd module
#
# Copright 2001-2008 LINBIT Information Technologies

And let it run on boot:

# chkconfig –level 345 drbd on

Great! So, now we are set up, right? Nope, wrong. We have a running DRBD setup now, but we still lack of a cluster-able file-system. GFS2 is a pretty good choice for such a task, so let’s try to format the DRBD-device on one of our nodes with it:

# mkfs.gfs2 -p lock_dlm -t cluster-setup:mycluster /dev/drbd1 -j 2

Before we can try to mount the device, we need to have OpenAIS/CMAN running, in order to manage our GFS consistency. Let’s start the cman service therefor (on both nodes!):

# service cman start

Starting cman and starting fenced could take several seconds, be patient. If you installed both servers identically and followed this documentation step by step everything should work out just fine.

At last, we can now mount our DRBD device into some folder (on both nodes) and start playing around with our fresh setup:

# mount -t gfs2 /dev/drbd1 /mnt/somefolder

I hope everything worked out for you and I also hoped that this brief summary helped you getting a bit easier into the actual setup of such a cluster setup. Feel free to ask any questions or provide feedback in any form.

Enjoy!

Palm Pre Development Bundle 0.2

Yes, after not even four hours I’ve already finished building the 0.2-release of my Palm Pre Development Bundle for TextMate. In case you’re wondering what weird stuff I’m talking about, please read my previous post first.

However, this second release includes a lot more features than it had before, plus I’ve made use of the CocoaDialog now. Let me describe the new features from the top to the bottom of the screenshot on the left site.

First of all, there’s “Generate New Project”. This lets you execute a palm-generate with all important attributes and opens the created project afterwards using the “mate” terminal-command, which needs to be available for this to work. All you have to do then is simply to save the TextMate project right into your generated project-directory.

Next, we still have “Generate New Scene”. I’ve enhanced the feature now, so that you’ll get a cocoa dialog asking for the scene’s name. Beware: The generation usually works as it should, the only problem is the TextMate project-drawer, which doesn’t seem to refresh by itself. A workaround: Cmd+H to hide TextMate and then click on its Dock-icon to make it appear again. Then all newly generated files should be visible in its drawer.

The next three features work just as before, no enhancements at all. On the fourth, the “Launch Project in Debugging-Mode” feature, I’ve implemented a palm-launch with debugging options, that can be run on an existing, packaged and installed project.

Next, there are ways to close and remove installed Projects. “Close running project” of course only works, when the App is actually running and “Remove installed Project” removes the App from the device. As device for all those commands the first device found by the Palm toolset will be taken – so if you would like to use the Emulator, better disconnect your real device and vice versa.

I’ve also built-in two features that let you simulate test calls and SMS on your Emulator, if you changed from password authentication to SSH public key authentication. You can do this either manually or try to use the feature at the menu’s bottom named “Auto-install SSH-Pubkey on Emulator”. Depending on your SSH-key-setup it works out or… not.

The other seven features allow you to simulate GPS drives on the Emulator – again only if you’ve set-up SSH-Pubkey authentication.

I hope you enjoy this release of the Palm Pre Development Bundle for TextMate!

Download: Palm-Pre-Bundle-0.2

UPDATE: There’s a newer version available! Get it here. Or use GitHub.

The scene generation works like this: You implement your this.controller.pushScene(“Main”);-statement, select the scene’s name (Main, without the quotes!) and select the scene-generation command from the bundle’s menu. The command will immediately generate you a new scene named just the way you chose to name it.

The other three commands can be ran by pressing the keys Fn+Ctrl+F5/F6/F7. Attention: The bundle only works with TextMate Projects! Generate your Palm Pre project like you always do, by using the following command:

palm-generate -p “{ title:’ProjectName’, id:com.my.ProjectName, version:’1.0.0′ }” ProjectName

Then, create a new TextMate Project and drag&drop the folder palm-generate created for you (“ProjectName”) into the Project’s drawer. Save the project within your Project-directory (“ProjectName”) and then run the commands.

This is the very first version of this bundle and I’ll keep constantly improving it with other features that help me and hopefully others on the development of Palm Pre Web-Apps.

Enjoy!

Download: PalmPre-Bundle-0.1

UPDATE: There’s a newer version available now! Get it here.

export EZMWLUCENE_HOME=/opt/lucene/server
/usr/lib/jvm/java-6-sun-1.6.0.12/jre/bin/java -Dezmwlucene.home=$EZMWLUCENE_HOME -Djava.io.tmpdir=$TMP -cp $EZMWLUCENE_HOME/ezmwlucene.jar:$EZMWLUCENE_HOME/lib/jetty-6.1.14.jar:$EZMWLUCENE_HOME/lib/jetty-util-6.1.14.jar:$EZMWLUCENE_HOME/lib/servlet-api-2.5-6.1.14.jar:$EZMWLUCENE_HOME/lib/commons-codec-1.3.jar:$EZMWLUCENE_HOME/lib/commons-httpclient-3.1.jar:$EZMWLUCENE_HOME/lib/commons-logging.jar:$EZMWLUCENE_HOME/lib/FontBox-0.1.0-dev.jar:$EZMWLUCENE_HOME/lib/lucene-core-2.4.0.jar:$EZMWLUCENE_HOME/lib/lucene-highlighter-2.4.0.jar:$EZMWLUCENE_HOME/lib/PDFBox-0.7.3.jar:$EZMWLUCENE_HOME/lib/poi-3.5-beta3-20080926.jar:$EZMWLUCENE_HOME/lib/poi-scratchpad-3.5-beta3-20080926.jar net.sourceforge.ezmwlucene.service.EzMwLuceneService

Those two lines can be packed-up within a shell-script, which then gets ran by a proper /etc/init.d-script. For me, it now just works perfectly.

Enjoy!

The first thing needed is a client computer running any kind of the supported OSs by the Amazon API tools and of course the tools themselves. After you’ve installed those and configured all credentials the right way, we can create a new pair of SSH keys for our new project. Due to the location I’m currently in, I’ve chosen to use Amazon Instances in the western EU. Execute the following line on your command-line:

ec2-add-keypair –region eu-west-1 test-keypair

The result should look something like this:

[Deprecated] Xalan: org.apache.xml.res.XMLErrorResources_en_US
KEYPAIR test-keypair e1:1a:d1:a1:a1:1c:10:a1:b1:d1:cb:11:11:1a:11:11:f1:11:ae:fe
—–BEGIN RSA PRIVATE KEY—–
XXX
—–END RSA PRIVATE KEY—–

You can now copy the lines from BEGIN… until END… (including those two) into a file which you’ll be using as SSH-key for connecting to your instance. Don’t forget to chmod 600 it!

Next, let’s see what base-images for creating our instance we could you – first, provided by Amazon themselves:

ec2-describe-images –region eu-west-1 -o ‘amazon’

The list is contained of several different OSs and versions, although in our current project we can’t make use of any of those. Therefor, we’re now searching for a perfectly fitting, really good operating system:

ec2-describe-images –region eu-west-1 -a | grep -i debian

And yet, we receive another list with several different versions of the Debian Linux distribution. After we’ve picked the one we’d like to run, we should check what instances are currently up and running:

ec2-describe-instances –region eu-west-1

If you’re using Amazon’s EC2 for the first time, there shouldn’t be any items listed. We can now start our very first instance, by copying the instance’s identifier (in the second column, a string starting with ami-) and pasting it into our command:

ec2-run-instances –region eu-west-1 -k test-keypair -g ‘http/s’ -g ‘ssh’ ami-b8446fcc

In this command, we tell Amazon to start up a new instance that’s built on top of the ami-b8446fcc-image, using the key-pair we just created before and using some custom built firewall-rules named “http/s” (which allows us to connect to port 80 and 443) and “ssh” (port 22).

We need to wait a few seconds, until the instance comes up. We can use the describe-instances command from above to check the instance’s status:

ec2-describe-instances –region eu-west-1

As soon as it’s up and running, the “pending” column should have been replaced by a dynamically allocated hostname and the status “running”. Keep in mind, that this hostname/ip is dynamically allocated! If you want a fixed IP, you need to allocate and assign an Elastic IP – I’ll show you later how to do so.
If our firewall rules worked out, we can now connect using SSH:

ssh -i ~/Library/EC2/id_rsa-test-keypair root@ec2-11-111-11-111.eu-west-1.compute.amazonaws.com

By default, Amazon sets up a Small Instance, that provides around 10 GB of hard drive, an Dual-Core AMD Opteron 2218 with 2600 MHz and around 1.7 GB of RAM. Small instances, in comparison to the bigger ones, also still provide a real swap-partition which is limited to 895 MB. Here, you could run into problems when installing some Oracle for example, since the DB would like to have 1 GB or more Swap-space. If 895 MB should not be enough, the only way to enlarge it seems to be to use a file within your file-system for that. Either, by placing it somewhere into / or by using /mnt for that. /mnt is a special mount in Amazon instances which provides you 147 GB of additional volatile storage. Amazon doesn’t guarantee in any way the storage to be stable/solid or even backed up – and usually /mnt is only used for bundling your instance. You might now think “so, where could I place my data, if / is only providing me 10 GB of space and /mnt should not be used for storing sensitive data?” – well, there’s a third possibility named Elastic Block Storage. An EBS is being displayed to your instance as regular block-device (/dev/sdb, …) that’s format- and mountable. There, sensitive data could be stored, by bind-mounting the directories you’d like to have your data in. I’m not going to explain how this works, else I’ll never finish writing this brief documentation.

However, since we’re connected to the instance now, we can set it up the way we want it, with whatever software we need on it. I’ve assumed, that most people would set it up as regular LAMP-instance, therefor I’ve also added the firewall-rule for HTTP/HTTPS. After we finished installing the software we need, there’s one more package that should be plugged into the system: The Amazon AMI Tools. Simply wget them from http://s3.amazonaws.com/ec2-downloads/ec2-ami-tools.zip and unzip the package. Those tools make use of Ruby, so ensure having it installed on your instance. Also, you need to have the private key (pk-.pem) and the certificate (cert-.pem) you created the instance with somewhere within your instance’s filesystem, for later use.

Before we bundle up our system now, let’s come back to the topic we had before: The hostname/IP. Amazon allocates some dynamic address, unless you tell them to give you a fixed (called Elastic) IP. You can do that by simply executing:

ec2-allocate-address –region eu-west-1

… within your client’s command-line (where the Amazon API Tools have been installed – not on the instance!). As result you’ll get some IP address that has now being allocated by Amazon for you. The IP isn’t bound to any instance yet – it’s just allocated for you to be able to use it. ATTENTION: You pay for Elastic IPs as long as you do not assign them to an instance. Yes, that’s right. Amazon charges you for every allocated but unused IP hourly. By that, they want to prevent people “collecting” addresses, I guess. To assign the address you just received to your instance, simply run:

ec2-associate-address –region eu-west-1 -i i-11e11b1e 79.125.11.11

The i- is your actual instance’s ID, where the last, dot-separated number is the IP you’ve received. And yes, those are fake numbers – so don’t even try.

Now it could take a bit for Amazon to reconfigure the instance, but as soon as it finished, you should be able to re-connect to the instance using the IP you just assigned to it.

As last task for today, let’s bundle up the image the way we have it now. Bundling an image allows you more than just eating up your credit card’s limit by dumping your S3 buckets. On the one hand, with bundles you can recover machines that crashed or lost data within a few blinks and on the other, you can created new instances out of a bundle (talking about “scalability”).

For bundling, we use the AMI tools we installed. First of all, let’s create a directory for the bundle:

mkdir /mnt/myimage

After that, run the bundle-vol-tool:

ec2-bundle-vol -k pk-.pem -c cert-.pem -s -u -d /mnt/myimage/

This command takes several parameters for the private key, the certificate, the size of the resulting bundle in MB and your User-ID (without dashes). The User-ID can be found within your Account Information on Amazon’s EC2 site. The command should ask you, what architecture you’d like to bundle the system for – i386 should work out perfectly for what we’re doing. The following procedure could take some time, since the tool collections every peace of the system and builds a bundle into the directory we specified. As soon as the tool finished, we can upload our bundle to our S3-bucket:

ec2-upload-bundle –location EU -b -m /mnt/myimage/image.manifest.xml -a -s

Again, we need to specify some credentials (our access-key and the secret-key) for the upload to work. Also, we need to pick a globally unique bucket-name for uploading the bundle, what shouldn’t be that hard as long as you don’t try stuff like “linux” or other common words. The bundle will then be uploaded to your (private) bucket, so you have it for later use.

From within the web-interface you could now simply create new instances out of the uploaded bundle, without even knowing how the actual system was set up or having the Amazon API tools installed on your client.

Cool stuff, enjoy!

As I’ve written, moving the application-folders into the cloud seems to be working pretty good on one client. Now I’ve tested, how it is when using two clients and pulled the information contained in the cloud (from client A) down to client B. Each of the three applications worked in general, Pidgin started with the account configured on client A, Evolution started with the Inbox configure in client A but asked me for the password to access the mail-server (what’s clear, because I did not synchronize the key-rings) and Firefox displayed with the preferences configured, but prepended a message box that said:

Could not initialize the application’s security component. The most likely cause is problems with files in your application’s profile directory. Please check that this directory has no read/write restrictions and your hard disk is not full or close to full. It is recommended that you exit the application and fix the problem. If you continue to use this session, you might see incorrect application behaviour when accessing security features.

This confused me a bit, especially since the actual browser ran without any more problems. However, I’ve been to lazy to track down this permission problem.

After I’ve checked, if “one-after-another” synchronization worked, I tried out the simultaneous usage of both machines, while being connected and synced with the cloud on each of them. As I’ve expected, I ran into some problems: Suddenly, some more folder (thumbnail) appeared within the client B’s Ubuntu One folder, that contained his app-information. The folders remained until the actual Home folder finished receiving the data from within the cloud, then they just disappeared. I don’t know, if those have been merged or just deleted – it just worked afterwards.

Ubuntu One seems to be using “semaphores”, in a similar way token-ring was using: At first, client A is allowed to sync his data with the cloud. When this is finished, client B is allowed to sync. Then, it’s client A’s turn again – and so on. Theoretically, this is good. But in practice, Ubuntu One unfortunately seems to overwrite locale changes when pulling data down from the cloud. In comparison: MobileMe asks the user and merges the data, as good as possible.

In the end, simultaneous usage was unable to sync both machines in a way, so that data was kept consistent. Either one machine lost information, or the other. Especially when adding a new Pidgin account on client B, waiting for the sync, closing Pidgin on client A (which then seems to save a final account-info) and waiting for the sync there, you will be surprised your account not to be available when re-launching Pidgin on client A.

Of course, synchronization always is a tricky feature, but I guess, Ubuntu One lacks of an SVN-like back-end, that keeps track of all changes and makes merging possible. I’m really interested in how Ubuntu One will continue to evolve and I’ll try to keep tack of its development status. This could really kick ass someday, as soon as everything works seamless and simultaneous.

For my tests, I was using a vanilla Ubuntu 9.04 with latest package versions/updates installed. The installation of the PPA was pretty simple, thanks to the DEB provided on the Ubuntu One site, although I could not install the Ubuntu One GNOME-Client using the one-click feature implemented on the official Install-site. This probably could be the first thing a regular user could trap on.

So, after installing the packages manually by using a terminal and aptitude, the client appeared in Ubuntu’s “Internet”-submenu of the panel-main-menu. When a user installs Ubuntu One on a new computer and clicks the client’s icon within the menu to start the service, he will get a browser-window containing an Ubuntu One authorization-page. There, the user needs to click the “Authorize this Computer” button, so the computer will be able to sync with the Ubuntu One cloud. I took a quick look behind the scenes and as far as I’ve seen, Ubuntu One uses regular OAuth to authenticate computers to the cloud. The OAuth-token therefor will be saved within the “Passwords & Keys” thingy, that’s found somewhere in the main-menu.

However, the sync service itself creates a “Ubuntu One” folder within your home-directory, which syncs up into the cloud. Within this folder, there’s also a sym-linked-folder for Public content. The client-daemon doesn’t seem to be using some mechanism like iNotify to sync the folder contents up to the cloud, or if it does, it’s simply broken. At least on my test-machine, the client synchronized periodically – and by periodically I mean cycles with noticeable pauses in between. On one way that’s good, because not every tiny-whiny change that will be made to the folder’s contents will be pushed up to the cloud, what would literally kill your bandwidth, but on the other hand, the actual duration from one sync to another is just too big to be used with multiple devices simultaneously (e.g. an Android implementation or even another client-computer).

Talking about the simultaneousness, I don’t think that Ubuntu One is (yet) planned to be used on multiple computers simultaneous. On my test-setup I’ve created a sub-folder named “Home”, where I moved some dot-starting-folders from within my actual $HOME to and soft-linked them back to their actual location. My setup then looked something like:


devilx@vm-ubuntu:~$ ls -la | grep ^lrw*
lrwxrwxrwx 1 devilx devilx 38 2009-09-12 20:32 .evolution -> /home/devilx/Ubuntu One/Home/evolution
lrwxrwxrwx 1 devilx devilx 36 2009-09-12 20:31 .mozilla -> /home/devilx/Ubuntu One/Home/mozilla
lrwxrwxrwx 1 devilx devilx 35 2009-09-12 20:33 .purple -> /home/devilx/Ubuntu One/Home/purple
devilx@vm-ubuntu:~$


By this, I’ve pushed the preferences and information of my Firefox, my Evolution and my Pidgin into the cloud. A quick test showed me, that none of those three applications complained about their new “home” being a symlink to some directory within the cloud – and neither about any insufficient permissions that could have happened, if the cloud was set-up crappy (+1P for Ubuntu One). Still, this setup seems not that perfect for me, at the moment.

The synchronization of a modified .mozilla and especially of a modified .evolution folder seems to take for years. While I’m writing this text, the client-daemon is still synchronizing the files (it started nearly at the same time I’ve started writing this entry) and says “Updating 6 of 270 files…” – this could become a looooong night. Though, I don’t want to complain about Ubuntu One’s performance, since yet, it’s still in Beta (even if I don’t know, if Beta isn’t just an upcoming trend every company has to stick with -> e.g. Google).

I’ll try to clone this Ubuntu-installation and run them both with Ubuntu One being active – first, one after another (to see, if the applications could be synced without them complaining about parameters, that are incorrect for the secondary host they get synced to -> e.g. hostname information) and then I’ll try to run them simultaneously and hope for the best. If it should work out (what I don’t expect, just from what I’ve seen in similar projects), it would be really cool, because then, most applications could be synced this way without much hassle. I’d be really surprised, if this should be working, because then, the cloud seems to implement some kind of “merge” service, which allows you to upload data from two (or more) clients and seamlessly merge it up in the cloud together to one, consistent state.

Eh, I will see. Altogether, Ubuntu One is yet already working pretty cool, though I’m not quite sure, what a regular user should do with it, if he’s already aware of service like Dropbox or Amazon’s S3 – because at the moment, Ubuntu One unfortunately isn’t any better than those services. It just integrates more seamless into the GNOME-desktop. Hm… oh well.

On August 23rd, I wrote an E-Mail to the SourceForge-Support:

Dear Sir or Madam,

some years (now already ago, I registred on SourceForge.net (Username: devilx) and uploaded some OpenSource-Projects of mine. After a while, my Account has been blocked without any (for me visible) reason. Now, I’m interessted in using this Account again, unfortunately I can’t re-enable it by recovering the password (or else).

I would like to ask, if you could help me re-enable the Account.

Thanks in advance,

bye.

On August 27th, the SourceForge-Support (finally) answered:

Hello Marius,

This account was removed for a policy violation. It may not be
recovered. If you choose to open a new account, please be sure to
closely review our Site Legal documentation (
http://sourceforge.net/apps/trac/sitelegal/wiki ).

Best regards,

Daniel Hinojosa
SourceForge.net Support
sfnet_ops@corp.sourceforge.com

On the very same date, ten minutes later, I wrote back:

Hi Daniel,

thank you for your reply. I don’t know, why I should have violate your policy, since I didn’t do anything wrong on that account. It had been removed shortly after I created a project named “BFC”, what stood for Brainf*ck Compiler. I’m sorry, but it is not my fault for the Programming-Languag being called like that. If you rejected the project because of this fact, it would have been fair. But deleteing my whole account is pretty sad.

I was having some projects running under that account, which seem to be still available. Are there any possibilities for me to get my account named “devilx” (and all the project memberships I had) back?

Thanks in advance,

Marius.

On August 29th the Support wrote back:

Hi,

The account was closed at the time as there was a policy violation. We
won’t be restoring that account.

you may open a new account and if you desire, attempt to take over the
projects. If they are abandoned, this should be very easy to do.

Please be sure to be fully familiar with your Terms of Use:

http://sourceforge.net/apps/trac/sitelegal/wiki/Terms%20of%20Use

Best regards,

Daniel Hinojosa
SourceForge.net Support
sfnet_ops@corp.sourceforge.com

Half an hour later, I finished the communication:

Great! Say “Hello” to OpenSource and its support – that is, why people buy commercial, closed source products.

Thank you for no help.

Have a nice day.

And yeah, I know, it’s a free service and they have the right to do whatever they would want, blah blah blah. Still, it’s the fact that the support apparently had no idea what the actual problem with my account was nor why it really had been blocked. I’m not going to sign up for a new account, since nowadays there are (luckily) way more possibilities to get your own project hosted in whatever way.

Yet again a poor statement the OpenSource related projects/SourceForge makes.

Cheers!

The last time I check out the project, there was no such daemon for Unix(-like) platforms but Mac OS X itself. I decided to take a quick look at the independend istatd Project on Google Code and give it a shot. I fetched the sources, built them on a Debian Lenny and ran the daemon with a slighly modified configuration – and it worked!

I found it pretty cool. Actually, I found it so cool that it was the reason for me to buy the actual iPhone App. I have no Mac OS X Servers I’d like to monitor, but I could think of plenty of Linux machines which I’d like to keep an eye on – not as an replacement for Nagios, just as a solution for quick-live-monitoring.

However, I decided to build a Debian package, to make it easier to deploy the istatd on a couple of machines. I attached the Debian package to this post, so you can just download and install it on your Lenny machines. Warning: It’s not a clean and tidy built, lintian conform packge! I just hacked it together to have something that “just works”. And that’s what it actually should. Besides, be warned that the daemon takes quite long to shut-down, due to the fact that I’ve just used the regular /etc/init.d/skeleton to create an own /etc/init.d/istatd script, without going into deep workflow-checks. Here, the script takes something around half a minute to kill the istatd.

Anyway, now I’m going to take a look at the sources and see, if I could probably commit some enhancements to the projects. The last time I was doing C++ is *quite* a time ago, but it shouldn’t be too hard from what I’ve seen so far. On the project’s site it says that there’s no support for fans and temperature measuring, yet. I will check whether it’s possible to use lmsensors for getting those information and maybe hack it in – or even rewrite the daemon in C, what would be the best to do anyway.

Oh well, however. Enjoy the package.

Download: istatd_0.5.4-1_i386.deb

The current service-site describes the services mainly as synchronization option for your Ubuntu workstations, so that everything is kept up to date. My first thought on this was, that they’re using webdav (just like Apple does for their iDisk) for accomplishing this task, but as it seems, there’s no webdav involved. Maybe it’s built-up on Amazon’s S3?

I don’t know yet, since up to now I haven’t received my invitation to join and use this service. I was told that invitations are being sent amongst others depending on the service’s usage, so I really hope (since the ubuntuone.com isn’t that popular, yet) to receive mine soon.

Depending of how good this service works already, it could be a really good competitor to Apple’s MobileMe – especially if it should get an own “Exchange for the Rest of Us”, heh. I don’t know what’s planned to be implemented and as it seems there’s not much talking about that, but I’d really welcome it to see a working solution on that area.

As soon as I’ll receive the invitation, I will take Ubuntu One on a test-drive and try to see whether it would be possible to use this service on other distributions as well. I really can’t wait to get my hands on the service’s software, heh…

The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.

So, the GNOME Shell is actually a more lickable and not-so-crappy version of what we can remember from old Windows 98/2k times, usually called something like Talisman Desktop or similar. Those applications were replacements for the actual explorer.exe binary, which hooked into the system logon and tried to build a better looking and feeling, theme-able interface for the end-user. Though, these applications never really found a market niche, last but not least because of the mostly exorbitant pricing policy. A few time later these add-ons were pushed away by Windows XP’s own theming abilities.

However, as it seems the GNOME community now starting writing a similar add-on for the GNOME desktop, using features provided by modern soft- and especially hardware. The whole Shell is hardware accelerated and seems to be working pretty fluent – not only because it’s exceptionally not written in Python or any other sick scripting language. Instead, it makes use of native C code, combined with Clutter and hooks for JavaScript plug-ins.

From what I’ve seen so far, it’s not that bad and finally seems to really be an add-on that integrates into the desktop, instead of being just another application which I need to bound somehow into my GNOME desktop. My colleague just quickly compiled and ran it and at least on his nVidia accelerated hardware it worked out pretty smooth and at least while testing it didn’t crash once.

It could become a pretty cool and promising project, if the people running it will find somebody concerned about UI-Design/-Usability and maybe some graphical artists, too and maybe make it look more “stable”. At the moment, the whole ‘shell’ still looks pretty half-cooked, but of course, they’re just at their beginning. So let’s wait and see – or better even contribute and change!

53F9 D987 BB30 94E3 24DF 05D9 95C0 28A3 5D4E ED42

You can also find it linked on my contact page. I’ve also already revoked the old key on the MIT-PGP server, it’s just a matter of time until it gets unusable on all the other servers, too.

That’s it already. Later.

The biggest news is only visible if you pinged devilx.net before and re-ping it now: You would see, that its IP has changed. After my web-space’s performance at Strato got more and more terrible (download rates of 6kb/s), I decided to move my blog to a provider I’m more familiar with, where I pay less for even more: HostEurope.

The actual transition was pretty much squabbling, since the WordPress installation I was running at Strato was some never-changed-just-upgraded-from-1.x installation, where WordPress used a latin1-database. This caused me some trouble when moving to the new host, but I solved it by writing myself a conversion script that removes all “random” characters from the database-dumps and converted the databases to UTF-8. As front-end, I’m now running the latest WordPress-release available.

After I’ve finished the transition I looked at the Prologue-theme I was using and thought that an exchange (YES WE CAN!) could bring some freshness to my journal. Though, I had to keep in mind the work I hacked into my Prologue-theme (like for example the iPhone detection bundled with the theme-changer, and so on), since I didn’t want to lose these things. I’ve found a nice theme, downloaded and installed it and started extending it. The main problem with my actual Hemingway-theme is, that it doesn’t make use of standard WordPress widgets. Instead it uses its own widget-concept, what pretty much made me write every widget I wanted to use on my journal from scratch – and so I did. For some, I took existing WordPress widgets and transformed them to work with my current Hemingway, others, I hacked in from ground up. I will still need to extend the widgets a bit more, for example to make use of some caching, so that the widgets won’t reload each tweet or gallery picture every time a user opens a new link on my journal. Correction: Done. I’ve now implemented caching, even before going live, just to avoid data-transfer/connection troubles.

Altogether I hope that the browsing experience will be more enjoyable now. At the moment, the site’s speed seems to be pretty good, but I’ll keep an eye on it when the heavy usage starts. Feel free to write me some feedback regarding the site’s new layout and the site’s speed.

Enjoy!

However, so I thought, that either there just haven’t been many themes released since I’ve last checked (afair over a year ago) or there just haven’t been any good themes that were submitted and accepted at AGO. To verify that, I’ve taken a look at the gnome-look.org themes-section and proved my assumption true: I browsed through the first few pages of the GTK 2.x section and my eyes began to hurt. Then, I sorted the section to start with the highest-rated themes and my eyes hurt even more. One theme was – in the matter of quality and usability – worse than the other. Everywhere you looked only rough-cut pixmaps thrown together, added some really-not-looking-good background images to the menus and the window elements themselves and finished it all up with a foreground-color that either provided an exaggerated or an awfully low value of contrast. Meh.

The bummer is, that the majority of all themes look like that and only a few ones, mostly created by known artists like roberTO, Jakub and others really look tasteful and qualitatively good. In my opinion, this was and still is a major problem of the whole OpenSource community. OpenSource gives you the power to choose, modify and re-distribute, but I guess that exactly this power is being used in a wrong way – not only in the matter of control themes!

In general, especially within the Linux area, there are nearly no standards. Spoken from the designers’ view, there are not enough definitions like the GNOME UI-Design Guideline or the Tango Project, which try to convince and help the developers and/or designers to draw qualitatively better themes while still keeping up the freedom to choose and create. Of course, this won’t stop misbehaving designers to submit themes to un- or sloppy-moderated sites like gnome-look.org, but still it would provide the GNOME folks a “pressurizing medium” to say “You make it the good way, your theme might make it into our official project releases or at least on the cover of the official sites!“.

Though, for a real GNU/FSF-guy this way might sound like to much of “controlling” and “regulating” and by that lead to an operating system like for example Mac OS X (no, not Windows, there you have an even bigger problem regarding applications that look totally different than others) is. Still, most of these guys forget, that without at least a little bit of guide-lining, regulating and separating the wheat from the chaff especially the Linux Desktop will never make it into a higher market-share. There definitely is a reason, why companies like Novell and Red Hat keep up the hard and cost-intense work on their own UI-designs and improvements. If you want the users to be convinced about using a clean and stable operating system, you cannot simply stick with a UI on which the users’ thoughts are “Uh.” from the first click they’re doing. And of course, tastes are different and each user has a different one, but in one point all users will share the same opinion: An UI needs to be tidy and neat. No pixels. No exaggerated anti-aliasing (which should be better called “blur” in 90% of the existing GTK themes). Just a sleek and intuitive interface with clean structures and without distracting or even deranging elements (… like black backgrounds, white foregrounds and pixmaps that remind you of some white-noise-graph).

On software techniques the GNOME community seems to finally has understood what KDE is doing for years now already. There has to be a clean infrastructure (or backbone or whatever you’d like to call it) for solving problems and providing features. GNOME has started the move to GStreamer some years ago and now finally also moved to a backend (PulseAudio) which provides such an infrastructure. Also, introducing D-BUS and the HAL was a big step for the whole Desktop-Project, and the Gnome VFS seems to be trying to really compete with KDE’s now. So, as it seems, developers have finally recognized, that (especially in enterprise use) a desktop with no integration and where each application works different and uses a different infrastructure for providing audio, video or whatever else will never succeed against “the big ones”.

Unfortunately, in the matter of UI design, it still seems to take a while until contributors understand that it’s worthless drawing themes that look like Vista’s interface printed on a dot-matrix printer. By that, users of other desktop systems will always keep looking and thinking of Linux to be an unstable and totally not-integrative desktop-system, hacked together by some crazy, long-bearded freaks. Because for low-brown users, the UI is an essential element that helps them deciding whether a system looks usable to them or not. With an interface where each application looks the same, acts the same and allows the user to get this work done in an undisturbing way – and maybe adds a little bit of pleasure with smooth and clean looking effects (and by that I don’t think of wobbly windows!) – even someone that’s new to the matter will be able to get in touch with it quite fast.

I’m still waiting for the day on which especially GNOME’s interface-nazis finally make the move and decline all applications that do not strictly follow clearly defined designing guidelines for a clean and usable UI – even if it would throw out half of the applications shipped with a regular GNOME desktop (like Pidgin, OpenOffice.org, and so on…). Until then, I guess that Linux itself can be as solid as a rock, as fast as a lightening and free as free beer – it won’t be able to increase its popularity and climb the higher market-shares. Just because of the “look and feel”, which sometimes is just more important then pure functionality. Else, we would still be working on the CLI, wouldn’t we?

// btw: This is my 500th post I’ve been writing within over four years now already. Heh.

I’m using the service for the first time on a Mac, since at work I only tested out their functionality under linux and had quite some problems with S3. Amazon’s Simple Storage Service is pretty cool regarding their pricing and provides a very acceptable up- and download speed – other than for example my Strato FTP does. The only complicated thing for somebody who’s new in that domain might be the “How do I start?“-point. S3 uses a “web-interface” which communicates using a documented REST-API. Unfortunately, under Linux there aren’t many clients which actually can communicate with this interface. Actually, I’ve only found the S3-Firefox-Plugin, which provided a way to maintain the different buckets and their content. Under OS X, there are some more (mostly Java-based) clients, including the native Cyberduck more-than-FTP client, what surprised my pretty much. This was actually the point where I’ve switched from Panic’s “Transmit” to Cyberduck, by the way.

However, I created my own buckets and uploaded some content to use it as web-share and test out a bit more the speed it provides. One con I’ve found up to now is the bucket-naming. Your personal bucket subjects a global namespace, what can lead to period of time needed for finding a name which is not occupied yet. This makes it for example pretty hard to automize bucket creations, for using them in an own Cloud-Service.

Besides, the EC2 is pretty cool, too. It provides a very flexible and (in comparison to S3) very automatable solution for cloud computing in general. It’s very fast to set up a new instance of whatever linux or windows on EC2 and run the stuff needed on it. The only con is the pricing, I guess – In my opinion it’s way too much for a Xen-I-think-it-is machine. For the price you would pay within one frequent month you could get a real root server at some hosting provider. Of course, you would lose the flexibility, but surely it depends on what you’re looking for.

In total, I’m really stunned of the infrastructure Amazon provides with their EC2/S3/etc. Services and I like the smooth way everything works out on them. I could really think of some cool projects to realize on top of these services… hm.

So, after I’ve reconfigured the Demo VM to speak SSL, I created two different Groupware users and created the account for the first user on my iPod. I only tested the whole product using the E-Mail sync-service – since I did not wanted to lose my existing contacts or calendar entries – and configured “Push” for the new Exchange account. With the credentials of the second user, I logged-in via Zarafa’s (damn ugly) web-interface and wrote an e-mail to the first user, while having my iPod Touch lying on my table, unlocked, in “Home”-screen. The second I clicked the “Send”-button within the browser-window was the second in which a new badge popped up on my iPod, telling me that I have one unread E-Mail.

So actually the whole Zarafa/Exchange/Push stuff seem to work pretty good, though I don’t know yet how reliable it is. I will test this out a bit longer some time, because if it works the way it should, I could really think of using Zarafa on my private E-Mail account. Nor the world’s most advanced operating system‘s E-Mail client neither the iPod support IMAP IDLE yet, what makes it pretty uncomfortable when waiting for new E-Mails.

But eh.

OpenSuSE 11.1 Winter Boot-Screen?

Description: Some days ago, I arrived at work, booted my laptop and suddenly there was no more greenish boot-screen/-menu. Instead, there was some winter scenery with two walking penguins. I didn’t reconfigure anything the day before, the only thing I did, was installing an “autofs” patch which (as the description told me) should have fixed some serious bug. However, I still don’t understand what happened there, maybe just some easter-egg? But, it’s not eastern yet. However, after the next reboot, the boot-menu changed back to its regular appearance. Maybe just some of my colleagues was playing me a joke… hm.

The installation of OpenSuSE was as simple as it has always been and thanks to the DVD I had, I didn’t have to wait for the gigabytes of data to be transfered from the web-mirrors. After the installation was finished it took me around half an hour to configure my hardware. Unfortunately I still have the same problem I also had in Debian: My internal WiFi-card won’t connect to my AP. I guess it might be some damage on the hardware itself. However, after additionally installing some applications like Citrix’s ICA Client or the VPN Client, I customized the look and feel a bit and changed some settings here and there and… well.. I think, I’m pretty much ready now. I really like the installation, it runs pretty smooth and fast.

I’m planing to use it from now on and hope that it won’t get screwed again by some update which break my X11 or whatever, heh. I’ll see…

I can recognize some similarities there.

(and yes, installed Ubuntu 8.10 on VMware Fusion. Now I’m just building the VMware Tools for the Guest.)

My Linksys WRT54GL - now running OpenWRT!

Today the new hardware for my DSL 3k line arrived and I also installed it already. Everything works out pretty good so far. Now, with the new hardware, my Linksys WRT54GL became available for playing and hacking, so I’ve just started by replacing the Tomato Firmware I’ve had on it by the latest OpenWRT “Kamikaze” release (“openwrt-wrt54g-2.6-squashfs.bin”) available for my router. The whole replacement works out pretty good and fast, using the regular “Upgrade” function provided by Tomato. The OpenWRT documentation said, that image would be installable through Linksys’ regular upgrade-mechanism on the router’s stock interface, so I just tried it out with Tomato (since it’s mostly based on Linksys’ original firmware) – and OpenWRT runs!

The first thing I did was the reconfiguration of the WAN-Port to act as a DHCP-client instead of trying to establish PPPoE connections over it. Unfortunately I’ve seem to forgotten to configure the SSH service availability on that port. Tomorrow I’ll need to reconnect the router directly to my iMac using a LAN port and configure this feature. After that I’ll be able to keep it connected to my new router-hardware, on its LAN port.

I’ll see…

The actual reason, why I upgraded was KVM. Lenny seems to be getting more and more stable and by that usable as server system. Of course, it’s not etch yet, but since I’m trying to migrate from VMware (-Server) to KVM I’m actually forced to use Lenny. There are no KVM packages available for Etch, besides the ones from Backports.org. Unfortunatelly, even those are only available at version 28-4, what’s not that usable on a productive system.

However, so like I said, today I s/etch/lenny/g on my APT sources.list and ran an aptitude dist-upgrade. I was pretty surprised how fluent the upgrade worked out, the only thing it broke was the Roundcubemail I have installed on the machine for checking the Maildir via HTTP(S). Apache still works fine, Courier also runs, Fetchmail, and all the other stuff I had configured upgraded with nearly no problems.

Unfortunately, the upgrade still caused problems regarding my everyday-work. The most annoying thing is the fact, that I’m forced to use Icedove as mail client from now on, at least until some strange bug regarding the SSL authentication has been fixed in Evolution. The curious thing is, that with the previous version of Courier, Evolution worked just fine. I don’t know, what exactly the Courier developers changed, but it caused evolution to not be able anymore to authenticate against it. Some might say, it sounds like an Courier bug, but to be honest, I know how things are being implemented into Evolution and I don’t believe it’s Courier’s fault.

It’s pretty much a bummer, because I actually liked working with Evolution. Not because it’s fast – it’s not. And not because it’s light – it’s neither. And not even because it works perfectly in the infrastructure I’m sitting in – it definitely did not. But Evolution unfortunatelly is the only mail reader for the GNOME desktop environment, which really integrates into the desktop. I could always take a quick look at the meetings/appointments I have for a specific test, by just clicking the the clock on my menubar. Also, it was integrated into GNOME’s keyring, so that my mail-account password was just getting unlocked after the login.

However, this tiny, integrative features enhanced the usability of Evolution a lot, even if everything else might just suck. Now I’m trying to find out which bugreport documented the problem I’m experiencing, to put myself on CC. I’m really wondering when this will be fixed. If it takes as long as fixing problems regarding shared folders or caldav, then I guess I’ll just try to say Hello! to my future e-mail client Icedove.

Meh.

conn nat-t
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
left=192.168.10.193
leftsubnet=10.1.0.0/24
leftfirewall=yes
right=%defaultroute
rightid=client@example.com
rightsourceip=10.100.0.2
auto=add

We added a new virtual IP (rightsourceip) for the client. The network of this IP will be defined on the server’s configuration. We need this for the whole scenario to work out, even if the client/Roadwarrior is behind a NAT. As rightid (client-id) we use the client’s e-mail address.
Server config:

config setup
plutostart=no

conn nat-t
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
left=10.1.0.4
leftsubnet=10.1.0.0/24
leftid=192.168.10.193
leftfirewall=yes
right=%any
rightid=client@example.com
rightsubnetwithin=10.100.0.0/24
auto=add


Here, we also defined the client’s e-mail address as rightid, defined that the right side could be anything (“%any”) and told the server to serve the virtual network 10.100.0.0/24 for the right side. By that, the configuration can be applied to different clients and the actual IP configuration is provided on the client’s side. Yet, I did not find out whether there’s a possibility to set up some DHCP server and provide connecting clients a dynamic address automatically.
However, this setup now also works with Roadwarriors that are behind NATs, what means that the actual setup could look like this:

[roadwarrior]—-[nat]—internet—[nat]—[server]—network

Isn’t this cool?
Enjoy.

Anyway, I flew over the release notes and I have to say that the whole stuff sounds pretty cool: ASP.NET 2.0 API, System.XML 2.0, System.Drawing 2.0, Mono.Cairo,C# 3.0 compiler with full LINQ support, Visual Basic 8 compiler (yay! :-D), the dotNET 2.0 Strip-Set, the FlowLayoutPanel and many more. So maybe, from this point maybe Mono could really become a real alternative to dotNET, if things keep going on like this.

However, I was wondering whether there are downloads for Mono on the Mac, but unfortunatelly the project doesn’t provide an installer for Mono 2.0 yet. Not that I would really use Mono-applications on my Mac (mostly because there still aren’t any available which use the Mac’s native interface toolkit – and I don’t really want to use GTK# on a Mac) but it would be nice for some little hacking or even writing smaller (CLI-) tools which would run on any Mono-able platform.

However, I think that the first thing I’ll do is to wait for the according packages to receive in Debian Experimental and set up some VM with an Apache that speaks ASP.net 2.0. I’m really interessted how far Mono already supports the ASP stuff and what could be done with it. The MojoPortal already is a great demonstration, but are more complex projects also possible yet?

I will see…