ASTERISK TRIXBOX ADHEARSION VOIP SELINUX SIP NAT JUUHNAL Since 1994: The Original Magazine of the Linux Community ASTERISK FOR CONVENIENT PHONE CALLS Do Telephony WIRESHARK SNIFFS VOIP PROBLEMS VOIP THROUGH NAT EMBEDDED ASTERISK ADHEARSION WITH ASTERISK COMMUNIGATE PRO AND VOIP MARCH 2007 ISSUE 155 www.Unuxjournal.com PLUS: The D Language Enterprise and High-Performance Computing Under Your Control Industry Leading 4P x86 Computing Innovative server technology with outstanding performance and memory scalability 4-Way ^Tfre/neWorkstation™ • AMD Opteron™ processors • Featuring AMD Socket F (1207) • XGi Volari Z9 graphics chip • Up to 128GB of DDR2 533/667 memory • Up to 6.0TB SATA or 2.4TB SAS • 2 PCIe x16, 1 PCIe x4 and 3 PCI-X • Redundant fans • Hot-swappable drives • Windows® or Linux OS 4-Way 3U JKtreme Server™ * • AMD Opteron™ processors • Featuring AMD Socket F (1207) • Up to 128GB of DDR2 533/667 memory • Up to 4.5TB SATA or 1.8TB SAS • 3 PCI-X and 2 PCI Express x16 • Redundant power supplies and fans • Hot-swappable drives • ServerDome Management - IPMI 2.0 • Windows® or Linux OS Leveraging Xen Virtualization with the Appro XtremeServer Go to http://www.appro.com/whitepaperA/Vhite Papers.asp AMD Opteron™ Processors: • Quad-Core Ready - increase capacity without altering datacenter infrastructure • Best performance per-watt with energy-efficient DDR2 • Optimized system performance with Direct Connect Architecture For more information, please visit www.appro.com or call Appro Sales at 800-927-5464 or 408-941-8100. Today, Dan configured a switch in London, rebooted servers in Sydney, and watched his team score the winning goal in St. Louis. With Avocent data center solutions, the world can finally revolve around you. Avocent puts secure access and control right at your finger tips - from multi-platform servers to network routers, your local data center to branch offices, across the hall or around the globe. Let others roll crash carts to troubleshoot - with Avocent, trouble is on ice. To learn more, visit us atwww.avocent.com/iceto download Data Center Control: Guidelines to Achieve Centralized Management whitepaper or call 866.277.1924 for a demo today. W v Avocent, the Avocent logo and The Power of Being There are registered trademarks of Avocent Corporation. All other trademarks or company names are trademarks or registered trademarks of their respective companies. Copyright © 2006 Avocent Corporation. CONTENTS MARCH 2007 Issue 155 50 Time-Zone Processing with Asterisk, Part I Hello, this is your unwanted wake-up call. Matthew Gast 56 Home Box to Trixbox Add a digital receptionist to your home. Michael George 66 How to Configure SIP and NAT Swatting NAT for VoIP. Sean Walberg 70 Expose VoIP Problems with Wireshark Shark in the network. Sean Walberg ON THE COVER • An MPD-Based Audio Appliance, p. 86 • Asterisk for Convenient Phone Calls, p . 50 • Wireshark Sniffs VoIP Problems, p. 70 ||« VoIP through NAT, p. 66 ||« Embedded Asterisk, p. 78 • Adhearsion with Asterisk, p. 74 • CommuniGate Pro and VoIP, p. 82 • The D Language, p. 90 2 | march 2007 www.linuxjournal.com ILLUSTRATION ©ISTOCKPHOTO.COM/STEFAN WEHRMANN The competition doesn’t stand a chance. If you base deployment decisions on performance and price, Coyote Point’s for you. We've cornered that market. To prove it we asked The Tolly Group to evaluate our E350si application traffic manager against the competition. The results speak for themselves. Throughput? Almost 40% more than others in our space. Cost of transactions per second? Up to four times less. Connection rate? In some cases, one-sixth the cost. One-sixth! And we're told Coyote Point is the #1 choice for today's open source networks. But don’t just take our word for it. Get the facts. Call 1.877.367.2696 or write info@coyotepoint.com for your free copy of the full Tolly Report. •V CoyotePoint r\C ^ CONTENTS Sif COLUMNS _ 18 REUVEN M. LERNER'S AT THE FORGE Dojo 22 MARCEL GAGNE'S COOKING WITH LINUX Free Long Distance—Really! 28 DAVE TAYLOR'S WORK THE SHELL Compact Code and Cron Contraptions MICK BAUER'S PARANOID PENGUIN Introduction to SELinux, Part II 34 JON ''MADDOG" HALL'S BEACHHEAD _ Wavsmall _ 36 DOCSEARLS' LINUX FOR SUITS DIY Internet Infrastructure 96 NICHOLAS PETRELEY'S /VAR/OPINION Dealing with the Devil QUICK TAKES _ 48 COYOTE POINT EQUALIZER E550SI LOAD BALANCER Logan G. Harbaugh IN EVERY ISSUE | LETTERS 112 UPFRONT 1 TECH TIPS NEW PRODUCTS 1 ADVERTISERS INDEX INDEPTH 74 APPLYING ADHEARSION TO ASTERISK A gem of an Asterisk tool. Jay Phillips 78 COMBINE UCLINUX AND ASTERISK ON A CARD uClinux is the Digi-Key to embedding Asterisk. David Rowe 82 VOIP WITH COMMUNIGATE PRO How to do VoIP with CommuniGate Pro. Daniel Sadowski and Stephen Pratt 86 BUILDING A MULTI-ROOM DIGITAL MUSIC SYSTEM MPD on simple hardware goes a long way. Chad Files 90 THE D PROGRAMMING LANGUAGE What comes after C++ and C#? Ameer Armaly Next Month SECURITY You're running Linux but does that mean your systems are as secure as they need to be? Next month, we'll help you find out and give you what you need to lock down and manage your Linux environments. We'll tell you why Single Packet Authorization (SPA) is a step up from port knocking, and then we'll follow up in the next issue with instructions on how to implement SPA. How does your filesystem security stack up? It stacks nicely with eCryptfs, as you'll see. We'll take you under the hood of Multi-Category SELinux and explain the details behind OpenSSH. As always, there's much more. We'll show you how to create dynamic forms and reports with Inkscape and XSLT, and follow up with more information about time-zone pro¬ cessing with Asterisk. We'll tell you why MySQL deserves a double-take, and Marcel Gagne will explore Mondo Rescue disaster recovery. USPS LINUX JOURNAL (ISSN 1075-3583) is published monthly by Belltown Media, Inc., 2211 Norfolk, Ste 514, Houston, TX 77098 USA. Periodicals postage paid at Houston, Texas and at additional mailing offices. Cover price is $5 US. Subscription rate is $25/year in the United States, $32 in Canada and Mexico, $62 elsewhere. POSTMASTER: Please send address changes to Linux Journal, PO Box 980985, Houston, TX 77098. Subscriptions start with the next issue. 4 | march 2007 www.linuxjournal.com Gemini • Two fully independent systems in a 2U • Ability to run two discrete operating systems in one box • Up to 16 CPU cores • Up to 12 hot-swappable SATA, SCSI, or SAS hard drives • RAID 0, 1, 5, 6, 10, 50 available on both systems • Opteron™ or Xeon™ multi-core processors • Up to 64GB memory per motherboard • One available PCI-X or PCI-E slot per motherboard • High efficiency AC and DC power options 2 Systems in One Built on open standards, the Gemini 2U elegantly accommodates two discrete motherboards in a 25" chassis uniquely designed for easy access from the rear. Gemini 2U represents the realization of intoxicating power and superior environmental specifications, with considerably less power consumption, less heat and less noise. Remarkably, it all fits nicely into any standard rack. Front to back, Gemini 2U is both powerful and efficient. At Open Source Systems we understand you need practical, customizable, and affordable solutions that are easy to manage and maintain. For more information and to request your evaluation unit today, visit us at www.OpenSourceSystems.com, or call direct at 866.664.7867. ©2006 Open Source Systems, Inc. All Rights Reserved. AMD and AMD Opteron are trademarks or registered trademarks of Advanced Micro Devices, Inc. Other company products, names, and logos may be trademarks or service marks of others. LINUX JOURNAL. Since 1994: The Original Magazine of the Linux Community Digital Edition Now Available! Read it first Get the latest issue before it hits the newsstand Keyword searchable Find a topic or name in seconds Paperless archives Download to your computer for convenient offline reading Same great magazine Read each issue in high-quality PDF Try a Sample Issue! www.linuxjournal.com/digital LINUX JOURNAL Editor in Chief Nick Petreley, ljeditor@linuxjournal.com Executive Editor Jill Franklin jill@linuxjournal.com Senior Editor Doc Searls doc@linuxjournal.com Art Director Garrick Antikajian garrick@linuxjournal.com Products Editor James Gray newproducts@linuxjournal.com Editor Emeritus Don Marti dmarti@linuxjournal.com Technical Editor Michael Baxter mab@cruzio.com Senior Columnist Reuven Lerner reuven@lerner.co.il Chef Fran^ais Marcel Gagne mggagne@salmar.com Security Editor Mick Bauer mick@visi.com Contributing Editors David A. Bandel • Greg Kroah-Hartman • Ibrahim Haddad • Robert Love • Zack Brown • Dave Phillips • Marco Fioretti • Ludovic Marcotte • Paul Barry • Paul McKenney Proofreader Geri Gale Publisher General Manager Director of Sales Regional Sales Manager Circulation Director Marketing Coordinator System Administrator Webmaster Accountant Carlie Fairchild publisher@linuxjournal.com Rebecca Cassity rebecca@linuxjournal.com Laura Whiteman laura@linuxjournal.com Joseph Krack joseph@linuxjournal.com Mark Irgang mark@linuxjournal.com Lana Newlander mktg@linuxjournal.com Mitch Frazier sysadm@linuxjournal.com Keith Daniels webmaster@linuxjournal.com Candy Beauchamp acct@linuxjournal.com Linux Journal is published by, and is a registered trade name of, Belltown Media, Inc. PO Box 980985, Houston, TX 77098 USA Editorial Advisory Board Daniel Frye, Director, IBM Linux Technology Center Jon "maddog" Hall, President, Linux International Lawrence Lessig, Professor of Law, Stanford University Ransom Love, Director of Strategic Relationships, Family and Church History Department, Church of Jesus Christ of Latter-day Saints Sam Ockman, CEO, Penguin Computing Bruce Perens Bdale Garbee, Linux CTO, HP Danese Cooper, Open Source Diva, Intel Corporation Advertising E-MAIL: ads@linuxjournal.com URL: www.linuxjournal.com/advertising PHONE: +1 713-344-1956 ext. 2 Subscriptions E-MAIL: subs@linuxjournal.com URL: www.linuxjournal.com/subscribe PHONE: +1 713-589-3503 FAX: +1 713-589-2677 TOLL-FREE: 1 -888-66-LINUX MAIL: PO Box 980985, Houston, TX 77098 USA Please allow 4-6 weeks for processing address changes and orders PRINTED IN USA LINUX is a registered trademark of Linus Torvalds. Typhoon™ 600 Series Personal Supercomputer TyanPSC's Typhoon™, the next generation turnkey Personal Supercomputer has the power to blow away all your computational needs! Purpose-built for office and laboratory environments, easy to deploy and use, the Typhoon™ provides intense computational power in remote or constrained places, works like a PC and is whisper quiet. High Performance Computing Just Got Cooler Clusters of Typhoons / Low Power Small size Form Factor / Under Mobility T-630 DX/T-650 QX Series • Up to 186 / 256 GFIops at your desk! • Turnkey, Easy-to-Deploy, and Easy-to-Use • Integrated 5 node cluster - up to 20 / 40 processor cores in a box! • Plugs into standard wall outlet - only uses 15 Amps • Microsoft® Windows® Compute Cluster Server 2003 pre-installed • High Performance in Constrained spaces: Office, Remote, Plane, Boat, etc • RAID capable /%. Windows Compute Windows® Cluster Server 2003 DflNPSG Personal Supercomputer Tyan Computer USA 3288 Laurelview Court Fremont, CA 94538 USA Tel: +1-510-651-8868 Fax: +1-510-651-7688 Pre-Sales Tel: +1-510-651-8868x5120 Email: marketing@tyan.com For More ln|j R»at» 1; ptemmvreit l www.tyanpsc.com letters Gnull and Voyd Just when I thought you could not possibly come up with a column more irritating than Marcel Gagne's Cooking with Linux (full of useful information embedded in silliness), you bring us Gnull and Voyd. Give us the tech tips; please lose the trailer trash schtick. Patrick Wiseman As you (and others) wish. Tech tips stay; Gnull and Voyd go. — Ed. !Gnull and Voyd Keep up the good work. I enjoy your /var/opinion column, and I continue to look for Reuven Lerner's fine columns. You folks have helped me become a better system administra¬ tor over the years, and I thank you for that. David MacDougall Forgiveness A few months ago, I wrote to you saying we had to break up—-you had become too chatty and opinion-filled for my taste. I have to admit that it turns out I was bluffing. I love you too much, and today, I renewed my subscription. You did take a significant dip in quality, but things have gotten better the last couple of months. More important, though, is the fact that you started from such a high-quality base that even when it dipped, you were still the only Linux publication for me. Andy Balaam V Organized Repression Your/var/opinion [January 2007] regarding the trade-offs between GPLs versions 2 and 3, reminded me of a wry remark that's worth repeating: "There's no such thing as freedom—it's just a question of how the repression is organised!" Struan Bartlett More Than Just Developers You claim that "the only people who are truly harmed by having the software on ROM are the tiny minority of hackers who want to run a modified version of the software on the gad¬ get" [January 2007 /var/opinion]. This state¬ ment is false. Hackers may be the only people whose goals are directly impeded by immutable embedded software. But where does the soft¬ ware created by hackers eventually trickle down to? The user, who would know no more about the software than how to load it into the device and make use of whatever enhanced features it provides. The "vast majority" of users are harmed by the chilling effect on a "tiny minority" of capable developers because they do not benefit from the software that otherwise would have been developed. Ryan Underwood Point taken. But if the source code is avail¬ able, as it must be under GPLv2, then developers can learn from it and use it, just not on a particular device. — Ed. DocBook XML and CSS David Lynch's November 2006 article on using DocBook XML to build simple Web sites was timely for me. For many years, I'd been writ¬ ing the documentation for my open-source projects in raw HTML, but I've recently "seen the light" and now use a combination of DocBook XML and CSS. However, my deploy¬ ment approach is quite different from David's. Instead of relying on frames and the brows¬ er's ability to convert XML to HTML—and suffer from the complications this brings—I simply convert the DocBook XML to HTML off-line, then upload the output to my Web site. This is a much simpler approach that still preserves the key advantages of DocBook. I recommend it to anyone writing software manuals or simple Web sites, looking for a clean split between content and presentation. For an example of how it's done, download the HR-XSL Project (hr-xsl. sou reef orge.net), and look in the doc directory. Trevor Harmon Ode to Joy Jon Hall is making some extremely weak arguments against patents [Beachhead, January 2007], First and foremost, the argument should not be if we should have software patents. The argument should be on how software patents and patents in general are implemented and maintained. Although it may take me several years to come up with a completely new operating system, it may take someone else only a few weeks or months. This does not mean that this new, novel operating system should not be patented and protected so that big companies cannot steal it. You see, to invent something, the inventor is usually intimately involved in that field or research. Sometimes the best ideas just appear out of nowhere. The idea itself may be easy or hard to implement, it may require more or less time, but what matters in the end is the ingenuity and usefulness. This is one thing everyone who is complaining about patents is missing. Patents are there to protect the small guy. It is not the other way around. It may look like that today, as the imple¬ mentation and enforcement of the patent laws may be unfortunate, but ultimately, the idea behind a patent is to protect your invention. Imagine a world with no copy protection, trade¬ marks, patents or other laws protecting ingenu¬ ity and uniqueness. In a short period of time, there would be no invention, no new music or works of art. We would see only repeats and same stuff over and over again. There would be no incentive to innovate. It would simply not be a smart investment to invest in invention. That kind of world would be just terrible. To some extent, this is already happening with software development. Small shareware developers that used to drive invention and put pressure on big companies are now hav¬ ing very little reason to invent. It is hard to protect the invention, and if they don't 8 | march 2007 www.linuxjournal.com [LETTERS] Breaking Numbers Down I read with interest "Breaking Numbers Down" [Dave Taylor's Work the Shell, U, December 2006], having recently dealt with this problem myself. I believe be is a generally overlooked, but very powerful, UNIX utility. Taylor's script nicely illustrates the use of be, and it is very useful for most purposes, but unfortunately, it doesn't scale well when dealing with the entire range of binary prefixes (en.wikipedia.org/wiki/Binary_prefixes). First, the numeric test -It used to find the first non-zero {kilo|mega|giga}int fails with numbers larger than 2 73 -1 (at least on bash-3.0-8.2 running under kernel 2.6.8-24.25-smp). Second, to extend this to deal with petabytes, exabytes, zettabytes and yottabytes, a total of 16 calls to be must be employed, with the attendant overhead of shelling out to the system for each. An alternative, which uses be more efficiently and avoids testing a number too large for shell, follows: # total letters nc='echo -n $1 | wc -c' # numeric letters nn='echo -n $1 | tr -cd ’[0-9] ' | wc -c' if [ -z "$1" -o $nc -ne $nn ] ; then echo "Usage: kmgp < integer>" echo " where 0 <= integer <= exit 1 fi SIprefix=" KMGTPEZY" # kilo, mega, giga, tera, peta, *exa, zetta, yotta # what is the closest power of 1024? # ( In(1024)=6.93147180559945309417) order='echo "scale=0 ; 1 + *1 ($1) / 6.93147180559945309417" | be -1' # find the letter associated with this power of 1024 letter='echo "$SIprefix" | cut -c $order' if [ $nn -gt 3 then scale=3 else scale=0 fi value='echo "scale=$scale ; $1/(1024 A ($order-1))" be -1' echo "$value$letter" This version contains two calls to be and one to cut. The calls to be merit some discussion: The first: # what is the closest power of 1024? # ( In(1024)=6.93147180559945309417) order='echo "scale=0 ; 1 + *1 ($1) / 6.93147180559945309417" | be -1' determines the closest power of 2 10 by using the fact that dividing a logarithm by the logarithm of N is the same as taking its Nth root. The offset by one compensates for the fact that cut is one-based, not zero-based. Note that we are loading bc's math libraries by using be -I. The second: value='echo "scale=$scale ; *>$1/(1024 A ($order-l))" | be -1' divides by 1024 raised to the correct order and scales to an appropriate number of decimal places. Averaging the time taken for both scripts on 400 arbitrary numbers, I find that the logarithm-based script is a little more than three times faster. On the other hand, if numbers larger than several hundred gigabytes are of no interest, the original script is faster. John protect it, someone bigger will come along and take their market, or if that doesn't happen, a less usable, but free version will be published. Why invent? It's better to steal someone's idea, hire some cheap labor and just put the money into marketing rather than R&D. On a side note regarding the music and visual art comments Jon made: imagine if I could copy Ode to Joy, then add two notes at the end of the piece and claim it as my own. If I could market it better and more strongly than the original composer (Beethoven), who would be able to say who actually wrote that piece of music in the first place (assuming I was living in the same time period)? More important, if that were to happen to Beethoven, would he be able to write a single piece of music again without being afraid some¬ one will steal it? Would he write music at all? Nebojsa Djogo Jon "maddog" Hall replies: I agree entirely that "big companies" (or anyone else) should not be able to steal your work, but I disagree that software patents are the way to make sure that doesn't happen. Copyright, contract and licensing law were applied to software a long time before soft¬ ware patents generally became coded into law in 1995. People were protecting their software way before software patents were generally available. Regarding the big and small point—the small software creator does not have the money to fight a software patent battle in court. Witness the contest between RIM and NTP recently, where three of NTP's four claimed patents were www.linuxjournal.com march 2007 | 9 [LETTERS] overturned at a cost of millions of dollars in legal fees. The fourth one might have been overturned, but RIM and NTP decided to "settle". The only people who won from this debacle were the lawyers. I did not advocate a world without "copy protection", only software patents. I (and most of the Free Software community) appreciate copyrights, trademark and trade secret laws for the protection of people's ingenuity. Free Software relies on copyrights for its licensing. Regarding the Beethoven scenario — Beethoven would have sued you for copy¬ right infringement and probably would have won in court. But, he would not have been able to block you from using a triplet, or some other "process" of writing music. Unfortunately, patents are not foolproof in protecting an invention. Witness the issues around Alexander Graham Bell and Antonio Meucci (www.italianhistorical.org/ MeucciStory.htm). All Beethoven would have had to do was publish his symphony in any public, dated document (a much simpler and less costly procedure than a patent applica¬ tion), and it would have been protected by copyright law. Thank you for writing your letter, but I stand my ground against software patents. At the Forge Reuven's column in Linux Journal is one of my favorites, and I read and read it again, but the one in the January 2007 issue is one of the best articles I have ever read in Linux Journal. Please offer my thanks to Reuven for his job. Stefano Canepa Myths? I appreciated Paul McKenney's article explaining recent advancements in real¬ time Linux ["SMP and Embedded Real Time", January 2007], and I especially enjoyed the "priority boost" comic strip in Figure 13. However, I was a bit disappointed at his attempts to dispel certain "myths" about parallel and real-time programming. In Myth #2, for instance, I was hoping for some insight as to why parallel programming is not "mind crushingly difficult". Unfortunately, Dr McKenney's explanation was nothing more than a declaration that "it is really not all that hard". Until I see a more substantial argument to dispel this so-called myth, I'm inclined to believe that parallel pro¬ gramming is in fact quite difficult. To para¬ phrase Edward A. Lee: insanity is to do the same thing over and over again and expect the results to be different; therefore, pro¬ grammers of parallel systems must be insane. Also, in Myth #5, Dr McKenney is propa¬ gating a myth instead of dispelling one. He notes that as Web sites become spread across multiple servers—load balancers, firewalls, database servers and so on—the response time of each server must "fall firmly into real-time territory". Here he equates "real time" with "real fast", which is such a common myth, it probably should be at position #1 in his list. In fact, real-time systems are all about predictability, not speed, and their design often sacri¬ fices performance for predictability. And yet, Dr McKenney implies that moving Web servers to a real-time environment will magically reduce their response times. This is simply not true. The response time of a Web server goes up only in the presence of overload—too many people hitting it at once—and when this happens, a real-time Web server will fail just as easily as a non-real-time server would. I hope that any Web admins out there who have been inspired by Dr McKenney's article will put down their copy of Ingo Molnar's real-time preemption patch and forget about real-time Linux. Simply adding another server behind their load balancer will have a much greater impact in improving overall response time—and require far less effort! Trevor Harmon Typo There is a mistake in David Lynch's January 2007 article "How to Port Linux when the Hardware Turns Soft". He says that BSP stands for Broad Support Package. This is incorrect. The correct expansion is Board Support Package. Trevor LINUX JOURNAL fit Your Service MAGAZINE PRINT SUBSCRIPTIONS: Renewing your subscription, changing your address, paying your invoice, viewing your account details or other subscription inquiries can instantly be done on-line, www.linuxjournal.com/subs. Alternatively, within the U.S. and Canada, you may call us toll-free 1-888-66-LINUX (54689), or internationally +1-713-589-2677. E-mail us at subs@linuxjournal.com or reach us via postal mail, Linux Journal, PO Box 980985, Houston, TX 77098-0985 USA. Please remember to include your complete name and address when contacting us. DIGITAL SUBSCRIPTIONS: Digital subscriptions of Linux Journal are now available and delivered as PDFs anywhere in the world for one low cost. Visit www.linuxjournal.com/digital for more information or use the contact information above for any digital magazine customer service inquiries. LETTERS TO THE EDITOR: We welcome your letters and encourage you to submit them to ljeditor@linuxjournal.com or mail them to Linux Journal, 1752 NW Market Street, #200, Seattle, WA 98107 USA. Letters may be edited for space and clarity. WRITING FOR US: We always are looking for contributed articles, tutorials and real- world stories for the magazine. An author's guide, a list of topics and due dates can be found on-line, www.linuxjournal.com/author. ADVERTISING: Linux Journal is a great resource for readers and advertisers alike. Request a media kit, view our current editorial calendar and advertising due dates, or learn more about other advertising and marketing opportunities by visiting us on-line, www.linuxjournal.com/advertising. Contact us directly for further information, ads@linuxjournal.com or +1 713-344-1956 ext. 2. ON-LINE WEB SITE: Read exclusive on-line-only content on Linux Journal's Web site, www.linuxjournal.com. Also, select articles from the print magazine are available on-line. Magazine subscribers, digital or print, receive full access to issue archives; please contact Customer Service for further information, subs@linuxjournal.com. FREE e-NEWSLETTERS: Each week, Linux Journal editors will tell you what's hot in the world of Linux. Receive late-breaking news, technical tips and tricks, and links to in-depth stories featured on www.linuxjournal.com. Subscribe for free today, www.linuxjournal.com/enewsletters. V 1 0 | march 2007 www.linuxjournal.com Play with fun tovs Garmin International, the world leader in GPS technology located in Olathe, Kansas, is growing at a rapid rate. We are on the hunt to find the best and brightest individuals to help us continue creating cutting edge products. ow** POSITIONS CURRENTLY AVAILABLE INCLUDE: LINUX SOFTWARE ENGINEER IRC265 This person will be responsible for developing software for Garmin's communication and navigation products. This requires the candidate to be experienced in C, C++ or other selected languages for either embedded or application development for desktop Linux in accordance with Garmin software development methodology. Responsibilities will include testing software using debuggers, emulators, simulators and logic analyzers, performsoftware releases and software quality assurance activities and maintenance on products already in production and new product software design. The ideal candidate will have a Bachelor of Science degree in Computer Science, Electrical Engineering or Computer Engineering from a 4 year college or university or the above/equivalent education or experience. Excellent academic record of composite GPA of 3.0 or better and experience and/or training in high level languages such as C, C++ for either embedded or desktop Linux. Working knowledge of the GNU tool chain for software development and experience with application frameworks such as Gtk+, Gtkmm, Qt, and Qtopia. SYSTEMS ADMINISTRATOR - INTERNET IRC385 This person will be pri¬ marily responsible for maintaining the infrastructure that powers the Garmin web site. This requires the candidate be experienced supporting Open Source web systems including Linux, Apache, JBoss and MySQL, load balancing devices, security tools, and assisting developers. The candidate must show proven capability to support a highly available web site as well as the underlying infrastructure required to provide stability, security, and scalability on the Internet. This includes intimate knowledge of Bind, LDAP, J2EE, email, ethernet and wide area networking. Security skills and knowledge, and an ability to clearly communicate these concepts and requirements, is essential. The ideal candidate will have worked 2+ years as a Network or Web engineer supporting a web site that takes millions of hits per day, and includes brochure as well as ecommerce and advanced data delivery functionality The ability to work with application and site developers to deploy scalable, secure and stable web applications is required. Support for IIS, MS SQL, Windows, and Oracle iAS is needed. Experience operating in a co-located or remote-hosted and global load balanced environment is a plus. Knowledge of emerging Internet technologies and standards is expected. On-call support is required. For more information or to apply on-line, visit our website at www.garmin.com/careers. GARMIN FRONT NEWS + FUN Promise has released hardware specifications for the full line of chipsets supported by the sata_promise.c driver. This is excellent news, especially considering that Promise has been reluctant to release any specs until now. Jeff Garzik has been negotiating with them on this issue for a while now, and as this news shows, he has made significant headway. It's great to see Promise begin to turn around on this issue. Karel Zak is working toward forking the util-linux project or taking it over from Adrian Bunk. Karel maintains the Red Hat package, and Adrian has not been as active as Karel would like on the project lately. Karel posted to the linux-kernel mailing list recently, explaining his plans to create a git reposi¬ tory and home page for the project and to start merging known bug fixes into the code base. His intention is to make the transition as peaceful as possible and have a good handoff from Adrian. As H. Peter Anvin points out, an outright forking of the code could be the best way toward that peaceful transition. As he says, once Adrian sees that Karel is able to do a good job, he might feel less reluctant to let go of the project. Mikulas Patocka has released an initial version of SpadFS, a new filesys¬ tem he created as part of his PhD thesis. It attempts to solve the problem of sudden reboots in a simpler way than journalled filesystems. Mikulas finds journalling too complex and bug-prone, preferring a method that he calls crash counting. In this technique, the filesystem keeps track of whether it has been mounted or unmounted; it also tags fresh data with this information, until the data can be written properly into a consistent state. If the computer crashes and comes back up, the filesystem will notice that its saved mount state doesn't match its current mount state, and it can then revert to the most recent consistent state of its data. SpadFS seems to be on the fast track to kernel inclusion, with support from Linus Torvalds, who has gone so far as to say that it "doesn't look horrible" to him. The brand-new ext4 filesystem has been accepted into the official kernel. Actually, at its current state of development, it's more just ext3 with some additional patches, making acceptance a much less difficult prospect than other filesystems, notably ReiserFS. But unlike ext3, the ext4 code will continue to accrue new features and undergo other large changes. These large changes were one of the primary reasons why Linus Torvalds insisted that the developers give the project a new name. The filesystem, he said, should be completely trustworthy. Once stabilization occurs in a filesystem, he believes that should be the end of it. Little enhancements and bug fixes might still be okay, but for larger changes involving greater risk of data corruption and other problems, a stable filesystem just should not have to go through that. This was the motivation behind forking ext2 into ext3, and probably will be the motivation behind forking ext4 to ext5 in a few years. Presenting a system's power source to the user via a consistent interface has not been a high priority in kernel development until recently. Each different type of battery has had its own interface into the kernel, creating a generally hard-to-use mess. But David Woodhouse recently announced a generic battery class driver, regularizing the entire interface. He is even considering adding an AC power interface to this driver, though there have been some voices of dissent. Richard Hughes, for instance, feels that batteries and AC power are sufficiently different to warrant a separate driver for each. But as David currently sees it, the two interfaces will be so similar that there's no point in duplicating a driver for each. So far, the debate has not been decided. Having at least one generic power driver, however, does seem to have a lot of support among the kernel hackers. — ZACK BROWN U Index, March 2007 1. Number of journalists in prison, worldwide, on December 7, 2006: 134 2. Increase in jailed journalists over one year earlier: 9 3. Number of nations with jailed journalists: 24 4. Number of jailed journalists that are Internet-based: 67 5. Position of China among the world's leader in jailed journalists: 1 6. Number of jailed journalists in China: 31 7. Firefox's market share percentage in Slovenia: 39 8. Firefox's market share percentage in Finland: 35.4 9. Firefox's market share percentage in Slovakia: 34.3 10. Firefox's market share percentage in Poland: 32.3 11. Firefox's market share percentage in the Czech Republic: 31.3 12. Firefox's market share growth rate percentage in France: 19.5 13. Firefox's market share percentage in North America: 13.5 14. Firefox's market share percentage in Oceania: 21.4 15. Average minutes and seconds spent on a Web site over mobile phone: 2:53 16. Average minutes and seconds spent on a Web site over other connections, including PCs: 5:03 17. Linux server revenue in billions of dollars for the last measured quarter: 1.5 18. Linux year-over-year revenue growth percentage: 5.4 19. Linux share percentage of all server revenue: 11.8 20. Reliability rank of Linux-based Tiscali: 1 Sources: 1-6: Committee to Protect Journalists | 7-16, XiTi Monitor | 17-19: IDC | 20: Netcraft.com — Doc Searls diff -u WHAT'S NEW IN KERNEL DEVELOPMENT 12 | march 2007 www.linuxjournal.com [UPFRONT] Cast Freely Campware has released Campcaster 1.1, an open-source radio broadcasting system that runs on Linux (Debian and Ubuntu, so far) and is made to scale from individuals to staffed stations to multiple stations in a network. Features include: > Live, in-studio playout > Web-based remote station management > Automation > Playlists > Centralized program material archives > Fast playback (using GStreamer) > Program sharing > Search-based backup > Localization > Open, extensible architecture (including extensive use of XML-RPC APIs) Campcaster is the latest open-source prod¬ uct from Campware, an initiative that supports independent news and media organizations in emerging democracies. Other products are Campsite (multilingual news publishing), Cream (customer relationship management or CRM) and Dream (newspaper distribution management). Find links to all and more at campware.org. If you're interested in Campcaster, you also may want to look at Rivendell, a heavy-duty radio broadcast automation system developed by Salem Radio Labs, a division of Salem Communications, which owns one of the largest chains of radio stations in the US. In addition to Rivendell, Salem Radio Labs has a pile of Linux-based open-source products. Many are in use outside the US as well. Find them at salemradiolabs.com Although Campware is focused on emerging democracies and Salem Radio Labs is focused on the Christian broadcasting community, goods pro¬ duced by both are wide open for anybody to use. — DOC SEARLS A New Province Manitoba is going open source. And vice versa. The Manitoba Media Centre is a new "Open Source Entertainment Engineering, Innovation, and Production Research Facility" ( Top Ten Reasons 1 We’re Changing LJ Back to Its Original Smaller Size 10. The old /var/opinion used to fit perfectly in my birdcage. 9. The edges stick out when I'm pretending to read Playboy. 8. My vintage Logitech hand scanner needs three passes per page. 7. It doesn't fit in my hand. 6. It slides off the toilet lid. 5. Saves trees. 4. It doesn't fit in my magazine holder. 3. Wired did it. 2. The extra white space caused too much glare. 1. Number one is irrelevant—you don't need LJ when doing number one. of Open Source in Winnipeg, capitalized by a $20 million investment from the Provincial Government of Manitoba and Linux Media Arts—a Los Angeles-based media production company. The Centre grows out of a trade mission effort between Manitoba and California. The Manitoba Media Centre will work on development of multimedia applications for film, television and the Internet. It also will concentrate on the needs of educational institutions and developing economies. Michael Collins, CEO of Linux Media Arts, says, "Our goal is to leverage the $20 million into at least a $100 million endowment within 18 months to two years through consulting, product development contracts and sponsor¬ ships." For Linux specifically, he intends to approach development "from the perspective of what is important to multimedia users. In other words, tool and applications and kernel changes that will improve the media experience. The various distros and the companies who support them do not have this market specifically in mind. It's mainly a support issue. How best can we support the multitudes of users worldwide building systems and products for this $1 trillion market? We think there is room for more." Find out more at manitobamediacentre.org. — DOC SEARLS They Said It Just because it's hard doesn't make it worth doing. —Britt Blaser It's often assumed that putting secret codes in music files to protect them from being copied is a way to prevent copyright infringement. But it's not really about that at all. At heart, digital rights management (DRM) is a business strategy, not a police action. And that strategy may be reaching the end of its natural life. —Nick Carr, www.roughtype.com /archives/2006/12/curtains_for_mu.php We are moving to a world in the 21st century in which the most important activities that pro¬ duce occur not in factories and not by individual initiative but in communities held together by software. It is the infrastructural importance of software which is of primary importance in the move to the post industrial economy...Software provides alternative modes of infrastruc¬ ture and transportation that is crucial in economic terms because the driving force in economic development is always improvement in trans¬ portation....Software is creating roadways that bring people who have been far from the center of human social life to the center of that social life....Software can be used to keep software from being owned. Now we live in a different world for the first time, all the physics, all the mathematics, everything of beauty in music and the visual arts, all of litera¬ ture can be given to everybody everywhere at essentially zero marginal cost beyond the cost of making the first copy. —Eben Moglen, keynote at Plone, www.youtube.com/watch?v=NorfgQIEJv8 www.linuxjournal.com march 2007 | 13 [UPFRONT Tales of an Asterisk Addict I've been building my Asterisk phone system at home for about a year and a half now. I hope that by reading this article, you get an idea of some of the configurations that can be built with Asterisk and how each configuration functions, as well as each configuration's drawbacks. Asterisk has given me the flexibility to handle incoming calls in ways that you'd never think possible and to make out¬ going calls more convenient. For those of you who don't know what Asterisk is, Asterisk is a software program that can interface with the Public Switched Telephone Network, PSTN, and provides voice mail, conferencing and other sophisticated call-handling features, all under your control. I first got started with Asterisk when I was searching the Web trying to learn what I could about VoIP. When I happened upon the Asterisk program, I couldn't believe it could be everything it was hyped up to be. Once I got it installed and configured, I was able to download software that I could use like a regular telephone, but I could call only other users on my server. This was a fun toy, and my young son got a kick out of hearing his dad's voice on the computer. As fun as this standalone system was to play with, it wasn't very useful, so I decided to add an inexpensive interface card to the system that would allow it to make and receive phone calls over our regular PSTN phone line. With this inter¬ face card in place, my wife and I were able to use our computers just like regular telephones. The computers even rang when someone called us. By this time, I was hooked; VoIP was fun! It was about this time that my wife and I had grown dissatisfied with our current answering machine, so I configured Asterisk to function in its place. As an answering machine, it worked quite well. My wife and I were able to put messages into folders, forward them to each other, and receive our voice-mail messages as e-mail attachments. As we both read our e-mail regularly, having our voice mail available from our e-mail client was very convenient. People like to have fun with their answering machine greeting messages, and I'm no different. Because of Asterisk's flexibility, I was able to do something that couldn't be done with a conventional answering machine. My answering machine greeted people by name! When a call came in, the Asterisk system would answer and play a recording of me saying "Hello". Then it would use the caller's caller ID to find a .wav file, 555-1234.wav for example, that contained a recording of me saying the caller's name. Then, finally, it would play our standard greeting. The result was something like "Hello, Tyra Banks, you have reached my super smart answering machine. Please leave a message." Tyra never actually called me, but I'm sure she's just busy. It also was nice not to have to get up to see who was calling. The Asterisk system was able to send caller-ID information to my MythTV, which dis¬ played who was calling on our television. Sending caller-ID information as a pop-up to my wife's laptop as well as my workstation was pretty simple. But what was really nice was having incoming calls announced over the server's speakers. We actually were able to hear who was calling without having to run over to a phone or caller-ID box. In hindsight, it sounds rather lazy not wanting to be bothered to get to a phone to see who's calling. On the other hand, there are times when we simply don't want to be bothered. Why should I get up from the dinner table to find out who's calling, only to find it's a tele¬ marketer that I don't want to speak with anyway? The main problem with the Asterisk system at this point was that there was a definite disconnect between the Asterisk system and the "real" phones in the house. For example, we weren't able to use our real phones to check voice mail. The solution to this problem was the addition of an Analog Telephony Adapter (ATA). I chose to buy a Sipura SPA2002. The SPA2002 has one Ethernet port, two telephone ports and speaks the SIP VoIP protocol. The SPA product line is easy to configure with a Web browser. Once the SPA and Asterisk were configured, I could plug two phones in to the system and dial in and out with them. Of course, I wanted to make the system as transparent as possible, so I had to do something a bit different. I bought a two-line telephone split¬ ter and plugged both "telephone" lines from the SPA into the line one and line two receptacles on the splitter. Then, I plugged the line one and two receptacle into the wall, essentially using the splitter as a joiner. Now I could use any phone jack in the house, either line one or line two. I chose to use line two in the office and line one everywhere else. In most houses, if someone is on the phone, no one else can use the phone. With this setup, if someone is on the phone on line one, we simply go to the office and pick up line two to make our call. This has proven to be very convenient. The analog telephones have one minor defi¬ ciency. The only way to know if you have voice mail waiting for you is to pick up the receiver and listen for the stutter dial tone. Of course, being able to receive voice mail as e-mail attachments is nice, but this situation is only slightly better than having Qwest's voice-mail service. Alas, this minor annoyance didn't improve until I started using standalone IP telephones, which I describe later. Once I had gotten the home VoIP system working to our satisfaction, I decided to make the big jump by cutting our ties to Qwest and subscribing to a VoIP service instead. Choosing a provider turned out to be more difficult than I had expected. Because I still wanted to use my Asterisk system for call processing, I was able to eliminate several providers right away. Many providers either don't allow you to use Asterisk or don't support the use of Asterisk with their service. With some¬ thing as complex as VoIP, and as important as my home phone, I really wanted to have support available. As I researched the remaining options, I discovered that many VoIP providers won't allow you to use the service for any commercial calls, including telecommuting and charitable activities. These companies don't publicize this type of policy, but if you read the fine print, you often find that the penalty for getting busted can be steep. At this point, I was down to the wholesale VoIP providers, but this came with the added bonus of being able to get ridiculously low rates, because the provider isn't providing any call features and isn't having to manage a voice-mail system. Finally, I chose to go with a company called Terravon Communications, although other compa¬ nies support the use of Asterisk with their service. Now that I was essentially my own phone company, this was when the schooling began. The first thing to note is that most wholesale VoIP providers are on a prepaid basis, so if you forget to pay for next month's service, you get shut off pretty quickly. The symptoms of failing to prepay are difficult to diag¬ nose, because you still have a dial tone, but you can't call anywhere! I also learned, the hard way, that even seemingly innocuous changes to the Asterisk dial plan can cause major problems. I wish I had a dollar for every time I made a late-night tweak to the dial plan only to wake up the next morning to discover that the phones didn't work. Eventually, I learned to test, test, test. Then there are those rare times that the phones don't work, and you know you didn't change anything. After working through the problem, you decide that the problem must be on the provider's side. So now who are you going to call? Well, nobody, because your phones don't work! Most of your support issues will be handled via e-mail. This is a mixed blessing. On the one hand, it means that you don't get the immediate satisfaction of talking to a warm body. On the other hand, it gives you the opportunity, or obligation, to provide the sup¬ port staff with all of the information they need to diagnose the problem. I actually have a trouble report template I use on those rare occasions when I encounter problems on the provider's side. I first describe what the problem is. I confirm that I've made no changes to my Asterisk, server or firewall configuration since the last time it worked. I give a specific example of what I am trying to do that isn't working, such as providing a phone number or 14 | march 2007 www.linuxjournal.com EmperorLinux ...where Linux & laptops converge Portab Since 1999, EmperorLinux has provided pre-installed Linux laptops to universities, corporations, government labs, and individual Linux enthusiasts. Our laptops range from full- featured ultra-portables to desktop replacements. All systems come with one year of Linux technical support by phone and e-mail, and full manufacturers' warranties apply. i Toucan T60/T60ws ThinkPad T60/T60ws by Lenovo • Up to 15.4" WSXGA+ w/ X@1680xl050 • ATI Mobility FireGLV5200 • 1833-2333 MHz Core 2 Duo • 512 MB-4 GB RAM • 60-120 GB hard drive • CDRW/DVD or DVD±RW • 5.2-6 pounds • 10/100/1000 Mbps ethernet • 802.11a/b/g (54Mbps) WiFi • Starts at $1950 Powerf EmperorLinux specializes in the installation of Linux on a wide range of the finest laptops made by IBM, Lenovo, Dell, Sony, and Panasonic. We customize your choice of Linux distribution to your laptop and provide support for: ethernet, wireless, X-server, ACPI power management, USB, EVDO, PCMCIA, FireWire, CD/DVD/CDRW, sound, and more. ° Rhino P820/M90 Dell Latitude D820/Precision M90 Up to 17" WUXGA w/ X@1920xl200 NVidia Quadro FX 3500M graphics • 1667-2333 MHz Core 2 Duo • 512 MB-4 GB RAM • 40-160 GB hard drive • CDRW/DVD or DVD±RW • 6.3-8.6 pounds • 802.11a/b/g (54Mbps) WiFi • ExpressCard/EVDO • Starts at $1455 EmperorLinux offers Linux laptops with unique features. Ruggedized Panasonic laptops are designed for harsh environments: drops, vibrations, sand, rain, and other extremes. ThinkPad tablet PCs are like other laptops, with an LCD digitizer for pen-based input both as a mouse and with pressure sensitivity for writing and drawing on-screen. Raven X60 Tablet ThinkPad X60 Tablet by Lenovo • 12.1" SXGA+ w/ X@1400xl05 • 1667-1833 MHz Core Duo • 1-4 GB RAM • 80-120 GB hard drive • 4 pounds • Pen/stylus input to screen • Dynamic screen rotation • Handwriting recognition • X60s laptops available • Starts at $2300 www.EmperorLinux.com 1-888-651-6686 Model prices, specifications, and availability may vary. All trademarks are the property of their respective owners. V#'- v> v Tiny WiFi Controller boots Linux in 1.1 seconds $129 CPU board only $249 as shown IP i \* quantity discounts start at 10 units 200 MHz CPU * TS-7400 CPU board ■ Low power, low heat, long life ■ Up to 128MB on-board Flash - Up to 128M SDRAM " SD Flash Card socket " 1 external USB port " 1 10/100 Ethernet " 802.11g internal WiFi option ■ One piece, rugged aluminum enclosure option measures 1.1” x 4.9” x 3.1” Design your solution with one of our engineers * Over 20 years in business a Never discontinued a product a Engineers on tech support a Custom configurations and designs w/ excellent pricing and turn-around time * Most products stocked and available for next day shipping [UPFRONT] area code that I can't reach. Finally, I give them the relevant timestamped log entries from /var/log/asterisk/messages. I usually start by trun¬ cating the log file and telling Asterisk to start logging either IAX or SIP debug messages. Then, I do whatever it takes to repeat the symptoms. All of the messages that the servers exchanged, as well as the steps that my Asterisk server executed are now in the log file, which I send as an attach¬ ment to the tech support staff. You can save a lot of time by making sure that the engineers have all of the information they need—the first time. One day, I got a call from a coworker who had heard that I had my own VoIP server. One of his friends was going to be in Europe for about three weeks and they wanted to know if I could set him up. He had a wireless PDA that ran Windows CE and wanted to know if he could connect it to my server and use it like a phone to call his friends and family in the United States, from Italy. Because this sounded interesting, I agreed to give it a try. He installed a copy of SJphone, and I configured it to talk to my Asterisk server. Then he went to Europe. Amazingly, it worked pretty well! I talked to him for several minutes, and it sounded fine, though I was a bit jealous to hear that he was sit¬ ting in a wireless cafe in Venice, Italy, while I was sitting in my office. The whole experiment cost me only $6 US in line charges, so it was worth it just for the nerdiness of it. I shudder to think what it would have cost him to call home from Europe with a land line, much less what it would cost if he had tried to use his cell phone. I was already able to use any phone or com¬ puter in the house to make and receive phone calls, but I wasn't done exploring. I managed to borrow a Cisco 7960 IP telephone. This was a substantial, though temporary, improvement to our telephone system. The 7960 is a very attractive, business¬ looking phone. It also features a sharp LCD display that it uses to display context-sensitive menus as well as caller-ID information. But most important for me, it has a bright-red message-waiting indicator that we can see from across the house. However, at $300 US, the 7960 isn't in my budget. Because the 7960 I had borrowed didn't allow Web-based configuration, it was a little bit more difficult to configure than the SPA2002.1 had to create a configuration file that the 7960 down¬ loaded from a TFTP server, which I also had to install. Fortunately, example configuration files are available on the Internet. Finally, I decided to buy my own IP telephone and chose the Polycom Soundstream IP501, which I bought atVoipSupply.com for about $180 US. This positions the IP501 as a midrange telephone, suitable for either the office or home. The IP501 is a nice-looking device, though perhaps not as attractive as the Cisco device. It also has a red, blinking, message-waiting light. The LCD display seems smaller, but it's functional. The big plus with the IP501 is the way it sounds. Going from the Cisco phone to the Polycom phone is like going from AM radio to FM; it just sounds better. The IP501 has a rudimentary Web-based con¬ figuration capability, though the real meat of the device's capability is exposed only via a configura¬ tion file that the device downloads via FTP or HTTP. Fortunately, the Polycom Web site contains complete examples of these configuration files as well as a 166-page Administrator's Guide. Both the Cisco and Polycom phones feature a two-port switch that allows you to plug your PC workstation in to the phone, and then plug the phone in to the network. In this configuration, the phone will prioritize the real-time voice traffic over the rest of the network traffic, thus ensuring that voice quality is as good as it can be. Also, both devices are capable of negotiating separate VLANs for both the phone and the attached PC. This allows your voice traffic to travel over a separate, perhaps more secure, network. The network infrastructure has to support VLAN negotiation for this to work. In the year or so that I've been using Asterisk, I've learned a lot and had a lot of fun. Starting from a standalone "toy" system, I added PC-based soft- phones. Later, the system was connected to the PSTN. Then, the system was connected to the house phone wiring. Finally, I added dedicated IP telephones. I ended up with a phone system that rivals those of many large offices. Each configura¬ tion, as well as each device, has its benefits as well as drawbacks. They all have their own unique quirks. Learning about these quirks is what makes VoIP so much fun. — MIKE DIEHL See our website for options, peripherals and x86 SBCs USER FRIENDLY by J.P. ' IlHiif 1 Frirti LIIMMlLlOlliMI 1 a UCK6P UP AZKTHOTH 01 DM T TAKE TOO KWDLY TO MY MIRTH. tarr.-SKYPe has service TO THE CENTER OF WFWnVfT Are you shocked by the high cost of iSCSI & Fibre Channel storage? AoE is your answer! ATA-over-Ethernet = simple, low cost, expandable storage. www.coraid.com M 'i r r r r 11 i i i r 1 11 i _ L . i W Winn W Product Excel le f l l. EtherDrive® SRI520 • RAID enabled 3U appliance with 15 slots for hot swap SATA disks • Check out our other Storage Appliances and NAS Gateway 1. Ethernet Storage - without the TCP/IP overhead! 2. Unlimited expandability, at the lowest possible price point!! 3. You want more storage...you just buy more disks - it's that simple!!! Visit us at www.coraid.com for more information. CORAID 1.706.548.7200 The Linux Storage People www.coraid.com COLUMNS AT THE FORGE REUVEN M. LERNER Dojo Become a black belt in JavaScript in your very own Dojo. JavaScript has experienced a renaissance in the past year or two. Whereas many Web developers long saw JavaScript as a second-class programming language, useful for (at best) decorating Web pages, it is an increasingly central technology for Web developers. Whether you are adding Ajax (Asynchronous JavaScript and XML), dynamic HTML or new GUI widgets to your Web pages, you likely have begun to use JavaScript more in the past year or two than ever before. Luckily for all Web developers, the rapid and widespread interest in JavaScript programming has result¬ ed in the development of JavaScript libraries and toolkits, many released under an open-source license. In my last few columns, we looked at Prototype, which aims to make general JavaScript programming easier, and at Scriptaculous, which provides visual effects and interface widgets. Prototype has become quite popular among open-source programmers, in no small part because of its inclusion in the Ruby on Rails application framework. But, Prototype and Scriptaculous are far from the only games in town. Another popular open-source JavaScript framework is Dojo. Dojo is based on a number of con¬ venience classes and objects begun by Alex Russell of JotSpot, a startup purchased by Google in 2006. Russell continues to work on Dojo, but contributions of code and money now come from other sources as well, including companies such as Sun and IBM. Moreover, Dojo is now included by default in the popular Django Web application framework, giving it additional exposure. This month, we take an initial look at Dojo, examining the way it divides code into packages, then at several of the convenience functions it provides for JavaScript program¬ mers and, finally, at a very small sample of Dojo's large wid¬ get library. Even if you have no intention of using Dojo, I hope you find this article instructive. I almost always find it useful to see how other languages and toolkits do things, if only to get some better perspective on what I am doing. Installing Dojo The first thing to understand about Dojo is that it is large, at least by JavaScript standards. (Remember that all JavaScript code must be downloaded from the server, interpreted by the browser and then executed within memory, all as quickly as possible. A large JavaScript library might offer many features, but it will make performance unacceptably slow.) Thus, although we might consider Dojo to be a single, large library, it is actually a collection of many smaller parts. This is a relevant point even before you download Dojo, because the download site requires that you choose which combination of features you prefer to use. Knowing that my server is on a relatively high-speed line, that my sites tend to be relatively lightweight and that I plan to explore Dojo as a developer, I installed the "everything" version, labeled as kitchen sink on the download site. But, if you are interested in Dojo solely for its rich-text editor, or for use in Ajax or charting, you might want to download one of the many smaller versions, each identified by the subset of Dojo's func¬ tionality it covers. For the purposes of this column, however, I assume you also have downloaded the kitchen sink version. At the time of this writing, Dojo is at version 0.4.1, and the kitchen sink version is available from the URL download.dojotoolkit.org/release-0.4.1/ dojo-0.4.1-kitchen_sink.tar.gz Once you have downloaded the file, unpack it: tar -zxvf dojo-0.4.1-kitchen_sink.tar.gz The directory that you open will contain a number of different items, including a README file, several Flash anima¬ tion (*.swf) files used in Dojo's persistent storage engine, the main dojo.js JavaScript file and several subdirectories, includ¬ ing one containing demos (called demos), one containing the source code for much of Dojo's functionality, and release and tests directories for development of the toolkit itself. To get Dojo up and running on your server, you must put dojo.js and the src subdirectory under your document root. I tend to put my Web sites under /var/www/SITENAME/www, and JavaScript files go in the javascript directory under that path. I created a further subdirectory named dojo and put both dojo.js and the src directory there as well. Thus, the full path to dojo.js on my filesystem is A/a r/www/S ITE N A M E/www/j ava sc ri pt/d oj o/d oj o.j s, but the URL that we will use to load it from a Web page will be /javascript/dojo/dojo.js. And, indeed, we can load Dojo into our Web pages using the standard Although the above loads dojo.js into the browser's memory, this does not mean all of Dojo's commands are now available. Rather, including dojo.js makes it possible for us to load one or more of Dojo's individual packages. You can think of dojo.js as a bootloader, in that its only purpose is to make Dojo available to you later on, rather than to perform any tasks on its own. Dojo Packages As we saw during the past few months, Prototype and Scriptaculous have fairly well-defined roles, and thus, they remain separate products. Prototype provides a large num¬ ber of convenience functions for JavaScript programmers, 18 | march 2007 www.linuxjournal.com and Scriptaculous adds GUI-related functionality on top of it. Dojo is designed with a different organizational philosophy in mind, providing a wide array of different functions, many of which might seem unrelated to one another. For example, Dojo provides GUI elements (for example, a rich-text editor, a date picker, interfaces to mapping sites and layout containers). But, it also provides an event system, making it possible to assign functionality to particular events, using a variety of different models. It provides a client-side storage system with more sophistication than HTTP cookies. It provides a number of utilities for JavaScript programmers, making it possible to create new classes, send notes to a debugger or otherwise work with the language. Each of these pieces of functionality is available inside of a separate package, which is both loaded and identified with a hierarchical name structure. Thus, all Dojo functions begin with dojo (for example, dojo.declare and dojo.debug), and they are loaded as part of a similarly named hierarchy. Loading a Dojo package is as simple as putting: inside your HTML. You can load more than one package, using multiple invocations of dojo.require. Dojo's package loader is smart enough to take care of any dependencies that might exist. JavaScript Helpers Once you have included Dojo, you can begin to use some of its improvements to the JavaScript language. Dojo includes a number of convenience functions to make JavaScript programming easier, some of which are quite similar to what Prototype offers. For example, nearly every JavaScript program needs to retrieve nodes based on their id attributes. (An id attribute is supposed to be unique in a particular page of HTML, thus allowing us to identify a node uniquely.) To assign the variable myNode to the node with the ID of target, we normally would need to write: var myNode = document.getElementById("target") ; Dojo allows us to abbreviate this to: var myNode = dojo.byld("target"); This is not quite as short as Prototype's $() operator, but it is still a significant improvement, making programs both shorter and more readable. Dojo also provides some new mechanisms to work with arrays and other enumerated lists. For example, it provides a foreach loop: dojo.tang.forEach(arrayName, iterationFunctionName); The above code causes iterationFunctionName to be invoked once for each element of arrayName. Thus, we could say: var names = ["Atara", "Shikma", "Amotz"]; dojo.tang.forEach(names, alert); to print each of these names in an alert box. Dojo provides several other convenient functions for use with arrays, including dojo.map (which invokes an operation on each element of an array, producing a new array as a result) and dojo.filter (which returns an array of those items for which a function returns true). Stylistically, the documentation for Prototype seems to encourage users to write inline func¬ tions, whereas the Dojo documentation encourages users to write named functions and then refer to them. However, you can adopt whichever style is more appealing to you. Rich Text One of the easiest parts of Dojo to begin using is its collec¬ tion of widgets. From the time that HTML forms were first standardized, Web developers have wanted a richer set of widgets from which to choose, in order to provide applica¬ tions that resemble—in style, as well as power—parallel widgets available for desktop applications. Dojo provides a number of such widgets, making it possible to include rich-text editors, sliders and combo boxes in our programs. For example, we might want to use the Dojo rich-text editor, allowing people to write using more than the plain text that a save documents; you simply work with them, and you can expect the computer to save what you've done reliably. This month, we take a simpler approach, including our rich-text editor in an HTML form submission. Unfortunately, it's still not obvious how we can pull this off, because HTML forms consist of and Listing 2 shows an example of how this might look when incorporated into a simple HTML form. When the contents of the form are sent to the server, all formatting is preserved using HTML tags. Your application will need to parse this HTML to understand any formatting that might appear in the text. Of course, if your plan is to take the input text and simply display it in a Web browser, not much (if any) work is needed on your part. You can stick the input into a database and then retrieve it whenever it is needed. (I haven't checked into the security of this widget to make sure it is immune to cross-site scripting attacks, so you might want to investigate it further before simply accepting, storing and displaying user data.) Conclusion As you can already see, Dojo offers a wide variety of functions and doesn't take much effort to start using. But using many of the other widgets Dojo includes, such as an attractive DatePicker, requires that we use Dojo's sophisti¬ cated event handler, which we did not examine here. Next month, we will look at events in Dojo and how that package lets us incorporate special effects, Ajax and many more widgets into our Web applications. ■ Reuven M. Lerner, a longtime Web/database consultant, is a PhD candidate in Learning Sciences at Northwestern University in Evanston, Illinois. He currently lives with his wife and three children in Skokie. Illinois. You can read his Weblog at altneuland.lerner.co.il. Resources The main source for information about Dojo, as well as Dojo software releases, is at dojotoolkit.org. Documentation for the toolkit is still a bit sparse, but it has improved significantly in the last few months, and continued improvements seem likely, given Dojo's growing popularity. The main URL for Dojo documentation is at dojotoolkit.org/docs, with Dojo.book (the Wiki-based Dojo documentation) at manual.dojotoolkit.org/index.html. Some good articles about JavaScript toolkits, including Dojo, are at www.sitepoint.com/article/javascript-library Finally, a good introduction to rich-text editing with Dojo is at dojotoolkit.org/docs/rich_text.html 20 | march 2007 www.linuxjournal.com PGI Unified Binary™ Now, PGPcompilers can generate a single PGI Unified Binary executable fully optimized for both Intel EM64T and AMD64 processors, delivering all the benefits of a single x64 platform while enabling you to leverage the latest innovations from both Intel and AMD. PGI Fortran, C, and C++ compilers deliver world-class performance and a uniform development environment across Linux and Windows as part of an integrated suite of multi-core capable software devel¬ opment tools. Visit www.pgroup.com to see why the leading independent software vendors in structural analysis, computational chemistry, computational fluid dynamics and automotive crash testing choose PGI compilers and tools to build and optimize their 64-bit applications. The Portland Group” www.pgroup.com ++ 01 (503) 682-2806 The Portland Group, Inc. is an STMicroelectronics company. PGI, The Portland Group, PGI Unified Binary are trademarks or registered trademarks of STMicroelectronics. Other brands and names are the property of their respective owners. COLUMNS COOKING WITH LINUX Free Long Distance— Really! marcel gagne If you are still recovering from the last time you paid your long-distance bill. Chef Marcel may be able to offer some relief. Yes, mes amis, there really is an Ubuntu wine, distributed by the South African winemaker KWV. Figure 1. If you don’t have a SIP address yet, Ekiga makes it easy. Click the link provided, and you’ll be set up in no time. Mon Dieu! Frangois, look at this phone bill! Explain these long-distance charges. Yes, I know you have friends and family all over the world, but why are you calling them from the restaurant telephone? Quoi? Because it is too expensive to use your own phone? Frangois, aside from the fact that you have used up two months of your salary with these calls, there are better ways to save money on long distance. How? By using your Linux system and a Voice over IP program, of course. That just happens to be the focus of tonight's menu. We will discuss this bill later, mon ami. I can already see our guests starting to arrive. Head to the wine cellar, immediatement. Bring up the 2004 South African Ubuntu Shiraz we were sampling earlier today. Vite! Perhaps if you are truly efficient, I may re-instate your salary despite these calls. Enough smiling. Vite! Ah, welcome, mes amis, to Chez Marcel, home of fine wine and fine Linux fare. Please sit and make yourselves comfortable. I have sent Frangois to the wine cellar, and he should be back with your wine very shortly. While we wait, however, let me ask a question. Who, besides myself, would like to avoid paying hefty long-distance fees? I see. Well, how does free long distance to anyone anywhere in the world sound? That's what I thought. VoIP (Voice over IP) programs allow you to communi¬ cate with others running similar programs on their respec¬ tive computers. All you need, aside from a computer, is a microphone and speakers, though it's often a good idea to use a headset that combines these two. Your voice is transmitted via packets over your existing Internet connection to a receiving system, wherever it might be. Just as with cell phones that include every feature imag¬ inable, from cameras to MP3 players, it's getting harder and harder to find a program that's just a phone. Many offer advanced features, such as call answer, conference calling and a whole lot more. Using the right program, you even can transmit video, just like they did back in the 1960s on 2001: A Space Odyssey. To transmit video, you also need a Webcam. These inexpensive USB cameras are used for a vari¬ ety of things, providing glimpses into the life of the individual running a particular Web site. Other sites provide a camera to reassure us that they are indeed working. Others still are there to let parents observe their children playing at day care. As it turns out, they also help make great video phones. Ah, Frangois, you have returned. Please, pour for our guests. Make sure everyone's glass is full. There are a couple of things we should talk about before we look at the phones on today's list. Where shall we start? Mais oui —protocols, protocols, protocols. SIP, or Session Initiation Protocol, is (as the name implies) a protocol used to create, manage and end ses¬ sions between two or more users. The sessions we are talking about in this case are phone conversations. All of the programs on tonight's menu are SIP phones. As you know, here at Chez Marcel, we love open source and we love open protocols. A wonderful thing about all these programs is that every one of them can call another's SIP address. The second thing we need to cover is security and some of the problems it poses to VoIP programs. If you are running these packages on your corporate or home LAN, you should have no problems. The same holds true if you are running them from a single machine con¬ nected to the Internet—odds are this will work without a hitch. The catch comes when you try to work from behind a masqueraded (or NATed) firewall. Luckily, many of these programs use STUN to help with this little problem. STUN stands for Simple Traversal of UDP through NATs (which stands for Network Address Translations). Aren't you glad they just call it STUN? The whole point is to provide a 22 | march 2007 www.linuxjournal.com protocol that helps systems working from behind a NAT firewall route their packets to and from the appropriate place. To use STUN, your program must register with a STUN server, a number of which are public and free to use. That should take care of the background information. Let's take a look at some SIP phones now, starting with a little something called Ekiga. Once upon a time, there was a program called GnomeMeeting. These days, it's called Ekiga, and it is a great VoIP program. Ekiga, which sup¬ ports both SIP and H323 protocols, is an excellent tele¬ phone application as well as a great video conferencing tool. It even will work with Microsoft NetMeeting. You'll find that Ekiga is rich in features with multiple, simultane¬ ous account support, call hold, call transfer, call forwarding, instant messaging and a whole lot more. Ekiga is available from its Web site (see Resources), where you'll find binaries for a number of popular distribu¬ tions (and source, of course). Ekiga also has a .net sister site from which you can get your own SIP address so that peo¬ ple can call you or look you up in the on-line directory. In fact, when starting Ekiga for the first time, you are present¬ ed with the the First Time Configuration Assistant (Figure 1). Part of this process involves registering a free Ekiga.net SIP account (if you don't already have one). You can enter your address here, or click the link provided to set one up. When you are happy with the information you are pre¬ senting, click the Forward button to continue, and you will be asked to specify the type and speed of connection you are using. When you click Forward past this screen, you'll come face to face with the issue of security I mentioned earlier. Click the box labeled Detect NAT Type, and Ekiga's Assistant will try to determine what kind of routing assistance you may need. If the program determines that you are behind a NAT firewall, you'll be given the opportunity to enable STUN support. Click Forward. For the next few screens, the Assistant will help you configure your sound card, microphone and Webcam. As you go through the Configuration Assistant, buttons are provided to test your chosen settings, whether they be audio or video. By the way, Ekiga also provides support for FireWire digital cameras (like the digital video camera you bought to take videos of your new baby) through pwlib plugins. If you are going to use one of these cameras, make sure you also download and install the pwlib-plugins-avc package. You always can configure a different camera later by clicking Edit on Ekiga's menu bar, selecting Preferences, and then looking under Video Devices. Change the Video Plugin over on the right (Figure 2), and your camera should be detected. Of course, you don't need a Webcam (or any kind of camera) if you just plan to use Ekiga as a SIP phone. Click Apply on the final screen, and Ekiga fires up. You can config¬ ure several options with the package through the preferences menu. You also can re-run the First Time Assistant at any time. To place a SIP call, type sip: friendsaddress@ekiga.net in the address bar just below the menu bar—this example assumes that your friend's SIP address is a registered Ekiga.net address (Figure 3). A little pop-up window appears on the Cki^j Pralarn-ncav Genera* Personal Data General Settings Gall Options Sound Events Protocols Network Settings SIP Settings H.ljl f.Rttlnqs Coders Audio Codecs Video Codecs newces Audio Hevlcns Video Devices Video Plugin Vlduo pluym: 1394A0VC - Video Devices Input dirvlci" Sony DCR HC40 DJ VCFL - 1 omat: channel; image: N15C (America) (None) .jf ^QmI !■£ I di'wr-nr. Figure 2. With the right plugin. Ekiga can configure and use a FireWire digital camera. Figure 3.1 wonder if Mom and Dad are available for an Ekiga chat? second PC warning the user of an incoming call. If you accept the connection, the two clients can communicate. Notice the button bar to the left in Figure 3. You can turn video or audio on and off, and you can bring up a chat window for text message exchange. In fact, Ekiga will work under a number of different configurations. You can run video only, audio only, text only or any combination of the three modes. If you have a camera and your friends don't, that's okay too, because they'll still be able to see you. Of course, it can be a little disconcerting to know that www.linuxjournal.com march 2007 23 COLUMNS COOKING WITH LINUX Figure 4. WengoPhone aims to be a complete messaging solution. somebody out there can see you, but you can't see them. When you run Ekiga, make sure you turn on the con¬ trol panel. It opens up to a tabbed window in the applica¬ tion, providing support for audio and video controls as well as a dialpad. This shows the status of calls, your regis¬ tration with on-line directories and other information, and it can be turned on or off at any time without affecting the transmission. Ekiga also provides an address book, so you can search users who are registered with Ekiga.net. Simply click the address book icon on the left icon bar. Frangois, our guests' glasses are looking a little dry. Please offer everyone a refill while I present the next item on tonight's menu. WengoPhone is a fantastic VoIP client, and one you must check out. First and foremost, WengoPhone has great sound quality, a must for a VoIP application. It features free Wengo-to-Wengo communications worldwide; inexpensive Wengo-to-standard-telephone calling (using Wengo credits); conference calling; SMS support; instant messaging to Yahoo, MSN, AIM/ICQ and Jabber (such as Google Talk) clients; as well as video chat. Wengo is a very slick and Figure 5. If you don’t already have an account, this is your opportunity. feature-rich application. I'll tell you all about it, but start by visiting WengoPhone's Web site and downloading a copy. When WengoPhone starts, it asks you to log in using the e-mail address with which you registered and your password (Figure 5). If this is your first time, you likely won't already have a Wengo account, so click the Click here if you don't have a Wengo account button. A browser window appears on the Wengo Web site where you can register your account. On doing so, you'll get a small Wengo credit you can use to call land lines and cell phones (to which you also can send text messages). After you are registered, Wengo starts up, finding and configuring your audio and video automatically. This isn't to say it will find everything you have, but it tries. Down at the bottom right-hand corner of the main WengoPhone window (Figure 4), there are little icons telling you the status of your connection, registration, audio and other things. If there's a problem with the audio, for instance, an icon appears with a tooltip alerting you of the trouble. You can then click the icon to make adjustments to the levels or to visit the configuration screen. You can fine-tune a number of WengoPhone's features through the configuration dialog. Click Tools on the menu bar, and select Configuration to open the settings window. In Figure 6, I am using the dialog to enable and configure my Webcam. I mentioned previously that WengoPhone supports instant messaging. This is a great way to clean up some appli¬ cation clutter on your desktop. If you're using one or more instant messaging clients in addition to a VoIP application, Wengo can help you out. To use WengoPhone as your instant messenger, click Accounts in the configuration window's sidebar. Then, select Add and enter your screen names and passwords for either Jabber/Google Talk, MSN, AIM/ICQ or Yahoo. The configuration dialog also lets you set a call¬ forwarding address, sounds, language or auto-away timeouts. 24 march 2007 www.linuxjournal.com THE PENGUIN Another server down. Another night at the office. Whether it's deploying a hundred new servers or installing the latest security patch, it doesn't matter. You're sleeping with the serv¬ ers again. Penguin Computing® introduces Scyld Webmaster™ Infrastructure Manager. Its centrally-managed, highly available architecture makes large pools of Linux servers act like a single, consistentvirtual system,significantly reducing complexityand time to deploy servers on the fly. Its highly secure environment makesyourserverfarma'virtualfortress'and its simplified man¬ ageability cuts your maintenance windows and administration by up to 80%, dramatically improving TCO. So go on home, catch some zzzzs and know that Penguin is standing guard. MAY CAUSE DROWSINESS S SCYLD AMDCT PENGUIN HIGH DENSITY CLUSTER. The highest density, modular blade server architecture on the market. With powerful Scyld WebMaster™Infrastructure Manager for s\nq\e point command and control, and AMD Dual Core Opteron™ for a highly productive user experience. Penguin Computing www.penguincomputing.com REALLIFELINUX Penguin Computing and the Penguin Computing logo are registered trademarks of Penguin Computing Inc. Scyld WebMaster™Infrastructure Manager and the Highly Scyld logo are trademarks of Scyld Computing Corporation. AMD Opteron and the AMD logo are trademarks or registered trademarks of Advanced Micro Devices, Inc. Linux is a registered trademark of Linus Torvalds. ©2006 Penguin Computing, Inc. All rights reserved. COLUMNS COOKING WITH LINUX 401 Ffiitllic .riHML'. tm f..kll Fcavi.ird Ariv.Hfctiid K F n.iblr topu - Connection Type- Unlink Lj|M.iliLy klii|]iikiJ r . 4 wl y[3i l i li! I l'i ncl chh-iiht Iran b.llldwildtll Video quality j Uawn 1 kbiUsS 1 Up (kbftftl NVwnn.al □ to vi i □ la I JH Gwd 512 CC2Q40 12Bto256 FaiHlinl Wiirninq! WEmyi uvitI Fnr Lhr Eii',1 tbnr iip iiy piihuhtiiI 5li.il yciu m-!iy I the normal video quality mode, then you can try diffident modes to find out the most suitable one Tips -On I ci hLtp:tfl.["J luc m i hit -1 n rii , lE , rmmi L yciur intiYikH : niintt Em*i ii.initvjtllh Make a test video ca£ Figure 6. Use To call someone with your WengoPhone, enter a SIP WengoPhone’s address into the location bar at the bottom (Figure 4, configuration dialog to again). Click the green call button, and your party's SIP enable video support. phone rings. This could just as easily be a Wengo address as an Ekiga address. To call a standard telephone, enter a plus sign followed by the complete number, including country code (where applicable) and area code. Using WengoPhone, you can send text messages to cell-phone users with the SMS feature. Simply click the SMS icon, and a small composer window appears (Figure 7). Enter your contact's phone number (remember the plus-sign number format) or select it from your address book, then enter your message. A counter lets you know how many characters you have used and how many are available. When you are done, click Send. For people, like your Chef, who avoid text messages because they don't like thumbing, this is a great little feature. SMS, like calling regular phones of other non-Wengo users, does cost credits, which you can buy directly from your WengoPhone, but the price is very reasonable. In fact, calling the rates inexpensive seems unfair—downright cheap sounds more appropriate. As I write this, a call from my PC in Ontario, Canada, to England is .008 cents (Euro) per minute. Yes, those are two zeros to the right of the decimal point. Directly to the right of your nickname on the status bar, you'll see a counter indicating the amount left in your Wengo credits account. Click the total, and an information window expands below, with a small menu of options. One of these is labeled Purchase call out credits. Click here, and a browser window appears from which you can make your purchase or discover rates. I fear, mes amis, that closing time is already upon us, with plenty of other VoIP phones left uncovered. Gizmo offers Figure 7. Send text messages to your friends without getting your thumbs in a knot. another great softphone rich in features. Although the Linux client did not yet support video at the time of this writing, Gizmo does allow you to record calls (with great sound qual¬ ity). It also has some amusing features, such as configurable hold music and audio sound effects (for example, rolling thunder or a tiger's roar) that you could insert into your calls. Although it's not as feature-rich as some of the softphones covered on today's menu, you also might want to check out KPhone or Linphone. I'll leave you to explore those when you return home, but the clock on the wall is truly insistent. Frangois, kindly refill everyone's glass one more time so that we may raise a toast. And now, mes amis, raise your glasses and let us all drink to one another's health. A votre sante! Bon appetitlm Marcel Gagne is an award-winning writer living in Waterloo. Ontario. He is the author of the all-new Moving to Free Software, his sixth book from Addison- Wesley. He also makes regular television appearances as Call for Help’s Linux guy. Marcel is also a pilot, a past Top-40 disc jockey, writes science fiction and fantasy, and folds a mean Origami T-Rex. He can be reached via e-mail at mggagne@salmar.com. You can discover lots of other things (including great Wine links) from his Web site at www.marcelgagne.com. Resources Ekiga: www.ekiga.org Ekiga's Sister Site: www.ekiga.net Gizmo Project: www.gizmoproject.com KPhone: sourceforge.net/projects/kphone Linphone: www.linphone.org WengoPhone: www.wengophone.com Marcel's Web Site: www.marcelgagne.com The WFTL-LUG, Marcel's On-line Linux User Group: www.marcelgagne.com/wftllugform.html 26 march 2007 www.linuxjournal.com servers direct go straight to the sourcei MORE PRODUCTS, SETTER SERVICE, GUARANTEED. MANAGE RISKS, REDUCE COSTS. THE DUAL-CORE INTEL® XEON® PROCESSOR IN YOUR SERVERSDIRECT SYSTEM OFFERS BUILT-IN TECHNOLOGIES TO ENCHANCE SECURITY AND RELIABILITY SDR-3500T 3U 64-BIT XEON DATABASE SERVER Designed to provide outstanding performance with dual-core Xeon® 5000/5100, ideal solution for storage and mission critical business application server FEATURE HIGHLIGHTS: $ 2,499 Intel Xeon 5050 3.0GHZ Dual Core Processor (Dual Processor Option) 3U Chassis with 800W Redundant Power Supply Intel® 5000P (Blackford) Chipset Kingston 1024MB 667MHz DDR2 ECC FB-DIMM(2pcs x 512MB) Seagate 400GB SATA-II16MB Cache 7200RPM 16 x 1” Hot-swap SATA Drive Bays ATI ES1000 Graphics with 16MB video memory Intel® (ESB2/Gllgal) 82563EB Dual-port Gigabit Ethernet Controller RAID 0,1,5,10 Support 1U ENTRY LEVEL SERVER 1U Pentium 1 D servers support the latest dual-core architecture that delivers unmatched multi-tasking capabilities in an uni-processc ivironment COST EFFECTIVE 2U SERVER Businesses with 50 or more employees seeking maximum performance, storage room, expandability and uptime 1U Rackmount Chassis with 300W Power Supply Pentium® D 930 3.0GHZ Dual Core 800FSB Inter 1 E7230 (Mukilteo) Chipset iton 1024MB 667MHz DDR2 ECC (2pcs x 512MB) Seagate 250GB SATA-II 7200RPM hard drive Hot-swap SATA Drive Bays ATI f ageXL graphics, 8MB i) PCI-e Gigabit LAN Ports SKU# SDR-1110T $ 1,599 4U T0WER/RACKM0UNT 64-BIT XEON ENTERPRISE SERVER Powered by the latest dual-core Xeon 5000/5100® sequence processors, versatility in either a tower or rackmount 4U form factor and support enterprise-class Intel Xeon 5050 3.0GHZ Dual Core Processor (Dual Processor Option) 4U Rackmountable / Tower Intel® 5000X (Greencreek) Chipset Kingston 1024MB 667MHz DDR2 ECC FB-DIMM (2pcs x 512MB) 8pcs x Seagate 400GB SATA-I116MB Cache 7200RPM 3Ware 9550SX-8port RAID Controller Card GeForce 6200 TC128MB OB 256M support DDRTV-out PCI-E Intel® (ESB2/Gilgal) 82563 Dual-port Gigabit Ethernet Controller SKU# SDP-7045A-TB Mil Intel Xeon 5050 3.0GHZ Dual Core Processor (Dual Processor Option) 2U Chassis with 600W Power Supply Intel® 5000V (Blackford VS) Chipset Kingston 1024MB 667MHz DDR2 ECC FB-DIMM (2pcs x 512MB) Seagate 400GB SATA-II 16MB Cache 7200RRSM 6x1" Hot-swap SATA-II Drive Bays ATI ESI 000 Graphics with 16MB video memory Intel® (ESB2/Gilgal) 82563EB Dual-port Gigabit Ethernet Controller RAID 0,1,5,10isupport SKU# SDR-2501T $ 3,999 SDR-5500T 5U ADVANCED STORAGE SERVER Powered by the latest dual-core Xeon 5000/5100® sequence processors, the absolute best storage capacity available in a 5U format Intel Xeon 5050 3.0GHZ Dual Core Processor (Dual Processor Option) 5U Chassis with 24 hot-swap bays & 950W redundant power supply Intel® 5000P (Blackford) Chipset Kingston 1024MB 667MHz DDR2 ECC FB-DIMM (2pcs x 512MB) 12pcs x Western Digital 400GB SATA RAID Drive 1 pc x 3Ware 9550SX-12 port RAID Controller Card ATI ESI 000 Graphics with 16MB video memory Intel® (ESB2/Gilgal) 82563EB Dual-port Gigabit Ethernet Controller RAID0,1,5,10 support SKU# SDR-5500T $ 6,799 SERVERS DIRECT CAN HELP YOU CONFIGURE YOUR NEXT HIGH PERFORMANCE SERVER SYSTEM - CALL US TODAY! Our flexible on-line products configurator allows you to source a custom solution, or call and our product experts are standing by to help you assemble systems that require a little extra. Servers Direct - your direct source for scalable, cost effective server solutions. 1.877.727.7887 I www.sepvepsdipect.com Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, Pentium, and Pentium III Xeon are trademarks of Intel Corporation or it’s subsidiaries in the United States and other countries. COLUMNS WORK THE SHELL DAVE TAYLOR Compact Code and Cron Contraptions It’s a simple job to do a cron job. This month, I thought I'd take another sidetrack. (You knew that entrepreneurs all have ADD, right?) So, it should be no surprise that to me, the fastest way from point A to point B is, urn, what were we talking about? Maximum Capability, Minimum Code Reader Peter Anderson sent in a code snippet that offers up a considerably shorter way to convert a really big byte count into kilobytes, megabytes and gigabytes than the one I shared in my December 2006 column. His question: "Why so much extra code?" His snippet of code to do this takes advantage of the built-in math capabilities of the Bash shell: value=$l ((kilo=value/1024)) ((mega=kilo/1024)) ((giga=mega/1024)) echo $value bytes = $kilo Kb, $mega Mb and $giga Gb Peter, you're right. This is a succinct way of solving this problem, and it's clear that a shell function to convert, say, bytes into megabytes easily can be produced as a one- liner. Thanks! As I've said in the past, I don't always write the most con¬ cise code in the world, but my goal with this column is to write maintainable code and to get that prototype out the door and be ready to go to the next thing as fast as possible. That practice isn't always compatible with the quest for ele¬ gance and perfection in the coding world, to say the least! Coding with Crontab On an admin mailing list, I bumped into an interesting question that makes for a perfect second part to this column—a simple script that's really just a one-line invocation, but because it involves the cron facility, becomes worth our time. The question: "I need to run a cron job that looks in a certain directory at the top of every hour and deletes any file that is more than one hour old." Generally, this is a job for the powerful find command, and on first glance, it can be solved simply by using an hourly cron invocation of the correct find command. For neophyte admins, however, there are two huge steps involved that can be overwhelming: figuring out how to add a new cron job and figuring out the correct predicates for find to accomplish what they seek. Let's start with find. A good place to learn more about find, of course, is the man page (man f i nd), wherein you'll see there are three timestamps that find can examine, ctime is the last changed time, mtime is the last modified time and atime is the last accessed time. None of them, however, are creation time, so if a file was created 90 minutes ago but touched or changed eight minutes ago, all three will report eight minutes, not 90. That's probably not a huge problem, but it's worth realizing as a very typical compro¬ mise required to get this admin script working properly. For the sake of simplicity, I'll actually change this example to deleting files that haven't been accessed in the last 60 minutes, not worrying about how much earlier they might have been created. For this task, I need ctime. find has this baffling syntax of +x, x and -x for specify- This is a succinct way of solving this problem, and its clear that a shell function to convert, say, bytes into megabytes easily can be produced as a one-liner. ing 60 minutes, and it would read as "more than x", "exactly x" and "less than x", respectively. If we use the sequence -ctime -60, we'll get exactly the opposite of what we want; we'll get files that have been changed in the last 60 minutes. Or is that what we are specifying? Without a unit indi¬ cated, the default time unit is really days, so -60 is actually files that have been changed in the last 60 days—not what we want! To specify minutes, we want to use cmin rather than ctime (I told you find was confusing). Here's how that might look: find . -cmin +60 The above also matches directories, however; so another predicate we'll want to add is one that constrains the results only to files: -type f (type d is only directories, and so forth). 28 march 2007 www.linuxjournal.com Do you take But, that's not exactly right either, because we probably want to ensure that we only ever go one level deeper instead of spending a lot of time traversing a complex file tree. This is done with the little-used maxdepth parameter, which is described as "True if the depth of the current file into the tree is less than or equal to n." Now, let's put this all together: find . -cmin +60 -type f -maxdepth 1 See how that all fits together? Now, the last part of this requirement is actually to delete the matching file or files, and I have to admit that this gives me some cause for anxiety, because if you make even the slightest mistake with the find command, you can end up deleting tons of files you didn't want removed—not good. So, rather than just use -delete, I suggest you use -print, and for a day or so, let it run and have cron automat¬ ically e-mail the resulting report to you. Hooking into Cron Speaking of which, the way that you get to the data file that defines which jobs you want run when from the crontab facility is the crontab command. Log in as the desired user (probably root in this case), then type: crontab -e You'll now be editing a file with comments (lines starting with #) and lines composed of five space-separated values followed by an sh command, like this: /home/taylor/every-minute.sh This is rather brutal on the system. It invokes this script every sin¬ gle minute of every day—probably overkill for just about any process, but it illustrates the basic format of crontab entries. The fields are, in order, minute, hour, day of month, month and day of year. To have our job run every hour, for example, we can simply set the minute field to a specific value. For example: 10 * * * * /home/taylor/every-hour.sh Every hour, at ten minutes after the hour, the script is run. That works. Now, to stitch it all together, the best bet is to drop the find com¬ mand into a very short shell script and invoke the script with cron, rather than having the command itself in the crontab file. Why? Because it gives you lots of flexibility and makes it very easy to expand or modify the script at any time. Put everything in this column together and you should be able to really start exploiting some of the recurring job capabilities of your Linux box. I am a big fan of cron and have many, many jobs running on a nightly basis on my servers. It's well worth learning more about, as is the find command. Now, what were we talking about earlier?* "the computer doesn't do that" as a personal challenge? So do we. LINUX JOURNAL Since 1994:The Original Monthly Magazine of the Linux Community www.LinuxJournal.com Dave Taylor is a 26-year veteran of UNIX, creator of The Elm Mail System, and most recently author of both the best-selling Wicked Cool Shell Scripts and Teach Yourself Unix in 24 Hours, among his 16 technical books. His main Web site is atwww.intuitive.com. COLUMNS PARANOID PENGUIN MICK BAUER Introduction to SELinux, Part II Understanding SELinux’s security models is the first step in harnessing its power. In my last column, we began exploring the concepts, terms and theory behind Security-Enhanced Linux (SELinux). This month, we conclude our overview, ending with a description of the SELinux implementation in Red Hat Enterprise Linux, Fedora and CentOS. As much as I'd like to dive right in with the new mate¬ rial, SELinux is one of the most complex topics I've tackled in this column, so some review is in order. Rather than simply summarizing last month's column, however, here's a list of SELinux terms: ■ Discretionary Access Controls (DACs): the underlying security model in Linux, in which every file and directo¬ ry has three sets of access controls, known as permis¬ sions: one set each for user-owner, group-owner and other. These permissions can be changed arbitrarily, at the discretion of the file's or directory's owner ■ Mandatory Access Controls (MACs): a much stronger security model, of which SELinux is an implementation, in which access controls are preconfigured in a system security policy that generally does not allow system users or processes to set or change access controls (permissions) on the objects they own. ■ Subject: a process that initiates some action against some system resource. ■ Action: a system function (writing a file, executing a process, reading data from a socket and so on). ■ Object: any system resource (process, file, socket and so on) against which subjects may attempt actions. ■ User: in SELinux, an SELinux-specific user account is separate from underlying Linux user accounts and owns or initiates a subject process. ■ Role: analogous to Linux groups in that it represents a set of access controls that apply to a specific list of possible users. In SELinux, a user may be associated with multiple roles, but may assume (act within) only one role at a time. ■ Domain: a combination of subjects and objects permitted to interact with each other. ■ Type: synonymous with domain in SELinux. ■ Security context: the user, role and domain/type associ¬ ated with a given subject or object. ■ Transition: when a process attempts to change from one role to another by spawning a new process that "runs as" the new role, or when a process attempts to create a new file or directory that belongs to a different role than its parent directory. ■ Type Enforcement: the security model in SELinux in which processes are confined to domains via security contexts. As I mentioned last time, Type Enforcement is the most important of the three security models imple¬ mented in SELinux. In fact, in the Red Hat Enterprise Linux (RHEL) targeted policy, which I cover at length later in this article, Type Enforcement is the only SELinux security model used. Role-Based Access Controls As important as Type Enforcement is, it's a very process- oriented model. It's most useful for "sandboxing" or isolating daemons. But, what about actual human users, who may perform a variety of tasks on the system and, therefore, may need to traverse multiple domains? SELinux's Role-Based Access Control (RBAC) model concerns the ways in which users may transition between the roles they're authorized to assume and, by extension, between the domains in which those roles have rights. In practical terms, such a transition occurs when a process running from within one domain spawns a process into a different domain. For example, suppose user Mick is authorized to operate in the role Parent, which in turn is associated with the domains Supper and Bedtime. In order for Mick to transition from Supper to Bedtime (for exam¬ ple, to start a shell session in the Bedtime domain, with access to files and processes authorized for that domain but not for the Supper domain), an RBAC rule must explicitly allow the role Parent to transition from Supper to Bedtime. This is in addition to, not instead 30 march 2007 www.linuxjournal.com of, the need for Parent to be defined in security contexts for those two domains. Multi-Level Security The third security model in SELinux is Multi- Level Security (MLS). MLS is in turn based on the Bell-LaPadula model for data labeling. The guiding principle of both the Bell- LaPadula model and MLS is "no read up, no write down". That is to say, a process (user) authorized to read data of one classification may not read data of a higher (more sensitive) classification, nor may that process (user) write data of a given classification anyplace in which it might be accessed by processes (users) authorized only to view data of lower (less sensitive) classifications. For this model to work, each subject on the system must be associated with a security clearance—that is to say, the maximum sensitivity of data to which that subject may have access. Every file (object) also must be labeled with a classification that specifies the minimum clearance a subject must have in order to access it. The MLS Range field, supported in SELinux since Linux kernel 2.6.12, provides this information in the secu¬ rity contexts of both subjects and objects. The traditional four data security classifications are, in decreasing order of sensitivity, Top Secret, Secret, Confidential and Unclassified. However, in MLS, many more such hierarchical classifications can be defined in your security policy. Also, each hierarchical classification can be associated with non-hierarchical compart¬ ments, which you can use to enforce a need-to-know policy in which subjects authorized at a given classification level may be granted access only to objects associated with specific compartments within that classification. For example, suppose the process hamburgerd has overall subject clearance of Secret, and specific clearance (within the Secret classification) to the compartments ingredients and handshakes; such a clearance might be notated as { Secret / ingredients, handshakes }. If the file high_sign has an object clearance of { Secret / handshakes }, hamburgerd will be permitted to read it. Note that by "non-hierarchical", I mean that compartments within the same classifica¬ tion are peers to each other. If I define two compartments, apples and oranges under the classification Classified, neither compartment is considered more sensitive than the other. However, any compartment associated with the Secret or Top Secret classification will be consid¬ ered more sensitive than either { Confidential / apples} or { Confidential / oranges}. Multi-Category Security I've referred to SELinux's three security models (TE, RBAC and MLS). In Red Hat Enterprise Linux 5, there's actually a fourth: Multi-Category Security (MCS). As you might imagine, the combination of hierarchical classifications and non-hierar¬ chical compartments makes MLS well suited to large bureaucracies, such as military organizations and intelligence agencies, but too complex for more general purposes. Red Hat has therefore implemented an alternative file- classification model in RHEL 5's implementation of SELinux: Multi-Category Security (MCS). MCS uses SELinux's MLS Range field, essen¬ tially by ignoring the Classification field (assign¬ ing a classification of 0 to all subjects and objects) and instead acknowledging only the Compartment field. In this way, the power of data labeling is simplified to something more like the Linux DAC group functionality. In other words, MCS is similar to MLS, but lacks the added complexity of hierarchical classifications. SELinux Simplified: Red Hat's Targeted Policy Now that you understand SELinux's underlying security models and are familiar with at least a portion of SELinux's formidable body of jargon, we can turn our attention to SELinux's debut in the mainstream: Red Hat's targeted policy. For many if not most system administra¬ tors, having to understand SELinux's various security models and complex terms, and man¬ aging its myriad configuration files, which may cumulatively contain hundreds or even thou¬ sands of lines of text, makes tackling SELinux a highly unattractive undertaking. To address this problem, Red Hat devised a simplified SELinux But, what about actual human users, who may perform a variety of tasks on the system and, therefore, may need to traverse multiple domains? Linux Laptops Starting at $799 Linux Desktops Starting at $375 Linux Servers Starting at $899 DON’T BE SQUARE! GET CUBED! / Technologies 309.34.CUBED shoprcubed.com COLUMNS Figure 1. RHEL 4’s system-config-securitylevel Tool policy, called targeted, that emphasizes Type Enforcement, greatly simplifies RBAC and omits MLS altogether. In fact, RHEL's targeted policy doesn't even implement Type Enforcement globally; it only defines domains for 12 specific subject daemons, placing all other subjects and objects into a default domain, unconfinedjt, that has no SELinux restrictions (outside of those 12 applications' respective domains). The daemons with SELinux domains in RHEL 4 and 5's targeted policy are: ■ dhcpd ■ httpd ■ mysqld ■ named ■ nscd ■ ntpd ■ portmap ■ postgres ■ snmpd ■ squid ■ syslogd ■ winbind You may wonder, doesn't this amount to a global policy of "that which isn't expressly denied is permitted?" And, isn't that precisely backward of the "default-deny" stance that Mandatory Access Controls are supposed to provide? Not really. It's true that the targeted policy falls well short of a trusted SELinux implementation of the kind you'd use for US Department of Defense work. However, neither does it amount to an "allow by default" policy, the regular Linux DAC (filesystem) controls still apply. So, if you think of the targeted policy as an extra set of controls layered on top of, not in lieu of, the normal filesystem permissions, application-level controls, firewall rules and other things you'd have on a hardened Linux system, you can see that even a limited SELinux policy can still play a meaningful role (no pun intended). In fact, I'll go a step further and say that Red Hat's tar¬ geted policy is SELinux's best hope (to date) for mainstream adoption. Red Hat is by far the most popular Linux distribu¬ tion to ship with any SELinux policy enabled by default; if that policy were locked down so tightly that any customized or substantially reconfigured application was barred from proper operation, most users would simply disable SELinux. (This was, in fact, what happened when Fedora Core 2 shipped with a "default-deny" SELinux policy.) By enabling an SELinux policy that applies only to a limited, well-tested set of applications, Red Hat is minimizing Resources Faye and Russell Coker's article "Taking advantage of SELinux in Red Hat Enterprise Linux": www.redhat.com/magazine/006apr05/ features/selinux McCarty, Bill. SELinux: NSA's Open Source Security Enhanced Linux. Sebastopol, CA: O'Reilly Media, 2005. Definitive resource, but predates Red Hat and Fedora's implementation of targeted and strict policies. Mayer, Frank, Karl MacMillan and David Caplan. SELinux by Example: Using Security Enhanced Linux. Upper Saddle River, NJ: Prentice Hall, 2007. Brand-new book, by several SELinux contributors. Chad Hanson's paper "SELinux and MLS: Putting the Pieces Together": selinux-symposium.org/2006/papers/03-SELinux-and-MLS.pdf "Red Hat Enterprise Linux 4: Red Hat SELinux Guide": www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ selinux-guide/index.html Russell Coker's tutorial "Introduction to SELinux on Red Hat Enterprise Linux 4": www.coker.com.au/selinux/talks/ rh-2005/rhe!4-tut.html 2 | march 2007 www.linuxjournal.com the chances that a significant percentage of its users will associate SELinux with inconve¬ nience and lost productivity. Furthermore, the targeted policy can be administered by a simple GUI, system-config-securitylevel, that doesn't require the user to know anything about SELinux at all. The targeted policy ships with RHEL 4 and 5, Fedora Core 3 and later, and CentOS 4 and 5. Red Hat's Strict Policy The comprehensive "deny-by-default" policy originally developed for Fedora Core 2, called strict, is still maintained for RHEL, Fedora and CentOS, and it can be installed instead of tar¬ geted. However, strict is not officially (commer¬ cially) supported in RHEL due to its complexity. On most systems, this policy takes a lot of manual tweaking, both by editing the files in /etc/selinux and by using the standard SELinux commands chcon, checkpolicy, getenforce, newrole, runjnit, setenforce and setfiles. Note that Tresys (www.tresys.com) maintains a suite of free, mainly GUI-based, SELinux tools that are a bit easier to use, including SePCuT, SeUser, Apol and SeAudit. These are provided by RHEL's setools RPM package. Note also that on non-Red-Hat- derived Linux distributions, SELinux policies usually reside in /etc/security/selinux. To customize and use the strict policy on RHEL 4, see Russell Coker's tutorial "Introduction to SELinux on Red Hat Enterprise Linux 4" (see Resources). You need to install the package selinux-policy-strict, available in Fedora's rawhide repository (the selinux-policy-strict package in Fedora Core 5 or 6 may also work in RHEL 4). Conclusion It's also possible, of course, to develop and enable your own SELinux policies from scratch, though doing that is well beyond the scope of this article. In fact, entire books have been written on this topic. See Resources for information on SELinux policy creation and customization. And with that, I hope you're off to a good start with SELinux. Be safe !■ Mick Bauer (darth.elmo@wiremonkeys.org) is Network Security Architect for one of the US’s largest banks. He is the author of the O’Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux}, an occa¬ sional presenter at information security conferences and composer of the “Network Engineering Polka”. COLUMNS BEACHHEAD Waysmall An appliance approach is ideal for Asterisk. JON "MADDOG" HALL Another OpenBeach (www.openbeach.org.br) is over, and I sit in the Pousada Dos Golfinos for a few days both relaxing and writing business plans for various companies as well as this column. This OpenBeach period was unusual due to the num¬ ber of talks I gave to various organizations in Brazil, and also because I met a very interesting young man named Kristian Kielhofner and learned about his AstLinux project. Unless you have been hiding under a rock for the last several years, you probably know about the FOSS project called Asterisk (www.asterisk.org), a complete PBX system for serving VoIP and wired telephone systems. ~ ■- - _ J Asterisk works on many distributions of Linux, BSD and Mac OS X systems, and a lot of people simply put Asterisk on top of one of those systems, hook it up to the Internet and use it that way. Some of the features Asterisk provides are caller ID, voice mail, direct inward dial (instead of having to ask an "operator" for an extension), call logging and accounting, support for a wide variety of codecs (the software that converts, compresses and massages voice signals into binary streams), conferencing, interactive voice response, call for¬ warding, interactive directory listing, music on hold and transfer, roaming extensions, remote call pickup, spell/say, and much, much more. Asterisk was started by a young man named Mark Spencer, who now is the president of a company called Digium (www.digium.com) that contributes to and supports Asterisk and makes systems that run it. Kristian, on the other hand, decided that he would like to see how small a distribution of Asterisk and Linux he could make and still have full functionality. He calls it AstLinux (www.astlinux.org). Small, tailored distributions have more advantages than merely saving disk space. By eliminating functionality not used and using libraries and programs optimized for size, you often can increase the security and (by better uti¬ lization of both main memory and cache) the speed of sys¬ tems with relatively low-speed CPUs. You also can reduce the power requirements required by systems that, by their nature, should remain on (as a phone system should), and by reducing moving parts (such as disks and fans), you increase the system's life expectancy. Here at the beach (or on board boats), the salt air is very destructive of electron¬ ics, but those with moving parts, such as disks and fans, are particularly susceptible. Although AstLinux is a compact distribution of Asterisk, Kristian points out that it is full-featured, able to be tailored, and even has some other VoIP applications, such as OpenSER. Because AstLinux is aimed at small, embedded sys¬ tems, it has specific images for processor architectures other than the traditional Intel, and specifically for low- power processors. It is also designed to run from Compact Flash or boot live from a small business-card-sized CD. In addition to introducing me to AstLinux, Kristian introduced me to Gumstix. Now, I have always been interested in the very large and the very small. I like Linux high-performance clusters (or huge data farms) and embedded systems. I have pur¬ chased (yes, I normally buy them with my own money) more embedded system development kits than grains of sand on the beach, but I always like seeing what else is out there. Somehow I had missed Gumstix! Gumstix computers (www.gumstix.com) are based on the Intel XScale processor and come in 200MHz or 400MHz models. They are literally about the size of a stick of a famous-name chewing gum and are expandable by adding on similarly sized option boards. The basic Gumstix can have Bluetooth capability right on the board, and with other option boards, they can be turned into either a Waysmall computer (with serial ports and a USB client) or a Netstix computer (with Ethernet and a Flash socket), including a nice case for each. With 64MB of RAM and 16MB of Flash, it is obvious that these systems are not general-purpose gaming desk¬ top replacements. On the other hand, my first UNIX 34 march 2007 www.linuxjournal.com "workstation" had 1MB of RAM and a 10MB disk (and yes, we did have the X Window System on it), so with careful pruning of code, you can put a reasonable amount of functionality on the Gumstix systems. And, with either wired Internet or the new 802.11g wireless option, you could create a diskless client for even more capabilities. Another nice thing about Gumstix is that the technical information for its boards are available under a Creative Commons Attribution-ShareAlike 2.5 License. For those who want to design their own circuits to use with Gumstix, this is invaluable. One caution, however. Although the Gumstix site is fairly helpful with all sorts of FAQs and other information, it does not provide step-by-step instructions. Of course, there are other embedded systems and sys¬ tem suppliers. The PC/104 (www.pc104.org), the uClinux Project (www.uclinux.org) and SSV in Germany (www.ssv-embedded.de/ssv/english/products/htm) also are interesting in their own right. It is just that the Gumstix line is so darn cute! Finally, I would like to say a few words about Kristian himself. I spent quite a few days with Kristian as we gave talks in Sao Paulo, Brasilia, Curitiba and, finally, Florianopolis, Brazil. Some of Kristian's talks were techni¬ cal, but as quite a few were given with high-school or college students in the audience, Kristian took some time to discuss how FOSS had affected his life. Kristian gave credit to FOSS and the FOSS community for giving him the opportunity to turn his life around and have fun learning and building both a project and a busi¬ ness based on FOSS. I have met many young people like Kristian, but it is always nice to meet another, and particu¬ larly one that is as friendly and outgoing as Kristian. It validates what the FOSS community has been saying all along—that FOSS can help build character and open opportunities for people of all ages. As I finish my last Caipirinha, and the sun goes down, I think of projects that could use a small system. ...a Small tailored distributions have more advantages than merely saving disk space. Jon “maddog” Hall is the Executive Director of Linux International (www.li.org), a nonprofit association of end users who wish to support and promote the Linux operating system. During his career in commercial computing, which started in 1969, Mr Hall has been a programmer, systems designer, systems administrator, product manager, technical marketing manager and educator. He has worked for such companies as Western Electric Corporation, Aetna Life and Casualty, Bell Laboratories, Digital Equipment Corporation, VA Linux Systems and SGI. He is now an independent consultant in Free and Open Source Software (FOSS) Business and Technical issues. Hurricane Electric Internet Services... Speed and Reliability You Can Depend On! Flat Rate Gigabit Ethernet 1,000 Mbps of IP $ 1 3,000/month* Full 100 Mbps Port Full Duplex $2,000/month Colocation Full Cabinet Holds up to 42 1U servers $400/month Order Today! email sales@he.net or call 510.580.4190 he.net 'Available at PAIX in Palo Alto, CA; Equinix in Ashburn, VA; Equinix _inChicago, IL; Equinix in Dallas, TX; Equinix in Los Angeles, CA; Equinix in San Jose, CA; Telehouse in New York, NY; Telehouse in Los Angeles, CA; Telehouse in London, UK; NIKHEF in Amsterdam, NL; Hurricane I and Hurricane II in Fremont, CA, and Hurricane in San Jose, CA COLUMNS LINUX FOR SUITS DOC SEARLS DIY Internet Infrastructure An open-source angle on muni-Net infrastructure build-out. We want something that works for everybody; a new infrastructural tide that lifts all boats— like Linux did. and still does. Although Moore's Law drives up compute power, network speeds languish. One reason I moved to Santa Barbara in 2001 was that Internet connectivity was much better here than in Silicon Valley, where I had lived for the preceding 16 years. Six years later, however, my connection speeds in Santa Barbara are barely any better, and the costs have gone up. Worse, the city appears to be a low-priority region for Verizon and Cox, our local telco/cableco duopoly. Although Verizon is rolling out fiber to homes in dozens of communities around the country, Santa Barbara isn't one of them. And, although Cox is also rolling out higher-speed ser¬ vices, Santa Barbara is smaller and farther away from Cox's Atlanta headquarters than any other markets. And, we're not alone. The same kind of story is hap¬ pening in most communities across the US. This is why hundreds of those communities are doing what Linux and open-source developers have done all along: taking mat¬ ters into their own hands, doing for themselves as individ¬ uals and groups what proprietary businesses and industries can't or won't do. They're rolling their own infrastructure. That's why I've been taking part in a local citizen effort to build infrastructure that the local duopoly can't or won't provide. This has involved lots of meetings and dis¬ cussions—not only amongst ourselves, but with local busi¬ nesses, civic leaders, elected representatives, infrastructure (fiber, wireless) deployment contractors and other folks, including cable and phone company people. We want something that works for everybody; a new infrastructural tide that lifts all boats—like Linux did, and still does. This is why our emphasis is more on fiber than on wireless. We want Net infrastructure that maximizes capacity for the longest possible time, and for the largest number of people and locations—much as we might be doing if the challenge were building roads or reservoirs. It's still early, and we're pioneering here, as are many other communities. To help gather useful thinking at this pioneering stage, I've put together a FAQ for myself, and for anybody else who wants the benefit of the same thinking. Because much of this thinking is informed by, and modeled on, the successful experiences of the Linux and Open Source movements, I thought I'd share my FAQ draft here. Bear in mind that this is just thinking out loud at this point. It's provisional. I offer it in hope that it's useful to other folks in other towns who are trying to do the same kind of thing. I also offer it in faith that the smart readers of Linux Journal will help myself and others think and work our way to local Net infrastructure that favors every¬ body, and not just incumbent carriers. So here goes. Q Why does need fiber-optic Internet infrastructure? A For the same reason it needs roads, water, waste treatment and electricity. The Internet is becoming a "fifth utility", no less essential than those other four. Fiber¬ optic cabling is the best form of "pipe" for carrying the Net. It is also the most "green" and has enormous capacity. One fiber optic pair can carry thousands—even millions— of times more data than any form of copper wiring or any form of wireless connection. Q Why not do wireless infrastructure instead of fiber? A Even wireless needs a fiber backbone. We think it's essential to bring the best connections to everybody. We also can add lots of wireless service on top of fiber infrastructure. Even cities opting for wireless build-outs require fiber backbones. We want to make the Net's maxi¬ mum capacity available to everybody. This requires bring¬ ing fiber connections to homes, businesses, hospitals, libraries, government offices and other fixed locations—or as close as we practically can. After that we can easily add all the wireless or wired coverage we want. Q Isn't the Internet just a service we already get from cable or phone companies? A No. The Internet is not itself a "service". It's a means for transporting data between devices anywhere— without regard for the distance between them or the routes between them. It also was designed on "end-to- end" principles, which make the "middle" of the network as transparent, uncomplicated and cost-free as possible. The Internet is radically different from telephone, cable TV and other networks optimized for a single purpose. It exists to support whatever anybody wants to build on it or use it for. Its purpose is to maximize sup¬ port for a maximum variety of uses, while minimizing its own intrinsic costs. In this respect, it is a public utility like water, roads, waste treatment and electric power. The Internet cares no more about how you use it than your electric outlets care what you plug in to them or than your water faucet cares about whether you're washing dishes or filling a cup. 36 march 2007 www.linuxjournal.com The Industry Leader for Server Appliances Custom server appliances or off the shelf reference platforms, built with your image and software starting under $1,000. From design to deployment, we handle it all. Delivering an appliance requires the right partner. MBX Systems is the right partner. We understand that by putting your name on our hardware, you're putting your reputation in our hands. We take that seriously. We provide the services you need to support your customers. Better than the competition. You never even MBX systems need to touch the hardware. Engineering. Design. Deployment. We handle it all, so you can focus on what's important to you. Your software. Your sales. Your success. Visit us at www.mbx.com or call 1 -800-681 -0016 today. www.mbx.com 11 -800-681 -0016 2006 MBX Systems, 1101 Brown Street Wauconda, IL. 60084. All trademarks used herein are the property of their respective trademark holders. COLUMNS LINUX FOR SUITS We want to make the Nets maximum capacity available to everybody. Q But aren't telephone and cable companies utilities as well? A Yes, but they are also businesses, and they're designed originally for single purposes. Although the Net today is carried to our homes and businesses by these two businesses, the relationship in the long run is the other way around. Telephony and video used to be analog services. Now they are only two among many other forms of data that the Net is capable of transporting. So in the long run, we need to see telephony and video as two among a countless variety of businesses that are supported by the Net. And, we need to stop seeing the Net as gravy on top of telephone and cable service. Q Is Net infrastructure costly to deploy? A The Internet itself is not inherently scarce—as are water, electricity and roads. Instead, the Internet was designed as a way to remove distance between every connected device and the people who use those devices. There is no "long distance" to the Internet. Once a device is "on" the Net, it is zero distance from every other device in the world that's also on the Net. That's because the Net was designed so the functional distance between any two keyboards in the world is no greater than the distance between those keyboards and their screens. Meanwhile, the cost of digging trenches, pulling cable and other expenses is far above zero. But it is also far less than the cost of building roads, water distribution and waste treatment infrastructures. And in the long run, it is just as important as any of those. Q Doesn't the Net cost money to maintain? A Yes, it does. But the maintenance costs are more like those for roads than for phone or cable TV. Unless a town (or a county) wants to go into the phone and TV businesses, the engineering and maintenance costs do not have to be high. But capable engineers and maintenance workers are required, just as they are for other utilities. Q Isn't the Internet service we get from telephone and cable companies good enough? We have e-mail. We can browse the Web. We can do instant messaging. We can search on Google and buy stuff from Amazon. A The phone and cable companies deserve credit for offering Internet services and contributing to the expanded reach of the Net. But it is important to understand two things. First, the Net is far more than just an extra service provided by telephone and cable companies—even though that's how those companies sell and bill for it. Second, the Internet is a third-priority offering for both telephone and cable companies. Right now telcos and cablecos are working much harder at getting into each other's core businesses than they are at expanding Internet services. And, the Net is about much more than e-mail, searching and browsing. It is becoming an essential backbone for civilization itself. There are many public and private service needs that can be served only by reliable high-capacity Net infras¬ tructure. Doctors can do diagnostics and even surgery over distances. Public safety services can communicate and share data rapidly. Businesses that deal in graphical imagery, high-quality audio and moving pictures can produce and share their work far more easily. Most important, businesses and civic activities of all kinds can be supported—not only the two incumbent businesses that first brought the Net to our homes. Q Doesn't all this threaten telephone and cable companies? A lt doesn't have to, because there is nothing keeping telephone and cable companies from also going into other businesses that are opened up by a growing Internet. In other words, there are benefits to incumbency other than leveraging original business models. In fact, the Net offers enormous opportunities to tele¬ phone and cable companies—opportunities to provide countless services in addition to their traditional ones. That's because there is no limit to what you can do with the Net. Telephone and cable companies have a head start, both in existing facilities and existing relationships with thousands or millions of customers. Instead of being in one, two or three businesses (the phone, cable and Net "triple-play" businesses they're in now), these companies can offer an infinite variety of value-added services to indi¬ viduals and companies and organizations that use the Net. Q Why do cities and counties need to build out Net infrastructure? Why not let the marketplace take care of it? A Unfortunately, the marketplace we have is not a free and open one. Telephone and cable companies are captive to long-standing regulatory environments that are changing very slowly. Also, neither side has shown much interest in putting Net build-out ahead of their core busi¬ nesses. Both telephone and cable operators have powerful lobbying forces in Washington, DC, and at the state level as well, working to protect their traditional businesses from the "threat" of Internet growth. Giving them exclusive rights to control Internet infrastructure and growth is a guarantee that the going will be very slow. Q Doesn't the federal government care? A Not much. Although the Internet was born in the US, neither our federal government nor its pro¬ tected communications duopoly have shown much interest in the Net's development. Nor has our govern¬ ment paid much attention to how well the Internet supports and sustains economic growth. Other coun¬ tries—Korea, Japan, Denmark, Netherlands and France, for example—have encouraged Net build-out for most of the last decade. As a result, the US is now 11th in "broadband" penetration. By deciding to leave Net 38 march 2007 www.linuxjournal.com StorageWare SA108 -Supports the latest Intel® Quad-Core Xeon® Processors -Intel 5000P Chipset with 1333Mhz FSB -Up to 16GB of PC2700 ECC Registered DDR Memory -Up to 2.25TB Redundant Storage Capacity (3TB Raw) Starling at $2899 PerformanceWare 1550 -Supports the latest Intel® Quad-Core Xeon® Processors -Intel 5000P Chipset with 1333Mhz FSB -Up to 16GB of PC2700 ECC Registered DDR Memory -Up to 584GB High Performance SAS Redundant Storage Starting at $3999 StorageWare SA360i -Supports the latest Intel® Quad-Core Xeon® Processors -Intel 5000P Chipset with 1333Mhz FSB -Up to 16GB of 667MHz ECC Registered DDR2 Memory -Up to 11.25TB of Native Redundant Storage Starting at $4999 We’ve expanded our StorageWare server line featuring the latest Intel® processors including Core™ 2 Duo, Dual-Core or Quad-Core Xeon® and Serial ATA RAID 6 to bring you the fastest and most reliable disk array available. With over 11TB of storage in a RAID 6 configuration, these systems showcase high-performance, high-density enterprise storage that keeps your data safe. £ ^ [linux]™ www.pogolinux.com Experience, Imagination, and Support. Pogo Linux is Hardware Solutions Built for Linux, Built for You. To get started, contact us at 888.828.POGO or inquiries05@pogolinux.com Pogo Linux, Inc. 701 Fifth Ave. Suite 6850, Seattle, WA 98104 Intel, Intel logo, Intel Inside logo, Pentium, Xeon, and Xeon Inside are trademarks or registered trademarks of Intel corporation or its subsidiaries in the United States and other countries. For additional terms and conditions please visit www.pogolinux.com COLUMNS LINUX FOR SUITS And, the Net is about much more than e-mail, searching and browsing. It is becoming an essential backbone for civilization itself. build-out to the monopolists who feel threatened by it, our federal and state governments have assured limits on our economic growth and have reduced our com¬ petitiveness in the world marketplace. Q How have the carriers crippled our Internet service? A The Internet was designed originally as a symmet¬ rical system. That means the "upstream" and "downstream" speeds should be the same. That's the kind of Internet connectivity we find in universities and inside large companies. But it's not what the telephone and cable companies provide to our homes and small businesses. What we get is asymmetrical—much higher downstream than upstream. The reasons are not neces¬ sarily bad ones. Most of us consume far more data than we produce. This is especially true when we download large graphical files, watch a YouTube video or listen to the live stream of a radio station over the Net. The carriers have optimized their systems for asymmetries between production and consumption. The problem is, these asymmetrical lines relegate every¬ body to a consumer role and prevent us from becoming producers as well. This limitation is compounded by what are called "port blockages". This is where our phone or cable company prevents us from setting up our own Web server or running our own mail server. Again, they have some good reasons for blocking the ports on our computers that those services could run on. Spammers, for example, can take advantage of open mail server ports on our computers. But these port blockages also prevent all types of uses, including the ability to set up home businesses of many kinds. So, instead of, say, offering services that aid in the development of small and home businesses, the carriers just shut off possibilities to avoid hassles that might dis¬ tract focus from their core phone and cable TV businesses. There is also, in both the telephone and cable busi¬ nesses, a traditional high-charge orientation toward busi¬ ness customers. If you're a business, they want to charge you a lot more money for the same level of service provided to "consumers" who produce nothing other than a monthly payment. The carriers will talk about providing a higher grade of service for the money, but the costs are often so high that they drive businesses away. As a result, businesses don't take advantage of what the Net has to offer. They buy the lowest-price offering and stick to browsing the Web and doing e-mail. Q Isn't local infrastructure build-out a case of government competing with private industry? A No. It's a case of citizens finding a way to do what a protected duopoly cannot. What we are doing is also not competitive. We want to open our new fiber infrastructure to use by anybody, including cable and phone companies. We have their interests at heart too. By building out pure Net infrastructure—rather than competing with cable TV and phone systems—we are protecting and supporting their core businesses. Q Isn't this different from what we're seeing in other cities that roll out "triple-play" fiber systems? A Yes, it is. By just installing the "transport", and leav¬ ing the services up to other parties (including the phone and cable companies), we are doing two things. First, we're saving money by not getting into businesses and facilities that actually cost a lot to start and maintain. Second, we are treating the Net as the simple utility it needs to be. As a city, we know how to maintain roads, water treatment and waste facilities, and so on. We also know how to support businesses rather than compete with them. That's what we are doing here. Q What will it cost to bring fiber-optic cabling to homes and businesses? A We have estimates of up to $2,500 per "drop"—about the cost of a big flat-screen TV (without the immediate and certain depreciation). But the cost of fiber-optic cabling itself is actually less in most cases than the labor cost of bury¬ ing it in the ground or hanging it from poles. There is much we can do to drive costs down for the city and to make it easy for citizens to connect to the network as they need it. For example, we can require that conduit and fiber be put in the ground everywhere a trench is dug. We can hang fiber on poles first and work out the individual drops later. We can cre¬ ate a regulatory and procedural environment that encourages citizens and local businesses to build their own neighborhood fiber networks, which we can then connect to our publicly or privately own owned "backbone" whenever they're ready. We would love to create an environment where local businesses do much of the build out and make money in the process. Q lf you're not selling phone and cable TV services, how are you going to pay back the cost of installing the fiber cabling? A We'll have to approach this the same way we approach building out any new public infrastruc¬ ture—just as we did when we built our water systems, our waste treatment plants, our roads. We need to think cre¬ atively about this, but also take advantage of what we already know about building utility infrastructure. Q What do you expect will be the economic benefits of this? A We can begin to hint at those by looking back at what the Internet has done for our lives, and our economies, over the last ten years or more—and multiplying it by count¬ less citizens and businesses that are finally able to do what they want with a Net infrastructure that truly supports it. Q A Are there any downsides to building this out? No. And that's the real bottom line.B Doc Searls is Senior Editor of Linux Journal. He is also a Visiting Scholar at the University of California at Santa Barbara and a Fellow with the Berkman Center for Internet and Society at Harvard University. 40 march 2007 www.linuxjournal.com SuperServer 6015T-T/INF • Twin Intel® Quad-Core/Dual-Core CPU Max. up to 4 Xeon® 5300/5100 processors • Twin Dual CPU platforms with Intel 5000P/1333/1066MHz • Twin 8 DIMM supports 64GB of Fully-Buffered DIMM 667/533 • Twin PCI-E x8 (low-profile) I/O slots • Twin 2 x 3.5” hot-swap SATA drive bays • Twin Dual LAN Gigabit LANs/Infiniband • Twin VGA ports with 16MB PCI Graphic • Twin rear I/O ports • Twin 3 sets heavy-duty counter-rotating fans • Twin Management socket for IPMI 2.0 with virtual media over LAN and optional KVM-over-LAN • 980W High-efficiency power supply w/l 2 C (90%+*) Advantages & Benefits • 16 cores in single 1U - Support heavy network traffic & computing intensive applications • Double density and computing power - Fit up to 84 servers in a 42U standard rack & save IT space rental costs • Independent power control - Each node has its own power front-panel • Independent cooling control - Each node has 3 heavy duty fans with optimal fan speed control • Higher power utilization increases power supply efficiency - Saves energy costs • Two nodes in one 1U - Extended server life cycle, saves chassis, power supply and rack costs • Reduce power cables and power strips - For easy cabling, better airflow and reduced cabling costs • Save maintenance / management costs - Maintain two systems logically in one physical space Applications • HPC cluster computer nodes, data center, data farm, front-end server and other computing intensive applications • Our new generation power supply efficiency is 90% in a typical loading operation AMAX Arrow Electronics ASI Bell Micro Ingram Micro MA LABS Synnex Tech Data 1-800-800-6328 1-888-427-2250 1 -800-2000-ASI 1-800-232-9920 1 -800-456-8000 1-408-941-0808 1 -800-756-5974 1-800-237-8931 www.amax.com www.arrownacp.com www.asipartner.com www.bellmicro.com www.ingrammicro.com www.malabs.com www.synnex.com www.techdata.com intel) Xeon inside © 2007 Super Micro Computer, Inc. Specifications subject to change without notice. All other brands and names are the property of their respective owners. Intel, the Intel logo, Intel inside, the Intel Inside logo, Intel Xeon are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. TECH TIPS ► Make KPilot work with Ubuntu, watch processes, lock files and create passwords in PHP. ► Making KPilot Work with Ubuntu The version of KPilot that comes with Ubuntu/Kubuntu Edgy Eft does not work with many Palm devices, such as the Palm TX, many Treo phones and others. Although many people are complaining about the difficulty of setting up the USB port, this tip doesn't address that par¬ ticular issue. Even if you get the USB port working (I use a network sync, so it doesn't matter to me), you'll encounter other problems. For example, in many cases, KPilot copies the records from your Palm but erases the records from your Palm in the process. At the time of this writing, the good folks at Ubuntu have not yet seen fit to update KPilot. There's no need to wait though. You can download the latest KPilot, compile and install it yourself. The version I downloaded works fine with my Palm devices. You must have the KDE and Qt development libraries to compile KPilot, so you will need to install kde-devel at the very least. You also need cmake, which isn't installed by default in Ubuntu. You need to install the latest version of pilot-link separately as well, and compile it, first. In this example, I installed pilot-link in /usr/local/src/pilot-link-0.12.1. I also set the following environment variables for my platform (this is optional and may not apply to your platform): export CFLAGS="-march=athlon64 -02 -pipe" export CXXFLAGS="${CFLAGS}" export CPPFLAGS="${CFLAGS}" export CXX="g++" Here are the commands to download, make and install KPilot: cd /usr/local/src svn co svn://anonsvn.kde.org/home/kde/branches/KDE/ ^3 .5/kdepim/kpi lot/ cd kpilot ./configure --prefix=/usr --with-pilot-link=/usr/ ^local/src/pi lot-link-0.12.1 make -f Makefile.cmake make -f Makefile.cmake install If you already have KPilot running, you need to exit, and you may even have to kill the daemon with the command: kiHall kpilotDaemon Restart KPilot, and now you should be able to sync without prob¬ lems. If you want to keep up to date with the latest changes, you can update the source code with the following command (obviously, you need to configure and install again afterward): svn update kpilot —Nicholas Petreley ► Linux watch Command Much open-source software for Linux has good monitoring commands for observing process activity. Some of the commands do not have graphical user interfaces, and in other cases, administrators prefer to use the command line. Monitoring the progress of an activity is a continuous task. The Linux watch(l) command (linux.about.com/library/ cmd/blcmdl1_watch.htm) is a useful tool for monitoring progress. It allows users to run a command and watch the output in a terminal window. It can execute the monitoring command at regular intervals and show differences (option -d) between successive updates. Many Amanda (amanda.zmanda.com) users, myself included, use the watch command to observe the Amanda backup progress. The Amanda status command amstatus (wiki.zmanda.com/ index.php/amstatuscommand) can be run with the watch command every minute to monitor the progress for each filesystem being backed up: watch --differences=cumulative **--interval=60 amstatus backupconfig The above command watches the backup progress for the Amanda configuration backconfig. Another use for watch is to watch memory usage in a system: watch cat /proc/meminfo —Paddy Sreenivasan ► PHP Create Password Script The following tip comes courtesy of Foundations of PEAR: Rapid PHP Development by Nathan A. Good and Allan Kent, published by Apress (www.apress.com/book/bookDisplay.html?blD=10181). This tip shows how to generate strong passwords using a PEAR package called Text_Password. To use the code shown in this tip, you need to have PEAR installed along with PHP, and you need to install the Text_Password package. To install the Text_Password package, type: pear install text_password The Code: The PHP script that creates the password looks like this: Pas sword Example 42 | march 2007 www.linuxjournal.com

Here is a pronounceable password, defaulting to 10 characters:

Here are 5 unpronounceable passwords, with a length of 15 characters each:
< u 1 >

    • < ? php } ?>

    The Results: When the script is executed, it generates output very similar to that shown here. Of course, because the passwords are generated randomly, your actual results will differ slightly: Pas sword Example

    Here is a pronounceable password, defaulting to 10 characters:
    vumaechoud

    Here are 5 unpronounceable passwords, with a length of 15 characters each: