Thursday, August 20, 2009

OpenNMS and Apache2 on Debian Lenny

OpenNMS and Apache2 on Debian Lenny 5.0

What's the motivation? Jetty as built via OpenNMS does not have a configurable cipher suite or at least an obvious and/or intuitive method that wouldn't necessitate web crawling. Weak ciphers create noise on a Nessus scan listing it as a medium-level vulnerability. I found (2) how-tos on the OpenNMS wiki and both of them entailed using Jetty with AJP support. I wanted something simpler.

1. Edit /etc/opennms/opennms.properties and uncomment this line:
opennms.web.base-url = https://%x%c/

Restart OpenNMS

2. Install mod_proxy for Apache2 and add module:
$ a2enmod proxy

Beware that the default Debian proxy configuration disallows all proxy access. My installation required me to loosen it up a bit.
Edit "/etc/apache2/mods-available/proxy.conf", get rid of "Deny from all" and add:
Allow from 127.0.0.1/8 192.168.90.0/24

3. Add the virtual host entry for OpenNMS on Apache. Edit "/etc/apache2/sites-available/default-ssl" and add:

ProxyPass http://127.0.0.1:8980/opennms
ProxyPassReverse http://127.0.0.1:8980/opennms


Done. Everything works fine. Nessus is happy. Deployment secure.

Tuesday, January 27, 2009

Cray pas haunted house

I really like drawing with Cray pas. I don't feel any pressure to achieve something great when working with them. It is not technically demanding like, say, painting. I've tried my hand at painting and found it to be frustrating since my ideas never map themselves to the brush.

My daughter likes haunted houses...

Friday, January 23, 2009

Cray pas -- first go

Last night my older daughter was real demanding. In fact, the evening was so emotionally draining that after everyone went to bed I decided to grab a big piece of paper, sit on the floor with a box of cray pas, and draw a picture. It was actually cathartic. Here it is...

Thursday, January 22, 2009

Mind mapping software: XMind vs. FreeMind vs. MindManager vs. Inspiration

I've always had a disorganized mind brimming with ideas and while it has served me well over the years I felt it was time to 1) optimize the way I think, 2) delineate and partition work, and 3) preserve state. Why do I need to preserve state? When I get distracted or pulled off on some wild tangent I need to focus quickly again. Likewise, when dragging myself into the office on Monday mornings I want to pick up precisely where I left off on Friday. Finally, and maybe it's because I'm getting older, I spend more time thinking about what I've been thinking about. It's a sort of vicious cycle wherein the moment I'm situated to perform a task, right when I've knifed fresh paints on the palette, I have to go to the restroom or get a coffee or eat lunch and all is lost.

Enter mind mapping. I've spent a considerable amount of time this past week evaluating various mind mapping software on OS X. The candidates were MindJet MindManager 7, Inspiration, FreeMind, and XMind

Here's a summary of my impressions:

Inspiration:
  • Old MacOS9 look and feel
  • Costs $$$$ -- but why should I pay that for a something that feels so outdated?
  • Crashed twice and felt somewhat unwieldy for very large corporate or engineering projects
  • Very very nice outline mode handy for cut and paste right into a doc or email.
  • Might consider the Kidspiration for the youngins
MindManager7 for Mac:
  • $$$ but the newer MM8 is only available on Windows
  • Frequently crashed (due to evaluation? Doubt it)
  • Overview mode was annoying with no automatic way of expanding every node in the tree
  • Nice interface and keyboard shortcuts
  • Good documentation
  • Supports floating nodes
  • Worked quite well -- felt productive from the start.
FreeMind:

  • OpenSource. This is the product I wanted to like the most being a fan of the opensource community.
  • Full export
  • Cloud functionality mimics XMind boundaries.
  • Text mode is somewhat clumsy -- how does one delete the text icon when there is no longer any text without deleting the node itself?? This is precisely the sort of information I don't want to waste time digging around for.
  • Documented key-mappings for Mac didn't always match reality
  • Overview mode?
  • Annoying options menu -- especially choosing default colors
  • No floating nodes and difficult to place nodes where you want them (they're always snapping back to the way FreeMind wants it)
  • Somewhat primitive look and feel
  • I took some time before I felt truly productive with this product



XMind:


  • Some components OpenSource
  • Extremely polished, friendly interface
  • Good documentation
  • Floating nodes
  • Intuitive -- felt productive almost at once.
  • Easy to both add and delete notes using function+F4
  • Compact legend of key-bindings instantly accessible via ↑⌘L
  • Optional tri-pane window featuring outline view and properties
  • Cool Boundary and Summary functions
  • Nice auto-styling like multi-branch coloring and line tapering
  • Flexible node styling such as rounded, rectangle, callout, fishhead
  • Useful templates
  • Can't export to PDF in the free version


Ranking: 1) XMind, 2) FreeMind, 3) MindManager, 4) Inspiration.

XMind just wins hands-down in $$$, ease of use, form, and function. I would even consider purchasing the yearly subscription for some advanced features (Gantt charting) @ $49 a bargain.

Freemind is nice, too, but not as polished, full-featured, or easy to use as XMind. As mentioned before, I like opensource community projects, but in the end I need to get work done.

Shortly after XMind was made available at no cost, one of the FreeMind developers initiated a thread on the FreeMind mailing list asking whether or not it was worthwhile to continue that project (see here). Obviously the answer should be yes -- why crumple in the face of competition? Reading through the thread, however, I noticed a lot of commentors stated that while XMind is good, it's also slow whereas Freemind is lean and fast and, as such, Freemind is more suitable for quick off-the-cuff mapping. While it is true that Freemind is a bit spryer I feel this is negligable -- at least on a modern desktop.

Wednesday, December 17, 2008

Keeping my iTunes Library on an external hard drive across systems

Real simple: I have both an Apple desktop and laptop with limited disk space and want all my iTunes media to reside on an external HD that I can switch between systems.

This is fairly straight-forward.  In "Advanced Preferences" I changed the "iTunes Music folder location" to my external drive (in my case:  WD Passport/iTunes:).  This worked well for me until today.  Now to backtrack a little, when I first set-up this schema I even symlinked the ~/User/Music/iTunes directory to my external disk with the notion that I'd even want " iTunes Music Library.xml" (the dictionary file that maps every file in iTunes) on the external drive.  Ultimately this was stupid because if the external drive was not connected I couldn't fire up iTunes to listen to, say, the radio, without the application wanting to create an new library (equivalent to launching iTunes while pressing alt).

But that was then and this is now.  I'm not sure why my iTunes directory got screwed today but it did.

What happened was I accidentally "reset" the "iTunes Music folder location" which defaulted to my local hard drive.  When I tried to add the external hard drive location, the iTunes directory was greyed out (grayed out). Greyed out meaning I couldn't add it.  Then I attempted "Add to Library" (command+o) and the external iTunes directory was also greyed out.  WTF??

At first I thought there was some defaults com.apple.iTunes RootDirectory entry I could fool with like I did when I wanted to default my iPhoto Library to the external hdd some time ago.  But no go (another case of an OS X inconsistency).

It wasn't until I thought about doing something inane with permissions that I noticed that the iTunes directory on the external disk was an iPhoto-esque package content directory.  "Get Info" on iTunes even listed "open with iPhoto".  Hmmm. I stupidly changed it to "open with iTunes" but that was low-brow desperation.

Opening a shell and doing a "ls -lad" on iTunes showed:

drwxr-xr-x@ 20 rpetkus staff 680 Dec 17 19:40 iTunes/

What is "@"?  "man ls" informs me that @ = extended attributes which I can list with "-@"

$ ls -lad@ iTunes/

drwxr-xr-x@ 20 rpetkus staff 680 Dec 17 19:40 iTunes/
  com.apple.FinderInfo 32

What is com.apple.FinderInfo? Turns out this is a Uniform Type Identifier (UTI) which ascribes a lot more meaningful type data to a file than a mere file extension (.jpeg) or MIME type.  I found this older link which was a informative read about UTIs on OS X.  

After my reading assignment I surmised that I want to get rid of this extended attribute using the "xattr" command which doesn't have a man page but "xattr -help" is pretty self-explanatory.

Make iTunes a normal folder again:

$ xattr -d com.apple.FinderInfo iTunes/

Viola! iTunes on my external hard drive is no longer greyed-out, I can set it as my Music Folder location and "Add to Library".  Resolution.

As a side note, if you're doing the same thing with your external hdd, make sure under "Advanced Preferences" that you select "Copy files to iTunes Music folder when adding to library".  This way, if you add more media to iTunes on one system with the external drive, it indeed gets copied there for consumption on the second system.

Monday, December 1, 2008

Solaris 10, Kerberos, and OpenLDAP

Solaris 10 - Solaris in general - annoys me and Linux is favored for all instances except those where I need to reap the benefits of ZFS. Today as a precursor to deploying SUDO on a number of Solaris systems, I sought to eliminate ssh-key access and allow individual accounts to logon. Piece of cake in Linux but Solaris?

I want to use kerberos for authentication and ldap for authorization. I'm using OpenLDAP and not SUN LDAP so this already creates a bit of chafe, but I'm not going to install SUN LDAP or install a 3rd party PAM module - I want everything to be default so the next person to inherit this mess doesn't go mad.

Now I don't want to use pam_ldap for account authorization since this implies 1) I'm using SUN LDAP and 2) I'm storing account information like PASSWD in LDAP. We don't.

I *do* want to use vanilla pam_unix_account and rely on nsswitch.conf to state my name service preferences.

Now one would assume, given my requirements, that a reasonable SSH PAM stack would look like this:
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth sufficient pam_krb5.so.1
other auth required pam_unix_auth.so.1
other account requisite pam_roles.so.1
other account required pam_projects.so.1
other account sufficient pam_unix_account.so.1

Then why doesn't it work???? Why, in debug mode, does it always complain that account so and so is not found?

After some investigation it turns out that if using OpenLDAP for authorization one needs to add "objectClass=shadowAccount", and that's it, as an attribute to every single uid=xxx,ou=People,dc=place,dc=org. At least for those users that want to be authorized for login.

What a pain. And how much precious time did I waste on this? 2, maybe 3 hours? Unbelievable.

Monday, November 17, 2008

The Great Farce Part I

About 2 years ago there was a major change at my lovely place of employment -- out went the Old Director (OD) and in came the new. The new fellow was much vaunted, real tech-savvy, vocal and strong. New Director (ND) had actually helped develop a piece of software that we consumed heavily and this implied that ND was relevant and valuable. OD was swell but perhaps ill-suited for the prominent Director position as he was burdened with a modicum of introversion. The daily trade was plied in the confines of his office and rarely did he speak, if at all, to the common folk that produced many of the real, tangible items that were consumed by the facility. Nevertheless, OD was both well-respected and well-liked. He allowed only a close coterie of esteemed folks - the upper echelon - to influence and provide council. But at the time, occupying a lower caste, I had to be content lapping at the meager drip of information which fell in my pan.
Then, one day, without warning, word spread that OD was to retire from his storied post. Since OD rarely communicated anything to the larger group, the advertisement for the ND was discovered in a vocationally relevant circular. Change was in the wind and would arrive in the Spring.
About a month or so before the arrival, there were a series of secret meetings amongst the mid and upper-level managers. It was crucial to strategize earlier rather than later. Would the pecking order be preserved, could new territory be up for grab? Old allegiences were strengthened and enemies were kept close. There would be alignment with the new power at all costs. Every ounce of data obtained about ND was parsed for clues and suggestions from the most heralded dissertation to the meagerest plea for help on a mailing list. And yours truly? I was cynical yet optimistic. I was hoping for my chance; a meritocracy.
Enter Spring. It was buzzing that a wholly new organizational chart had been devised. There was an endless queue of covert meetings between ND and the mid/upper level managers. Decisions were being made and, as far as I knew, the common folk that produced real things, such as myself, were never consulted. It was leaked that, at the behest of ND, a quasi-famous Industrial Psychologist (IP) had been hired to analyze the staff, make assessments, and present reportage and council to ND. It was at this point that I become uneasy and warn't too shy about it, neither.
IP had authored some books and wrote vignettes for public radio. IP was disarming enough, as I suspected would be the case. Each staff member was allotted one hour of couch time. Some folks strode in there thinking this was their big opportunity to be an instrument of change, some were paranoid and promised to present to IP an inpenetrable shell, and one particular clown read up on industrial psychology ahead of time, picked up a bit of argot, and sought to turn the tables. I wasn't interested in any of that. I resolved to be forthright and helpful but I wasn't in the mind to put my cards on the table, so to speak. I was more interested in listening to the type of language employed by IP and keen to identify the triggers that implored me to lower my guard and spill forth -- knowledge of those triggers and techniques could be useful.
Upon completion of all the interviews, IP anonymized and categorized the data into a series of talking points and presented it to the staff during a lively 2 hour group meeting. Common issues and concerns were bulletted and reviewed. I list some specimens that will become relevant later on here:
1. People's roles and responsibilties are either ill-defined and nebulous so as to mean nothing or they are too specific and thus constrictive.
2. People want a more transparent organization, one where decisions and logic are communicated and where input is encouraged and well-regarded.
3. People want the opportunity to become more involved, redefine their roles, and grow professionally.

To be continued...