xampp

At times I've wanted to try doing some development work on my eeepc, but the default distribution doesn't come with a LAMP stack (and so far I've been too chicken to try installing something else).

Today I tried installing xampp, and that seems to work pretty well. So far my only complaint is that it doesn't seem to come with any version control tools (like svn), and I don't see an easy way to add/compile them (the eeepc doesn't have gcc).

SSL in MySQL connections

Last week I wanted to figure out how to use SSL certificates in MySQL connections. This is well-documented on the MySQL Web site, but here are a few wrinkles I experienced while figuring out how to get this working (this was with MySQL5 on CentOS5 and RHEL5).

After creating the certificate authority (CA) certificate/keyfile pair, you can specify them in the mysqld section of /etc/my.cnf:

ssl-ca=/etc/pki/CA/ca-cert.pem
ssl-cert=/etc/pki/tls/certs/mysql-server-cert.pem
ssl-key=/etc/pki/tls/private/mysql-server-key.pem

When making certificates for a client connecting locally (e.g., ssluser@localhost), it's important to supply localhost as the "common name" when prompted by openssl. (Yes, it's probably pretty silly to use SSL for a connection over the loopback interface, but you might be in this situation if you were testing.)

If you want to specify the CA (whose signature must appear in client certificates) when setting up a MySQL user (as you might when using the require x509 syntax), the fields should be separated by backslashes ('/'): grant usage on *.* to ssluser@localhost require issuer '/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd/CN=www.example.com/emailAddress=webmaster@example.com';
The following command will more-or-less correctly format the issuer for the grant statement:

openssl x509 -text -in /path/to/ca-cert.pem | grep Issuer \
| cut -d':' -f2 | sed -e 's/, /\//g'

Using issuer and subject items imply x509, and it's an error to try using x509 and issuer.

Depending on the require clause in the grant statement, you can use one or more of the following to connect to the SSL-enabled server:

1. mysql -u ssluser -p


2. mysql -u ssluser --ssl-ca=ca-cert.pem -p


3. mysql -u ssluser --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -p

If you use require none or omit the require clause, you can use any of the three connection commands. If you use require ssl, you can use #2 or #3. And if you use require x509, you have to use #3 (note that #3 includes the --ssl-ca option). After connecting, type status (or just \s) and make sure that the SSL item says something encryptiony (mine says Cipher in use is DHE-RSA-AES256-SHA).

Unless client certificates are really necessary (extra client-level authentication), it's probably adequate just to use require ssl and to have the client provide the CA certificate (this appears to provide as high a level of encryption as the client certificate does). But note that you still need to generate the server certificate and key, even if you're not using client certificates.

iterating through an array in bash

Every now and then I need to iterate through an array of items in a bash script, and I can never remember the syntax--I always have to look it up. So here's a quick example...

#!/bin/bash

things=( first second third )

for i in ${things[@]}
do
  echo $i
done

If the number of array elements is large, it can be useful to have one element per line:

things=( \
first \
second \
third \
)

Ubuntu

I finally gave Ubuntu a try recently. I'd previously tried it as a VMWare Server guest and hated it. But that probably wasn't a fair shake, so I installed it on my laptop last week. I was really impressed by how easy it was to get everything set up. It only took a few hours to get it installed and pretty highly customized with some of my favorite packages, including gtkpod, grip, easytag, mplayer, fluxbox, VMWare Server, gkrellm (and a few of its plugins), and grisbi.

About the only thing that really took a while was getting fluxbox to work, and that's because Ubuntu does it rather differently than CentOS (what I'm used to). It took me a little while to realize that I needed to be using ~/.fluxbox/startup rather than ~/.Xclients, and it took me forever to cotton on to the fact that the ~/.fluxbox/keys syntax had changed between v0.9.x and v1.0.x. I'd never had the following three lines in my keys file before, but they're pretty important (you can't easily get to the fluxbox menu without them):

OnDesktop Mouse1 :HideMenus
OnDesktop Mouse2 :Workspacemenu
OnDesktop Mouse3 :RootMenu

About the only thing I couldn't do was install native drivers for one of my wireless cards. I have two cards: a Linksys WPC11v4 802.11b card and a Netgear 802.11g card. The Linksys card has open-source drivers which support monitor mode (so that I can run kismet), while the Netgear card only has Windows drivers. It was very easy getting ndiswrapper and wpa_supplicant set up for the Netgear card, but I never got the Linksys drivers working. Looks like other people have had the same trouble, and the solution may be to try a different kernel. Oh, well.

Anyway, it was all pretty easy, and I may start using Ubuntu on all my desktops. And O'Reilly's Ubuntu Hacks was pretty helpful.

fetchmail for gmail

If you have lots of email accounts, it can be a real pain checking all of them. But if you're running a mail server on a Linux box somewhere (like postfix on your workstation at home, for example), you can use fetchmail to download the messages from your IMAP and POP3 mail accounts. That way, all your mail is in one place (and you only have to go to one place to read it).

gmail recently added IMAP support (it's one of the tabs under Settings). Once you enable IMAP support in your gmail account, you could add something like the following to your ~/.fetchmailrc file:

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl

nofetchall just gets the new messages, keep prevents fetchmail from deleting the messages off your gmail account (so that you can still read them by logging on the gmail), and ssl keeps your password encrypted when fetchmail connects to gmail. Then just run fetchmail -s in cron every now and then.

Something to keep in mind is that although this won't delete your messages from gmail, it'll mark them as read. So if you log in to gmail, new messages won't look new, they'll look read (because fetchmail has read them).

GNU screen w/ ssh-agent

I maintain a lot of Linux servers, and I find it useful to keep an ssh session open to each one. But I don't want a terminal window open for each server, so GNU screen has been really helpful to me. I've used screen for years and I thought I knew most of its features, but I recently saw a post on polishlinux.org which has some really neat screen tricks which were new to me.

One screen trick I've used a lot in the past is to run screen inside of an ssh-agent session, with each screen window being an ssh session to one of my servers. So if I generate a password-protected ssh key and share it to all my servers, I can do the following:

$ screen -S wrapper -c .screenrc_escP
$ ssh-agent /bin/bash
$ ssh-add # supply ssh key password
$ screen -S ssh

The first call to screen sets up a 'wrapper' session, so that the ssh-agent will work for adding new windows to the inner screen session, even if I re-attach from another terminal. The .screenrc_escP configuration file contains escape ^Pp so that the two nested screen sessions have different escape sequences.

Then within the inner screen session, I can ssh to my servers without passwords (because I've already given the ssh key password).

The tedious part of doing this was manually opening all those ssh sessions and naming the screen windows. But now (thanks to the polishlinux.org post) I see that I can save something like the following to a file called .screenrc_ssh:

screen -t host1 ssh host1
screen -t host2 ssh host2
screen -t host3 ssh host3
screen -t host4 ssh host4

And then I can instead do this:

$ screen -S wrapper -c .screenrc_escP
$ ssh-agent /bin/bash
$ ssh-add # supply ssh key password
$ screen -S ssh -c .screenrc_ssh

And all my ssh sessions open like magic.

Another interesting part of the polishlinux.org post is the discussion of regions. This feature lets you split a screen window into regions. I've done this several times by accident, and I always just found it annoying, because I'd have to look in the man page to see how to close a region. I never knew how to use the feature. But you could have an ssh session to two servers in the two regions of the same window--allowing you to run some long-running process on one server and keep an eye on it while you're working on another server in the other region.

Screen rocks.

gpg-based password wallet

I've been using the following script for a while to store passwords in an encrypted file. As you can see from the comments, it's based on a script from a linux.com article, but I've added several features which make it more agreeable to me. To use, save it as an executable file somewhere in your path (I've saved it as ~/bin/wallet).

You'll need to specify the location of the encrypted wallet file. You can do that in one of three ways:

1. with the PASSWD_LIST environment variable
2. having something like 'PASSWD_LIST=/path/to/wallet.gpg' in ~/.walletrc
3. on the command line: wallet -c /path/to/wallet.gpg
   

Then just type wallet to view your password wallet in less, or type wallet -e to edit your wallet (set your VISUAL environment variable to your favorite editor, or wallet will default to vi).

And here's the script...

#!/bin/bash

# alteration of script described at
# http://www.linux.com/article.pl?sid=07/03/06/1640216
# changes from original:
# 1. use of VISUAL envariable for editor
# 2. storage of password in variable, rather than file
# 3. view-only mode (rather than always opening in text editor)
# 4. symmetric encryption
# 5. saving backup copy of encrypted password file prior to editing
# 6. creates password wallet if it doesn't exist
# 7. encrypted file can be specified by -c option, by PASSWD_LIST
#    envariable, or in ~/.walletrc

if [ -f ~/.walletrc ]; then
. ~/.walletrc
fi

if [ -z ${VISUAL} ]; then
VISUAL=vi
fi

EDIT_PWFILE=0
while getopts 'ec:' OPTION
do
case $OPTION in
e) EDIT_PWFILE=1;;
c) PASSWD_LIST="$OPTARG";;
?) printf "usage: %s [ -e ] [ -c encrypted file ]\n" $( basename $0 ) >&2
 exit 2
 ;;
esac
done
shift $(($OPTIND - 1))

if [ -z "${PASSWD_LIST}" ]; then
echo "need the encrypted file specified by PASSWD_LIST (in ~/.walletrc"
echo "or the envariable) or with the -c option"
exit 2
fi

if [ ! -f $PASSWD_LIST ]; then
echo "$PASSWD_LIST doesn't exist--attempting to create..."
echo "(you'll need to give gpg a master password in a moment)"
mkdir -p $( dirname ${PASSWD_LIST} )
TEMPFILE=$( mktemp /tmp/wallet.XXXXXX )
gpg -c -o ${PASSWD_LIST} ${TEMPFILE}
rm -f ${TEMPFILE}
EDIT_PWFILE=1
fi

# prompt the user for the password
PASSWORD=$( dialog --stdout --backtitle "Password Locker" \
--title "Master Password" --clear --passwordbox \
"Enter the Password Locker master password." 10 51 )
RETVAL=$?

case $RETVAL in
1)
  echo "Authentication Required!"
  exit 1;;
255)
  echo "Authentication Required!"
  exit 1;;
esac

# if we're not editing the file, just display it and quit
if [ $EDIT_PWFILE -eq 0 ]; then
echo $PASSWORD | gpg --decrypt --passphrase-fd 0 $PASSWD_LIST | less
clear
exit
fi

TMPDIR=$( mktemp -d /tmp/wallet.XXXXXX )
chmod 700 ${TMPDIR}
PASSWD_LIST_UNENCRYPTED=${TMPDIR}/wallet
# decrypt the password list
echo $PASSWORD | gpg -o $PASSWD_LIST_UNENCRYPTED --passphrase-fd 0 \
$PASSWD_LIST &> /dev/null
RETVAL=$?

# if decryption succeeded, open the password list in the editor
# and then re-encrypt it after the editor closes
case $RETVAL in
0)
  mv $PASSWD_LIST ${PASSWD_LIST}.bak
  ${VISUAL} $PASSWD_LIST_UNENCRYPTED 2> /dev/null;
  echo $PASSWORD | gpg -c -o $PASSWD_LIST --passphrase-fd 0 \
      $PASSWD_LIST_UNENCRYPTED &> /dev/null
  CRYPT_RETVAL=$?
  if [ $CRYPT_RETVAL -eq 0 ]; then
      rm -rf ${TMPDIR}
      clear
  else
      echo -n "gpg failed to encrypt your password file! "
      echo "Please fix the problem manually!"
      echo "unencrypted file at $PASSWD_LIST_UNENCRYPTED"
      exit 1
  fi;;
?)
  echo "error condition detected (invalid password?)"
  rm -rf ${TMPDIR}
  exit 1;;
esac

stupid bash tricks

Saw this on digg or something last week (and a friend also sent it to me via del.icio.us):

10 Linux Shell Tricks You Don’t Already Know. Really, we swear

I usually don't find these posts very useful, but this one had a couple of nice surprises. I'd never heard of ssh-copy-id, but it sure looks a lot easier than adding pubkeys manually. And the trick of recovering from an NFS mount gone haywire might work for a Samba mount (that happened to me the other day).

Shoutout to PJ

In support of PJ, I'm including the following inaccurate statements from a TechNewsWorld article by Kimberly Hill. Perhaps this will draw a few search engine hits. If you are reading this, please read PJ's side of the story, in which she (PJ) makes it clear that she had no part in the OSRM study about patents supposedly infringed by Linux: this is in direct contradiction to comments made by Laura Didio of the Yankee Group.

Here are some of the statements PJ refutes:

Back in 2004, said DiDio, then-fledging insurance firm Open Source Risk Management commissioned a study to determine just how many patients Linux may infringe upon. At that time, the number was pinned at 280 or so, most of them owned by IBM (NYSE: IBM) Latest News about IBM, with about 30 held by Microsoft.

The now-infamous study was performed by Pamela Jones of Groklaw, and its methods and conflicts have seen much comment since then. Still, DiDio asserted, the open source community itself was the first to raise the issue of how much Linux actually overlapped, in terms of intellectual property, with proprietary software.

Middle-click on a laptop

Lately I've been using my laptop without a mouse (actually on my lap, rather than on a table where there's room for a mouse). My laptop has a touchpad with two buttons. I've enabled Emulate3Buttons in X11 so that I can click both buttons at the same time to simulate a middle-click. This is useful to me, because I use middle-click a lot for pasting (highlighting some text is an implicit 'copy', and a middle-click pastes at the cursor location).

The problem is that I find it difficult to click both buttons at the same time. I usually end up clicking one or the other, which typically throws off the focus and undoes the 'copy' (so the stuff I want to paste is no longer in the X11 clipboard).

(Yes, this is exactly the sort of thing that drives me insane.)

The other day while I was working on a desktop computer, I ran some google searches trying to find a solution, and I found out that if you do shift-numlock and then a 5 on the number pad, that amounts to a middle-click (then you have to do shift-numlock again to resume normal use of the number pad).

(Have you seen the problem with this solution yet?)

I was eager to get home to try this on my laptop, only to feel a crushing humiliation to realize that my laptop does not in fact have a dedicated number pad. (There's a special function key which can convert about a dozen keys on the keyboard into a number pad, but the trick doesn't work on my laptop.)

But then I realized that I could use xmodmap along with the key-handling feature of my window manager. The xmodmap 'pointer' command lets you remap your mouse keys in real time (a left-handed person can use this to make his/her mouse work correctly). If I tell my window manager that control-alt-9 means xmodmap -e 'pointer = 1 3 2' and that control-alt-0 means xmodmap -e 'pointer = 1 2 3', then I can highlight some text (to copy), do control-alt-9, and do a hard-to-screw-up right-click to paste (and then control-alt-0 to resume normal right-click operation).

To do this in fluxbox, just add these two lines to ~/.fluxbox/keys:

Control Mod1 9 :ExecCommand xmodmap -e 'pointer = 1 3 2'
Control Mod1 0 :ExecCommand xmodmap -e 'pointer = 1 2 3'

Xnest

This is basically a distillation of a recent Linux Magazine article ("Using Xnest" by Roderick W. Smith, p. 46 of the March 2007 issue, available at http://www.linux-mag.com/id/3431/ with free registration).

Let's say you're running gnome in Linux. You've installed some other window manager (like XFCE or fluxbox), and you want to try it but don't want to close all your applications and log out (to log in to the other window manager). You can run the other window manager in Xnest. Xnest is like running another X11 instance inside an application window. Try running the following (for fluxbox):

Xnest -ac :1 &
DISPLAY=:1 fluxbox &

This should run fluxbox in a new window. You get all the features of a window manager (wallpaper, multiple desktops, etc.) inside an application window.

I've yet to come up with a particularly compelling use for this. It's mostly (to me) just a stupid human trick. But it may intrigue some of your more easily-impressed friends.

CentOS 5 follow-up

I've had a week to play more with CentOS 5 on my laptop, and I've overcome a few of the shortcomings that were bothering me last time. It eventually occurred to me that I could use gnome-panel and its pager. That worked out pretty well, but actually I find that I like fbpanel even better. fbpanel is a lot like gnome-panel, but is a little more configurable. And the pager shows scaled-down versions of my wallpaper--not a big deal, but cool.

I was able to build grisbi from source, but I couldn't get OFX support to work. The libofx/openjade/opensp dependency hell was too annoying, so I just turned off that feature. OFX is a file format for financial records. Some financial institutions might be able to deliver your financial records in OFX format, and then you could import them into grisbi (if OFX support is built in). So my build might not be very useful for some people. It's not a feature that I've ever used, so I don't really miss it. I'm just glad to have grisbi working in CentOS 5. Leave a comment if you'd like the spec file.

Firewalling NFS, testing SMTP

Yesterday I found a useful Web page explaining how to use Linux iptables to firewall an NFS server. Firewalling NFS is complicated, because NFS picks random listener ports when it starts up. But by following the instructions on this page, you can edit a few files to tell NFS which ports to use:

http://www.lowth.com/LinWiz/nfs_help.html

If you are using Red Hat (or something similar, like CentOS), you only have to edit /etc/modprobe.conf, /etc/sysconfig/nfs, and /etc/services. The only thing I'd add to this tutorial is that you can just put something like 'STATD_PORT=4000' in /etc/sysconfig/nfs, rather than hardcoding the rpc.statd port number in the nfslock startup file. Then you can use iptables to control access to the following ports (tcp and udp for each port): 111, 2049, 4000, 4001, 4002, and 4003. I actually had to reboot to get nfslock to start up on port 4001. Oh, well.

Another useful Web page shows how to run an SMTP session using telnet (you could also use netcat):

http://www.yuki-onna.co.uk/email/smtp.html

One useful application of this technique is testing the access rules of an SMTP server (for example, making sure you're not inadvertently relaying for certain hosts).

grip, gtkpod, id3lib, grisbi

This is a post about some useful GNU/Linux programs I've recently discovered. I use CentOS, and RPMs for these packages are available from karan and/or DAG.

I bought a Sandisk Sansa MP3 player in late 2005. I don't know how I got through the workday before I did that. I've bought two more since then (a larger storage capacity each time). Sansas basically work like external USB hard drives, making them Linux-friendly: you can just drag-and-drop MP3 files onto them. The Sansa's firmware then reads the files' ID3 tags to display a list of available music (ID3 tags are bits of data in an MP3 file which give the artist name, album name, track title, etc.).

Sansas are not compatible with iTunes, and I haven't tried any of the other online music services--I just rip my own CDs to MP3 files. I use grip to rip the CDs. grip is basically a nice, feature-rich graphical interface to cdparanoia and LAME. It'll connect to a CDDB site (like freedb.org) to download album and artist names and track titles, rip the CD tracks to WAV files, then encode the WAV files as MP3s.

Although I can then just plug in my Sansa and start moving files around, it's nicer to have something to keep my music more organized. I use gtkpod for this. I keep all my music files on my PC, and then periodically change what I've got on the Sansa (the Sansa is 4GB, not large enough to hold my entire library). gtkpod is a nice program for displaying what's on my PC, what's on my Sansa, and changing out files on the MP3 player.

Although grip is pretty good about setting the ID3 tags on the MP3 files, it's not foolproof. The ID3 tags will occasionally have errors or be missing altogether. gtkpod has a feature for changing ID3 tags, but I haven't had much luck with this--it sometimes even causes gtkpod to crash. So I usually just use the command-line utilities in the id3lib package. id3info lists a file's ID3 tags, and id3tag and id3cp can be used to change them.

The last software package I want to mention has nothing to do with music. It's called grisbi, and it's a pretty good personal finance program. Although I've never tried Quicken or Microsoft Money, grisbi is probably pretty comparable. I use it to track my checking account. grisbi lets me define a list of transaction categories, and I can tag a transaction when I enter it. grisbi keeps up with my account balance and has features for bank statement reconciliation. It can also run reports, handle scheduled transactions (for things like automated drafts and deposits), and track multiple accounts. I've found it to be a convenient way of balancing my checkbook (much less error-prone than scribbling in the check register).