On March 2nd, I will be starting a new job as an IT System Support Specialist III at Kennesaw State University.  Typical of a government job, the title is rather meaningless.  To be specific, I will be supporting a variety of Linux and Mac OS X servers for the university and the platforms running on them (Drupal, Moodle, and other technologies.)  The production servers are RHEL and the development is on CentOS.

Of course, every good turn comes with a down turn.  On Wednesday, I went to my doctor because of a little bit of abdominal pain for 2 days.  Because of the location of the pain, and a bit of an elevated white blood cell count, he sent me over to the ER to get an abdominal CT.  Turns out that my appendix was “slightly inflamed”.  Long story short, about 10PM that night I was in the OR having my appendix removed.  It may be a common procedure, but the pain is still pretty decent.  Hopefully it will be gone before I have to start the new job.  And hopefully I won’t have to do heavy lifting in the first couple of weeks of my new job. 

My experience with Kubuntu has been frustrating, to say the least, and I doubt it has much to do with the Ubuntu team.  Firstly, the insistence on making everything “big” drives me crazy.  How can I use KDE when it won’t let me resize panels?  I also can’t find a way to create custom launcher icons on the panels (in gnome, I have a few set up to open ssh connections I use very often).

Also, how can I get a functional Application menu in Kubuntu that has proper icons and does not replace one menu section with another?  It’s ridiculous that it hides the list of application categories to display the applications themselves, unless the user is supposed to always know what category something is in.

Basically, I completely agree with the comments posted here: http://meta.ath0.com/2008/01/18/kde-4-ui-critique/ and am wondering if anyone knows of ways to work around them.

International standards (e.g., ISO) should be open and royalty-free.  It’s ridiculous if there’s a “standard” that’s locked in to a single vendor.  Can someone explain any sanity to this situation?

My desktop, on the other hand, I keep squeaky clean.  On the other hand, I sometimes have related files on my laptop and desktop… so even more filesystem mayhem.

So I think I need a good way to manage my laptop files.  First off, more self discipline.    Secondly, I’m thinking of a small utility to merge files between two systems.  Perhaps some sort of bi-directional rsync based on modified dates?  Maybe also a method for mapping particular files/directories on one system to the other.  From the days of Windows 9x, I remember something like Windows Briefcase (if that’s what it was called) and it now seems like a decent idea.  Anyone know of this?  If not, maybe it’s time to learn some Glade and pyGTK.

Slides are available here: SSH & GPG. They don’t show everything, as a lot of it was Demo and Q&A, documented below.

This is Part 1 of a two part series.  I got far more questions about the OpenSSH content, so I’ll be focusing on that here.  I’ll add GnuPG content shortly, time permitting.

SSH Basics

Connect to a remote servia via ssh:

ssh USERNAME@HOSTNAME [Optional command to execute]

To generate a SSH keypair and transfer it to remote server for authentication:

ssh-keygen -t rsa && ssh-copy-id HOSTNAME

You can then send it to more HOSTNAMEs just be repeating the ssh-copy-id HOSTNAME step.

Setting up a Config File

By creating a file .ssh/config, you can permanently set certain options.  Each server is represented by a Host stanza, and the value of this is how you refer to the server.  For example:

Host router1
    HostName router1.example.com
    Port 2222
    Username admin

Performing “ssh router1″ with this config file is equivalent to “ssh admin@router1.example.com -p2222″, saving a lot of typing for those servers you connect to all the time!  In the advanced section below, I’ll demonstrate both the command-line option and the config file option.

Advanced SSH Features

The following sections demonstrate some of the more advanced ways SSH can help secure your communications and save you time.

TCP Connection Tunneling

If you want to create an encrypted tunnel out of your current network for a service, you can use the -L SSH option.  It takes -L localport:remotehost:remoteport.  You then connect your application to localhost:localport, and it acts like you’re connecting from your SSH server!  Great for getting around/behind firewalls.

ssh -L 25:mailserver:25 user@host
ssh -L 1080:socksserver:1080 user@host

In .ssh/config:

LocalForward localport remotehost:remoteport

If you want, you can also have SSH act like a SOCKS server, and all communications between your client and this virtual socks server will be encrypted!  Set up your client application to connect to a SOCKS 4/5 proxy on localhost, port 8080, and then connect to an SSH server via:

ssh -D 8080 user@host

In .ssh/config:

DynamicForward 8080

Multiple SSH sessions in one connection

You can use a single TCP connection for multiple SSH sessions to the same server.  This reduces latency in starting the 2nd and further connections, and does not require additional authentications.  This is very useful when doing frequent operations over SSH.  This is only really useful when specified in the .ssh/config file as this:

ControlMaster auto
ControlPath ~/.ssh/master-%r@%h:%p

Using ssh in a pipe.

It can be useful to send data from one side to another via an ssh connection.  Perhaps there is some filter only installed on the remote system, or you wish to copy over a large directory structure but rsync is absent on the remote system.

# copy dir1 to dir2 on target without rsync, as one command:
tar cz dir1 | ssh target tar xz -C dir2
# use hexdump on the remote system
cat somefile | ssh target hexdump

Store your SSH key in memory for your session.

You can store the SSH key in memory, already decrypted, to avoid having to put in your passphrase repeatedly.  This allows it to stay encrypted on disk and protect your key from tampering.

eval `ssh-agent`
ssh-add

You can also use Keychain from the Gentoo project (though now available in most distributions) to maintain a per-reboot ssh-agent session.  This is very useful on desktops as it is available to all terminals and applications rather than a single shell session.  Full documentation for keychain is available at: http://www.gentoo.org/proj/en/keychain/

Conclusion

If you have any questions or feel anything needs a clarification, leave a comment and I’ll be happy to update with more content!

Mark Shuttleworth, the founder of Ubuntu, wrote:

Mozilla Corp asked that this be added in order for us to continue to call the browser Firefox. Since Firefox is their trademark, which we intend to respect, we have the choice of working with Mozilla to meet their requirements, or switching to an unbranded browser. [...]

I think it’s perfectly reasonable for Mozilla to have requirements and guidelines for the use of their trademark [...] That said, I would not consider an EULA as a best practice. It’s unfortunate that Mozilla feels this is absolutely necessary, but they do, and none of us are in a position to be experts about the legal constraints which Mozilla feels apply to them.[...]

Please feel free to make constructive suggestions as to how we can meet Mozilla’s requirements while improving the user experience. It’s not constructive to say “WTF?”, nor is it constructive to rant and rave in allcaps. Your software freedoms are built on legal grounds, as are Mozilla’s rights in the Firefox trademark. To act as though your rights are being infringed misses the point of free software by a mile.

I have to completely agree with this.  The reaction of the community is, in some cases, completely irrational.  People ‘threaten’ to fork Ubuntu if this EULA is displayed; people state they have to use another distribution because Ubuntu is not listening, etc., etc.  What people somehow don’t get is that it’s NOT Ubuntu’s choice: they can either ship FF with the EULA popup or remove all branding and ship it under another name (ala Iceweasel), which would probably be a slight burden to Ubuntu adoption.  (People migrating from Windows would have no idea what Iceweasel is.) I do think it’s somewhat shortsighted of Mozilla to feel that an EULA is necessary to call the browser ‘Firefox’, but that’s the route they’ve chosen.  If you don’t like the EULA, you can choose to install the ‘abrowser’ package or another browser.

Unfortunately for me, I don’t see a lot of choice but to use Firefox or abrowser: I regularly use a half-dozen extensions (Ubiquity, NoScript, Ad Block Plus, Web Developer Toolbar, UnMHT, etc.), and I don’t know of any other browser with that sort of flexibility.  Midori, the alternative browser in Gnome in Intrepid, seems to have a seriously hard time rendering some pages, and I haven’t even thought about trying Flash in it.

It also makes me begin to think about alternative e-mail clients.  Can anyone recommend a client that supports GPG signing/encryption, multiple address books, and can import from Thunderbird?  It would also need to support something similar to Thunderbird’s identities, as I use multiple e-mail addresses associated with a single account (as well as multiple accounts).

I’m a complete fan of open source, but I also realize that Mozilla has to protect its brand.  Mozilla is a business that has funded a great deal of Open Source Development, and that wouldn’t have been possible without the partnership with Google and other aspects of the Firefox brand.  Software companies have to generate a stream of revenue somehow, and I think the people who are using the Launchpad bug as a forum are missing that.

• Basic SSH usage.
• Public Key Authentication
• SSH Tunneling
• SSH Socks Emulation
• GPG key generation
• GPG signing and encryption (command-line)
• Thunderbird integration (enigmail)

If anyone has any input on additional points to be covered or anything of that nature, please drop me a comment here or send me an email at david -at- webgroup -dot- org.

Here’s the backstory:
My girlfriend and I occasionally travel and we take a LOT of pictures.  (Hey, digital cameras make it so easy, right?)  In the 4 years we’ve been together, I would say we have ca. 10,000 images.  And they’re all sitting on a shared drive off my desktop.  They’re in directories on a per-trip basis, but not really organized beyond that, so finding a photo involves scrolling through thumbnails: sometimes as many as 1000.  What I’d like to be able to do is access this share and tag the photos and be able to search through the tags.  Seems relatively straightforward, but since my girlfriend uses Windows, it needs to be cross-platform.  And I’d like it if it was (semi) stable if both of us access it at the same time.  I don’t need photo editing, though I’d like to be able to directly open a local photo editor for cropping/other work.

Anyone know of something that meets these requirements?  If nothing can be found, I may end up implementing something in, say, Python, but I don’t like to reinvent the wheel.

After the Senate’s complete ignorance of anything remotely resembling the American Constitution, they voted 69-28 to grant telecom companies immunity for their role in illegal and unethical wiretaps.  Looks like it’s now okay to monitor communications without a proper warrant.  (The lack of warrant, admittedly, has more to do with the USA Patriot act than the FISA amendment.)

Sen. Obama, the presumed Democratic nominee for President, voted for the amendment.  Looks like his campaign speeches about civil liberties in this country don’t extend quite so far as the Senate floor.  Perhaps he thought that he would be labeled as un-patriotic for supporting the Constitution.  In any case, I had been prepared to support Sen. Obama, however his vote on this issue and changes in his speeches since Sen. Clinton dropped out of the race has made me significantly question that.  Maybe he’d like to use the Constitution for White House toilet paper, if he makes it there.

Also notable is that Sen. McCain couldn’t even be bothered to vote.  I guess he had better things to do, like the never-ending presidential campaign.  Or, perhaps, it just escaped his elderly mind, as things like the Bill of Rights and your job as a United States Senator tend to do once you reach his age.

In any case, it’s a shame that there’s no Presidential candidate who wants to support the people.  Instead, we will continue to have a country driven by a fear of 3rd-world people hiding in caves and remote villages in the Middle East.