Secret Lair Labs

Really, Brother?

2012-01-04T04:13:00.001-08:00

This is popping up on my screen every five minutes.

Really? Ink Low?
Doesn't look low to me, and certainly not low enough to be BUGGING ME EVERY FIVE MINUTES.

I'd expect it to be complaining at 15%-25%, not "hey, your black dropped below 50%!"

I think I'm going to change the printer's assigned hostname from the router to 'navi'.

"HEY, LISTEN! HEY, LISTEN! HEY, LISTEN!"

1976 Jaguar XJ-12 with Chevy 350 For Sale!

2011-12-09T06:01:00.001-08:00

Hello, all my friends on the internet reading this.

My friends and I are in a bit of a rough spot. We're sort of short on the rent, this month. Y'see, we're about 45 days into bootstrapping a little film business here in california, trying to run things in a 'stack-all-the-added-value' sort of way. We've got some fancy camera gear (Epic X & 5D Mk2, KesslerCrane 12' Jib, Zoom H4N & Mics), but it ain't all ours yet. We rented a fancy location to shoot and live in, but it ain't all ours yet. We're still linking up with people and pitching for jobs.

Here's some of the awesomeness we've thrown together in the last few weeks:

As part of our awesome film gear, we had to have an awesome car to film. She shows up in the first clip.

It's Nate North's Silver Jaguar XJ-12.

She's had her Jaguar V-12 engine replaced about 10000 miles ago with a reliable Chevy V-8 350, since the Jaguar has a relatively standard GM-compatible driveline. There are two gas tanks with a dashboard console button to switch between them.

I believe it also has a T700-R4 transmission with a 30% overdrive, so for a V8, it does pretty well on the road.
She's all mechanical, so if you're looking to increase milage, HHO Kits Direct has some pretty awesome holiday deals right now.
Plenty of room under her hood, Power windows, Heater, Working AC, Viper car alarm controlling power locks, spiffy clean red interior.

Anyway, I'll get to the point. Sadly, we're going to have to let her go. But I'd like her to find a good home.
She'd make a wonderful holiday gift for a car tinkerer. That's where you come in, internet.

To make sure my friends have a cheerful holiday, I'm willing to pack her on a U-Haul car-hauler off the back of a 10' U-Haul truck,
and drive her to any destination out to as far as, maybe Texas, maybe further.
I'm willing to show up at your place, christmas evening or morning to unload her, then take a Greyhound back home to Los Banos.

Right now, we're asking $7000, or taking the best offer we get.

I'm sorta hoping there's someone out there with some holiday spirit willing to keep us burning into January with a little more to eat with; but we are humble folk, and will continue on our diet of homemade bisquick pan-pizzas and spaghetti with various sauces. Inexpensive, yet delicious!

Alternatively... If you don't want the car, We're for hire doing all sorts of things... :)

Pass this around your G+ Circles, give us a holler here in the comments, send me an email at Kamilion@gmail.com, a voicemail* at (408) 890-7463, or track down one of my housemates on the internet, we'd love to hear from you!

* My apologies, I have run out of money to pay T-Mobile this month, but Google Voice will still be happy to transcribe your message and email it to me!

"Asking questions is important, because that's when intuition gets converted into inspiration."

2011-12-08T16:01:00.001-08:00

So I changed my email signature recently and trimmed out some of the quotes in it.
I got an email from a friend of mine who noticed, and happened to ask about who the author of the quotes were.

The answer is: Me!

"Asking questions is important, because that's when intuition gets converted into inspiration."

Let me give you an example, I call it:

"How to learn CSS in 40 minutes."

Many thanks to wraith of Lytedev.com for his assistance!

[15:20:46] [Kamilion] cause you scrolled my CSS question off the screen when wraith came back
[15:20:56] [wraith] sorry
[15:21:02] [wraith] little brother has a play - about to leave
[15:21:09] [Kamilion] wraith: ah, no worries then
[15:21:09] [wraith] what's the Q, Kami?
[15:21:16] [wraith] I got ~20 mins
[15:21:16] [Kamilion] oh okay
[15:21:32] [Kamilion] I have a "CSS" field here in drupal
[15:21:43] [Kamilion] and I'm trying to figure out what to stuff in it
[15:22:11] [wraith] pic/
[15:22:13] [wraith] ?
[15:22:20] [wraith] I need a context...
[15:22:38] [wraith] it's probably the class that it's identified as by the CSS
[15:22:45] [wraith] but I dunno
[15:23:29] [Kamilion] Styles for regions
[15:23:29] [Kamilion]  
[15:23:29] [Kamilion] Configure styles which you can add to regions on the "manage display" screens. Add multiple styles line per line.
[15:23:29] [Kamilion] If you want to have a friendly name, separate class and friendly name by |, but this is not required. eg:
[15:23:29] [Kamilion] class_name_1
[15:23:29] [Kamilion] class_name_2|Friendly name
[15:23:29] [Kamilion] class_name_3
[15:23:54] [Kamilion] so it's asking for a CSS class
[15:24:10] [wraith] yeah - classes basically say how an element can be referenced or get'd
[15:24:14] [Kamilion] http://files.sllabs.com/files/theme/style.css
[15:24:19] [Kamilion] there's the existing classes
[15:24:31] [Kamilion] and I'm trying to figure out how to call one, ANY of them
[15:24:32] [wraith] well you give it classes based on what styles you want it to inherit
[15:25:08] [Kamilion] I got that part
[15:25:12] [Kamilion] but like
[15:25:16] [wraith] so if there are styles for the ".green-button" class that you want your element to inherit, you would give it the "green-button" class
[15:25:36] [Kamilion] ah after the dot is the class?
[15:25:41] [wraith] yep
[15:25:43] [Kamilion] what's the #thisthingcalled
[15:25:46] [wraith] . identifies classes
[15:25:49] [wraith] # identifies ids
[15:25:53] [Kamilion] ids
[15:25:55] [Kamilion] okay
[15:26:00] [Kamilion] so that's a CSS ID
[15:26:03] [wraith] and no symbol prefix means an html element
[15:26:06] [Kamilion] and the . below is the classes
[15:26:10] [Kamilion] yeah
[15:26:13] [Kamilion] I saw those at the top
[15:26:21] [wraith] yep - they're generally declared first
[15:26:26] [Kamilion] figured that was 'do this for any html element you see by default'
[15:26:32] [wraith] yup
[15:26:37] [Kamilion] then clearfix
[15:26:40] [Kamilion] which i read up on
[15:26:51] [Kamilion] fixes z order for things like colorboxes
[15:27:12] [wraith] and helps re-heighten blocks which contain floated elements
[15:27:13] [wraith] yep
[15:27:14] [Kamilion] cause it's definied at the top after the html elements
[15:27:25] [wraith] yeah - it's an important helper class to have 
[15:27:36] [Kamilion] but then I'm kinda lost
[15:27:42] [Kamilion] it starts defining IDs
[15:27:50] [wraith] yeah - stylesheets get pretty big pretty fast
[15:27:57] [wraith] so what you wanna do is this:
[15:28:02] [wraith] find other elements on the page
[15:28:12] [wraith] that have the style you want for your new element
[15:28:15] [wraith] see which classes it's got
[15:28:21] [wraith] and give your element the same classes
[15:28:28] [wraith] it will therefore inherit the same styles
[15:28:39] [wraith] and if everything is done right, you will have successfully imitated the element
[15:28:45] [wraith] if you're wanting to make something new
[15:29:02] [wraith] you'll have to find different elements that seem to have bits and pieces of the styles you want to inherit
[15:29:03] [Kamilion] .footer-gallery-block { width: 260px; } 
[15:29:03] [Kamilion] .footer-gallery-block img { background-color: #191F2F; border: 1px solid #252C3E; float: left; margin-bottom: 10px; margin-right: 9px; padding: 5px; }
[15:29:03] [Kamilion] #footer ul.twitter { -moz-border-radius: 10px; -webkit-border-radius: 10px; border-radius: 10px; background: url("images/tweetbg.png") repeat scroll 0 0 transparent;
[15:29:03] [Kamilion] list-style-type: none; padding: 10px; width: 280px; margin-left:0; }
[15:29:24] [Kamilion] that appears in the middle of a bunch of #footer stuff above it
[15:29:32] [Kamilion] but the gallery block doesn't have the ID defined
[15:29:42] [wraith] Kamilion: is this still lensipedia?
[15:29:43] [Kamilion] and then they pick up with the same ID after the gallery block
[15:29:44] [Kamilion] yeah
[15:29:54] [Kamilion] bout halfway down that style.css
[15:30:02] [Kamilion] http://files.sllabs.com/files/theme/style.css
[15:30:26] [wraith] got it
[15:30:35] [Kamilion] I think I want to be dealing in the node area, which is just below that
[15:30:46] [Kamilion] since that's where most of my 'content' is displayed
[15:30:52] [Kamilion] but there's no id there
[15:30:57] [wraith] so what kind of elements are you trying to create here?
[15:31:04] [wraith] what's it supposed to do and be?
[15:31:19] [Kamilion] Well, I've got a couple things I want to do
[15:31:34] [Kamilion] first, I want to define a non-repeating background image for some of these articles
[15:31:43] [Kamilion] but only on some *types* of articles
[15:31:52] [wraith] gotcha
[15:31:52] [Kamilion] eg, canon_lenses but not nikon_lenses, for now
[15:32:03] [wraith] so then you want to make a class
[15:32:10] [Kamilion] so I need to figure out what both of those have in common
[15:32:37] [wraith] yep
[15:32:39] [Kamilion] and then choose a specific image based on, eg, the article's content type
[15:32:40] [wraith] node-canon-lens
[15:32:43] [wraith] that's the class
[15:32:54] [Kamilion] it's making some?
[15:32:57] [wraith] yeah
[15:33:05] [Kamilion] and there's just nothing attached to that in the css
[15:33:17] [wraith] so then you need to put in what you want
[15:33:23] [wraith] that is, a non-repeating background-image
[15:33:42] [Kamilion] okay, second task;
[15:34:04] [Kamilion] http://lensapedia.com/tags/canon-lens?page=6
[15:34:06] [Bottien] Title: Canon Lens | lensapedia.com (at lensapedia.com)
[15:34:13] [Kamilion] this is a 3-column layout
[15:34:20] [Kamilion] I can add a css class to each column
[15:34:33] [Kamilion] i want to add this to the 'right' column
[15:34:51] [Kamilion] where the retail price and stuff is
[15:34:56] [Kamilion] then style those elements
[15:35:14] [wraith] that's class "group-right"
[15:35:14] [Kamilion] what is my workflow for finding these elements and styling them?
[15:35:18] [wraith] so in the stylesheet
[15:35:21] [wraith] you'll wanna reference
[15:35:35] [wraith] .ds-3col-stacked .group right { /* CSS */ }
[15:35:48] [wraith] you using chrome?
[15:35:50] [Kamilion] yeah
[15:35:52] [Kamilion] chromium 17
[15:36:04] [wraith] right click the element, inspect element
[15:36:09] [wraith] be sure it's really your element
[15:36:18] [Kamilion] k, I think I see it
[15:36:22] [Kamilion] yeah
[15:36:24] [wraith] if not, hover around until you find the box that encompasses your element
[15:36:24] [Kamilion] class grou-right
[15:36:24] [wraith] then
[15:36:29] [wraith] just look at the classes
[15:36:29] [Kamilion] then a bunch of fields
[15:36:31] [Kamilion] okay
[15:36:32] [wraith] space-separated
[15:36:48] [Kamilion] right, so field effects them all, field-name-field-msrp
[15:36:56] [wraith] right
[15:37:11] [Kamilion] that will tag only that field
[15:37:11] [wraith] elements can have multiple classes
[15:37:13] [wraith] any of which
[15:37:18] [wraith] can select that element
[15:37:20] [wraith] right
[15:37:21] [wraith] you got it
[15:37:44] [Kamilion] so this is #group-right .field-name-field { do-it-here:stuff }
[15:37:44] [wraith] it's kinda like OOP
[15:37:50] [wraith] nope
[15:37:55] [wraith] .group-right
[15:37:58] [wraith] not #group-right
[15:38:03] [wraith] since it's a class
[15:38:05] [wraith] not an id
[15:38:19] [wraith] 'class="group-right"' not 'id="group-right"'
[15:38:27] [Kamilion] okay so if I wanted to dick with field-name-field-msrp
[15:38:37] [Kamilion] which is under group-right
[15:38:39] [Kamilion] in the html
[15:38:50] [wraith] .group-right .field-name-field-msrp { /* CSS */ }
[15:38:56] [Kamilion] AH.
[15:39:00] [wraith] . selects classes, # selects ids
[15:39:06] [wraith] so you'll generally use .
[15:39:15] [Kamilion] Oh I see, so I'm doing the selectors inside the CSS itself
[15:39:20] [wraith] yep
[15:39:29] [Kamilion] see, this is why I needed a people
[15:39:37] [wraith] I understand =D
[15:39:41] [Kamilion] all the books and all the kings blog posts couldn't put humpty dumpty together
[15:39:50] [Kamilion] rightyo
[15:40:04] [Kamilion] so lemme syntax this one
[15:40:40] [Kamilion] .group-right .field-name-field-msrp { background: url("images/tweetbg.png") repeat scroll 0 0 transparent; }
[15:41:03] [Kamilion] that would ONLY affect MSRP if it was in that right handed box
[15:41:04] [wraith] sounds good
[15:41:08] [wraith] yep
[15:41:12] [Kamilion] if I moved the field to the left handed box
[15:41:15] [wraith] or in AN right-handed box
[15:41:18] [wraith] ANY*
[15:41:18] [Kamilion] say inside the actual clicky article
[15:41:27] [Kamilion] then I could style it totally differently
[15:41:29] [wraith] then it won't style it that specific way, right
[15:41:31] [wraith] yep
[15:41:40] [wraith] it has to meet all the selectors in the html and in that order
[15:41:50] [Kamilion] ... All of them?
[15:41:55] [wraith] yep

[15:42:55] [Kamilion] so if field-type-number-float is never defined
[15:43:03] [Kamilion] then it's just ignored in the html until I go and define it
[15:43:18] [wraith] right
[15:43:26] [wraith] because the CSS will never go look for it
[15:43:45] [Kamilion] okay, so where in this style.css would I put that?
[15:43:49] [wraith] anywhere
[15:43:50] [wraith] but, keep it organized, so
[15:44:02] [wraith] preferrably with similar selections
[15:44:08] [Kamilion] .group-right .field-name-field-msrp { background: url("images/tweetbg.png") repeat scroll 0 0 transparent; }
[15:44:16] [Kamilion] should I put that under the node comment?
[15:44:29] [Kamilion] since that's where in my mind, I'm wanting it applied?
[15:44:51] [wraith] yep
[15:44:54] [Kamilion] then go into defining links and search blocks under there
[15:44:54] [wraith] however it works in your mind
[15:45:02] [wraith] my personal way, is to go from top to bottom
[15:45:10] Kamilion nods
[15:45:12] [wraith] so I start with the body, (and any other html elements)
[15:45:14] [wraith] then move down
[15:45:15] [wraith] header,
[15:45:16] [wraith] content
[15:45:18] [wraith] sidebar
[15:45:21] [wraith] footer
[15:45:30] [wraith] and put everything kind of in order that way
[15:45:32] [wraith] however
[15:45:39] [wraith] that's not how most people do it, but do it how you see fit
[15:45:48] [Kamilion] well, under the searchblock they define specific behavior for, the front page image slideshow, and some other minor html 'extras'
[15:45:59] [Kamilion] tr.even and tr.odd
[15:46:06] [wraith] yeah
[15:46:17] [wraith] what you could also do
[15:46:22] [Kamilion] when the credits were referenced, they were also at the bottom of the page
[15:46:25] [wraith] is just keep user-defines stuff at the VERY bottom
[15:46:25] [Kamilion] but
[15:46:29] [Kamilion] Ahh
[15:46:30] [Kamilion] okay
[15:46:36] [Kamilion] there's already a few of those
[15:46:45] [wraith] well there ya go - that'll work just fine too
[15:46:47] [Kamilion] but like
[15:46:56] [Kamilion] just above the credits section is the 'top social network icons'
[15:46:56] [wraith] that way if you every change templates, you know which stuff is yours
[15:47:03] [Kamilion] meaning the social network icons in the top bar of the site
[15:47:06] [Kamilion] above even the header
[15:47:10] [Kamilion] where the search box is
[15:47:16] [wraith] yeah, like I said, most people don't do it the way I do
[15:47:20] Kamilion nods
[15:47:24] [Kamilion] anyway
[15:47:31] [Kamilion] thanks for the help man, go support your little brother
[15:47:37] [wraith] np - cya later =)
[15:47:39] [Kamilion] Much appreciated.
[15:47:43] Kamilion save-logs
[15:47:46] [wraith] absolutely
[15:48:09] Kamilion holds CSS over his head
[15:48:11] [wraith] lol
[15:48:12] [wraith] ok
[15:48:14] [Kamilion] Da na na NAAA
[15:48:15] [wraith] bbl
[15:48:18] Kamilion waves

OOPs, time to catch up to the rest of the internet...

2011-03-24T15:02:00.000-07:00

"Object-oriented programming is eliminated entirely from the introductory curriculum, because it is both anti-modular and anti-parallel by its very nature, and hence unsuitable for a modern CS curriculum. A proposed new course on object-oriented design methodology will be offered at the sophomore level for those students who wish to study this topic."

https://existentialtype.wordpress.com/2011/03/15/teaching-fp-to-freshmen/
http://lwn.net/Articles/434745/

Finally. Advocating Object-Oriented Programming is like advocating Pants-Oriented Clothing.

Parsing HTML with Cthulhu

2010-09-14T14:01:00.000-07:00

You can't parse [X]HTML with regex. Because HTML can't be parsed by regex. Regex is not a tool that can be used to correctly parse HTML. As I have answered in HTML-and-regex questions here so many times before, the use of regex will not allow you to consume HTML. Regular expressions are a tool that is insufficiently sophisticated to understand the constructs employed by HTML. HTML is not a regular language and hence cannot be parsed by regular expressions. Regex queries are not equipped to break down HTML into its meaningful parts. so many times but it is not getting to me. Even enhanced irregular regular expressions as used by Perl are not up to the task of parsing HTML. You will never make me crack. HTML is a language of sufficient complexity that it cannot be parsed by regular expressions. Even Jon Skeet cannot parse HTML using regular expressions. Every time you attempt to parse HTML with regular expressions, the unholy child weeps the blood of virgins, and Russian hackers pwn your webapp. Parsing HTML with regex summons tainted souls into the realm of the living. HTML and regex go together like love, marriage, and ritual infanticide. The <center> cannot hold it is too late. The force of regex and HTML together in the same conceptual space will destroy your mind like so much watery putty. If you parse HTML with regex you are giving in to Them and their blasphemous ways which doom us all to inhuman toil for the One whose Name cannot be expressed in the Basic Multilingual Plane, he comes. HTML-plus-regexp will liquify the nerves of the sentient whilst you observe, your psyche withering in the onslaught of horror. Rege̿̔̉x-based HTML parsers are the cancer that is killing StackOverflow it is too late it is too late we cannot be saved the trangession of a chi͡ld ensures regex will consume all living tissue (except for HTML which it cannot, as previously prophesied)dear lord help us how can anyone survive this scourge using regex to parse HTML has doomed humanity to an eternity of dread torture and security holes using regex as a tool to process HTML establishes a breach between this world and the dread realm of c͒ͪo͛ͫrrupt entities (like SGML entities, butmore corrupt) a mere glimpse of the world of regex parsers for HTML will instantly transport a programmer's consciousness into a world of ceaseless screaming, he comes~~, the pestilent sl~~ithy regex-infection will devour your HTML parser, application and existence for all time like Visual Basic only worse he comes he comes do not fight he com̡e̶s, ̕h̵is un̨ho͞ly radiańcé destro҉ying all enli̍̈́̂̈́ghtenment, HTML tags lea͠ki̧n͘g fr̶ǫm ̡yo͟ur eye͢s̸ ̛l̕ik͏e liquid pain, the song of re̸gular expre~~ssion parsing~~ will extinguish the voices of mortal man from the sphere I can see it can you see ̲͚̖͔̙î̩́t̲͎̩̱͔́̋̀ it is beautiful the final snuffing of the lies of Man ALL IS LOŚ͖̩͇̗̪̏̈́T ALL IS LOST the pon̷y he comes he c̶̮om~~es he co~~mes theichor permeates all MY FACE MY FACE ᵒh god no NO NOO̼OO NΘ stop the an*̶͑̾̾̅ͫ͏̙̤g͇̫͛͆̾ͫ̑͆l͖͉̗̩̳̟̍ͫͥͨe̠̅s ͎a̧͈͖r̽̾̈́͒͑e not rè̑ͧ̌aͨl̘̝̙̃ͤ͂̾̆ ZA̡͊͠͝LGΌ ISͮ̂҉̯͈͕̹̘̱ TO͇̹̺ͅƝ̴ȳ̳ TH̘Ë͖́̉ ͠P̯͍̭O̚N̐Y̡ H̸̡̪̯ͨ͊̽̅̾̎Ȩ̬̩̾͛ͪ̈́̀́͘ ̶̧̨̱̹̭̯ͧ̾ͬC̷̙̲̝͖ͭ̏ͥͮ͟Oͮ͏̮̪̝͍M̲̖͊̒ͪͩͬ̚̚͜Ȇ̴̟̟͙̞ͩ͌͝S̨̥̫͎̭ͯ̿̔̀ͅ

see: http://www.codinghorror.com/blog/2009/11/parsing-html-the-cthulhu-way.html

and: http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags

and: http://esr.ibiblio.org/?p=1411

Want your own psychopathic crazy text? http://www.textozor.com/ serves all your smudged and blotted needs.

Malware and Virus Scans

2010-08-26T11:53:00.000-07:00

So, a lot of my associates are Windows users out of necessity.

Got an email this morning:
"Our pc's fans started goin off again on full blast. We already did the virus detection and surprisngly it found viruses and deleted them. But today it started on full blast again. Any ideas?"

... Stop letting people use Internet Explorer? ;)

There's some .PDF, Flash, and JAVA vulnerabilities going around now; make sure you patch up your Adobe Reader and Flash Player to current, Update your JAVA to 6u22 or higher, run TFC.exe and then run a malware bytes scan.

After MBAM finishes cleaning up; go into the Windows Scheduled Tasks in control panel and remove any suspicious jobs (Lot of the nasty ones are untitled and look like a GUID like
"{21EC2020-3AEA-1069-A2DD-08002B30309D}")

Then fire up process explorer, Options Menu -> Verify Image Signatures, View -> Select Columns and make sure "Verified Signer" is checkboxed, View -> Show Process Tree, click the - by wininit.exe to hide system services and kill off anything that doesn't have an entry in the Company Name field. (Kill *Any* Unsigned EXEs, even stuff from Logitech mouse drivers and Realtek audio controls)

In fact, you can usually prune every user process off except for the root Explorer.exe process.
If you're careful, you can even kill off most services other than svchost.exe and
anything with "(Verified) Microsoft Windows" in the Verified Signer column.

Then fire up autoruns.exe and remove any suspicious startup entries. Heck, if you can, remove everything but the nvidia/ATI driver autoruns.

Now run TFC.exe once more to make sure all the tempdirs are emptied.

Alternatively, you can run an offline scan with a bootcd like AVIRA's Rescue CD -- the ISOs are updated weeklyish.

http://dlpro.antivir.com/package/rescue_system/common/en/rescue_system-common-en.exe

AVAST's also a good option.
http://www.avast.com/free-antivirus-download

Your best choice is to get Chrome, Chromium, or Firefox and load them with the Adblock and PDF Download extension that prompts you to download PDFs -- just click cancel if the prompt comes up unless you intentionally clicked a PDF link yourself.

Myself, I use Chromium and Chrome Adblock. Chromium has an internal PDF renderer that doesn't rely on Adobe, and it's sandboxed by default. You can enable it from chrome://plugins/ which also will warn you if other plugins are not up to date.

Still, it pays to be careful.
If you'd like to see how sophisticated some of these attacks are, check out this series of articles:
http://www.h-online.com/security/features/CSI-Internet-HQ-1050609.html

Drupal on nginx

2010-08-26T02:17:00.000-07:00

Just got an email from someone asking for my drupal config template, Ask and ye shall receive:

# Search and replace subdomain.fqdn.com with your domain info.
server {
listen 80;
server_name subdomain.fqdn.com;
access_log /var/www/sites/subdomain.fqdn.com/logs/access.log;
error_log /var/www/sites/subdomain.fqdn.com/logs/error.log;

# EXPERIMENTAL
#location / {
# root /var/www;
# index index.php;
# error_page 404 = @drupal;
#}
#
#location @drupal {
# rewrite ^(.*)$ /index.php?q=$1 last;
#}

# Set site_root
root /var/www/sites/subdomain.fqdn.com/public/;
index index.php index.html;

# Set doc_root (Drupal CleanURLs)
location / {
if (!-e $request_filename) {
rewrite ^/(.*)$ /index.php?q=$1 last;
}
}

# hide protected files
location ~* \.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$ {
deny all;
}

# serve static files directly
location ~* ^.+\.(jpg|jpeg|gif|css|png|js|ico)$ {
rewrite ^/favicon.ico$ /sites/default/themes/mytheme/favicon.ico break;
access_log off;
expires 30d;
}

# Install Imagecache module, update the location, enable this directive
location ^~ /sites/default/files/imagecache/ {
index index.php index.html;
# assume a clean URL is requested, and rewrite to index.php
if (!-e $request_filename) {
rewrite ^/(.*)$ /index.php?q=$1 last;
break;
}
}

location ^~ /sites/default/files/downloads/ {
index index.php index.html;
autoindex on;
}

# FastCGI Via Socket
location ~ \.php$ {
fastcgi_pass unix:/tmp/php-fastcgi.socket; #127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www/sites/subdomain.fqdn.com/public$fastcgi_script_name;
include fastcgi_params;
}
}

# Proxy Via Socket or TCP
#location ~ \.php$ {
# proxy_pass unix:/tmp/php-fastcgi.socket; #127.0.0.1:9000;
# proxy_connect_timeout 15;
# proxy_redirect default;
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# #proxy_set_header X-Forwarded-Proto https;
# }
}

### Redirect www to root domain?
#server {
# listen 80;
# server_name www.subdomain.fqdn.com;
# rewrite ^/(.*) http://subdomain.fqdn.com/$1 permanent;
# }

### Redirect root domain to www?
#server {
# listen 80;
# server_name subdomain.fqdn.com;
# rewrite ^/(.*) http://www.subdomain.fqdn.com/$1 permanent;
# }

### HTTPS server
#server {
# listen 443;
# server_name subdomain.fqdn.com;
# ssl on;
# ssl_certificate /var/www/sites/subdomain.fqdn.com/private/cert.pem;
# ssl_certificate_key /var/www/sites/subdomain.fqdn.com/private/cert.key;
# ssl_session_timeout 5m;
# ssl_protocols SSLv2 SSLv3 TLSv1;
# ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
# ssl_prefer_server_ciphers on;
# access_log /var/www/sites/subdomain.fqdn.com/logs/secure.access.log;
# error_log /var/www/sites/subdomain.fqdn.com/logs/secure.error.log;
# location / {
# root /var/www/sites/subdomain.fqdn.com/public/;
# index index.php index.html;
# }
# location ~ \.php$ {
# fastcgi_pass unix:/tmp/php-fastcgi.socket; #127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /var/www/sites/subdomain.fqdn.com/public$fastcgi_script_name;
# include fastcgi_params;
# }
# }

Sometimes you must make the best of what you have available...

2010-08-25T23:19:00.000-07:00

Super Armatrons rock in so many ways.

Every robot that you ever heard of normally employs some sort of individual servo mechanism for powering each joint of the robot. Not so with Armatron; There are no electronics inside at all, in fact the toy is entirely powered by a single motor. All of the toy's functions are controlled by a complex array of mechanical transmissions and gear trains. It's powered by 2 D batteries, directly connected to a power switch and a dinky brushed DC motor that looks to run around 300 RPM; it's very slow. Some clever folks have replaced the motor with a steam engine.

The Box, and the Manual (For posterity)

Yes, you are supposed to keep score yourself. :)

This toy has so many moving parts it almost defies verbal explanation. Shown above is an overview of the base mechanisms. Each of the two joysticks can be moved up/down, left/right and clockwise/counter-clockwise for a total of six movements of the arm. Each of the six movements is bi-directional. Four of the six movements are bi-directional with two speeds in each direction. The joystick linkages (orange parts) control six transmissions (black and white parts). All the transmissions are powered by a single motor on the right. The gearing above the motor is for a timing mechanism described below. The gearing and shafting behind the transmissions connect the transmissions to a series of ring gears described below.

There are three sections to the transmission system: (1) a row of six black forward gears, (2) a row of six black reverse gears and (3) a row of six white indexing drums. The picture above shows the lower row of forward gears without the other two sections of the transmission. The picture also shows how the forward gears drive the output shafting.

The picture above shows how the upper row of six reverse gears mesh with the lower row of six forward gears.

The picture above shows three of the six indexing drums. The red arrow indicates an inner gear fixed to the main drive shaft. One of the outer black gears is for high-speed operation. The other outer black gear is for low-speed operation. Friction between the gears causes the entire drum to rotate about the shaft unless the drum's position is held by one of five indexing tabs. Green arrows indicate four of the five tabs distributed around the drum. The tabs determine which of the two gears on the drum engages the forward or reverse gear. The combinations are slow-forward, fast-forward, slow-reverse and fast-reverse. The fifth index is neutral where no gears are engaged. Note how the left drum is thinner and has only one outer gear. This corresponds to the claw movements, which have only one speed in forward and reverse.

The images above show how the up/down movement of the right joystick controls the indexing of the rightmost drum. This corresponds to the up/down motion of Armatron's shoulder joint.

This picture shows the gear covers back in place. The arm assembly fits into the round ring gear socket. Armatron can continuously rotate through a full 360 degrees. This is made possible by the stack of ring gears. Each movement is transmitted from the base to the arm via a ring gear. The orange and back barrel is a timer mechanism that cuts power to the arm after the allotted time has expired.

Here are all the ring gears layered back in the socket.

This shot shows the underside of the arm assembly that fits into the socket of ring gears.

Here's some drawings of the mechanism ripped from the patents.

Catching up with the configuration curve

2010-08-19T14:21:00.000-07:00

Okay, so, I discovered some new stuff.

First: nginx can be convinced to do close-to-automatic deployments.

sudo tee /etc/nginx/conf.d/autoconfig.conf <<-\EOA
    client_max_body_size 5M;
    client_body_buffer_size 128k;
    proxy_connect_timeout 90;
    proxy_send_timeout 180;
    proxy_read_timeout 180;
    proxy_buffer_size 16k;
    proxy_buffers 8 16k;
    proxy_busy_buffers_size 32k;
    proxy_intercept_errors on;
    fastcgi_connect_timeout 60;
    fastcgi_send_timeout 180;
    fastcgi_read_timeout 180;
    fastcgi_buffer_size 128k;
    fastcgi_buffers 4 256k;
    fastcgi_busy_buffers_size 256k;
    fastcgi_temp_file_write_size 256k;
    fastcgi_intercept_errors on;
    include /var/www/sites/*/config/*;
EOA

Now when you drop a new site into /var/www/sites your configuration will be picked up after an 'reload nginx'! Just rename the config folder to config-disabled and reload 'nginx' to disable a site.

Second: PostgreSQL!

I'm sick of mySQL, Sun, and Oracle. Screw 'em all, time to jump ship to Postgres.
Yay for Drizzle and MariaDB; keep up the good work and don't let The Man (Oracle) keep you down. Maybe I'll come back from the pg-side, maybe not.

apt-get install postgresql php5-pgsql phppgadmin

This is a little more involved to setup than mysql, due to the lack of dbconfig-common support requiring manual setup.

nano /usr/share/phppgadmin/conf/config.inc.php

Now find and change the following line

$conf['extra_login_security'] = true;

$conf['extra_login_security'] = false;

and now all userids can login.

Now, postgresql itself comes in a locked down config out of the box.

sudo su postgres -c psql template1

ALTER USER postgres WITH PASSWORD 'securePassword!';
\q

sudo passwd -d postgres
sudo su postgres -c passwd

nano /etc/postgresql/8.4/main/postgresql.conf

Change the line:

#listen_addresses = 'localhost'

listen_addresses = '*'

and also change the line:

#password_encryption = on

password_encryption = on

nano /etc/postgresql/8.4/main/pg_hba.conf

Set up something like this: (IPv6 is used by default for some reason.)

# IPv6 local connections:
host    all         redmine_user         ::1/128               trust
host    all         all         ::1/128               md5

Easy way to do this is to highlight the ipv6 line, hit Ctrl-K, the up arrow, Ctrl-U, then change the 'all' username to 'redmine_user'.

service postgresql-8.4 restart

And you should be set.

mkdir -p /var/www/sites/phppgadmin/config

sudo tee /var/www/sites/phppgadmin/config/phppgadmin.conf <<-\EOA
server {
        listen 80 default;
        server_name localhost;
        access_log /var/www/sites/phppgadmin/logs/phppgadmin.access.log;
        error_log /var/www/sites/phppgadmin/logs/phppgadmin.error.log;

        location / {
            root /usr/share/phppgadmin;
            index index.php;
            }

        location ~ \.php$ {
            include /etc/nginx/fastcgi_params;
            fastcgi_pass unix:/tmp/php-fastcgi.socket;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /usr/share/phppgadmin$fastcgi_script_name;
            }
        }
EOA

rm /etc/nginx/sites-enabled/default
reload nginx

And viola, postgresql!

Weaving Redmine, RVM, Ruby, Rails, Rack, Thin, and nginx as a reverse proxy

2010-08-04T18:38:00.000-07:00

Yesterday, it came down from On High.

Bossman say 'We need a trouble ticket system.' and Kami say "yes massa!"

A quick trawl of wikipedia's list later, and Redmine's the winner.
Time Tracking, Revision control integration, and full RBAC + lockdown, and all written in my favorite language, Ruby.

So, we'll be starting from where my previous post in the series left off.

You should have Lucid + nginx + php5-fastcgi + phpmyadmin set up already. (Honestly, you can skip the PHP stuff if you're not interested; I keep it around for Drupal and phpmyadmin.)

First: Get some required packages.

apt-get install curl patch git-core subversion autoconf build-essential bison libreadline6 libreadline-dev zlib1g zlib1g-dev libssl-dev libsqlite3-0 libsqlite3-dev sqlite3 libxml2-dev libmysqlclient-dev libpq-dev

Second, install rvm.

bash < <( curl -L http://bit.ly/rvm-install-system-wide )

tee -a ~/.bashrc <<-\EOA
[[ -s '/usr/local/lib/rvm' ]] && source '/usr/local/lib/rvm'
EOA
source '/usr/local/lib/rvm'

Disable ruby's documentation generation (Don't need it on rackspace; skip this if you're on a dev box.)

echo "gem: --no-rdoc --no-ri" >> /etc/gemrc

Install ruby 1.8.7.

rvm install 1.8.7

Now set it as the default.

rvm use --default 1.8.7

Get the sqlite3 gem compiled

gem install sqlite3-ruby

IF this fails, you're probably missing libsqlite3-dev

Get the mysql gem compiled

gem install mysql

IF this fails, you're probably missing libmysqlclient-dev

Get the pg gem compiled

gem install pg

IF this fails, you're probably missing libpq-dev

Install rack 1.0.1








gem install rack -v=1.0.1

Install rails 2.3.5





gem install rails -v=2.3.5

If you want the optional gantt chart generation, you'll need rmagick.

apt-get install libmagick9-dev imagemagick

That will pull down a bunch of -dev packages; now build the native extensions.

gem install rmagick

Now we need a better appserver than webrick. Let's go get thin.














gem install thin
Decide on where you'd like the redmine app to live; I like the private directory under the hostname.

mkdir -p /var/www/redmine.domain.com/private/ && cd /var/www/redmine.domain.com/private/

Now, checkout version 1.0's latest revision.


svn co http://redmine.rubyforge.org/svn/branches/1.0-stable redmine

Okay, we've got redmine; now to configure it. First, let's setup the database. Run this SQL in phpmyadmin:


create database redmine_core character set utf8;
create user 'redmine_user'@'localhost' identified by 'my_password';
grant all privileges on redmine_core.* to 'redmine_user'@'localhost';

Or phppgadmin: (Paste each line separately.)

CREATE ROLE redmine_user LOGIN ENCRYPTED PASSWORD 'my_password' NOINHERIT VALID UNTIL 'infinity';

CREATE DATABASE redmine_core WITH ENCODING='UTF8' OWNER=redmine_user;

Edit the config/database.yml and configure the database settings.

cd redmine/config/ && cp database.yml.example database.yml

production:
  adapter: mysql
  database: redmine_core
  host: localhost
  username: redmine_user
  password: my_password
  encoding: utf8

Or for Postgresql:

production:
  adapter: postgresql
  database: redmine_core
  host: localhost
  username: redmine_user
  password: my_password
  encoding: utf8

Now return to the redmine root (cd ..) and generate the session store.

rake generate_session_store

Now, we'll have redmine populate the database.

RAILS_ENV=production rake db:migrate

You'll be prompted to choose a language here; just hit enter for english.

RAILS_ENV=production rake redmine:load_default_data

Wooo! Let's test it.









ruby script/server thin -e production

Now visit port 3000. You should get a nice blank redmine instance.

Now, for configuring nginx for a reverse proxy test:

server {
        listen                  80;
        server_name             redmine.domain.com;
        access_log              /var/www/redmine.domain.com/log/access.log;
        error_log               /var/www/redmine.domain.com/log/error.log;
        root                    /var/www/redmine.domain.com/public/;

        location / {
                try_files       $uri @fallback;
                }

        location @fallback {
                proxy_pass              http://127.0.0.1:3000;
                proxy_connect_timeout   15;
                proxy_redirect          default;
                proxy_set_header        Host    $host;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                #proxy_set_header       X-Forwarded-Proto       https;
                }
        }

Okay, this works!

Next step: Setting up thin clusters on boot.

thin install

Set up the icky old init-scripts:

update-rc.d -f thin defaults

Now we can add YAML config files in /etc/thin/ !

--- 
pid: tmp/pids/thin-redmine.pid
group: rvm
wait: 30
timeout: 30
log: log/thin.log
max_conns: 1024
require: []

environment: production
max_persistent_conns: 512
servers: 2
daemonize: true
user: www-data
socket: /tmp/thin-redmine.sock
chdir: /var/www/redmine.domain.com/private/redmine

Okay, let's start thin.

service thin start

And fix up our nginx proxy config:

upstream thin_redmine {
   server   unix:/tmp/thin-redmine.0.sock;
   server   unix:/tmp/thin-redmine.1.sock;
}

server {
        listen                  80;
        server_name             redmine.domain.com;
        access_log              /var/www/redmine.domain.com/log/access.log;
        error_log               /var/www/redmine.domain.com/log/error.log;
        root                    /var/www/redmine.domain.com/public/;

        location / {
                try_files       $uri @fallback;
                }

        location @fallback {
                proxy_pass              http://thin_redmine;
                proxy_connect_timeout   15;
                proxy_redirect          default;
                proxy_set_header        Host    $host;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                #proxy_set_header       X-Forwarded-Proto       https;
                }
        }

Enable your configuration and restart nginx.

service nginx reload

...

PROFIT!

Here's some links:

http://code.macournoyer.com/thin/usage/

http://www.redmine.org/wiki/redmine/HowTo_configure_Nginx_to_run_Redmine

gPXE and the HTTP server that could

2010-07-19T11:46:00.000-07:00

eBox 1.4 has support for serving a bootfile over TFTP.

Only it's broken. Oops.

Here's my quick fix:
sudo nano /etc/inetd.conf

Code:

tftp           dgram   udp     wait    root  /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/tftpboot

That /var/lib/tftpboot is where tftp will serve files from.
eBox expects it to be serving a file such as:
/var/lib/ebox/conf/dhcp/eth0/firmware

Code:

tftp           dgram   udp     wait    root  /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/ebox/conf/dhcp/eth0

Now when you 'upload' a new boot file to eBox's dashboard,
/var/lib/ebox/conf/dhcp/ethX/firmware
gets replaced with whatever you've uploaded.

But eBox won't set the dhcp-option 'filename' to serve it.

sudo nano /usr/share/ebox/stubs/dhcp/subnet.mas

Look for

Code:

% if(defined($info{'nextServer'})) {
                next-server <% $info{'nextServer'} %>;
% }
% if(defined($info{'filename'})) {
                filename "<% $info{'filename'} %>";
% }

And change it to

Code:

% if(defined($info{'nextServer'})) {
                next-server <% $info{'nextServer'} %>;
                # Filename entry added by Kamilion (dec 01 2009)
                filename firmware;
% }
% if(defined($info{'filename'})) {
                filename "<% $info{'filename'} %>";
% }

Now we need something to boot.

Go pick up the latest gPXE from here:
http://www.rom-o-matic.net/gpxe/gpxe-git/gpxe.git/contrib/rom-o-matic/build.php

Click Customize.

Change the following Settings:

[X] DOWNLOAD_PROTO_HTTPS
[X] DOWNLOAD_PROTO_FTP

[X] TIME_CMD
[X] DIGEST_CMD

And paste in the following Embedded Script: (Good base, but edit if you wish)

Code:

#!gpxe
echo "Greetings! Hit Ctrl-C to bail out."
sleep 5
echo "Going to DHCP on primary network adapter"
ifopen net0
dhcp net0
echo "Going to try http://netboot/default.gpxe"
chain http://netboot/default.gpxe
echo "Didn't work, we're still here. Falling back to http://boot/default.gpxe"
chain http://boot/default.gpxe
echo "Didn't work, we're still here. Falling back to BKO"
set 209:string pxelinux.cfg/default
set 210:string http://boot.kernel.org/bko/
echo "Here we go, off to boot.kernel.org!"
chain http://boot.kernel.org/bko/pxelinux.0
echo "Didn't work, we're still here. No Internet connection? Falling back to next BIOS Boot device"

You should get a single .pxe file back after clicking Get Image.

Go to DHCP -> Interface -> Advanced Options -> Thin Client.
Settings:
Next server: eBox
File Name [browse]
File path in next server:

Click "Change" to complete the settings, then Save Changes.

Place this file in the root of your HTTP server, named default.gpxe, and create a DNS alias to that machine named 'netboot'.

Code:

#!gpxe
imgfree
chain http://netboot/boot/menu.gpxe

Here's an example you can use to load Parted Magic:

Code:

#!gpxe
imgfree
kernel -n img http://bigblock/boot/pmagic/4.5/bzImage load_ramdisk=1 prompt_ramdisk=0 keymap=us loglevel=0 rw sleep=4
initrd http://bigblock/boot/pmagic/4.5/initramfs
boot img

Here's an example you can use to boot from iSCSI.

Code:

#!gpxe
imgfree
#dhcp net0
set keep-san 1
sanboot iscsi:10.10.10.250::::iqn.bigblock:storage.iscsikarmic-one
chain http://10.10.10.250/boot/iscsi.gpxe

More examples here: http://boot.sllabs.com/boot/

How to use u3-tool in Lucid

2010-07-16T16:47:00.000-07:00

As my few blog visitors may be aware, I've been using the U3 customizer for windows for a long time on my 4GB cruzers to make them bootable.

http://blog.sllabs.com/2008/05/booting-heron-from-u3.html

I came across the u3-tool sometime ago when I bought my Clarion MiND, but I've only actually used it recently.

The U3 Customizer tools were released somewhere in 2005 and won't work in anything but windows XP 32bit, and won't recognize U3s over 8GB.

Gonzor discovered TwinMOS's application version supported Larger drives, Vista, and was released in 2007. However, the copy from TwinMOS didn't work for me -- and yet Gonzor's copy from mediafire did, both are version 1.0.5.5

I just bought an open-box 16GB Contour EXtreme with AES from newegg for $40, and it came yesterday.

So I started searching on how to hack a 16GB U3 drive.

"Oh, right, u3-tool... Almost forgot about that!"

In searching for 'how to use u3-tool', I ran across ubuntu launchpad bug report #534070 and played around a little.

I had some issues trying to get the windows version to work, I could resize the CD domain, but 'burning' the ISO failed consistently at 4-5% with a scsi error.

In Ubuntu Lucid, you can just 'sudo apt-get install u3-tool' but:
I was *NOT* able to get /dev/sg* or /dev/sr* to work -- I had to address the disk device itself as /dev/sdf to get it to work.

Hope this helps others out, as I think the major problem people are having is trying to use one of the /dev/sg like the u3-tool help text mentions.

Here's the log of the CD domain resize and burn I ran.

kamilion@SonyRA840G:~$ sudo u3-tool -i /dev/sdf
Total device size: 14.95 GB (16051601408 bytes)
CD size: 7.69 MB (8060928 bytes)
Data partition size: 14.94 GB (16043474944 bytes)
kamilion@SonyRA840G:~$ sudo u3-tool -l UbuntuLucid3264.iso /dev/sdf
CD image(1874288640 byte) is to big for current cd partition(8060928 byte), please repartition device.
kamilion@SonyRA840G:~$ sudo u3-tool -p 1874288640 /dev/sdf

WARNING: Loading a new cd image causes the whole device to be whiped. This INCLUDES
the data partition.
I repeat: ANY EXCISTING DATA WILL BE LOST!

Are you sure you want to continue? [yn] y
kamilion@SonyRA840G:~$ sudo u3-tool -l UbuntuLucid3264.iso /dev/sdf
|**************************************************| 100%

OK

kamilion@SonyRA840G:~$ sudo u3-tool -i /dev/sdf
Total device size: 14.95 GB (16051601408 bytes)
CD size: 1.75 GB (1874329600 bytes)
Data partition size: 13.20 GB (14177271808 bytes)

After I changed the ISO, I also had to open Disk Utility (palimpsest), "Format the Disk" to create a new MBR geometry, and then create a new NTFS partition.

(Which I've subsequently copied Windows 7's bootmgr to the root of the flash partition and ran "bootsect /nt60 U:", then copied the contents of the 7 install cd to the flash)

Both sections of the device are now bootable, the CD boots ubuntu lucid 32/64 TORAM=Yes, and the flash boots the 7 preinstallation environment.

(Yeah, I know the picture's screwed up -- I'll edit the blogspot CSS later.)

So that all worked just fine for me. Hope it does for you, too!

(And for the person who emailed me to ask about the background... It's from SSDD.)

Fun with nginx, upstart, and lucid

2010-06-09T11:01:00.000-07:00

Howdy boys and girls!

Today we'll be mangling us some web.

I've started off by installing a fresh copy of Ubuntu Lucid Server in Virtualbox 3.2.4. Mind, if you're using a Linux host, turn *ON* host caching in the "SATA Controller" if your host's using EXT4 as the filesystem your VDIs are stored on, otherwise it will try to use AIO and corrupt your VDIs. The host kernel needs a patch to fix this, but neither karmic or lucid have it, apparently. Anyway.

The Core System

For my first act, I've shuttled over my SSH public keys so I can use my agent to login.

ssh kamilion@laptop # Say no or ^C to make empty ~/.ssh dir with proper perms!
scp kamilion@laptop:/home/kamilion/.ssh/authorized_keys ~/.ssh/authorized_keys
tee -a /etc/ssh/sshd_config <<-\EOA

# No passwords! Get bent, crackers!
PasswordAuthentication no
EOA

For my second act, I've tossed a couple of the more useful utilities on. (python-software-properties gives you "add-apt-repository ppa:freenx-team" shortcuts)

sudo apt-get install python-software-properties dnsutils openssh-server denyhosts screen htop rsync nethogs sqlite3

Make *sure* you add your REAL origin IPs to /etc/hosts.allow

tee -a /etc/hosts.allow <<-\EOA

sshd: 10.0.0.5
sshd: 24.48.64.128
EOA
AND edit /etc/denyhosts.conf to enable blocklist sync.

nano /etc/denyhosts

At the bottom, you need to uncomment: SYNC_SERVER, SYNC_DOWNLOAD, SYNC_DOWNLOAD_THRESHOLD = 10, and SYNC_DOWNLOAD_RESILIENCY = 2d
then:
/etc/init.d/denyhosts restart

This will sync the ssh blocklists from the denyhosts server.
Uncomment SYNC_UPLOAD too, please contribute your stats!

(Yes, I know this is pointless after shutting off password auth, but BETTER SAFE THAN SORRY.)

Virtual Machines

If you're using a VM, this might be handy:

sudo apt-get install build-essential dkms
sudo rm /etc/init/tty[2-6].conf #Disable other TTYs because this is a VM.

The virtualbox guest additions will use dkms to build the guest kernel modules automatically.

You can select the Install Guest Additions from the vbox menu to insert the ISO into the cdrom.

/media/cdrom/autorun.sh

The Webserver

Now we'll install nginx.

sudo apt-get install nginx

And set it up to startup on boot with upstart.
The prestart tests the config; handy!

sudo tee /etc/init/nginx.conf <<-\EOA
# /etc/init/nginx.conf
# nginx - starts the nginx webserver

description "nginx"

start on (net-device-up and local-filesystems)
stop on runlevel [016]

pre-start exec /usr/sbin/nginx -t

expect fork
respawn
exec /usr/sbin/nginx
EOA

Now you should be able to

start nginx

and check port 80 for the default "Welcome to nginx!" response.

Right -- so this is served out of /var/www/ by default and controlled from /etc/nginx/ in such a manner that you dump config stanzas into a file in /etc/nginx/sites-available/ and link them as such:

sudo ln -s /etc/nginx/sites-available/fqdn.com /etc/nginx/sites-enabled/fqdn.com && sudo service nginx reload

you should get a working vhost with a proper config.

So, we're now capable of serving static pages, what else can we do?

Let's check which modules and defaults our nginx was compiled with:

nginx -V

nginx version: nginx/0.7.65
TLS SNI support enabled
configure arguments: --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --with-debug --with-http_stub_status_module --with-http_flv_module --with-http_ssl_module --with-http_dav_module --with-http_gzip_static_module --with-http_realip_module --with-mail --with-mail_ssl_module --with-ipv6 --add-module=/build/buildd/nginx-0.7.65/modules/nginx-upstream-fair

Looks like we've got fastcgi, DAV, FLV streaming, gzip and mail-proxy by default.

Installing PHP5

Now for PHP5.

sudo apt-get install php5-cgi php5-mysql php5-pgsql php5-sqlite php5-suhosin php5-imap php5-mcrypt php5-gd # php5-gd is usually needed

# security disclosure risk: shut php up -- hide version!
sudo sed -i '/expose_php/s/\;exp/exp/;/expose_php/s/=.*/= 0/' /etc/php5/cgi/php.ini
grep 'expose_php' /etc/php5/cgi/php.ini

sudo tee /etc/init/php-fastcgi.conf <<-\EOA
# /etc/init/php-fastcgi.conf
# php-fastcgi - starts php-cgi as an external FASTCGI process

description "php-fastcgi - respawning UNIX Socket"

start on (net-device-up and local-filesystems)
stop on runlevel [!2345]

expect fork
respawn
exec /usr/bin/sudo -u www-data PHP_FCGI_CHILDREN=5 PHP_FCGI_MAX_REQUESTS=125 /usr/bin/php-cgi -q -b /tmp/php-fastcgi.socket
EOA

Okay, now to start it.

start php-fastcgi

PHP5 FastCGI for nginx

Now you'll need an nginx config.

Here's one of my templates:

# Enable with
# sudo ln -s /etc/nginx/sites-available/fqdn.com /etc/nginx/sites-enabled/fqdn.com && sudo service nginx reload

server {
        listen                  80;
        server_name             fqdn.com www.fqdn.com;
        access_log              /var/www/fqdn.com/log/access.log;
        error_log               /var/www/fqdn.com/log/error.log;

        location / {
                root            /var/www/fqdn.com/public/;
                index           index.php index.html;
                }

        location ~ \.php$ {
                fastcgi_pass    unix:/tmp/php-fastcgi.socket;
                fastcgi_index   index.php;
                fastcgi_param   SCRIPT_FILENAME /var/www/fqdn.com/public$fastcgi_script_name;
                include         fastcgi_params;
                }
        }

### Redirect www to root domain?
#server {
#       listen                  80;
#       server_name             www.fqdn.com;
#       rewrite                 ^/(.*) http://fqdn.com/$1 permanent;
#       }

### Redirect root domain to www?
#server {
#       listen                  80;
#       server_name             fqdn.com;
#       rewrite                 ^/(.*) http://www.fqdn.com/$1 permanent;
#       }

### HTTPS server
#server {
#       listen                  443;
#       server_name             fqdn.com;
#       ssl                     on;
#       ssl_certificate         /var/www/fqdn.com/private/cert.pem;
#       ssl_certificate_key     /var/www/fqdn.com/private/cert.key;
#       ssl_session_timeout     5m;
#       ssl_protocols           SSLv2 SSLv3 TLSv1;
#       ssl_ciphers             ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
#       ssl_prefer_server_ciphers       on;
#       access_log              /var/www/fqdn.com/log/secure.access.log;
#       error_log               /var/www/fqdn.com/log/secure.error.log;
#       location / {
#               root            /var/www/fqdn.com/public/;
#               index           index.php index.html;
#               }
#       location ~ \.php$ {
#               fastcgi_pass    unix:/tmp/php-fastcgi.socket;
#               fastcgi_index   index.php;
#               fastcgi_param   SCRIPT_FILENAME /var/www/fqdn.com/public$fastcgi_script_name;
#               include         fastcgi_params;
#               }
#       }

The Database

Okay, let's move on and install a real database. Doesn't really matter which you choose. I'm gonna go with mysql for now so we can use phpmyadmin later.

sudo apt-get install mysql-server

Enter your new mysql root password twice.

Now for phpmyadmin.

sudo apt-get install phpmyadmin

It'll ask which server you want to configure it for -- leave both apache2 and lighttpd disabled and continue. Yes, we want to use dbconfig-common. Enter your mysql root password for the first one; then just hit enter to have phpmyadmin generate it's own account and random password.

sudo tee /etc/nginx/sites-available/phpmyadmin <<-\EOA
# Enable with
# sudo ln -s /etc/nginx/sites-available/phpmyadmin /etc/nginx/sites-enabled/phpmyadmin && sudo service nginx reload
server {
        listen 80 default;
        server_name localhost;
        access_log /var/www/apps/logs/phpmyadmin.access.log;
        error_log /var/www/apps/logs/phpmyadmin.error.log;

        location / {
            root /usr/share/phpmyadmin;
            index index.php;
            }

        location ~ \.php$ {
            include /etc/nginx/fastcgi_params;
            fastcgi_pass unix:/tmp/php-fastcgi.socket; #127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /usr/share/phpmyadmin$fastcgi_script_name;
            }
        location /nginx_status {
            # copied from http://blog.kovyrin.net/2006/04/29/monitoring-nginx-with-rrdtool/
            stub_status on;
            access_log   off;
            allow 24.48.64.128; # Home
            allow 10.0.0.5; # Work
            deny all;
            }

        }
EOA

Make some empty logdirs or nginx will go splat when it can't access them.

mkdir -p /var/www/apps/logs/
chown -R www-data.www-data /var/www/apps/logs/

Kill the pesky default site now that we have phpmyadmin. (yes, "reload nginx" is a command. Nifty, huh? The magic of Upstart!)

ln -s /etc/nginx/sites-available/phpmyadmin /etc/nginx/sites-enabled/phpmyadmin
rm /etc/nginx/sites-enabled/default
reload nginx

You should now be able to access phpmyadmin and login with root/mysqlpass.
phpmyadmin also can synchronize two mysql instances now, as well.

Additional Information and Tricks

SSH tunnels are your friend! Sync DBs over ssh with phpmyadmin!
ssh -vg -L 8080:localhost:80 -R 33306:mysql-server.home:3306 user@fqdn.com

firefox http://localhost:8080/server_synchronize.php

replace mysql-server.home with whatever hostname/ip has the mysqld instance you wish to sync with. You can pick any port instead of 33306, just make sure you tell phpmyadmin to look at "localhost" on that port.

You can clone whole servers too!
push.sh:
#/bin/bash
rsync -azvv -e ssh /var/www/ root@fqdn.com:/var/www/
rsync -azvv -e ssh /etc/nginx/ root@fqdn.com:/etc/nginx/

pull.sh:
#!/bin/bash
rsync -azvv -e ssh root@fqdn.com:/etc/nginx/ /etc/nginx/
rsync -azvv -e ssh root@fqdn.com:/var/www/ /var/www/

Want a remote mini-desktop? This'll take a couple minutes.
add-apt-repository ppa:freenx-team
apt-get install freenx-server firefox gnome-core synaptic

Boom, grab the nxclient.

Now, go forth and serve pages!

Goodbye [DB], Hello Crunchyroll!

2010-06-08T19:55:00.001-07:00

To [DB]:

Thanks for almost five years of quality entertainment.
Because you guys and guys like you subbed all this time, we now have legal ways to get our fix. I just signed up with crunchyroll -- they've got a $20 off promo right now, but I politely declined it and paid the full $59 for a year.

Thank you for all of your hard work. Thank you for making this possible. Thank you for making this POPULAR.
Thank you for clogging teh intartubes with petabytes of anime. Thank you for the fakesubs, the trollsubs, your sense of humor, and not taking crap. Thank you for running a tracker that handles torrents with 5000 seeders and 12000 peers. Thank you for spending your time. Thank you for spending your money.
And most of all -- Thank you for spending your lives.

Cheers.

-- Kami, a happy anime fanatic

Windows 7 and the Mysterious Unidentified Network

2010-04-15T13:04:00.001-07:00

Fixing Win7's Unidentified Network problem

http://www.sevenforums.com/tutorials/71408-unidentified-networks-set-private-public.html

Use gpedit.msc to go to Computer Configuration -> Windows Settings -> Security Settings -> Network List Manager Policies.
Right click All Networks and select Properties.
Set the following: User can Change Name, User can Change Location, User can Change Icon. Click OK.
Use services.msc to locate "##Id_String1.6844f930_1628_4223_b5cc_5bb94b879762##" from Apple Computer, INC. -- right click on it and say properties.
Click the Stop button, then use the pulldown to switch to "Disabled" startup.
This will disable the mdnsresponder.exe which sets a gateway address of 0.0.0.0 resulting in that second spurious "Unidentified Network" that fucks everything up.

Open your network center.
Click Manage Wireless Networks from the sidebar. DELETE THEM ALL except your own home/work networks (You should know the names by now!) and return to the Network Center.
Click on the connection's icon under View your active networks.
Click Merge or Delete network locations. DELETE THEM ALL except your primary networks. Click Close. Click OK.
Click Change Adapter Settings from the sidebar.
Right click each "real" network adapter and "Disable" it. They should have device names like "Intel Wireless" and "Broadcom Gigabit".
Ignore devices like "Cisco VPN", "Bluetooth Device", "1394 adapter".
Re-enable the devices you just disabled.

Waboom, all fixed, no reboot required.

Burnout Paradise and Windows 7

2009-07-24T18:15:00.000-07:00

Long time, no post.

Okay, so I was installing Burnout Paradise: The Ultimate Box on my shiny new Windows 7 bootable VHD, and MSIInstaller kept throwing error code 2203 at the start of the install.

So, tracked down this gem of info:
Google Groups (microsoft.public.platformsdk.msi)

Windows NT has a nice command line tool called cacls.exe (change ACLs) that can display or set access control rules for files. Kinda like Take Ownership, but without actually having to alter the file's ownership.

And, it turns out a MSIInstaller 2203 error can be caused by NT AUTHORITY\SYSTEM not having access permissions on the %TEMP% or %SYSTEMROOT%\Installer folder.

Off to the commandline I went.

C:\Users\Kamilion>cacls %SystemRoot%\Installer
C:\Windows\Installer NT AUTHORITY\SYSTEM:(OI)(CI)F
Everyone:(OI)(CI)R
BUILTIN\Administrators:(OI)(CI)F

Well, that looks normal.

C:\Users\Kamilion>cacls %TEMP%
C:\Users\Kamilion\AppData\Local\Temp Raziel\Kamilion:(OI)(IO)F
Raziel\Kamilion:(CI)F

Ahha! I'm the only one with access to my own tempdir...
Well, we'll fix that.

C:\Users\Kamilion>cacls %TEMP% /E /G SYSTEM:F
processed dir: C:\Users\Kamilion\AppData\Local\Temp

So, I've just added an ACL allow for SYSTEM with Full access.
Let's see if it took.

C:\Users\Kamilion>cacls %TEMP%
C:\Users\Kamilion\AppData\Local\Temp Raziel\Kamilion:(OI)(IO)F
Raziel\Kamilion:(CI)F
NT AUTHORITY\SYSTEM:(OI)(CI)F

Sure enough!

Run the installer, and boom, no more 2203 error. I have my Burnout, and learned a new trick!

Sometimes annoying errors can actually be useful.
Edit: Argh, no [code] tags!

Booting The Heron from a U3

2008-05-12T12:22:00.000-07:00

Well, one day last week, I got bored and decided to tinker with my Sandisk Cruzer Titanium 4GB with U3. Normally, when you jam one of these in your USB port, it shows up as a 6MB CD-ROM drive and the rest of the space as a USB Mass Storage Device (USB Harddrive).

Now, here's the neat thing: It does this all in hardware.
The chipset inside registers as two distinct devices, a CD-ROM with autoplay software for windows with the fancy U3 launchpad, and the actual flash drive. Windows Device Manager shows two devices, and jamming it in my Ubuntu 8.04 installation also displays as two drives. So, thinking about this, I walked over to a friend's PC, rammed it in the front panel USB, hit the power button, and whacked F12 to show the boot drive selection menu.

Imagine my surprise when even the BIOS recognized it as two distinct devices...
So, I started tooling around google, and discovered the "U3 Universal Customizer".
Normally, people would use this to patch in a new ISO under 6MB to replace the existing one.

I began screwing around with some of the other software from the Hak5 site, and poked around with the USB Switchblade & USB Hacksaw software...

Basically, what they are, is a replacement for the 6MB portion of the drive that contains some 'malware' that will bleed a windows system dry -- swipes all the passwords, sets up an encrypted stunnel, and emails it all off to an address of your choice. Interesting, but not terribly useful unless you're a vengeful 14 year old intent on swiping some other kiddie's myspace passwords for fun and pr0fit. Big deal. Since I run Ubuntu primarily now, it wouldn't affect me, even with WINE installed, due to the very nice "This disc has autoplay, do you want to execute it?" dialog.

So I tinkered around with it some more... And then I found out by trial and error that the U3 Universal Customizer can change the domain size of the CD side of the device! The first time I tried this was with a 10MB ISO containing Process Explorer and some other bits including DiskTrix's Ultimate Defrag. From everything I read, I was told this would brick the unit, but I tried anyway. It worked!

So then I figured, hey, wait a minute. If I can shoehorn 10MB on there, what about 700MB?
Well, first try, it didn't work... but LPUninstaller managed to unbork my drive and LPInstaller got me back to the standard U3 Launchpad.

Then I thought... Hey, what if there's a signature stuck on the ISO somewhere that the U3 bits are looking for?

I dug up a copy of MagicISO, which can normally remaster ISOs, opened up cruzer-autorun.iso, deleted everything but the autorun.inf, dropped process explorer in there, edited the autorun.inf, opened up my Ubuntu 8.04 ISO, saved the bootsector to a BIF file, copied all of the files out of the ISO to C:\Ubu804, loaded the bootsector.bif into the cruzer-autorun.iso, and dropped all the files in C:\Ubu804 in there, and ran U3 Universal Customizer...

*45* minutes later, SUCCESS!

So I jammed the drive into my friend's PC, hit the power button, whacked F12 to get to the boot menu, and selected the U3 Titanium CDROM device...

And bricked my pants as Ubuntu's CD Bootloader came up. Hit enter twice, and about 45 seconds later, I'm staring at the Ubuntu 8.04 desktop, grinning my ass off like an idiot. Plus you can use the rest of the Mass Storage side for "persistant" mode! Now if I could just figure out how to get "toram" working again, and dump openoffice from casper, I'd be one happy camper!

To sum it all up:

Edit the existing cruzer-autorun.iso with MagicISO instead of creating a new ISO.
"Burn" the ISO onto the Cruzer with U3 Universal Customizer.

This should work with just about any bootable ISO that doesn't rely on things expecting hard coded ISO9660 LBA addresses.

(And it should even work on an UBCD4Win / BartPE / OpenSolaris Indiana or Nevada /Nexenta ISO under 4096MB!)

The only thing you need is unrestricted access to a Windows NT5.x (Windows 2000 / Windows XP) machine for about an hour.

Good luck, beware of bricking your $50 keychain bootable CD-ROM!

Forcing Vista Home Basic/Premium to play with SAMBA

2008-04-30T13:28:00.000-07:00

After spending hours trying, I finally managed to come up with a solution...
From my posting in the MSDN forum:

[quote user="Jim Frost"]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LMCompatibilityLevel

controls the security level mandated or allowed for logins. In Vista it defaults to 0x3, which means "NTLMv2 only". This is not supported by Samba, or at least not supported by any of the Samba servers I use (Mac OS X, Debian Sarge, or Buffalo TeraStation). This is despite the fact that the Samba documentation implies that it should work.
[/quote]

NTLMv2 did not work reliably until recent samba 3.0.2X releases.
Vista Home Basic/Premium does not have secpol.msc. Ultimate does.

[quote user="K Frazier"]

I had the same issue with my Linksys Media Server Router (WRTSL54GS) which offers SAMBA based NAS.

In addition to the suggestion to change the LSA Compatability from 3 to 1 (NTLMv2 required to NTLMv2 if available), which reverts back to XP type of authentication, I also found that treating the UserID as that of a foreign domain controller works.

That is...If your NAS is a member of the FOO workgroup, when you pass your authentication info, you can specify the format of "FOO\userid" in the username field. It is important to use the Workgroup name and not the NAS server machine name. This should work for most current generation SAMBA implementations.

[/quote]

The full solution for Vista Home Basic/Premium+ SambaV2/V3:

Set HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LMCompatibilityLevel from 0x3 to 0x1 to switch from "0x3: Try NTLMv2" (Confuses samba) to "0x1: Negotiate NTLMv2 if possible, Try NTLMv1, else use MSLANMAN".

Vista also REQUIRES a domain identifier before the username:
For all of us home users without a domain controller, use your WORKGROUP name instead of a DOMAIN identifier:

If I wanted to log in on a machine named "SERVER", one would assume you would use "SERVER\username" but this is incorrect.
What you actually want to do is login as "WORKGROUP\username" with Vista AFTER setting LMCompatibilityLevel to 0x1.

So, for many people this would look something similar to:
"MSHOME\Owner" or "MSHOME\Administrator"

Remember, you need both the registry edit AND the identifier\username!

Good luck!

--Kamilion