Linux User & Developer magazine
– a good read while having your car MOT’d

I was delighted to take my car to Swiftest in Aldershot this morning, for one simple reason (see pic – and no, it wasn’t because of the coffee, although that helps!)

Female Friendly policy:
A Good ThingTM

In fact, there are two good reasons to use Swiftest in Aldershot.  Three, actually.

First, the aforementioned reading material.

Second, the professional, helpful and polite staff (Rob, James & co).

Lastly, it has to be the “Female Friendly” policy.  I was there first thing (7:30am) for my car to be MOT’d, and the only other two customers to come in at this early hour were both female.  I’d say that was testimony enough.

I confess: this is a problem without an obvious solution.

As a server administrator managing tens, possibly hundreds, of domains via Parallels’ Plesk control panel system, you may be forgiven for getting frustrated, from time to time.  It happens.

While Plesk is a big time-saver for many tasks, there are occasional quirks which only help to irritate.  One of these being SSL certificates.

Security warning in Chromium

The Plesk control panel comes with a standard SSL certificate which is used to encrypt all HTTPS connections to/from the server by default.  Most server administrators will probably want to replace this with a certificate that correctly identifies their specific server.

The usual route, through Plesk 9.5.x would be to log in, click Settings, click SSL Certificates, and then create / delete certificates accordingly until you have a new default server certificate.  The final step would be to tick the checkbox next to the new default certificate and click “Secure Control Panel”.

This gives you the impression that the new certificate is now used by the control panel.  It isn’t.

So, the next morning, you’ll probably receive one of these by email:

################# SSL Certificate Warning ################

Certificate for hostname 'plesk', in file:
/etc/httpd/conf/httpd.pem

The certificate needs to be renewed; this can be done
using the 'genkey' program.

Browsers will not be able to correctly connect to this
web site using SSL until the certificate is renewed.

##########################################################
Generated by certwatch(1)

"Hmm", you think, "this should have been updated when I 'Secured the Control Panel'".  Yes, it should.  So, the next logical step would be to edit httpd.pem and replace the Key and Certificate values of this file with those displayed through Plesk's SSL Certificates section.  Then simply restart the web server.  Ha ha! Fail!  Browsing to the control panel still results in the security warning. What gives?!! 
 
After you have restarted the web server many times, both via the operating system's /etc/init.d method and via /usr/local/psa/admin/bin/websrvmng, you conclude that, actually, this is also not the certificate that requires updating.  So, which certificate file stored on the system is the one being served by Plesk?

Good question.  While you're searching for an answer, try checking/editing /usr/local/psa/admin/conf/httpsd.pem  and  /usr/local/psa/etc/httpsd.pem.  Nope?

Oh well, how about just resorting to a reboot and taking down everyone's services for a moment? ... Not ideal, but it works.  But this is not the right way!!!  :-(
 
********* UPDATE 23/11/2011 ***********
 
I have stumbled upon the right way to do this.  In a shell: 

cd /usr/local/psa/etc/
mv httpsd.pem httpsd.pem.old
cp /usr/local/psa/admin/conf/httpsd.pem .
service psa restart

I remember once watching a documentary on Arnold Schwarzenegger’s bodybuilding career (or was it this one?) in the ’70s and early ’80s.

All of the bodybuilders in that golden era had their own training programme managers and promoters.  I recall that one manager/promoter, working for another bodybuilder, loved his own quotes.

These quotes would range from the urbane, “the pen is mightier than the muscle”, to somewhat more characteristically humorous: “remember the golden rule: he who has the gold, makes the rules“.

Well, in the completely unrelated world of PHP programming, this perl of wisdom (sic joke) is worth hanging on to.  Why?  Well, if you have ever used PHP’s variable variables, knowledge of the correct syntax is worth its weight in gold.  It’ll save hours, if not days, of debugging.
So, anyway, I’ve been coding a calendar system for a valued client for the past ten days or so.  My first attempt I pretty much scrapped as it got too complex and almost impossible to debug.  The second version is much better, except for one issue which has been giving me grief until now.

Variable variables in PHP are extremely useful, but I throw in a word of caution immediately: use them sparingly.  It can be easy to quickly lose track of what’s called what and why it’s there.  Especially if any single script is 400+ lines long.

To set a variable variable, it’s easier to start off giving a value to an ordinary variable:

$myVar = "myVarVar";

Now, I want to create a variable variable with the name $myVarVar, so this is how it’s done:


$$myVar = "this is my variable variable";

To see the contents of the variable variable, you can do either of the following:


echo $$myVar;     // or
echo $myVarVar; 

Both will output “this is my variable variable” to the screen/page.

Snooker Loopy
Things start getting interesting when you introduce arrays and loops. Take the following example:


for($i=0; $i<4; $i++) {
$myVar = "myVarVar".$i;
$$myVar = "  Variable variable £".$i;
}

creates and produces:

echo $myVarVar0; // "Variable variable #0"
echo $myVarVar1; // "Variable variable #1"
echo $myVarVar2; // "Variable variable #2"
echo $myVarVar3; // "Variable variable #3"

Boy, I am always amazed at the breadth of stuff that goes on weekly, surrounding people’s preferred operating systems, new hardware press releases and so on.  For me, it’s one of the best things about the internet: constant information from all corners of the globe, seeking an audience and advocate elsewhere.

Intel, AMD and the new kid in town

Image via CrunchBase

So, this week there has been loads of stuff which caught my attention, only a short list of which I have time to share.  First things first, Ars Technica : a constantly vibrant source of interesting news out there in the technosphere.  Featured in its hallowed pages was the title ARM’s Eagle has landed: meet the A15“.  Indeedy, ARM is developing more processor chips which are beginning to compete with the likes of Intel’s Atom and AMD’s lesser-known Geode.

AMD Geode™ LX 800@0.9W Processor

The exciting thing here is that a third player is entering the midst of a traditionally two-horse race: GPU/CPU design and manufacture (AKA AMD vs Intel).  Similarly to the console race of 2007-ish, a third player getting involved (in the console war, this being Microsoft‘s XBox 360) does great things for the market and the larger picture.  Who would have thought, against the mighty 360 or PS3, that the Wii would have competed so well?

 

We’ll see how this plays out in a different way with chip manufacturers though but, as with most of these things, the early adopters of SmartBooks (Netbooks with phone capabilities, typically powered by ARM processors) will likely be Business types and Linux users who aren’t just taken in by the big names.

The Apple is finally ripening
Finally. Sense at Apple.  Well, some at least. Developers are creative, resourceful individuals.  So throwing down the gauntlet by restricting their development languages was kind of a draconian, hard-line gesture by a company pimping itself as cool and trendy.  Sorry Fanbois, but it was a bit Microsofty, actually.  Which is actually unfair to Microsoft, as they are generally far less restrictive about this (as this list of programming languages illustrates..).  Then again, 99.4% of malware is aimed at Windows users.


But back to Apple, this Ars story describes the change in stance at Cappuccino.


How nice of them to open up their policy as well as opening up their iOS 4.1 BootROM in the same week!  In case anyone thinks I have a grudge against Apple, far from it.  This vulnerability intended feature clearly demonstrates that Apple are committed to opening up their systems and allowing users to fully use what they have purchased.  Brilliant!

Oh, but then there are still situations which make you wonder.  Like the stealthy Apple OS-X update that kept “fanbois strangely silent“…   I’m not sure I would have described Apple’d products as a “mutant virus“, but their loyal customers’ thinking probably is.  But then, Apple build fashion statements, not computers.


Open systems continue to gather pace


There’s an interesting article at O’Reilly on debunking the 1% myth.  The 1% myth is the idea, forever purported by some in the industry, that Linux only has 1% of desktop market share.  Succinctly put, as there is no way of actually measuring this accurately, it’s a false claim (as the article details).


Talking of open software, media player Amarok is looking more and more beautiful.  What’s not to like about this, especially when it’s free?

Enhanced by Zemanta

(to view all photos in this article, visit my flickr photoset)

I’ve been needing a netbook for work for a little while.  So, chancing upon Martin Lewis‘s wonderful MoneySavingExpert web site, this article on cheaper netbooks was the prompt I needed.

My main criteria for a netbook were:

  • Battery life as long as possible.
  • With my large hands, it must be as ergonomic and accommodating as possible.
  • Preferably without Windows.  What’s the point of paying for something I won’t use? 
  • Linux must work well on it.
  • As light & small as possible.

Given that nearly all early (pre dual core) netbooks are based on Intel’s Atom / 945 mobile chipset, most of the above criteria were already met.  Ergonomically, I’d read that each netbook had its foibles, so this point was moot.  The battery life was, for me, the deciding factor, which is why I chose a Samsung N130: the only model in the discounted range which ships with a 6-cell battery.  In ideal circumstances, this will last 6 hours.


Order process, shipping, packing and unpacking

The Argos outlet on eBay accepted only PayPal payments, but this didn’t matter to me.  The purchase process was as painless as you could expect.  I ordered the unit on a Friday morning.  On a Monday morning, at my office, it arrived courtesy of a cheery DHL delivery chap.  No complaints so far!

The packing itself was as you’d expect: satisfactory for the job, with nothing much else to note.  Unboxing the unit was a quick affair, and before long I had a shiny netbook on my desk.  Considering this unit is classed as “refurbished”, I could see absolutely no defect or mark on it whatsoever.  I would have been very happy were this brand new.

Plugging in, powering on, first impressions

When unpacking the device, I was impressed with the general feel of it.  The plastic shell feels robust and the lid action is smooth.  Instead of a clasp, the lid clamps to the base by means (I’m guessing) of a magnet arrangement, which has a lovely feel about it.  Furthermore, Fedora behaves as expected, going straight into standby when the lid is closed.

The weight of the unit was good too.  Before I put the battery in, that is.  After that, the weight felt subjectively like it had more than doubled, which would put some people off I’d imagine. However, it’s hardly as heavy as my laptop so by my standards it’s still very light.  A positive effect of the battery unit is in providing more stability while on a desk, and more resistance to the motion of closing/opening the lid.  All together, it works well.

Along the front, left of the touchpad, are 5 LEDs.  I question the value of having an “on” LED in addition to a “charging” LED, but these are tiny devices so power consumption is likely to be equally tiny.  Besides, if unplugged, the charging LED isn’t illuminated. Again, another moot point.

The feel of the keyboard is good. There isn’t a compromise in terms of key press action, although to fit in a full QWERTY keyboard, some compromises in layout have had to take place. As you can see, the hash (#)/tilde and right square-bracket/brace keys are squashed in, but the compromise is acceptable.

Fedora installation and general usage

I use Fedora, CentOS and Red Hat in my day job, so for me it’s the architecture that I prefer due to familiarity (which, in this case, has not yet bred contempt!).

Using the usblive-creator tool in F13 on my laptop, I was able to set up a USB drive with a Fedora 12 live CD image, ready to boot and install on the netbook.  I’d opted for F12 because I’ve had issues with mobile broadband on F13 that worked fine on F12, and mobility is the primary goal here.  A quick change to the boot order in the BIOS and it was good to go.


I was surprised how quickly the installation completed.  After having read about Atoms generally being slow processors, I’d expected an unhealthy dose of lethargy when installing the OS.  The first boot wasn’t particularly tardy either (and this is running on a 160GB Toshiba hard drive with Fedora’s default encrypted LVM set up).  It’s comparable to my HP laptop (2007 model) with a Turion TL-60 (@2GHz) w/4GiB RAM (@667MHz).  In usage, though, it’s somewhat slower than the AMD laptop, taking considerably longer to load up Firefox (with half as many extensions, too).

As hoped, my Huawei E270 mobile broadband dongle worked straight away.  I was also pleased that the webcam worked with no effort whatsoever (screenshot shows Cheese; ’nuff said)! So, what doesn’t work straight away?

  • Brightness controls on the keyboard.  Probably fixed easily by identifying the char code generated with the keystroke and binding it to the dim/brightening function in GConf (he says, having no real clue..)
  • Wireless.  I believe a Broadcom 4312 is under the bonnet, so this shouldn’t be a hard fix with a quick visit to linuxwireless.org.
  • Some things I haven’t tested yet, like monitor switching and the built-in microphone.  But everything else seems to work fine.

A bit more on ergnomics

It has taken me a little while to get used to the layout of the keyboard and touchpad.  A problem I am overcoming slowly is that the touchpad’s two buttons are actually a single, rocker-style button.  It sits flush to the surface of the base, and this lack of tactile feel I find awkward.  I often find my thumb in the wrong position, mistakenly pressing on the bottom of the touchpad rather than the left button.  The pointer then jumps across the screen instead of clicking on the intended widget.  A small but annoying issue.

Also, the keyboard is great to use while typing (as I do here, writing this review on the N130) but for cursor positioning it can become more tricky.  Hitting CTRL-End to position the cursor at the end of some text, for example, is now CTRL-Fn-PgDn(End), given the multi-function aspect of the PgDn(End) key.  Likewise, the cursor keys are just a shade on the small side.  But these are minor complaints in the overall picture.

Final analysis

Taking into account the annoyances, weighing them against the needs of the many… I would have to have to award this machine 8/10.  At £150 (incl VAT) + £4 postage, it has exceeded my expectations.  Sure, it’s not perfect, but the price, utility and solid build get my vote.  I would recommend one for a partner, friend or colleague….. maybe even a parent 😉

Oh, there is one thing about it that I couldn’t understand.  There was this sticker on the top which made no sense (“Designed for Windows XP”).  Surely you design an operating system for target hardware and not the other way around..?  Well, regardless, I think the new location for the sticker makes much more sense.  🙂


< – old

new ->

Well Apple-lovers, you sure do choose interesting products. Like the iPod; a “revolutionary” portable audio player, being probably the first to have a non-replaceable battery. I might be wrong, having done no research on the subject, but this was enough to turn me off. Let alone the insistence of using iTunes.

Or the iPad; the computer-but-not-a-computer consumer device that let’s you do anything you want with your media.  So long as it is on Apple’s terms.  I don’t get why someone as apparently intellectual as Stephen Fry gets so excited about it. Yes, it’s so exciting, in fact, that I’d go immediately to iPad.com and check it out!

The iPad. I mean, for goodness sake, it’s a laptop without a keyboard, but with potentially harmful restrictions, a proprietary operating system and about as much appeal as a colonoscopy. According to Fry, it also has no “multitasking, still no Adobe Flash. No camera, no GPS”. But it does have a touch-screen and 3D desktop effects… Perhaps that’s why the Free Software Foundation dropped “Freedom” Fry’s video from their homepage: who’d want to appear as hypocritical as that?

And then there’s the iPhone. This is the biggy. Apple are using typical Microsoft-like tactics here.  Make an “irresistable” upgrade, probably for free or very cheap, and subtly attach some conditions to it. This time, as exposed in Giorgio Sironi’s blog post, The Apple of Sin, the condition is that you must only develop iPhone applications in languages prescribed to you by Apple.

The reasons, given by Giorgio, are pretty clear: Apple want to kill any chance of Flash appearing on the iPhone, else it might be inconsistent with the new iPad policy.

So, Mac users, be aware that your choice of platform may well come to haunt you in a year or two, when Apple extends this anti-Flash policy to OS X.  There is one nice aspect of this, though: Apple might just force Adobe to open-source Flash.  Then will follow a review-and-embrace process, where Flash gains recognition as an open standard.

Then we’ll see if Apple is embracing open standards as it “seems” to be with its current policies.  If not, then you’ll get more choice of hardware and software if you choose Windows. And even more if you opt for Linux and, not only would that be cheaper, you would also retain your right to choose what you do with it.

Sorry about that. 😉

I recently ‘dented’ (tweeted on identi.ca) a question to a group of software developers: what music do they listen to that is conducive to coding?I received a variety of answers, with just as wide-ranging tastes as you could expect, really. Clearly, I hadn’t conducted a very economic experiment. Perhaps I was asking the wrong question.

The question I should have asked is this: which music do you listen to that evokes a calm, creative and logical state of mind? In other words, I needed to key-word the question to (a) elicit greater impact on the reader and (b) give the question more scope, more context.

The premise of the question is the science behind brainwaves. Apparently, alpha waves in the brain (those which occur at between 8-13Hz [cycles per second]) are the most conducive to creative AND logical thinking. It is commonly associated with a meditative state of mind, deeply relaxed, daydreaming, fantasizing and creatively visualising various scenarios.

This dispels some notion that left brain/right brain dominance exists. I can’t remember which is which, but it is said that the right hemisphere is more creative and the left, more logical/analytical. Or vice versa.

But this alpha wave state could, in fact, also support such dominance, if it allowed for the idea of submission of the dominant region during periods of relaxation. In other words, we will have one personality profile when active, busy, even stressed, and another profile when relaxed, calm, clear.

It follows, then, the people seeking to produce creative works – whether it be software code, writing, visual art or music, should always seek the best environment to create alpha brain waves. Music is just one component; meditation, light scents, lighting, physical comfort and staying hydrated also contribute, as does the avoidance of caffiene and alcohol.

But for me, most of all, it’s music.  And quite often, that’s trance. 😉

Having installed CentOS (wikipedia) on a server here, I was surprised to find that, by default, the source repositories were not enabled.
Below are the source repo definitions I use.  Simply create a file called “Centos-Source.repo” (# chmod 644) in /etc/yum.repos.d/ and enable repositories as required (using enabled=1).  Please note that this example is for CentOS version 5 and may differ from any official versions out there.  I offer no warranty… it just works for me.  ;-)

[base-SRPMS]
name=CentOS-$releasever – Base SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/os/SRPMS/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1
enabled=1
updates
[update-SRPMS]
name=CentOS-$releasever – Updates SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/updates/SRPMS/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1
enabled=1
used/produced in the build but not released
[addons-SRPMS]
name=CentOS-$releasever – Addons SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/addons/SRPMS/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1
enabled=0
packages that may be useful
[extras-SRPMS]
name=CentOS-$releasever – Extras SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/extras/SRPMS/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1
enabled=0
packages that extend functionality of existing packages
[centosplus-SRPMS]
name=CentOS-$releasever – Plus SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/centosplus/SRPMS/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1
– packages by Centos Users
[contrib-SRPMS]
name=CentOS-$releasever – Contrib SRPMS
baseurl=http://mirror.centos.org/centos/$releasever/contrib/SRPMS/
gpgcheck=1
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
priority=1

The full title of this blog should really be ‘SELinux is preventing mysqld (mysqld_t) “search” to ./tmp (public_content_rw_t)’ as that is the problem I’ve been having with CentOS recently (and hence my searches on the web for a solution).
The cause of the problem
I use SugarCRM for customer and project management data – and very good it is too! (Gratuitous plug – I can help your company install and use this fine software :-) ). Except that recently, when listing my Accounts within Sugar, I would not see all of the account context. Only the account data itself would be displayed and none of the subpanels/links. The query to retrieve more data was failing, with this error message displayed in the browser window:
mysqld: Can't create/write to file '/tmp/#08y2jw' (Errcode: 13)
In my system log (/var/log/messages), I also got multiple SELinux errors like this:
Oct 13 09:07:50 server setroubleshoot: SELinux is preventing mysqld (mysqld_t) "read" to ./tmp (public_content_rw_t). For complete SELinux messages. run sealert -l 1762c478-f3a2-4eeb-be09-bd3dc037d945
Clearly, the reason for “Errcode: 13″ was due to SELinux.
Incidentally. if you have seen a similar error on your web site, but with (Errcode: 28) instead, this is likely due to shortage of disk space. A great way of determining operating system errors like this, is to use ‘PError’, thus:
# perror 28
OS error code 28: No space left on device

# perror 13
OS error code 13: Permission denied

So there we are – two distinct and different issues.
With SELinux, resolving the permission issue can be difficult. By issuing # sealert -l 1762c478-f3a2-4eeb-be09-bd3dc037d945, as suggested above, I got the following output (trimmed and highlighted for clarity):

Summary:
SELinux is preventing mysqld (mysqld_t) “search” to ./tmp (public_content_rw_t).
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for ./tmp,
restorecon -v ‘./tmp’
Additional Information:
Source Context root:system_r:mysqld_t
Target Context system_u:object_r:public_content_rw_t

First things first: issuing # restorecon -v './tmp' didn’t fix it for me. I was also surprised to see that the path to /tmp was relative to the current working directory, so I tried a slightly modified # restorecon -v '/tmp', but to no avail. After restarting mysqld, the problem persisted: MySQL was simply being refused access to /tmp. Somewhere, a policy is disallowing this.
It’s a mistake to assume the the source context and target context should be the same; they don’t have to be, as it’s entirely policy-driven.  I made bold those aspects (the file Type) above to highlight this incorrect assumption (that I previously held).
Find and fix a policy?
Although finding the troublesome policy and analysing it is a Good Thing, it’s also time-consuming and requires significant knowledge of SELinux, chiefly to avoid creating security holes. A better way, I found, was simply to relocate where mysqld tries to store temporary data.
Thanks to Surachart Opun’s blog, I learned that you can specify a new location for temporary files. In /etc/my.cnf, add or edit the following:
[mysqld]
tmpdir=/tmp # # e.g.
tmpdir=/var/lib/mysql/tmp

Now do the legwork to set up the directory properly:
First, create directory with appropriate permissions
# cd /var/lib/mysql
# mkdir tmp
# chown mysql:mysql tmp
# chmod 1750 tmp

Now set the SELinux context up:
# chcon --reference /var/lib/mysql tmp
and make the SELinuiux context permanent:
# semanage fcontext -a -t mysql_db_t "/var/lib/mysql/tmp(/.*)?"
Finally, restart mysql:

SugarCRM – Open Source CRM system

# service mysqld restart
Closing thoughts: optimisation
The methods above fixed the particular problem I was having. They didn’t, however, actually pinpoint the cause. This is one of the good things about Linux and SELinux in particular: you are forced to rethink what the system is doing and work out a solution that sits within the predefined security context – or learn how to write SELinux policies. Personally, I prefer the former ;-)
There is an additional benefit to the solution above – namely, optimisation. Because we have specified the security context with semanage, we are free to mount an external file system and use that instead for MySQL’s temporary files. In other words, we can maintain the security but increase the performance.  One such filesystem could be tmpfs. tmpfs is actually a RAM Disk, uses a fixed amount of RAM to provide file storage. It is much quicker than an on-disk filesystem and thus perfectly optimised for storing temporary, caching data. There are many resources about tmpfs on the web. A good introduction to tmpfs can be at Planet Admon.

There is one thing I want from Org-mode more than anything: the ability to record the time I spend on various activities – even unplanned ones – and then see a summary of this time at the end of the week.

Luckily, this is actually really simple.  I won’t go through the details of how to install or set-up Org-mode; that information is easy to read through at its rightful place.  Instead, it’s the key time-recording feature which I’ll briefly touch on here.

How to start:

  1. Open up Emacs (not got Emacs? See the GNU web site or download it straight from the GNU FTP site)
  2. Start Org-mode by opening a .org file:

     C-x C-f  ~/org/work.org

  3. Start the clock on any item:

     C-c C-x C-i

  4. Leave it running for a minute or two and then stop the clock:

     C-c C-x C-o

  5. Now go into Agenda view:

     C-c a a

  6. When in Agenda view (commonly this opens in a second frame), just hit R:

     R

Et voila! You should be able to see a summary of the time you have booked on your activities.