Re: [Server-devel] Centos as a base for sugar-Dextrose? and/or XSCE

2013-07-28 Thread Tom Mitchell
More precisely CentOS tracks RHEL (Redhat enterprise linux).
Fedora is experemental in that features found to be stable in Fedora can be
gated into RHEL.Another aspect is hardware.  For OLPC Fedora or Ubuntu
is most likely to have hardware support.  Politics appears to open up more
hardware on Ubuntu   (WiFi, Gfx).Centos with alternates should  get
there with some assembly required.
On Jul 28, 2013 3:43 PM, David Farning dfarn...@activitycentral.com
wrote:

 We are mixing our channels abit here.

 A Sugar based desktop on CentOS is pretty unlikely. As Peter noticed,
 there are many dependencies necessary for a recent Sugar which are not
 present in CentOS. CentOS intentionally lagges fedora by several
 releases for stability. If someone wanted to do it badly enough, it
 would be possible to backport the fedora 18 GTK stack to CentSO

 A school server based on CentOS or Ubuntu LTS is more likely. The
 challenge is remaining compatible with XOs. For hardware
 compatibility, a XO requires recent OLPC-OS versions which are based
 on recent fedora version.

 The step necessary to make XSCE on CentOS run on _Commodity_X86_
 hardware are not that great. The problem is that it would require
 maintain a non-XO branch in parallel with the XO compatible branch..
 Anyone have the time, energy, and flame retardant skin to tackle that?
 :)

 On Sun, Jul 28, 2013 at 4:41 PM, Thomas Gilliard satelli...@gmail.com
 wrote:
  I am having install problems using the i386 6.4 Centos Live Cd/DVD's. Has
  anyone had kernel panics after install finishes and when rebooting?
  i7 Laptop with install on USB HD (USB3)
  ---
  would like to do Both if it is possible.
 
   But first I would like to setup a USB external HD with centos and
 install a
  schoolserver on it. As a test system.
  This could be booted on my system76 i7 laptop (gazelle) using a wired and
  wireless connection.
 
  I have a working install of os885  (11.3.1) on the XO-1.5 Adam lent me
 for
  testing.
 
  Getting a current Sugar-Desktop (Dextrose?) to run on centos would be
 great.
  The long term stability of centos is very attractive.
 
  Please contact Peter robinson about the possibilities. He did an initial
 try
  as sugar 0.88.1 on Centos as referenced below. But found that it had too
  many missing dependencies.
 
  Cordially
 
  Tom Gilliard
  Bellingham WA.
  #satellit_e on #schoolserver freenode IRC
 
  On 07/26/2013 06:09 PM, George Hunt wrote:
 
  If this is referring to whether XSCE will run on centos, that's a
 different
  question that whether sugar-destop will run on centos.
 
  But maybe I'm responding with insufficient information about the
 question.
 
  George
 
 
  On Fri, Jul 26, 2013 at 8:14 PM, Adam Holt h...@laptop.org wrote:
 
  Jerry,
  Can you help at all here?
 
 
  On Fri, Jul 26, 2013 at 6:10 PM, Thomas Gilliard satelli...@gmail.com
  wrote:
 
  Adam;
 
  Peter Robinson (usually on #fedora-arm) asked  me in a PM IRC session
  today to have you contact him:
 
  satellit_e has anything  newer been done on centos sugar-desktop?
 
 http://pkgs.org/centos-6-rhel-6/epel-i386/sugar-0.88.1-1.el6.noarch.rpm.html
  pbrobinson no, we tried it but the dependencies are too old
  pbrobinson so it was decided it was more pain than it was worth
  satellit_e ok   that was what I just found:  )
  pbrobinson yes, I think 0.88 would likely work and it's likely from
 our
  attempt but 0.88 is ancient so we should likely just kill it
  satellit_e I like the long time stability of centos too bad
  pbrobinson It has it's uses but unfortunately because sugar is moving
  quite fast long term stability and needed and wanted features tend
 to be
  mutually exclusive. RHEL-7 (and hence likely Cent-OS 7) will likely be
 close
  to supporting what we need for Sugar 1.0 so that might suffice but
 then
  I said that with RHEL-6 too
  satellit_e I have been playing with schoolserver DX3 and Adam wanted
 to
  know if centos might be used but Way over my head I fear
  pbrobinson ask adam to email me
  satellit_e ok
  pbrobinson if he wants that discussion
  pbrobinson presumably DX3 is dextrose?
  satellit_e yes
  satellit_e olpc
  pbrobinson OK, is it currently fedora based?
  pbrobinson (I've never used Dextrose)
  satellit_e I have tested it in Ubuntu and on my XO-1.5 and as a vdi
 in
  VirtualBox
  pbrobinson not sure what that means
  satellit_e
 
 http://wiki.sugarlabs.org/go/Ubuntu#Ubuntu_12.04.2_LTS_-_Dextrose_Sugar_Live
  pbrobinson no, what I mean is the dextrose distro derived from Fedora
  or something else
  pbrobinson not what platforms you ran it on
  satellit_e looks like fedora
  pbrobinson OK
  satellit_e basically for XO-1.5 1.75
  pbrobinson if he's really interested in an educated answer tell him
 to
  ping me an email
 
  satellit_e https://sugardextrose.org/projects/dextrose/wiki/Wiki
  satellit_e http://wiki.laptop.org/go/User:Holt/XS_Community_Edition
 
 
 
 
  --
  Unsung Heroes of OLPC, interviewed live @ 

Re: [Server-devel] DNS on XS 0.7

2013-04-24 Thread Tom Mitchell
What DNS server are you asking to look things up for you.
If the gateway works.  Can you ping the IP address... (note google has
many, many, this one)
# ping www.google.com
PING www.google.com (74.125.28.103)

Check your /etc/resolv.conf file for sanity.
If you add:
 nameserver 8.8.8.8
and retry do you get an answer.

Often the gateway device has a running name server.
Other times localhost is listed (127.0.0.1) which requires
a running and correctly configured name server on local host.

Tools like dig, host, nslookup have options to test a name server
and also disclose the hosts contacted for answers.

Note Well (N.B.) that recursive name servers have come under attack and
what worked last week may have been restricted/ repaired  to not
provide recursive
name lookups that you did not know you depended on.





On Mon, Apr 22, 2013 at 10:00 AM, vanessa ramos da cruz
v.ramosdac...@gmail.com wrote:
 Halo,

 I have a Server with XS 0.7, with an ISP (Internet service provider) and an
 ISP-provided DNS server. It always worked very well, but now lost the
 Internet access. I think the DNS is not solving the names, because i can
 ping the gateway, but by pinginging www.google.com i become the answer
 unknown host.

 Can some one help me?

 ___
 Server-devel mailing list
 Server-devel@lists.laptop.org
 http://lists.laptop.org/listinfo/server-devel




-- 
  T o m   M i t c h e l l
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] buffer bloat - may be OT

2011-06-03 Thread Tom Mitchell
On Fri, Jun 3, 2011 at 1:16 PM, Peter Robinson pbrobin...@gmail.com wrote:
There are some back of the envelope computations that
can help with OLPC in a wireless mesh or from a server.

Bandwidth is fixed.  So if there are two OLPCs connecting
to a server you need to divide the bandwidth by two and target
a sub second send  buffer allocation configuration.   Watching
latency can prove important because latency problems indicate that
one application near or far could fill the buffers.   By keeping the
send buffers
small a fair share access to the net can effectively be established by
the system
process scheduler.  Receive buffers can be big, but it is better to
have the system
advertise a modest buffer space.

Next in the talk is a mention of critical services.  One of which is
name services.
DNS is in the critical path for almost all operations in the OLPC and XS server.
Time outs for DNS lookups are many seconds so a slow lookup can
keep a window from opening for many seconds.   Most often overlooked
is localhost (127.0.0.1).  After localhost are the lookups for private networks
(192.168.x.x, 172.16.x.x, 10.x.x.x).   These are often allocated by DHCP
for each OLPC but even these need to be resolved quickly because timeouts
are long.  The system will continue after the timeout but timeouts are long.
The XS must be able to resolve any address it allocates via DHCP.  And
each OLPC must be able to lookup names for all the IP addresses it connects to.
It is possible to setup a name server on the XS that is authorative or with
a host res order that places hosts before dns in the /etc/host.conf file.
Populating /etc/hosts with all the private name lookups is a valuable trick
when establishing a class room that is not known to the world because it
is hidden behind a NAT box.

Also watch for another type of private networking uses the link-local
address range
(169.254.1.0 to 169.254.255.254).  If link-local or Zero configuration
networking is
involved these addresses also need to be resolved promptly.

It helps but is not sufficient to just use numbers.   A secure shell connection
(ssh me@192.168.4.24) can take fifteen seconds to connect if the lookups
to three name servers fail.   If both ends are quickly resolved the
connection can take place
in the blink of a screen refresh.

It also makes sense for the XS server to run a squid proxy server.  DHCP can be
configured so DHCP clients get the proxy server info.The big value
of a squid
server is all the rich web content that sites serve up.   The proxy server also
places a number of critical lookups on the XS where they can be evaluated,
measured and managed.   IP filters can also firewall many problems.

Some of this is analogous to the issues that HPC clusters
like a ROCKS or Beowulf cluster encounter.   Like an XS setup there is one
larger system that serves as a gateway and central hub and behind it are
many compute servers.   These clusters like a school server can be isolated
or fully connected to the internet and have the same living in isolation or
full network service connected issues and problems.


 On Fri, Jun 3, 2011 at 7:37 PM, Sameer Verma sve...@sfsu.edu wrote:
 On Thu, Jun 2, 2011 at 7:32 PM, James Cameron qu...@laptop.org wrote:
 On Thu, Jun 02, 2011 at 09:50:57AM -0700, Sameer Verma wrote:
 I don't know if any traffic shaping implications will affect the
 school server, but in the hopes that it might, I'm copying that list
 as well.


-- 

                      T o m   M i t c h e l l
                    mitch-at-niftyegg-dot-com
My lifetime goal is to be the kind of person my dogs think I am.
___
Devel mailing list
Devel@lists.laptop.org
http://lists.laptop.org/listinfo/devel


Re: [Server-devel] buffer bloat - may be OT

2011-06-03 Thread Tom Mitchell
On Fri, Jun 3, 2011 at 5:00 PM, Tom Mitchell mi...@niftyegg.com wrote:
 On Fri, Jun 3, 2011 at 1:16 PM, Peter Robinson pbrobin...@gmail.com wrote:

Sorry Peter Robinson and readers ... I got the attribution wrong.

-- 

                      T o m   M i t c h e l l
                    mitch-at-niftyegg-dot-com
My lifetime goal is to be the kind of person my dogs think I am.
___
Devel mailing list
Devel@lists.laptop.org
http://lists.laptop.org/listinfo/devel


Re: [Server-devel] Question on number of iptables rules

2011-02-01 Thread Tom Mitchell
On Tue, Feb 1, 2011 at 5:28 PM, Anna ascho...@gmail.com wrote:
 My test XS at home has a FQDN and is open to the outside.  Therefore this is
 probably a pretty rare issue in XS land, but I thought I'd ask.

 I noticed my ambient rx/tx traffic on eth0 had gone from really low (like
 0.1 to 0.7 kB/s) to hovering between 5-20 kB/s.  I went through httpd's
 access_log and error_log and blocked a bunch of IPs that looked kinda
 sketchy.  Chinese and Russian search engine bots, script kiddies looking for
 phpmyadmin, that kinda stuff.


It can help to block China and Russia but the way spam and denial
of service botnets work that is more limited than you might wish.

Two tools denyhosts and PortSentry come to mind.  They
will deal with many blunt script attacks that come from anyplace on the
globe even Iceland ;-)

With a system live on the internet it is often valuable to block
everything first and then open exactly what you need
for exactly those that need it.

The number of rules by itself almost does not matter.
Sometimes the order of rules matters more.
For example you can drop/block all connections to telnet
and many other port services in a very early rule and never
need to test your long list of IP address blocks.

Log files always need to be watched.







-- 

                      T o m   M i t c h e l l
                    mitch-at-niftyegg-dot-com
My lifetime goal is to be the kind of person my dogs think I am.
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] IP Address Pools for XOs, known clients, and unknown clients on XS 0.6

2011-01-12 Thread Tom Mitchell
On Wed, Jan 12, 2011 at 8:03 AM, Anna ascho...@gmail.com wrote:
 I like to leave the AP open on my test XS 0.6 at home, but ran into an issue
 with that yesterday.  I noticed the lights on my router blinking like crazy,
 so I did a live tail on the squid access log to see what was going on.

 tail -f /var/log/squid/access.log

 And oh, my goodness.

Leaving an access point open is getting more and
more questionable.   Because of the tangle of
issues that can surface it does pay to setup basic
encryption and passwords.  You proxy logs will help
you a lot if there are issues.

My strategy has been to give the access point
an interesting name...
A friendly name might be AskAnna  another name
might be informative GoAwayBob.   Names
like password is guest also work.

Pass phrases need not be hard to remember.  Examples
might be:  I love OLPC! or AnnaSaysWelcome.


The reason to establish basic encryption is that without
encryption it is too easy for some passer by to snoop
up pass words to web sites.   None the WiFi crypto systems
are terribly strong but they do keep the riff raff out.







-- 

                      T o m   M i t c h e l l
                    mitch-at-niftyegg-dot-com
My lifetime goal is to be the kind of person my dogs think I am.
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static IP and DNS problems

2010-07-01 Thread Tom Mitchell
On Thu, Jul 1, 2010 at 8:30 AM, Martin Langhoff
martin.langh...@gmail.com wrote:
 On Thu, Jul 1, 2010 at 2:23 AM, David Leeming

 working... how about... giving us the actual messages in the logs?
.
 To get the interesting msgs from /var/log/messages, you can do

 grep named /var/log/messages  named-messages.log

Yes please... precision with messages is always a big help.
You can restart named and then trim the messages to
reflect one restart by checking the date and time.


 My aim is only to recover the server back to default condition. Is it
 possible to copy over the config files (with appropriate changes if needed)
 from another server installation that is running in the default state? If so
 which ones?

 Damn - that file is not under git control :-/

 Get hold of the xs-config rpm (from the install cd for example) -- you
 can get the file from the rpm following the process outlined here:
 http://www.cyberciti.biz/tips/how-to-extract-an-rpm-package-without-installing-it.html

Good link.  no need to use the root account...

It may make sense to enhance the makefile to
have a make clean target.   If the makefile
tleaves originals and work with copies such
a target shouldt be possible.  Also make
clean uses a common target for make so the concept
would reinforce common programming practices.

i.e. something like.
  #  make -f xs-config.make named-xs.conf
and
  #  make -f xs-config.make clean

Another tool to invest in might be etckeeper which
makes sense for servers of any kind.  But that is
not as simple.


-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
server-de...@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static IP and DNS problems

2010-07-01 Thread Tom Mitchell
On Wed, Jun 30, 2010 at 11:23 PM, David Leeming
da...@leeming-consulting.com wrote:
 I can see a lot of occurrences of bad owner name and zone rejected in
 the messages log which may be related.

Bad owner name is likely an typo in the zone file.

The error should have the line number where the parser
gave up.   The error should be close to and above
or if you are lucky on the line.

You should see a file name to inspect and a line number.
By any chance do your host names use underscores.


-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
server-de...@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static IP and DNS problems

2010-06-29 Thread Tom Mitchell
On Tue, Jun 29, 2010 at 9:34 AM, Martin Langhoff
martin.langh...@gmail.com wrote:
 On Tue, Jun 29, 2010 at 1:43 AM, David Leeming
 da...@leeming-consulting.com wrote:
 I tried to set up the WAN interface with a static IP address and DNS
 pointing at the gateway, following instructions at

 It is all pretty straightforward -- but and DNS pointing at the
 gateway sounds suspicious. Where did you add that dns pointing at
 the gateway?


Tell us more about the local site setup.

DNS at the gateway is common in a DHCP world especially
behind a NAT router.  It should be possible to see what
name servers the NAT router or Gateway is connected to
by connecting to the configuration tool and then test them
with dig or host.   Another tool traceroute can let you
see if you have connectivity to the name server.   A static
address must not be in the DHCP servers pool of addresses.


 What should I be looking for?

  - Is bind running correctly on the XS? To understand this... - are
 there any interesting msgs in /var/log/messages.log from named ? Do
 the following commands work... (executed on the XS)

   dig google.com @localhost
   dig `hostname -f` @localhost

  - Is /etc/resolv.conf correctly pointing to the named running on the XS?


Two interesting google hosts are public name servers:
$ host 8.8.8.8
8.8.8.8.in-addr.arpa domain name pointer google-public-dns-a.google.com.
$ host 8.8.4.4
4.4.8.8.in-addr.arpa domain name pointer google-public-dns-b.google.com.

These name servers can be used on a command line:
$ host www.google.com 8.8.8.8
Using domain server:
Name: 8.8.8.8
Address: 8.8.8.8#53
Aliases:

www.google.com is an alias for www.l.google.com.
www.l.google.com has address 74.125.19.104
www.l.google.com has address 74.125.19.103
www.l.google.com has address 74.125.19.147
www.l.google.com has address 74.125.19.99


N.B. that localhost is not resolved by google.
This can be important and is commonly solved
by /etc/hosts and placing a host reference in
host.config.

So, do check /etc/host.config  you can have the local
file /etc/hosts inspected by the resolver code first
by setting placing hosts as the first tool in
the resolver line and follow that with DNS ( bind )
   $ cat /etc/host.conf
   multi on
   order hosts,bind

This lets your localhost line in /etc/hosts be seen.
It also lets you name hosts on the inside of a
NAT that uses private networks.
   192.168.0.0 – 192.168.255.255
   172.16.0.0 – 172.31.255.255
   10.0.0.0 – 10.255.255.255
  and watch for the zero configuration IP address space
  169.254.0.0/16 as described in RFC 3927

http://en.wikipedia.org/wiki/Private_network

Private networks are interesting.   They cannot
be auto routed and there is no global reverse
lookup

Name servers  for private networks are interesting.
They are a couple cases, the ``easy'' one is
where all the network is routed and no private
networks are involved.   Private networks are
more interesting because outside of the private
network a ``smart'' router's address is returned
while inside local private network numbers are
returned.

Debugging requires knowing if private net numbers
are being used and if the name server is returns
two views one for outside lookup and another
of inside lookups.  Netmasks?? this is another
topic of interest.   Netmasks establish broadcast
conventions that are important for many services.

One tactic is to take advantage of local /etc/host
resolution and fill in many of the interesting lookups by hand while
debugging a name server.  Once the debugging is
finished comment out or delete the hand made edits
to avoid future confusion (important).

An XS server can sit inside or on the edge of
a local network so the local decisions for setting
up a network environment can be important.



 hth,

 m
 --
  martin.langh...@gmail.com
  mar...@laptop.org -- School Server Architect
-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] firewalling/nocat

2009-09-29 Thread Tom Mitchell
Please mark it GPL.

A  README.GPL file on your server or some comments in the source or in
email should do.
Lots of scripts do not have a GPL line but may have an Implied GPL in
a source tree policy.  Since you are not checking it in yourself it seems
like a good thing to do and a courtesy to those that take it an run with it.
Scripts have source so the key obligation of the GPL is done.

On Tue, Sep 29, 2009 at 12:39 PM, Jerry Vonau jvo...@shaw.ca wrote:
 Hi Martin:

 I've worked up what I think the basic layout of what the firewall rules
 need to look like that would be used with nocat's access.fw I've
 stripped and ported nocat's initialize.fw script for our needs, should
 set up the required iptable rules. access.fw accepts 4 inputs:
 [permit\|deny] [MAC] [IP] [Class] There are 4 classes of access, Owner,
 Member, Public, with None being the default, The access from ranging
 from full to none. (read the script) I have my rough script and the
 resulting rule set at: http://members.shaw.ca/jvonau/pub/iptables/

 I have not tested this yet... (I need sleep now..) Just looking for feed
 back at this point. Just wondering since the hood is up, should we be
 looking to lock down the services a bit?

 Jerry



 ___
 Server-devel mailing list
 Server-devel@lists.laptop.org
 http://lists.laptop.org/listinfo/server-devel




-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] timestamps on backups

2009-09-16 Thread Tom Mitchell
On Wed, Sep 16, 2009 at 5:37 AM, Martin Langhoff
martin.langh...@gmail.com wrote:
 On Wed, Sep 16, 2009 at 2:28 PM, Hamilton Chua hamilton.c...@gmail.com 
 wrote:
 I'm not sure if anybody has noticed this yet but after doing a backup,
 it seems the datestamps on the backup page are wrong.

 We might need more detail than that if we're to understand the situation :-)

 Is there something about time zones and time synchronization that we
 need to be aware of with regards to backups.

 Yes, the utc time on all machines should make sense. So do

  date --utc

 on XS and on the laptops involved to make sure all players are in the
 same decade. This has been tested with machines on different TZs so it
 should work. As long as utc agrees across machines.

 --
  martin.langh...@gmail.com
 http://lists.laptop.org/listinfo/server-devel

The two numbers 4 hours and 40 years are almost telling.

Linux keeps time as seconds from midnight January 1, 1970 12:00:00 GMT.
Today GMT (Greenwich Mean Time) has been replaced by UTS (Coordinated
Universal Time)
which is GMT done better with atomic clocks.

Since you are using XS on 0.6d5 and Sugar on a Stick the system gets the
initial time of day (date) from the local hardware clock.   A unix/Linux system
default sets the local hardware clock to UTS while windows sets it to
local time.
Depending on daylight savings time in (say) Oklahoma four hours looks
like a Windows
system setting the hardware time of day.  Since Linux can be configured to play
nice with windows and set the hardware clock to local time windows is not
always the issue in possiblly confusing the offset from GMT/UTS.

The 40 years is very close to the beginnig of unix time (zero seconds) and
can be seen on a confused local time of day clock.

NTP (network time protocol) tools can be used to set the time of
day on a network connected system to the correct UTS time.

Local time is computed based on UTS and an offset time zone.

Since all binary time stamps are UTS different users can set different
timezone values in their environment and the system will do the 'right' thing.

See:
  date
  date --uts
  date -u
  (export TZ=Europe/Paris;date;date-u)
#
 touch /tmp/now
 stat /tmp/now
 (export TZ=Europe/Paris; stat now)











-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Duplicate IP Address

2009-04-06 Thread Tom Mitchell
On Mon, Apr 6, 2009 at 6:16 AM, Dave Bauer d...@solutiongrove.com wrote:
 I am having issues testing two soas1 virtual machines running on the same
 box.
 They got through NAT cable modem so they end up on the same ip address.

 The second VM can see the first in the neighborhood, but the first doesn't
 see the second one.

 I am wondering if this might have to do with the IP address sharing or where
 else I should look.

 Thanks

This sounds normal.

Cable modems should pick up a single public IP address via a dhcp like
process.
The router/Nat box should then assign private IP addresses to systems
connected to
it.In the context of NAT traffic to a port on the public side is translated
to  a port and private IP address.  Commonly traffic out is triggers a
translated
transparent matching inbound link although firewall rules can impose additional
restrictions.

Virtual machines add additional confusion... with their virtualized
network links.
Remember that addresses in the 10.xxx.yyy.zzz and 192.168.xxx.yyy are not
routed the way public nets are.



-- 
T o m   M i t c h e l l
mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] A simple signed bundle/directory trust scheme for the XS

2008-08-13 Thread Tom Mitchell
On Tue, Aug 12, 2008 at 9:29 AM, Jerry Vonau [EMAIL PROTECTED] wrote:
 Martin Langhoff wrote:
 On Tue, Aug 12, 2008 at 2:24 AM, Michael Stone [EMAIL PROTECTED] wrote:
  * What use cases are you trying to support?

 Insert a usb stick with content that is OK'd by the regional NOC
 (network operations centre) for execution/installation on the XS.


-

  * What security
 properties are you trying to check?

 Signed by the NOC, not changed.


 Why not encrypt the partition on the usb-stick? Not too sure what all
 that would involve, just some food for thought.

Caution,  strong encryption is not legal in all the world.
Better to just use signed RPMs and perhaps hand verifiable checksums.

Key point: RPMs can be re-signed.

Some of the most in need parts of the world are places where trust
is most fragile.   I suspect that digital signatures and checksums can
be used to keep all the OLPC processes as reliable, open and
transparent as possible.  Encryption implies a deep lack of trust to
me.  Signed files permits trust and also verification.  Also the
ability to extract and verify without a secret the content of any
package might be important in a troubled region.

Summary:  RPMs can be re-signed this permits local organizations to
pickup, verify, test and if their policy desires re-sign the packages
for local, regional use.

Fragment from the man page:

Signatures:

rpm {-K | --checksig} [signature-options] PACKAGE_FILE...

rpm {--addsign | --resign} PACKAGE_FILE... 

So signed by the NOC, and not changed is possible to do. The
regional NOC may need to manage the secret half of their keys and
distribute the public half of their but that is less of a problem and
more trusting and open than full encryption.

-- 
 T o m M i t c h e l l
 mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static Ip settings

2008-08-12 Thread Tom Mitchell
On Mon, Aug 11, 2008 at 10:38 PM, James Cameron [EMAIL PROTECTED] wrote:
 On Mon, Jul 28, 2008 at 08:19:30AM -0700, Tom Mitchell wrote:
 The comment about Debian version  reminds me to ask about man and
 info pages.  Is there a set of man pages that matches the packages for
 various XO installations?   Since XO disk space is small I expect an
 online or school server cache

 These are deleted from the build after the RPMs are installed but before
 the final images are made.

 For specific manual pages one might reinstall the RPM involved, but a
 general capture of the whole documentation tree isn't available.

 An idea I had was to build an RPM of the documentation being deleted
 during the build, and providing this for download.  I've not
 investigated how to do that.

Thanks --
Documentation that matches the package set as delivered will be needed.
I have not looked for the build scripts...  Is there a  pointer?


-- 
 T o m M i t c h e l l
 mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static Ip settings

2008-08-12 Thread Tom Mitchell
On Tue, Aug 12, 2008 at 04:50:20PM +1000, James Cameron wrote:
 On Mon, Aug 11, 2008 at 11:10:13PM -0700, Tom Mitchell wrote:
  I have not looked for the build scripts...  Is there a  pointer?
 
 http://dev.laptop.org/git?p=users/mstone/puritan;f=install_hacks.py;hb=devel_jffs2
 
 line 161.
 
 # kill caches and documentation (needs to be done after we finish reading the 
 rpm db)
 for dir in ('var/lib/rpm', 'var/lib/yum', 'var/cache/yum', 'usr/share/doc',
 'usr/share/man', 'usr/share/info', 'usr/kerberos/man'):
 lout(['/bin/rm', '-r', '-f', join(root, dir)])
 
 -- 
 James Cameronmailto:[EMAIL PROTECTED] http://quozl.netrek.org/

Thank you

Removing the man and info pages is an obvious and necessary step to keep within 
the
tight space limits of the XO.In a not too urgent future .. I would like to
see the rm become a mv so they can be captured and packaged for
something like a school server or slurped into some laptop.org web location
for reference by teachers, users and those doing community support.

Is this worth a low priority tracking ticket or some such...?


Regards,
mitch

-- 
T o m  M i t c h e l l 
Got a great hat... now what.

___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel


Re: [Server-devel] Static Ip settings

2008-08-11 Thread Tom Mitchell
The comment about Debian version  reminds me to ask about man and info pages.
Is there a set of man pages that matches the packages for various XO
installations?   Since XO disk space is small I expect an online or
school server
cache

On Sat, Jul 26, 2008 at 5:08 PM, James Cameron [EMAIL PROTECTED] wrote:
 On Sun, Jul 27, 2008 at 09:40:04AM +1100, David Leeming wrote:
 Thanks James, I think this was a case of a typo and fixation with the
 error staring me in the face!! Sometimes one should look for the
 obvious!!!

 ;-)

 I used the Debian version of ipcalc in my reply.  Should you need it,
 another variant of ipcalc is on the XO, as part of the initscripts
 package, but it has different syntax ...

 $ ipcalc --netmask 202.0.158.96/29
 NETMASK=255.255.255.248

 --
 James Cameronmailto:[EMAIL PROTECTED] http://quozl.netrek.org/
 ___
 Server-devel mailing list
 Server-devel@lists.laptop.org
 http://lists.laptop.org/listinfo/server-devel




-- 
 T o m M i t c h e l l
 mitch-at-niftyegg-dot-com
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel