How to secure MythWeb on Ubuntu (5.10) Linux?

By default, /etc/mythtv/mythweb-htaccess.conf is linked to .htaccess file inside /var/www/mythtv. (/var/www/mythtv itself is a soft-link to "/usr/share/mythtv/mythweb") [Applies to Ubuntu 5.10]

This is what I did to secure my MythWeb interface

1) Knock off the .htaccess file inside "/usr/share/mythtv/mythweb"

2) Edit the file /etc/apache2/apache2.conf (preferrably after saving a copy as old.apache2.conf), and add these entries:

Alias /mymyth/ "/usr/share/mythtv/mythweb/"
<Directory "/var/www/html/mythweb">
 AllowOverride AuthConfig
 AuthType Basic
 AuthName "restricted area"
 AuthUserFile /etc/apache2/mythtvusers
 require user user1 user2
 Options Indexes FollowSymLinks MultiViews
 Order allow,deny
 Allow from 192.168.1.
 Satisfy any
</Directory>

3) Create the users:

User htpasswd -c option while you're creating the very first user.

# htpasswd -c /etc/apache2/mythtvusers user1 

Do not use the "-c" option for adding more users. If -c is used, it will overwrite your file, thereby deleting information about your the other users you already added.

For example, add user "user2":

# htpasswd /etc/apache2/mythtvusers user2

The above shown configuration will not prompt users from 192.168.1.0 network for any passwords.

4) Chmod your password file:

# chmod 640 /etc/apache2/mythtvusers 

All done. At this point, you can restart apache (/etc/init.d/apache2 restart as root).

Fire up your favorite browser and point it to the url: http://mymythserver/mymyth/

Where mymythserver is the IP/URI of your MythWeb Server. Please note the trailing slash (/) after mymyth in the url, it is very important. (Well, you'll see...!!)

EPSON Stylus CX1500 on Ubuntu Linux

Yay..!! I could finally use EPSON Stylus CX1500 printer on my Ubuntu.

EPSON Stylus CX1500 is an All-In-One (multifunctional)printer. Besides printing, it can scan and act as photocopier by itself. (ie, for photocopy stuff, it does not have to be connected to any machine.)

I don't believe this printer made it to the big outlet stores. It was available for Online purchase from Epson.com, and that's how I ended up getting this one.

I am yet to use it as a scanner in Linux, have heard that SANE finally supports this model.

As for printing, even though this model is not listed in the Epson printers list in gnome-cups-manager, I found that adding it as a Stylus-C42UX printer would let you print stuff.

Here is my lpstat o/p for reference:

$ lpstat -t
scheduler is running
system default destination: Stylus-C42UX
device for Stylus-C42UX: usb:/dev/usb/lp0
Stylus-C42UX accepting requests since Jan 01 00:00
printer Stylus-C42UX is idle.  enabled since Jan 01 00:00
     Ready to print.

Here are some related pages:

Product Page from Epson, Online guides for CX1500, and Reference Guide .

MythTV Transcoder -- what is it?

(Originally from this page. )

The transcoder re-encodes files from one MythTV format to another. The main purpose of the transcoder is to allow users with hardware encoders (PVR-250) or systems that can only record in RTjpeg due to performance reasons (multiple capture cards, slow system, etc) to create MPEG-4 streams to save space.

The transcoder can be used in two ways:

• Automatically re-encode every file once it has completed recording
• After marking commercials, the transcoder can be run manually to delete the commercials from the file (thus further saving space)

The two methods are independent. The first is an automatic process that can be enabled/disabled through the setup program; the second is a manual method which must be invoked on each recording individually.

The second method can be used on files that have already been transcoded (or files which were are already in the correct format), so only the frames immediately following a cut section will be re-encoded, resulting in a very minimal loss of quality.

To enable automatic transcoding, do the following: start the setup program under the host-specific settings: set the Transcoder Auto-run checkbox

For either manual or automatic transcoding: start mythbackend start mythfrontend select setup, and the Transcoding recording profile. now select either RTjpeg or MPEG-4 (selecting any of the hardware encoders will result in the transcoder not working). set the other parameters as you'd like. For best performance, you should match the audio to the 'Default' profile. If you plan to only use the manual transcoder, you can choose to set the video to be the same as the default profile too (as long as it is MPEG-4 or RTjpeg)

Everything should now be setup properly. If you elected to use the Auto-Run feature, the transcoder will automatically launch after each recording is complete. The transcoder thread runs at a low priority, so it should not impact any critical tasks or other recordings.

If you want to manually transcode a program, simply press 'X' while watching a recording (you should have already finished marking all commercials). If you change your mind, hitting 'X' again will stop the transcoding.

Once the transcode is complete, mythbackend will replace the old file with the new as soon as it is no longer in use.

devlabel shows different page80 identifiers on multipathed devices

I've 5 multipathed luns from Symmetrix as shown below, (Lun 0 being vol. logix database)

Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
Attached scsi disk sdb at scsi0, channel 0, id 0, lun 2
Attached scsi disk sdc at scsi0, channel 0, id 0, lun 3
Attached scsi disk sdd at scsi0, channel 0, id 0, lun 4
Attached scsi disk sde at scsi0, channel 0, id 0, lun 5
Attached scsi disk sdf at scsi1, channel 0, id 0, lun 0
Attached scsi disk sdg at scsi1, channel 0, id 0, lun 2
Attached scsi disk sdh at scsi1, channel 0, id 0, lun 3
Attached scsi disk sdi at scsi1, channel 0, id 0, lun 4
Attached scsi disk sdj at scsi1, channel 0, id 0, lun 5

Let us examine lun 2. The device names are /dev/sdb and /dev/sdg.

/dev/sdb (primary path)

# devlabel printid -d /dev/sdb
S80:373031303731303231303330EMCSYMMETRIX

/dev/sdg (alt path)

# devlabel printid -d /dev/sdg
S80:373031303731303231333031EMCSYMMETRIX

The SCSI Page 80 identifiers of /dev/sdb and /dev/sdg should be identical, both being dual paths to the same device. BUT THEY ARE DIFFERENT...(!!??)


Lets use scsi_unique_id to examine /dev/sdb and /dev/sdg further:

/dev/sdb

# scsi_unique_id /dev/sdb
model: EMC     SYMMETRIX
page80: 373031303731303231303330
page83 type6: 00018570107153594d3032310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

/dev/sdg

# scsi_unique_id /dev/sdg
model: EMC     SYMMETRIX
page80: 373031303731303231333031
page83 type6: 00018570107153594d3032310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

scsi_unique_id shows two different page80 identifiers: 373031303731303231303330 (sdb) and
373031303731303231333031 (sdg)..!!


(Oh yes, /dev/sdb and /dev/sdg are *indeed* alternate devices..!!)


System Details:

ES release 3 (Taroon Update 5) , 2.4.21-27.ELsmp, devlabel: 0.48.03


Update (10.27.05): They had to turn on C-Bit, and once they did that, this problem went away.

How to force a panic/crash in Linux?

You can evoke a crash/panic by:

echo c > /proc/sysrq-trigger

System can be forced to crash from the console by pressing: "Alt-syrq-c"

What are the command keys and what do they do?

'r'     - Turns off keyboard raw mode and sets it to XLATE.

'k'     - Secure Access Key (SAK) Kills all programs on the current virtual
         console. NOTE: See important comments below in SAK section.

'b'     - Will immediately reboot the system without syncing or unmounting
         your disks.

'c'     - Intentionally crash the system without syncing or unmounting
         your disks.  This is most useful if the NETDUMP client package
         has been installed.

'o'     - Will shut your system off (if configured and supported).

's'     - Will attempt to sync all mounted filesystems.

'u'     - Will attempt to remount all mounted filesystems read-only.

'p'     - Will dump the current registers and flags to your console.

't'     - Will dump a list of current tasks and their information to your
         console.

'm'     - Will dump current memory info to your console.

'0'-'9' - Sets the console log level, controlling which kernel messages
         will be printed to your console. ('0', for example would make
         it so that only emergency messages like PANICs or OOPSes would
         make it to your console.)

'e'     - Send a SIGTERM to all processes, except for init.

'i'     - Send a SIGKILL to all processes, except for init.

'l'     - Send a SIGKILL to all processes, INCLUDING init. (Your system
         will be non-functional after this.)

'h'     - Will display help ( actually any other key than those listed
         above will display help. but 'h' is easy to remember :-)

See sysrq.txt somewhere underneath /usr/src/linux-XXX/Documentation for more information.

/sbin/lvm.static in rhel4.0 systems

RHEL 4.0 has lvm2. There is an executable file /sbin/lvm.static, and this is to explain what it does.

     o The full set of LVM2 commands is now installed in /usr/sbin/. In boot
       environments where /usr/ is not available, it is necessary to prefix
       each command with /sbin/lvm.static (/sbin/lvm.static vgchange -ay, for 
       example).

       In environments where /usr/ is available, it is no longer necessary to
       prefix each command with lvm (/usr/sbin/lvm vgchange -ay becomes
       /usr/sbin/vgchange -ay, for example).

     o The new LVM2 commands (such as /usr/sbin/vgchange -ay and 
       /sbin/lvm.static vgchange -ay) detect if you are running a 2.4 kernel,
       and transparently invoke the old LVM1 commands if appropriate. The
       LVM1 commands have been renamed to end with ".lvm1" (for example, 
       /sbin/vgchange.lvm1 -ay).

See this link for more information. 

GandhiCon 3 ? M$ to Support Linux in Virtual Server 2005

M$ has announced support for Linux in its virtualization software, Virtual Server 2005.

Follow the /. thread for more. Here is the news link.

From that thread:
"A VM-type OS is larger and much more complex. In a proprietary VM, it would be easy to hide a test for a specific OS so that it couldn't be found. You could break arbitrary parts of the target OS, and it would be extremely difficult for the OS's supporters to diagnose what you've done and program around it. They've done it in the past; they'll do it in the future. "

Yeah, if guest_os is linux, MS Virtual Server probably *will* slow that instance down.

MS's Steve Ballmer in a statement made in year 2000 stated that "Linux is communism. " , and later as "Linux is Cancer" (2001).

I guess, that all have changed now, huh?

IE, like FireFox to support Tabbed Browsing too?

It is not about Maxthon, nor about MYIE2.

Following what Firefox has, IE6 is soon to support Tabbed Browsing with an update to the MSN toolbar.

They are going to have an RSS aggregator too.

More at this link.

Its about time the buggy software changed a bit since it is last inception, which was umm.. err.. 4 years ago?

Does Linux LVM support alternate PV links?

Stuff has changed and evolved over time.

Answer: NO.

Linux LVM knows nothing about the alternate path to your PV. If you extend your volume group to the alternate PV, LVM treats the alt device as if it were a new PV.

When the system starts up, it calls vgscan to scan all the devices; and I don't know what lvm2 does when it finds lvm2 VGDA on the alternate PVs. Perhaps, it just ignores it.

With the Demise of Sistina, looks like the official stance is to advise mdadm etc. Neverthless, that also is kind of incomplete, as mdadm has on-disk metadata and modifies it and hence is NOT cluster-safe for concurrent activation.

Not sure about EVMs, whether it supports alternate PV links. More on that later...

Drop a comment if you have something to say on Linux LVM.

Setting up ssh equivalency between Linux hosts

Alright, most of the decent and latest Linux ssh are version 2. Hence I am to cut the crap and get directly onto how to get this to work.

Say, you have hostA, which should get to hostB as root without a password.

We got to tell hostB the public keys of hostA. We have to create keys first for hostA. Login as root onto hostA, and run:

# ssh-keygen -b 1024 -t dsa

This would created a file, id_dsa.pub mostly in $HOME/.ssh directory.

Cut and paste this file's contents onto a file authorized_keys2 in $HOME/.ssh/ directory of the other host.

If you are trying to get in as root, make sure that your sshd_config (usually it is /etc/ssh/sshd_config ) has "PermitRootLogin yes".

If you're making changes to sshd_config, make sure you restart sshd to bring those changes into effect. sshd can be restarted as "service sshd restart" as root.

Now, from hostA, run ssh hostB. If its the first time you're sshing to hostB, you may see a question like: "Are you sure you want to continue connecting (yes/no)? " , say yes, and bingo you're good to go...

Second field in /etc/shadow explained.

An interesting thing about RHEL /etc/shadow file.

Its about the second field of /etc/shadow (if shadow passwords are enabled).

If the value is ! or *, the account is locked and the user is not allowed to log in.

If the value is !! a password has never been set before (and the user, not having set a password, will not be able to log in).

More here...

To disable an user, just replace the second field in his/her /etc/shadow entry with * or ! .

CNET.com --- stupid, mindless IT journalism.

Cnet article about DNS outages at Comcast explains DNS as:

"The DNS system essentially routes one's Internet protocol address to the appropriate Web site that the user wants to visit. "

Original Article here. Screenshot of article is at this link.

Huh? WTF?

They got that wrong, and backwards.

Essentially, a DNS server resolves the hostnames to an IP address.

Stop smoking, Cnet...!!

Microsoft Corp. v. Zamos (Goliath .v. David)

University of Akron student David Zamos bought educational copies of Microsoft Windows and Office XP Pro for $60 each. After realizing he'd have to wipe his computer to install them, he tried to return them. The college would not take them, neither would Microsoft. He was forced to keep them. The kid sold the un-opened pieces of the software on E-bay. Microsoft sued him for thousands of dollars in damages, their lawyers threatened to take his Ford Escort to recover $ 143.50.

Zamos has been fighting .

In short, instead of caving into high-powered attorneys for the Software Giant, he decides to fight back, and goes to the press. Goliath is hit. Read on here...

Devsense, fusion
Google

Gmail grows and Gmail ROCKS..!!

Looks like my Inbox just grew bigger.

I've now 1854 MB.



MSN Hotmail, you suck. Comes to mind is the time when I had 2MB as my Inbox Limit.

Yahoo's 6MB in those days were a true Luxury...!!

Best of all, Gmail lets me access from Thunderbird.

Oh, and I've not seen a spam in my Gmail Inbox.

Can you trust download.com?

Was reading about the Security Fix for PuTTY dated Feb 20, 2005, I stumbled upon this on their download page:

2004-12-23 Trojan PuTTY installer circulating

We've been alerted to a trojan PuTTY 0.56 installer that was posted on CNET's download.com for about a fortnight (now removed). We are informed it installed various spyware.

The file length was 509860 bytes (much shorter than any installer we've ever released) and the md5sum was 49550e478e9dd008998c2c5294a884c5.

We'd like to take this opportunity to encourage everyone to verify the signatures of PuTTY downloads before executing them. Details are on our Keys page.

Another solid proof that you cannot trust downloads.com and similar sites. Not that they wrote the program, they are just storing it to be downloaded, but still Spyware gets inside there copy. Whew...!!