Crazy Media Conversion!

There's is a hella tight mod for KDE called "audiokonverter" which adds a context-menu in Konqueror to, you guessed it, konvert audio! Get it, "konvert" is "convert" only with a K! Hahahhahaha! Those KDE kids, they're so kfunny!

Okay, shenanigans aside, it's nice. It will descend recursively since we all keep our music in properly structured folders, prompts for destination folder (where it recreates the same folder structure), and then the appropriate quality level (e.g. 1-10 for Oggs but bitrate for MP3). Works great! Requires the encode/decode utilities for whatever formats you want. Even handles the tags properly (at lease for OGG and MP3 which I've tested).

Audiokonverter! It's your daddy!

IM, Just Another Unix Service

My latest adventure has been in trying to get Jive Wildfire to authenticate against PAM instead of LDAP directly. The reason for this is that this is a more manageable authentication scheme for two reasons (which any sys admin should know already):

1. The (XMPP) service does not have to be reconfigured for different environments (e.g. passwd files vs kerberos vs ldap),


2. No separate password database.

My concern re: #1 is that there is some interest in running an Instant Messaging (IM) service at work but little support for getting a kerberized service. The server (Jive Wildfire) support for it is tentative at best and client support is none (e.g. ticketed authentication) so why bother? I'd have to setup key entries for the service to talk to the KDC and basically do a lot of work whereas the Pluggable Authentication Module (PAM) system is there and ready. Heck, even if the server-side support was better, the complete lack of GSSAPI/Kerberos support on the client side is a killer.

So on to #2 which is the main reason for doing any of this at all. Managing seperate password databases means system users have to have a login and password for every service and manage their passwords seperately. Since this doesn't happen (with normal users), everyone just uses the same password for everything and they use the same password for years and years. It's bad enough with the sys admins doing the same thing for core services, but that's a whole other issue.

Anyhow, I had initially setup Jive Wildfire (then Jive Messenger) to authenticate directly against my LDAP directory specifically to avoid the problems with #2. It worked well. But now faced with managing an IM server for work, I have the same two problems. Maintaining a separate password database is going to mean zero user buy-in but if I can say "just use your IRMACS password" then it won't be a problem. So that gets us back to how to setup the auth to integrate with the Kerberos system. The answer is "I dunno" or PAM.

So, PAM, you little bastard, what's the deal? It turns out Jive Wildfire doesn't have PAM support either natively or as a proper plugin (e.g. loadable at runtime) so what we need is this Java module called Shaj. Put the Java library, the .jar file, and the platform-specific library, the .so file, into wildfire/lib. Then configure Jive to use "Native Authentication":

  <provider> 
    <auth>
      <className>org.jivesoftware.wildfire.auth.NativeAuthProvider</className> 
    </auth>
    <user> 
      <className>org.jivesoftware.wildfire.user.NativeUserProvider</className> 
    </user>
  </provider>  

And voila! Right? WRONG! I couldn't login, my client kept crashing, this "Shaj" thing was screwed. I went back and forth, back and forth, and just to get to the point where I knew what to do (above) but it ust didn't work. Something was odd since I was finally able to login to the admin interface but still nothing on the client.

It turns out that, naturally, after having been flailing around in the dark in the first place, my client had finally bit the dust. Something just got fubar between the removing and adding accounts and the server going up and down and up and down... After I stomped all my kopete config files, it worked great! Auth against PAM! Beauty!

So now I still have to test one last feature... Can I change my system password through my IM client? Does that just change my IM password (e.g. is it stored by Wildfire) or does it change my system password? Does it work at all? What about if I change my system password, is that reflected immediately in the IM login?

All I know is that "it should work (tm)"

An old argument in favour of openness rather then obscurity

A commercial, and in some respects a social doubt has been started within the last year or two, whether or not it is right to discuss so openly the security or insecurity of locks. Many well-meaning persons suppose that the discussion respecting the means for baffling the supposed safety of locks offers a premium for dishonesty, by showing others how to be dishonest. This is a fallacy. Rogues are very keen in their profession, and know already much more than we can teach them respecting their several kinds of roguery.

Rogues knew a good deal about lock-picking long before locksmiths discussed it among themselves, as they have lately done. If a lock, let it have been made in whatever country, or by whatever maker, is not so inviolable as it has hitherto been deemed to be, surely it is to the interest of honest persons to know this fact, because the dishonest are tolerably certain to apply the knowledge practically; and the spread of the knowledge is necessary to give fair play to those who might suffer by ignorance.

It cannot be too earnestly urged that an acquaintance with real facts will, in the end, be better for all parties. Some time ago, when the reading public was alarmed at being told how London milk is adulterated, timid persons deprecated the exposure, on the plea that it would give instructions in the art of adulterating milk; a vain fear, milkmen knew all about it before, whether they practiced it or not; and the exposure only taught purchasers the necessity of a little scrutiny and caution, leaving them to obey this necessity or not, as they pleased.

-- From A.C Hobbs (Charles Tomlinson, ed.), Locks and Safes: The Construction of Locks. Published by Virtue & Co., London, 1853 (revised 1868).

How time flies...

I've been keeping busy with my project over the last month so not too much tickin' over here per se. The trick of the day is to use SSH for a SOCKS(5) proxy as per the comments here. The article is about using PuTTY to SSH to a server and open an encrypted proxy connection. As the peanut gallery says, this is even easier with ssh:

ssh -D1080 host.example.com

There, done. Tell your browser you have a SOCKS proxy at localhost:1080 and there you go! Right?

Well apparently I'm missing something cause it ain't working yet. I'll get there though, that's my goal. I'll get there...

/me mutters something about browsers

What Time is It?

So for a while there I was getting really confused. I kept getting the output from daily cronjobs on Chevette mailed to me in the afternoon but with a timestamp of the middle of the night. Lo and behold, Chevette's clock was just plain wrong.

So naturally, I needed to get me some of that NTP that the kids keep talking about. It turns out the folks over at http://www.pool.ntp.org/ are trying to organize a large number of NTP servers from volunteers. It's a really cool project and worth taking a look at since they discuss specific usage issues and how to best configure your client to update time from the 'net.

So initially I setup NTP on chevette and then I realized that neither siona nor friday were synching time so I did those too. After a little bit of reading on the above website as well as the ISC's site, I ended up deciding to try to run my own NTP server on the LAN. Okay, not really exciting, but overall, the setup is really easy and definately cool. Siona updates against the ca.pool.ntp.org servers and then chevette and friday both update against her. Kinda neet to have that working finally :D

Okay, back to work and my ever-growing TODO list.

Chevette is Loaded and She's Online Live!

Hot hot hot! Chevette is online. Took an afternoon of downloading packages and updates and about an hour of PAM/LDAP configuration and she's live and running the Icecast stream. The stream was running off Friday before but given that's the only usable computer in the house, that was rapidly getting dysfunctional.

On the fun side, the single ices feed including transcoding takes ~30-33% of her CPU. w007! She's already loaded!

In other news, I changed the google search shortcut in Konqueror (which can be done in Firefox too) from the boring "gg" to "grep". That's right, I can now grep the 'net. Who's your daddy? Or should I say:

grep: your daddy

Google returned 1 hit: archangel

Adding a test server and some rantin'

After rebuilding Siona a couple weeks ago, I went out and (finally) bought a battery backup. I got the smallest APC UPS I could get from Futureshop which cost 40CDN. I brought it home, hooked it up, and installed "apcupsd" on Siona. It's pretty bitchin. With apcupsd, I set the tolerences, e.g. if the battery level drops below 10% or 3 minutes remaining, and the battery will notify apcupsd that power is failing so apcupsd can shutdown the server.

The really fun part is that I already got to "test" the power failure events. I had set the threshold to 10 minutes but the estimated battery life, which is just w/ Siona mind you, is only 8.4 total. So the thing with the UPS is that if there are any "significant" fluctuations in the power from the line, then it cuts to battery mode. These dirty power fluctuations happen, oh, every other day or so. So even though it only cuts to battery for a second and then restores normal power, my threshold was high enough that it just issued a shutdown at the first sign of trouble. So I've now confirmed proper operation of the UPS during a "power event" and I've "tuned" the parameters (back to the mfr default).

In other cool application news, I'm finding that AmaroK really rocks! It builds a database of your music from the song meta-data and has a really fabulous interface both for playing music (queues and playlists) and for modifying the metadata (e.g. you can update many songs at once). AmaroK is pretty damned good.

So for upcoming events, I'm thinking of finally putting Chevette to use again but this time as just a test server. Her display is hopelessly foobar and upgrading RAM would also require more $$ then I want to invest in her (sadly). So I figure she'll make a good test server so I can setup stuff like a secondary mail server and test fail-over for mail delivery. Or inter-domain operation with the XMPP server. Or just try different applications. I plan to load her with Debian Sarge on the weekend and go from there.

Anyhow, back to work for me.