The Tlog - a technology blog » Unix / Linux / *BSD

FreeBSD 8.0 is out today

Pedro Timóteo — Fri, 27 Nov 2009 10:48:01 +0000

See the release notes, if you’re curious.

I had been using FreeBSD 6.x and later 7.0 until I bought my current home server, about a year and a half ago, which had a SATA controller that FreeBSD didn’t detect out of the box. I used that as an excuse to try out Linux as a server again, and switched to Ubuntu, which I’m still using right now. But FreeBSD is a very nice OS, and I miss some parts of it (such as pf, ported from OpenBSD, which I also used before, and which is infinitely better and more sane than the almost Lovecraftian horror of iptables.)

If I ever get a second home server, maybe I’ll try one of the BSDs again, just for fun.

What’s this site running?

Pedro Timóteo — Wed, 25 Nov 2009 19:52:54 +0000

As an intermission (there’s more to come in the SPF series), here’s what’s changed on my server since, oh, about a year and a half ago:

The OS is now Ubuntu Karmic Koala (9.10), and all the server’s running software comes from the standard Ubuntu packages, which means that whatever version is in Karmic¹, that’s what I’m running here.
I’ve switched, definitely, from Apache to nginx. It’s faster, more efficient, and ridiculously easier to configure (to put it in perspective, in terms of ease of configuration, it’s like OpenBSD’s amazing pf to the unholy abomination that is Linux’s iptables.) nginx works perfectly with the two pieces of software I use the most on my server, WordPress and MyBB, even while using a SEO plugin with the latter, which requires some non-trivial redirect rules.
As I don’t trust any ISP’s email server to distribute the mail my server sends (mostly confirmation emails from my forums), and since most ISPs and companies these days block mail sent from dynamic IP addresses, I keep a 256 MB Slicehost slice, with a static IP address and, most importantly, reverse DNS, which I use as a smart host for my home server. The slice doesn’t have a lot of power in terms of CPU (and it’s not meant to), but, as bandwidth is much cheaper in the US than in my poor country, the “small” limit the cheapest slice includes is a lot; I use it for serving static files, mostly for my forums (all images and Javascript files are served from there), and I still have bandwidth to spare.
I’ve stopped using a Squid proxy in my home network, and nowadays access the web directly… except for when I indulge in one of my newest weird habits: reading webcomics like this one or this one while having lunch or dinner. At such a time, moving instantly from comic to comic is a must… so I simply re-enable Squid (with more aggressive caching than I’d use for normal browsing; after all, existing comics typically aren’t going to change, are they?), do a nice little wget in my server to download and cache the entire comic, and then enjoy reading the whole of it (in as many meals as it takes) as if it was stored locally…
A few changes to my email server’s configuration, mostly related to spam filtering… but I’ve been writing about that, haven’t I? And there’s still more to come.

with updates, of course — people who are afraid of installing updates (“but… it might break something!”) are nothing more than mewling weaklings who are utterly incompetent as sysadmins; they should never be allowed within a mile of any server. Even one running Windows.

More updates: Ubuntu, WordPress

Pedro Timóteo — Fri, 02 May 2008 09:17:45 +0000

Just updated this server to Ubuntu 8.04 (why do they always have these odd version numbers?). As always, it was incredibly difficult: I had to type this entire command:

do-release-upgrade

and even remember to press Enter afterwards! This Linux stuff is really too tough for us mere users…

Also, WordPress 2.5.1 on this blog and a couple others. Incidentally, if you’ve just upgraded to 2.5.1 and suddenly your RSS feed is empty, you were probably hit by this bug. That link includes info for fixing it, too (basically, you have to replace two files with newer development versions).

It’s official: I’m on the job market again. :)

Pedro Timóteo — Tue, 22 May 2007 17:09:20 +0000

As of now, I’m looking for a job in the area of Lisbon, Portugal. Sorry to any non-Portuguese readers / potential employers, but I am not ready to move abroad at this time of my life.

My ideal job, at the moment, would be a senior sysadmin / junior PHP programmer “hybrid”, but I’m open to alternatives.

As I’ve said here before: no outsourcing, no MS stuff, no helpdesk. I don’t see this as “arrogance” on my part, but simply as not wanting to waste both sides’ time.

For more details (in Portuguese), and the full CV, please visit www.pedrotimoteo.com/cv . Thank you.

Edgy to Feisty on Slicehost

Pedro Timóteo — Thu, 17 May 2007 14:17:53 +0000

Since I’m in an upgrading mood , I’ve just upgraded my Slicehost slice from Ubuntu Edgy (6.10) to Feisty (7.04).

It was incredibly hard: I had to type in two whole commands! Namely,

apt-get install update-manager-core do-release-upgrade

Gee, this Linux thing is much too complicated and troublesome for us mere mortals.

Slicehost: An experiment

Pedro Timóteo — Wed, 15 Nov 2006 19:35:35 +0000

Currently (as it’s been from the beginning), my sites are all running on my home server (an OpenBSD box). I like the control it gives me; most web hosting services are of the “we provide this software for you” kind. Sorry, but, to me, it’s root access or nothing.

Even though my uplink is quite lousy (384Kbps), I haven’t actually had any problem with it, even when I was Dugg / Redditted / Shoutwired / del.icio.used / whatever.

However, I’ve long wondered about whether the fact that my server is located in Portugal is harming me in terms of search engine results for my English-language sites. The fact is that I get a comparatively large number of people arriving there from google.pt, even when the site in question is in English. Now, if google.pt is benefiting my English-language sites simply because they’re physically located in Portugal, it stands to reason that google.com (which is several orders of magnitude more important) will benefit US-based sites… and, if it puts those ahead, it follows that others are put behind.

(Did I make any sense just now? )

Therefore, since a few minutes ago, I’m a customer of Slicehost. In just 2 minutes, I had an Ubuntu virtual server running, with full root access by ssh. There’s nothing running there right now, but soon there will be: I will be moving one of my blogs, Way of the Mind, there (and it’ll be getting a new domain as well). I’ll only do it about a month from now… but I may start other sites there, in the meantime.

We’ll see if it makes a difference. I’ll post my results here.

Linux, fundamentalism and the many distros (part 2)

Pedro Timóteo — Mon, 06 Nov 2006 11:05:50 +0000

(Part 1 got too big, so…)

And now for the “yet another distro? it’s because of this that Linux will never conquer the masses!” part.

Every time a new Linux distribution appears – and, sometimes, even at other times – a lot of people – both Linux users and otherwise – say something like the above. That Linux will never “succeed in the marketplace”, because it’s too fragmented, there are too many choices, there’s not a single standard, and so on.

I believe those people are missing the point. To the “average user” — and I don’t mean the average Solitaire / Minesweeper-addicted Windows user, but the average guy/girl who is curious about trying some new OS — there are 4 Linux distros: Fedora, Ubuntu, Suse and maybe Mandriva. If another distro appears, it’s a specialized thing. If you’re a Linux geek, and the distro’s goals appeal to you, you may try it out. But to suggest that it’s causing “fragmentation” makes no sense. As I said, the newcomer will choose from one of those four distros, period.

Sometimes, the critics use a different approach, which I’ve seen quite recently: “there are so many distros, and these guys think that all other distros suck, and it’s they who will create a good one, for a change? What arrogance!”. This is, I’m sorry to say, more commonly seen here in Portugal, a country that seems to despise achievement and hate achievers. Who is anyone to believe he can do better? Who does that guy think he is, to divert from the majority? To create something on his own?

I think that happens for two reasons: the aforementioned hate of achievement, and also the fact that Portuguese Linux users don’t actually believe in Free Software. Sure, we use it, but most of us are quick to call anyone who cares about the ideology “a fanatic” (fundamentalist, zealot, taliban, etc.). Now, a huge part of Free Software is the right to fork – or the right to build on the work of others. Of standing on the shoulders of giants. If someone picks a piece of free software – or even an entire distro – and believes he can do better – even if just for a small number of people’s needs – he has the right to do so. And he’s not harming anyone – including “the community”. It’s possible that others will actually benefit from his work, that some of it will find its way into other distros.

But people call him a “splitter”. What is this, The Life of Brian?

Linux, fundamentalism and the many distros (part 1)

Pedro Timóteo — Fri, 03 Nov 2006 11:42:28 +0000

This is, in a way, a reply to something that has annoyed me for a long time now, and which, reading other tech blogs such as those in Planeta Asterisco, I see a lot of.

A recent example (though far from the worst) is this post by Carlos Rodrigues, about the news that the FSF will release a 100% Free Software Ubuntu variant. The accusations – both by Carlos and others – are of two kinds: that those guys are fanatics, fundamentalists, talibans, etc., and the even more common “yet another distro? it’s because of this that Linux will never conquer the masses!”

And things like those are said, quite often, by Linux users (though it’s fashionable for them, these days, to say that Linux isn’t ready for the desktop after all, and use Windows or MacOS X instead, and Linux only on servers… but I digress).

Now, about the first… we all care differently about different matters, right? What is important, even a matter of life and death to some, can be irrelevant to many others. Each of us has different priorities. This is normal.

What I don’t find “normal” – or, more precisely, healthy, or right – is when you call anyone who cares even a little more about a subject than you do, a “fanatic”.

Think about it. Do you consider yourself perfect, or something? Do you care about subject A exactly as much as is correct, and anyone who goes a milimeter beyond that is already guilty of taliban-like fundamentalism? Is the maximum allowed “caring” defined by how much you care?

I don’t care about software freedom as much as Richard Stallman and others, but I understand why it’s important to them. I understand where they’re coming from. And I respect them for it. Others, however, call them “fanatics”… simply for caring a little more than they (those others) do.

I don’t care much about how well decorated my place is, but I don’t call my GF “a fanatic” because she cares about it more than I do.

I’ve always thought U2 was a pretty average band, with some good songs, and never understood how so many people almost worship them… but I don’t call those “fanatics”.

I don’t care the least bit about soccer, but I don’t call those who do “fanatics”, unless they’re actually hurting people or damaging property (and even then, they’re more morons than “fanatics”).

I eat meat, but I don’t call vegans “fanatics”.

Is this so hard to understand? Is it so “cool”, or so “mature”, to not care? (sometimes, the P* members seem to be in a “competition” to be the one who cares the least about everything…) Are people so conceited that they believe they care about everything exactly the right amount? That caring a little more than they do is unacceptable?

Hmm, this is already too long… there is now a part 2, about the “so many distros harm Linux” thing.

Ubuntu vs SUSE

Pedro Timóteo — Fri, 28 Jul 2006 11:07:50 +0000

Last week, I bought a new PC, with an AMD64 CPU, which was (and is) to be my main work PC, when I start working at home full time next month. Of course, it was going to have Linux – Windows, to me, simply isn’t usable as a non-gaming OS: in order to be user-friendly for newbies, power users are sacrificed. I simply don’t understand how people can work without multiple, instantly switching desktops, decent copy & paste, and a decent command line. But I digress, that’s not the point here.

Now, I started with Slackware many eons ago, then switched to Red Hat (at version 3.0.3) and, two years ago, I moved to a company where SUSE was the default distro (it’s the company I’ll be leaving at the end of August). I liked SUSE a lot, and still do. And I got quite used to it.

But I’ve been hearing so many good things about Ubuntu that I decided to try it. I chose Kubuntu, as I prefer KDE, and installed it.

Well… I wasn’t impressed. Sure, I only used it for a couple of days, but it didn’t “feel” right, for several reasons:

when installing, it tried to download updates before asking for a proxy server. At home, my PCs have to use one, so the download failed, and, worse, it marked all update servers as down. I had to re-add them manually, because it thought it had no servers to update from.
by default, the list of update servers is very sparse; you need to add several ones to make it useful.
ugly, ugly fonts in KDE.
in the AMD64 version, no Java, and no Flash.

So, after a week, I moved to SUSE 10.1, and I’m quite happier. Fonts look great, I have Java and Flash in a 64-bit Firefox, KDE isn’t “crippled” by default, it asked for the proxy server before attempting to update, and so on.

Now, I’m not saying I know something nobody else does. It’s quite possible that Ubuntu is much better, that those problems are easily fixable and I just didn’t look in the correct place, or do things “the Ubuntu way”, and so on. If that is so, I’d really like you guys to tell me why you prefer Ubuntu.

Unix and Windows admins

Pedro Timóteo — Wed, 14 Jun 2006 15:45:00 +0000

“A Unix admin needs to be root. A Windows admin needs to reboot.”

(seen as a Slashdot sig)

Server upgrade: aftermath

Pedro Timóteo — Mon, 24 Apr 2006 12:25:50 +0000

Things mostly went well, though it certainly took much longer than I expected.

The OpenBSD 3.9 installation, itself, went quickly and perfectly. Copying configs from the old HD, and adapting them, took a bit longer.

One of the initial problems was that, while OpenBSD 3.7 had no problem using Ultra DMA 5 on my VIA VT82C571 controller, 3.9 “downgraded” it to non-Ultra DMA mode 2. Copying stuff between drives was noticeably slower. A quick Googling found the workaround, and everything was fine (and faster) afterwards.

MySQL 5.x (and 4.x) still has the bug where the client utilities link to -l../.libs/libmysqlclient.so.15.0 instead of -L../.libs -lmysqlclient. It has been reported often, but the MySQL guys, apparently, can’t seem to be bothered to fix it – it seems that, to them, free Unixes mean just Linux. It compiled fine (after working around that bug), but then Apache couldn’t start with PHP (which was compiled to use MySQL) enabled. This had happened to me before, so I knew MySQL was the problem; I looked around in ports (which maybe I should have done from the beginning, but I didn’t expect the MySQL port to be so up to date), and there it was, a working MySQL 5 + PHP + Apache.

eaccelerator stopped working, however, It compiles and installs, but the httpd children began to segfault all the time. Since PHP is the same as before, I’m guessing it’s Apache – OpenBSD still uses a heavily patched version of 1.3.29, the last one before the licence changes. I’ll have to look into it later. Still, the server is certainly quick enough .

Everything else seems to be fine, and it’s great to have more than 100 gigs of free disk space (I also added a new drive), too.

Server upgrade – hardware, OS

Pedro Timóteo — Fri, 21 Apr 2006 14:54:43 +0000

This server will be down tomorrow, for about an hour or so. I’m going to add a new hard drive and some more RAM, and will upgrade OpenBSD 3.7 to 3.9.

It’s not that the server actually needs need more power right now, as it’s more than enough for what it does (blogs, mini-sites, proxy, email gateway, firewall/router, and some other stuff). But I have a few plans…

OpenBSD 3.9 can now be pre-ordered

Pedro Timóteo — Wed, 08 Mar 2006 16:03:53 +0000

The title says it – you can now pre-order OpenBSD 3.9, for $45. I’ve already ordered mine. It’ll be released on May 19.

Highlights from this version are also on the page linked above. I’m still running 3.7 here, having skipped 3.8. As they support old versions for a year, and they release a new version every 6 months, 3.9 will coincide with the time to upgrade 3.7.

OpenBSD may not have all the bells and whistles of Linux, or even FreeBSD, but it’s small, fast, stable, secure, and, most of all, clean – unlike most Unixes, which install everything and the kitchen sink, enabling everything by default, a standard OpenBSD installation is just the OS, with only ssh running.

This is, to me, the right attitude: instead of having to track down what’s running or open, and having to disable / close stuff, with the danger of missing something, here, you enable what you know you want. What a thought.

The BSDs

Pedro Timóteo — Wed, 01 Feb 2006 11:53:44 +0000

Informit has an article titled BSD: The Other Free UNIX Family, which goes into some detail into the story of the main 3 open source BSDs, and the differences between them. I especially recommend it for Linux people who never tried “the other side”.

Incidentally, this very site runs on OpenBSD.

Geek humor: from the OpenBSD mailing list

Pedro Timóteo — Thu, 15 Dec 2005 17:15:20 +0000

Original post:

OpenBSD 3.8:

dd if=/dev/zero of=/dev/sd0c bs=1024k

6MB/s

Linux 2.4:

dd if=/dev/zero of=/dev/sda bs=1024k

53MB/S

Any clue about the difference? Of course I’m also interested in different ways to do this but the difference is what puzzles me.

And one of the replies:

They have a superior /dev/zero

More on SUSE 10.0

Pedro Timóteo — Thu, 24 Nov 2005 14:53:34 +0000

I’ve been using it for a while now, here at work. As I said before, it “feels” faster than 9.1, on the same hardware.

A couple of problems, though:

no MP3 support by default. Not a huge problem, since I always transfer my CDs to Oggs instead of MP3s, but most internet streams, such as Magnatune, are encoded as MP3. Stupid patents.
OpenOffice.org 2.0 crashes if I close it using the “X” at the top right, instead of using “File -> Exit”. No data loss, since it happens after it asks you whether you want to save, but it’s still annoying to have a KDE dialog box saying that an application crashed.
Amarok, the media player, had some problems, which were bypassed by changing the audio engine to Xine. It used to stop playing (but without any error messages or complaints) after playing a few files.

On the other hand, the bluetooth support was great. I was able to easily transfer files to and from both my phones (an N-Gage QD and a 6630), without having to install anything extra – it simply detected both the bluetooth USB dongle and the phones.

SUSE 10.0 at work

Pedro Timóteo — Wed, 02 Nov 2005 22:17:09 +0000

Since a few hours ago, I’ve moved from SUSE 9.1 to SUSE 10.0 at work. Didn’t have much time to “get my hands dirty” with it, but so far so good – the installation is simple and easy, everything looks and feels “polished”, and the default KDE theme is beautiful.

Also, I don’t know if it’s just me – I don’t think so… – but everything feels “faster”. And no, it isn’t because the system doesn’t have a lot of installed software yet – it does. It’s just that some fraction-of-a-second pauses that I’ve got used to in the last year using that same computer (with SUSE 9.1)… simply aren’t there. New versions of some software? A kernel better tuned to interactive usage? Maybe it’s several things at the same time.

Oh well, more to explore tomorrow. I’ll also post a screen capture here, hopefully.

Unix tip of the day

Pedro Timóteo — Fri, 21 Oct 2005 17:10:47 +0000

This happened originally with an AIX box, but I’ve just tried it on Linux and it works the same. It’s not rocket science (but then again, which is rocket science, except actually working in rocketry?), but it can be useful.

A colleague had, by mistake, created a file beginning with a “-”, due to a badly placed redirect (“>”). And, now, the file was hard to delete, because the system assumed that I was giving parameters to the “rm” command.

rm -file didn’t work, of course.

rm "-file" … nope.

rm \-file … nah.

rm "\-file" … no way.

rm -i * , intending to say “yes” to that file and “no” to everything else… nope.

Of course, I could have moved all the other files somewhere else, then delete the directory. But that was a production system, and you know how that is.

A little googling gave me the answer: you can use “--” to say that there are no more parameters after that.

rm -- -file . Simple as that.

OpenBSD’s 10th birthday

Pedro Timóteo — Tue, 18 Oct 2005 17:38:14 +0000

OpenBSD is 10 years old today!

OpenBSD is my favorite Unix variant, although due to laziness I use Linux on my work desktop. But for servers… it’s a dream. Fast, secure by default (instead of closing stuff after installation, everything is already closed down, and you open what you need), lightweight, with the best man pages of any Unix in the world (which other Unixes almost never update, or simply forget about)… it just works. pf, the firewall, is incredibly easy to configure (makes Linux’s iptables look like a sadistic joke, if you ask me… yuck!) yet powerful. It doesn’t include everything but the kitchen sink as part of the OS, just mostly the OS itself – the rest can be installed as packages, ports, or from source.

All my sites, along with my internal proxy server, mail server, DNS server, etc. run on a single OpenBSD box. I’ve tried other server OSes, but I always come back to OpenBSD – it’s everything I want, and perhaps as important, it’s no more than what I want.

So… Happy birthday, OpenBSD!

An Anti-Spam gateway #2: A note about compiling on Linux

Pedro Timóteo — Tue, 11 Oct 2005 15:16:33 +0000

(NOTE: this is part of the “An Anti-Spam gateway” series)

These days, most Linux distributions, especially the RPM-based ones like Fedora, Red Hat or SUSE, increasingly assume that “nobody compiles stuff anymore”. Due to that, they don’t install, by default, the development parts of most libraries and applications.

An example: by default, a distro will install OpenSSL, with the openssl package. But that’s the library files only. It “gives” OpenSSL to other RPMs that need it, but, when you try to compile any program to use OpenSSL, it will fail (or, possibly worse – it will compile, but without OpenSSL support, and you may fail to notice it), because you are missing the header files.

They’re in the openssl-devel package.

So, from now on, through the rest of this series, pay attention when compiling (mostly in the ./configure part). If it fails, or if it passes but says that you are missing an important library, the thing to do is probably to look for the missing *-devel package, and install it.

Incidentally, this is not a problem in the BSDs.

SUSE 10.0

Pedro Timóteo — Fri, 07 Oct 2005 12:17:27 +0000

Novell/SUSE Linux 10.0 OSS is out. Another one to try out when I return from holidays – I’ll finally update my ancient 9.1 version.

Highlights: gcc 4.0.2, Linux kernel 2.6.13, KDE 3.4.2, GNOME 2.12, X.org 6.8.2, OpenOffice.org 1.9.125.

Thunderbird 1.5b1

Pedro Timóteo — Mon, 12 Sep 2005 09:47:28 +0000

Shortly after Firefox 1.5b1, the new beta of Mozilla Thunderbird is also out.

I don’t use an email client at home (I use GMail), but I’ve just updated Thunderbird from 1.0.6 to 1.5b1 at work (Linux). So far, so good. No crashes (these betas have been at least as stable as the latest stable versions, which is impressive). New preferences look, just like Firefox. Spell checking as you type (may be of interest to many people, but I turned it off in less than a minute ).

Not a lot of “wow” stuff here, but then again, it’s a mail client.

Firefox 1.5 beta 1

Pedro Timóteo — Fri, 09 Sep 2005 14:40:45 +0000

Yep, it’s out. I’m posting with it (on Linux) right now.

Looks faster, and so far hasn’t crashed yet, except when I opened the file browser: it crashed every time, then. But I was using development (2.7.x) versions of GTK, compiled a month or so ago; since 2.8.3 is out, which is a stable version, I compiled and installed it, and presto! Problem solved!

(to those who say “see, Linux is too complicated, some library versions make programs crash, and you have to compile stuff”, I was using the development libraries because I wanted to! I didn’t need them for anything in particular, and I could have stayed with RPM versions, but I’m a “bleeding edge” maniac (less so than years ago, but still a bit ).

EDIT: It’s not “faster”, it’s way faster. It’s when you browse familiar pages and you are, unconsciously, expecting them to take a little time to draw themselves, and they appear instantly, that you notice it. I recommend you try it. I’ll install it on my home Windows PC later today, too.

EDIT #2: Using it on my XP home PC as well. Zero crashes, zero problems so far. Also, in less than 24 hours, I’ve found that about half of the extensions I use have been updated and are now compatible. I’d guess that most or all of them will be, in a day or two.

Linux and usability

Pedro Timóteo — Wed, 07 Sep 2005 15:46:32 +0000

(NOTE: this is translated and a bit expanded from a comment I originally posted, in Portuguese, on Carlos Rodrigues’ blog.)

Many people (including geeks, and including Linux users) often say that “Linux isn’t ready for the desktop”. Yet, I’m using it on mine (at work), so it must be ready for at least some desktops, right?

One thing is desktop Linux for a geek/sysadmin/etc.. Here… well, I wouldn’t have Windows on my work desktop. It’s simply not usable or flexible enough to me. It may be OK for a “mouse engineer”, but the whole interface (changed little since Windows 95) seems to assume that everything will be done by clicking here and there, and that nobody has more than 3-5 different things open at a time. With Linux (in fact, with X) I get multiple desktops, dozens of simultaneous (and accessible in a non-confusing way) xterms, entire desktops for some graphic applications, speed, smoothness and stability. And it’s configurable for my way of working, instead of me having to adapt to the interface designers’ preferences. For a “power user”, Windows simply can’t compete with a WindowMaker or a KDE. My colleagues at work try to reproduce the functionality they see me using by installing some weird apps on their XPs, but, every time I look at those, I just shake my head.

A completely different thing is a desktop for a “normal” Joe. He’s fed up with worrying about spyware, viruses, growing slowdowns, occasional crashes, and he’s heard about some “Lunix” thing, so he decides to try installing it. This guy will be in BIG trouble: things like mounting/unmounting drives, selecting some of the hardware from a list that looks like gibberish to him instead of having it automatically detected (or inserting the manufacturer’s CD with the driver), using “WinHardware” like WinModems, playing the games he already has at home, using Office with everything exactly like he’s used to… well, all of that will go wrong. What he wanted, really, wasn’t a different operating system — it was a secure, stable Windows.

And I believe that those are what people think of when they say “Linux isn’t ready for the desktop”.

But there’s still a 3rd case, which is an important one: the non-tech person, in a company, who uses his or her PC to write a few reports, read and reply to emails, do some calculations, browse a couple of sites, and nothing else. To that person, a “locked up” Linux, with the applications that person needs in “large friendly icons” on the desktop, maybe a Solitaire or Minesweeper clone or two (to avoid deppression and suicide for lack of them ) and no more – without the ability to install or uninstall anything, or alter system files, is, IMO, perfect. Much better, and easier to use than any Windows system. The user can’t damage the system (except by using violence against the hardware), doesn’t have dozens of applications or options he doesn’t need – or indeed know what they are -, but only 4 or 5, clearly indicated. And it’s much easier to administer or update remotely by the sysadmin. It doesn’t require an anti-virus or anti-spyware program. It doesn’t become slower as time passes, needing a reinstall after a few months. In a way, it’s much more like an “appliance” (such as a TV set) than a computer: it just works.

IPsec woes

Pedro Timóteo — Tue, 06 Sep 2005 13:39:41 +0000

OpenSwan, ipsec.conf man page:

CONN PARAMETERS: MANUAL KEYING The following parameters are relevant only to manual keying, and are ignored in automatic keying.

and, still in that section:

esp ESP encryption/authentication algorithm to be used for the connection, e.g. 3des-md5-96 (must be suitable as a value of ipsec_spi(8)'s --esp option); default is not to use ESP

Note that that option (“esp”) doesn’t appear in the AUTOMATIC KEYING options list. From the above, one would guess that it’s only for manual keying, and that for automatic keying that option is ignored – that, indeed, it’s not necessary.

Right? Unfortunately, that’s not true, from what I’ve seen.

Until I added:

esp=3des-sha1-96

to a particular automatic keyed connection, it simply wouldn’t work, because the default is to use md5 instead of sha1, and the other side used sha1.

Oh well… things like this end up making us sysadmins not trust documentation. Unless it’s OpenBSD, of course.