Garnser

Closing blog

2009-10-12T13:42:00.000-07:00

As I've recently decided to get my own company going again I've made the decision to close this blog, it will still be available as is but there wont be any further posts. For technical solutions etc please refer to kb.sedoss.com were I'll post future technical solutions related to my consulting company.

Thanks for all of you who has followed my blog, as you hopefully know you can get to my personal blog via me.garnser.se.

Creds to Microsoft

2009-09-16T23:56:00.001-07:00

Throughout the last few weeks I've somewhat raped my soul and went against most things I believe in. Why? I've done a Windows AD implementation to solve a somewhat interesting problem.

I've been working with an organization to help them create a centralized way of having authentication across the border, this include Windows, Linux and OS X servers and clients. Looking at the problem initially I gave it a try to run Samba as a PDC, unfortunately the development hasn't come as far as I hoped so I gave up that idea.

The solution I ended up choosing (which I haven't completely finished yet) is to utilize Windows AD and all that comes with it. As many know AD + Linux has never been a fun thing to deal with until recently as Microsoft decided to implement rfc2307 for Unix attributes. Doing this makes life a lot easier and I managed to put together a working solution in just a few hours, including group definitions!

For now I'm still working on having Samba authenticate with ADS so that shares can be maintained on a Linux-box rather than a Windows server (who wants to run NTFS anyway?) there's still some issues with it but I hope to have it ironed out pretty soon.

Didn't think I would say this but thank you Microsoft for opening up for us Unix-hackers!

Making smbldap-tools rfc2307bis

2009-09-05T19:22:00.000-07:00

Just stumbled upon a setup where I had to make smbldap-tools rfc2307bis compliant, figured I should post the patch here.

This adds ou and uniqueMember to smbldap-populate.

*** /usr/sbin/smbldap-populate.orig 2009-09-05 09:58:29.000000000 -0700
--- /usr/sbin/smbldap-populate 2009-09-05 10:04:10.000000000 -0700
***************
*** 285,293 ****
--- 285,295 ----
loginShell: /bin/false

dn: cn=Domain Admins,$config{groupsdn}
+ ou: Domain Admins
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 512
cn: Domain Admins
memberUid: $adminName
***************
*** 295,344 ****
--- 297,359 ----
sambaSID: $config{SID}-512
sambaGroupType: 2
displayName: Domain Admins
+ uniqueMember: uid=$adminName,$config{usersdn}

dn: cn=Domain Users,$config{groupsdn}
+ ou: Domain Users
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 513
cn: Domain Users
description: Netbios Domain Users
sambaSID: $config{SID}-513
sambaGroupType: 2
displayName: Domain Users
+ uniqueMember: uid=$adminName,$config{usersdn}

dn: cn=Domain Guests,$config{groupsdn}
+ ou: Domain Guests
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 514
cn: Domain Guests
description: Netbios Domain Guests Users
sambaSID: $config{SID}-514
sambaGroupType: 2
displayName: Domain Guests
+ uniqueMember: uid=$guestName,$config{usersdn}

dn: cn=Domain Computers,$config{groupsdn}
+ ou: Domain Computers
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 515
cn: Domain Computers
description: Netbios Domain Computers accounts
sambaSID: $config{SID}-515
sambaGroupType: 2
displayName: Domain Computers
+ uniqueMember: uid=$adminName,$config{usersdn}

dn: cn=Administrators,$config{groupsdn}
+ ou: Administrator
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 544
cn: Administrators
description: Netbios Domain Members can fully administer the computer/sambaDomainName
sambaSID: S-1-5-32-544
sambaGroupType: 5
displayName: Administrators
+ uniqueMember: uid=$adminName,$config{usersdn}

#dn: cn=Users,$config{groupsdn}
#objectClass: top
***************
*** 375,389 ****
--- 390,407 ----
#displayName: Power Users

dn: cn=Account Operators,$config{groupsdn}
+ ou: Account Operators
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 548
cn: Account Operators
description: Netbios Domain Users to manipulate users accounts
sambaSID: S-1-5-32-548
sambaGroupType: 5
displayName: Account Operators
+ uniqueMember: uid=$adminName,$config{usersdn}

#dn: cn=System Operators,$config{groupsdn}
#objectClass: top
***************
*** 397,433 ****
--- 415,460 ----
#displayName: System Operators

dn: cn=Print Operators,$config{groupsdn}
+ ou: Print Operators
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 550
cn: Print Operators
description: Netbios Domain Print Operators
sambaSID: S-1-5-32-550
sambaGroupType: 5
displayName: Print Operators
+ uniqueMember: uid=$adminName,$config{usersdn}

dn: cn=Backup Operators,$config{groupsdn}
+ ou: Backup Operators
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 551
cn: Backup Operators
description: Netbios Domain Members can bypass file security to back up files
sambaSID: S-1-5-32-551
sambaGroupType: 5
displayName: Backup Operators
+ uniqueMember: uid=$adminName,$config{usersdn}

dn: cn=Replicators,$config{groupsdn}
+ ou: Replicators
objectClass: top
objectClass: posixGroup
objectClass: sambaGroupMapping
+ objectClass: groupOfUniqueNames
gidNumber: 552
cn: Replicators
description: Netbios Domain Supports file replication in a sambaDomainName
sambaSID: S-1-5-32-552
sambaGroupType: 5
displayName: Replicators
+ uniqueMember: uid=$adminName,$config{usersdn}

";
if ("sambaDomainName=$domain,$config{suffix}" eq $config{sambaUnixIdPooldn}) {

New project going down

2009-08-31T01:15:00.001-07:00

I'm currently working on a new exciting open-source project which is taking up the wast majority of my time. Once official I'll hopefully get back to somewhat of my normal life and start posting more again, for now follow me on twitter.

If you are or know someone who may be interested in contributing with code or design please contact me directly at jpetersson [ at ] garnser dot se.

Flow control routing

2009-08-11T01:38:00.001-07:00

Just this morning I stumbled upon an article about Lawrence G. Roberts work on flow-control routers. I'm a bit surprised that I haven't stumbled upon his work earlier given that he's been in the market with this since 1999.

The technology behind flow-control is well described in the following chart:

If you're interested I would give the article about it a read, it's quite impressive that we've been able to keep up the last few years with 40 year old technology, I'm sincerely hoping to see more of these solutions in the future, especially if someone would decide to implement it into the Linux kernel.

MySQL.com down

2009-07-29T08:18:00.000-07:00

As some of you may have read we recently had an outage with MySQL.com we're now back up and in better shape. Due to this I'm now back in Sweden for a couple of weeks hacking a bit, hopefully I'll be able to post some fancy diagrams here at some point around it.

Going private

2009-07-15T00:40:00.001-07:00

Given that the nature of this blog has become quite technical I've decided to break out a portion of it that has more of a personal touch to it. I'll try to post updates more frequently on this blog with things going on in my life and my thoughts on various decisions. This blog will stay around but I'll limit it to technical information/solutions only for now.

You can follow the new blog at me.garnser.se

SMS-proxies

2009-07-14T08:19:00.000-07:00

Communicating over the Atlantic in an easy and cheap way has always been a hassle, surely products like Skype/IM has helped with this a lot but it's still not a perfect solution given that there's some restrictions.

I've recently gotten myself into the situation where I want people in Sweden to be able to send me SMS from Sweden not paying more than their usual local rate and have their messages end up on my phone with no extra charge.

I'm sure that if anyway at AT&T sees this they're going to get furious about it but hey, hackers will always be around doing stuff like this, adopt to the new technology instead.

Either way, starting to look into this problem I was thinking about a couple of SMS projects I've done a couple of years back, unfortunately all of these were payed services meaning that if I were to receive any message the sender would pay a minimum of 5 SEK ($0.5) which kinda kills the idea of the project. After poking around with colleagues someone gave me a tip about Ballou that has SMS services.

So I registred and looked around in the FAQ to figure out how to get things working, I expected there to be an option to have a prefix in an SMS followed by the message which would be sent to a 5-digit number or similar but I got a nice surprise, upon request you'll be assigned a dedicated number for no extra cost.

Obviously I would meet some more issues around this, Ballou does have an email forwarding service so I figured I should try sending it to AT&T's mail-to-SMS service, unfortunately it turned out that Ballou included a lot more information than I needed for this setup. When receiving an email it is formatted like:

2009-07-13 18:57:36
Från +467066XXXXX
Till +4673012XXXXXX

Text:
Message

And yeah that's HTML being sent as well. I could probably see myself making use of this extra data in another project but for this the only thing I wanted to have was the actual message, given the restricted amount of people I am giving this number to I would be able to figure out who it is anyway, so this is kinda where my project took of.

As I've posted about before I'm using the Google Enterprise services including email for my domains, I had somewhat of a naive hope that they would support some kind of macros when forwarding emails but unfortunately this wasn't the case.

Given the situation I decided to look into alternative ways to get the essential information to my mobile, what came to mind was a quick Perl hack.

This script is quite simple but yet powerful, essentially what it does is:

Look for any unread message from Ballou notifying me that a new SMS has been delivered.
Download the given email.
Parse the email for the actual message.
Mail to AT&T's mail-to-SMS service.

Even though the setup isn't as straight-forward as one could wish it to be it does the job, if anyone knows another solution that's free you're welcome to ping me about it :).

Oh and btw Ballou, please honor newlines and don't run s/\n//g on my messages, it's putting words together and it's honestly pretty damn annoying.

iPhone, a next potential thin client?

2009-07-06T10:09:00.000-07:00

I've blogged about this before but after discussing it with friends and colleagues recently I got a new eye-opener. Looking at thin clients on the market today many of them has equal or less performance compared to the iPhone 3G(S).

As you may know Citrix has release an application called Citrix Receiver allowing you connect to a Citrix server and control Microsft Windows applications from your iPhone. As this may be a step in the right direction it's really not enough as you're limited by the size of your screen on the iPhone.

Looking at patents filed by Apple there's one that comes to mind within this category; #20080002350. This patent describes how you would be able to dock your MacBook (Pro) in an iMac looking device (see MacRumors). I haven't read the details of what this patent covers as far as which devices that's potential candidates but the iPhone surely could be one in conjunction with a remote X like environment like Sun offers using it's thin clients.

Another touch which Gizmodo posted about is to make something similar to what Asus is planning to release soon. A keyboard with a built-in computer. However in this case the computer would be the phone and the keyboard would really just be a docking-station.

So Apple, hopefully you're R&D department has someone reading blogs and ideas how Apples products could be utilized, and if so, dump the projector stupidity and give us a solution to use the iPhone as a thin client.

Feedback to Google

2009-07-02T02:18:00.001-07:00

So since it's rumored that Google does check on the Internet for feedback in recent changes I wanted to give my $.02 on some things:

- Spacing in google search on the left side: Why would you do this? Unfortunately we live in a world were screens are getting smaller and the resolution stays the same with this netbook-mania, removing any valuable space is moronic.

- Apply of labels in Gmail: I'm a "Enterprise"-customer of Gmail and quite a heavy user. I've became quite abusive with my labels but I like to have things organized causing me to tag multiple emails with multiple labels, the extra click of accepting that I've chosen a label when searching for one is a PITA, if you did choose the wrong one it's just one click to remove the wrongly selected anyway, why make it redundant?

Office 2.0

2009-05-15T18:11:00.001-07:00

Dinner ready!

2009-05-10T20:30:00.001-07:00

Making some food

2009-05-10T20:11:00.001-07:00

Potatoes, beef and mushrooms.

DNS query parser

2009-04-29T13:43:00.000-07:00

The last days I've been working on our internal DNS servers looking at the new BIND statistics I enabled 2 weeks back. I sure found some interesting behaviors of some clients that shouldn't be there thanks to it.

Thinking a bit more at statistics I started looking at the query-log, if you have managed a DNS server you know that the query-log tends to build up quickly and it can become pretty unmanageable to troubleshoot unless you've some decent programming skills. Due to this I figured, hell, lets dump the data in a MySQL database so we can run some nice queries to see trending etc.

The code below is what I ended up with. What it does is creating a named pipe (FIFO) that allows BIND to write all query-log data directly a database after being parsed by the script.

Please notice that I'm still working on the code and will post the updates to this post, if you have any proposals or issues with it please email me.

Disclaimer: This code is very much untested and it's expensive to run from a CPU perspective, use caution!

...
logging {
  channel query_log {
      file "/var/log/querypipe";
      time-stamp yes;
  }
...

Once started all query-log data is sent to the script and gets parsed, once the writecache has reached it's top the data is being written to the database. The reason for maintaining a writecache is because MySQL with MyISAM has a lot better performance inserting several rows at once rather than one at the time, the backside to this is that you're data wont be real-time which may not be ideal depending on your reporting needs.

CREATE TABLE `queries` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`date` varchar(25) DEFAULT NULL,
`time` varchar(25) DEFAULT NULL,
`id` int(11) DEFAULT NULL,
`port` int(11) DEFAULT NULL,
`query` varchar(255) DEFAULT NULL,
`rr` varchar(25) DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=MyISAM

To run the code edit the variables to match your system settings, to demonize it run it with -D, once started, run rndc reload or restart your name-server to release locking of the query-log.


#!/usr/bin/perl

use Getopt::Long;
use DBI;
use POSIX qw(setsid);
   
my $daemon = 0;

Getopt::Long::GetOptions('daemon|D' => \$daemon);


if ($daemon) {
    defined(my $pid = fork)   or die "Can't fork: $!";
    exit if $pid;
    setsid                    or die "Can't start a new session: $!";
}

$SIG{INT} = \&terminate;
$SIG{HUP} = \&terminate;

sub terminate {
    unlink $FIFO;
    exit 0;
}

while (1) {
    
    my $LOG_PATH = '/var/named/chroot/var/log/';
    my $FIFO     = $LOG_PATH.'querypipe';
    my $RNDC     = '/usr/sbin/rndc';
    my $user     = 'named';
    
    my($login,$pass,$uid,$gid) = getpwnam($user) or die "$user not in passwd file";
    
    my $db = DBI->connect("dbi:mysql:database=dns;host=localhost:3306;user=dns;password=dns") or die "Failed to connecto DB\n";
    
    while (1) {
 unless (-p $FIFO) {
     unlink $FIFO;
            system('mknod', $FIFO, 'p')
                && die "can't mknod $FIFO: $!";
 }
 chown $uid, $gid, $FIFO;
 system("$RNDC reload");
 open (FIFO, "< $FIFO") || die "can't read $FIFO: $!";
 while () {
     my($date, $time, $source, $port, $query, $rr) = /([0-9]{1,2}-[A-Za-z]{3}-[0-9]{4}) ([0-9]{2}:[0-9]{2}:[0-9]{2}).[0-9]{1,5} client (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#([0-9]{1,5}): query: (.*) IN (.*) +/;
     
     my $statement = $db->prepare("INSERT INTO `queries` values (NULL, '$date', '$time', '$source', '$port', '$query', '$rr')");
     $statement->execute() or die "Failed to write to DB!";
 }
 close FIFO;
    }    
}

Planned additions:
- ~~Help-messages~~
- ~~Function to log~~
- Auto adjust write frequency based on load
- Clean-up
- Fix MySQL table to use appropriate fields

Enabling your recursive BIND server to support DNSSEC

2009-04-05T22:42:00.000-07:00

So I've been doing some BIND hacking this weekend looking into enabling my recursive BIND instance to do DNSSEC lookups if available.

Since the root-servers today doesn't have native support for DNSSEC DLV (Look-aside Validation) has to be used. ISC provides one of these giving somewhat of a proxying DNSSEC validation.

To enable DNSSEC lookups on your servers the easiest approach is to use dnssec-configure which reconfigures your named.conf with the appropiate variables. To enable, run:

dnssec-configure --dnssec=on --dlv=on -u -b

This will add the following to your config:

options {
...
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside . trust-anchor dlv.isc.org.;
dnssec-accept-expired yes;
...
}

...
include "/etc/named.dnssec.keys";

Open up /etc/named.dnssec and add the following to enable DLV:

include "/etc/pki/dnssec-keys/dlv/dlv.isc.org.conf";

This includes the DNSKEY of dlv.isc.org which is required to validate lookups towards this server. Unless you include the key lookups will not work. Notice that you may have to shuffle the files around a bit to adopt to your setup.

After you restart named your BIND server will query the DLV server for secure lookups, if you have logging enabled you will be able to see DNSSEC debug records.

As you probably know, when using signed entities keys are refreshed with a set constant of time. The recommended time for a DNSKEY is 1 month. Due to this the key you have present in your dlv.isc.org.conf will become deprecated after 1 month. I decided to solve this by making a perl-script re-creating the dlv-configuration every night to ensure that my server doesn't loose the capability of doing lookups. If DLV is unavailable no recursion will work!

Here's the script:

#!/usr/bin/perl

use IO::File;
use strict;
use warnings;
use Net::DNS;
use Data::Dumper;

my $dlv_file = "/var/named/chroot/etc/pki/dnssec-keys/dlv/dlv.isc.org.conf";

my $res = Net::DNS::Resolver->new(
nameservers => [qw(127.0.0.1)],
recurse => 1,
debug => 0
);

my $dnssec_key = $res->query("dlv.isc.org", 'DNSKEY');

my $dlvconf = new IO::File('<'.$dlv_file);

sub nl2br {
my $t = shift or return;
$t =~ s/([\r\n])/$1/g;
return $t;
}

open FILE, ">".$dlv_file;
print FILE "trusted-keys {\n\n";
print FILE for map {

"dlv.isc.org. ".$_->flags.' '.$_->protocol.' '.$_->algorithm.' "'.nl2br($_->key)."\";\n"

} $dnssec_key->answer;

print FILE "};\n";
close (FILE);

chown 25, 25, $dlv_file;

system("rndc reload");

exit 0;

Add the script to crontab and it will automatically update the DLV key as needed.

Meetings, meetings and meeting

2009-01-16T08:24:00.001-08:00

All the usual, meetings all day, going to Menlo Park rather than Santa
Clara today to hang out with some old colleagues

Hard at work

2009-01-15T16:30:00.000-08:00

About time to go home, way too many late nights this week.

Good morning Broomfield

2009-01-13T09:58:00.001-08:00

Well I have to admit that our view in the bay-area isn't as great.

Settled in the hotel

2009-01-12T19:06:00.000-08:00

So after a day in the office and pizza night with the colleagues I settled at my hotel. 2 rooms + kitchen. I can't make up my mind which room to sleep in :(

Flying out to Denver

2009-01-12T05:44:00.000-08:00

Flying out to Denver to hang out with my new team for a couple of days.

24

2009-01-11T21:52:00.001-08:00

Watching 24, have to wake up in 6 hours :(

Thai + milkshake

2009-01-11T17:23:00.001-08:00

Mark and I ended up at some Thai-restaurant for lunch, and I must say,
the food was freaking spicy...cooled of with a milkshake afterwards.

Good morning sunshine

2009-01-11T11:15:00.001-08:00

It has been pretty cold in the Bay-area lately (around 50) but it seams like we'l have a turnover soon, it's even supposed to hit 70 today. Hopefully I'll find a good excuse to go outside.

New desk(top) setup

2009-01-11T10:37:00.000-08:00

After requesting a new 20" monitor for my home-office my boss asked if I'd prefer a 24" instead since he had those on the shelf. Not being rude I obviously had to accept that. Anyhow, due to this I decided to take home my 24" from the office and put it at home thus resulting in this.

While being at it I decided that I've been running Vista on my desktop for way to long so I finally made the step back to Ubuntu. However what's new now is that since I've the i7 CPU there's some mad potential to run virtual machines, so far I'm up to: Fedora 10, OpenSolaris, Ubuntu 9.04 beta, Vista Ultimate and Windows 7 all running seamlessly in parallel.

Leaving the US for xmas

2008-12-19T22:27:00.000-08:00

It's the time of the year again, xmas, since my family lives back in Sweden I'm somewhat obligated to go there, (un)luckely enough I have a 10 hour layover in Chicago so I'll be able to kill some time going downtown with a friend of mine, should be fun.

The phone-call of change

2008-12-14T19:03:00.000-08:00

Meetings, and phone-calls, small ideas that turns into a revolution.

I got a phone-call last Friday, and it will indeed turn things into a revolution.

Stay tuned...

The stupidity of spending money

2008-11-21T18:43:00.000-08:00

Since I started getting a decent salary I've just given price tags a blind eye, and a deaf ear to what customer reps are saying, i.e. I never ask or check what the price for something is.

So tomorrow I'm going to a wedding, friend of mine is getting married. Since this week has been pretty stressful I didn't end up doing it until today. Getting into the store all the reps are friendly as always, shows me different options and I select something I think looks good.

After fitting I go our to the cashier to pay, as a small surprise the cashier says, that's $1299. Ugh, my credit-card has a limit of $700 and my debit card is limited to something similar. So I end up buying a gift-card to split the cost on. But oh yeah, that hurt, really bad, especially since I wear suits like, 1 time per year, based out of this I ought it to myself to wear it every freaking day.

Yes I'm stupid and I'll try to start looking at the price tags, for now it's shop-stop for the rest of the year (I've already bought my family xmas-presents).

*sigh*

Dear Santa Jobs

2008-11-02T20:12:00.000-08:00

The other day me and my colleagues were discussing what the next step for the iPhone could be. One of them proposed that it could make sense to integrate the mini-DisplayPort, and further use it as a portable computer. This idea tingled me a lot. If I would be able to carry my actual computer in my pocket, dock it and be ready to run with the data and apps it would be golden. What might make more sense is to put some of the cababilities in the dock, say core OS but let the iPhone do the actual CPU work.

Looking at the technical aspect of this there might be some possibilities using the Intel Atom CPU which supports clock-frequencies of 800Mhz-1.87GHz. The current CPU in the iPhone is an ARM 1176 620@412 MHz. If the iPhone were to use the Atom CPU it could run at a slower clock-rate in "phone-mode" and faster in "computer-mode". As far as the graphics goes this might be a more valid concern, I've some doubts that the PowerVR GPU would be able to handle the 1920x1200 pxls of an Apple Cinema Display.

So please Apple and Mr. Santa Jobs get to work. I bet this would tingle more people than me!

2008-10-31T22:47:00.001-07:00

2008-10-31T22:46:00.000-07:00

Network and multimedia updates

2008-10-27T15:13:00.000-07:00

DRAFT

So I figured it was time for some updates on my home network/multimedia setup since I moved 2 weeks back. As we're now 4 people on the network rather than 1 I've done some slight changes.

Network
The network is controlled by 2 units, my Linux server and an Apple Time Capsule. The Linux server hosts DNS, DHCP, UPnP, NTP, Samba, AFP, NFS, OpenVPN etc. it also acts as a router/gateway/firewall.

The Time Capsule acts as an 802.11n AP and switch for my multimedia equipment that requires more bandwidth than ~150Mbit or equipment that doesn't support wifi.

An issue we stumbled upon when moving in was that nothing in the house was pre-wired. For us to be able to wire our equipment we would have to drill etc. To make this easier I started playing with the idea of using wire-less bridges, thus I picked up an Airport Extreme, giving me a 802.11n wireless bridge and an Ethernet port to connect a switch to. Since my roommates didn't want to spend the $99 we took some old Linksys's we had laying around and flashed them with dd-wrt which gave us the same functionality. The result: Wired connections in every room without any physical labor.

As you may have seen Boxee was recently released for AppleTV, this has built in support for UPnP and supports way more codecs than my PS3 and takes less power. After flashing the ATV with atvusb-creator we were up and running. This didn't really eliminate the need for any of iTunes streaming servers I have since I'm still getting legal content of the iTunes store but at least I can save some of my power-bill for not having to use my PS3 to watch downloadable content.
As far as music goes things are pretty much the same. One nice addition was the Airport Express which support AirTunes allowing me to stream music over the air from any room.

Updated media setup and streaming

2008-09-18T22:03:00.000-07:00

Due to various reasons I've started to extend my multimedia setup at home. Mostly for convenience but also to get a good reason to do some hacking after hours.

As posted earlier here's the physical setup of my multimedia center.

So this is all old news so lets get to the new ones. I recently purchased a new server for home to do some hacking on, try out new stuff etc. As of earlier I haven't really had a good way of distributing media across my devices. For example, if I wanted to watch a divx movie on my projector I either had to run a 25ft cable from my Mac Mini or put the movie on an external hard-drive and plug it into my PS3. Sure this isn't all that much work but it's still a pain as it could be easier.

So the PS3 has a nice features whereas it supports UPnP (Universal Plug and Play) this allows for network devices to stream media over a standardized protocol to devices that supports this, in this case my PS3. I did some experimenting with this when I initially got my PS3 but it wasn't all that successful.

Today I stumbled upon a new daemon called MediaTomb that works with the PS3 UPnP setup pretty much out of the box (1 row of config had to be added). MediaTomb also has some nice features whereas it scans set folders within a set time-interval to identify new media-content. Other daemons such as Deluge doesn't so you have to do it manually each time you want to stream new content.

Now thanks to a script me an my colleague developed, I enable a download, the content is unpacked an placed in an appropriate folder, MediaTomb scans the folder and voila, the Media is accessible on my PS3 using only with 1 mouse-click at my computer.

The second problem I've been working on this week is to gain access to my Music library from work, surely my iPhone is an awesome music player but I can't drain my battery all day long and quite honestly, iTunes does a better job.

Due to this I started thinking of a networked solution that would allow me to achieve this goal. First of was me.com, aka .mac which with its function BacktoMyMac allows me to access my disk remotely from any Mac enabled with my .mac account. I immediately ran into problems with this as it required my firewall to be opened up on the fly, this was solved using the upnpd daemon in Fedora but I honestly don't want to leave the security of my network into code I haven't or wont investigate further. Secondary this wasn't all that effective, as I played songs in iTunes I saw delays up to 30 seconds when changing songs which is quite painful. BackToMyMac wouldn't allow me to see mounted shares either.

I figured I had to take another approach so I decided to install an OpenVPN server at home, as I'm using OS X I was a bit reluctant to this idea as OpenVPN hasn't worked all that well with OS X by history, luckily enough most issues has been worked out and it's running smoothly nowadays.

Once I had my OpenVPN connection established I started sharing my content folders using Samba. The reason I choosed Samba was easy, it simply works in any OS. Once the share was mounted I started syncing my media in iTunes. The initial sync took a while but not any-longer than I expected it too. Once up and running the song shift was cut from 30 seconds to 2-5 depending on the size of the song. While playing without changing songs manually the lag was 0 as iTunes seams to cache the data.

This setup would not have worked prior to iTunes 8 as version 7 had issues with media stored on a networked device resulting in labeling all content as unavailable until the user double-clicked on every single file. This issue was resolved as of version 8.

The last approach which I haven't had time to investigate further yet is using daap daemon at my server and share music as if my server was an iTunes server. The cons with this is that you can only share music, nothing else and it only works with iTunes.

UPDATE: The daap-server seams to handle the latency a lot better than the Samba-share. Change of songs are instantaneous but then again, music only so I think I'll stick with Samba.

UPDATE2: Turns out that Samba works really bad with OS X, due to this I tried NFS and AFP as well. AFP ended up being the best choice as far as OS X clients goes, however I decided to keep NFS and Samba around for non OS X clients.

So that's it, down is a diagram of the new setup, if there's any questions feel free to post in the comment section.

A notice, as far as the daap connection between my Mac Mini and Apple TV goes it's all fine and dandy with both music and video. Whichever way Apple has solved it they've done a good work. My shows are downloaded automatically, stored on my NAS and streamed by my Mac Mini to my Apple TV.

The Panic Button

2008-09-05T08:35:00.000-07:00

*ring*....*ring*...*ring*

- "Hello?"

It's 4am in the morning and like too many other nights something is down.

- "Our call-centers seams to be having issues can you have a look at them?"

- "Sure..."

I log in and the more I start looking the more things keep crashing, suddenly I crash. I press the PANIC button.

3.59am: I wake up sweaty and scared to death.

I need some vacation....

"For whatever liable reason now that I work for Sun, no our call-centers wasn't down, as a matter of fact nothing was down, I just had a nightmare about work and it was awefully realistic"

Testing sunglasses

2008-08-17T08:44:00.001-07:00

New multimedia installation

2008-07-19T09:23:00.001-07:00

So I made the decision to buy a Playstation 3, unfortunately my existing multimedia setup at home didn't cut it so I had to buy a new speaker system as well. After looking around and talking to friends I decided on the Logitech Z-5500 system.

Since I'm starting to get a significant amount of systems at home I decided to put together a diagram for the connections.

I'll post further updates as I receive my equipment.

Appetizer #2

2008-07-06T15:22:00.001-07:00

Scallops with shrimp-omelet and spinach stew.

Appetizer

2008-06-21T16:52:00.001-07:00

Egg with caviar and shrimp.

Diskless linux boot

2008-06-16T17:33:00.000-07:00

DRAFT!

Prep DHCP
# yum install dhcp

# emacs /etc/dhcpd.conf

allow bootp;
allow booting;

ddns-update-style interim;
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.10 192.168.0.254;
default-lease-time 3600;
max-lease-time 4800;
option routers 192.168.0.1;
option domain-name-servers 192.168.0.1;
option subnet-mask 255.255.255.0;

filename "pxelinux.0";
next-server 192.168.0.1;
}

Prep TFTP
# yum install tftp-server dhcp syslinux
# emacs /etc/xinet.d/tftp

disabled = no

# mkdir /tftpboot/pxelinux.cfg
# cp /usr/lib/syslinux/pxelinux.0 /tftpboot/

# cd /tftpboot/pxelinux.cfg
# emacs 01-FF-FF-FF-FF-FF-FF

prompt 0
default linux
timeout 1000

label linux
kernel vmlinuz-.nfsboot.
append init=/sbin/init root=/dev/nfs rw nfsroot=192.168.0.254:0.0.0.0:192.168.0.1:255.255.255.0 noapic acpi=off

Install CHROOT environment

# mkdir -p /nfsroot/slave1
# emacs installslave.sh

MYCHROOT=/nfsroot/slave1

mkdir -p $MYCHROOT/etc $MYCHROOT/dev $MYCHROOT/dev $MYCHROOT/proc $MYCHROOT/sys

cp /var/cache/yum/fedora/mirrorlist.txt /nfsroot/slave1/var/cache/yum/fedora/
cp /var/cache/yum/updates/mirrorlist.txt /nfsroot/slave1/var/cache/yum/updates/

cp -r /etc/yum* $MYCHROOT/etc
touch $MYCHROOT/etc/fstab

mknod $MYCHROOT/dev/null c 1 3
chmod 666 $MYCHROOT/dev/null

mount --bind /proc $MYCHROOT/proc
mount --bind /sys $MYCHROOT/sys

yum --installroot=$MYCHROOT groupinstall "Base"

umount $MYCHROOT/proc
umount $MYCHROOT/sys

./installslave.sh

NFS
# emacs /etc/exports
/nfsroot/slave1 192.168.0.254(rw,no_all_squash,no_root_squash)

Build kernel
$ su -c 'yum install yum-utils rpmdevtools'
$ rpmdev-setuptree
$ yumdownloader --source kernel
$ su -c 'yum-builddep kernel-.src.rpm'
$ rpm -Uvh kernel-.src.rpm
$ cd ~/rpmbuild/SPECS
$ rpmbuild -bp --target=`uname -m` kernel.spec
$ cd ~/rpmbuild/BUILD/kernel-/linux-./
$ cp configs/ .config
$ make oldconfig
$ make menuconfig
$ cp .config ~/rpmbuild/SOURCES/config-
$ cd ~/rpmbuild/SPECS
$ emacs kernel.spec

% define buildid .nfsboot

$ rpmbuild -bb --with baseonly --without debuginfo --target=`uname -m` kernel.spec
$ cp ~/rpmbuild/RPMS//kernel-..rpm /nfsroot/slave1
# chroot /nfsroot/slave1
# rpm -ivh ~/rpmbuild/RPMS//kernel-..rpm
# exit
# cp /nfsroot/slave1/boot/vmlinuz-.nfsboot. /tftpboot

emacs /nfsroot/slave1/etc/rc.local
/bin/mount 192.168.0.1:/nfsroot/slave1 /

pwconv

http://www.digitalpeer.com/id/linuxnfs
http://fedoraproject.org/wiki/Docs/CustomKernel

Visit too IKEA

2008-06-12T18:48:00.001-07:00

Yum!

Automatic update of DNS with Time Capsule and BIND dyndns

2008-06-04T20:32:00.001-07:00

I doubt that anyone has the same setup as I have, but anyhow here's a
script I made to update the DNS record of my home-server:

To get a sense of what the script is doing let me explain my setup.

I've a hosted server where I host all my domains. One of the record is pointing at my home-server. As this server is on a consumer Internet transit it tends to change IP every now and then which can be a pain in the neck when you need to access it from a remote location and don't know the IP.

So what this script is doing is:
- Pulls IP information from my Time Capsule (which also is my router).
- Compares the IP information with a file containing the last known IP, if this file doesn't exist it is created once the updates are finished.
- Provided that the IP pulled from the Time Capsule doesn't match the last known IP the script logs into my DNS server, executes a script that updates the record pointing at my home server
- Once an update is finished it sends an email to AT&T which converts to an SMS with me as the recipient

This runs with cron every minute.

#!/usr/bin/perl

use IO::File;
my $oldip_file = "/root/oldip";

open (SNMP, "/usr/bin/snmpgetnext -cpublic -v1 192.168.1.1 IP-
MIB::ipAdEntIfIndex |");
while (<>) {
$data = $_;
};
close SNMP;

@ip = split('\.|\ ', $data);
$ip = $ip[1].".".$ip[2].".".$ip[3].".".$ip[4];

my $oldip = new IO::File('<'.$oldip_file);  if ($ip != <$oldip>) {
system ("ssh -i /root/.ssh/id_rsa.dnsadmin dnsadmin
\@**** '/home/dnsadmin/scripts/update.sh ".$ip."'");
system ('echo "**** has a new IP '.$ip.'" | sendmail 408*******@txt.att.net
');

open FILE, ">".$oldip_file;
print FILE $ip;
close (FILE);
};

If you're going to use this remove the spaces by "< SNMP >" blogspot thinks this is a HTML tag and wont let me post it.

Network emulation

2008-06-03T14:29:00.001-07:00

BIND: Semi-dual master

2008-05-03T20:32:00.000-07:00

Lately I've tried to figure out a couple of ways to have a redudant master setup of BIND. BIND itself doesn't have any features to support this which has been bothering me as it would be useful to fail over to a secondary slave.

After numerous discussins on the bind-users list I've reached the conclusion of how I would do it, described in the picture to the right.

BIND slaves is able to notify other slaves when changes occur. To utilize this I would have 1 primary master, and a secondary master which acts as a slave towards the primary. Both of these servers wouldn't allow queries from clients but they would feed the slave-servers acting as DNS-servers for clients on the network.

Unfortunatly this doesn't solve the entire problem as the slave doesn't take flags such as allow-update, or update-policy. The best way to solve this is most likely going to be some kind of script syncing the primary config to a standby file at the secondary.

I'll be working on this solution the coming weeks and post further info I gather along the way.

Sometimes you just want to kill yourself

2008-03-14T22:56:00.000-07:00

Yes, sometimes you want to kill yourself and take others with you in the fall.

Since I came home today I've spent a great deal of time trying to collaborate Samba, OpenLDAP and BIND to act as an Active Directory server. By history I've dealt a great deal with Active Directory servers and like the idea behind it but I've never liked the implementation.

Anyhow, as I was reading up on how AD works and how to implement it I just realized minute by minute what a horrible LDAP implementation AD is. Surely I knew this before I started off but can someone really make LDAP _this_ bad?

Anyhow, 5 hours into it I gave up, I would describe the experience as trying to touch your toes with your hands when standing up. I bet there's someone who can do it but it's simply not normal!

To move on I was going to implement IPsec (the horrible VPN protocol) on the same server, but no-no, you can't run IPsec of 1 single interface, it has to be 2. Intellegent ideas such as bridging is something completely unknown to IPsec.

So to add up:
I'm not running any windows computers so I really don't have a need of AD, just wanted to see how it could be done.
IPsec, I was planning to run this along with OpenVPN, but why bother, OpenVPN it sure as hell a much better choice all categories.

Conclusion: Proprietary and old network standards can go to hell. Long live open source and innovation!

So what's happened to be due to the acquisition

2008-03-04T19:32:00.001-08:00

As you may know Sun Microsystems has acquired MySQL as of Q1 this year. The first thing that came to my mind because of this was; Do I have a job? Do I get to stay in the US? If not can I work in Sweden?

So last week I received an offer letter from Sun, I get to stay 9 months and gets a decent raise on top of it.

So where does this leave me? Surely I might be out of a job in 9 months or I may find something within or outside Sun. Overall I think it's exiting to be a part of a merge of two opensource companies but I'm sad about loosing the general MySQL spirit that has been with us for so long. Hopefully we'll be able to affect Sun with our spirit and create something great together.

3 firstnames?

2008-03-04T18:10:00.000-08:00

I've had a couple of interesting days lately dealing with different governmental departments.

Somehow I managed to find out that I was supposed to inform the Swedish national registration that I've emigrated the USA, so I ended up sending them an email informing about this.

Couple of weeks later I received a snail-mail stating that the process was finished, but I noticed something that I found odd. The section stating my first, middle and lastname didn't have any fields for my middle names, they were all written as firstnames, seams odd right? So I decided to check this up, after a couple of emails back and forth the national registration verified that I don't have any middle names, I just have first-names, and 3 of them!

Now this was getting complicated as the name I use is Jonathan, but this is actually my third firstname, so on all my documents it says "name1 name2 Jonathan Petersson". Overall this has worked out fine since I came to the US both with immigration, social security, banks etc. I was simply Jonathan. But the DMV didn't agree at all, my name was clearly my first firstname.

Based on this I now have to go through a horde of paperwork, AGAIN! Renew my social security, notify all agencies, get new contracts and so on just because I was using my de facto firstname.

Luckily enough Sun (yeah Sun bought MySQL if you didn't know) has a splendid immigration department and it seams like they will be able to solve all the issues for me.

So overall, don't think your name is X, it might be Y, it took me 20 years to get to know about it.

My new mic

2008-03-01T16:29:00.001-08:00

How to enable BIND with DNSSEC and Secure Dynamic Update using SIG(0)

2008-02-02T23:06:00.000-08:00

For the last couple of days I've been struggling trying to figure out how to get DNSSEC with SDU (Secure Dynamic updates) to work using SIG(0) keys. I was almost at the edge of giving up when a colleague of mine proposed to try it out in RHEL 5.1 and file a bug report to RedHat, and so I did only to get the surprise that it worked perfectly fine.

Since I've spent so much time on this I decided to blog on how to do this. I hope someone get use of this blogpost.

First off please notice that this configuration was made using:


Red Hat Enterprise Linux Server release 5.1 (Tikanga)
Linux dl360-g5-i.mysql.com 2.6.18-53.1.6.el5 #1 SMP Wed Jan 16 03:56:43 EST 2008 i686 i686 i386 GNU/Linux
bind-chroot-9.3.3-10.el5

I can not guarantee that it will work with whatever setup you're using!

The tools used to enable DNSSEC and SDU is:

dnssec-keygen
dnssec-signzone
nsupdate

First off we need to configure named.conf, here's an example configuration:


options {
 directory "/var/named";
 dump-file "/var/named/data/cache_dump.db";
 statistics-file "/var/named/data/named_stats.txt";

 version "secret";

 querylog yes;

 allow-transfer { 127.0.0.1; };

 key-directory "/etc/keys";
};

logging {
 channel my_security_channel {
     file "/var/logs/named_log.txt" versions 20 size 40m;
     print-time yes;
     severity debug 2;
 };

 channel my_dynamic_channel {
     file "/var/logs/dynamic_log.txt" versions 2 size 40m;
     print-time yes;
     severity debug 65535;
 };

 category default { my_security_channel; };

 category default              { my_dynamic_channel; };
 category client               { my_dynamic_channel; };
 category config               { my_dynamic_channel; };
 category database             { my_dynamic_channel; };
 category delegation-only      { my_dynamic_channel; };
 category dispatch             { my_dynamic_channel; };
 category dnssec               { my_dynamic_channel; };
 category general              { my_dynamic_channel; };
 category lame-servers         { my_dynamic_channel; };
 category network              { my_dynamic_channel; };
 category notify               { my_dynamic_channel; };
 category queries              { my_dynamic_channel; };
 category resolver             { my_dynamic_channel; };
 category security             { my_dynamic_channel; };
 category unmatched            { my_dynamic_channel; };
 category update               { my_dynamic_channel; };
 category update-security      { my_dynamic_channel; };
 category xfer-in              { my_dynamic_channel; };
 category xfer-out             { my_dynamic_channel; };

};

view "internal" {
   match-clients { 127.0.0.1; };

   recursion yes;
   allow-recursion { localhost; };

   zone "example.com" IN {
           type master;
           file "data/example.com.db.signed";
           update-policy {
                   grant example.com subdomain example.com. any;
           };
   };
};

include "/etc/rndc.key";

This configuration is pretty straight forward and doesn't have to many elements to it but to an unknown user there might be some unknowns.

version "secret";
First off we want to make sure that a potential intruder isn't aware of which version of BIND we're using. If an intruder has knowledge about the flaws in a certain version of BIND we're taking the risk of being exploited.

key-directory "/etc/keys"
BIND needs to be aware of your private keys when doing updates, otherwise the changes you'll make will not be signed and you'll have to do a manual resign of the zone which kills the purpose of dynamic updates.

logging
When dealing with DNSSEC it's important to know what's going on, in the example configuration pretty much all logging is enabled to give us a wide picture of what kind of connections and data-transfers that's passing to and from your server. All of it isn't a necessary but logs are always more useful than one think.

view "internal"
This element isn't really necessary in this simple setup but if you have a DNS server that hosts different zones in different networks (external/internal) this is crucial to not distribute your internal zones. It also to enable the right person to get the right data.

recursion "yes"
Recursion allows clients to resolve domains and or hosts that your server isn't authoritative for. This isn't necessary in this example but can be useful.

allow-recursion { localhost };
This is yet an element which isn't necessary in this setup but it's important to know that you don't want to have recursion enabled for anyone but trusted sources. Your DNS server should only host your domains unless it's internal or intended to allow recursive traffic.

file "data/example.com.db.signed"
Usually you would probably use something like example.com.db but when signing the zone-file the name is changed to .signed there is however a flag in dnssec-signzone letting you decide the output name of the file so it's really up to you if you want to use the .signed suffix or not.

update-policy
To enable us to do dynamic updates we need to have permission to do it. The grant statements tells the BIND server what which key is allowed to change. There's multiple options for this but for now we want this key to be able to change anything.

Now that we've a configured named.conf we want to create a couple of directories for the files to be placed in. In this example we're using the chrooted package from RedHat, notice that you're setup might be different.

First of we want to create directories for the keys and log files

mkdir /var/named/chroot/var/logs
mkdir /var/named/chroot/etc/keys

Followed by that is a couple of symlinks to make our life easier when accessing files.

ln -s /var/named/chroot/etc/named.conf /etc/named.conf
ln -s /var/named/chroot/etc/keys /etc/keys

We also need to make sure that BIND has full permission of the folders, unless it has it wont be able to pick up the keys necessary.

chown -R named:named /var/named/chroot/var/logs
chown -R named:named /var/named/chroot/etc/keys

Now that we've all of the directories available we need to create a zone-file. Go to /var/named/chroot/var/named/data and open up your favorite editor. When you're in the editor you want to post the following conf:

$ORIGIN .
$TTL 3600       ; 1 hour
example.com             IN SOA  ns1.example.com. hostmaster.example.com (
                              2008020201 ; serial
                              7200       ; refresh
                              3600       ; retry
                              604800     ; expire
                              3600       ; minimum
                              )
                      NS      ns1.example.com.
$ORIGIN example.com.
ns1                     A       127.0.0.1

Remember that your settings may vary.

As we're finished with the zone file we need to create a couple of keys, one for DNSSEC and one for SDU. The reason why we've two different keys is because DNSSEC leverage DNSKEY while SDU uses KEY. This also adds an additional set of security by separating signing from updating.

To create the keys go to your key folder /etc/keys and execute the following commands:

dnssec-keygen -a rsasha1 -b 1024 -n zone example.com
dnssec-keygen -k -a rsasha1 -b 1024 -n zone example.com

The first command generates the keys you need to sign your zone, meanwhile the second generates the keys for the updates. When finished you'll have 4 keys named Kexample.com.+005+12345.private and .key.

What we need to do now is to add our DNSKEY and KEY to our zone file, you can either copy and paste the content in the .key files or execute the following command:

cat /etc/keys/Kexample.com.*.key >> /var/named/chroot/var/named/data/example.com.db

You'll now have two entries at the bottom of the zone file looking similar to this:

example.com. IN KEY 256 3 5 AwEAAcldVDO9D1NM7zVCOt2hrXoKJw8Vd2O37N5ykJcK2ODgDlCnXo6R lt/HjzIPZq4A04a0X/9AJVpDk8sZQP4kkbcv4WkXpmKSFJyhIW3B7b+k ouWnyPkym0EEFrSmIaKKQw4asMaH2Ei\
WBpOEWPeFWRtD2lX8YZRVm1tE Si8GH/oT
example.com. IN DNSKEY 256 3 5 AwEAActFWDC3bvmy6U5URVjz+EzmP/vbkUu8c0SUPpce3mv11DptfEo9 +BiY3A0NUPNfLXgIH1h75A6ZUPDBGApU54NsYJNo9bBPlcvWj7MA0VX6 wdPODqUNhuRfVrA8a3nuUC0PzSN1\
wC+sl396P91sWq9lYbYLjujm/nEg tREih0EB

We're now ready to sign our zone.

Go to your data directory /var/named/chroot/var/named/data/. It's now important that you sign with the correct key, compare the content in both .key keys and remember the name of the one containing the DNSKEY statement, this is the key we're going to use to sign our zone.
To sign the zone execute the following command:

dnssec-signzone -t -g -o example.com example.com.db /etc/keys/Kexample.com.+005+12345.private

This should give you an output that's similar to this:

example.com.db.signed
Signatures generated:                       21
Signatures retained:                         0
Signatures dropped:                          0
Signatures successfully verified:            0
Signatures unsuccessfully verified:          0
Runtime in seconds:                      0.114
Signatures per second:                 182.734

If you get the errormessage dnssec-signzone: cannot load dnskey /etc/keys/Kexample.com.+005+26385.private: bad key type
you tried to use an incorrect key.

After running the script you'll have 3 new files in the data-directory:

example.com.db.signed
dsset-example.com
keyset-example.com

The one that's of interest for us is the example.com.db.signed file which should look similar to this:

$ORIGIN .
$TTL 3600       ; 1 hour
example.com             IN SOA  ns1.example.com. hostmaster.example.com. (
                              2008020202 ; serial
                              7200       ; refresh (2 hours)
                              3600       ; retry (1 hour)
                              604800     ; expire (1 week)
                              3600       ; minimum (1 hour)
                              )
                      RRSIG   SOA 5 2 3600 20080304065047 (
                              20080203055047 51525 example.com.
                              TZNrgK8y35vEcDrB4pMVvf0+nV5HRcL+9gQvfxrlPV6F
                              rt9+8WjSQTug63G3YdpEWIPXB1hZvgovpWRrK6MsImex
                              Vvx8US59jJLjjQowG7DiD2XYcfg23ufgHfpNv71X0QuM
                              ZkyntzvGOL7wn+SgbJDglersJkbKJzFv5FJrBks= )
                      NS      ns1.example.com.
                      RRSIG   NS 5 2 3600 20080304054131 (
                              20080203054131 51525 example.com.
                              hTQF3MyTnlvfkvSCtUAvQltzyIo5vvo3K33cDzD+Ahc2
                              z9hBelkGLZu6XO0B3bvWLbzKzCFkUVjjMDtWPMnd3Srx
                              RGqspo1HGqvU0gT6W6OTXeevgKbcHZ0Ctt6gDF03EgEI
                              qmAlWlpRhWMCdgJ7XhM41fvsSE7LdiKsiX3XrE8= )
                      KEY     256 3 5 (
                              AwEAAcldVDO9D1NM7zVCOt2hrXoKJw8Vd2O37N5ykJcK
                              2ODgDlCnXo6Rlt/HjzIPZq4A04a0X/9AJVpDk8sZQP4k
                              kbcv4WkXpmKSFJyhIW3B7b+kouWnyPkym0EEFrSmIaKK
                              Qw4asMaH2EiWBpOEWPeFWRtD2lX8YZRVm1tESi8GH/oT
                              ) ; key id = 17781
                      RRSIG   KEY 5 2 3600 20080304054131 (
                              20080203054131 51525 example.com.
                              YpfIG5nM45Ty3HSpD0sGbeM84WhNCtVP9wayQPt9F6zd
                              6Tdu+NanfoAdiQ0oIDTd5nLToTk81sihcNClvAHPwpff
                              VtkQ2g+vEjJuPEL53vN6WL81Fh//a+6P8O410wxNGajC
                              rrYt5WI2bId8SJ+Sw0kzBgzxRoH+7F1+/O3zL2o= )
                      NSEC    ns1.example.com. NS SOA KEY RRSIG NSEC DNSKEY
                      RRSIG   NSEC 5 2 3600 20080304054131 (
                              20080203054131 51525 example.com.
                              rcQlAb+bS62KuNA4EpFFKpbmy+bFxw3sSZO+unB4CmM1
                              5PycFPbFm4m2+OQLoy20IM85ugszUsReOfCtEe/JEe6Q
                              eEQGm/JmFnQJ2mf5yYn4cN+DId8+FVwG6kvIcjCjmNbC
                              pz7NWYdM1lbeBFASIXF+es9rSg4kjSmJmS2f5Pg= )
                      DNSKEY  256 3 5 (
                              AwEAActFWDC3bvmy6U5URVjz+EzmP/vbkUu8c0SUPpce
                              3mv11DptfEo9+BiY3A0NUPNfLXgIH1h75A6ZUPDBGApU
                              54NsYJNo9bBPlcvWj7MA0VX6wdPODqUNhuRfVrA8a3nu
                              UC0PzSN1wC+sl396P91sWq9lYbYLjujm/nEgtREih0EB
                              ) ; key id = 51525
                      RRSIG   DNSKEY 5 2 3600 20080304054131 (
                              20080203054131 51525 example.com.
                              mkegJTmyMG6uEC9DkG7KUExvHOj3q2iDgaEmw7o9RB1s
                              ETUvwd8uteCH13TvBZ3EXMxdpEFaE4EhccYIArUlqarA
                              z1kzeCyslyIGS4TwsZTR94/cQY8F6Yv8cv8u+ISxSoO+
                              hZCLXOrQ9wyMhx82smT/NycwvLzHxtgikvWLWw4= )
$ORIGIN example.com.
ns1                    A       127.0.0.1
                      RRSIG   A 5 3 3600 20080304054131 (
                              20080203054131 51525 example.com.
                              BzvAbDGuu4rEE6kDjXehVIULkGajBJXF/B6D27k9DWIH
                              9MJ/vi9frE/E4jLz/frY3rHdDgtolGX05SphuEsFdmMo
                              G1a1yQIvfJVHY5L0Xc03qMquhsXVd5yJS5DwyxEZuxqZ
                              DMgeLjp0bm9M1FabOhpIcm4gQqu5JTxHo/5CEtw= )
                      NSEC    testing A RRSIG NSEC
                      RRSIG   NSEC 5 3 3600 20080304065047 (
                              20080203055047 51525 example.com.
                              tNNunF81mxfWJaUYtwtAkirNaV7J9cUKni7pZTL2FAMi
                              kmQDnTKQUP5a4nogDT9zB0gRxr0pL1lpVC3vSV7tJAl7
                              t7/R9DE6wO7I3VA08wTyKc2k9rS0xA06C4SPwWJGHZXl
                              nxxck4gAunaum+FXlqnY9YILnCbapWlCQGTkCa8= )
testing                CNAME   example.com.
                      RRSIG   CNAME 5 3 3600 20080304065047 (
                              20080203055047 51525 example.com.
                              RknsWLMnxfD1ixiNezyHNLRSK/GKf19N9EXvQopa7pji
                              ziyqf3uYWKrJtnGQoe8vdpy8GbTrWw5ZzdxlYVe66cGC
                              q+saQEc9KdTOo6kDCH7WrXnY9Tko6+tPTZqM61XvyLQa
                              BqZKKi6bkktJv6orhbyx4KuyFdVTL/wW4h3HpUs= )
                      NSEC    example.com. CNAME RRSIG NSEC
                      RRSIG   NSEC 5 3 3600 20080304065047 (
                              20080203055047 51525 example.com.
                              GtV/5WFPMph2EVoPNe/fbhOxZG8sANoAw4GayI1esMqV
                              qTshx4yWlJt02TTtNc4AsAjk6NBi7ctQWXgtHitDeAzJ
                              pRhImA9RRY082WkG2GCCVCf4a/ldcf4SQt6E3C6wj+5P
                              iI+Uz4BjAAEHxfT7mB19m1YLo7MVhxlKe6QFW1c= )

Our zone is now signed and we can start bind.

/etc/init.d/named start

If the startup script complains about anything have a look at the permission and the config file.

As we're up and running we're now ready to run a Secure Dynamic update. For this we'll be using nsupdate.

To add a new A record execute the following:

nsupdate -d -v -k /etc/keys/Kexample.com.+005+12345.private
server 127.0.0.1
zone example.com
update add testing.example.com. 3600 A 127.0.0.1
show
send
show

Provided that you've all the permission and configuration right you should see something like this:

Creating key...
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0 ;; flags: ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0 ;; UPDATE SECTION: testing2.example.com. 3600 IN CNAME example.com.  Sending update to 127.0.0.1#53 Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  61419 ;; flags: ; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1 ;; ZONE SECTION: ;example.com.   IN SOA  ;; UPDATE SECTION: testing2.example.com. 3600 IN CNAME example.com.  ;; SIG0 PSEUDOSECTION: .   0 ANY SIG 0 5 0 0 20080203081438 20080203080438 17781 example.com. aa+FdvAx/qpSSHEO2SHFeG+dSWgJ3L81UfLOeyxA2QkxEJV6pHrCL34k eBs2W/Ay7KPL7UMd/OAyVo1tjotbeNFkbO8O/+/sBltNttHOOYg6W4Cf gvOX3z/OwGqVQiu2OluRGsu7tN3LEl4IlgJMChIg1yJ+xl7bSaoa8QQI OmU=   Reply from update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  61419 ;; flags: qr ra ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0  Outgoing update query: ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:      0 ;; flags: ; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0

You've now added an A record dynamically to your zone!

If you've a look in the log-file /var/named/chroot/var/logs/dynamic_log.txt you should see something similar to this:

03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: TCP request
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: using view 'internal'
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: request is not signed
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: recursion available
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: query
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: AXFR request
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: transfer of 'example.com/IN': AXFR question section OK
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: transfer of 'example.com/IN': AXFR authority section OK
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: zone transfer 'example.com/AXFR/IN' approved
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: ns_client_attach: ref = 1
03-Feb-2008 09:13:39.364 client 127.0.0.1#48060: view internal: transfer of 'example.com/IN': AXFR started
03-Feb-2008 09:13:39.364 example.com.           3600    IN      SOA     ns1.example.com. hostmaster.example.com. 2008020206 7200 3600 604800 3600
03-Feb-2008 09:13:39.364 example.com.           3600    IN      RRSIG   SOA 5 2 3600 20080304081335 20080203071335 51525 example.com. ars67v4wWyWVuf/HPPfScgSUvGi7lX+qq0+nzMq\
8+uoeSUBkg4d8OHn6 FZ39YVVie4CQ/aV8J4aanwnrPnbuHeDEODuYr4btXpZRsF4WtsCfesyH ZhzqzKw04GS90/NNlAIedT+r0ZsCkkLR8kon4LecEyo8qPqbO3aUuX2I FgY=
03-Feb-2008 09:13:39.364 example.com.           3600    IN      NS      ns1.example.com.
03-Feb-2008 09:13:39.364 example.com.           3600    IN      RRSIG   NS 5 2 3600 20080304054131 20080203054131 51525 example.com. hTQF3MyTnlvfkvSCtUAvQltzyIo5vvo3K33cDzD+\
Ahc2z9hBelkGLZu6 XO0B3bvWLbzKzCFkUVjjMDtWPMnd3SrxRGqspo1HGqvU0gT6W6OTXeev gKbcHZ0Ctt6gDF03EgEIqmAlWlpRhWMCdgJ7XhM41fvsSE7LdiKsiX3X rE8=
03-Feb-2008 09:13:39.365 example.com.           3600    IN      KEY     256 3 5 AwEAAcldVDO9D1NM7zVCOt2hrXoKJw8Vd2O37N5ykJcK2ODgDlCnXo6R lt/HjzIPZq4A04a0X/9AJVpDk8sZQP4kkbcv\
4WkXpmKSFJyhIW3B7b+k ouWnyPkym0EEFrSmIaKKQw4asMaH2EiWBpOEWPeFWRtD2lX8YZRVm1tE Si8GH/oT
03-Feb-2008 09:13:39.365 example.com.           3600    IN      RRSIG   KEY 5 2 3600 20080304054131 20080203054131 51525 example.com. YpfIG5nM45Ty3HSpD0sGbeM84WhNCtVP9wayQPt\
9F6zd6Tdu+NanfoAd iQ0oIDTd5nLToTk81sihcNClvAHPwpffVtkQ2g+vEjJuPEL53vN6WL81 Fh//a+6P8O410wxNGajCrrYt5WI2bId8SJ+Sw0kzBgzxRoH+7F1+/O3z L2o=
03-Feb-2008 09:13:39.365 example.com.           3600    IN      NSEC    ns1.example.com. NS SOA KEY RRSIG NSEC DNSKEY
03-Feb-2008 09:13:39.365 example.com.           3600    IN      RRSIG   NSEC 5 2 3600 20080304054131 20080203054131 51525 example.com. rcQlAb+bS62KuNA4EpFFKpbmy+bFxw3sSZO+un\
B4CmM15PycFPbFm4m2 +OQLoy20IM85ugszUsReOfCtEe/JEe6QeEQGm/JmFnQJ2mf5yYn4cN+D Id8+FVwG6kvIcjCjmNbCpz7NWYdM1lbeBFASIXF+es9rSg4kjSmJmS2f 5Pg=
03-Feb-2008 09:13:39.365 example.com.           3600    IN      DNSKEY  256 3 5 AwEAActFWDC3bvmy6U5URVjz+EzmP/vbkUu8c0SUPpce3mv11DptfEo9 +BiY3A0NUPNfLXgIH1h75A6ZUPDBGApU54Ns\
YJNo9bBPlcvWj7MA0VX6 wdPODqUNhuRfVrA8a3nuUC0PzSN1wC+sl396P91sWq9lYbYLjujm/nEg tREih0EB
03-Feb-2008 09:13:39.365 example.com.           3600    IN      RRSIG   DNSKEY 5 2 3600 20080304054131 20080203054131 51525 example.com. mkegJTmyMG6uEC9DkG7KUExvHOj3q2iDgaEm\
w7o9RB1sETUvwd8uteCH 13TvBZ3EXMxdpEFaE4EhccYIArUlqarAz1kzeCyslyIGS4TwsZTR94/c QY8F6Yv8cv8u+ISxSoO+hZCLXOrQ9wyMhx82smT/NycwvLzHxtgikvWL Ww4=
03-Feb-2008 09:13:39.365 ns1.example.com.       3600    IN      A       127.0.0.1
03-Feb-2008 09:13:39.365 ns1.example.com.       3600    IN      RRSIG   A 5 3 3600 20080304054131 20080203054131 51525 example.com. BzvAbDGuu4rEE6kDjXehVIULkGajBJXF/B6D27k9D\
WIH9MJ/vi9frE/E 4jLz/frY3rHdDgtolGX05SphuEsFdmMoG1a1yQIvfJVHY5L0Xc03qMqu hsXVd5yJS5DwyxEZuxqZDMgeLjp0bm9M1FabOhpIcm4gQqu5JTxHo/5C Etw=
03-Feb-2008 09:13:39.365 ns1.example.com.       3600    IN      NSEC    testing.example.com. A RRSIG NSEC
03-Feb-2008 09:13:39.365 ns1.example.com.       3600    IN      RRSIG   NSEC 5 3 3600 20080304081335 20080203071335 51525 example.com. q4HaSLSsYfO2SMw/MVnfiZsgxQ1PHCzHIaWmZG\
sZ4MkRwEYYPZN3ID1c kisMR2DUU+/5tzrJnflipOfyXTU0ecHGbIpiI8buuM/zqgHgEAxSFDJG TkA06pkqsXCfllDwh7ClLMaK/SeBdudvB2wXHNtUFfXNmmve+SHGsTE6 G+Q=
03-Feb-2008 09:13:39.365 testing.example.com.   3600    IN      RRSIG   NSEC 5 3 3600 20080304081335 20080203071335 51525 example.com. hVCltJNA9X2/dD77uwLzWrpmVYYvNEAkdTU4qV\
QL2+8ZHxt553DA3eFk DF5qd74L+rs2piDgVZ7L0qYzzPGO8pZAyw9HyGKF0adi40NdhVhPegy3 Tax1ThTcayuNTPE/t7nSwgfWKEDdSQVBjIZ4GFQKYIigAIGyKnmWKe2v 0JM=
03-Feb-2008 09:13:39.365 testing.example.com.   3600    IN      NSEC    example.com. A RRSIG NSEC
03-Feb-2008 09:13:39.365 testing.example.com.   3600    IN      RRSIG   A 5 3 3600 20080304081335 20080203071335 51525 example.com. FZi8W+FsfUjSur8HfMVjrn6hJEOL0ewZoKuwBJ9QA\
lsqLwYs0TRA3HGU nSN6pXypaw0d0udBo+0IQq/lW4C3FScDpNwCZqWlSmjMEpR/C7d7uPNh jUARGcq9pXdSaJ439QtSARLXNL/8tVZjCUglwYAX8/4bbPvjNOIPrOi1 NHs=
03-Feb-2008 09:13:39.365 testing.example.com.   3600    IN      A       127.0.0.1
03-Feb-2008 09:13:39.365 example.com.           3600    IN      SOA     ns1.example.com. hostmaster.example.com. 2008020206 7200 3600 604800 3600
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: view internal: transfer of 'example.com/IN': sending TCP message of 2109 bytes
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: view internal: transfer of 'example.com/IN': AXFR ended
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: view internal: next
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: view internal: ns_client_detach: ref = 0
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: view internal: endrequest
03-Feb-2008 09:13:39.365 client 127.0.0.1#48060: read

To completely verify that you're record has been added do a zone-transfer and grep for your entry:

host -t axfr example.com localhost | grep testing

testing.example.com. 3600 IN RRSIG NSEC 5 3 3600 20080304081335 20080203071335 51525 example.com. hVCltJNA9X2/dD77uwLzWrpmVYYvNEAkdTU4qVQL2+8ZHxt553DA3eFk DF5qd74L+rs2piDgVZ7L0qYzzPGO8pZAyw9HyGKF0adi40NdhVhPegy3 Tax1ThTcayuNTPE/t7nSwgfWKEDdSQVBjIZ4GFQKYIigAIGyKnmWKe2v 0JM=
testing.example.com. 3600 IN NSEC example.com. A RRSIG NSEC
testing.example.com. 3600 IN RRSIG A 5 3 3600 20080304081335 20080203071335 51525 example.com. FZi8W+FsfUjSur8HfMVjrn6hJEOL0ewZoKuwBJ9QAlsqLwYs0TRA3HGU nSN6pXypaw0d0udBo+0IQq/lW4C3FScDpNwCZqWlSmjMEpR/C7d7uPNh jUARGcq9pXdSaJ439QtSARLXNL/8tVZjCUglwYAX8/4bbPvjNOIPrOi1 NHs=
testing.example.com. 3600 IN A 127.0.0.1

You now have a functioning DNSSEC and SDU setup.

Back home in the US

2007-11-28T18:57:00.000-08:00

Yes. After 2 weeks of traveling in Europe I'm back home. Back in the US. Every time I get back here I feel more and more at home. I've finalized my extension of my contract through 08. Hopefully I'll stay here even longer.

Yes, I'm alive

2007-10-29T18:12:00.000-07:00

So I've been kinda away from here, not that I know why but I haven't really had anything to talk about. So as usual I've been working my ass off. It's getting tiring but as usual I still enjoy it.
This weekend I went up to Boise with Jason to do some networking. Most things went well things are working and there isn't really any complaints...

HDTV for Linux

2007-09-19T22:00:00.000-07:00

Yes!

I finally found it! A HDTV card that works with Linux, ONLY! :D
So since I haven't gotten any firm commitment on how long I'm going to stay in the US I'll just wait until I know. Hopefully I'll end up staying the whole 2008, and it that case I've decided to get some stuff, just to pass time.

pcHDTV HD-5500 Epson PowerLite Home Cinema 1080

Yes it's going to be pricy but hey. Who doesn't want to watch HDTV on a 100" screen or rock some Wii games for that part?

Making some music

2007-09-18T21:17:00.000-07:00

So I don't know why but I ended up trying to write some music. Surely I haven't been able to finish any and I'm just doing it to pass time.
Personally I don't like to hear myself singing and I don't expect someone else to, so I've warned you!

Anyways, I've uploaded the stuff I've made so far to my server at home. You can access it at:
music.garnser.se

Dynamic updates of DHCP

2007-09-17T16:24:00.000-07:00

So as I came to the office today I thought, wouldn't it be great if there was a tool that re-wrote the dhcpd config file based on a perl script?

Obviously I thought of doing this myself (as the programmer I am). But to make life a bit easier for myself I made a lookup at Google for dynamically updating ISC DHCP.
And woho! There's a pre-built API called OMAPI and someone built a tool on top of this called OMCMD.

After a couple of hours trying to get the stupid key to work (TSIG hmac-md5) I finally got it working.

For those of you who're used to update the DNS dynamically the syntax is about the same:

omcmd [-K keyfile | -k keyname key] [-s server] [command]


Adding to DHCP
omcmd -K keyfile -s 10.1.32.10 create host name=test ip-address=1.2.3.4 hardware-address=ff:ff:ff:ff:ff:ff hardware-type=1;

What OMAPI does is to write the new config to
/var/lib/dhcpd/dhcpd.leases, it looks a bit funky to me

hostname {
 dynamic;
 ip-address 1.2.3.4
 hardware-address ff:ff:ff:ff:ff:ff;
};


But it works.

The script that I'm using looks like this:
HOSTNAME=hostname.domain.com
IP=1.2.3.4
MAC=FF:FF:FF:FF:FF:FF

omcmd -k keyname md5hash create host ip-address=$IP name=$HOSTNAME hardware-type=1 hardware-address=$MAC


An issue that comes with using omcmd (I don't know if this is part of the IMAPI API) is that you cannot add DHCP entries pointing at hostnames rather than an IP-address.

Taking a different route

2007-09-17T16:22:00.000-07:00

So I've decided to take a different route on my blog.

The reason for this is pretty simple. My new mobile doesn't support uploading to the blog and I'm simply to lazy to take the time to do it manually.

So I've decided to post more linux/network related stuff here. I'll still post some stuff that's about me as a person every now and then though.

Continues issues getting into the american society

2007-09-16T20:11:00.000-07:00

So I've been an employee in the US for 2.5 month now and things are going pretty well at work. I'm enjoying my life overall (it's always nice to start off from the beginning) but obviously there's obstacles which one has to overcome.

One of these is the Social Security number.
So at first when I went to apply for it I ended up in a 4 hour long q, and no I'm not that patience so I dropped of after 1 hour saying to myself that I had better things to do, well working that is.
So I went back to Sweden for a month, at this point I cannot get my payment cause I can't use my US bank accounts without a SSN, woopie!
So I got back here, applied for one only took 30 minutes this time since I was there before they opened. Lucky me I guess, now that's in progress. At least I hope so cause a couple of days ago I realized that I had different names written on my I-94 and my application and I've honestly no idea of if I'm going to get a SSN or if I've to re-apply. ARGH!

So secondly is my driver license which wasn't to painful to get. Well, get in the sense of passing all the tests. So after I made the tests they told me that I should have my driver license in 4-6 weeks which sounded fine, sure it's a lot slower than in Sweden but I couldn't care less since I was going back for a month anyway.
So now when I got back I still hadn't received my driver license so I ended up calling DMV. And guess what they tell me? "You didn't apply your SSN when first applying for a driver license". Well that's just awesome. Couldn't they've been a bit more predictive and tell me that when I first applied? So this will effectively mean that I wont be able to get my driver license until I get my SSN plus 4-6 weeks. And that is if I get my SSN due to my miss-writing in the application. Not that I've a car or anything but this really bugs me out to the extreme. What's the reason of having all of the procedures when you aren't told anywhere all of the things you need?

But yet again, I still enjoy living here. Likewise work it sucks plenty some days but there's something keeping me. We'll see how it goes.

Pre-review of Transcend solid state disk

2007-09-07T20:23:00.000-07:00

So far I haven't succeeded in getting Ubuntu installed on my solid state disk which has been somewhat of an disappointment, apparently Ubuntu isn't to friendly about installing the OS on a USB disk (which the disk appears as), there's some fixes but I'll wait with it until I receive my new laptop.
For now write and read performance hasn't been tremendous but it's at least faster than my 80GB 4.2k rpm disk. Hopefully it's better than the 100GB 7.2k rpm disk which follows in my new laptop. Since I'll only have my OS on this disk it should be fine either way.

Pimping table

2007-09-07T20:22:00.001-07:00

So I went to IKEA yet again and found some cool LEDlamps so I decided to pimp up my table

Preparations for the crayfish party

2007-09-06T20:50:00.001-07:00

Yes I look ridiculos but so will everyone else at the party ;)

Buying stuff

2007-09-05T21:51:00.000-07:00

So I started shopping again, to much but whatever, I'm a geek, what to expect. So here's the list:

First off, a solid state disk Transcend 16GB Express Card

Second, speakers Creative GigaWorks T20 (I've 2 pairs of these back in Sweden)

Third the 3rd gen iPod "fatty" Nano

And yes I'll give you a small review on all of them as soon as I've tried them out.

Bottle finally opened!

2007-09-04T21:33:00.001-07:00

So since I forgot to buy a tons of shit at IKEA a capopener for example I 've been kinda owned by myself a couple of times like when cooking dinner or having some beer but as you can see I managed to get one bottle open by using my keys.

My sweet guitar

2007-09-03T10:26:00.000-07:00

So you may wonder what I'm doing on my spare time except for working? As I posted before I bought this beauty, a Paul Reed Smith SE Custom, must say that I'm really pleased with it, and so far my neighbours haven't complained, guess I should start rock out a bit more ;)

Some beer at Marks place

2007-09-03T10:24:00.001-07:00

So Jason dragged me along to Marks place were we ended up drinking some beer, playing random old-school games and so on. Obviously I had a bit to much to drink so I cannot say that I remember to much..

Wanna go home

2007-08-26T15:19:00.000-07:00

So I've gotten pretty fed up, I'm getting really tired of Sweden and just wants to get back home to CA. Since I came back here I can just tell how many relations that has been lost, basically it feels like there's nothing left for me here unless I go back to my old self which I just doesn't want to.

I'm going back home on Thursday I doesn't know when I'll be back, hopefully it will take a while.

Cya Sweden, this trip was a big disappointment, all categories...

Network hacking in Uppsala

2007-08-12T13:10:00.001-07:00

Yes, whereever I go it's continuously networkhacking...

Ant invation!

2007-08-09T14:46:00.001-07:00

Ok, this is just simply disgusting, sure there's a lot of pros and cons living on the country-side but this takes the price for cons.

Right, I'm back in Sweden

2007-08-03T16:26:00.000-07:00

So I've completely forgot to post about this, I'm back in Sweden for a month or so. Someone had to cover for everyone here while they went on vacation and who would be better than the guy who just moved from Sweden? Guess I wont get any vacation this year either...

Webbalert

2007-08-03T16:20:00.000-07:00

So i recently read at Engadget about this new work-day daily show called Webbalert. I haven't decided if I like it or not yet but it's clearly interesting to see a woman leading shows like this, more of this please!

Mobile back

2007-08-03T16:01:00.001-07:00

So I was lucky, it only took one week to get it repaired but obviously they wiped the whole phone and since I'm somewhat anti backups I'll just have to blaim myself. The phone on the picture is the backup I used, my worthless Treo 650.

Mobile dead..

2007-08-02T07:32:00.000-07:00

So the reason for why I haven't blogged anything lately is because my mobile crashed when I landed in Sweden. The reparation takes 2 weeks...minimum :(

Since I came back from US I've been working all the time...not much interesting happening =/

IT hacking

2007-07-24T19:29:00.001-07:00

Phear!!

Guitar

2007-07-22T16:08:00.001-07:00

So I was bored and decide to take a ride to the Guitar Central to check out some guitars, I ended up coming out with this beauty.

Samba + ACL

2007-07-17T20:04:00.000-07:00

So I've been hacking Samba and Linux ACL with a colleague today. Must say that it's way better than UNIX standard permission structure but it still seams to have some old issues which haven't been resolved completely, automatically recursive when creation of new files for example.

Foot in the wood

2007-07-11T23:30:00.001-07:00

Originally uploaded by garnser

I took this photo by accident last year when I went to Boise, Idaho, USA, I like it somehow, nice with the colors in the ground.

Awsome piercing

2007-07-11T23:24:00.001-07:00

L o u . P a s c a l

As some of my friends know I've a small "fetish" or whatever you would call it for piercings and tattoos, the only thing I've is stretched earlobes but that's about it, we'll see if I'll get some more later on (used to have more though).

Anyhow I really do like this photo and the piercings. What do you think?

Bicycling after work

2007-07-11T22:32:00.000-07:00

So Jason and Mark took me bicycling after work today, we ended up going 8 miles which by 3 were uphill. I must say that this was really fun to do even if I would've liked to go longer but still, not everyone has been living on his bike for the last several years. Unfortunately I didn't get any pictures since I forgot the mobile in the car :( wasn't to much to see though except for uphill roads and such.

Yay, internet finally!

2007-07-10T18:45:00.001-07:00

So this morning Comcast dropped by to install internet for me, must say that it was very complicated, connecting modem to outlet and modem to laptop. I could probably not have done it myself...

Best AMV ever

2007-07-10T04:20:00.000-07:00

So I was browsing around at YouTube for Anime music videos and stumbled upon this one which is probably the best one I've ever seen.

So since I suck at youtube stuff I posted the wrong video, the right one is up now, enjoy!

Parking-lot issues...

2007-07-08T22:48:00.000-07:00

So I'm having some issues with the parking in my new apartment, I've been assigned parking-lot EE2 but obviously some bastard has taken it. Since I was leaving for LA I sent this email to my landlord:

Hi again.

I've located my parking slot to find that someone else is using it.

The car parked in my slot (EE2) has the following registration-number: XXXXXXX
I've now parked in slot (EE1) and my registration-number is: XXXXXXX

I'm leaving for Los Angeles tomorrow (Wednesday) at 6pm and wont be back until Sunday.

Hopefully my parking slot will be freed up by tomorrow but if not I'll be unable to move it until Sunday.

Please call me if you've any questions my mobile number is: 408-931-XXXX

So today I got back from LA and what do I see? I've gotten 3 parking violation notifications, and the bastard who has taken my parking-lot hasn't received any!! To bad that I'm to lazy to go to the landlord, their office is closed now anyhow. Guess I'll send em an email.

Middle of nowhere

2007-07-08T15:11:00.001-07:00

So Oliver and I went back up to Cupertino today, a nice trip of 650 km, the road has it moments but it's mostly desert or farms all over.

Party at Olivers place

2007-07-06T22:21:00.001-07:00

Ok, it wasn't really a party, just a good excuse to get drunk since the legal age of drinking is 21 over here. I had some fun and met some more people even though I drank a bit to much :(.

Hollywood

2007-07-05T15:44:00.001-07:00

Ah! Finally, now I've seen the Hollywood sign. Sadly enough you cannot get any closer to it without having polices chasing you all over. Anyhow the trip up to the in-official lookup point was really nice, the closest I can come to think of would be Italy, small roads with well designed houses all over in the hills.

Downtown L.A.

2007-07-05T13:45:00.001-07:00

So things are going well at the office, I've actually been able to have 4 days of _real_ vacation this year. Since I'm in the US now I decided to go south to LA to meet up with Oliver and have some fun for a couple of days.

Things moving on

2007-07-03T11:11:00.000-07:00

So lately there has been a bunch of stuff going on. I've gotten my apartment, driver license, bank account, applied for a social security number and so on. Since I've transfered my mobile to AT&T I'm having some issues blogging with my mobile since I only get GPRS since AT&T decided to have 3G on another frequency than than in Europe.

Dinner with the Flipper team

2007-06-27T19:30:00.001-07:00

Finally arrived to Cupertino

2007-06-22T22:21:00.000-07:00

So I've finally arrived to Cupertino, here's the insane trip I had to do.

Arlanda -> Frankfurt -> Los Angeles -> San Jose

07:00 CEST: Wake up
07:30 CEST: Cab to the airport
08:00 CEST: At the airport
08:20 CEST: Checking, tickets and TSA cleared, going to gate
10:00 CEST: Announcement: The flight to Frankfurt has been delayed due to a thunderstorm, estimated boarding time is 11:00am CEST
10:15 CEST: Good news, we can board ahead of time
11:00 CEST: Boarding completed
11:20 CEST: Take off
13:40 CEST: At the Frankfurt airport, my next flight is leaving 13:55, Gotta hurry
13:40 CEST - 13:55am CEST: Runs like crazy to the other terminal
13:55 CEST: Announcement: The flight to Los Angeles is delayed due to the thunderstorm......
14:20 CEST: Boarding
15:00 CEST: Boarding completed and take off

17:00 PST: Arrives to Los Angeles, 30 minute delayed, fairly good in my opinion
17:30 PST: US immigration cleared
17:30 - 18:15 PST: Waiting for luggage, waiting a bit more....
18:15 PST: Announcement: Ehm... half of the luggage is gone, including mine (YAY awesome!!!)

My next flight is leaving at 18:55 PST and I don't have my boarding pass

18:40 PST: Goes to the self-checkin, my reservation code doesn't work, goes ahead to United services
19:00 PST: Awesome I've missed my flight, well lets hope that they can put me on another one
19:10 PST: Gets to the counter. "Your flight has been delayed until 19:35 PST" (Thank god!)
19:30 PST: TSA cleared, running without shoes to the gate (no time to put them on after the TSA)
19:34 PST: At the gate, boards quickly
19:50 PST: Takeoff!

Now I just have to wait to get my luggage, luckily enough I brought one change in my carry-on luggage, I'm just hoping that I'll get it by tomorrow, they have no idea where it is :(

Hope you'll enjoy the story ;)

Walking to the office

2007-06-22T07:20:00.001-07:00

No I don't work at Apple I just happens to go by them on my way to the MySQL office.

Arrival at the hotel

2007-06-21T22:53:00.001-07:00

I've finally(!) arrived to the hotel, I'll Blog about my insane trip tomorrow

Leaving Sweden

2007-06-21T00:21:00.001-07:00

I'll be of for a trip to the US for 3 weeks to find an apartment, get a driver license and stuff like that.

Hats at the office

2007-06-12T08:33:00.001-07:00

This is what we do at the MySQL office.

Stepping on a nail

2007-06-11T13:26:00.001-07:00

So I was demounting a pallet and was going to the door to close it, OUCH! A nail was pointing upswards and of course I stepped on it. People has been nagging me about getting a tetanus-shot but we'll see if I'll get it or not.

Playing Zelda all weekend

2007-06-10T14:55:00.001-07:00

I don't know if I posted that I bought a Wii but anyhow. I bought "The Legend of Zelda: Twilight Princess" this Friday and have been playing for 21 hours this weekend, I'm now at 37% completion of the game, although that's just an estimate by looking at a walkthrough...yes I'm cheating some but not until I've been trying to solve it myself for 1 hour.

Anyhow, if you have a Wii and haven't got Zelda to it, get it!

Walking home

2007-06-06T15:22:00.001-07:00

Since there's om bus going directly to my parents house I've to walk 2 kilometers the last part, at least during night time...

Swedens' national day

2007-06-06T13:34:00.001-07:00

Today we're celebrating Swedens' national day. To add some extra spice to it we won against Iceland 3-0. GO SWEDEN!

Start of the day

2007-06-05T02:54:00.001-07:00

Since I missed the bus by 5 minutes I decided to spend most time of the morning on the porch of my house. Nothing really beats this a warm summer-morning.

The dog

2007-06-04T10:40:00.001-07:00

So family decided to get a flatcoted, here it is after a bunch of failed photos.

The visa has arrived!

2007-06-04T02:35:00.001-07:00

I've finally received my visa, now I'm just waiting for an approval for my flight.
As it seams now I'm leaving the 21st for 3 weeks.

The visa interview

2007-05-30T03:42:00.000-07:00

So I just wanted to share my crazy morning to get to the interview.

06:20 am: The alarm goes off and my cousin comes into the room to make sure that I'm waking up. (I stayed at her place).
06:30 am: I've washed myself and is getting dressed with my new suit which cost me a fortune.
06:40 am: Heading of to the subway station with my cousin, ahead of schedule.

06:55 am: PANIC! I've forgotten my passport at my cousins place. I get of the train, runs to the other platform that goes back.
07:00 am: The train finally arrives after 5 painful minutes.
07:05 am: The train is now back at the first station.
~~~~~~: I'm running like a maniac to my cousins place to pick up my passport, the more I run the more sweaty I get, awesome to smell horrible for my interview....
07:15 am: I'm back on the train towards Stockholm downtime and realize that I'll never make it to 8am.

07:25 am: Suddenly I see my cousin at the subway station which the train is coming into, apparently she has been jumping on every train since I left to check for me. We're going one more station and all of a sudden she drags me out of the train and starts running. Since I know that I'm screwed in regards of timeframes I just follows her. When we get up on groundlevel she grabs the first cab she sees and tell him to drive fast as hell. (Notice that it takes about 40 minutes to go by car from this station to the embassy and the time is now 07:30am.

~~~~~~: Time passes....

07:55 am: The cab arrives to the embassy. JUST IN TIME!! My cousins throws me out of the cab to make sure that I'll get there.

So now I'm here, and what do I see.... a LOOONG queue, outside, in the cold.

So I'm standing in the queue for 45 minutes, I'm still not inside the embassy since everyone has to pass the security control. And I'm getting more and more worried that I'm screwed.

08:45 am: I'm now in the embassy, leave my papers and passport to a cashier and sits down to wait.
09:15 am: A man in the speaker says: Jonathan Petersson, please come to window D.

A small note here, everything that's within ( ) is thoughts I'm having during the so called interview.

I'm now standing in front of the immigration guy who sits inside a stall, we're divided by a glass window.

- Good morning, he says.
- Good morning, how are you?

- I'm fine thanks, and you?
- I'm fine to.

- So you're going to work for SQL in the United States?
- Yes (It's called MySQL...)

- What does SQL stands for?
- Standard Query Language (Gha! Wrong it's Structured Query Language)

- Uhm ok.
So how long are you planning on staying in the United States?
- Well, we haven't decided yet.
I guess I'll stay as long as the company needs me to.
If they want me to stay for one year I'll do that.
If they want me to stay for two year I'll do that. (Why do I continue!?)
If they want me to stay for three year I'll do that. (Gha man get out of it!!)

- Uhm, ok.
Your visa is hereby approved, you'll have it sent to you on Tuesday.
Have a nice day.

- Uhu? Well thanks....

So I'm spending all this morning hurrying like crazy, spends $30 on a cab, have bought a new suit for way to much money, and shoes for $150 which he doesn't even sees just to spend less than 5 minutes doing non-constructive talking. What an awesome way to start the day on.

More updates on the visa

2007-05-28T13:01:00.001-07:00

I've finally received all the papers needed for the visa, a nice chunk of 180 papers or so. On Wednesday I'm having the interview and then I'm probably one week of from leaving Sweden, must say that my feelings are mixed but as we all know, the show must go on.

A piece of salad

2007-05-28T10:29:00.001-07:00

Well this is the last week in my apartment and this will probably be the last dish that I'll do.

This is not a good sprut

2007-05-26T17:21:00.001-07:00

Quote: kryckan

Ehm, what?!

2007-05-22T13:30:00.001-07:00

Well this was the last thing I expected to see while walking home...