Dirk-Jan’s blog

Last week I setup a server in a cloud based on Xen virtualization technology. After some hours research I decided to go for the Rackspace cloud. I chose the minimal setup to start with, which is a 256MB memory configuration that comes with 10GB disk space. As stated in the specs, the 256MB plan will get you 1/64 of the CPU allocation. Which is fine to start with for a standard LAMP setup.

For now they only offer a large variety of Linux distributions. I chose Debian 5.0 Lenny, because it makes migration easier as the site is running on Debian 5.0 already. The registration process and setup of the minimal Debian install went very smoothly. In under two hours I had successfully migrated a website. So for the setup part I am totally satisfied, let’s see how the availability part will develop.

This howto describes how to configure vsftpd to enable SSL using so called intermediate/ chaining certificates.

Edit vsftpd.conf so that SSL is enabled:

It is very important to construct the certificate file /usr/share/ssl/certs/vsftpd.pem with the correct certificate order. The fist Your certificate file has to be a .pem file. If you also received an Intermediate Certificate then you have to concatenate this with the Domain Certificate and your Private Key file into one single .pem file. Make sure all the information is included, without any spaces or blanks, see below.

This is how to check a SSL enabled FTP service (FTP Secure). See the result below:

Today I recieved a strange message when I tried to open a RDP connection.

To resolve this issue you need to add the client hostname.

This happens with rdeskop version 1.6.0 on Fedora 11 (rdesktop-1.6.0-4.fc11.x86_64).

When using WordPress version 2.5.1 (Debian Lenny package) it is not possible to add/upload media using the “Add media” button in the editor. If you click on Add an image, a new window appears where you should have the option buttons “Browse” and “Upload”, but they’re gone. What’s left is a “Choose files to upload” button that won’t do anything.

I have experienced this problem when using Mozilla Firefox 3.0.14 on Linux with the Shockwave Flash add-on enabled.

Workaround: When this add-on is disabled the add media problem will not occur. To disable the add-on, open Firefox and go to ‘Tools’ -> ‘Add-ons’ and select disable Shockwave Flash.

Last week I’ve spend some time doing an Asterisk PBX setup at home. Because I like the technique and my girlfriend likes to use the phone I decided to build my own PBX (Private Branch Exchange). In other words a telephone exchange. So doing some research I figured out what the requirements where and came up with the following components:
- a SIP provider
- a SIP compliant phone
- Asterisk PBX software
- an Internet connected Linux server running 24/7

As for the SIP provider I chose the Budgetphone company because they support Asterisk and you get a local area number on which you can be called.

On my search for a suitable phone selected the Siemens Gigaset A580 IP. The main reasons I chose this phone where:
- it’s a hybrid phone so you can use POTS and or VOIP
- it’s energy efficient by using multiple energy-saving technologies
- it’s in a affordable price range

The installation of Asterisk was a piece of cake. Being a very happy user of Debian Linux, I installed the pre-compiled package from the Debian repository by executing the following command:

In my case the Asterisk server has a public ip-address, and the phone base station is located in private ip space behind a NAT router.

Below you’ll find the Asterisk configuration. This configuration is known to work on Asterisk version 1.4.21.2~dfsg-3. In my case all configuration files reside in ‘/etc/asterisk/’.

sip.conf:

extensions.conf:

voicemail.conf

When done editing those files, you need to connect to the Asterisk CLI (Command Line Interface) by using the following command:

Set the verbosity level to 10:

To reload the new configuration issue:

To see if the SIP services have registered succesfully issue:

I needed to configure the next fields in the base station configuration to get the phone registered with Asterisk. Go to ’settings’ -> ‘telephony’ -> ‘connections’ -> ‘edit’ -> ’show advanced settings’.
- Authentication Name: phone
- Authentication password: *******
- Username: phone

- Domain: local
- Proxy server address: Asterisk server ip
- Registrar server: Asterisk server ip

To make the MWI (Message Wait Indicator) work on the handset you need to follow the next steps:
Web browse to the Siemens phone web interface, go to ’settings’ -> ‘telephony’ -> ‘Network Mailbox’. For the connection you want MWI with, enter the voicemail access number into the ‘Call Number’ box, in my case 1001 and tick the ‘Active’ box. This will make the Siemens phone subscribe to the mailbox status.

Have fun!

Recently I have a personal certificate also known as a Digital ID on a smart card (Aladdin eToken) to access a secure web service. While installing the certificate I noticed it is also possible to use it to digitally sign and encrypt email with the same certificate, so I fired up Thunderbird and added the PCKS#11 security device to configure signing using S/MIME. See the steps below.

“PKCS#11 is one of the family of standards called Public-Key Cryptography Standards (PKCS), published by RSA Laboratories. It defines a platform-independent API to cryptographic tokens, such as Hardware Security Modules (HSM) and smart cards.” (Source: http://en.wikipedia.org/wiki/PKCS11)

I assume you already have installed the eToken software. In case you haven’t, take a look at this article I wrote earlier.

Open Thunderbird and go to Preferences -> Advanced -> Encryption -> Security Devices

Click on “Load” and enter a Module name or choose the default like I did, which is “New PKCS#11 Module” and browse for the ‘libeTPkcs11.so’ library. This file probably sits in ‘/usr/lib’ or ‘/usr/lib64′. Be sure to pick the right one, because you need the 64bit version if you’re using 64bit Firefox.

Open Account Settings -> Security

Select the certificate on your smart card you like to use.

Thunderbird and Firefox are not bundled with the needed CA’s to support GlobalSign PersonalSign Class 2 out-of-the-box. You have to Import the GlobalSign Primary Class 2 CA (http://secure.globalsign.net/cacert/PrimClass2.crt) and GlobalSign PersonalSign Class 2 CA (http://secure.globalsign.net/cacert/PersonalSignClass2.crt) to make it work in Thunderbird, otherwise you’ll notice you’re not able to send digitally signed email.

To make the eToken PKI 5.0 client work on my 64bit Fedora 11 workstation with the 32bit version of the Aladdin eToken middle ware I had to install the following packages: hal-libs.i586, libusb.i586, openct.i586, pcsc-lite-openct.i586, pcsc-lite-libs.i586, pcsc-lite.i586 and dependencies.

If you don’t install the 32bit version of the packages, the installation of the pkiclient software will result in a error. The pkiclient software does need one of the following bundle dirs ‘/usr/lib/readers’ or ‘/usr/lib/pcsc/drivers’, or else it will exit with the error message below.

Do not try to add the eToken as a security device in Firefox or Thunderbird as you’re probably running the 64bit version of the applications. The 64bit applications refuse to load the 32bit ‘libeTPkcs11.so’, you’ll be prompted with a message “Unable to add module”.
I have requested the 64bit version of the middle ware, which should make things easier.

Recently I had to use a laptop for a course I was doing. This Fujisu Siemens Amilo Li 2727 laptop came with Windows Vista pre-installed. Since the installed OS didn’t matter for the course I installed the latest Ubuntu which is 9.04 (Jaunty). All worked well except for the wireless card (Atheros Communications Inc. AR242x 802.11abg Wireless PCI Express Adapter (rev 04)). The ath5k driver for the wireless card is being correctly initialised, as you can see:

It appears that the wireless card is enabled but not activated, so you’ll need to turn it on. Using Windows you use the Fn-F1 key combination to activate the wireless card, but this doesn’t work with Linux. The easiest way to get wireless going is by activating a kernel module called acer_wmi. As soon as you execute the following line you’ll notice the wireless led will light up. There are other ways, but this is by far the most easy and elegant way to do it.

The wireless card is now active! Wait a moment and you’ll see wireless networks appear in the NetworkManager if you’re in range. Just for the record I am using Ubuntu kernel 2.6.28-11-generic at the moment of writing.

To make this solution last on a reboot, you’ll have to add the module name ‘acer_wmi’ to ‘/etc/modules’.