Our CA has a recently unveiled service which will scan our public IPS and report on detected certificates close to expiry which is handy, but we have a lot of servers on non-routable and / or firewalled addresses, so an internal scan is the only way to cover them all.

There seem to be at least a couple of other published approaches in the google including ssl certificate expiration check and the neat ssl-cert-check script at prefetch.net which will take a list of servers and express the expiry date. I wanted something slightly different (more minimalist): as we’re using the excellent zabbix for general system monitoring which especially likes system commands or scripts which take a single parameter and spit out a single return value.

In this case that parameter is a server name or IP address,  returning  either the number of days until SSL cert expiry, or the certificate issuer, depending on which version of the script is called. As I said, we’re using this with zabbix but this is just a command line script usable for quick on the spot checks or could easily be incorporated into another monitoring / alerting system.

A nice simple method I would probably use if I didn’t have zabbix would be to incorporate this into a quick and dirty loop script which periodically queries a list of ips or subnets and fires off an email if the ‘days to expiry’  is below a certain value (exactly what zabbix does now). It could be made a bit more elegant perhaps by using a bit of nmap to build a fast list of responding servers to query, but depends what you want, how much time you have, and how much of a stickler you are for efficiency =)

(Command line for all scripts is simply: ./script-name server.name.or.ip.address )

Script: sslcheck-expiry

#!/bin/bash
# Simple SSL cert days-till-expiry check script
# by Glen Scott, www.glenscott.net

openssl_output=$(echo "
GET / HTTP/1.0
EOT" \
 | openssl s_client -connect $1:443 2>&1);

if [[ "$openssl_output" = *"-----BEGIN CERTIFICATE-----"* ]]; then

        cert_expiry_date=$(echo "$openssl_output" \
         | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' \
         | openssl x509 -enddate \
         | awk -F= ' /notAfter/ { printf("%s\n",$NF); } ');

        seconds_until_expiry=$(echo "$(date --date="$cert_expiry_date" +%s) - $(date +%s)" |bc);
        days_until_expiry=$(echo "$seconds_until_expiry/(60*60*24)" |bc);

        if [[ $days_until_expiry -ge 0 ]]; then

                echo "$days_until_expiry";
                exit 0

        else

                echo "EXPIRED ($days_until_expiry days)";

                exit 0
        fi

else
    echo "NOT_FOUND";
exit 1

Checking the issuer as well as the expiry

Because we have a bunch of servers setup for dev, test or other purposes with self signed “snake oil” certs and I dont really care about the certs on those, I wanted a method to determine the issuer. (Zabbix then has some logic which only bothers to email us if a cert is about to expire AND is from a real CA.)

Script: sslcheck-issuer-o

Returns the “O” (Organisation) value from the issuer string.

#!/bin/bash
# Simple SSL cert get-issuer-O
# by Glen Scott, www.glenscott.net

openssl_output=$(echo "
GET / HTTP/1.0
EOT" \
 | openssl s_client -connect $1:443 2>&1);

if [[ "$openssl_output" = *"-----BEGIN CERTIFICATE-----"* ]]; then

        cert_issuer=$(echo "$openssl_output" \
         | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' \
         | openssl x509 -noout -issuer -nameopt sname \
         | tr '/' '\n' | grep O= | cut -c3- );

                echo "$cert_issuer";
                exit 0
else
    echo "NOT_FOUND";
exit 1
fi

Script: sslcheck-issuer-cn

If for some reason you want the CN value from the issuer string, use this instead.

 
#!/bin/bash
# Simple SSL cert get-issuer-CN
# by Glen Scott, www.glenscott.net

openssl_output=$(echo "
GET / HTTP/1.0
EOT" \
 | openssl s_client -connect $1:443 2>&1);

if [[ "$openssl_output" = *"-----BEGIN CERTIFICATE-----"* ]]; then

        cert_issuer=$(echo "$openssl_output" \
         | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' \
         | openssl x509 -noout -issuer -nameopt sname \
         | tr '/' '\n' | grep CN= | cut -c4- );

                echo "$cert_issuer";
                exit 0

else
    echo "NOT_FOUND";
exit 1
fi

Additional notes:

All scripts use the openssl s_client function to connect to the first string (assuming IP or server name) on default port 443. It echoes some HTTP GET requests and an EOT, otherwise openssl will sit there until timeout waiting for something to happen. If the remote connection sends a certificate down the pipe (identified by the presence of “”—–BEGIN CERTIFICATE—–”) it will process it, otherwise it returns the value ‘NOT FOUND’, which is a catch all for no certificate, a malformed certificate, a network timeout and so on.

A quick glance at these will reveal a lot of duplication: indeed the last two only differ by one line. This is on purpose; I actually started out building a do-everything script with a switch to determine behavior (like this script I subsequently found). This would be a lot more efficient in terms of network requests, you could retrieve the cert once and analyse it in multiple ways. Unfortunately it turns out zabbix really only likes dealing with the one parameter – a minor issue for which I will forgive it – so I’ve broken this out into three smaller scripts.

OpenSSL will only return the date in a format like “Sat Jan 1 17:15:00 WAST 2010″. I was starting to figure out how to chop it up into a usable format like DDMMYYYY using sed, awk, cut and the rest but discovered  to my surprise that the unix date utility understands the string just fine as is. The date is converted to seconds since epoch and the ‘bc’ utility does some math on it, returning a rounded value in days.

Instead of awk in the last two I’ve used a handy-dandy utility called, simply, ‘text replace’ (tr). I actually don’t use awk, sed and regular expressions much and am correspondingly unfamiliar with the syntax, thus was happy to discover and use this nifty shortcut. It’s not as powerful as sed/awk but is great for a simple character replace like this, especially when the process of trying to manipulate both kinds of slashes in the issuer string and replace them with newlines '\n' is frying my brain.

As always, your mileage may vary, particularly regarding any differences in the basic syntax of the various utilities across platforms (I’m using RHEL). ’date’ for example is very forgiving here, this might not be the same everywhere. I’ve also had issues in the past with the syntax of SED on OSX.

Hope someone finds this helpful, and I will write up a brief post on using zabbix to manage SSL cert expiry at some point as well.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

I needed to create and deliver several training sessions for PDAs covering the following topics:

• Connection to the wireless network and config of proxies etc for internet access
• Synching with the exchange server and related calendaring and email
• Transferring files back and forth to the device

As well as a few other items which came up on the day.

You’ll need a VNC server (not client) on the windows mobile device. I ended up downloading Pocket VNC Server and running that, with a regular VNC client connection from the laptop.

Once the service is running you have to figure out which IP each device is listening on, then initiate a client vnc connection from the PC to the mobile device. After this you can use the PDA and the PC  (eg projector or big screen) will display what is happening on the PDA in a window, which can be recorded or screenshot as required.

There are two ways to get a VNC session to the PDA – either via an activesync connection (I used a USB cable, possibly you could use ActiveSync via bluetooth if you’re adventurous), or via a local wireless LAN. I wasted a lot of time trying to setup a Bluetooth PAN (Personal Area Network) between my laptop and the PDA so I could connect via a small private subnet, but couldn’t get it working. <rant>I remain convinced that most of bluetooth networking is junk and not yet much good for enterprise use</rant>.

Option 1: Activesync (Cabled)

Activesync is actually the easiest way to get an IP connection. It wasn’t documented anywhere obvious, but once you have an activesync connection established, the two devices (host PC/laptop, PDA) should have the following IPs:

• 192.168.55.100 – Host PC
• 192.168.55.101 – PDA

As long as you’re not going to be messing with the activesync connection and don’t want to walk around or move far from the PC, this is fine to use. Its actually preferable in that you’re not at the mercy of a wireless connection for your presentation. Having the wireless drop out or go flaky when you’re trying to demonstrate something to a room full of people is not what you want.

Option 2: Wireless

This method could be used either in AP or ad-hoc config. As there was a good wireless signal from one of our campus access points in the room, I went with the AP option. I also allowed each device to DHCP an address: somewhat risky in case the leases changed for some reason but it worked out ok. A more leak-proof method would have been to hardwire the IP’s to something static while still using the wireless network.

I used a well known freeware tool called VXUtil to determine the ip address of my PDA to use for connection to the VNC server.

Pros: You can walk around the room, you can demonstrate the full range of exchange/activesync settings, you can demonstrate internet connectivity. (I’ve demo’d google earth on the pda on a big screen via this method – it can be a bit of a slideshow over VNC, but it gets the point across).

Cons: Wireless can have random connection issues. You cant demonstrate setup of a wireless connection on the PDA since its already using one. Even if your setup doesn’t involve disabling and re-enabling wireless, You’ll probably end up disconnecting yourself anyway. (Windows mobile networking is fun like that).

Option 3: Both Wireless and Activesync, or: Heres one we prepared earlier.

To get this done, You can use any live screen recording software, or even take screenshots of the steps in your demo. I used an app for windows (camtasia) since we had a license for it, but there are likely suitable programs for linux as well (provided you can get your networking going with or without activesync).

Pros: Its rock solid. Networking is taken out of the picture so you shouldn’t have a problem.

Cons: You have to have it all pre-prepared, if you want to deviate from the prepared material you have to augment your presentation with either option 1 or 2.

That’s about it. Get the VPN server installed, get some form of networking up, connect to it from the PC, and you’re good. Its a little slow but a lot better than trying to get a room full of people to see what’s going on by holding your 320×240 PDA screen above your head…

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

If you want the gory details, check the thread over at bugs.launchpad.net. I’ll distil the useful bits below.

After the upgrade, my huawei 3G modem stopped being detected by NetworkManager. I’d see the fake ‘ZeroCD’ drive try to map itself and occasionally a gnome message box would be thrown up about a failed mount attempt, but no modem.

A look in the logs revealed /var/log/messages filling up with lines like this:

kernel: option 3-1:1.2: GSM modem (1-port) converter detected
kernel: usb 3-1: GSM modem (1-port) converter now attached to ttyUSB0
kernel: option 3-1:1.1: GSM modem (1-port) converter detected
kernel: usb 3-1: GSM modem (1-port) converter now attached to ttyUSB1
kernel: option 3-1:1.0: GSM modem (1-port) converter detected
kernel: usb 3-1: GSM modem (1-port) converter now attached to ttyUSB2
kernel: option1 ttyUSB2: GSM modem (1-port) converter now disconnected from ttyUSB2
kernel: option 3-1:1.0: device disconnected
kernel: option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1
kernel: option 3-1:1.1: device disconnected
kernel: option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
kernel: option 3-1:1.2: device disconnected

So the modem was being disconnected and reconnected at least a couple of times a second for some reason, and the storage device was not appearing at all.

I tried the usb_modeswitch tool which is supposed to jolt misbehaving HUAWEI (and other brand) devices out of their stupor with some undocumented SCSI/USB commands, but no success this time.

After a bit of googling, it turns out this is (was) a known bug in the way the more recent linux kernel handles the combination USB Modem/Storage device hardware (and was allowed to remain in a major release of Ubuntu which is a bit unfortunate as it seems these types of USB modems are pretty common).

There are a couple of fixes pending an official update: either install a patched version of the kernel, or temporarily disable the USB Storage kernel module which looks pretty easy and apparently worked for a few people:

# rmmod usb-storage

Untested by me: Your mileage may vary.  Be warned that even if this works, by unloading the usb-storage kernel module you will lose support for any USB based storage devices, so this is strictly a temporary workaround. I thought I’d try the more permanent and possibly dangerous (?) kernel solution first, which worked.

Steps to upgrade your kernel to a compatible version:

1. Check your current version with the uname -a command. My post-9.10-Karmic upgrade version was: 2.6.31-14-generic #48-Ubuntu SMP  x86_64 GNU/Linux
2. Go to http://kernel.ubuntu.com/~kernel-ppa/mainline/ and download the .deb files for the kernel headers (“all”) and the kernel for your architecture (“amd64″ or “i386″). If you don’t have any kind of internet on the affected ubuntu box, grab them via another connected machine and copy them via removable media (windows or mac should be fine for just getting the files). You want the “linux-header” and “linux-image” files from within the folder with the latest (hopefully stable) version number. You can ignore the source file for now.
3. Go to a command prompt, change to the folder where the downloaded .deb files are located, and execute the following, substituting the .deb file names for the versions you have (make sure you install the headers first).

4. sudo dpkg -i ./linux-headers-2.6.32-020632rc8_2.6.32-020632rc8_all.deb

5. sudo dpkg -i ./linux-image-2.6.32-020632rc8-generic_2.6.32-020632rc8_amd64.deb

After this, provided everything worked, you’re a reboot away from your modem working again. After the boot, uname -a should reveal the newly installed kernel version. Mine is: 2.6.32-020632rc8-generic #020632rc8 SMP

Once plugged in, the modem worked instantly and my mobile broadband account connected fine. Hooray!

While lsusb output looked the same as before:

Bus 006 Device 004: ID 12d1:1001 Huawei Technologies Co., Ltd. E620 USB Modem

My /var/log/messages also looked a lot healthier:

kernel: USB Serial support registered for GSM modem (1-port)
kernel: option 6-2:1.0: GSM modem (1-port) converter detected
kernel: usb 6-2: GSM modem (1-port) converter now attached to ttyUSB0
kernel: option 6-2:1.1: GSM modem (1-port) converter detected
kernel: usb 6-2: GSM modem (1-port) converter now attached to ttyUSB1
kernel: option 6-2:1.2: GSM modem (1-port) converter detected
kernel: usb 6-2: GSM modem (1-port) converter now attached to ttyUSB2
kernel: usbcore: registered new interface driver option
kernel: option: v0.7.2:USB Driver for GSM modems
kernel: scsi 8:0:0:0: CD-ROM            HUAWEI   Mass Storage     2.31 PQ: 0 ANSI: 2
kernel: scsi 8:0:0:1: Direct-Access     HUAWEI   SD Storage       2.31 PQ: 0 ANSI: 2
kernel: sr0: scsi-1 drive
kernel: Uniform CD-ROM driver Revision: 3.20
kernel: sr 8:0:0:0: Attached scsi generic sg1 type 5
kernel: sd 8:0:0:1: Attached scsi generic sg2 type 0
kernel: sd 8:0:0:1: [sdb] Attached SCSI removable disk

Additionally, with the new kernel, both the pseudo cdrom, the 3G modem, and presumably the SD storage (though I don’t use it) are working at the same time. So, problem solved.

(Another improvement I noticed with the new version of ubuntu/kernel is I can disconnect the wireless broadband account via networkmanager without nasty gnome freeze-ups. Not sure what the culprit was for this: I worked around by disconnecting the hardware to avoid freezes, but looks like this too is now solved).

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

First, any hit on the OpenID /openid/server url (I am using non-default permalinks) generated the following :

Fatal error: Call to undefined function add_options_page() in
/path/to/wp-content/plugins/wp-contact-form/wp-contactform.php on line 200

This was pretty obviously a conflict with WP-Contactform. Disabling this plugin made the above error go away, so I’ll be looking for a replacement for it soon.

Once the contactform error was worked around by disabling the plugin, the following appeared:

Fatal error: Call to a member function needsSigning() on a non-object in
/path/to/wp-content/plugins/openid/Auth/OpenID/Server.php
on line 1495

This would happen when I tried to specify my URL (whether main blog or wordpress author url) as an openid – it would seem to be working, go through the logon process then generate the error and the authentication process would abort.

After much googling (not much out there but this was helpful, sort of) and a good period of waiting and trying new versions of the OpenID plugin as they were released, the solution / workaround turned out to be extremely simple. It was a plugin conflict (doh) and a process of elimination identified the culprit and main show stopper: the cryptographp plugin.

No idea why but once it was disabled things worked fine. I was using this plugin to generate protective captchas for my comment forms. I replaced it with Simple CAPTCHA. (Its worth noting that in the 15 minutes or so I had no CAPTCHA active, I had already received a bot comment spam – and my site isn’t heavily trafficked by any means). I might choose another solution at some point from the plethora available, but for the time being, Simple Captcha gets the job done fine.

So thats about it. In a nutshell, some seemingly unrelated plugins were conflicting, disabling them and replacing with alternatives fixed it.

Now I can use glenscott.net as an OpenID, and my visitors have a nice simple OpenID login option on comments pages =)

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

I had a play with the stock ASUS install for a while, but it was less than exciting. What finally killed it for me was the broken Xandros wireless networking. To get WPA you need to do an update (via the wired connection) and after the update it still didn’t work for me. I finally learned that due to some scripting errors by the eee pc xandros developers WPA still breaks if there are certain characters in the password. Rather than do the script editing dance to fix a distro I was already feeling lackluster about I decided to move on to Ubuntu.

Installation of Ubuntu is a total breeze and everything you need plus instructions is over here : http://www.ubuntu-eee.com/. I won’t go over it here but to summarize:

1. Grab the .ISO (less than 700MB, I used the torrent)
2. Get the unetbootin netboot install utility (sourceforge)
3. Blast the .ISO onto your 1GB usb drive
4. Fire up your eeepc, do the usual ESC to choose boot device, and you’re away.

Up until the install I wasn’t aware of the existence of the ubuntu netbook interface remix: its essentially a touchscreen friendly netbook menu/window manager and very cool. Its the first real argument I’ve seen that might sway me towards installing a third party aftermarket touchscreen.

There are a couple of things that needed changing from the stock install, most importantly the broken SD Card mount function. Fortunately this is dead easy to fix (and it is maybe already sorted in the latest release even as I type this).

Run an update

Before doing any tinkering, its worth allowing ubuntu to run a package update via the synaptic package manager / built in updater / cmd line “apt-get update, apt get upgrade”. This is dead easy: do it first =)

Fixing the SD Card mount

This is a minor annoyance, possibly already fixed if there is a new release out, but very easy to fix.

1. Fire up a terminal window (under accessories)

2. sudo gedit /etc/fstab

3. Comment out (put a hash at the start of) the last line which refers to the cdrom.
4. Save and exit.

This is a minor oversight by the distribution chefs and takes about five minutes to fix. After doing that the SD card mount works seamlessly.

Getting your Divx/Xvid going

The next thing you’ll probably want to do is install media codecs so you can play your divx/xvids files on the go. This is as simple as firing off the media player while you have an active net connection and telling it to download the codecs from the apt repository (just search for ‘xvid’).

Another package I needed which didn’t come preinstalled was the VPN client. Standard ubuntu procedure applies here, as in the following packages should be installed:

• pptp-client

• gnome-network-manager

After that a command line network manager restart command purports to give you the VPN options in your network menu, but I needed to reboot before mine appeared. After all this was installed, my netbook connected ot the WPA network and through again to the PPTP VPN no worries.

Currently Unresolved Resolved Issue 1: hibernation is busted.

I won’t go into detail, but even after installing the hibernate package and going in with a gparted usb boot to match the swap partition size to my installed RAM size (512mb), hibernation is still broken. I don’t get the “Insufficient SWAP” type error messages now and it appears to be hibernating, but powering it back on results in a fresh boot rather than a restore from hibernation.

For the time being I’m resorting to leaving it in suspend and making sure I keep it charged if its not being used for a few days.

UPDATE: following the instructions for file-based hibernation in this excellent article at ubuntu-eee.com has things working perfectly.

Currently Unresolved Resolved Issue 2: Webcam is busted

Firing up the built-in ‘cheese’ app doesn’t give me any webcam goodness, only static. This is probably some default setting gone awry in a config file: once again I havent done much (any) research on this so it might be a simple fix. I haven’t tried Skype with it yet either.

UPDATE: Somehow the webcam had become disabled in the BIOS between the Xandros install and the Ubuntu install. Re-enabling it fixed all. Doh.

Currently Unresolved Issue 3: Some windows don’t fit the screen

This can be gotten around to an extent by the hold-down-alt-when-clicking trick, but what I really want is a VGA utility like the one included in the stock distro which allows a bigger virtual screen size. There might be something out there, but I haven’t give it a proper look yet.

I’ll post an update if I manage to resolve any of these items (before going on holiday in a few weeks =) )

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

As mentioned, the eeepc I acquired had XP installed (nlited) and no recovery DVD, so no option of using the built in rescue partition to restore the EEEPC back to the factory state. (Apparently you can hit F9 normally and it takes to to a ‘restore me from hidden partiton’ type GRUB menu). I figured this wouldn’t be a problem, I’d just go to the Asus support site and grab the image. Its linux, right, should be able to get the firmware images easily from the manufacturer, right?

Wrong.

I ransacked the official eeepc.asus.com support site looking for what I needed: at the other end of the search I can honestly say I found zero useful material or info there. (Don’t even bother visiting it, you’re better off going straight to google for this). The support/download section had BIOS updates and the like, but nothing to help with a reinstall. Even searching the forums for what I imagined to be blatantly obvious issues (eg: where do I download the restore cd?) came up with bupkis.

I concluded, to my chagrin, Asus has decided to withhold the support software (a linux distro?) for whatever reason, and the forums were evidently being policed according to this policy, removing any useful information pertaining to it. I expected to find at least a link to an outside site, as google was telling me about various helpful torrents: not finding even a whisper of this on the official support forums smells like seafood.

After a bit of googling and torrent searching I found a few ISO images which purported to be eeepc 701 flavored including a copy of Ubuntu, but I couldn’t get them to run from USB key: syslinux made the drive bootable but either the kernel options were wrong and linux would not boot, or I could get it to boot by plugging in manual options (specifying location of initrd etc) but only made it partway into a boot before falling over and restarting. (I didn’t bother noting or chasing down those errors as I didn’t particularly fancy my mission this evening to be going down the road of fixing boot issues in roll-your-own livecds booting from USB sticks). I realise I’ll probably have to suss this out properly for installing Ubuntu and other flavors down the road, but for now I just wanted the stock Xandros system restore.

I eventually found some downloads which solved the problem.

Heres the process in WinXP:

1. The first thing you need is the EeePC 901 ASUS Linux USB Flash Utility available from eeefiles.com (Link updated! http://www.netbookfiles.com/574/eee-pc-8g-xp-asus-usb-flash-utility-version-v1131/ ). I guess this is the version which comes on the support DVD, but I don’t have that and it wasn’t available from the official site, so… (By the way, thanks a lot Asus, making me resort to downloading from a third party site instead of a trusted source).
2. The next file you’ll need is the Xandros Eee Pc 701 Edition ISO. Get it from the eeepc 701 community project on sourceforge.
3. Once you’ve downloaded both of the above its all pretty much downhill!
4. Now either burn the ISO to a physical disk, or mount the image using a program like daemontools.
5. Plug in your 2GB+ USB stick
6. Run the USB Flash utility, select the detected USB drive,wait for it to format. If prompted, remove and re-insert the stick after the format. It will ask for the linux disk (either insert the physical copy you burned or mount the ISO into a drive).
7. Linux will copy (it takes a few minutes) and at the end you should have a bootable restore on the USB drive.
8. Power on the eeepc, hit F2 for BIOS options, go to “Advanced” and set the “OS Installation” to “Start”. F10 to Save and exit.
9. Put the USB drive in your eeepc, reboot, hit escape on POST to get to the boot menu, and you’re off.
10. Xandros will install (took about ten minutes on mine). Remember to go back into the BIOS and set “OS Installation” to “Finished” once its finished.

That really shouldn’t have taken me a whole evening of googling to get done =

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

Note that the following explanations, definitions of features and so on are the product of my own observation and experimentation with various WM5 and WM6 mobile devices. I have found some documentation on their functions but the majority of information I have discovered through trial and error. If there is some official documentation somewhere which contradicts what I say here (and I wouldn’t be at all surprised) then so be it: what I can say for sure is mine works.

That said, Windows Mobile networking is in my experience notoriously flaky and even though the stuff here works for my device, your mileage may vary considerably.

Ok, lets get into it.

Golden rule: Anytime you change anything at all in the networking profiles, after you have saved the changes, disable and re-enable the wireless network/adapter. I have a control utility for this on my device – (HTC Hermes) – but this will vary between devices. Following this step  every time I change anything has reduced my frustrations considerably – not doing this means settings often just don’t take effect, and after doing this sometimes things just start working.

A quick explanation of terms I’ve used:

• “Config Profiles” refer to the named settings you can create and assign to different networks in “Network Management” (Start -> Settings -> Connections -> Connections -> Advanced -> Select Networks) – Some of the existing config profiles are ‘My ISP” and “My Workplace” (and you will have others automatically created for your ISP if you have mobile internet access on your SIM card via a 3G or GPRS network).

Explanation of how WM decides which network to use (And hence which attached config profile is used to decide how to connect)

Windows mobile networking is whack (but you knew that already, right?). Here’s how it breaks down: It decides how to handle a http network request based on whether there are any decimals (periods) in the dns name.

By its logic, anything with a decimal/period is ‘internet’ and anything without a decimal/period is ‘work’.

So:

1. “http://bogus.internal” is handled with the config profile attached to the“Internet” network
2. “http://bogus” is handled with the config profile attached to the“Private Network” network

You can create multiple different named config profiles and assign any of them to either “Internet” or “Private Network”.

An important thing to note is, a config cannot have a VPN server added to it (or use an already setup VPN) when applied to the ‘Internet’ network. If you want to use a VPN you’ll have to do it through the ‘Work’ network (see exceptions hint below).

Explanation of the ‘Exceptions’ settings.

Now – anything in the ‘Exceptions’ list goes through the “My Work” profile regardless of whether the dns name has decimals in it to not. The good news is you can use wildcards here to force a wide range of sites through the ‘My Work’ profile if you want – hint: http:/*.* and https://*.* . I didn’t end up using this for my solution, but you might find it useful.

I’m sure this flavor of networking makes sense to some software engineer in Microsoft land, but to me it just spells confusion. Once I worked out what was actually going on, I figured out some shortcuts/config hacks which can be used to railroad the networking into doing more or less what you tell it to.

So here’s what I’ve done to make mine work:

First, I access everything using its FQDN – no dotless machinename shortcuts. This makes sure everything is using the profile assigned to “Internet” (regardless of whether I’m on a work network or not).

Make sure the ‘Exceptions’ section has no entries.

Next, tell windows mobile that every wireless network you connect to is “The Internet”. Forget about the “Work” option . As far as my usage goes, that option is useless. All the wireless networks I connect to are set to “Internet”. If you have already added a wireless network and don’t know if its tagged to “Work” or “Internet, you can go into settings -> wireless networks, find existing networks, and change which network it connects to.

Next, create a couple of new custom network configs, as follows:

• ‘Direct Connection’ – this does as it says, and contains no settings for proxy or vpn.
• ‘Proxy Connection’ – this has my work proxy server entered

You do this via Settings –> connections (tab) –> connections (icon) –> Advanced (tab), Select Networks (button). Here you can edit existing or create new config profiles.

Incidentally, my workplace uses VPNs to grant authenticated access to the wireless network – so not allowing a VPN connection to a host on a “private network” just breaks everything.

Once you’ve done that and entered your proxy authentication credentials in the appropriate places, you’re ready to go. Whenever you want to change how you’re connecting to the net go to network settings, and change “internet” to one of your created profiles. Remember to start/stop the wireless to force the change, and your next network access should be using either direct, proxy, (or VPN – see below), whichever you’ve chosen.

By doing this you lose any pretense of windows Mobile networking transparently working from whichever location / network you are connected to, but it never worked properly for me anyway, and at least this way you have some control back.

Connecting to a VPN

The above covered getting web access only, either direct or via a proxy. To get a VPN connection active (eg for skype and the like) heres what you have to do instead:

1. Assign a config profile to the ‘work’ network
2. Add a VPN connection to the config profile you used. You can add VPN connections to a config profile by assigning it to to the “Internet” connection, hitting OK, going back to the ‘Tasks’ tab and clicking the ‘Add a new VPN server connection’.
3. Add the appropriate wildcard exceptions (to the ‘exceptions’ section) to trigger the VPN connection for every hostname.

Once I get a VPN up at my work from inside the wireless I can make direct connections to outside hosts, for example using PocketPutty. Be warned though that even if it does connect, Windows Mobile likes to shut down the VPN connection once it decides it is no longer in use, eg after you haven’t looked at web pages for a while, regardless of whatever else you are doing on the network, (say in a live SSH session). Parking pocket IE on a web page with an auto-refresh might possibly fool it into keeping the VPN alive, but I haven’t experimented with that yet.

Hopefully there is some useful info in here and it eases the pain of getting your mobile device networking in a saner fashion.

This is a fairly quick covering of networking with WM5/6 and its highly likely there are holes, inaccuracies and/or bits left out:  If anyone has queries, corrections or extra to add, go ahead and comment or hit up the contact form for direct email.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

(Quick solution: ignore the site the “Add engines” link takes you to and go to mycroft.mozilla.org instead – its all there).

I’m a big fan of the firefox search bar: I have it setup for google, google images, dictionary.com, urban dictionary, wikipedia, wikiquote, youtube, imdb and ebay. I’ve even written two search plugins in use at the computer science dept at my university which is used to search the staff directory + and general website.  I use them all the time, and they will be included in the firefox 3.x deployed to the workstations our 17+ computer labs this semester.

So I’m a fan, I consider search plugins a highly desirable if not essential time-saving feature in my browser, and as soon as I install a new copy of firefox, I take time out to customise my search menu pretty much straightaway. I quietly evangelise the feature to others, show them how easy their common searches can be. Click here, click there, bam, done, easier, isnt firefox great?

Problem is,  what used to be a simple and smooth process is no longer. By default anyway – and only if you’ve upgraded your browser relatively recently.

Now I haven’t actually gone back and installed an older version to check or anything, but I’m pretty sure that getting more search plugins used to be a case of dropping the search menu, selecting “Manage Search engines”, then “Get more search engines” (or the equivalent text) in the settings dialog.

This would take me to a site I never bothered to remember the URL of, since the link was always right there in settings.

Used to be, I could go *wherever the aforementioned link went*, type in the name of *major searchable site* I wanted to add (ebay/youtube/wikipedia/etc) and would be presented with a list of links – click on them, approve the security popup, and wham, the plugin is added. It was quick and easy, and I found that if I was searching somewhere (ebay for example), rather than go straight to the site and use their search, it was worth the 60 or so extra seconds to go via the search plugins site and add them to my search bar.

Now, this simplicity is broken, due to a simple change: the “Get more engines” link now takes me to addons.mozilla.org. Different site, ok, cool – as long as it gives me the functionality, right? I have faith. Its landed me automatically in the ‘Search plugins’ category. Cool. I seach for ‘ebay’. It turns up… zilch. Searching for ‘google’ gives me… ‘AOL search’ (wtf?).

Oh no.

A couple of minutes later navigating around and trying different searches with no fruit, I realise that regardless of whether this site actually does conspire to harbour the search bar plugins I pursue, perhaps concealed behind some menu or search option I have overlooked, however n00b-like I may be in overlooking said option, this new way of adding plugins has failed, catastrophically. It has failed the end user test. Namely, its chief advertised function – adding searchbar plugins – is nowhere in sight. Not to the casual user, and not to me. It is, it seems, akin to getting in a taxi, asking to be taken to a restaurant and being dumped at the local gymnasium. I wanted a hamburger and I didn’t even get something edible. The place I’ve been taken is not even related.

So I dumped the broken site and hit google looking for firefox search plugins. A couple of links in, I found what looks like the old site – mycroft.mozdev.org - which has the goodness, the instant search, the 60 second convenience I wanted. I bookmarked it, problem solved – for me, anyway. Now I remember that URL in case I need to add more plugins on another machine, or demonstrate the add plugins feature on someone elses browser.

I just hope this difficulty doesn’t put people off using firefox, especially those migrating from other browsers.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

There seems to be a few different ways to get the SMB bit done but I ended up using smbfs: you’ll need this on your system for this script to work. If you don’t have it and you’re using a package manager it should be pretty simple to get, a bit of apt-get install smbfs should do the trick.

Note: I am aware of various security issues with running scripts as root, storing passwords in scripts, and this sort of thing. Since this is a super simple backup script, I’m doing it anyway : Complaints department is /dev/null ;)

Script 1: this is a super simple version. It tars and copies some folders to the remote share and thats it.


#!/bin/bash

#simple backup script
#by Glen Scott, glenscott.net

# set smb server and auth vars
sharename="//ourserver/ourshare"
username="ourdomain\ourbackupuser"
password="passwordgoeshere"

backuplocation="/backups/*"
savepath="/root/"
filename=$(hostname).backup.$(date +%a).tar
mountpoint="/mnt/smb"

#tar up the backup folder
tar -cf $savepath$filename $backuplocation

#connect to the share
mount.smbfs $sharename $mountpoint -o username=$username,password=$password

# move the tar
mv -f $savepath$filename $mountpoint

# disconnect the share
umount $mountpoint

#all done!

Script 2: this is the second version I made for another box. It needed a mysql database backed up as well so I added a few lines in for that. I also took the chance to add a quick working folders checker / creator, tidy it up a bit and comment everything.


#!/bin/bash

# simple backup script
# by Glen Scott, glenscott.net

# this is a simple script to tar.gz certain folder locations and copy them to a SMB share
# this script should be run periodically from crontab
# you will need smbfs installed on your system or modify the samba mount method

# set smb server and auth vars
sharename="//ourserver/ourshare"
username="ourdomain\ourbackupuser"
password="passwordgoeshere"

#set mysql details
mysqlhost="localhost"
mysqlusername="root"
mysqlpasswd="mysqlpasswordhere"

#set which folder locations we want to backup, inc trailing slashes
#add more here and append to the appropriate tar line further down the script if needed

location1="/var/"
location2="/backup/"

#set temp files and folders
backuptemp="/backuptmp/"
savepath="/root/backup/"
filename=$(hostname).backup.$(date +%a).tar.gz
mountpoint="/mnt/smb"

# make sure our working folders are present and accounted for

if [ ! -d "${backuptemp}" ]
then
mkdir $backuptemp
fi

if [ ! -d "${savepath}" ]
then
mkdir $savepath
fi

if [ ! -d "${mountpoint}" ]
then
mkdir $mountpoint
fi

# tar up the files we want into the backup temp
tar -cf ${backuptemp}files.tar $location1 $location2

#dump the local mysql db into the backup temp
mysqldump "-h${mysqlhost}" "-u${mysqluser}" "-p${mysqlpasswd}" --all-databases --lock-tables > ${backuptemp}mysqldump.sql

#tar up the backup temp folder
tar -czf $savepath$filename $backuptemp

#connect the smb share to our mount point
mount.smbfs $sharename $mountpoint -o username=$username,password=$password

# copy the tar (could also move it but whatever you like)
cp -f $savepath$filename $mountpoint

# disconnect the share
umount $mountpoint

#all done

As long as you have smbfs installed, the above should work fine.

A word on smbfs: without it the above script will fail. You can probably install smbfs quite easily on your system with the command apt-get install smbfs (or yum if you’re using redhat/fedora, or whatever your flavor of package manager happens to be). I use debian, so apt-get works just fine for me.

A word on Crontab: You’ll need to add the script to your local cron to get regular backups.

I won’t go into hideous details about how crontab works, theres plenty of that on the net already. To keep it simple, if your distro supports it (most should) you can put a symlink to the script in /etc/cron.daily or /etc/cron.weekly which will give you a simple schedule.

If you want something a bit more complicated, you’ll have to mess with the crontab. I’m aware there are commands to get this done but I’ve always just edited the system crontab directly. Mine runs twice a week, on wednesdays and fridays, so my crontab line looks like this:

# m h dom mon dow user command
0 2 * * 3,5 root /root/backupscript

Righto, thats it.

UPDATE: I notice a mutated version of this script has been posted in this forum thread over at linuxquestions.org – cool! Check it out over there if you want to see what someone else has done with it.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

The deal is, I’m wanting to publish stories and other standalone type pieces of writing on this site, and I want to create them as nice friendly text wordpress pages, but I don’t want each and every story to appear as a default pages link. The titles are long, there’ll be a few of them, and they’ll screw up my page layout if included in the pages menu(s), especially in the top nav bar where theres limited space.

To change this behavior, you just need to go into your theme template files and add some parameters to wp_list_pages(). The definitive list of parameters is over here and is worth a read:

http://codex.wordpress.org/Template_Tags/wp_list_pages

The most useful ones for this task are ‘include’, ‘exclude’, and ‘depth’. You can string multiple parameters together using the ampersand & character like so: wp_list_pages(foobar=1&moobar=2);

Include and exclude will do as they suggest, given a comma delimited list of page numbers. If you use include it will only include the specified pages, if you use exclude it will include all except the specified pages.

I decided a better way to get it done, actually ideal for my purposes, is to create all my ‘hidden’ pages in a subcategory, and set the depth parameter to ’1′. This means any page created as a subcategory will not appear in the navigation menus, though it can be explicitly linked to, or appear in a list of links for that subcategory (exactly what I want).

The Widgets file

I managed to sort out the top nav bar page listing on my template pretty easily by making the change to the header.php file, but I couldn’t find anything immediately obvious generating the page listing in sidebar.php, or any of the other theme includes. After some bumbling around trying to figure this out, I discovered the sidebar listing was being handled by wordpress widgets . This was pretty easy to fix once I found out where the widgets file is (/wp-includes/widgets.php), although since it uses an array for the parameters its slightly different than the edit above.

You have a few options for changing how the pages display through the wordpress widgets control panel, but sadly no way to exclude sub-pages by default. This would be a cool thing to have available, and I’d write it into the widget file and make my version available, but my php is far too rusty at the moment for this even though its pretty simple.

Ok, how to do it manually. Open up the widgets file for editing and find the section which defines function wp_widget_pages and add to the line which starts as follows:

$out = wp_list_pages (array ('title_li' => '', etc etc and add to it the parameter ‘depth’ => 1, so it ends up looking something like this:

$out = wp_list_pages( array('title_li' => '', 'depth' => 1,'echo' => 0, 'sort_column' => $sortby, 'exclude' => $exclude) );

Thats it. save the file and your side menu should hide all pages in sub-categories.

Also, there is this plugin I found over here which interferes somehow with wp_list_pages(); to cause the change everywhere the function is called. Might save having to mess with multiple places in the template / widgets file depending how your theme is set up. (Mine has pages listed in a top nav bar as well as a side menu, for example).

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.