I had a play with the stock ASUS install for a while, but it was less than exciting. What finally killed it for me was the broken Xandros wireless networking. To get WPA you need to do an update (via the wired connection) and after the update it still didn’t work for me. I finally learned that due to some scripting errors by the eee pc xandros developers WPA still breaks if there are certain characters in the password. Rather than do the script editing dance to fix a distro I was already feeling lackluster about I decided to move on to Ubuntu.

Installation of Ubuntu is a total breeze and everything you need plus instructions is over here : http://www.ubuntu-eee.com/. I won’t go over it here but to summarize:

1. Grab the .ISO (less than 700MB, I used the torrent)
2. Get the netboot install utility (sourceforge)
3. Blast the .ISO onto your 1GB usb drive
4. Fire up your eeepc, do the usual ESC to choose boot device, and you’re away.

Up until the install I wasn’t aware of the existence of the ubuntu netbook interface remix: its essentially a touchscreen friendly netbook menu/window manager and very cool. Its the first real argument I’ve seen that might sway me towards installing a third party aftermarket touchscreen.

There are a couple of things that needed changing from the stock install, most importantly the broken SD Card mount function. Fortunately this is dead easy to fix (and it is maybe already sorted in the latest release even as I type this).

Run an update

Before doing any tinkering, its worth allowing ubuntu to run a package update via the synaptic package manager / built in updater / cmd line “apt-get update, apt get upgrade”. This is dead easy: do it first =)

Fixing the SD Card mount

This is a minor annoyance, possibly already fixed if there is a new release out, but very easy to fix.

1. Fire up a terminal window (under accessories)

2. sudo gedit /etc/fstab

3. Comment out (put a hash at the start of) the last line which refers to the cdrom.
4. Save and exit.

This is a minor oversight by the distribution chefs and takes about five minutes to fix. After doing that the SD card mount works seamlessly.

Getting your Divx/Xvid going

The next thing you’ll probably want to do is install media codecs so you can play your divx/xvids files on the go. This is as simple as firing off the media player while you have an active net connection and telling it to download the codecs from the apt repository (just search for ‘xvid’).

Another package I needed which didn’t come preinstalled was the VPN client. Standard ubuntu procedure applies here, as in the following packages should be installed:

• pptp-client

• gnome-network-manager

After that a command line network manager restart command purports to give you the VPN options in your network menu, but I needed to reboot before mine appeared. After all this was installed, my netbook connected ot the WPA network and through again to the PPTP VPN no worries.

Currently Unresolved Resolved Issue 1: hibernation is busted.

I won’t go into detail, but even after installing the hibernate package and going in with a gparted usb boot to match the swap partition size to my installed RAM size (512mb), hibernation is still broken. I don’t get the “Insufficient SWAP” type error messages now and it appears to be hibernating, but powering it back on results in a fresh boot rather than a restore from hibernation.

For the time being I’m resorting to leaving it in suspend and making sure I keep it charged if its not being used for a few days.

UPDATE: following the instructions for file-based hibernation in this excellent article at ubuntu-eee.com has things working perfectly.

Currently Unresolved Resolved Issue 2: Webcam is busted

Firing up the built-in ‘cheese’ app doesn’t give me any webcam goodness, only static. This is probably some default setting gone awry in a config file: once again I havent done much (any) research on this so it might be a simple fix. I haven’t tried Skype with it yet either.

UPDATE: Somehow the webcam had become disabled in the BIOS between the Xandros install and the Ubuntu install. Re-enabling it fixed all. Doh.

Currently Unresolved Issue 3: Some windows don’t fit the screen

This can be gotten around to an extent by the hold-down-alt-when-clicking trick, but what I really want is a VGA utility like the one included in the stock distro which allows a bigger virtual screen size. There might be something out there, but I haven’t give it a proper look yet.

I’ll post an update if I manage to resolve any of these items (before going on holiday in a few weeks =) )

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

As mentioned, the eeepc I acquired had XP installed (nlited) and no recovery DVD, so no option of using the built in rescue partition to restore the EEEPC back to the factory state. (Apparently you can hit F9 normally and it takes to to a ‘restore me from hidden partiton’ type GRUB menu). I figured this wouldn’t be a problem, I’d just go to the Asus support site and grab the image. Its linux, right, should be able to get the firmware images easily from the manufacturer, right?

Wrong.

I ransacked the official eeepc.asus.com support site looking for what I needed: at the other end of the search I can honestly say I found zero useful material or info there. (Don’t even bother visiting it, you’re better off going straight to google for this). The support/download section had BIOS updates and the like, but nothing to help with a reinstall. Even searching the forums for what I imagined to be blatantly obvious issues (eg: where do I download the restore cd?) came up with bupkis.

I concluded, to my chagrin, Asus has decided to withhold the support software (a linux distro?) for whatever reason, and the forums were evidently being policed according to this policy, removing any useful information pertaining to it. I expected to find at least a link to an outside site, as google was telling me about various helpful torrents: not finding even a whisper of this on the official support forums smells like seafood.

After a bit of googling and torrent searching I found a few ISO images which purported to be eeepc 701 flavored including a copy of Ubuntu, but I couldn’t get them to run from USB key: syslinux made the drive bootable but either the kernel options were wrong and linux would not boot, or I could get it to boot by plugging in manual options (specifying location of initrd etc) but only made it partway into a boot before falling over and restarting. (I didn’t bother noting or chasing down those errors as I didn’t particularly fancy my mission this evening to be going down the road of fixing boot issues in roll-your-own livecds booting from USB sticks). I realise I’ll probably have to suss this out properly for installing Ubuntu and other flavors down the road, but for now I just wanted the stock Xandros system restore.

I eventually found some downloads which solved the problem.

Heres the process in WinXP:

1. The first thing you need is the EeePC 901 ASUS Linux USB Flash Utility available from eeefiles.com. I guess this is the version which comes on the support DVD, but I don’t have that and it wasn’t available from the official site, so… (By the way, thanks a lot Asus, making me resort to downloading from a third party site instead of a trusted source).
2. The next file you’ll need is the Xandros Eee Pc 701 Edition ISO. Get it from the eeepc 701 community project on sourceforge.
3. Once you’ve downloaded both of the above its all pretty much downhill!
4. Now either burn the ISO to a physical disk, or mount the image using a program like daemontools.
5. Plug in your 2GB+ USB stick
6. Run the USB Flash utility, select the detected USB drive,wait for it to format. If prompted, remove and re-insert the stick after the format. It will ask for the linux disk (either insert the physical copy you burned or mount the ISO into a drive).
7. Linux will copy (it takes a few minutes) and at the end you should have a bootable restore on the USB drive.
8. Power on the eeepc, hit F2 for BIOS options, go to “Advanced” and set the “OS Installation” to “Start”. F10 to Save and exit.
9. Put the USB drive in your eeepc, reboot, hit escape on POST to get to the boot menu, and you’re off.
10. Xandros will install (took about ten minutes on mine). Remember to go back into the BIOS and set “OS Installation” to “Finished” once its finished.

That really shouldn’t have taken me a whole evening of googling to get done =\

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

There were a couple of very interesting aspects of the demonstrations, firstly the high power electric arcs being generated, and secondly the safe handling of said arcs by Peter the Tesla guy and the TV show presenter - they had these huge arcs from the coils terminating on steel rods being held, as well as on a metal cage with a person inside, on a steel glove, and even a tinfoil hat worn on the person whilst immersed in the family pool. This was made safe by making sure the circuit was constantly grounded through nice fat copper cables and/or the water of the pool - so while it looked like the arcs were millimeters from frying the humans involved, the current was actually happier to literally follow the path of least resistance (the copper, instead of the human).

Pretty amazing stuff to watch, I’m really glad I went. You can see photos and videos of this and more of the projects Peter has done on his website: www.tesladownunder.com - well worth a look.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

Note that the following explanations, definitions of features and so on are the product of my own observation and experimentation with various WM5 and WM6 mobile devices. I have found some documentation on their functions but the majority of information I have discovered through trial and error. If there is some official documentation somewhere which contradicts what I say here (and I wouldn’t be at all suprised) then so be it: what I can say for sure is mine works.

That said, Windows Mobile networking is in my experience notoriously flaky and even though the stuff here works for my device, your milage may vary considerably.

Ok, lets get into it.

Golden rule: Anytime you change anything at all in the networking profiles, after you have saved the changes, disable and re-enable the wireless network/adapter. I have a control utility for this on my device - (HTC Hermes) - but this will vary between devices. Following this step  every time I change anything has reduced my frustrations considerably - not doing this means settings often just don’t take effect, and after doing this sometimes things just start working.

A quick explanation of terms I’ve used:

• “Config Profiles” refer to the named settings you can create and assign to different networks in “Network Management” (Start -> Settings -> Connections -> Connections -> Advanced -> Select Networks) - Some of the existing config profiles are ‘My ISP” and “My Workplace” (and you will have others automatically created for your ISP if you have mobile internet access on your SIM card via a 3G or GPRS network).

Explanation of how WM decides which network to use (And hence which attached config profile is used to decide how to connect)

Windows mobile networking is whack (but you knew that already, right?). Here’s how it breaks down: It decides how to handle a http network request based on whether there are any decimals in the dns name.

By its logic, anything with a decimal is ‘internet’ and anything without a decimal is ‘work’.

So:

1. “http://bogus.internal” is handled with the config profile attached to the“Internet” network
2. “http://bogus” is handled with the config profile attached to the“Private Network” network

You can create multiple different named config profiles and assign any of them to either “Internet” or “Private Network”.

An important thing to note is, a config cannot have a VPN server added to it (or use an already setup VPN) when applied to the ‘Internet’ network. If you want to use a VPN you’ll have to do it through the ‘Work’ network (see exceptions hint below).

Explanation of the ‘Exceptions’ settings.

Now - anything in the ‘Exceptions’ list goes through the “My Work” profile regardless of whether the dns name has decimals in it to not. The good news is you can use wildcards here to force a wide range of sites through the ‘My Work’ profile if you want - hint: http:/*.* and https://*.* . I didn’t end up using this for my solution, but you might find it useful.

I’m sure this flavor of networking makes sense to some software engineer in Microsoft land, but to me it just spells confusion. Once I worked out what was actually going on, I figured out some shortcuts/config hacks which can be used to railroad the networking into doing more or less what you tell it to.

So here’s what I’ve done to make mine work:

First, I access everything using its FQDN - no dotless machinename shortcuts. This makes sure everything is using the profile assigned to “Internet” (regardless of whether I’m on a work network or not).

Make sure the ‘Exceptions’ section has no entries.

Next, tell windows mobile that every wireless network you connect to is “The Internet”. Forget about the “Work” option . As far as my usage goes, that option is useless. All the wireless networks I connect to are set to “Internet”. If you have already added a wireless network and don’t know if its tagged to “Work” or “Internet, you can go into settings -> wireless networks, find existing networks, and change which network it connects to.

Next, create a couple of new custom network configs, as follows:

• ‘Direct Connection’ - this does as it says, and contains no settings for proxy or vpn.
• ‘Proxy Connection’ - this has my work proxy server entered

You do this via Settings –> connections (tab) –> connections (icon) –> Advanced (tab), Select Networks (button). Here you can edit existing or create new config profiles.

Incidentally, my workplace uses VPNs to grant authenticated access to the wireless network - so not allowing a VPN connection to a host on a “private network” just breaks everything.

Once you’ve done that and entered your proxy authentication credentials in the appropriate places, you’re ready to go. Whenever you want to change how you’re connecting to the net go to network settings, and change “internet” to one of your created profiles. Remember to start/stop the wireless to force the change, and your next network access should be using either direct, proxy, (or VPN - see below), whichever you’ve chosen.

By doing this you lose any pretense of windows Mobile networking transparently working from whichever location / network you are connected to, but it never worked properly for me anyway, and at least this way you have some control back.

Connecting to a VPN

The above covered getting web access only, either direct or via a proxy. To get a VPN connection active (eg for skype and the like) heres what you have to do instead:

1. Assign a config profile to the ‘work’ network
2. Add a VPN connection to the config profile you used. You can add VPN connections to a config profile by assigning it to to the “Internet” connection, hitting OK, going back to the ‘Tasks’ tab and clicking the ‘Add a new VPN server connection’.
3. Add the appropriate wildcard exceptions (to the ‘exceptions’ section) to trigger the VPN connection for every hostname.

Once I get a VPN up at my work from inside the wireless I can make direct connections to outside hosts, for example using PocketPutty. Be warned though that even if it does connect, Windows Mobile likes to shut down the VPN connection once it decides it is no longer in use, eg after you haven’t looked at web pages for a while, regardless of whatever else you are doing on the network, (say in a live SSH session). Parking pocket IE on a web page with an auto-refresh might possibly fool it into keeping the VPN alive, but I haven’t experimented with that yet.

Hopefully there is some useful info in here and it eases the pain of getting your mobile device networking in a saner fashion.

This is a fairly quick covering of networking with WM5/6 and its highly likely there are holes, inaccuracies and/or bits left out:  If anyone has queries, corrections or extra to add, go ahead and comment or hit up the contact form for direct email.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

(Quick solution: ignore the site the “Add engines” link takes you to and go to mycroft.mozilla.org instead - its all there).

I’m a big fan of the firefox search bar: I have it setup for google, google images, dictionary.com, urban dictionary, wikipedia, wikiquote, youtube, imdb and ebay. I’ve even written two search plugins in use at the computer science dept at my university which is used to search the staff directory + and general website.  I use them all the time, and they will be included in the firefox 3.x deployed to the workstations our 17+ computer labs this semester.

So I’m a fan, I consider search plugins a highly desirable if not essential time-saving feature in my browser, and as soon as I install a new copy of firefox, I take time out to customise my search menu pretty much straightaway. I quietly evangelise the feature to others, show them how easy their common searches can be. Click here, click there, bam, done, easier, isnt firefox great?

Problem is,  what used to be a simple and smooth process is no longer. By default anyway - and only if you’ve upgraded your browser relatively recently.

Now I haven’t actually gone back and installed an older version to check or anything, but I’m pretty sure that getting more search plugins used to be a case of dropping the search menu, selecting “Manage Search engines”, then “Get more search engines” (or the equivalent text) in the settings dialog.

This would take me to a site I never bothered to remember the URL of, since the link was always right there in settings.

Used to be, I could go *wherever the aforementioned link went*, type in the name of *major searchable site* I wanted to add (ebay/youtube/wikipedia/etc) and would be presented with a list of links - click on them, approve the security popup, and wham, the plugin is added. It was quick and easy, and I found that if I was searching somewhere (ebay for example), rather than go straight to the site and use their search, it was worth the 60 or so extra seconds to go via the search plugins site and add them to my search bar.

Now, this simplicity is broken, due to a simple change: the “Get more engines” link now takes me to addons.mozilla.org. Different site, ok, cool - as long as it gives me the functionality, right? I have faith. Its landed me automatically in the ‘Search plugins’ category. Cool. I seach for ‘ebay’. It turns up… zilch. Searching for ‘google’ gives me… ‘AOL search’ (wtf?).

Oh no.

A couple of minutes later navigating around and trying different searches with no fruit, I realise that regardless of whether this site actually does conspire to harbour the search bar plugins I pursue, perhaps concealed behind some menu or search option I have overlooked, however n00b-like I may be in overlooking said option, this new way of adding plugins has failed, catastrophically. It has failed the end user test. Namely, its chief advertised function - adding searchbar plugins - is nowhere in sight. Not to the casual user, and not to me. It is, it seems, akin to getting in a taxi, asking to be taken to a restaurant and being dumped at the local gymnasium. I wanted a hamburger and I didn’t even get something edible. The place I’ve been taken is not even related.

So I dumped the broken site and hit google looking for firefox search plugins. A couple of links in, I found what looks like the old site - mycroft.mozdev.org - which has the goodness, the instant search, the 60 second convenience I wanted. I bookmarked it, problem solved - for me, anyway. Now I remember that URL in case I need to add more plugins on another machine, or demonstrate the add plugins feature on someone elses browser.

I just hope this difficulty doesn’t put people off using firefox, especially those migrating from other browsers.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

There seems to be a few different ways to get the SMB bit done but I ended up using smbfs: you’ll need this on your system for this script to work. If you don’t have it and you’re using a package manager it should be pretty simple to get, a bit of apt-get install smbfs should do the trick.

Note: I am aware of various security issues with running scripts as root, storing passwords in scripts, and this sort of thing. Since this is a super simple backup script, I’m doing it anyway : Complaints department is /dev/null

Script 1: this is a super simple version. It tars and copies some folders to the remote share and thats it.


#!/bin/bash

#simple backup script
#by Glen Scott, glenscott.net

# set smb server and auth vars
sharename="//ourserver/ourshare"
username="ourdomain\ourbackupuser"
password="passwordgoeshere"

backuplocation="/backups/*"
savepath="/root/"
filename=$(hostname).backup.$(date +%a).tar
mountpoint="/mnt/smb"

#tar up the backup folder
tar -cf $savepath$filename $backuplocation

#connect to the share
mount.smbfs $sharename $mountpoint -o username=$username,password=$password

# move the tar
mv -f $savepath$filename $mountpoint

# disconnect the share
umount $mountpoint

#all done!

Script 2: this is the second version I made for another box. It needed a mysql database backed up as well so I added a few lines in for that. I also took the chance to add a quick working folders checker / creator, tidy it up a bit and comment everything.


#!/bin/bash

# simple backup script
# by Glen Scott, glenscott.net

# this is a simple script to tar.gz certain folder locations and copy them to a SMB share
# this script should be run periodically from crontab
# you will need smbfs installed on your system or modify the samba mount method

# set smb server and auth vars
sharename="//ourserver/ourshare"
username="ourdomain\ourbackupuser"
password="passwordgoeshere"

#set mysql details
mysqlhost="localhost"
mysqlusername="root"
mysqlpasswd="mysqlpasswordhere"

#set which folder locations we want to backup, inc trailing slashes
#add more here and append to the appropriate tar line further down the script if needed

location1="/var/"
location2="/backup/"

#set temp files and folders
backuptemp="/backuptmp/"
savepath="/root/backup/"
filename=$(hostname).backup.$(date +%a).tar.gz
mountpoint="/mnt/smb"

# make sure our working folders are present and accounted for

if [ ! -d "${backuptemp}" ]
then
mkdir $backuptemp
fi

if [ ! -d "${savepath}" ]
then
mkdir $savepath
fi

if [ ! -d "${mountpoint}" ]
then
mkdir $mountpoint
fi

# tar up the files we want into the backup temp
tar -cf ${backuptemp}files.tar $location1 $location2

#dump the local mysql db into the backup temp
mysqldump "-h${mysqlhost}" "-u${mysqluser}" "-p${mysqlpasswd}" --all-databases --lock-tables > ${backuptemp}mysqldump.sql

#tar up the backup temp folder
tar -czf $savepath$filename $backuptemp

#connect the smb share to our mount point
mount.smbfs $sharename $mountpoint -o username=$username,password=$password

# copy the tar (could also move it but whatever you like)
cp -f $savepath$filename $mountpoint

# disconnect the share
umount $mountpoint

#all done

As long as you have smbfs installed, the above should work fine.

A word on smbfs: without it the above script will fail. You can probably install smbfs quite easily on your system with the command apt-get install smbfs (or yum if you’re using redhat/fedora, or whatever your flavor of package manager happens to be). I use debian, so apt-get works just fine for me.

A word on Crontab: You’ll need to add the script to your local cron to get regular backups.

I won’t go into hideous details about how crontab works, theres plenty of that on the net already. To keep it simple, if your distro supports it (most should) you can put a symlink to the script in /etc/cron.daily or /etc/cron.weekly which will give you a simple schedule.

If you want something a bit more complicated, you’ll have to mess with the crontab. I’m aware there are commands to get this done but I’ve always just edited the system crontab directly. Mine runs twice a week, on wednesdays and fridays, so my crontab line looks like this:

# m h dom mon dow user command
0 2 * * 3,5 root /root/backupscript

Righto, thats it.

UPDATE: I notice a mutated version of this script has been posted in this forum thread over at linuxquestions.org - cool! Check it out over there if you want to see what someone else has done with it.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

The deal is, I’m wanting to publish stories and other standalone type pieces of writing on this site, and I want to create them as nice friendly text wordpress pages, but I don’t want each and every story to appear as a default pages link. The titles are long, there’ll be a few of them, and they’ll screw up my page layout if included in the pages menu(s), especially in the top nav bar where theres limited space.

To change this behavior, you just need to go into your theme template files and add some parameters to wp_list_pages(). The definitive list of parameters is over here and is worth a read:

http://codex.wordpress.org/Template_Tags/wp_list_pages

The most useful ones for this task are ‘include’, ‘exclude’, and ‘depth’. You can string multiple parameters together using the ampersand & character like so: wp_list_pages(foobar=1&moobar=2);

Include and exclude will do as they suggest, given a comma delimited list of page numbers. If you use include it will only include the specified pages, if you use exclude it will include all except the specified pages.

I decided a better way to get it done, actually ideal for my purposes, is to create all my ‘hidden’ pages in a subcategory, and set the depth parameter to ‘1′. This means any page created as a subcategory will not appear in the navigation menus, though it can be explicitly linked to, or appear in a list of links for that subcategory (exactly what I want).

The Widgets file

I managed to sort out the top nav bar page listing on my template pretty easily by making the change to the header.php file, but I couldn’t find anything immediately obvious generating the page listing in sidebar.php, or any of the other theme includes. After some bumbling around trying to figure this out, I discovered the sidebar listing was being handled by wordpress widgets . This was pretty easy to fix once I found out where the widgets file is (/wp-includes/widgets.php), although since it uses an array for the parameters its slightly different than the edit above.

You have a few options for changing how the pages display through the wordpress widgets control panel, but sadly no way to exclude sub-pages by default. This would be a cool thing to have available, and I’d write it into the widget file and make my version available, but my php is far too rusty at the moment for this even though its pretty simple.

Ok, how to do it manually. Open up the widgets file for editing and find the section which defines function wp_widget_pages and add to the line which starts as follows:

$out = wp_list_pages (array ('title_li' => '', etc etc and add to it the parameter ‘depth’ => 1, so it ends up looking something like this:

$out = wp_list_pages( array('title_li' => '', 'depth' => 1,'echo' => 0, 'sort_column' => $sortby, 'exclude' => $exclude) );

Thats it. save the file and your side menu should hide all pages in sub-categories.

Also, there is this plugin I found over here which interferes somehow with wp_list_pages(); to cause the change everywhere the function is called. Might save having to mess with multiple places in the template / widgets file depending how your theme is set up. (Mine has pages listed in a top nav bar as well as a side menu, for example).

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

Preamble: Our new staff laptops are pretty fantastic. Faculty has an initiative subsidizing the cost of deploying tablet notebooks to all schools in Computing and Health Science. I already had one of the few X41s which were wasting away in storage when I arrived: nobody seemed to want to use them becuase they apparently underperformed. I dusted one off and moved from the T42 I was using to the X41, and found the reduced footprint/weight to more than make up for any loss of grunt.

So the new machines have landed, and they’re the very capable Lenovo X61. I’ve had one for a month or so running alongside the X41. I would have made the transition without delay, as the new hardware is better in many respects, and I’m not that biased against Vista that I would avoid upgrading for that reason alone (Vista is mandatory on these new machines to increase staff exposure to the O/S), but theres been a major sticking point, and thats support for my favorite XP encryption solution, Truecrypt with TCGINA.

I’ve had at least one laptop stolen in recent years, and while no important data was lost / exposed via the theft, I now have a heightened awareness of the danger of carrying unencrypted data around. TCGINA does a great job in XP of hooking into the login process and pre-mounting your encrypted storage even before the user profiles are loaded, which means that data can be stored there as well. This effectively means that your desktop folder, my documents, IM data, browser (IE or FF) favorites and history and the like are all stored safely. If the device is lost or stolen, without your password, that sensitive file you left on the desktop isn’t sitting there exposed on an unencrypted diak waiting to be harvested by a forensic undelete utility.

Truecrypt 4 with TCGINA is broken on Vista

Vista takes a different (non GINA) approach to handling the login process , so TCGINA no longer gets it done. This was a real headache: I needed to be using Vista for work but wasn’t comfortable with an unencrypted portable system. (This is before TrueCrypt5 was released - more on this shortly). The X61 has a TPM and thus (any big brother TPM/Vista backdoor conspiracy theories aside) bitlocker should have been an option, but because of the partitioning setup on my notebook, it isn’t. This is because bitlocker works by creating a separate primary partition (size ~1gb or so) on your drive to stick its bootloader and encryption software.

Problem was, I already had the maximum 4x primary partitions. I’m never satisfied, so after installing Vista I went in with a linux livecd and gparted (gnome partition GUI, like travelling first class compared to being jammed in the luggage bay using fdisk) and sliced it up so I could have three additional OS’s booting natively. These were Ubuntu, Backtrack 3 Beta, and WinXP SP2 - (the latter being a real adventure to get co-habitating peacefully with the others, due to an unfortunate tendency to blat whatever bootloader I was using with its own apon install).

Eventually it all worked, with GRUB on the boot partition loading up whichever of my 4 OS/s I wanted. On a side note, whenever I messed with the size of the Vista partition (gparted handles ntfs partition resizing fine) Vista would fail to load until I went in with the vista boot dvd and ran the very simple repair/rescue procedure. Did this each time, and then it was fine.

(I’m aware that alternative bootloaders such as XOSL can supposedly work some magic when it comes to maximum / types of partitions and the O/S’s loaded from them, but I have yet to try it. )

So having reached this stage things were mostly groovy, my 4 OS’s on one machine, but with no encryption whatsoever. At this point, I would have been happy to have it on the Primary O/S only (Vista) as the others were mainly for testing and would be unlikely to have any sensitive data on there, but even that seemed out of reach due to the TCGINA/Vista broken-ness.

So what to do?
Answer: Truecrypt 5 rocks and is not broken on Vista

Midway through pondering how I was going to find a solution, a rescue came along: TrueCrypt 5 was released with a major major feature added: the ability to encrypt entire system & boot partitions.

This was pretty much holy grail stuff to me at that point.

I wasted no time in firing up the new Truecrypt on Vista to see if the promises were true. Summary: some of them are. Its good, but not perfect. It didn’t work “out of the box” (but then bitlocker didn’t work at all): There were hiccups because I had GRUB as my primary bootloader (TC5 refuses to deal with anything but the windows bootloader) and I was unable to encrypt my entire disk, as I initially thought I’d be able to do, because my partition setup included logical partitions (this scenario throws an error after you try to process a whole disk which contains logical partitions).

So to get it working? First, I had to nuke GRUB from the primary partition, and set it up on the secondary so I could still access my linux installs. This was pretty simple: I booted into Ubuntu (which is where my grub config lives) and installed it on the second partition via some simple GRUB commands which I googled and now cant remember (partition 2 happens to be where XP is installed), then booted up with my vista dvd and let it replace the primary bootloader.

It is probably worth noting that I also had the Backtrack distro* installed on one of the logical partitions (along with a swap partition and an independently encrypted truecrypt partition), and GRUB could load Backtrack fine throughout this process, as its location didn’t change. (sda6).

After that it was as simple as running the truecrypt system/boot encryption wizard from Vista again, allowing it to create a recovery CD (backup of the volume headers in case of corruption or a changed, forgotten password) and waiting for a couple of hours while it processed my vista system partition, live.

Voila - it works. My Vista partition is now secure, and my other OS’s boot fine, albeit unencrypted. The next step is to reorganize everything so I can get rid of the logical partitions and hence do a proper whole-disk encryption to cover both my Windows and Linux installs. I’m sure theres a post in that.

* Backtrack is a Slackware based livecd distro loaded with a plethora of security tools. Since my primary laptop is usually of the subnotebook/ultraportable breed and hence doesn’t usually include a CD/DVD drive, I’ve previously installed backtrack to a USB key and booted off that, but its easier to have it integrated as a boot option, epecially with nice large hard drives making the 3GB or so loss of usable space hardly noticable.

UPDATE: I have since received a few queries about this article via email and clarified it a bit, so I’ll post the emails and responses below.

John: Hello,
i read your article Quad boot with Linux, XP and Encrypted Vista on the Lenovo
x61 Tablet, but there is not much details. My problem is that i have 2 primary
partitions, 1. is winxp, second is linux. I have grub loader. So my problem is
after i will encrypt my windows primary partition + use pre boot lock stuff from TC, how my grub loader will work? Because if i understand well TC boot lock will delete MBR a put own code overthere.
Thanks for your reply.

Hi John

I have not encrypted WinXP with Truecrypt yet, only Vista, however I suppose it is more or less the same.

To answer your question: When you encrypt your windows partition it will install the TC bootloader on the MBR, and yes it will overwrite GRUB.

What you need to do is install GRUB on your linux partition before running truecrypt in windows. You will need to boot into linux and run some “grub” commands (suggest you google them) to install it to another partition/drive. (It is ok to have the grub bootloader installed on two drives at once). Once you have encrypted your windows system partition, the Truecrypt bootloader will detect any other bootable drives on the system and give you the option of booting from them instead of your encrypted windows when you start up. (They will not be encrypted or otherwise protected by truecrypt, but they will be bootable)

John: Ok till that part its clean, u mean just install grub not into MBR but on the linux partition where the linux is. Dont understand what u mean by grub will be installed on two drives at once, u mean MBR + linux partition?

Yes, you install the grub bootloader onto your linux partition. After that grub will be *temporarily* installed two places at once, but only until you run fixboot+fixmbr, after that the Windows bootloader will be restored to the primary drive/partition.

If I recall correctly, truecrypt will not do full system encryption while you have GRUB on the primary MBR, so once you have installed GRUB on your linux parition/drive, you need to replace it on the primary with the default WinXP bootloader (easiest way is to go in with the WinXP boot cd, go to the recovery console and use the “fixboot” and “fixmbr” commands). Once you have done this, boot back into windows (should go straight on with no sign of grub) and TC should encrypt your windows system partition fine.

John: Here is a place where i completly got lost. What do u mean by primary MBR? Ok anyway why do i have to put grub to primary? Didnt u say that its enought to install grub on linux partition, and simply overwrite MBR by truecrypt? Why do i have to do fixmbr and stuf…

fixmbr and fixboot are the microsoft command line tools for restoring the default windows bootloader. You need to do this because truecrypt will not encrypt a windows partition which has grub installed as its primary bootloader. Truecrypt then replaces the windows bootloader with its own bootloader which will then launch windows (encrypted) and also any other bootable drives/partions (ie your linux one with GRUB installed) that it finds.

So a basic sequence of things you would do:

1. Boot into your linux install and install the grub bootloader onto the linux drive/partition
2. Boot into windows recovery console (winxp cd) and restore the default bootloader (fixboot/fixmbr)
3. Take cd out and boot up normally - grub should be gone and you will get into windows.
4. Run truecrypt and encrypt windows partition
5. Next time you boot up, TC bootloader is there and you can boot straight into windows or grub/linux.

Hope this answers your question!

John: Thanks a lot, –=John=–

Hope this helps anyone else as well  =) - Glen

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

It should be noted that most of this gripe is based on experiences with Pocket PC 2003 and its predecessors. WM5 and WM6 are recent additions to the fold for me, and a number of the mentioned issues seem to be, if not solved, at least partially smoothed over.

So far, so far the strongest argument I’ve yet encountered for blowing Windows Mobile away in favor of some flavor of embedded linux is the WM implementation of networking. A real shame because aside from that, WM more or less seems to get it right - decent information management, desktop / remote email sync (when you can get past the networking hurdles), and with third party tools, enough access to the internals to keep a techie happy. Except the networking interface.

Windows mobile networking has generally confused me. As a network admin, I’ve dealt with plenty of odd setups, but Windows Mobile truly does take the cake. After a few hours of mind games you’ll likely be begging for a simple ‘do what your told’ setup as opposed to the ’second guess you because we know better’ philosophy that WM6 seems to adopt.

I have messed around with these devices for longer than I should admit. Many a time I’ve had everything working - for a while. Then it stops, develops amnesia, stumbles about disoriented. Losing wireless has the device utterly, and inexplicably confused, and too often for happenstance a hard reset will get things going again - with the exact same config.

Indeed, there seems to be a new definition of logic when it comes to how networking should function, and often a setting will seem to have no effect, or the result will be inconsistent. It will work for a while then stop. One application will work fine, but another will not. Changing a seemingly unrelated networking parameter has ramifications: things start working in an unexpected fashion or not at all.

The approach seems to be akin to a puzzle game with a random element as opposed to a tool designed to achieve an outcome. Sometimes it will work, sometimes will not. The same inputs to the black box will not always render the same output.

Now I’ve had a bit of a dubiously qualified rave, making vague accusations and pointing my finger about the place at indistinct phantoms, here are some actual specifics I have encountered.

Most, if not all of the headaches come from the implementation of multiple networking profiles - “My Work”, and “The Internet”. Now this multiple config setup could have been cool, if they hadn’t crippled them both in subtle and painful ways. Setting them up in seemingly logical configs does not work (ie you expect to connect to a network, access that network through a proxy if specified, access it directly if not).

After many many hours of trial and error I found some answers on the net which pretty much confirmed there wasn’t much to be done except half baked workarounds. I’ll outline the situation briefly; Its been a while since I struggled with them properly, but heres the gist:

• Options for the different networking areas are buried, entwined, and otherwise concealed within layers of subterfuge - idiosyncratic ways to get to oddly named tabs and mislabeled options, labels and check boxes. I can only assume this is to prevent joe businessman getting into the settings to mess them up, but they do equally well at confusing IT techs who expect some kind of consistency with other configuration standards. I’ve been hoping since the pocket PC days that they would throw all this out and start again, but sadly WM6 seems to have retained most of it.

• “My Work” traffic is defined by the device as any server accessed without a period-delimited dns entry. Whaa… So ‘ourmailserver’ would be accessed through whatever the ‘My Work” profile uses, but ‘ourmailserver.internaldomain’ won’t be. You don’t get an option to change this. Also, its not specified or appear to be documented anywhere obvious on the device.

• To get to the internet via a connection associated with the ‘My Work’ profile, you must have a proxy server entered. You do not get a choice. No proxy, no internet, regardless of whether you happen to have direct access or not.

• You can specify a list of addresses NOT to use the proxy/internet profile for. (Exceptions). This seemed to be a workaround to get access to the net via VPN from the wireless network on campus (see below).

• Activesyncing the device with a PC seems to arbitrarily replace the proxy settings on the device with the proxy settings of IE from the PC being synched. It took me a while to figure out this is why my old bosses settings would work for a while on his GPRS plan (which uses a proxy server on the ISP’s network), then die (after he docked his pda and the settings were replaced).

• VPN-ing only seemed to be allowed through an ‘internet’ connection. (this might have changed in WM6 - except… well see the next point). In WM5 The device assumes you will never be connecting to a VPN from the ‘My Work’ network. Wrong in our case, as we connect to a VPN internally when using wireless - 99% of how the PDA works. To get this working, the wildcard exceptions workaround needed to be used.

• VPN in WM6 - what VPN? It doesnt work. Sets up fine, then never offers to connect, and attempts to connect manually fail silently. Less than ideal. Fortuantely re-jigging the new devices to use our internal proxy seems to work for most functionality.

• Pocket IE is hardwired to obey the O/S proxy settings. Often I was unable to access web pages because of some internal device proxy confusion based in the proxy settings (third party tools would show clean pings and connections possible to the proxy server and / or the destination server). It is notable that I could often get pocket mozilla (minimo) and pocket opera to load pages when pocket IE would not.

• Pocket MSN seems very sensitive to proxy settings. I have only ever had it working when the device has a direct connection to the net, wither via activesyncing to a PC which has a direct connection, or using GPRS.

Complaining like this smacks of heresay, because its hard to be specific about just where and in what manner things are broken. The place is like a wall of mirrors - and the diatribe sounds like someone ranting on without qualification. It sounds like the ravings of a lunatic, of a n00b, of a crazy man.

In truth, a lot of the complaints I have had seem vapous unless you’ve experienced them yourself. I know - I know these problems exist because I’ve sat for hours struggling with the damn things, and I’ve managed to set up plenty of networking devices before, and they work, so I have to lay it back on the device in question rather than any outstanding incompetence on my part.

I think the problem is this: if you add to the various configuration craziness mentioned before the fact that wireless can be flaky, you have a test environment with shifting terrain which makes it difficult to baseline and describe properly, let alone start mapping out solutions. Regardless, Windows Mobile devices are set to become part of the widespread IT landscape at my workplace very soon, and it will be at least partly up to yours truly to ensure it happens as smoothly as possible, so a-testing I must go.

UPDATE: I have posted a few solutions to some of these issues in the post Windows Mobile 5/6 Networking Profiles, Proxy and VPN setup.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.

So the challenge is on to create a fully functional, useful cluster.

A couple of smaller academic clusters have already been set up and are in various states of functionality: these are ok for a bit of experimentation and concept work but there is a push to get a serious cluster in place for serious industrial work horse activity with potential grunt tasks ranging from render farms for multimedia departments, to encryption/password cracking for law enforcement.

I sat down with the IT manager the other day to sketch out some logistics and a rough budget. Its a pretty interesting venture. We’re looking at a 180+ node cluster of P4 2-3Ghz machines, with a further expansion of the project within a year to include another 30+ 64bit 3.8Ghz machines. A couple of our old Xeon servers will likely end up as head nodes, with most of the projected budget going into the networking/fibre storage gear that will be necessary to supply decent bandwidth to the nodes.

So I’m currently shopping around for some clustering solutions. Not knowing a whole lot about clustering and distributed apps yet, I’m currently researching and pondering the best way to get this done. I took a look at Windows Cluster Server 2003 but didn’t even get to the install stage as a minimum hardware requirement is 64bit CPU’s, and as mentioned previously we wont be there until next year at the earliest.

The school is keen to see a Windows cluster in place as proof of concept, as the linux version has already been tested (ROCKS with Ganglia).

Several hours worth of digging around the storeroom for KVM, power, cabling and network gear later, I had a 4 node test cluster setup and wasted no time in firing up clusterknoppix to get the ball rolling. All the cool stuff I imagined would be in there are, such as inbuilt DHCP/TFTP from the head node along with automatic zombification of potential nodes via network boot/PXE. At the moment the nodes are PXE-ing ok but failing to join the cluster for some reason, an issue I’ll be working on next.

Once the test is running, it’ll be mostly a case of ironing out the logistics of making it bigger: and of course once this sucker is off the ground, the next fun part will be deciding what to do with it.

Some potential applications:

• Distributed password cracking / rainbow table generation

• Graphics rendering (eg lightwave, 3Ds, blender)

• Grunt calculation/statistics apps (eg MATLAB)

Lightwave has its own renderfarm type solution called ScreamerNet which has apparently been ported to linux, which may be useful. I’m actually pretty excited about the renderfarm potential of this cluster, and I’ll be looking more closely at screamernet in the coming days.

Accounting and Job Scheduling /Queuing

One of the interesting facets to the task is, once we get the actual cluster up and doing whatever it is we want it to do, we need to create a reliable job scheduling / (possibly credit based) charging system for compute time. At the moment I sort of envision a web page based system providing a common interface so other departments can log on and reqisition chunks of nodes for various tasks, put any files etc necessary on the network, and have nintely percent of the admin work done for them.

Fortunately I have access to a good developer here who I will be working with on the charging system: it will be interesting to see what we finally cook up.

Visit glenscott.net for more content. Some rights reserved: Except where specified otherwise, the content of this feed is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.