Feb 15 11:34:34 localbox ovpn-client[2621]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 15 11:34:34 localbox ovpn-client[2621]: TLS Error: TLS handshake failed

Due to this, I’ve come up with a routine to work around the problem. First, you need to make sure you can SSH in from outside your network. The settings I use look like this:

Assuming you can still SSH in, the process to restart the OpenVPN server is pretty simple. Just use the option -D and specify a port, to set up a proxy for your web browser.

ssh -D 1800 root@yourtomato

After that, configure the proxy on your local machine or browser to use localhost on port 1800, and you should be able to reach Tomato on its LAN IP.

In SVN, I had set up a repository for each general area of coding I do, one for personal stuff, one for freelance work, and so on. In those, I had folders for each project. In the projects, I had folders for each version, basically a snapshot of the code at a landmark date. I looked and tried many different programs to convert them to git, but ultimately couldn’t find anything that worked. I took an alternate route: set up an empty Git repository for each project, copied the versions in, tagged them, and copied the next highest version in. I lost a lot of my history, but thankfully that didn’t really matter to me as long as I had the landmark versions.

It took me an entire day to copy and set up all my projects, but I’ve noticed myself committing more often with more descriptive comments and just pushing when I’m done, since it’s so much faster and less troublesome than SVN. I’m definitely no power–user, but I never really was with SVN either. I also really like the idea of each clone being an entire repository in itself, in case something were to happen to my main repositories. Overall, I’m glad I chose to make the change.

Anyway, I took a look through the available plugins for e-commerce and settled on the widely used WordPress e-Commerce. I installed it, set up a few test categories and items, and handed an admin password over for the client to give it a try and see if it was agreeable. As it turned out, there was a problem in the plugin where you couldn’t switch the editor from HTML to Visual or vice versa. Loaded up Firebug and found it wasn’t properly including a certain JavaScript file. I also noticed that it wasn’t properly uploading photos, and not applying category photos. Digging through the logs, I found it was trying to write to a not created directory, ./wp-content/uploads/wpsc. Created the directory, changed some permissions, and reinstalled the plugin. Everything was good again and the client was happy with the choice.

Exciting? Not really. I’m just glad it was an easily fixable problem, but I’m still not exactly sure why the JavaScript was failing when there isn’t any in the directories it created.

I updated to Ubuntu 10.04, also known as Lucid Lynx, on my server and SFTP in PHP applications stopped working. Turns out that the pecl build isn’t compatible with the version of PHP shipped with 10.04, as far as I can tell. I tried reinstalling it, but it wouldn’t build. Thankfully I found out that there’s a package of it available in the repos.

Here’s the new method to enable SSH in PHP, which makes SFTP in WordPress work again.

user@computer:~$ sudo apt-get install libssh2-php

Restart Apache and you’re on your way. Way simpler than before is just a nice bonus.

Anyway, click the “read the rest of this entry” link for the script if you want to look at it.

#!/usr/bin/perl -w
#
# Gtalk Highlight Notification
#
# Simple script that sends a GTalk Notification upon a highlighted word
# by almiteycow
#
#
# ---------------------------------------------------------------
# Jabber/GTalk implementation from
# http://www.pervasive-network.org/SPIP/Google-Talk-with-perl-bis
#
# by Thus0
# Copyright (c) 2005, Thus0. All rights reserved.
#
# released under the terms of the GNU General Public License v2

use strict;
use warnings;
use Xchat qw( :all );
use Net::XMPP;

## Configuration
## Put the account you'd like to send notifications FROM here. You might need to make a second account.
our $googleusername = "username";
our $googlepassword = "password";
## Put the account you'd like to send notifications TO here.
our $to = "notificationuser";

our $body;
our $resource = "PerlBot";

## End of configuration

#------------------------------------

# Google Talk & Jabber parameters :

our $hostname = 'talk.google.com';
our $port = 5222;
our $componentname = 'gmail.com';
our $connectiontype = 'tcpip';
our $tls = 1;

#------------------------------------

my $name = 'Notification Script';
my $version = '0.1';
our $state = 0;

register($name, $version, 'Notification Script');
prnt("Loaded $name $version");

foreach ('Channel Msg Hilight') {
	hook_print($_, &connectAndSend);
}
hook_command('notify', &notifytoggle, { help_message => 'Usage: /notify (0/1) to turn off/on notfications' });

sub notifytoggle {
	if ($_[0][1] == "1") {
		$state = 1;
		Xchat::print("GTalk Notification On");
	} elsif($_[0][1] == "0") {
		$state = 0;
		Xchat::print("GTalk Notification Off");
	} else {
		Xchat::print("invalid option");
	}
	return EAT_XCHAT;
}

sub connectAndSend {
	if($state == 1) {
		my $highlighted = $_[0][0];
		my $msg = $_[0][1];
		my $data = "@{$_[0]}";
		my $ircserver = Xchat::get_info("server");;
		my $ircroom = Xchat::get_info("channel");
		$body = "New Message from $highlighted: $msg on $ircserver$ircroom";

		my $Connection = new Net::XMPP::Client();

		# Connect to talk.google.com
		my $status = $Connection->Connect(
			hostname => $hostname, port => $port,
			componentname => $componentname,
			connectiontype => $connectiontype, tls => $tls);

		if (!(defined($status))) {
			prnt "ERROR:  XMPP connection failed.n";
			prnt "        ($!)n";
			exit(0);
		}

		# Change hostname
		my $sid = $Connection->{SESSION}->{id};
		$Connection->{STREAM}->{SIDS}->{$sid}->{hostname} = $componentname;

		# Authenticate
		my @result = $Connection->AuthSend(
			  username => $googleusername, password => $googlepassword,
			  resource => $resource);

		if ($result[0] ne "ok") {
			prnt "ERROR: Authorization failed: $result[0] - $result[1]n";
			exit(0);
		}

		# Send message
		$Connection->MessageSend(
			to => "$to@$componentname", body => $body,
			resource => $resource);
	}

	return EAT_NONE;
}

First, open an ssh connection to your mailcleaner server. I’m using Linux, if you’re on Windows, use PuTTY or something.:

ssh root@mailcleaner

The default password is “def”. Then, do:

nano /usr/local/share/spamassassin/72_active.cf

A quick little text editor should pop up. Hit Ctrl+W to do a search, and type “FH_DATE_PAST_20XX” into the search field. Hit enter. You’ll see a line like the following:

header   FH_DATE_PAST_20XX      Date =~ /20[1-9][0-9]/ [if-unset: 2006]

Change it to:

header   FH_DATE_PAST_20XX      Date =~ /20[2-9][0-9]/ [if-unset: 2006]

Ctrl+X to exit, and Y, when asked if you want to save. You’re mostly done. You just need to log into the admin interface and restart the applicable services. Or reboot, if you don’t know how to do that.

The part I’m not too sure about is when the rule will be overwritten. I haven’t investigated to see if mailcleaner is grabbing a new set of rules every so often or not, so I’ll just have to keep my eye on the scoring for now.

When I started working for them, one of the things I wanted to do was end this mess. Being a fan of open source software (and having a project budget of $0), I started poking around into the various options. At first, I was looking for something to hook directly into the server, but I quickly found that there was no cheap way of going about it. However, I did find that you could drop a spam filter gateway SMTP server right in front of it. I tried looking for an all inclusive package, but was unfortunately not able to, I was going to have to set it up piece by piece. I ended up setting up a postfix box, with spam-assassin, mailscanner, and some RBL checks. I spent about 2 weeks customizing it and setting it just right.

It worked well for about a year, but by then, the rapid Ubuntu development had broken many of the packages I installed, to the point that the server was barely able to boot. In addition, a few users were reporting false positives, and try as I might, I couldn’t release them from the quarantine.

I went back to the drawing board. This time, I took note of a piece of software called mailcleaner. It ran a setup very similar to the one I had custom made, except it was more of an all-in-one package. It promised to install and be configured within a couple of hours. It was the truth. It’s one of the easiest things I’ve had to set up. It wasn’t without its quirks though. I noticed the update process wasn’t working correctly. I poked around in the shell and documents, and noticed it was based on an old build of Debian (sarge). Updates for the OS had ended earlier in the year. Even the repository for the mailcleaner software itself wasn’t working. Quick fix for this, just change the repo locations. I had earlier noticed that the last update was scripted to replace the repo locations (I’m guessing this was a problem already), so easily inserted the new locations into the update script.

To do this, you run the updates like normal, until you get to the 2009012201 patch. You’ll need to edit the patch. It’s located at /usr/mailcleaner/updates/2009012201. Around line 32  you’ll see:

cat > /etc/apt/sources.list << EOF
deb http://archive.debian.org/debian sarge main non-free contrib
#deb http://archive.debian.org/debian-security sarge/updates main non-free contrib
deb http://pool.mailcleaner.org sarge mailcleaner
EOF

Replace the lines so it looks like:

cat > /etc/apt/sources.list << EOF
deb ftp://archive.debian.org/debian-archive/debian sarge main non-free contrib
deb ftp://mirror.switch.ch/mirror/mailcleaner.org/ stable mailcleaner
EOF

Apply the patch as per the normal instructions, and everything should go fine.

So, let’s start with specs related to this problem, for those of you who are looking for help for similar problems:

Abit IP35 Motherboard
ICH9R SATA controller
Western Digital Raptor Drives x2

Now, this may help people with a various range of equipment. I think it applies to a good portion of the Intel ICH series SATA controllers, and I bet it’s not just limited to my motherboard or hard drives. Leave a comment if it this helps you, so other people searching can find the answer as well. Read on for more information.

Now, it started when I tried to upgrade to 7. I backed up all my data and shut down. I had come across another WD Raptor in my travels, so I figured, why not use the RAID ability of my motherboard to add a striped RAID0 for the system disk. Installed them both, booted, set up the RAID in BIOS, and then booted up the disc and started the install. I was pleasantly surprised to see that Microsoft had added the SATA drivers for my motherboard, so the RAID partition showed up promptly and correctly. I followed the prompts and let it install; everything went swimmingly, it was the quickest easiest Windows install I’d ever done. It went to go do the first of many reboots; I watched and waited. It continued setting up after the reboot, now running off the hard drive and doing the “configuring your system” part of the install. It was very very slow, but I was patient. Then all of a sudden, my system rebooted. That was OK, I figured, it was just doing another reboot for its setup. I was entirely wrong. Upon reboot it told me that something had gone wrong with the install and I would have to do it over.

After many reboots and configuration changes, I realized that it seemed to work fine if I had my motherboard in IDE or ACHI mode. IDE wasn’t an option, as I wanted the speed benefits. I was persistent, so AHCI wouldn’t cut it either. I tried many different versions of the drivers for the ICH9R: Intel’s, Abit’s, Microsofts. I tried loading them during install, loading them after I had it installed in AHCI mode. Nothing worked. Eventually I figured out that if I used a spare SATA drive I had laying about, I could install it on there and clone the drive back onto the RAID drives. I did so, and everything was happy, for a while.

Eventually, Windows 7 RC came out, and I would be forced to upgrade from Beta to RC starting July. I downloaded the new disc and burned it to DVD. Backed up my data, rebooted and started the process. I had a hint of remembrance for the last time, but I figured it was an update and a problem they had already noticed and fixed. Wrong again. Same problem happened. I forgot most of the process I did last time to make it work as well. I did try the other drive thing eventually even. Still nothing. I came around to noticing that the driver that was installed said “Intel(R) ICH9R/DO/DH SATA AHCI Controller”. I looked at the Intel Matrix Storage Console and nothing RAID related showed up. I figured there was something wrong there. So, I decided to try to force it into loading the RAID controller driver instead. To my amazement, it worked.

So, here’s the way to install Windows 7 or Vista on a computer with RAID on these components. Take note, you could definitely potentially screw up your computer and cause irreparable harm to it or yourself by following these directions. I take no responsibility.

1. Grab the latest Intel Matrix Storage software from their site and extract it, or grab the floppy drivers for the install, doesn’t really matter. Extract them wherever, maybe on a usb drive.
2. Install your OS onto one of the drives in AHCI mode, if it won’t install successfully, you’ll need to find a spare SATA drive and do it to that drive.
3. Boot into the OS and install the drivers, if you haven’t done it during the install.
4. You’ll notice the above Intel ICH9R SATA ACHI driver in device manager.
5. Launch regedit, and find these keys:
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesiaStor
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesiaStorV
   HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesmsahci
6. You need to modify the “Start” parameter of them, mine are set to the following: iaStor is set to 3, iaStorV is set to 0, msahci is set to 0.
7. Reboot, and change your BIOS setting to RAID before Windows starts.
8. You should now check device manager to see if it says “Intel(R) ICH8R/ICH9R/ICH10R/DO SATA RAID Controller”.
   
9. You can now clone your drive onto your RAID install, or just expand your drive into a RAID using the Intel Matrix Storage Manager program. I did the clone and it worked.
10. Enjoy!

I don’t like to use FTP at all when I can help it. It’s an old protocol and doesn’t hold up in regards to security. I could use FTPS, which is a Secure Sockets Layer over FTP, requiring a key exchange, but frankly, that sounds like too much work for me. Since I already use SSH and SSH has file transfer capability, I usually use that to manage things. It’s commonly called SFTP. Unfortunately, this breaks many apps that expect you to be using FTP, such as WordPress.

Little known to me was that this wasn’t the fault of WordPress; those glorious developers had already added ssh file transfer support to it some time ago. What was lacking was communication between PHP and SSH. When I researched online, I found instructions on how to get them talking to each other, which kicks in the SFTP support in WordPress. I’ll detail them here for reference. (Note, this is on Ubuntu Hardy, and I’m using Apache 2 and PHP5.)

user@computer:~$ sudo apt-get install libssh2-1-dev php-pear
user@computer:~$ sudo pecl install -f ssh2
user@computer:~$ sudo nano /etc/php5/apache2/php.ini

Find the section titled “Dynamic Extensions” and below, add:

extension=ssh2.so

Save it and exit, and then just do an Apache restart.

thanks to [Kevin van Zonneveld]

It turns out they’re actually some sort of fish bot network. That’s fish as in the thing that swims in the water, not so much the malicious hacker kind. There’s a ton of them (names here), usually ending with *coho, *trout, and *salmon. It’s something called Project Upstream. From their web page:

“Project Upstream is an organization dedicated to promoting social ideals through the use of exciting new technology. Our most well-known service is our swarm of robotic fish, which connects AIM users to each other. Robotic fish connections occur spontaneously, and also by request.”

Their mischievous method is they will message two people at random, pulling names from Google, twitter, digg, etc.. They’ll act as a middleman, disguising each chat participant’s screen name from one another, basically enticing them to talk to each other randomly. Both users will usually cluelessly think the other has messaged them, and most of the time respond accordingly to that. However, you might also end up talking to a more knowledgeable user, as you can request your own fish. Chat messages are sometimes modified with a pirate theme, or old tymey english, or other variants. You can opt out of the program by sending a message containing $optout to one of the bots.

To me, it seems like a Discordian version of the Omegle project. Also, it’s a great social experiment and good natured fun all around. Good luck little fishies!

[project upstream] [request a fish] [wikipedia] | via [nixie pixel]