I have a FON router which allow anyone to connect to Intenet via my network connection. I like the openess and idea behind FON but I do not want to get in trouble if someone do bad things and using my network connection.

One solution is to connect the FON accesspoint to a separate network segment and let all traffic from that network go through TOR, the onion router. 

Another feature is when I want to be anonymous on Internet I plugin my computer to that network segment.

Setup

I use OpenBSD as my firewall and the first step is to download, compile and configure TOR. I downloaded the tarball from https://www.torproject.org and used the normal procedure:

# wget https://www.torproject.org/dist/tor-0.2.2.35.tar.gz

# tar xzvf tor-0.2.2.35.tar.gz 

# cd tor-0.2.2.35                                                                                                                                                                

# ./configure&&make&&make install

Configure pf

I use a specific ethernet interface, fxp0, which will route all traffic into tor. 

--cut from /etc/pf.conf--

#Tor traffic

tor_if ="fxp0"

# Tor's TransPort

trans_port = "9040"

pass in quick on $tor_if inet proto udp to port domain rdr-to 127.0.0.1 port 5300 

pass in quick on $tor_if inet proto { tcp udp } to !($tor_if) rdr-to 127.0.0.1 port $trans_port

--end cut--

Configure tor

# cat /usr/local/etc/tor/torrc

VirtualAddrNetwork 10.192.0.0/10

AutomapHostsOnResolve 1

TransPort 9040

DNSPort 5300

Log notice syslog

#Log debug stderr

RunAsDaemon 1

Note: I know that best practice is to let the tor process run as non root user. That requires read access to /dev/pf and I did not bother to get it working.

Dhcpd config

I assume that a OpenBSD sysadmin knows how to setup dhcpd so I will just show the config addon I did to /etc/dhcpd.conf.

shared-network tor-net {

        option  domain-name "it-slav-tor-net";

        option  domain-name-servers 10.1.2.1;

        option  ntp-servers 10.1.2.1;

        subnet 10.1.2.0 netmask 255.255.255.0 {

                option routers 10.1.2.1;

                range 10.1.2.100 10.1.2.200;

        }

The ip-adress of the fxp0 interface is 10.1.2.1

Start tor

# /usr/local/bin/tor

Jan 10 20:52:48.880 [notice] Tor v0.2.2.35 (git-b04388f9e7546a9f). This is experimental software. Do not rely on it for strong anonymity. (Running on OpenBSD i386)

Jan 10 20:52:48.885 [warn] It's a little hard to tell, but you seem to have Libevent 1.4.0-beta header files, whereas you have linked against Libevent 1.4.14b-stable.  This will probably make Tor crash.

Jan 10 20:52:48.886 [notice] Initialized libevent version 1.4.14b-stable using method kqueue. Good.

Jan 10 20:52:48.886 [notice] Opening Socks listener on 127.0.0.1:9050

Jan 10 20:52:48.887 [notice] Opening Transparent pf/netfilter listener on 127.0.0.1:9040

Jan 10 20:52:48.887 [notice] Opening DNS listener on 127.0.0.1:5300

Final step

Plugin your fon router and enjoy!

Links

The hints to this article was found at:

•  https://trac.torproject.org/projects/tor/wiki/TheOnionRouter/TransparentProxy 

As an it slave, I have the same problems as most datacenters:

• Running out of space because of more and more machines get into the datacenter
• Overheating
• Powerconsumption

Added to the "normal" datacenter problems, I also have to deal with:

• Wife acceptance
• Noice, my neighbours has complained about the noice outside my basement.

To address this issues I will run a consolidation project to get fewer machines by using virtualization. As virtualization engine, KVM is choosed.

This article will describe some pitfalls I run into and how I solved them.

KVM plattform

KVM seems to be the future for virtualization within the Linux area since Xen has done some mistakes.

As I have good experience of running CentOS and has KVM included I decided to use CentOS as the plattform for my virtualization.

Issues

Bridge network

To let the virtual boxes has full access to the network you need create a network bridge, it is rather straightforward and well documented so I will skip this part. I used the documentation on Red Hat customer support. Why KVM requires a bridge instead of a normal NIC is another question

Snapshots

One handy feature with virtualization is that the virtual systems can be one big fat file at the physical host, this gives the possibility to make full backups without turning the system down a.k.a snapshots.

However to get snapshot to work the filetype must be qcow2 and raw is the default format.

It is possible to convert from raw to qcow2 format by running the command:

qemu-img convert -f raw -O qcow2 <virtualhost>.img <virtualhost>.img.qcow2

Remember to turn of your virtual system by running:

virsh shutdown <virtualhost>

After the conversion:

virsh edit <virtualhost>

modify the type and path, i.e.

      <driver name='qemu' type='qcow2' cache='none'/>
      <source file='/var/lib/libvirt/images/web.img.qcow2'/>

Start your virtual system:

virsh start <virtualhost>

Take a snapshot with:

qemu-img snapshot -c <snapshotname> <virtualhost>.img.preallc.qcow2

To create a full image of your snapshot you need to compile a more resent version of qemu-img then shipped with CentOS 6.2, I download a later version and compiled it from here, i renamed the new to qemu.img2 and copied it to /usr/local/bin

qemu-img2 convert -p -f qcow2 -O qcow2 -s <snapshotname> <virtualhost>.img.preallc.qcow2 <targetpath>

Beware: This command can use all your resources and may affect all your virtual systems, use nice and ionice to prevent it.

Disk I/O

After installing just a few virtual system I noticed that my physical host got alot of I/O wait, it can be seen by using tools like top.

To monitor this I installed the nagios plugins:

• check disk io, can be found here
• check cpu stats, can be found here
• check_libvirt, developed by op5 and an Howto

However it seems like that though my virtual systems did more or less nothing they caused alot of disk I/O on the physical system.

I did some investigations and read quite many articles, fiddled and tested. The following is what worked for me in my setup.

#1 Change disk scheduler

The disk scheduler can be changed on runtime by modify the file:

/sys/block/sda/queue/scheduler

to see what scheduler you use now:

cat /sys/block/sda/queue/scheduler

Change sda to the device you have.

The scheduler that worked best for me is deadline

echo deadline > /sys/block/sda/queue/scheduler

#2 Mount with noatime

A feature in Unix and other Unixlike systems like Linux is that it normaly stores when a file is accessed. So one read always produce a write and if you are using raid like morroring this get worse, one reade always generate several writes. This creates alot of overhead for a feature soldom used.

So change /etc/fstab so it will mount the file systems with noatime.
An axample:

UUID=a290aa4b-635c-45fa-b144-1fbef90b3735 /                       ext4    defaults,noatime        1 1

#3 Preallocation disk images

A real boost that is hidden in the featureset and not shown in the virtualmachine gui is using preallocation disk images. They cannot be created from the GUI so I install the virtual machine, turn it of and convert it afterwards.

qemu-img convert -f qcow2 -O qcow2 -o preallocation=metadata <virtualhost>.img.qcow2 <virtualhost>.img.preallc.qcow2

Change the path to new image name by editing the virtual machine settings

virsh edit <virtualhost>

Conclusions

In my opinion it seems like KVM is still a little bit immature or at least the tools to handle it. Maybe it would be a good idea to have one linux distro focusing on beeing the best platform for virtualization.

I am convinced that I can get even more bang for the bucks out of my installation if I learn how to tweak it even more, so if you have any hints, do not hesitate to contact me. Preferably as a comment to this blogpost.

Referenses:

• op5 Monitor, a nagios based enterprise monitor tool to monitor my environment
• check_libvirt, a nagios plugin done by op5 to monitor KVM
• check_diskio, a nagios plugin to monitor disk I/O
• check_cpu_stats, a nagios plugin to monitor cpu usage rather detailed
• Another blogpost which helped me
• KVM performance improvements and optimizations – Red Hat presentation

• Support for offline maps – no need to have online gmap connection
• Introducing IP traffic “weathermaps” i.e. a user friendly way to present traffic flows, being WAN or LAN traffic
• Display monitor data on external web i.e visualise and distribute the information to greater crowd
• Multiple of  time saving tasks such as multidelete, free text filter, save searches etc.

Having a modern easy to use proactive monitoring system is the core of assuring quality delivery of your enterprise applications to your user. However cool report and dashboards are great, if they require complex skills, many hours to set up and maintain -  the value is quickly gone.

With op5 Monitor v5.5 we introduce a number of features to make the information more presentable and understandable. We have made lots of new micro features to make the everyday change management easier and faster.

Major features in this release:   
•    Support for offline map
    ⁃    Now integrating the open streetmap (OSM) project, making the vizualisation of large networks easier and offline
    •    Support for IP traffic flow visualisation on maps or any background
    •    Publish op5 Monitor data / widget on external web service
    •    Multi tier host & service groups
    ⁃    A host or service group can now be part of another group creating a tree structure of dependencies.
    •    Multidelete – it’s always easy to add a new host or service to a system – now it´s easy to remove as well – saves lots of time!
Usability improvements:
    •    Saved searches
    •    Search on notes and comments and search in scheduling queue
    •    Free text filter
    •    Enhanced Alert history
    •    Authentication fallback

In total we have fixed and added more then 240 items in this release. Please let us know what you think – we focus on Your needs, just tell us!

Best regards
The op5 Team!

More about the new release

As a monitoring fanatic, I think that have mirrored disk without monitor the mirror is worse then not have a redundant disk system at all. If you think that you are safe and you are not, is worse then be aware of a risk and calculate with it.

This article will describe how I did monitoring my FreeNAS system mirrored disks status using Nagios or op5 Monitoring. I assume basic knowledge of Nagios or op5 Monitor and that a Nagios agent is installed.

Demarcation

This article will focus on GEOM raid monitoring. Of cource all important services should be monitored, like HTTP, CIFS, SMB, disk space, CPU Load, memory usage and so on. However that is basic monitoring knowledge and there is alot of documentation on the net howto achive that.

Monitor the GEOM mirror

The most interesting part is to monitor the GEOM mirror to make sure that that the raid1 is working. 

After some googleing I found check_geom, downloaded it and put it in /usr/local/libexec/nagios/ where the other plugins are located.

Add a line to /etc/nrpe.cfg

command[check_geom_mirror]=/usr/local/libexec/nagios/check_geom mirror

and test from Nagios/op5 Monitor host:

# ./check_nrpe -H fnas -c check_geom_mirror
OK mirror  - mirror/2TBmirror0 COMPLETE { ad6 , ad4 }

It works!
 

Configure Nagios or op5 Monitor

In /opt/monitor/etc/services.cfg at the op5 Monitor host

# service 'Disk Raid Mirrors'
define service{
    use                            default-service
    host_name                      fnas
    service_description            Disk Raid Mirrors
    check_command                  check_nrpe!check_geom_mirror
    contact_groups                 it-slav_mail,it-slav_jabber
    }

The result

I tested unplugging the SATA cabel to one of the mirrored disk and after a couple of minutes I got an Critical notification that my disk mirror is broken, I plugged SATA cabel and got a Warning:

After a couple of hours the mirror was OK.

Useful links:

• Previous article describing howto install nagios or op5 Monitor agent on FreeNAS
• op5, an Enterprise Monitor product company
• op5 Monitor, Enterprise Monitoring based on opensource
• Nagios, an excellent opensource monitor tool
• FreeNAS, very capable NAS based on FreeBSD

The widget keeps track of how many times the word "moln" appear on idg.se webpage and displays it in a easy view in The Tactical Overview.

Screenshoots from the different modes:

Links:

• op5 Sandbox with a live cloud widget online, registration is necessary
• Ninja, the new and inovative nagios gui
• Widget exchange area

Kudos to op5 support that has created this excellent widget 

Background

I have a need of GPS tag my digital photos. Unfortunatly a GPS device to my camera costs approx 230 Eur. In my humble opinion I think that is way of, especially considering that with some software in the camera any standard USB GPS reciever would do the job. They cost approx 40 Eur.

I have an Android phone where there is tons of apps that could create a GPS log whenever I want to, however it drains the battery in just a couple of hours. I want to track my routes at least a whole day without the need to charge.

The solution is to buy a GPS logger and after some research I found Ventus GPS Route Logger G730, and it looked like it would work with Linux.

This article will describe my experience making the G730 Ventus GPS Route Logger and Linux.

Using skytraq

According to webpages skytraq can be used to create GPX tracks from the G730 Logger.

Unfortunatly the skytraq software are not in the Ubuntu repos so I had to download and install it manually. It is downloadable from  http://code.google.com/p/skytraq-datalogger/

It is out of the scope for this article how to compile and fullfill the requirements needs.

When the GPS Logger is attached the following will show up in /var/log/messages:

Jan 15 14:13:08 it-slav kernel: [21689.101101] usb 6-2: new full speed USB device using uhci_hcd and address 3
Jan 15 14:13:09 it-slav kernel: [21689.316181] usb 6-2: configuration #1 chosen from 1 choice
Jan 15 14:13:09 it-slav kernel: [21689.319138] pl2303 6-2:1.0: pl2303 converter detected
Jan 15 14:13:09 it-slav kernel: [21689.332192] usb 6-2: pl2303 converter now attached to ttyUSB0

So now we can communicate with the GPS Logger:

peter@it-slav:~/dl/skytraq/skytraq-datalogger-0.5-1$ ./skytraq-datalogger --info
kernel version: 1.4.8 -- ODM version: 1.8.22 -- revision: 2008-10-23
log_wr_ptr:      28626
total sectors:   510
sectors left:    506
max time:        3600 s
min time:        1 s
max distance:    1000 m
min distance:    0 m
max speed:       1000 km/h
min speed:       0 km/h
datalog enable:  1
log fifo mode:   1
AGPS enabled:    0
AGPS data left:  none
baud-rate:       38400 bps

Get the gpx file:

./skytraq-datalogger --dump >20110310.gpx

And now a gpx file named 20110310.gpx is created.

Setup

There is a possibility to conifigure the behvior of the GPS logger with skytraq, however it is possible to configure more parameters in the Ventus G730 so to fully configure I had to install the windows software that come with the logger.

The configuration is rather strange, there is a possibilty to log per time, over a certain speed and distance for the following:

• General
• Walking
• Car
• Bicycle

How the device knows what type of vehicle I use for traveling and if the General settings override the others is undocumented.

Problems

Most of the time when trying to communicate with the logger it gives this message:

peter@it-slav:~/dl/skytraq/skytraq-datalogger-0.5-1$ ./skytraq-datalogger --info
No response from datalogger.

And after a few seconds it works again. Sometimes unplugging the device and connect it again helps. The behavior is very stochastic and some patience will help:)

The logger can be used as a GPS recever and the output is in standard NMEA format that GPSd understand. So if you want to use it together with your favorite GPS software it works. However my experience is that if you want to dump the output from the G730 Logger the GPS output must be turned of:

./skytraq-datalogger --set-output-off

Suggestion

I suggest that Ventus should open the specification howto communicat with the device so third part software could use the device. To hide that type of information do not provide any advantage, rather the opposite.

I wrote an email to them and the correspondence can be seen below. I hope this blog post will make Ventus change their mind.

–cut–

-------- Original Message --------
Subject: Sv: Ventus g730
Date: Mon, 3 Jan 2011 13:25:49 +0800
From: <support@ventusdesign.com>
To: Peter Andersson <peter@it-slav.net>
CC: Ventus <info@ventusdesign.com>

> Hi
>
> I have just bought a Ventus g730 GPS Logger and I have some feedback.
> Before buying the device I made sure that it fullfilled my requriements:
> -Works with linux
> (http://www.petrilopia.net/wordpress/hardware/ventus-gps-route-logger-g730-linux/)
> -Create gpx files
> -Battery that last at least 12 hours
>
> Unfortunately you have have taken a strange decision and do not support
> Linux. However according to several forums the G730 is compatible with
> http://code.google.com/p/skytraq-datalogger/
> After fiddling with the device I found that the skytraq-datalogger
> sometimes works and sometimes does not. And I probably will return the
> device to the store if I cannot get it to work better with an open and
> free operating system.
>
> My recommendations to you are:
> 1-Provide an open specification how to access the data in the device
> 2-Modify the http://code.google.com/p/skytraq-datalogger/ software so it
> works with G730 and provide the code change to the team behind
> skytraq-datalogger, and also provide the software on you website.
>
> By following these simple steps (especially #1) you will sell a-lot of
> more devices to the people that prefer open and freedom.
>
> Best regards
> Peter Andersson
> peter@it-slav.net
 

The dashboard has been modified and improved by the community and an example can be seen at op5 sandbox dashboard and can be downloaded from op5 community.

The original project place is http://dingleberry.me/2010/04/our-new-dashboard/

When I was preparing a presentation about what op5 is doing and our contribution to the community, I went to ideas.nagios.org. When I browsed the list of the biggest issues with Nagios I found out that op5 has packaged and solved them all in op5 Monitor. I encourage everyone to take a peak at the list and judge for them self what platform you want to use for your enterprise monitoring solution.

1. Nagios Clusters

op5 has developed Merlin (Module for Effortless and Redundant and Loadbalanced Infrastructure with Nagios). It provides the possibility to have a redundant or/and loadbalanced solution using Nagios. It also provides a scalable database backend for Ninja and Nagvis, take a peak at Merlin webpage.

2. Performance Graphing

In op5 Monitor op5 has added pnp4nagios that graphs more or less any check that gives a numerical value back.

3. New Status Map

We provide a new statusmap, it is a part of Nagvis project and called Automap. op5 has contributed to Nagvis by adding support for Merlin database backend and GoogleMaps integration

4. Better Interface

op5 has created a new PHP based interface that makes you proud of your monitor solution, called Ninja. Ninja stands for Nagios is now Just Awesome, it looks so good so you can show it to your manager:-) Take a peak at Ninja webpage.

We had a naming competition at op5 my suggestion to call it Yang, Yet Another Nagios Gui, did not get so many votes so the name become Ninja.

5. Configuration

Any one that has tried to configure Nagios by hand has thought bad thoughts. It is cumbersome and in the begining it makes even a skilled Unix admin frustrated. op5 has developed a web based configuration tool named Nacoma. It is included in op5 Monitor.

6. SLA reports

op5 has got alot of feedback from the customers and one issue was better reports, we have created two reports: availability and SLA report. Both of them can be scheduled and looks god compared to the reports in Nagios, they are included in Ninja

 
7. More members in core team

Well, this is something that op5 cannot controll, however, Andreas Ericsson one of op5s core developers are a member og Nagios steering board.

8. SNMP Trap receiver

This is something op5 is working on right now, we have today created a prototype together with a customer and depending of the outcome of that project we will know better when it will be available to the market.

9. UI-Improvment

op5s solution to this issue is Ninja, a better, nicer, scalable, database backend gui to Nagios.

10. Nagios Dashboard

A newTactical Overview with widgets or Nagvis, all included in Ninja

Links

• ideas.nagios.org http://ideas.nagios.org
• Nagios http://www.nagios.org
• op5 http://www.op5.com
• op5 Monitor http://www.op5.com/op5/products/network-monitor
• Ninja http://www.op5.org/community/plugin-inventory/op5-projects/ninja
• Merlin http://www.op5.org/community/plugin-inventory/op5-projects/merlin
• Nagvis http://www.nagvis.org/
• pnp4nagios http://docs.pnp4nagios.org/

I have found one way of still doing geeky things combined with vacation. That is update OpenStreetmap. Take a peak at my updates at:

• http://www.openstreetmap.org/?lat=56.4476895332336&lon=14.0158939361572&zoom=14
• http://www.openstreetmap.org/?lat=56.4213931560516&lon=14.0284895896912&zoom=14
• http://www.openstreetmap.org/?lat=60.1418289542198&lon=15.4323390126228&zoom=17

Openstreetmap is wikipedia for maps, and like wikipedia it is dependent of that people will update with correct data. One thing that fascinates me is that openstreetmap is extremly detailed in some areas. Probably a geek lives nearby.

When the earthquake hit Haiti, OpenStreetmaps was used by rescuers because all other maps was inaccurate. Alot of volunteers helped keeping the maps updated.

If you want to participate in the project, the process is simple:

1. Get an GPS reciever that can generate gpx tracks, I use my Android
2. Turn on the GPS and walk, run or bicycle around and gather GPS tracks
3. Upload the gpx to openstreetmap.org
4. Tag the roads, buildings and whatever you found

 To get started, read the beginners guide at Openstreetmap.

Finally it has arrived, Android 2.2 Froyo to HTC Desire. When I installed it I run into several problems and this is my guide how I solved it. It was a rather frustration experience and took a long while to solve. I ended up with a phone where almost everything was gone and I have to reinstall all my apps and configurations again.

I have not rooted my phone or changed anything that HTC or Google allow, so no rooted phone. I’m probably a poweruser but there is no obvious reason why I ended up with all these problems.

During this process I tried to find any information at HTC support site but I could not find anything that helped me. The best source of information is to use different user forums. My opinion is that HTC support web is crap.

This guide shows how I solved the problems I run into, I guess there is better way of doing it because this was a cumbersome and painfull process. I do not take any responsiblity if you end up with a bricked phone or loss of data.

Happy reading!

Installing, first try

Roumors on a swedish site, swedroids.se claimed that Froyo was out. My Desire had not given me the message that an update was available automatically as it should. Probably it just do not check with a high enough frequency to detect it.

I did a manual check and yipii, there was a system update available.

I choosed to do the update over the air, meaning that I used the phones update function.

After downloading and installing approximatly 30 minutes, the phone just showed the HTC logo and after that rebooted over and over again.

My conclusion was that the update has failed.

Recover, first try

I pulled out the battery and put it back again, pushed vol- and power and keept vol- pushed. Then I get into a menu where I could do some choices, I picked recover.

Now the phone managed to get passed the HTC logo and started up. It gave i progress bar starting from 0%and counting up to 92%, after a while it showed an error message "Sorry! Process system is not responding" with 2 options "wait" or "force restart" (or similar). Independent of which I pick or none, after a while the phone restarts with the same progress bar and error message. 

Install, second try

At this moment a couple of hours has passed and I was getting real frustrated. Google and swedroid forums showed me that alot of people seemed to have the same problems as I do.

I find the following guide that seemed to helped alot of people:

1. Download the Android 2.2 firmware for the Desire http://liveimage.htc.com/OTA_Bravo_Froyo_HTC_WWE_2.09.405.8-1.21.405.2_release4dua3bcrut4wrv30.zip

2. Rename the file update.zip and copy it to your microSD card via USB. I used an USB 3G dongle with an microSD reader.

3. Power down your Desire

4. Hold down the “Volume Down” button as you power the phone back on.

5. A screen should appear showing your phone’s system searching for various files. Scroll down to “recovery” and press the “Power” button.

6. When you see the triangle with an exclamation point symbol, press the “Power” and “Volume Up” buttons at the same time.

7. From the menu that appears, select “Apply sdcard:update.zip.”

8. When the screen displays “Install from sdcard complete” select “reboot system now” and wait for the phone to power back up.

It looked very promising, with text and progressbars showing that an installation was taking place. After a while the phone restarted and stoped with a triangle and exclamation mark. I tried it again and again and again…. With the same result.

Calling for help

At this point I get real desperate so I went to HTC supportweb and wrote an email describing my problems. After 1½ days I have  got an email that told me to send the phone to repair. 

Then I tried to call HTC support, they answered very fast but the support only told me to send the phone to the reseller to get it fixed. No trouble shooting at all and no questions what I have done.

Because I have important data, like logins to mail account, sip PBX, monitor solutions, facebook account and so on I decided that I would not send in the phone until I have waited a couple of days to see if something new shows up on different forums.

Install, twentieth something try

At this point I realized that all my settings will be lost I did a clean cache and a factory reset and did a new try with manual installation and this time it looked all right. The phone started up normally and asked for email accounts, facebook credentials and so on.

All my personal settings and data was gone but the phone seemed to work. I started to download a app and the phone rebooted again, sic. Everytime I installed a new app it rebooted and the app did not install.

But I remembered that I read that this was a common problem I searched the forums and did some Googling. Some people has solved this issue by do a "factory data reset" from menu->settings->SD & phone storage->Factory data reset.

So I tried that and everything was gone again, I entered the credentials to my accounts and did some setup. And tried to install a new app, and YES it did not reboot.

Conclusions

This behavior by a product that I have not hacked in any way is not acceptable. I work at a software company and know that there might be bugs but these bugs was so big and costed me so much time that it should have been tested better.

Even worse is that HTC support website give no hints what-so-ever how to solve these issues I had and HTC telephone support did not even try to help me. I think HTC has a lot todo to get a better and more professional support.

In this case enthusiasts and helpfull people that publish their knowledge helped me and probably many others, thanks. Especially swedroid.se which is an excellent site where swedish speaking people can get help with thier expensive Android phones.

I also think that HTC should encourage enthusiasts by be more open and support the possiblity to root the phones. I think that they will make more money in the long run, compare it with Linksys routers and OpenWRT.

Update-Aug 8:th 2010

I was contacted by HTC UK to get more feedback to their support site. It always make me happy when a company listen to the customer and try to improve the customer experience. Hopefully the HTC support web will contain enough info in the future so I could resolve the problems I had by going there. Good work HTC!

- OpenBSD 4.7 RELEASED -------------------------------------------------

May 19, 2010.

We are pleased to announce the official release of OpenBSD 4.7.
This is our 27th release on CD-ROM (and 28th via FTP).  We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.7 provides significant improvements,
including new features, in nearly all areas of the system:

 - New/extended platforms:
    o OpenBSD/alpha
      o Added support for the DS15/DS25/ES45.
    o OpenBSD/loongson
      New platform for systems based on the Loongson 2E and 2F MIPS-compatible
      processors. Supported machines include:
      o Lemote Fuloong 2F mini-PC
      o Lemote Lynloong all-in-one-PC
      o Lemote Yeeloong netbook (8.9" and 10.1" models)
      o EMTEC Gdium Liberty 1000 netbook
    o OpenBSD/sgi
      o Added support for multi-node SGI Origin systems, in M mode.
      o Added support for the SGI Origin 350, Onyx 350, Onyx 4 and
        Tezro systems.
      o Added SMP support on the SGI Octane.
      o Support for many more onboard devices on Octane and Origin systems.
    o OpenBSD/socppc
      o Added support for the RouterBOARD RB600A.
    o OpenBSD/sparc64
      o Preliminary support for running OpenBSD in a guest domain on top of
        an OpenBSD control domain on sun4v machines.

 - Improved hardware support, including:
    o Revamped SCSI midlayer and improved driver support.
    o UDF 2.5 and 2.6 (HDDVD and Blu-ray) disks support.
    o Added mpath(4), a driver that steals paths to scsi devices if they could
      be available via multiple paths and then made available via mpath(4).
    o New aibs(4) driver for ASUSTeK AI Booster hardware monitoring.
    o New uthum(4) driver for the TEMPerHUM USB temperature and humidity
      sensors.
    o New utrh(4) driver for USBRH temperature and humidity sensors.
    o New uyurex(4) driver for the Maywa-denki & KAYAC YUREX twitch/jiggle of
      knee sensor.
    o New urndis(4) driver for remote NDIS Ethernet over USB devices (phones).
    o New xf86-video-wsudl(4) Xorg driver for USB DisplayLink devices
      supported by udl(4).
    o New mpii(4) driver for LSI Logic Fusion MPT Message Passing Interface II
      based SAS 2 controllers.
    o New athn(4) driver for Atheros IEEE 802.11a/g/n wireless network devices.
    o New alc(4) driver for Atheros AR8131/AR8132 10/100/Gigabit Ethernet
      devices.
    o New lisa(4) driver for STMicroelectronics LIS331DL MEMS motion sensors.
    o New gcu(4) driver for Intel EP80579 Global Configuration Unit.
    o New lom(4) driver for LOMLite and LOMLite2 as found on many of Sun's
      UltraSPARC-IIi servers.
    o New vsw(4) driver for virtual switches on sun4v machines.
    o New vds(4) driver for virtual disk servers on sun4v machines.
    o Support for EP80579 integrated Ethernet and ICH9 M V has been added
      to em(4).
    o Support for 82599 and SFP+ 82598 devices has been added to ix(4).
    o Support for the Sun GigabitEthernet SBus Adapter 1.0/1.1 has been
      added to ti(4).
    o Support for SBus variants of the QLogic Fibre Channel host adapters
      has been added to isp(4).
    o Support for SBus variants of the Sun Gigabit Ethernet has been added
      to gem(4).
    o Support for Intel WiFi Link 1000 and Intel Centrino
      Advanced-N 6200/Ultimate-N 6300 has been added to iwn(4).
    o Support for Ralink RT3572 based 802.11n devices has been added to run(4).
    o VIA Tremor 5.1, M-Audio Revolution 5.1 cards has been added to envy(4).
    o New uhts(4) driver for USB HID touchscreens.
    o Improved touchscreen support in the xf86-input-ws(4) Xorg driver and
      improved calibration using the new device properties from Xinput.
    o Support for ON CAT6095 and ON CAT34TS02 temperature sensors added
      to sdtemp(4).
    o Several improvements and bug fixes to existing Ethernet drivers,
      including em(4), re(4), ti(4) and vge(4).
    o Support for the PIC PCI-X controller added to the SGI xbridge(4) driver.
    o Support for the onboard Fast Ethernet interface found on SGI Octane
      and many SGI Origin family systems, iec(4).
    o Support for more SGI input and video devices on Octane and Origin
      systems, with iockbc(4), impact(4), and odyssey(4).
    o Improved PCI resource allocation; more hardware left unconfigured by
      the machine's firmware (including hotplugged hardware) should work now.
    o Support for recording/full-duplex added to mavb(4).
    o Improved support for USB audio devices in uaudio(4).
    o Improved support for bwi(4) devices on strict-alignment architectures
      like armish.
    o Eliminate usage of SCSI tagged queueing mechanisms other than simple
      queuing, thus avoiding incorrect implementations on various disk devices.
    o Eliminate spurious dhclient(8) error messages when the specified
      interface does not exist.
    o Eliminate spurious softraid(4) error messages for removable devices
      without media.

 - New tools:
    o newfs_ext2fs(8) for creating ext2 filesystems.
    o mkuboot(8) for creating U-Boot boot loader images.
    o midicat(1) MIDI server allowing MIDI programs to communicate
    o POSIX-compliant fuser(1) to identify process IDs holding a file open

 - Filesystem midlayer improvements:
    o Dynamic Buffer Cache now supported to a max size set with sysctl
      kern.bufcachepercent
    o Dynamic VFS name cache rewrite, now uses Red/Black trees instead of
      linked lists.
    o Numerous NFS client stability fixes.
    o Fix FAT32 mounting.
    o Fix cd9660 directory handling to eliminate looping and random
      truncation of directory entries.
    o Fix various internal locking problems with cd9660, udf, msdosfs
      and ffs file systems.

 - pf(4) improvements:
    o nat-to, rdr-to, binat-to options replace the nat, rdr and binat
      translation rules.
      changes for more info.
    o The route-to, reply-to, dup-to and fastroute options in pf.conf
      move to filteropts.
    o pf(4) can now translate packets between different routing domains.
    o Added -S and -L options to pfctl(8) to store and load pf state table
      from a file.
    o Added support for IPV4 and IPv6 divert sockets.

 - OpenBGPD, OpenOSPFD and other routing daemon improvements:
    o Update capability code in bgpd(8) to follow RFC 5492.
    o BGP MPLS VPN (RFC 4364) support added to the bgpd RIB.
    o In bgpd(8), implement the RFC4486 BGP Cease Notification
      Message subcodes.
    o It is now possible to enable/disable specific BGP capabilities.
    o Update bgpctl(8) irrfilter to support IPv6 and 4-byte AS numbers.
    o Minimal router-dead-time of 1 second and sub-second hello intervals
      added to ospfd(8). Additionally it is now possible to specify
      sub-second SPF timers for faster route fail-over.
    o ospf6d(8) is now installed by default. The RIB can be synced with
      the kernel routing table now. Support for AS-ext LSA has been added.
      This is still work-in-progress but testing is highly appreciated.
    o ldpd -- the MPLS label distribution protocol daemon -- is now
      installed by default. A custom kernel with option MPLS is needed
      to use it.

 - Generic network stack improvements:
    o brconfig is now integrated into ifconfig(8)
    o Added vether(4), a virtual Ethernet device.
    o Two bugs in IPsec/HMAC-SHA2 were fixed, resulting in an incompatibility
      with the HMAC-SHA-256/384/512 hash algorithms with previous versions
      of OpenBSD and other IPsec implementations sharing the bugs.
    o In dhcpd(8), echo back the Relay Agent Information option if present,
      and add support for the ipsec-tunnel hardware type.
    o Make dhcrelay(8) pick up the routing domain from the specified interface
      and use that rdomain for relaying the packets to the server.
    o Added support in dhcrelay(8) for RFC3046 "DHCP-over-ipsec".
    o Make the tcpdump(8) BGP OPEN capability parser RFC 5492 compliant.
    o Added an exec command to route(8) to run a process and its children
      in a specified routing domain.
    o ifconfig(8) now deals with more than 64 alias addresses.
    o Various fixes to mbuf defragmenting and mbuf chain copying
      improve reliability.

 - Assorted improvements:
    o malloc(3) now has an S flag to turn on the options that help debugging
      and improve security.
    o Updated terminfo(3) database and ncurses(3) library.
    o Added support for lazy binding in ld.so(1) on hppa.
    o Added POSIX silent check option (-C) to sort(1).
    o Added POSIX extended regular expression support to sed(1) (-E option).
    o Added GNU-compatible macro prefix option (-P) to m4(1).
    o Make it possible to specify a port in resolv.conf(5).
    o Improved FILE locking support in stdio(3).
    o Added SO_SNDTIMEO and SO_RCVTIMEO support in pthreads(3).
    o cdio(1) no longer prints bogus information if no TOC is found on
      the disk.
    o New -v flag causes cdio(1) to print profile and feature information.
    o whois(1) no longer attempts to keep the memory of 6Bone alive.
    o Added per-application MIDI-controlled volume knob to aucat(1)
    o Added MMC and MTC support to aucat(1) making possible MIDI-to-audio
      synchronization.
    o Added mio_open(3) interface to access hardware and software MIDI ports
    o Many memory leaks found by parfait and eliminated.
    o Make handling of floppy disk disklabels more reliable by properly
      initializing starting label.

 - Install/Upgrade process changes:
    o Take more care to ensure all filesystems are umount'ed when restarting
      an install or upgrade.
    o If no possible root disk is found, keep checking until one appears.
    o The default ftp directory for -stable is now the release directory
      instead of the snapshot directory.
    o Selection of TZ during installs is no longer confused by
      trailing slashes.
    o If /etc/X11 is found during upgrades, add the X sets to the list
      of default sets to install.

 - OpenSSH 5.5:
    o New features:
      o SSH protocol 1 is disabled by default.
      o Remove the libsectok/OpenSC-based smartcard code and add support
        for PKCS#11 tokens.
      o Add support for certificate authentication of users and hosts
        using a new, minimal OpenSSH certificate format (not X.509).
      o Added a 'netcat mode' to ssh(1).
      o Add the ability to revoke keys in sshd(8) and ssh(1).
      o Rewrite the ssh(1) multiplexing support to support non-blocking
        operation of the mux master.
      o Add a 'read-only' mode to sftp-server(8) that disables open in
        write mode and all other fs-modifying protocol methods. (bz#430)
      o Allow setting an explicit umask on the sftp-server(8) commandline
        to override whatever default the user has. (bz#1229)
      o Many improvements to the sftp(1) client.
      o New RSA keys will be generated with a public exponent of 65537
        instead of the previous value 35.
      o Passphrase-protected SSH protocol 2 private keys are now protected
        with AES-128 instead of 3DES.
    o The following significant bugs have been fixed in this release:
      o Fixed a minor information leak of environment variables specified in
        authorized_keys if an attacker happens to know the public key in use.
      o When using ChrootDirectory, make sure we test for the existence of
        the user's shell inside the chroot and not outside. (bz#1679)
      o Cache user and group name lookups in sftp-server using
        user_from_[ug]id(3) to improve performance on hosts where these
        operations are slow. (bz#1495)
      o Fix problem that prevented passphrase reading from being interrupted
        in some circumstances. (bz#1590)
      o Ignore and log any Protocol 1 keys where the claimed size is not
        equal to the actual size.
      o Make HostBased authentication work with a ProxyCommand. (bz#1569)
      o Avoid run-time failures when specifying hostkeys via a relative path
        by prepending the current working directory in these cases. (bz#1290)
      o Do not prompt for a passphrase if we fail to open a keyfile, and log
        the reason why the open failed to debug. (bz#1693)
      o Document that the PubkeyAuthentication directive is allowed in a
        sshd_config(5) Match block. (bz#1577)
      o When converting keys, truncate key comments at 72 chars as per
        RFC4716. (bz#1630)
      o Do not allow logins if /etc/nologin exists but is not readable by
        the user logging in.
      o Output a debug log if sshd(8) can't open an existing
        authorized_keys. (bz#1694)
      o Quell tc[gs]etattr(3) warnings when forcing a tty (ssh -tt), since
        we usually don't actually have a tty to read/set. (bz#1686)
      o Prevent sftp(1) from crashing when given a "-" without a command;
        also, allow whitespace to follow a "-". (bz#1691)
      o After sshd(8) receives a SIGHUP, ignore subsequent HUPs while
        sshd(8) re-execs itself; prevents two HUPs in quick succession
        from resulting in sshd(8) dying. (bz#1692)
      o Clarify in sshd_config(5) that StrictModes does not apply to
        ChrootDirectory; permissions and ownership are always checked
        when chrooting. (bz#1532)
      o Set close-on-exec on various descriptors so they don't get leaked
        to child processes. (bz#1643)
      o Fix very rare race condition in x11/agent channel allocation
      o Fix incorrect exit status when multiplexing and channel ID 0 is
        recycled. (bz#1570)
      o Fail with an error when an attempt is made to connect to a server
        with ForceCommand=internal-sftp with a shell session. (bz#1606)
      o Warn but do not fail if stat(2)ing the subsystem binary
        fails. (bz#1599)
      o Change "Connecting to host..." message to "Connected to host." and
        delay it until after the sftp protocol connection has been
        established. (bz#1588)
      o Use the HostKeyAlias rather than the hostname specified on the
        commandline when prompting for passwords. (bz#1039)
      o Correct off-by-one in percent_expand(). (bz#1607)
      o Fix passing of empty options from scp(1) and sftp(1) to the
        underlying ssh(1); also add support for the stop option "--".
      o Fix an incorrect magic number and typo in PROTOCOL. (bz#1688)
      o Don't escape backslashes when displaying the SSH2 banner. (bz#1533)
      o Don't unnecessarily dup() the in and out fds for
        sftp-server(8). (bz#1566)
      o Force use of the correct hash function for random-art signature
        display. (bz#1611)
      o Do not fall back to adding keys without constraints when the agent
        refuses the constrained add request. (bz#1612)
      o Fix a race condition in ssh-agent(1) that could result in a wedged
        or spinning agent. (bz#1633)
      o Flush stdio before exec() to ensure that everything has made it out
        before the streams go away. (bz#1596)
      o Set FD_CLOEXEC on in/out sockets in sshd(8). (bz#1706)

 - Over 5,800 ports, major robustness and speed improvements in package tools.
 - Many pre-built packages for each architecture:
    o i386: 5951
    o sparc64: 5745
    o alpha: 5641
    o sh: 768
    o amd64: 5879
    o powerpc: 5785
    o sparc: 4053
    o arm: 3711
    o hppa: 5500
    o vax: 1785
    o mips64: 3690
    o mips64el: 4316

 - Some highlights:
    o Gnome 2.28.2.
    o KDE 3.5.10.
    o Xfce 4.6.1.
    o MySQL 5.1.42.
    o PostgreSQL 8.4.2.
    o Postfix 2.6.5.
    o OpenLDAP 2.3.43.
    o Mozilla Firefox 3.0.18 and 3.5.8.
    o Mozilla Thunderbird 2.0.0.23.
    o OpenOffice.org 3.1.1.
    o Emacs 21.4 and 22.3
    o Vim 7.2.267.
    o PHP 5.2.12.
    o Python 2.4.6, 2.5.4 and 2.6.3.
    o Ruby 1.8.6.369.

 - As usual, steady improvements in manual pages and other documentation.

 - The system includes the following major components from outside suppliers:
    o Xenocara (based on X.Org 7.4 with xserver 1.6.5 + patches,
      freetype 2.3.9, fontconfig 2.6.0, Mesa 7.4.2, xterm 250 and more)
    o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
    o Perl 5.10.1 (+ patches)
    o Our improved and secured version of Apache 1.3, with SSL/TLS
      and DSO support
    o OpenSSL 0.9.8k (+ patches)
    o Groff 1.15
    o Sendmail 8.14.3, with libmilter
    o Bind 9.4.2-P2 (+ patches)
    o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
    o Sudo 1.7.2
    o Ncurses 5.7
    o Latest KAME IPv6
    o Heimdal 0.7.2 (+ patches)
    o Arla 0.35.7
    o Binutils 2.15 (+ patches)
    o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.6
and 4.7, look at

        http://www.OpenBSD.org/plus47.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release.  As usual, between the
creation of the OpenBSD 4.7 FTP/CD-ROM binaries and the actual 4.7
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default).  Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible.  Therefore, we advise regular visits to

        http://www.OpenBSD.org/security.html
and
	http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@OpenBSD.org
mailing list.  For information on OpenBSD mailing lists, please see:

	http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.7 is also available on CD-ROM.  The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world.  The set includes a colourful booklet which carefully explains the
installation of OpenBSD.  A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol).  As an added bonus, the second CD contains an audio
track, a song entitled "I'm still here".  MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

    http://www.OpenBSD.org/lyrics.html#47

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.7 CD-ROMs are bootable on the following four platforms:

  o i386
  o amd64
  o macppc
  o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

        http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from.  For our default mail order, go directly to:

        https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts.  Additionally, donations to the project are
highly appreciated, as described in more detail at:

        http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts.  In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses.  There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs.  Contact the foundation directors at
directors@openbsdfoundation.org for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too.  We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.7 t-shirts are available now.  We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP.  Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet.  Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP.  With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
   mirrors which provide OpenBSD, then choose one near you:

        http://www.OpenBSD.org/ftp.html
        ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/ftplist

   As of May 19, 2010, the following ftp mirror sites have the 4.7 release:

	ftp://ftp.eu.openbsd.org/pub/OpenBSD/4.7/	Stockholm, Sweden
	ftp://ftp.bytemine.net/pub/OpenBSD/4.7/         Oldenburg, Germany
	ftp://mirror.aarnet.edu.au/pub/OpenBSD/4.7/     Brisbane, Australia
	ftp://ftp.wu-wien.ac.at/pub/OpenBSD/4.7/        Vienna, Austria
	ftp://ftp.usa.openbsd.org/pub/OpenBSD/4.7/	CO, USA
	ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.7/	CA, USA
	ftp://obsd.cec.mtu.edu/pub/OpenBSD/4.7/         Michigan, USA

	The release is also available at the master site:

	ftp://ftp.openbsd.org/pub/OpenBSD/4.7/	        Alberta, Canada

	However it is strongly suggested you use a mirror.

   Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
   pub/OpenBSD/4.7/ which contains these files and directories.
   This is a list of what you will see:

        ANNOUNCEMENT     armish/          mvme68k/         sparc64/
        Changelogs/      ftplist          mvme88k/         src.tar.gz
        HARDWARE         hp300/           packages/        sys.tar.gz
        PACKAGES         hppa/            ports.tar.gz     tools/
        PORTS            i386/            root.mail        vax/
        README           landisk/         sgi/             xenocara.tar.gz
        alpha/           mac68k/          socppc/          zaurus/
        amd64/           macppc/          sparc/

   It is quite likely that you will want at LEAST the following
   files which apply to all the architectures OpenBSD supports.

        README          - generic README
        HARDWARE        - list of hardware we support
        PORTS           - description of our "ports" tree
        PACKAGES        - description of pre-compiled packages
        root.mail       - a copy of root's mail at initial login.
			  (This is really worthwhile reading).

3) Read the README file.  It is short, and a quick read will make
   sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
   for example, i386.  This is a list of what you will see:

	INSTALL.i386    cd47.iso        floppyB47.fs    pxeboot*
	INSTALL.linux   cdboot*         floppyC47.fs    xbase47.tgz
	MD5             cdbr*           game47.tgz      xetc47.tgz
	base47.tgz      cdemu47.iso     index.txt       xfont47.tgz
	bsd*            comp47.tgz      install47.iso   xserv47.tgz
	bsd.mp*         etc47.tgz       man47.tgz       xshare47.tgz
	bsd.rd*         floppy47.fs     misc47.tgz

   If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
   and the appropriate floppy*.fs or install47.iso files.  Consult the
   INSTALL.i386 file if you don't know which of the floppy images
   you need (or simply fetch all of them).

   If you use the install47.iso file (roughly 200MB in size), then you
   do not need the various *.tgz files since they are contained on that
   one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
   README; otherwise, use the more complete instructions in the
   file called INSTALL.i386.  INSTALL.i386 may tell you that you
   need to fetch other files.

6) Just in case, take a peek at:

        http://www.OpenBSD.org/errata.html

   This is the page where we talk about the mistakes we made while
   creating the 4.7 release, or the significant bugs we fixed
   post-release which we think our users should have fixes for.
   Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
      you can use "fdimage.exe" located in the pub/OpenBSD/4.7/tools
      directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system.  This release
contains X.Org 7.4.  Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc.  During installation, you can install
X.Org quite easily.  Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software.  The software has been verified to build and
run on the various OpenBSD architectures.  The 4.7 ports collection,
including many of the distribution files, is included on the 3-CD
set.  Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD.  Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided.  Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.7/README)
file explains how to deal with these source files.  For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.7/ directory:

        xenocara.tar.gz     ports.tar.gz   src.tar.gz     sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

Ports tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber.  System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat.  X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use.  We would also like
to thank those who pre-ordered the 4.7 CD-ROM or bought our previous
CD-ROMs.  Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

    Alexander Bluhm, Alexander Hall, Alexander von Gernler,
    Alexander Yurchenko, Alexandre Ratchov, Alexey Vatchenko,
    Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
    Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
    Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
    Can Erkin Acar, Chad Loder, Charles Longeau, Chris Kuethe,
    Christian Weisgerber, Claudio Jeker, Dale Rahn, Damien Bergamini,
    Damien Miller, Dariusz Swiderski, Darren Tucker,
    David Gwynne,  David Hill, David Krause, Edd Barrett, Eric Faurot,
    Esben Norby,  Fabien Romano, Federico G. Schwindt, Felix Kronlage,
    Gilles Chehade, Giovanni Bechis, Gordon Willem Klok,
    Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
    Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
    Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
    Jason Meltzer, Jasper Lievisse Adriaanse, Jim Razmus II, Joel Sing,
    Joerg Goltermann, Johan Mson Lindman, Jolan Luff, Jonathan Armani,
    Jonathan Gray, Jordan Hargrave, Joshua Stein, Kenneth R Westerback,
    Kevin Lo, Kevin Steves, Kjell Wooding, Kurt Miller, Landry Breuil,
    Laurent Fanis, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
    Marco S Hyman, Marcus Glocker, Marek Vasut, Mark Kettenis,
    Mark Uemura, Markus Friedl, Martin Reindl, Martynas Venckus,
    Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
    Matthieu Herrb, Michael Erdely, Michael Knudsen, Michele Marchetto,
    Mike Larkin, Miod Vallat, Moritz Grimm, Moritz Jodeit,
    Nicholas Marriott, Nick Holland, Nikolay Sturm, Okan Demirmen,
    Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul de Weerd,
    Paul Irofti, Peter Hessler, Peter Stromberg, Peter Valchev,
    Philip Guenther, Pierre-Emmanuel Andre, Pierre-Yves Ritschard,
    Rainer Giedat, Reyk Floeter, Robert Nagy, Rui Reis,
    Ryan Thomas McBride, Simon Bertrang, Simon Perreault, Stefan Kempf,
    Stefan Sperling, Stephan A. Rickauer, Steven Mestdagh,
    Stuart Henderson, Takuya Asada, Ted Unangst, Theo de Raadt,
    Thordur I Bjornsson, Tobias Stoeckmann, Tobias Weingartner,
    Todd C. Miller, Todd Fries, Will Maier, William Yodlowsky,
    Xavier Santolaria, Yasuoka Masahiko, Yojiro Uo

I’m the happay owner of a Huawei E1750 modem and it is real easy to get it running in Ubuntu. This guide will probably work with many other 3G USB modems.

Just type from the command line:

sudo apt-get install usb-modeswitch

Plug in the modem

Go to the Network manager and enter your Mobile Broadband credentials and now it works!

I wanted to unlock my operator locked Huawei e1750 modem. After googling I found this page in swedish.

The unlock code can be calculated by using the IMEI number, the unlock code is sent by using AT commands.

I have succesfully tested this on e1750 and e1550.

I also tried it on e220 and it did not work.

1. Get the IMEI number

Normally this is printed on the device put the geek way of getting it is by asking the device:

peter@peter-laptop:~/huawei$ cat /dev/ttyUSB0 &
[1] 9378
peter@peter-laptop:~/huawei$ echo -e "ATI\r" > /dev/ttyUSB0
peter@peter-laptop:~/huawei$ ATI
Manufacturer: huawei
Model: E1750
Revision: 11.126.07.04.00
IMEI: 123456789012347
+GCAP: +CGSM,+DS,+ES

OK

So the IMEI number is: 123456789012347

2. Calculate the unlock code

The following python script will calculate the unlock code:

import hashlib

def getCode(imei, salt):
    digest = hashlib.md5((imei+salt).lower()).digest()
    code = 0
    for i in range(0,4):
        code += (ord(digest[i])^ord(digest[4+i])^ord(digest[8+i])^ord(digest[12+i])) << (3-i)*8
        code &= 0x1ffffff
        code |= 0x2000000
    return code

# Your IMEI goes here:
imei = "123456789012347"

print "Unlock code: %s" % getCode(imei, "5e8dd316726b0335")
print "Flash code: %s" % getCode(imei, "97b7bc6be525ab44")

When run:

peter@peter-laptop:~/huawei$ python unlock_code.py
Unlock code: 36963763
Flash code: 53969249

3. Use the unlock code

peter@peter-laptop:~/huawei$ echo -e 'AT^CARDLOCK="36963763"\r' > /dev/ttyUSB0

OK

Congratulations, now your modem is unlocked

With my new and fancy HTC Desire I wanted to look at my Nagios or op5 Monitor status. I have found two apps Nagroid and NagMonDroid.

NagMonDroid did I not get working, probably because op5 Monitor only uses https as protocol.

Nagroid works like a charm:

The configuration is rather straightforward:

I wanted to use the Android SDK on my Ubuntu machine, mainly to grab screenshoots but also to play around with it.

I followed the guidelines at this guide, but it did not work. DDM just show garbage as the device and when trying to get a screenshoot it complained with:

54:42 W/ddms: Unable to get frame buffer: device (????????????)
request rejected: insufficient permissions for device

After some googling i figured out that I had to hack my udev rules.

I added to /etc/udev/rules.d/51-android.rules

SUBSYSTEMS=="usb", ATTRS{idVendor}=="0bb4", ATTRS{idProduct}=="0c87", MODE="0666"
 

and run

reload udev

The idVendor and  idProduct was found by running lsusb:

# lsusb
Bus 002 Device 011: ID 0bb4:0c87 High Tech Computer Corp. 

Now when starting DDM:

And I can take screenshoots:

For the first time I felt that this is more than a phone, for the first time calender integration works, for the first time I can use the builtin GPS, for the first time accessing the web with a phone works, for the first time downloaded software really works.

My favorite apps so far is:

• Nagroid, to be able to view my op5 Monitor status
• FONMaps, find hotspots for LaFoneras
• Car Cast, listen and download podcasts
• MapDroid, to use preloaded OpenStreetmaps and GPS without using any bandwidth. Perfect when abroad because of the crazy price of data roaming outside Sweden.
• HTC Facebook, read and post on facebook
• FON Access, automatically connect to FON hotspots when traveling.
• GPS Logger, logg tracks in gpx format that almost any GPS software understand
• Sipdroid, to connect to my Asterisk PBX using 3G or WiFi

Of  cource the device is not perfect, I miss:

• The phone must be ‘rooted’ to be real useful, why? Open the phone so the community and others can develop apps that are real useful. Vendor lock-in always sucks.
• IPSec VPN so I can connect to my IPSec based OpenBSD firewall. The IPSec implementation in the phone sucks.
• OpenVPN, there exists OpenVPN apps but to use the the phone must be ‘rooted’
• Bluetooth modem, it is not possible to use the phone as a modem using bluetooth
• Screenshots, the phone must be rooted or using the SDK to take screenshoots. Why?

I really hope that Google and/or HTC understand and use the power of the community to make the Android even more succesfull by open it even more.

I bought a Fonera 2.0g WLAN router and I wanted to extend the functionality to have the possibility to add packages from OpenWRT. I also wanted the possibility to manage my new router with ssh.

The way to achive this is by installing developer firmware.

Installing

I followed the instructions at Fons beta/developer wiki.

The image I used can be found here.

Test

I try to connect by using ssh

peter@peter-laptop:~$ ssh -l root 192.168.10.1
root@192.168.10.1's password: 

BusyBox v1.11.1 (2009-04-17 12:45:57 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

                                        __
                                    _.-~  )
                         _..--~~~~,'   ,-/     _
                      .-'. . . .'   ,-','    ,' )
                    ,'. . . _   ,--~,-'__..-'  ,'
                  ,'. . .  (@)' ---~~~~      ,'
                 /. . . . '~~             ,-'
                /. . . . .             ,-'
               ; . . . .  - .        ,'
              : . . . .       _     /
             . . . . .          `-.:
            . . . ./  - .          )
           .  . . |  _____..---.._/ ____ Seal _
     ~---~~~~----~~~~             ~~                

                      Flipper                       

--------  Fonera 2.0 Firmware (v2.2.5.0) -----------
      * Based on OpenWrt - http://openwrt.org
      * Powered by FON - http://www.fon.com
----------------------------------------------------

Background

It is always a good idea to monitor the server hardware, in many cases the root cause of the probblem is hardware related like: a fan stops and the temperature gets to high, dust in the machine makes it to hot, disks that fails, memory corruption and so on.  This article will describe howto enable hardware monitoring on a HP Proliant running CentOS Linux and then howto collect the data with Nagios or op5 Monitor. The procedure is the same with RedHat Enterprise Linux and similiar with Suse Enterprise server.

The HP manuals and information is bloated with irrelevant information and I had to struggle several hours, ask collegues to get it running. I hope this blog article will help others to get monitoring of HP Proliant using HP Insight Manager easier to setup.

Installing the software on the target system

You need two packages from HP and can be downloaded from hp.com under "Support & Drivers". Search your hardware plattform and correct operating system:

• ProLiant Support Pack for Red Hat Enterprise Linux 5 (i686)  The latest Proliant Support Package 2010-03-02 name is psp-8.25.rhel5.i686.en.tar.gz
• HP System Health Application and Insight Management Agents for Red Hat Enterprise Linux 5 (x86). The latest name is hpasm-8.0.0-173.rhel5.i386.rpm

Install kernel source code and rpm tools:

# yum install kernel-devel rpm-build rpm-devel
 

Proliant Support Package is not supported on CentOS so you have to let the installer think it is a RedHat system. If you have a RHEL system skip the next steps.

# cp /etc/redhat-release /etc/redhat-release.backup

# echo "Red Hat Enterprise Linux Server release 5.4 (Tikanga)">/etc/redhat-release

Untar the Proliant Support Package

 # tar xzvf psp-8.25.rhel5.i686.en.tar.gz

Install the Proliant Support Package

# cd compaq/csp/linux/

# ./install825.sh

alot of text appears and some questions, answer them.

Install HP System Health Application and Insight Management Agents, and for some stupid reason it is in conflict with some other packages just installed. I solved it in a dirty way:

# rpm -i --force  --replacefiles --nodeps hpasm-8.0.0-173.rhel5.i386.rpm

Configure by running:

# hpa/etc/init.d/hpasm configure

and answer the questions.

Do not forget to restore /etc/redhat-release

# cp /etc/redhat-release.backup /etc/redhat-release

I did modify my /etc/snmp/snmp.conf to:

dlmod cmaX /usr/lib/libcmaX.so
rocommunity public
trapsink 10.1.1.20
syscontact peter@it-slav.net
syslocation PDC, Peters DataCenter

To test that you have installation and configuration work, run a snmpwalk from your Nagios or op5 Monitor host:

# snmpwalk -c public -v1  <ip-adress of your proliant box> 1.3.6.1.4.1.232

SNMPv2-SMI::enterprises.232.1.1.1.0 = INTEGER: 1
SNMPv2-SMI::enterprises.232.1.1.2.0 = INTEGER: 23
SNMPv2-SMI::enterprises.232.1.1.3.0 = INTEGER: 2
SNMPv2-SMI::enterprises.232.1.2.1.4.1.0 = INTEGER: 30
SNMPv2-SMI::enterprises.232.1.2.1.4.2.1.1.1 = INTEGER: 1
SNMPv2-SMI::enterprises.232.1.2.1.4.2.1.2.1 = STRING: "Compaq Standard Equipment Agent for Linux"
SNMPv2-SMI::enterprises.232.1.2.1.4.2.1.3.1 = ""
SNMPv2-SMI::enterprises.232.1.2.1.4.2.1.4.1 = Hex-STRING: 00 00 00 00 00 00 00
SNMPv2-SMI::enterprises.232.1.2.1.4.2.1.5.1 = STRING: "To gather Standard Equipment data for Linux."

...
 

Install check_hpasm on the Nagios or op5 Monitor host

The check_hpasm can be downloaded from Console Labs.

Unpack the tarball

# tar xzvf check_hpasm-4.1.2.tar.gz

Configure and compile

# ./configure --prefix=/opt/plugins/custom/hp-insight --with-nagios-user=monitor --with-nagios-group=users --enable-perfdata

...

# make

...

# make install

Test

# /opt/plugins/custom/hp-insight/libexec/check_hpasm -H  -C public

OK - System: 'proliant dl360 g3', S/N: '7J31LMW6N01D', ROM: 'P31 01/28/2004', hardware working fine, da: 1 logical drives, 1 physical drives | fan_1=50% fan_2=50% temp_1_cpu=16;50;50 temp_2_cpu=15;65;65 temp_3_ioBoard=21;56;56 temp_4_cpu=20;65;65

Congratulations your plugin and hw monitoring works!

Configure Nagios or op5 Monitor
 

checkcommands.cfg

# command 'check_hpasm'
define command{
    command_name                   check_hpasm
    command_line                   $USER1$/custom/libexec/check_hpasm -H $HOSTADDRESS$ -C $ARG1$
    }

services.cfg

# service 'Insight Manager'
define service{
    use                            default-service
    host_name                      humpa
    service_description            Insight Manager
    check_command                  check_hpasm!public
    contact_groups                 call_it-slav,it-slav_jabber,it-slav_mail
    }

Screenshoot, using ninja

 Useful links

• op5, a systems and network management company
• op5 Monitor, an enterpise monitor system based on Nagios
• Ninja, Nagios is now just awesome
• Nagios, enterprise monitoring based on opensource
• Hp support & drivers, a place to start looking for the HP software used in this article

• Hard to manage without iTunes
• iTunes is crap
• Cannot play ogg and flac
• I just want to attach it and it should popup like a USB disk, drop the files into it, detach and play the songs.

I got a hint from a friend that I should try RockBox, so I download it and used the very simple installer on linux and it works perfectly well. All the drawbacks mentioned above are solved and  as a bonus the gui is much better.

Now I can:

• Play ogg
• Play flac
• Customize the GUI
• Change myriads of settings
• Throw away mysterious sync software like iTunes and others.
• Attach it as a USB disk, drop my media files into it, detach and play them

If you are lucky and owns a Rockbox supported media player, update it. You will not regret it.

Background

I was with my geekfriends at a ski resort and I managed to get an Internet connection using a cellphone. Of course I wanted to share it with my friends. As geeks we brought a switch and a couple of ethernetcables.

Solution

Using this script on a Ubuntu 9.10 I managed to share my connection:

sudo ifconfig eth0 10.8.16.1
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv4.conf.default.forwarding=1
sudo sysctl -w net.ipv4.conf.all.forwarding=1
sudo iptables -P FORWARD ACCEPT
sudo iptables --table nat -A POSTROUTING -o ppp0 -j MASQUERADE

Conmnect everymachine with the switch and the clients just needed to use a 10.0.0.0/8 network adress and add 10.8.16.1 as default gateway and it works!

Background

At op5 we often run into BizTalk at customer sites as a business critical application. We have done an investigation and come up with a plugin  to monitor BizTalk.

To fully understand this document BizTalk knowledge is necessary.

Solution

op5 has developed a plugin that can monitor the following at a BizTalk server:

• Recieve locations – Verify that they are enabled.
• Send Ports – Verify that they are in Started state
• Group Overview – Catch messages in the message queue that are in state Suspended. The different type of messages are:
  • Dehydrated
  • Suspended
  • Queue

The plugin license is GPLv3 so it is free for any one to use and enhance.

Links

• check_biztalk the plugin that monitors BizTalk
• op5 Monitor Monitor solution based on Nagios
• Nagios free enterprise monitor software

After some Google search and reading of man pages I finally get it working.

My setup is a Nokia E52 and a IBM T60 laptop running Ubuntu 9.10. I have tested it with a Ericsson P1i and a Dell D630 aswell and I think the guidlines below will work with many other setups. One exception is probably iPhone

From a bash shell run:

peter@svarten:~$ sdptool search DUN
Inquiring ...
Searching for DUN on A8:7E:33:20:40:0F ...
Service Name: Dial-Up Networking
Service RecHandle: 0x10030
Service Class ID List:
  "Dialup Networking" (0x1103)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
    Channel: 5
Language Base Attr List:
  code_ISO639: 0x454e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Dialup Networking" (0x1103)
    Version: 0x0100

peter@svarten:~$ sudo rfcomm connect 1 A8:7E:33:20:40:0F 5
[sudo] password for peter:
Connected /dev/rfcomm1 to A8:7E:33:20:40:0F on channel 5
Press CTRL-C for hangup

Now my phone asks if I accept the connection and I choose "yes".

And now the networkmanager has a new "Mobile Broadband connection". Just choose your operator and it will work.

In situations like this I recommend a USB SATA/PATA interface i.e. Plexgear at Kjell&Company, the adapter looks like it is OEM:ed so there probably several with different brands.

Features:

• USB-SATA
• USB-PATA 2.5"
• USB-PATA 3.5"
• Power Supply for normal devices and SATA devices

The only thing I miss is that it does not contain a SCSI interface aswell

I have used it to backup files on a LVM disk, transfer files from old disk to a new when upgrading, reinitialize a disk that refused to install Windows 7, attach a DVD-Rom to a blade server and so on.

In my opinion every geek and sysadmin should have one.