When I fist saw this product I had an instance light-bulb moment, I could stop paying for a dynamic DNS service and build my own private one. As a broadband (DHCP) user I have a very basic requirement of needing to regularly update an A record so that I can find my pc

To bring my idea into fruition I began researching; I need a cli tool which I could run from cron on my linux box (to send the DNS update requests to rackspace). In my research I found rscurl, a cli tool to control cloud servers, as rackspace have a standard API for all their products I have been able to use rscurl to develop rsdns.

rsdns is a series of cli tools to adding/deleting/changing rackspace DNS records, as part of the tool development I have created a script called rsdns-dc.sh to run on my machine, below is a short how to:

How to get free dynamic dns from rackspace.

Pre-requisit: This is for linux/mac, if you want to do this on windows you’ll need bash, curl, awk, sed & dig installed – google is your friend.

The instructions below assume that you (a) have a domain and (b) have already changed your NS records to point to dns1.stabletransit.com & dns2.stabletransit.com.

Download the latest rsdns from gitgub and unpack somewhere, I like ~/bin/rsdns.

Go to your rackspace management portal and grap your username & API key (It’s under “Your Account” -> “API Access”)

Create a config file for rsdns (~/.rsdns_config) with your settings.

RSUSER=linickx
RSAPIKEY=123456
RSPATH=~/bin/rsdns/

You need your domain created on rackspace, you can either use rackspaces GUI to do this (It’s under “Hosting” -> “Cloud Servers” -> “serverabc” -> “DNS” ) or you can use rsdns, like so.

[LINICKX@SERVER rsdns]$./rsdns-domain.sh -d www.linickx.com -e spam@linickx.com

Once you have a domain setup you need an A record, this step was a deliberate design to avoid any rouge cron jobs from creating a million records, the dynamic client will only update an existing record – not create a new one.

To create the a record you going to need an IP address, it can be something random like the below, or you can use http://icanhazip.com to get your actual current IP. Again to create a record, you can use the rackspace GUI (It’s under “Hosting” -> “Cloud Servers” -> “serverabc” -> “DNS” -> “yourdomain” > “Add”) or you can use rsdns….

[LINICKX@SERVER rsdns]$./rsdns-a.sh -n dynamichost.linickx.com -i 123.123.123.123 -t 3600

In the above the TTL is set to 1hr, this is so that DNS caches do not keep the record too long. That’s all the pre-work done, now lets get your dynamic host setup!

The script to update your a record is rsdns-dc.sh, and you run it like this…

[LINICKX@SERVER rsdns]$./rsdns-dc.sh -n dynamichost.linickx.com

Easy huh? The script uses icanhazip to get your current IP, it then update the A record with it.

I never switch off my router so I have create a created a cronjob to run that script every 2 hours, plus the 1hr TTL should mean that the record is roughly in sync with my IP without making unnecessary requests – You can run the script more often if you like, just stay under the limits –> according to the API guidelines you can make upto 25 changes per min / 2 per second.

I use redhat based linux systems, so I can simply drop the following file called rsdns-dc into /etc/cron.d/ with this…

* */2  * * *     linickx /home/linickx/bin/rsdns/rsdns-dc.sh -n dynamichost.linickx.com &>/dev/null

Now we are actually done! Free private Dynamic DNS on your own zone, what more could you want?

*No, I didn’t get this working 1st time, it took me a good couple of hours of googling, but looking back I can see that all the info is there.

The key to getting this working is that the iphone side is not as configurable as it should be, so if you’re trying to get this to work you need to be talking to the IT administrator to get the concentrator side changed. The 1st word of warning is that the iphone client doesn’t support group authentication, so you’re going to be changing the base group, now by default most “production” groups will inherit settings from the base group, so you will need to make sure that if you change anything in the base group that it doesn’t effect your other L2L or Remote Access tunnels. (You have been warned.)

To get started, for whatever reason the iphone only supports cisco’s NAT-T implementation of IPSEC, so if you have a firewall or access-list in front of your concentrator you’re going to need to open up UDP 4500, then enable NAT Transparency. Another word of warning about NAT-T, we found that existing VPNS to Cisco Routers started to fail after enabling this, which was a bit odd as NAT-T wasn’t enabled under any of the L2L profiles, anyway, to fix the issue we enabled NAT-T on the routers (again make sure UDP 4500 is allowed though any ACLs) and under “conf t” issue:

crypto ipsec nat-transparency udp-encapsulation

So, back to the cVPN3k config……


Configuration -> Tunnel & Security -> NAT Transparency
IPSEC over NAT-T - TICK


So a quick explanation of the above so you get the idea; from the tree on the left, click “Configuration” then “Tunnel & Security” then “NAT Transparency” and tick the box next to NAT-T.

Now you need to setup your PHASE 1 Proposal…

Config -> Tunnel & Sec -> IPSEC -> IKE Proposal

I called mine iphone, and you need to configure the following settings.

• Authentication: Preshared Key (NOT the one with Xauth)
• Hash: SHA-1
• Encryption: 3DES
• DiffeHelmen: Group 2

After phase one, comes PHASE 2:

Config -> Policy Manage -> Traffic Mgnt -> SA

Again, add the following settings and I called mine: iphone

• Authentication: ESP / SHA
• Encryption: 3DES
• Enacapsulation: Transport
• IKE Proposal = iphone (or whatever your phase 1 was called)

Then finally we start working with the groups, so as mentioned above you need to work with the base group:

Config -> User Management -> Base Group

And you need to enable the following, the other settings will be optional:

On the Base Group Tab,

• Tunnel Protocol: Tick “L2TP over IPSec”

On the IPSEC Tab,

• Authentication: Internal or NT depending on what you’ve already configured for other Remote Access Profiles.
• IPSEC SA is set to: iphone
• Default Preshared Key: Set this to something really really long (this will be your secret on the iphone)

On the PPTP/L2TP Tab,

• L2TP Authentication Protocols: Tick MSCHAPv1 / MSCHAPv2
• L2TP Encryption: Tick 40 & 128 B

DONE! Now with a little bit of luck your iphone should connect.

A Quick note about comments: All support requested will be deleted, I don’t have access to a concentrator to offer any meaningful advise, you use the above config at your own risk.

My purpose was to use RADIUS authentication between a Nokia IPSO appliance such that users who access voyager or ssh get authenticated centrally; for RADIUS authentication to work your authentication server (in this case ACS) needs to supply the AAA client (in this can the ipso box) with a “return list attribute”. By default ACS doesn’t have the nokia attributes; to import attributes you need to get your hands on a dictionary file, for nokia ipso it’s /etc/nokia.dictionary – I’ve a copy here.

In you dictionary file you need to pick out some key elements, firstly the IANA-assigned enterprise code for the vendor and secondly a list of attributes to add. Using my nokia example the vendor code is the top line:

VENDOR Nokia 94

Thus the code is 94 , and everything below that are attributes.

So… Getting started with ACS, firstly if you have AAA clients which you want to use the new attributes you are going to need to delete them, and to be save reboot ACS. Now the import is done via the RDBMS sync process, since you do not have OS level access to ACS you need to upload a file called “accountActions.csv” (case sensitive), uploading this file tells the internal database to perform some commands or actions, examples would be to bulk import some users or bulk group changes, in our case we’re going to insert a new “Vendor” into the RADIUS database, and then insert some attributes.

I have created a file called createVendor_accountActions.csv if you renamed it to accountActions.csv and uploaded it to your ACS box via the RDBMS Sync tool (under system configuration) it’d perform the following actions:

• • Command -1
  • Priority – 8
  • Action – 350 (Create new Vendor)
  • Vendor Name – Nokia
  • ACS Vendor Number – Auto Assigned
  • Vendor ID – 94
  • Date of DB Transaction – 25/09/2007 13:00
• • Command – 2
  • Priotity – 0
  • Action – 355 (Restart ACS Services)
  • Date of DB Transaction – 25/09/2007 13:00

The command numbers are just like primary key fields in a database or row numbers in a spreadsheet, they need to be unique and incremental for each csv file, and the priority specify and order to apply the commands, you I guess you could set the priorities all to 0 and rely on the command number to process the file in order, but I set a priority just in case. After you apply the file ACS will be temporarily unavailable as the services restart.

Now, we look at one line of importAttributes_accountActions.csv, again it would need to be renamed to accountActions.csv, before uploaded, and lets take a look at one line.

• Command -1
• Priority – 7
• Action – 352 (Add VSA)
• Attribute Name – Nokia-IMSI
• The vendor to assign the attribute to – 94 (Nokia)
• Attribute ID – 224
• Attribue type – integer ( can only be integer, string or ipaddr)
• Date of DB Transaction – 25/09/2007 13:00

Hopefully this all starts to make sense when looking at your dictionary file, again the final line of the file restarts the services. An important thing to not here is that if you create a new vendor you need to re-start the services before you can apply an attribute to it, and you need to restart the services again to use the attributes… at this point here it’s probably worth mentioning that the version of ACS SE I’m using now (4.1) is a windows appliance, so if at any point your box hasn’t done what you think a reboot won’t hurt

Now you can add your AAA client and in my example you could set the vendor to RADIUS (Nokia) , if you then go into interface configuration RADIUS (Nokia) will appear, go in there and tick all the boxes for “group”, finally if you go into your group setup at the very bottom will be a list of attributes you’ve imported and can use !

Just in can you need them here are my references:

RDBMS Sync Import Definitions

Importing an accountActions.csv file into ACS SE

Universe CD version of RDBM SSync import Defs

Before re-flashing my device, I always take a list of what is installed, here’s what’s on there at the moment…

becomeroot
camera,
canola
dates
devicescape
fmradio
hildon-theme-cacher
hildon-theme-plankton
maemo-serivice-handler
maemo-wordpy
maemokrypt
media center
microb-browser
openvpn
webmail notify
mplayer
navicore
openssh
oss-statusbar-cpu
pidgin
python2.5-runtime
simplelauncher
skype
videocenter

I won’t cover them all here, as we’d all fall asleep, so I’ll pick out some favourites…let’s get installing!

Multi-Media, Music ‘n’ Video to you and me.

In my opinion every n800 should have Canola installed, it’s a great multimedia app. Canola has had some dependency issues in the past, so I’d recommend you install it before anything else. To get this working disable all your repo’s except the “Nokia Catalogue” and “Nokia Catalogue 3rd Party”, then hit this canola one click install.

UK Media Player (UKMP) is another great application to install for multi media, it has a couple of dependencies. You’ll need to switch on the extras repo, install mplayer (even if you don’t want ukmp, I’d recommend installing mplayer as it’s brilliant at playing back virtually any video file) and python either by using the application manager or the one click install files.

Utilities, those little extras you might need.

Here are some extras that’ll enhance your n800 experience, you should already have the xterm install right? But some other things that might take your fancy would be the oss-statusbar-cpuit adds a nice little applet to the systray that show how “busy” your n800 is, and you can add some commands to it too!

Camera & FM radio, are two Nokia apps that enhance what you can do with the n800 hardware that aren’t loaded by default, I’m not sure why… but to make it easier for you I’ve published a copy of my sources list, if your application manager has all these catalogues installed you should see the Camera and radio as options you can install.

Since writing my first document, OpenSSH has made its way into a repo, whether you use that or dropbear is up to you, I prefer openssh as it supports the keys that I use on the rest of my linux kit.

Plankton theme is probably one of the most popular themes added to an n800, to get it working you’ll need both files plankton + hildon theme cacher… also as quick tip, always change your theme to a default Nokia one before running a backup and re-flashing your device… basically it’ll stop the restore trying to use plankton before you’ve installed it.

Web, well it is a Nokia touch, I mean internet tablet after all.

I’d recommend you install the firefox derived web browser for maemo, it’ll allow you to run “non opera supported” sites like google docs. You can switch between the opera and firefox rendering engine; to do that you need to enable the hidden menu by editing /home/user/.browser and set hidden=true (Reference).

If you have a gmail or google apps account you’ll also want the Nokia mnotify, it’ll add a little applet to you systray … personally I’d prefer it to completely disappear if you haven’t got any new mail.

If you’re into instant messaging, then you’ll need a copy of pideon. It’s installed in components so if you’re an msn or googletalk user make sure you install the correct protocol support, if all else fails install them all

For mobile blogging you may want maemo-wordpy, it’s not yet something I’ve taken massive advantage of as I don’t have a keyboard and you need a reasonable amount of patience or practice to write a post with the stylus, but this is something I intend to tackle!

Pim, you know contacts and calendar stuff.

There’s no right answer to this, infact I’ve still yet to find something that suites me. As a user, I prefer Dates, Contacts and tasks by pimlico, they’re built on the existing nokia “contacts” back end (evolution data server), but I’ve yet to find a way of sync’ing them with anything which makes bulk importing and general day to day usage an issue.

The alternative is the GPE suite (calendar, contacts and todo). Lots of people recommend GPE, originally I had dependency conflicts on my when I was running the 2nd version of ITOS, I’m yet to install it, but I plan to as there’s been lots of complementary projects like erming for google calendar syncing and GPE summary – a desktop applet summary of your tasks and calendar

Ok, I think we’ll finish there….
I think this post long enough, I’d like to also do a part 3 and look at the security apps you can install on your n800, this won’t be so much of a n00b guide cause it won’t appeal to most people but it’s one of the reasons the n800 caught my eye originally.

Before.

As part of my website overhaul, I’ve finally gotten round to styling my /files/ directory. I was surprised at how easy it was actually, and the benefits far out way the time taken to set it up, not only does this part of the site now “fit in”, but I can apply analytics tracking and adsense I’m sure there probably is a wordpress plugin that can achieve the same thing… probably better, but I find my list of plugins ever growing and since I don’t need on for this I figure if Apache can do it, let Apache do it!

The work can be done in one of two ways either by pasting Apache directives into a .htaccess file (in the directory you want to apply conf to), or in your httpd.conf you can wrap it all up in a

<Directory> 

tag… something like

<Directory "/var/www/html/files/"> foobar> </Directory>

below is an example of a .htaccess file as that will apply to most people:

        RewriteEngine Off
        AddType text/html .shtml
        AddOutputFilter INCLUDES .shtml
        Options Indexes Includes
        IndexOptions FancyIndexing SuppressHTMLPreamble XHTML IconsAreLinks FoldersFirst SuppressDescription
        HeaderName /files/HEADER.shtml
        ReadmeName /files/README.shtml

Since my site uses wordpress with “pretty permalinks” enabled, the 1st thing I needed to do is disable mod re-write for the directory where I wanted listing enabled. Now if you check my /files/ page you’ll notice that the page title and tag line under “[LINICKX].com” change depending on what directory you are viewing, this is done with “Server Side Includes” (SSI), so the next two options in the above config set that up.

Now to take a look at the actual directory listing setup, it might be worth you taking a look at the Apache documentation for a full description, but the important ones to note are

Options Indexes Includes

to enable directory listing and switch on SSI, then you need

IndexOptions SuppressHTMLPreamble XHTML

to disable the default headers so that we can setup our style sheet and favour xHTML over HTML. Apache 2.2 users also have IndexStyleSheet available, but since I’m using CentOS4 we’ll do it this way. Finally you need the HeaderName, ReadmeName directives to tell Apache which file to look for (by default Apache looks for README.html, but that won’t support SSI)… note how my .shtml files are relative to my web root, these are not absolute paths on the file system, i.e. /files actually maps to /var/www/html/files.

You’re now good to go, HEADER.shtml should contain all the xHTML you want to appear before the directory listing, and README.html is everything after… make sure you include all the correct <html>, <body> and DOCTYPE tags.

Now you’ll want to get working is some dynamic content, for a simple “print current directory” you can use

<!--#echo var="REQUEST_URI"-->

in your html, further documentation on getting more magic is available here & here, I was able to knock up a simple line of code to print the current year at the bottom of the page….

<!--#config timefmt="%Y"-->
<small>Nick Bettison 2005 - <!--#echo var="DATE_LOCAL"--> &amp;copy; </small>;

Cool eh! The trick to watch out for is spaces in the above code, there should be no white space between

<--#echo

or the trailing

-->

After.

The final thing you’ll want to look at is those horible default icons! You have a couple of options: You can either simply replace/over-write the default ones (on my flavour of linux they are in /var/www/icons), or you can add

AddIcon /icons/tar.png .tar

to your htaccess file telling apache to look at tar.png rather than the default tar.gif, I found some deb archives which I extracted with file-roller (rather than trying to install anything) and simply changed the ones I was going to use…. I’m very please with the final result, I think it makes a big difference.

Happy Styling One & All!

These are the steps I ran through to enable usb networking between my nokia n800 and my fedora 7 laptop.

First we’ll start with the basic setup… I’ll assume you’ve read a getting started article similar to mine and already have root & xterm. By default n800 has a usb interface configured, you just need to enable it, so on your n800 type:

sudo gainroot
insmod /mnt/initfs/lib/modules/2.6.18-omap1/g_ether.ko
ifup usb0

The default settings add an interface with a static ip of 192.168.2.15/24 with a default gateway of 192.168.2.14.

Now lets set up something similar on Fedora, you need to create a file in /etc/sysconfig/network-scripts called ifcfg-usb0 with the following…

DEVICE=usb0
BOOTPROTO=static
IPADDR=192.168.2.14
BROADCAST=192.168.2.255
NETMASK=255.255.255.0
NETWORK=192.168.2.0
ONBOOT=no
MII_NOT_SUPPORTED=no

Now plug the usb cable into both devices, and on your fedora box (as root) type

ifup usb0

You now have connectivity, of course if you have a default fedora install pinging 192.168.2.15 will fail because of the firewall, it is probably best to temporarily disable the firewall (/etc/init.d/iptables stop) to see if it works, if so move onto configuring your firewall correctly (/etc/init.d/iptables start starts it again) You may also get usb conflicts, you can try

rmmod uhci_hcd

but it will disable any USB devices, you have been warned.

With this basic connectivity setup you’ll have two issues; you only have connectivity between fedora & n800 nothing else works, and opening any application on n800 causes it to try and connect to your wifi, so lets look at those….

I’m going to assume you used system-config-securitylevel to configure your firewall, its worth noting that any changes you make now will be overwritten by any future use of system-config-securitylevel so it’s probably best to take a backup of /etc/sysconfig/ipatbles now and later when you’re finished.

So as root type:

iptables -I RH-Firewall-1-INPUT 2 -i usb -j ACCEPT
iptables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD 1 -s 192.168.2.0/24 -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface eth0 -s 192.168.2.0/24 -j MASQUERADE
/etc/init.d/iptables save

This will allow all connectivity in from the usb interface allowing the n800 to send packets into the fedora box whilst the firewall is running, it will also NAT any traffic from the usb network hiding the n800 behind fedora so that you get onward connectivity. To get the NAT to work you need to enable ip forwarding, this allows fedora to pass pakets between interfaces, to do that type

echo 1 > /proc/sys/net/ipv4/ip_forward

and to get it to survive a reboot update /etc/sysctl.conf with

net.ipv4.ip_forward = 1

The final part is to enable name resolution (DNS), on n800, I updated /etc/resolv.conf with the opendns servers…

nameserver 208.67.222.222
nameserver 208.67.220.220

All things being equal you should now be able to ping www.google.com from your n800

To get applications to connect, I found on the latest version of ITOS that the DUMMY IAP didn’t work, so I stumbled across this solution.

Create an “ad hoc” wifi connection with static IPs… anything it doesn’t matter, and when that’s connected in xterm (as root) type ifconfig wlan0 down , you should now be able to connect to the web with your browser / skype etc over your usb network… sweet!

I’ve decided to write up all my notes, and bookmarks to make things easier for any other n800 n00bies Before we get started the compulsary screen shot !

Adding Software.
You’ll notice that there’s not a great deal installed, and what’s there very much resembles a phone ( *shock* ) and very quickly you’re going to want something extra. Now you’re in a bit of a chicken and an egg senarior, some software requires root access (more on that later) and some have a neat “single click install”.

First place to look for “single click installs” is maemo.org/downloads but you’ll notice, that some of the icons are greyed out, so I’d recomend going though the pain (lots of typing / hand writing with a stylus is) of setting up all the application repositries. To do so, open up the application manager, click (menu) Tools -> Application Catalogue -> New and simply fill in the fields for each repo one at a time. After completeing this you’ll be asked to refresh the catalogue, if you get errors you”l have to go through each one singley disabling it, doing a refresh until it works, and then check that you’ve made no mistakes; on the other hand if it works you’ll notice loads of new cool things you can install.

Got root?
If you’re new to linux, and don’t know about root, it’s basically the same as the “Administrator” account on windows… but with on exception root has NO RESTRICTIONS.. windows can (and does sometimes) stop the administrator from doing things (like deleting locked files) Unix / Linux will let the root account do anything, including wipe the file system, so use the root account with care.

You’re going to need root to do certain things, to use root you need to install “xterm” and “becomeroot” from you’re list of newly setup applications. Running xterm will give you a shell (like a windows dos prompt) where by you can directly type commands into the underlying linux, buy typing sudo gainroot you’ll notice the prompt will change from $ to # you now have god like access to your box… at this point I recomend you change the root password from “rootme” to something more secure, type passwd and follow the instructions.

(If that doesn’t work, read below, install ssh and see this)

Remote Access.
You can get remote access onto your n800 via a couple of ways. If you like a GUI try x11vnc from here you can get a vncviewer (for windows or linux) download the .deb file and open it with the application manager. I had no problems getting this working, but I did find using the mouse and keyboard on my pc a little slow and un-responsive so ymmv

The otherway, and what I use is an SSH sesion, much quicker very usable, and like running the xterm from your pc. From the list of installable applications choose “dropbear server” and using a client (try putty for windows).

To connect to your Internet Tablet you will need to know its IP address. To find this open the Connection manager and select Internet connection > IP address from the menu. Tip – you may find it easier to use a fixed IP address.

you can ssh root@ipaddress (using the password you set before, see why I said to change it) of course to be safe you can ssh user@ipaddress, but you’ll have to change the password for user like you did before but in a $ shell.

You’ll also want to disable ssh from starting automatically, you don’t want some script-kiddy trying to hack your box whilst you’re connected to a wifi network, as root type update-rc.d -f dropbear remove , then when you need it you can do /etc/init.d/dropbear start

Battery Life.
The 1st thing I noticed when I got my new toy was that I hammered the battery and only got about 1 -> 2 hours wireless useage. I can confirm that using adhoc wireless connections eat the battery, out in the world with proper AP’s battery life seems fine (3hrs+ online perhaps), but at home it really doesn’t last that long.

There are lots of things you can do, to improve battery life. 1st up enable “soft power off” , this will allow you to hold down the power button to but n800 into standby mode, really usefull for hitting before you put it back in your pocket. See this post here for a full set of instructions. Next up, tweak your wireless settings.. what you set here will depend on what you brought the n800 for, I would have thought most people would disable the “search for wifi” functionality as you probably don’t need it to automagically connect to a network whilst your driving or walking, so under the control panel -> connectivity set the search interval to “Never”. I’ve also screwed my Idle times right down so that it disconnets if I’m not doing anything …I haven’t yet been disconnected when I was doing something, but I do usually have to hit “connect to network” before opening a brower etc.

I’d also suggest using offline mode when you’re watching a video or something, that ways “stuff” isn’t happening in the background when you’re not using it.

End of Part One
I think that’s long enough, those few tips should be enough to make most users 1st experience better, in part two I’m going to talk about Apps, what I’ve installed and what didn’t get uninstalled

Hopefully you get the point, sometimes you need different tools for different jobs, if you want a full development platform with SVN support I suggest you take a look at eclipse (with subclipse ) but what if you already have done the development and you just want to do a quick upload.

My phpbb_recent_topics plugin is hosted here, and when the nice guys at wordpress gave me an svn account, I just wanted a quick way to upload what I’ve done. Now I must stress this may not be the “proper” way to use svn (there’s a book for that) but it is enough to achieve what we want, a straight forward upload.

I’m using redhat, so the 1st step was to install dag’s subversion rpm , I also needed to setup an “editor” variable for commenting.

SVN_EDITOR=vi
export SVN_EDITOR

Then, I went into a directory onto my server, and downloaded a copy of the existing subversion directory structure.

[nick@SERVER wp_plugins]$ svn checkout https://svn.wp-plugins.org/phpbb-recent-topics/
A    phpbb-recent-topics/trunk
A    phpbb-recent-topics/branches
A    phpbb-recent-topics/tags
Checked out revision 9232.
[nick@SERVER wp_plugins]$

My plugin (at the time) was on version 1, so my 1st steps were to create a version 1 tag, add it to svn, get the stable copy of my plugin, add that to svn.

[nick@SERVER wp_plugins]$ cd phpbb-recent-topics/
[nick@SERVER phpbb-recent-topics]$ ls
branches  tags  trunk
[nick@SERVER phpbb-recent-topics]$ cd tags/
[nick@SERVER tags]$ mkdir 0.1
[nick@SERVER tags]$ cd ..
[nick@SERVER wp_plugins]$ svn add phpbb-recent-topics/tags/*
A         phpbb-recent-topics/tags/0.1
[nick@SERVER wp_plugins]$ cd phpbb-recent-topics/tags/0.1/
[nick@SERVER 0.1]$ wget http://www.linickx.com/files/php/phpbb_recent_topics.txt
[nick@SERVER 0.1]$ mv phpbb_recent_topics.txt phpbb_recent_topics.php
[nick@SERVER 0.1]$ svn add phpbb_recent_topics.php
A         phpbb_recent_topics.php
[nick@SERVER 0.1]$

Finally I updated everything, and uploaded (committed) my files.

[nick@SERVER 0.1]$ cd ../../../
[nick@SERVER wp_plugins]$ svn update phpbb-recent-topics/
At revision 9232.
[nick@SERVER wp_plugins]$ svn --username linickx commit phpbb-recent-topics/
Adding         phpbb-recent-topics/tags/0.1
Adding         phpbb-recent-topics/tags/0.1/phpbb_recent_topics.php
Transmitting file data .......
Committed revision 9233.
[nick@SERVER wp_plugins]$

Remember this doesn’t publish your plugin on wordpress.org, to do that you need a valid readme.txt in the trunk directory, but as you can see once you’ve created all the files on your local box, it’s just a few commands to get your work uploaded.

Did you notice that the wordpress svn supports SSL ?

First off a warning: Don’t do this ! All the documentation, for CentOS, RHEL, Fedora, any redhat linux all say, clean installs are the best way, and upgrades are not advised…. therefore I offer no support or warranty that this will work, in fact, I you advise you to read this post, but step away from your consoles !

But, if you think it might be a laugh, the centos documentation is a bit old, and not 100% correct, so here is what I did. First up (as root – obviously), clear out your yum cache,and install the CentOS gpg key.

yum clean all
rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-4

Next, install some base centos packages, take not that some need to be forced on

rpm -Uvh --nodeps http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/centos-release-4-4.2.i386.rpm
rpm -ivh http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/python-elementtree-1.2.6-4.2.1.i386.rpm
rpm -ivh http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/python-sqlite-1.1.7-1.2.i386.rpm
rpm -ivh http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/sqlite-3.3.3-1.2.i386.rpm
rpm -Uvh --force http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/python-urlgrabber-2.9.8-2.noarch.rpm
rpm -Uvh --nodeps http://mirror.centos.org/centos/4.4/os/i386/CentOS/RPMS/yum-2.4.3-1.c4.noarch.rpm

finally remove the whitebox rpm db.

rpm -ev rpmdb-whitebox

Move any “whitebox” mirrors still in /etc/yum.repos.d and

yum install rpmdb-CentOS

Once you have that sorted, you can complete the upgrade with

yum update
reboot

& cross your fingers
If you come across the following warnings while using yum: Warning, could not load sqlite, falling back to pickle , I found…

yum install python-sqlite

Fixed the problem. And there we have it, all my boxes are now running CentOS – yay – just in time to look at the CentOS 5 upgrade

Dependency Problems ?
If a whitebox rpm is newer than the CentOS one, it won’t get upgraded, this might cause problems when installing new packages via yum. To solve the problem download the rpm manually from http://www.centos.org/modules/tinycontent/index.php?id=13 and force an upgrade

rpm --force -Uvh Something-CentOS.rpm

UPDATE: If you’re using something like Root Kit Hunter, you will notice a load of md5 hashes fail, these are whitebox rpm’s that didn’t need upgrading, to correct the problem you need to replace these with CentOS versions.. example rkhunter output:

/sbin/init  [ BAD ]

Find which rpm, init belongs to

# rpm -q --whatprovides /sbin/init
SysVinit-2.85-34.3

and upgrade it

wget http://www.mirrorservice.org/sites/mirror.centos.org/4.4/os/i386/CentOS/RPMS/SysVinit-2.85-34.3.i386.rpm
rpm --force -Uvh SysVinit-2.85-34.3.i386.rpm

Nagios is a great, enterprise class, open-source monitoring application; and what you need do is configure it to exactly represent how wordpress works; if you can get that right you can immediately get notified if any piece of the puzzle fails.

I’m going to write up a simple example of how to monitor wordpress and it’s associated jigsaw pieces, so we’re going to setup one host with appropriate dependant services. Ultimately, you should configure nagios to suit exactly how your environment works, but hopefully this “how to” will get you started.

Basic Config.
To configure nagios you need have services (such as http) associated with hosts; to get started, I’m going to have to assume you have followed another “how to” and have nagios up and running, and monitoring localhost, you can even use my own config generator to get you started Basically you should have a generic check-host-alive host.cfg entry like so:

define host{
        use                     generic-host            ; Name of host template to use
        host_name               linickx.com
        alias                   My WebSite
        address                 www.linickx.com
        check_command           check-host-alive
        max_check_attempts      10
        check_period            24x7
        notification_interval   120
        notification_period     24x7
        notification_options    d,r
        contact_groups  admins
        }

The first (and easiest) part of wordpress to monitor is the web-server which serves the web pages on port 80, so a /etc/nagios/serivces.cfg entry like.

define service{
	use                             generic-service         ; Name of service template to use
	host_name                       www.linickx.com
	service_description             HTTP
	is_volatile                     0
	check_period                    24x7
	max_check_attempts              10
	normal_check_interval           1
	retry_check_interval            1
	contact_groups                  admins
	notification_options            w,u,c,r
	notification_interval           960
	notification_period             24x7
	check_command                   check_http
}

Getting Technical.
Have you noticed the deliberate mistake ? I’m using resolvable names in my config files, this is deliberate as my website is on a shared server, and check_http with an IP address is very different to check_http www.linickx.com , but in order for www.linickx.com to work, DNS needs to be working. While we are here, it makes sense to monitor that as well. In /etc/nagios/checkcommands.cfg add an entry similar to….

# 'check_dns' command definition
define command{
        command_name    check_dns_linickx-com
        command_line    $USER1$/check_dns -H www.linickx.com -a 69.73.189.228
        }

Where the -a ip address , is the ip of your “A Record”, if you don’t know what that is you can use dnsstuff.com to find it for you. You can now create a service that uses that command…

define service{
        use                             generic-service         ; Name of service template to use
        host_name                       linickx.com
        service_description             DNS
        is_volatile                     0
        check_period                    24x7
        max_check_attempts              10
        normal_check_interval           5
        retry_check_interval            1
        contact_groups                  admins
        notification_options            w,u,c,r
        notification_interval           960
        notification_period             24x7
        check_command                   check_dns_linickx-com
        }

We have HTTP and DNS monitored, all the wordpress data is stored in a mySQL database, so now you need to monitor that, to do that you need to setup another checkcommand; add the following.

# mySQL command definition
define command{
	command_name    check_mysql
	command_line    $USER1$/check_mysql -H $HOSTADDRESS$ -u $ARG1$ -p $ARG2$
}

This check command will log into the database and report OK if it is working, much better than check_tcp 3306 . Now you can add the following service entry

define service{
	use                             generic-service         ; Name of service template to use
	host_name                       www.linickx.com
	service_description             mySQL
	is_volatile                     0
	check_period                    24x7
	max_check_attempts              10
	normal_check_interval           5
	retry_check_interval            1
	contact_groups                  admins
	notification_options            w,u,c,r
	notification_interval           960
	notification_period             24x7
	check_command                   check_mysql!USERNAME!PASSWORD
}

For this to work the user will need to have permissions to log into the nagios machine, so if you followed the wordpress codex and added “TO wordpressusername@localhost” in your mysql statement, you’ll need to add that to run

GRANT ALL PRIVILEGES ON databasename.* TO wordpressusername@NAGIOS-SERVER;

where NAGIOS-SERVER is a resolvable name or ip address. Note: Don’t forget about firewalls ! Make sure that TCP 3306 is open between your nagios box & wordpress website.

The bit that actually monitors wordpress.
You are now independently checking both HTTPD & MYSQL, but what if wordpress can’t actually connect (lets say wp-config.php is screwed), both these checks will pass and nagios will stay green; what you need to do is monitor a page. If that page works , everything’s fine, if the page fails (and you get the default database connection error page) then nagios flags and alert. We’re going to add another checkcommand

# 'check linickx.com wordpress' command definition
define command{
        command_name    check_wp_linickx
        command_line    $USER1$/check_http -H $HOSTADDRESS$ -u /blog/about-me -s "About Me"
        }

You can alter this in anyway you want, but what it does is it looks for http://$HOSTADDRESS$/blog/about-me (so http://www.linickx.com/blog/about-me) and if that page returns “About Me” then everything is OK.

Tidying up with dependencies.
We’ve already established that if either mySQL, http or DNS fails, wordpress will fail, so we want to ensure we don’t get hit with double alerts about the same problem, enter dependencies. HTTP is dependant on DNS, enter the following in /etc/nagios/dependencies.cfg (make sure you have cfg_file=/etc/nagios/dependencies.cfg in /etc/nagios/nagios.cfg )

define servicedependency{
        host_name                       linickx.com
        service_description             DNS
        dependent_host_name             linickx.com
        dependent_service_description   HTTP
        execution_failure_criteria      n
        notification_failure_criteria   u,c
        inherits_parent         1
        }

and WordPress is dependant on HTTP & mySQL , so you need…

define servicedependency{
        host_name                       linickx.com
        service_description             HTTP
        dependent_host_name             linickx.com
        dependent_service_description   WordPress
        execution_failure_criteria      n
        notification_failure_criteria   u,c
        inherits_parent         1
        }

define servicedependency{
        host_name                       linickx.com
        service_description             mySQL
        dependent_host_name             linickx.com
        dependent_service_description   WordPress
        execution_failure_criteria      n
        notification_failure_criteria   u,c
        inherits_parent         1
        }

You can check your config with nagios -v /etc/nagios/nagios.cfg , assuming you have no errors wait for checks to go green and begin testing. Tests you can run can be anything from unplugging the cable from your nagios box to simulate a complete failure, to stopping the mysql service on your website to make sure check_mysql works.

Making it pretty for the hell of it.
Nagios has a web interface, one of the things we can do is customize it to represent our config, how about a pretty icon for our website ? or a custom wordpress action ? Here’s how to setup a pretty icon and action (button to click on) for our wordpress service.

To get started, you’ll probably need a copy of the wordpress logo from the svn , I then cut the “W” out to make a square icon, but you can do what you like Firstly something non essential: To display any icon in nagios as a “host icon” you’re going to need it in both png and gd2 image format, you’ll have to install a conversion tool. (for redhat)

yum install gd-progs

to run the conversion, use the following…

pngtogd2 wordpress-logo.png wordpress-logo.gd2 0 1

that’ll give you a chunk size of 0 and no compression as recommended for nagios.

But if you just want service icons, then you can get away with just a png. Save any custom images in /usr/share/nagios/images/logos/ make sure they’re readable ( e.g. chmod 644 file ) and we’re good to go.

So the config file, 1st make sure you have cfg_file=/etc/nagios/serviceextinfo.cfg enabled in /etc/nagios/nagios.cfg . My sericeextinfo.cfg has the following…

define serviceextinfo{
	host_name               linickx.com
	service_description     WordPress
	notes                   My website  powered by wordpress !
	icon_image              wordpress-w.png
	icon_image_alt          WordPress
	action_url              http://$HOSTADDRESS$/blog/wp-admin/
}

What this does is it adds my wordpress-w icon to the nagios status pages, and give me a “red star” type icon which when I click on takes me to my wordpress admin page… cool !

Some compulsory Screen-shots.

That should just about wrap it up, one fully monitored wordpress installation; as you can see this can be adapted to monitor any php / mysql app Please let me know if you have any further suggestions.