LinuxSecurity Contributor writes, “This week, perhaps the most interesting articles include “Chrooting All Services in Linux,”
“Snort-Setup for Statistics HOWTO,” “Non-stop authentication with Linux clusters,” and “Building
a Linux Firewall.”

http://www.linuxsecurity.com/articles/forums_artic le-4242.html“

– By Daniel P. Dern –
Companies using Bluesocket‘s wireless
gateways may never know that there’s Linux inside the box. But
Bluesocket CTO Dave Juitt and his engineering staff are very aware of it;
in fact, he deliberately chose Linux for use in the company’s WG-1000 Wireless Gateway product, and is also looking ahead to using embedded Linux in its upcoming
next-generation product.

Wireless LAN technologies like the 802.11 (a.k.a. “WiFi”) family and Bluetooth let notebook and handheld computers, and peripherals like printers and phone headsets, communicate with networks and other devices, through a wireless “access point” or router.

Wireless service is convenient, easy to deploy and affordable. There’s no need for
notebook users to get up close and personal enough to an Ethernet hub to plug a
wire in, and no limit to users based on available hub ports. Wireless access
points and even wireless firewall/routers that can plug directly into to an Ethernet
port are available from companies like D-Link and LinkSys for less than $200.

But there’s a price to pay for convenient network access in the potential for misuse. For most home and SOHO wireless LAN users, the encryption features built into the
wireless services are sufficient to provide privacy and keep out unauthorized users.

However, companies and carriers are quickly discovering that wireless LAN access
has some of the same management concerns that they experienced in adopting wide-area networks, LANs, and Internet access from the corporate network, notably
access management such as authenticating users, privacy, quality of service, and bandwidth management.

“Because you’re dealing with such a skinny pipe being shared by possibly dozens or more users, you need all the management of bandwidth you can get,” says Patrick Rafter, director of corporate communications at Bluesocket. (Remember the drain on corporate and university Internet connections due to Napster, or, back in the 1990s, by Web access in general?)

Bluesocket to the rescue

Bluesocket’s WG-1000 Wireless Gateway offers one way to solve these problems for
wireless users. (Vernier Networks
and Reefedge, Bluesocket’s competitors, use
different network architecture approaches.)

Topologically, a WG-1000 sits between the wireless base station access points
and the rest of the network, and serves as a packet-filter firewall for all
traffic going to and from the wireless users. The WG-1000 supports VPN-like
IPsec tunneling for wireless LANs, and also provides management features
common to networks such as role-based access control, quality of service, and bandwidth management.

Physically, Bluesocket’s WG-1000 Wireless Gateway — currently based on a
866MHz Pentium III with 256MB RAM — comes as a 1U rack-mount enclosure,
allowing it to be installed in a standard rack in a wiring closet.

People with wireless-equipped notebooks and PDAs can, for example,
check email or use LAN/web-based applications while wandering from floor to floor,
or providing access control to Ethernet ports in semi-public spaces such as conference
rooms, cafeterias, etc. According to Rafter, one Bluesocket WG-1000 nominally supports up to ten 802.11b access points.

Bluetooth or 802.11, you choose

Because the WG-1000 isn’t directly providing the wireless service per se,
it’s independent of the radio frequency wireless technologies involved, meaning it should work equally well with 802.11, as well as Bluetooth,
HiperLAN2,
or any mix thereof. Currently, Rafter says, “most of what’s
out there is 802.11b,” and, according to Juitt, Bluesocket has demonstrated
interoperability with Bluetooth as well as with 802.11b.

Bluesocket only began shipping its first production boxes in September 2001,
often letting prospects try them out for a month — and nobody seems to
be returning them. The WG-1000 is currently being sold in more than 15 countries,
including Japan and New Zealand.

Organizations using Bluesocket’s Wireless Gateways include everything from
major technology-using workplaces such as accounting firms like
KMPG Consulting, in their four-floor office in the United Kingdom,
through universities in the United States, Europe, and Japan.
Even Microsoft is using it, in its Boston-area Envisioning Center,
to let visiting business executives make use of the .NET demos, check email, etc.

The University of Texas at Dallas is using one to control the wireless access it has deployed in apartment buildings, which house a mix of students and other tenants, according to Doug Jackson, director of technology
customer services at the university. The authentication and privacy features to restrict
access only to students. The first complex has 530 residents, and 48 wireless
access points; Jackson says he’s measured up to 172 simultaneous users going
through the Bluesocket gateway.

Similarly, Lasell College in Newton, Mass. is using a WG-1000 to provide controlled access to campus resources and the Internet for wireless users in the half-dozen areas the college has experimentally wireless-enabled, says Deborah Gelch, director of information technology at Lasell.

Linux enables rapid prototyping and system development

Although it’s not visible either to users or even network administrators — who
manage their WG-1000s through a Web-based interface — there’s Linux in
Bluesocket’s boxes.

Bluesocket CTO Dave Juitt, who was Bluesocket employee No. 1, deliberately
chose Linux as the development and production environment, and expects to
use embedded Linux —
network-upgradeable firmware — in the next-generation wireless gateway,
which is still under development.

“I’ve seen a lot of technology evolution and software,” says Juitt, whose
experience in security includes working at MITRE, Digital Equipment
Corporation and GTE Labs. “I work from a systems engineering perspective
in terms of creating viable products.”

To Juitt, “Linux is a wonderful operating environment that allows people to use
it as an underlying platform to create services and systems on top of. It’s amazing:
if you need building blocks, are going to snap things together — it’s modular
below the line of what the end user sees, and is seamless above it.

Linux and Open Source give Bluesocket access to a wide range of
quality resources. “Thanks to the huge number of developers all revealing
each others’ work, the quality of the code is very high to start
with, and the Linux community functions as extension of our own QA
department to test and reliable products to market more quickly,” Juitt says.

This means that “if you do the system engineering right, you
can very quickly put together a viable environment, versus what, say, back
at Digital, would have taken man-years of effort. Linux reduces that to
man-months,” he says.

“We went from prototype to product of the WG-1000 in six or seven months.

“I’m talking specifically about the architecture of Linux, not Unix; how it allows for modularity — and the availability of integral parts —
and how integrating Open Source in Linux enhances things. Open Source is the lever that creates the value. There’s a tremendous depth of knowledge that we can leverage. It’s like having a worldwide engineering team.”

In terms of Linux/Open Source resources (in addition to Red Hat Linux as the OS)
used by Bluesocket, “We rely on IPTables (the Netfilter framework was *very*
useful), MySQL, the Reiser filesystem, and CVS,” Juitt says.

Juitt selected embedded Linux rather than, say, QNX, for the next product, because
“the embedded Linux environment is in our technology vector.

“Our early commitment to Linux defined our direction and will make it easy
to go toward embedded Linux.” In turn, “an embedded Linux solution gives us
the development benefits of rapid prototyping, reusable components, and continued
access to the Open Source community.

“To be able to take a heavyweight operating system like Linux,
do the integration and system engineering, and refine it into an embedded
Linux appliance, is an amazing engineering path not available with any other
technology platform,” says Juitt.

“Linux is turning out to be a rapid prototyping tool that gives you a complete
system engineering environment in which to create. We can do what we need
to do with all the heavyweight compilers, we’ve got all the languages available.
We can do a proof prototype, create an early release, and then take all we’ve
done and port it into embedded Linux to get performance.”

Choosing Linux at the beginning has made it possible to evolve quickly into
the embedded systems approach, says Juitt. “My system engineering background says
you need to be able to see the whole system, the artist in me says you have to be able to get it onto the canvas quickly. You can’t do that with MVS or VMS.”

The Open Source aspect of Linux has been as important as its modularity,
Juitt says. “Linux is based on code reviews, so you know what’s
going in is high quality. The peer review quality of OS is so strong, it’s
a boon to get that access. You’re integrating technology that has been reviewed,
and can be verified.”

For a base distribution, Bluesocket uses Red Hat Linux. Bluesocket does have
proprietary software of its own, such as its control program, which the company has
been careful to segregate from the Open Source code.

“The tricky part for us is to keep from tweaking Open Source code,
to be able to maintain the integrity of all the Open Source software and
still have seamless integration with our software,” Juitt says.
“If you’re going to make use of Open Software, it’s important to
play by the rules.”

While Bluesocket is keeping its own software closed source, it has
been doing its best to also give some value back to the Open Source
community in the process of using open code.

“We’ve got a patch or two to the DHCP daemon we’re using,” Juitt says.
“We will be releasing the patch soon, and reviewing other contributions we can make.”

Daniel P. Dern is a freelance technology writer.
Most recently he was executive editor of Byte.com. His Web site
is www.dern.com.

Ted Kenney writes, “The iApplianceWeb site for information appliance development has published an article describing a Linux-based benchmark examining different approaches to real-time, memory-resident data management. The article, written by Steve Graves, CEO of McObject, tests the performance of a ‘traditional’ database deployed on RAM-disk against main memory database (MMDB) technology designed for memory-only use. Sources of database processing overhead are discussed. The piece is at http://www.iapplianceweb.com/story/OEG20020104S0070.”

The Associated Press (on CNN.com) reports on the Moxi Media Center, a souped-up digital media server with an 80-gigabyte
hard drive. It can deliver to as many as four televisions video recorded from a TV
signal and video or audio stored on the hard drive or from a built-in DVD/CD
player. “Moxi uses the open-source Linux operating system, meaning other companies can
easily change software layers or build new applications on top of the platform. The
company says its technology allows cable operators to reduce their average
manufacturing cost of digital set-top boxes from $570 per TV to $425 for a
single-TV household and $250 to equip a second TV.” More on Moxi from ZDNet.

ZDNet reports that a Remote Shell Trojan making its way around the Linux community us being dismissed by
security experts, who say it should not pose a risk if users are vigilant with the programs
they run.

ROCKETCALC LLC writes, ROCKETCALC announces Redstone, the first personal cluster computer. Approximately the size of a mid-tower PC (17x11x19.5in), Redstone contains eight Pentium processors connected by 100Mbps switched ethernet and up to 8GB PC-133 SDRAM. Redstone runs on Motor, an embedded Linux distribution developed by Rocketcalc, and is easily managed by Houston graphical cluster management software.

Redstone is designed to be easily integrated with Linux workstations and includes a CD-ROM collection of the most popular message-passing libraries and parallel utilities. Redstone is well-suited to parallel high-performance scientific computation, parallel application development, and classroom use.

For pricing information and available configurations, please visit the webpage http://www.rocketcalc.com or send an e-mail to info@rocketcalc.com.

PC Magazine offers a handful of predictions for 2002. Among them:”Linux will become user-friendly and emerge as a true desktop operating system competing
with those of Microsoft and Apple. But the interface will go in the direction of the Macintosh,
not Windows, once cross-compilers appear on the market and people discover that Apple’s
new Unix-based kernel makes porting from Mac to Linux easier than porting from Windows to
Linux. These cross-compilers will appear magically, but will turn out to have been waiting in
the wings.”

NuSphere Corporation today announced a new
version of NuSphere(R) Pro Advantage that improves application development
in group settings. Specifically, NuSphere Advantage V2.4 gives development
teams the version control and collaboration tools they need to create and
deploy web-based applications by adding tools including WebDAV (Web-based
Distributed Authoring and Versioning) and CVS (Concurrent Version Systems).
These upgrades continue NuSphere’s strategy of quarterly product rollouts,
ensuring customers the latest in technology and reliability.

NuSphere Pro
Advantage gives web application developers both the scalability and
manageability of a proprietary platform, and the affordability and
reliability of standards-based technologies such as PHP and Apache.

Web development teams are often geographically dispersed, gathering
information from diverse sources. With enhanced collaboration tools,
developers can work together in the next office, or accept contributions
from anywhere on the Internet. NuSphere PHPEd(TM) Advantage allows
enterprise developers to create and debug web applications through a single
IDE, and with these additions, multiple developers can collaborate on
projects directly through the IDE.

“This product has allowed us to successfully utilize a decentralized team
of programmers and decrease our development cost. It streamlines the
management of group projects and helps us save time and money for our
clients,” said Principal Michael Soracchi of struXsure Inc.
(http://www.struXsure.com). “With the addition of CVS and WebDAV, NuSphere
again is leading the way for PHP development. We have been using Pro
Advantage since last summer because we feel NuSphere offers the best
solution for PHP developers. Our developers can now push their
contributions to a central server, allowing simplified management of code
revisions, which will dramatically decrease our time to production.
NuSphere Pro Advantage is what struXsure is all about; as a business
solutions provider, it helps us to leverage our extensive experience
developing and implementing business driven technology solutions, meets all
of our core requirements and at the same time helps us lower our technology
costs, a grand slam for a growing company like struXsure. We love the product.”

“Issues such as controlling concurrent access to key aspects of a
development project, configuration management and code coordination, become
increasingly difficult with each additional developer working on a
project,” said Lorne Cooper, president of NuSphere. “NuSphere’s new,
integrated collaboration tools solve these problems by providing developers
with a distributed development environment linked to a central source for
their project. With these tools, NuSphere extends our affordable platform
for developing and deploying Internet applications, including all the
necessary development, collaboration and security components, from small
teams to both small and large groups.”

NuSphere Advantage V2.4 further expands on the company’s commitment to
provide users the best tools to build and deploy reliable, cost-effective,
enterprise-class applications. Specifically, NuSphere Pro Advantage now
includes the following:

Push-Button Deployment: WebDAV enables groups of developers to
collaborate on producing web sites over the Internet. Once WebDAV makes
documents available for editing on the web, collaboration is greatly
simplified. For example, if a person begins to work on a single author
document, adding another collaborator is easy, requiring just a change in
permissions to allow access to a document. This gives projects “push-button
deployment,” where everyone authorized can access files, edit them and
publish them.

Team Collaboration: Developers working on a team need to be able to
coordinate their individual changes, as well as work together. A
centralized version control system enables this process. Offering one of
the key features needed in open source development, CVS uses an unreserved
check-out model-one that doesn’t lock out other developers’ rights to that
file. Developers can organize their code contributions by keeping a history
of the changes made to a specified set of files. This permits a group of
developers to simultaneously work on a project and submit changes. Multiple
developers can access and edit the same, and CVS can automatically merge
the changes. With a CVS server, developers can contribute from all over the
world.

NuSphere® Advantage Availability
NuSphere Advantage V2.4, which includes CVS and WebDAV, is currently
available online for the entire Advantage product line: NuSphere Pro
Advantage, NuSphere PHPEd Advantage and NuSphere MySQL Advantage. For
NuSphere PHPEd Advantage and Pro Advantage customers, this upgrade will
also include additional feature enhancements for PHPEd. NuSphere Advantage
subscribers receive free quarterly updates comprising technology
enhancements that build off of its core components. Pricing and further
documentation for each software suite is available at www.nusphere.com.

About NuSphere Corporation
NuSphere delivers the first Internet Application Platform (IAP) based on
open source components, providing an integrated foundation that allows
companies to deploy reliable, cost-effective, enterprise-class applications
across Windows, UNIX and Linux environments. NuSphere® Advantage is an
integrated software suite that pairs the reliability and cost-effectiveness
of Apache, MySQL, Perl and PHP with new technology for building
business-critical web applications. NuSphere Pro Advantage was named “Best
Developer Tool” at LinuxWorld Fall 2001. Based in Bedford, Mass., the
company’s commercial software services include technical support,
consulting and training. For more information, visit www.nusphere.com or
call +1-781-280-4600.

# # #

NuSphere is a registered trademark in Australia and Norway; and NuSphere,
NuSphere MySQL and PHPEd are trademarks of NuSphere Corporation in the U.S.
and other countries. MySQL AB has applied for trademark registration of
MySQL. Any other trademarks and/or service marks contained herein are the
property of their respective owners.

Linux NetworX, a provider of powerful and easy-to-manage cluster supercomputing solutions, announced today plans to expand its Professional Services Group to help lower the barriers to adopting Linux-based cluster systems. Existing services include on-site cluster integration and 7 x 24 support, while expanded services will include application porting and optimization, and cluster training/certification.

“The Linux NetworX Professional Services Group will help make cluster computing more widely available to those organizations with limited technical resources, while allowing all of our customers to get the most out of their clustering investment,” said Clark Roundy, vice president marketing and professional services for Linux NetworX. “The benefits of the expanded services include easier-to-manage and more efficient systems that further reduce the total cost-of-ownership for our customers.”

The application porting service to be offered by Linux NetworX is vital in helping organizations change from traditional supercomputer or UNIX-based system, to using a Linux cluster supercomputer. For most organizations the return-on-investment for porting the application is realized well within the first year because of the enormous price-to-performance advantage Linux clusters deliver.

Linux cluster supercomputing, sometimes called parallel processing or distributed computing, is a method of linking multiple computers together to form a unified and very powerful system. By taking advantage of standard computer components, Linux NetworX clusters can match the performance of supercomputers for a fraction of the cost. Despite all of the benefits of clustering, there are some challenges, including the need for in-depth technical knowledge, and application compatibility.

Linux NetworX currently offers system integration, training and on-going support services. Application porting and optimization services will be available Feb. 2002, while Linux cluster certification training will be available May 2002. For more information, please e-mail services@linuxnetworx.com, or refer to http://www.linuxnetworx.com.

About Linux NetworX
Linux NetworX (www.linuxnetworx.com) brings its powerful and easy-to-manage cluster technology to those demanding high performance and high availability systems. Linux NetworX provides solutions for organizations involved in oil and gas exploration, aeronautical and chemical modeling, biotechnology research, graphics rendering and visual effects, Web serving, ISPs, ASPs, and other technological research fields. Through its innovative Evolocity hardware, ICE? cluster management tools and professional service and support, Linux NetworX provides end-to-end clustering solutions. To date, the company has built some of the largest cluster systems in the world, and boasts numerous Fortune 500 customers.

# # #

Linux is a registered trademark owned by Linus Torvalds. AMD and AMD Athlon are trademarks of Advanced Micro Devices, Inc. All other products, services and companies are trademarks or registered trademarks of their respective owners.”

– By Thomas C. Greene of The Register –

What a weekend it’s been. I spent the better part of it installing Linux on what has
got to be the piss-poorest laptop computer ever built. The comical piece of junk to
which I refer is a Compaq 1200 series, which I bought quite deliberately for the
road. I’m confident it’s unlikely to get stolen, and if it does, I’ll be inclined to thank
the thief.
The Presario 1200 is an exceptionally poor candidate for Linux, having been
specifically designed to run Windows, and having every conceivable
money-saving dodge in place. It’s grotesquely underpowered, with 64MB of RAM.
It’s got a CMOS setup which forbids tinkering past setting the time and boot order.

It’s got a ‘system restore’ CD which Compaq is too cheap to put Windows on. This
is perhaps the single most unforgivable item in a vast catalog of offenses. No, the
Windows cabs are all taking up much-needed space on the thing’s puny 5GB hard
disk. So nuts to you if you fdisk the sucker and then fail to get Linux working
decently and have no choice but load Windows again. Compaq will sell you the
CD you’ll need for that, the damnable cheap bastards.

Of course it’s got a Winmodem in place of a real modem, and we all know it’s just
about impossible to make one of those toys work with Linux, thanks to the
trade-secret paranoia of their manufacturers. And we all know how badly broken
the 2.4.x kernel is for PCMCIA, which I insist on having.

But I did fdisk the little junker, and it did feel awfully good. And then I set about
forcing Linux down its ungrateful Windows-compatible little throat.

Since I’d reviewed several of the most recent distros in terms of their ease of
installation and found Mandrake by far the friendliest, I figured I’d take it easy on
myself and start there. I do run SuSE on my desktop and my wife’s, but considering
the number of quality deficiencies Compaq saddled me with, I felt I could rely on
Mandrake to ease the pain.

How wrong I was. First off, it was impossible to run X by selecting my actual video
adapter, a crap item by Trident called the “CyberBlade” (a bit like naming a toy
poodle “Ripper” — fine so long as the irony is intentended).

After various attempts at making it work I finally had to load a generic VGA adapter,
which compromised my lame machine’s performance even more than Compaq
intended. And once Mandrake was installed I had to wrestle with the Winmodem,
which turned out not so bad in the end.

The shitbox has a Conexant Winmodem, and this, it turns out, is the only bit of luck
I can report from the entire escapade. Conexant has got a Linux
driver, and it’s actually effective. The RPM didn’t work for me, but the tarball did, so
long as I deleted /dev/modem before running the shell script. Which I did, on my
fourth or fifth attempt….

All right, so I got my pathetic Winmodem working. A fat lot of good that does me at
home with my preposterously slow, dropped-every-ten-minutes connection to MSN.
(I told you, the box is primarily for the road. MSN is traveler-friendly, if not much
else.)

No, I’d have to get my ethernet card working with my little DSL home network. And
at this point Mandrake beat me down.

I am not a quitter. I ran the two-mile, wrestled, and boxed in high school; and these
are three competitive endeavors one wins solely by being more stubborn and
willing to eat pain than one’s opponents, who are themselves extremely stubborn
and willing to eat pain as well (otherwise they’d be on the volleyball team, now
wouldn’t they).

Mandrake’s idea of installing PCMCIA is to present you with a list of drivers.
You’ve got to install one of them, which it insists on testing. The installer won’t let
you go further until it’s satisfied with your choice. Of course if none of them
happens to work, well, you’ll just have to cancel.

I tried every driver that could possibly have worked, and Mandrake rejected them
all. I did research — I found out which other cards mine emulates. I was systematic.
I was patient, stubborn, and willing to eat pain.

I tried, and tried again. Nothing worked. So I jotted down a number of drivers
Mandrake had available for installation, and hiked up to my nearest CompUSA,
where I bought another bloody card, for which I knew Mandrake had the drivers.

And I inserted it, and I attempted to install it, and Mandrake made a sucker of me
again. Thirty bucks I burned on a spare ethernet card.

So I did some more research, and found a boot image for Mandrake tailored
specifically for PCMCIA installation.

Ah, pay dirt.

This boot image immediately caused the lights on the card’s connector to light up.
Surely I was minutes away from installing it. I booted from the floppy and ran the
Mandrake installation CD, and it crashed.

So i entered every safe-mode command I could think of — ide=nodma, lores, nofb,
noauto, expert, text….

No good, no good, no good. I even tried them all at once. No good.

At that point I fdisked the little junker again.

And then I busted out SuSE, which actually is my favorite, though YaST is
undeniably clunky and entirely too present in the background. Linux is Linux is
Linux, but different distros have their advantages and disadvantages. As distros go,
SuSE is the most flexible one I’ve tried.

So guess what? SuSE likes PCMCIA, even with the crap 2.4.x kernel. There was
no driver to choose; no bollocky ‘test’. I just named it eth0, gave it a generic
192.168.0.1 IP and 255.255.255.1 subnet mask
like any ethernet card, and that was that.

It understands the ‘CyberBlade’ as well, with no difficulties.

SuSE has no decent DSL support unless you’re in Germany, but that’s not a
problem if you’re willing to tweak it. I did give the distro a black mark for this in a
previous review, but that was from the POV of my foil Harry Homeowner, who’s
likely to be inconvenienced if not thwarted by such an omission.

As soon as I got SuSE installed, with eth0 painlessly configured, I simply ran two
nifty RPMs from Roaring Penguin, which make DSL in Linux ridiculously easy
whatever distro or homebrew setup you’ve got. I had the Compaq shitbox on
Verizon’s mighty broadband pipes in minutes.

So now we’re an all-SuSE household here at Chez Greene, and pretty well
delighted all around. We’ve got two desktops and one laptop, and room on our little
$100 router for another machine.

We’re expecting it in March.

All Content copyright 2001 The Register