Turns out local administrators cannot elevate their privileges over the network, with UAC enabled.

Note that this doesn’t affect users in the Domain Admins group!

Now, you could do the dumb “neowin poweruser” thing and turn UAC off, or you could change this particular behavior in the registry. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

And add a new DWORD named LocalAccountTokenFilterPolicy with a value of 1, and then reboot. It all should work.

Again, users with Domain Admin privileges are unaffected.

You can find the new version here.

Questions, comments or Mirrors are welcome, as usual

UPDATE: Charlie Hull informs me that he has coerced my hacked-up Distutils file into SVN Head, which means there’s a good chance my packaging environnement will be integrated into mainline Xapian, or into the Lemur Consulting makefiles. Either way, this means one can build binaries a lot faster, which is great.

Being the kind of guy to plan things through before taking action (usually), I had previously made a test set-up with all the configs in vmware on my local workstation at home, before heading over and installing them. So I pop open my laptop, fire up the Cisco VPN Client, connect over there, leapfrog some routers in between and land on my workstation. Turns out I hadn’t left the vm running, so I can’t access it from the shell by SSH’ing in.

“Hey, no problem!” I thought. “I’ll just mount the disk images with vmware-mount.pl, fetch the configuration files, send them over with a convulted mess of ssh-within-ssh-within-ssh and unix pipes to my laptop! Piece of cake!”

But then something hits me. The Virtual Disk Image (vmdk) file had LVM Volumes as partitions. Which I can’t directly mount from my Ubuntu workstation. Usually, you can get away with issuing the following:

$ sudo /opt/vmware/bin/vmware-mount.pl /path/to/disk-image.vmdk patition_number -t ext3 /mnt/mountpoint

But to much of my dismay, partition 2 on this particular disk image is an LVM Volume, so it can’t be directly mounted. I has to be mapped and a bunch things has to be done before I can get to the data. I’m not even sure I have LVM support on the Ubuntu machine at the moment.

Curses. Unless I fuck around with it to make it work. Which I did. Read on for the details.

So, I light up a cigarette and get to work. I first issue the command described above, regardless of the outcome. vmware-mount.pl works by firing up part of vmware, accessing the disk, and then feeds the data through a Network Block Device (/dev/nb0), which, in turn, is then mounted wherever you specify.

The output is optimistic.

--------------------------------------------
VMware for Linux - Virtual Hard Disk Mounter
Version: 1.0 build-45731
Copyright 1998 VMware, Inc.  All rights reserved. -- VMware Confidential
--------------------------------------------

It has been reported that this program does not work correctly with 2.4+ Linux 
kernels in some cases, and you are currently running such a kernel. Do you 
really want to continue? [N] y

No Network Block Device detected.

There is no Network Block Device defined on this machine. This script is about 
to create the /dev/nb0 Network Block Device. Continue? [Y] 

Creating the /dev/nb0 Network Block Device

No Network Block Device driver detected.

Trying to load the Network Block Device driver kernel module... Success.

Client: The partition is now mapped on the /dev/nb0 Network Block Device.
mount: unknown filesystem type 'LVM2_member'

If you know the filesystem of the partition you want to mount, you can provide 
it using the -t command line option. Since you haven't done so, this script is 
going to try to determine the filesystem of the partition based on the partition
type and id.

Unable to retrieve the filesystem of the partition (the partition type is BIOS 
and the partition Id is 8E). Please file an incident with VMware at 
http://www.vmware.com/forms/Incident_Login.cfm by copying this error message.

So here I think, “I’m pretty fucked. I’ll have to hack vmware-mount.pl, and god knows vmware’s Perl scripts are complex.”

So, out of the blue, I try again. But then I notice the vmware disk image is locked. And /dev/nb0 is still present. So my vmware Disk Image is still attached to the network block device! Great!

So, I ignore the error messages, and install LVM support on my ubuntu box.

$ sudo apt-get install lvm2

Note: On Ubuntu Feisty, according to bug #96802, the lvm package has some packaging errors. You'll end up getting the error message "no program found for your current version of LVM" if you try to issue any of the LVM management commands. Long story short, issue the following to fix it:

$ sudo ln -s /lib/lvm-200 /lib/lvm-0

Next step, detect and mount the LVM volume you just added

Step 1: Load LVM kernel modules:

$ sudo modprobe dm-mod

Step 2: Detect new LVM Physical Volumes

$ sudo vgscan

It should appear as /dev/nb0. You may safely ignore errors about other devices. The last line should be: Found volume group "VolGroup00" using metadata type lvm2, or something similar.

Step 3: Activate the newly found vgroup

$ sudo vgchange -ay VolGroup00

(Substitute "VolGroup00" appropriately if you named your Volume Group differently)

Step 4: Display available volumes and mount them as necessary

$ sudo lvdisplay

Step 5: Mount logical Volume needed:

$ sudo mount -t ext3 /dev/VolGroup00/LogVol00 /mnt/lvm1 -o ro

Step 6: SUCCESS! (Profit)

I can now access my RHEL5 Disk from my Ubuntu machine. Now, time to go back to the convulted mess of ssh-within-ssh-within-ssh-and-unix-pipes, but that's a story for another day.

Also, an important note, I have no idea how to unmount that volume. Well, I know how to unmount the LVM volume, but I have no idea how to get rid of /dev/nb0 without a reboot. Also, do note that this may make your machine majorly unstable. I had to call a friend to walk over to my place and reboot my workstation because it hung while reading files. But in the end, it worked.

I hope this helps.

So, right now, I’m migrating my qmail, vpopmail, courier, clamav and friends set-up from Gentoo to Debian, on a new virtual machine. I followed the basic steps from here:

http://wiki.debian.iuculano.it/quick_howto

This gent was nice enough to provide the required qmail packages and patches. Only problem came when I tried to make courier work with vpopmail — turns out the official debian courier-imap packages don’t support vchkpw, which is the authentication mechanism for vpopmail. Fortunately, I managed to hack it in an almost clean way, that doesn’t involve building it yourself from tarball.

Read on for the jazz.

So, first of all, fetch the courier-authlib source. You should first make sure that your /etc/apt/sources.list file contains the “deb-src” lines for everything. apt-get update if necessary.

So, step one, create a folder to hold the sources and debian packages, and cd into it.

mkdir -p /usr/src/deb-source; cd  /usr/src/deb-source

Step two, fetch the sources.

apt-get source courier-authlib

Once that is done, you must install the tools and libraries courier might need to be built. This sounds scary, but is actually a breeze under Debian.

apt-get build-dep courier-authlib

This should bring in a few things like build-essential, if you don’t have a compiler on the machine yet.

Next, cd’ into the source folder, and into the debian package files.

cd courier-authlib-0.58/debian

Now you’re sitting where all the package specifications are configured, and the sweet thing is, you can hack them to your heart’s content. First of all, we need to edit the file named control.

vi control

Add the following at the end of the file to create a description for vchkpw.

Package: courier-authlib-vchkpw
Architecture: any
Depends: ${shlibs:Depends}, courier-authlib (>= ${RELUP})
Description: External authentication support for Vpopmail.
 This package contains vpopmail support for courier-authlib.

Next, we must create a list of files for the package.

echo "/usr/lib/courier-authlib/libauthvchkpw.so*" > courier-authlib-vchkpw.files

Failure to do this could lead to the following message during build:

/usr/src/deb-source/courier-authlib-0.58/debian/tmp/usr/lib/courier-authlib/libauthvchkpw.so.0.0.0 /usr/src/deb-source/courier-authlib-0.58/debian/tmp/usr/lib/courier-authlib/libauthvchkpw.so.0 /usr/src/deb-source/courier-authlib-0.58/debian/tmp/usr/lib/courier-authlib/libauthvchkpw.so File(s) found not belonging to any package, please contact maintainer make: *** [install] Error 1

Next step, altering the build parameters to include vpopmail support. That’s fairly easy. Just edit the file rules.

vi rules

Scroll down to the part where COMMON_CONFOPTS is defined, near line 35. Change the line where it says:

–without-authvchkpw \

so that it now reads:

–with-authvchkpw \

Once that is done, save the file, and you’re now ready to build the new and improved package:

# cd ..
# dpkg-buildpackage

Compiling authvchkpw.c
authvchkpw.c: In function 'callback_vchkpw':
authvchkpw.c:46: warning: value computed is not used
authvchkpw.c: In function 'auth_vchkpw_changepass':
authvchkpw.c:142: warning: passing argument 1 of 'parse_email' discards qualifiers from pointer target type
Compiling authvchkpwlib.c

This confirmed that support was indeed being included this time.

Once the build is done, simply install the required package.

# cd ..
# ls -lah *.deb
courier-authdaemon_0.58-4_amd64.deb     courier-authlib-pipe_0.58-4_amd64.deb
courier-authlib_0.58-4_amd64.deb        courier-authlib-postgresql_0.58-4_amd64.deb
courier-authlib-dev_0.58-4_amd64.deb    courier-authlib-userdb_0.58-4_amd64.deb
courier-authlib-ldap_0.58-4_amd64.deb   courier-authlib-vchkpw_0.58-4_amd64.deb
courier-authlib-mysql_0.58-4_amd64.deb
# dpkg -i courier-authlib-vchkpw_0.58-4_amd64.deb
Selecting previously deselected package courier-authlib-vchkpw.
(Reading database ...
27234 files and directories currently installed.)
Unpacking courier-authlib-vchkpw (from courier-authlib-vchkpw_0.58-4_amd64.deb) ...
Setting up courier-authlib-vchkpw (0.58-4) ...
#

And we're done.

Now all that is left is just to edit /etc/courier/authdaemonrc where it specifies the authentication modules to include our newly created one:

authmodulelist="authvchkpw"

And voilà. That wasn't so hard, was it?

I hope someone finds the following guide useful

This is nifty. Not something to scream about while tearing your clothes off in a moment of raw ardency, but still, I find it relatively useful.

You perhaps already know how Windows Debugging Tools such as WinDbg can output to a serial or network console, but I found out this concept can be extended to basically any console application that doesn’t really mess around with the terminal. See it as a mix between netcat and screen.

You just need “remote.exe” that comes with the Windows Debugging Tools. I personally use it to launch Macromedia JRun4 in a console on a development server at one of my client sites to debug their web application remotely. That way I can see the log in my local console instead of toggling between the server and Terminal Services. Read on for an overview of how it works.

Syntax

It’s fairly easy to grasp, if you keep in mind that parameters must be passed in a specific order.

A real-life, live example would be the following:

remote.exe /S "jrun.exe start devserver" jrun-console /U admin /U gauthiera

/S specifies the command to run, followed by the session name. In this particular case, it will run “jrun.exe start devserver” and name the session “jrun-console”.

/U will specify which users are able to access the session. I heard it doesn’t work unless you’re part of a Domain. I have yet to verify this. You can repeat the parameter as many times as necessary. Ensure, however, that the user running remote.exe is in there. Hence, in my example “admin” and “gauthiera” being the user who ran the command on the server and the client that is allowed to connect, respectively.

Client

On the client side, issuing

remote.exe /C devserver jrun-console

will connect to the listening server. I just issued the server name, followed by the session name.

You can also make sessions visibles or invisible, query them, and all sorts of other things. More details can be found in the application help. Just issue remote.exe /?, as usual.

It just comes in handy, sometimes.

To run the Active Directory Users and Computers with Administrator rights, you can use some runas.exe magic. Just create a shortcut to the following target:

C:\WINDOWS\system32\runas.exe /USER:DOMAIN\adminuser "mmc dsa.msc"

Of course, just change DOMAIN\adminuser to whatever applies.

It works fine for my purposes. The trick is just knowing the name of that particular mmc snap-in. That’s pretty basic knowledge, but I’ve been asked three times this week about it.

Simply put, all you need is the mgadiag.exe tool and the URL you wish to download from.

I tested it and it does work. It goes something like this:

• Run mgadiag.exe
• Look for the Download Center Code, and write it down (ex: 8KLVDJ6)
• Go to the URL you want to download from
• append &Hash=8KLVDJ6 to the URL (replace the value with your own)
• Enjoy your download.

The important part is that it works in Wine. And in the recently released CrossOver Office for Mac OS. See screenshot below.

What drove me insane was that, while you can publish your calendars to a WebDAV server for others to see and subscribe to, you cannot edit the calendars that are published — unless you have a .mac account. While I sincerly hope this will be in Leopard, I’m not holding my breath.

You see, I run Linux on my desktop at home, and Mac OS X on my laptop, for work. I just wanted to find a simple way to share my calendar between the two machines, and to be able to edit them on any machine.

And it just so happens I just have the solution.

Configuring the WebDAV server

Now, vast amounts of documentation can be found on the subject of setting up the WebDAV server. I’m not going to insult those who already worked on the problem by needlessly rewriting the instructions here. However, I will give you pointers.

• Enabling WebDAV on Apache [serverwatch.com]
• WebDAV on OS X With iCal [gregwestin.com]
• iCal Exchange (Free ics hosting)
• Free WebDAV Hosting [box.net]

So you could go ahead and setup your WebDAV server on *nix or OS X using the two first links, or you could just get free WebDAV hosting using the two others. Any will do.

For the sake of completeness, I will add my own WebDAV configuration below, on Gentoo Linux with Apache 2. I just installed mod_dav on apache2, and added the following configuration to /etc/apache/modules.d/10_mod_dav.conf:

<IfModule mod_dav.c>
  DAVLockDB /var/lock/mod_dav/Dav_Lock
  Alias /ical /var/dav/davroot
  DavMinTimeout 600
        <Directory /var/dav/davroot>
                Dav On
                Options +Indexes
                AllowOverride None
                AuthType Digest
                AuthName "ical-webdav"
                AuthDigestFile /var/dav/htpasswd.digest
                Require valid-user
                Order allow,deny
                Allow from All
        </Directory>
</IfModule>

Of course, I just then added a user using htdigest. You could use “AuthType Basic” if you don’t use mod_digest.

I tested the WebDAV functionality using the OS X “Connect to server” Function. Just enter the path to your webdav location.

I was prompted for authentication. Upon submitting my credentials, the drive was mounted on the desktop.

You should test to see if you can write files to the WebDAV folder. Once that’s done, we can move on the beef of this article.

Setting up iCal

You should take care of iCal first. First thing first, go ahead and share your calendar via iCal, as usual. Enter your WebDAV server information.

Once all is published and well, according to the little icon next to your calendar (), you have successfully published your calendar in a perfect read only fashion.

Making iCal Sync from the server

This is the sweet part, the core of this article. Now, we want iCal to also download the changes from the server. For this purpose, you must find out the Path of your corestorage.ics file for that calendar. Go have a look in ~/Libary/Application Support/iCal/Sources/, right now. (That being the “Library” folder from your Home Directory).

You should see some folder(s) with ugly names, one per Calendar you have. There’s no easy step to this, but you have to find out which is which. You can judge either by creation dates, or by opening the .ics file in your favorite text editor to see if you recognize some of the contents. Of course, if you only have one calendar, things are simplified, you will just have one folder, and one file.

In any case, write down the absolute path to the folder containing the ics file, it’s important. For instance, in my case, it turns out to be:

/Users/supernaut/Library/Application Support/iCal/Sources/2FBCA21F-80E0-44FD-B47A-ED34AE652010.calendar

ical_sync.sh

I have then written two scripts that take care of downloading, comparing and synchronizing your calendars from the WebDAV server. You will need the following utilities installed, most are available from Fink.

• wget
• md5sum

Download and place the following script somewhere on your system. I created a folder named “bin” in my home directory and placed it there.

Next, edit the script and change the variables to match your situation, eg:

ICALPATH="/you/core/ics/folder"
WEBDAV="http://www.yourserver.com/path/to/dav/folder/calendar.ics"
LOGIN="yourlogin"
PASSWORD="yourpassword"

WGET="/sw/bin/wget"
MD5SUM="/sw/bin/md5sum"

Remember! The value for $ICALPATH is actually the one you wrote down earlier. Don’t worry if you mess it up, the script will warn you.

Once that’s done, run it in terminal. It should tell you if ANYTHING goes wrong and back off. I made it extra careful, it would suck to wreck your calendar because the server is down or answers strange things.

This will indeed download and update your calendar on your Mac from the WebDAV server. But how will you make this happen automagically? Well, I have taken care of that too.

Working the Applescript magic

Turns out I have written a second script, this time, an applescript one. You can download the source over there.

Open it or paste it in Script Editor. You should then change the line

do shell script "bash /Users/supernaut/bin/ical_sync.sh"

to match the location of the ical_sync.sh script and then hit “compile”.

Once that’s done, just save it somewhere, but make sure you save it:

• As an Application
• Make sure the startup screen is unchecked

Once that’s done, simply replace the iCal icon in your dock by this script. You can add a pretty icon to it to make it more bearable.

Everytime you click on iCal then, it will sync up the calendar from the server, and tell if you if anything goes wrong. It will then proceed to launch the real iCal for you.

The AppleScript will show a dialog box if, say, the network is down, or something went wrong. For example:

You can then take action. As a precaution, in the event that it wasn’t what you wanted to do, the script will ask you if you still want to launch iCal.

I made it that way because, sometimes, you might want to look at your calendar without being connected to the internet. Makes sense, right?

Now, onwards to other Calendaring software.

Configuring Other Calendars

Nearly any other Calendaring software will not only fetch the lastest ics file from a webdav server, but will also write it back on change, or upon instruction to do so. This means, no problems whatsoever.

I use Korganizer in conjunction with Kontact on my KDE based desktop. Evolution and Sunbird could most likely do this as well.

I just added a calendar for a web source, and configured it with my WebDAV information:

Please excuse the craptacular quality of the screenshot. It was taken while forwarding X11 to my Mac over an SSH tunnel, and as such, fonts are screwy.

Then, it just worked out of the box. No problem whatsoever.

In conclusion

This is somewhat of a cheap and dirty hack, but it works fairly well. I’ve been using it for three weeks and it’s a dream. I sincerely hope that this has been somewhat useful to at least someone

Drop me a comment if you liked it, or if you have problems. Feel free to ask, really.

I decided it was a crime to shitcan such beautiful machines, so with the help of my friend Mike “I mangle french words” Le Blanc, we drove there, armed with a large truck and patience. Carrying them down the three stories with no elevator was an interesting experience. I scavenged lots and lots of interesting hardware there.

But i’m getting ahead of myself here. The point is, lots of screwy things start occuring when you have a Quad SMP machine, such a timers and clock drift. I started having a lot of problems with Apache recently… once in a blue moon, on restart, it would spawn a single process with no PID file, and hang there. Checking out error_log pointed out that apache would apparently hang while generating the Secret seed for Digest authentication (mod_digest). Disabling mod_digest would have worked, but sadly, I use it. This could be found in error_log:

[notice] Digest: generating secret for digest authentication ...
[notice] Digest: done
[notice] Apache configured -- resuming normal operations
[notice] caught SIGTERM, shutting down
[notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec2)
[notice] Digest: generating secret for digest authentication ...

Fortunately, I cobbled up a fix. Updated! Read on for a more elegant fix.

So it hangs while generating the secret for digest authentication. My gut feeling was that it had to do with the system running out of entropy (random data, that is). Probably waits for apr_generate_random_bytes() to complete but that never happens. I immediatly checked out the kernel for available entropy from /dev/random and friends.

# cat /proc/sys/kernel/random/entropy_avail
16

Now, I have no clue why, but entropy ran out (not quite, but close). Probably another whacky quad SMP issue. I’m starting to drive the Gentoo devs and maintainers crazy with my strange hardware.

Note: Before proceeding, please read the updated section below.

So, to remedy it, I fetched and installed rngd from the rng-tools package in Gentoo Portage. Check out your distro’s package repository for it or something similar. This tool allegedy gathers random data from I/O transactions and hardware stuff around. I compiled it, installed it and launched it. The Gentoo way:

# emerge -va rng-tools
# rc-update add rngd default && /etc/init.d/rngd start

Once that was taken care of, I checked the available entropy by querying the kernel once again.

# cat /proc/sys/kernel/random/entropy_avail
6854

That’s much better. To my surpise, Apache finished loading instantly the split second rngd started up. Schweet. Sounds like that fixes the problem. I have no idea why it occurs right now, but this works around it elegantly.

UPDATE! I figured out what the greasy poop was going on. Installing rngd will gather entropy using /dev/urandom if no hardware RNG is found by default. I didn’t pay much attention to that detail at the time. However, you will notice that when installing the Apache Portable Runtime on Gentoo (dev-libs/apr) the use flag urandom is available. Using euse (from gentoolkit) to get info about it returns the following:

valkyrie ~ # euse -i urandom
global use flags (searching: urandom)
************************************************************
no matching entries found

local use flags (searching: urandom)
************************************************************
[-    ] urandom (dev-libs/apr):
Use /dev/urandom instead of /dev/random

This will make apache fetch randomness from /dev/urandom directly, therefore giving the same result as rng-tools. The proper solution would be to just re-emerge dev-libs/apr with the urandom use flag enabled.

I tried it and it works beautifully, and looks a lot more elegant to me.

svn: Can’t recode string

Well, this was a matter of changing the encoding used by my system locale to match the one of the repository, which was done by editing the file .profile in my home directory (I use bash as a default shell, which is the default on OS X 10.3 and above, as opposed to csh) and added the following:

export LC_CTYPE="en_US.UTF-8"
export LANG="en_US.UTF-8"

This basically had the effect of setting up the locale to UTF8, which swallowed the file without problems. I just though I’d post it there because it was useful — I didn’t really google around to check out if that solution was already out there, but I will mirror it on underwares.org anyways.

Hope this helps someone, somehow.