My South

Sun StorageTek StorEdge 6140 FC/SATA array

2008-11-14T13:59:35Z

I did some tests with that array, as I did with an Infortrend OXYGENRAID device and an old LSI FC array.

The results can be viewed in this article.

Solaris 10: New ZFS version -> gzip compression

2008-11-14T09:16:17Z

With patch 137137-09 (SPARC) and 137138-09 (x86), Solaris 10 can handle zfs pools with version 10. You will have to upgrade your zpools; "zpool status" will result in this warning:

status: The pool is formatted using an older on-disk format.  The pool can
        still be used, but some features are unavailable.
action: Upgrade the pool using 'zpool upgrade'.  Once this is done, the
        pool will no longer be accessible on older software versions.

To upgrade, use the command

# zpool upgrade yourpoolname

The GZIP compression known by OpenSolaris and Solaris Express is now in the Solaris 10 code base starting from (kernel) patch 137137-09/137138-09.

You may set:

# set compression=gzip mypool/test

and - to set a gzip compression level:

# set compression=gzip-9 mypool/test

Congratulations Mr Obama!

2008-11-05T05:06:35Z

Congratulations for your unbeatable victory. May god give you all you need to reunite your country and to solve many of the problems.

You're right: Anything is possible in America.

[Update] Heise: The publisher of Germany's most read IT newsticker and IT forum begins to delete old user postings...

2008-10-30T09:23:29Z

and there are already over 700 angry comments by users discussing about the reasons for this step.
Members of Heise staff wrote that the database has grown too large and indexing kills too much performance now. And they note "editorial reasons" - leaving them nebulous:

"Wir starten morgen mit dem Löschen":

http://www.heise.de/extras/foren/S-Wir-starten-morgen-mit-dem-Loeschen/forum-7262/msg-15786090/read/

The heise newsticker is famous for the "troll postings" and conspiracy theories as well as many technical debates. It is Germany's most read IT website.

[Update:] Heise said it will not delete old posting due to users' protests. They will simply mark older threads as "read-only".

Photo Album of my Ivory Coast trip is online

2008-10-26T14:55:34Z

It is accessible here:

http://southbrain.com/southstills/ivorycoast2008/

Enjoy!

Glare/Glossy vs. matte anti-glare: 0:1

2008-10-21T19:41:11Z

As I take trains in Germany very often, I just took these two photographs of a glossy display (on an ICE train) and a matte display (on a local commuter train).

Looking at the market (and even Apple does this now), glossy display are everywhere. In my opinion, they are unusable. Perhaps at home, in a dark room to present a movie it is ok. But not for everyday's work.

I wrote this blog entry just sitting in this train (ICE 180). Internet is no problem because of EDGE/GPRS or 3G (UMTS) available nearly everywhere.

Just look at this glossy display. Perhaps it is a nice gadget for design students, but not for serious work.

This is an example of the displays in the local commuter train circulating from Weinfelden (Switzerland) to Singen or Engen in Germany. I think this is a good example of a matte anti-glare display.

Two weeks without electricity and without a water tap...

2008-10-09T16:31:18Z

The little village's name is "Niababli" or just "26" (vingt-six), and it has some wells to retrieve ground water. Google Maps has still the old route in his label map. (Niababli is on the center of this map).

My sole connection to Germany was a short wave receiver to listen to the "Deutsche Welle" station at night and the BBC world service. Sometimes I got some broadcasts from Voice of America as well.

Life is so totally different from what I ever saw in my life. Men are working on the fields, harvesting cacao, maniok and rice, the women are cooking on the field for the workers (it is a really embarassing for an employer to have nothing to eat for his employees here!).

My friend and me had the chance to live in a house built by her father, which was a brickhouse quite confortable. Because of malaria, the bed was entoured by a mosquito net.

On the evening, people came back from the fields, talking, keeping their families, drinking a beer in a "maquis" (the name of bars with food). The sound of the evening is the one of small power generators, running on diesel or gasoline to run the little cinema or some light bulbs.

And then you see that warm attitude, this charming reception of the people here. Nobody was hostile towards me, nobody had fear. I became quickly "le petit blanc" (I was among the tallest person in the village ...) and many children were already at 6am (they have London Greenwich time there) on our patio to wait for me. Children everywhere. Women make children when they want. And it has nothing to do with marriage. Educating children is the job of every adult. And: The children of a brother are like the own children and like these of the sister. The "little family" with "father, mother, children" is not existent.

Every child attends school here (which was financed and built by Germany here in the village) and continues school in Sassandra (the next city, 21km away) where they can go up to the bac (needed for university education).

Many leave the village when they reach that age to find themselves in the bigger citites.

All speak french fluently and most parents also teach them their native language. In this small village, three of them exist - and they are totally different and incompatible. French is the only language they can use to talk to other ivorians living in the state of the Ivory Coast.

Chinese Trash in Africa

2008-10-07T05:33:07Z

The first thing you'll notice in Ivory Coast is that chinese products are invading the country. You nearly have no chance to get a normal socket extension (to connect 5 devices to a single wall socket; something you'll find in the US or Europe für $1.99), you are left with the choice of a chinese "blinkenlights" product with a spinning "voltmeter" in it (showing you nothing) and many switches on it. Included a random algorithm which voltage will be the result and which person will be electrocuted next.

Examples: A bad iPhone copy and one of these "socket extenders":

Why we don't sell our products there? How the chinese have adopted that market so rapidly?

I am back from Africa!

2008-10-07T05:28:30Z

After three weeks in Ivory Coast I am feeling lucky that all went well and - on the other side - it hurts that I don't see my friends there any more.

I little photo album will follow and some remarks.

Abidjan, I am coming... (Ivory Coast)

2008-09-10T13:31:50Z

So no great updates will occur from Sunday, September 14th to Sunday, October 5th. After so many vaccinations and Lariam I am ready....

Il n'y aura pas de mises à jour pendant la période du 14ème septembre au 5ème octobre. Je sera en Côte d'Ivoire pour des visites - sans ordinateur et sans boulot. Enfin.

Airway (trajet):

Zürich Unique-Flughafen/Kloten (ZRH)
Paris Aéroport Charles de Gaulle (CDG)
Abidjan Aéroport Félix Houphouët-Boigny (ABJ)

Videos on youtube...

2008-09-03T06:16:07Z

are fascinating: People spent millions of dollars to have "crystal clear" pictures and now we're on HD, but everybody enjoys Youtube... Videos encoded with 320x240 pixels and scaled to 415 pixels wide while playback...

Nevertheless, I have a youtube channel now and I've put these zfs block pattern movies in there, resized to "youtube-ready"-size.

ZFS as a movie actor!

2008-08-29T17:59:36Z

Two mirrored volumes concatenated to give a 8TB storage pool. I logged 18 hours of block read/write activity and made a MPEG4-Movie out of it.

Green pixels summarize sector reads, red pixels sector writes. Each pixel represent the same number of consecutive storage blocks. The pixels are doubled in height because of the 4:2:0 color coding of MPEG4. Otherwise, a red pixel adjacent to a green one could not have been possible, as two lines are coded together with regard to color. It is a TV format, after all..

At half past eight, a backup job started, scanning many files. After 4 o'clock an expire run is started. And at 5 o'clock it is really "night" with user activity rebeginning at 6:30.

I used 640x480 pixel frames with 30 frames per second. Should be possible to watch on a NTSC TV :-) Enjoy!

UFS and ZFS write patterns [Update]

2008-08-25T11:28:46Z

As a followup to this article, I used a zfs volume and an ufs volume with an application doing the same work on both partitions (replicated sql engines).

Click on the still frame to download the video (4 MB, ISO MPEG 4 format):

]]>
Both hosts are running MySQL InnoDB databases and the application updates BOTH in the exact same manner (same INSERTs, SELECTs and UPDATEs).

The ZFS host does a "DELETE ..... WHERE ..." at 22:30 (10:30pm), the UFS host does that at 01:30am. Approx 3 million columns are deleted by these operations per database.

cmusaslsecretPLAIN? cmusaslsecretCRAM-MD5? cmusaslsecretDIGEST-MD5?

2008-08-22T17:40:04Z

Obsolete things can be nice. They can be useful. These "cmusaslsecret"-Thingies are.
But let's start from the beginning. You may however start to play with them!

You are using Cyrus SASL for authentification purposes? Supposedly with the Cyrus IMAP server or Postfix (the two major applications using Cyrus SASL)? Then you'll know the problem: You may use saslauthd(8) to connect to an authentication database as Unix PAM or LDAP. Problem: You will only be able to use plaintext logins. Why?

If using saslauthd, the SASL-enabled server gets the password given by the user/client, and asks saslauthd whether it is correct or not.

Plaintext authentication can be sufficient when using it with SSL/TLS. In IMAP environments this may be a good solution if all mail clients can be configured in that way. With SMTP you will have a problem. Many Mailservers being able to initiate authenticated outgoing SMTP connections do not use SSL/TLS. Many of them want to use CRAM-MD5 as it is defined in many standard drafts.

]]>
The Cyrus SASL v2 library does rely on knowing the "userPassword" as plaintext attribute to be able to compute the needed numbers for CRAM-MD5 and DIGEST-MD5 authentication. To get this cleartext password, it uses an "auxprop". Auxprops included in the standard Cyrus SASL 2 distribution are sasldb (the local database file store), MySQL (to retrieve values from a MySQL database) and ldapdb (to access SASL-enabled LDAP servers via proxy auth). In case you want to access an LDAP resource without using SASL itself but with a simple bind (over TLS/SSL), then my ldap auxprop is for you.

The problem? You will need a database carrying all the user passwords as cleartext entries. A security nightmare. Unless you are not using different passwords for different services you will have a big problem when this database gets known by a hacker (or the british government, you'll find these files in a suburban train then or on a lost USB stick).

The SASL v1 library was a little bit more intelligent in this case. To set a password, each mechanism did set its own secret in the database. These attributes were named "cmusaslsecretMECHANISM", so for CRAM-MD5 it was "cmusaslsecretCRAM-MD5", for cleartext logins it was "cmusaslsecretPLAIN".

The "trick": These attributes are still used by the "new" SASL v2 library. SASLv2 looks for "userPassword" and for the appropriate "cmusaslsecret"-value. But they can't be set any more, as they are marked as "obsolete". When calling "saslpasswd2" it even removes these attributes from the sasldb.

To use these attributes, you'll have to do two things:

First, extend your SQL table or your LDAP schema with three columns/attributes:

cmusaslsecretPLAIN
cmusaslsecretCRAM-MD5
cmusaslsecretDIGEST-MD5

In SQL it has to be a 8-bit-binary type (BLOB) or a character field (depending on your sql auxprop implementation). For LDAP, just use "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40" (octet String).

In the following example, the period (".") is used as concatenation operation: So

"pascal" . "gienger"

would result in

"pascalgienger".

1. cmusaslsecretPLAIN - plaintext authentication

To use plain/login without saslauthd but you want to use your auxprop to retrieve data, you must set cmusaslsecretPLAIN in your database.

The algorithm is quite simple:

cmusaslsecretPLAIN := salt . \0 . md5(salt . 'sasldb' . password)
salt := 16 random bytes
password := user password

First, create 16 random bytes as "salt". Take the MD5 value of the string consisting of these 16 bytes, concatenated by the string "sasldb" and ended by the user's password.
You will get 33 bytes, including the NULL byte in the middle.

This was easy. And very effective. An attacker stealing these values has got rubbish. He can't even do a useful thing with it. He has no possibility to reconstruct the password apart from trying dictionary attacks. (using the first 16 bytes as salt value and trying many passwords).

2. cmusaslsecretDIGEST-MD5 - DIGEST authentication

This is easy too. However, DIGEST-MD5 is not so much widespread as CRAM-MD is. It offers higher security though, because it can guarantee message integrity.

The cmusaslsecretDIGEST-MD5-Attribute has to be calculated like this:

cmusaslsecretDIGEST-MD5 := md5(username . ':' . realm . ":" . password)

This value will be 16 bytes in size (md5 result size).

The reason for that to work?
In DIGEST-MD5, the server (and the client) has to calculate

A1 := md5(username . ':' . realm . ":" . password) . ':' . nonce . ':' cnonce

This is

A1 := cmusaslsecretDIGEST-MD5 . ':' . nonce . ':' cnonce

nonce is a server-specified octet string created by random.
cnonce is a client-specified octet string created by random.

This is only one step, the next step is to combine this with A2, which defines the type of action/authentication wanted.

The intelligent thing here is the realm. This is very important, so you may use another realm for every service - thus resuting in different secrets "cmusaslsecretDIGEST-MD5". Why that?
If an attacker gets your cmusaslsecretDIGEST-MD5-Values, he can login with this in your server using the realm specified. He can't use these md5 values to login to other servers using different realms, because he can't calculate the new md5 value resulting from the new realm.
It your database is compromised, you will have to change the realm of your service and recalculate all cmusaslsecretDIGEST-MD5-values to repair the situation.

3. cmusaslsecretCRAM-MD5 - CRAM mechanism

Here we have the example of an easy mechanism (from the client's view) and a complicated mechanism (in terms of storing a secret not being identical to the password).
CRAM-MD5 relies on HMAC-MD5. As you know (or you'll read here) HMAC consists of two hashes, an inner and an outer one. HMAC uses a key to process messages. At the end you have a HMAC hash. HMAC-MD5 means you take MD5 for the inner and outer hash. It is named "keyed" because you will not only use a message (like in md5) but you also specify a key.
Next, you have to know that MD5 is a state machine. It has to be initialized, then data has to be pushed to it, and after a finalization stage, you get the md5 hash value for your data. It is not important however whether you push all the data in one step or you put it byte by byte. The md5 machine maintains an internal state, defined by 4 32bit-integers, giving 16 bytes of state value.

CRAM-MD5 uses the user's password as HMAC's key. Basically, the server sends a random string to the client, and the client responds with the username and the HMAC-MD5 output of the server's random string (using the password as HMAC key).
To avoid storing the cleartext password on the server side, we can do a trick: Just initialize the HMAC-MD5 algorithm and assign the key - without sending one byte of message. The 8 state integer variables (4 for the inner md5 state machine, 4 for the outer md5 state machine) are a function of the password then.

You won't be able to calculate the cleartext password from these 32 bytes, but you may compare (identical state values represent identical keys = passwords) and you still can do dictionary attacks.

If an attacker gets your cmusaslsecretCRAM-MD5 values, it can login to your server but also on all other servers using CRAM-MD5. Just use these values to initialize the HMAC-MD5-function and then pass the server random string and "bingo!" you're in (if you know the user name).
So restrict only one service of your site to CRAM-MD5 when using the same password for many things (normally you do that with Postfix Mail and Cyrus IMAP, so an attacker can use these values to read mail and send spam, but not to login to legal services or other things) or use different passwords for every service you offer with CRAM-MD5.

In C you would write (using RSA's public available MD5 header- and source files):

#include 
#include 
#include 

HMAC_MD5_CTX hmac;
HMAC_MD5_STATE state;
char buffer[32];
char dummy[16];
int i;

hmac_md5_init(&hmac, password, passwordlength);
for (i=0;i<4;i++)
{
  state.istate[i] = htonl(hmac.ictx.state[i]);
  state.ostate[i] = htonl(hmac.octx.state[i]);
}

memset((void *)buffer,0,32);
memcpy((void *)buffer,&state.istate,16);
memcpy((void *)buffer+16,&state.ostate,16);

hmac_md5_final(dummy,&hmac);

Your "buffer" has your needed 32 state bytes then.
Use these as cmusaslsecretCRAM-MD5.
htonl() is important to be independent of machine's endianness.

To play, you may use my example cmusaslsecret-calculation page to get the idea. Look how cmusaslsecretPLAIN changes on every submit, cmusaslsecretCRAM-MD5 changes only with the password and cmusaslsecretDIGEST-MD5 changes with all three values.

Swiss station "Beromünster" (531kHz) will shut down Dec 28th, 2008

2008-08-19T05:37:26Z

The famous "Landessender Beromünster" will shut down on Dec 28th. The name of the little city "Beromünster" was known throughout Europe, as it was marked on many radio scales of the last decades. It's frequency is 531kHz (since 1978).

Beromünster started broadcasting on June 11th, 1931. After 77 years of operation, its end is near.

]]> Beromünster has 2535 inhabitants (number of Dec 31th 2006) - it's the radio station which made it famous.

I remember having played with an electronics construction kit being a young boy and I constructed my first radio. There were two stations which could be heard very easily because they had a strong signal: Bodenseesender (SWF Südwestfunk 1; now SWR) at 666kHz (hehe no it was not the devil!) and Radio Beromünster at 531 kHz.

Even with the "Volksempfänger" (which has its 75th anniversary this year) you were able to listen to Beromünster using a better antenna. Despite being threatened by the nazi regime (it was unlawful to listen to non-german stations after 1939) nearly everybody did it in South Germany - the signal was so strong that even this radio with a really bad reception quality did decode it well.

The following picture shows the station antenna called Blosenbergturm. It is taken from Wikipedia (direct link).