Nov 13

Fixing DAViCal and PostgreSQL on Ubuntu 11.10 (Oneric Ocelot)

DAViCal is a great server for calendar sharing. It is an implementation of the CalDAV protocol which is designed for storing calendaring resources (in iCalendar format) on a remote shared server. I have used it for sharing with my wife and I at home with our iPads, iCal on OS X and iPhones to allow us to have a shareed schedule for the house and our events. There are now other options like Google Calendar and iCloud, but I still like to run my own stuff and control my own data. DAViCal was running fine for me over the last year or so, but it stopped ater I did my recent upgrade to Ubuntu 11.10 server for mergy.org. I deleted it all and did a reset from scratch on the calendar setups.

After spending some time this weekend getting this fixed again, I found some simple fixes that aren’t out there yet in the docs. My problems were related to the PostgreSQL version bump to 9.1. Hope this is helpful if you are seeing issues with this as I have.

The installation page for DAViCal is pretty close, but now with PostgreSQL 9.1, things have changed a bit.


1. Slight Adjustments to the Database Setup

You can install DAViCal via the

$ su apt-get install davical

but the files in /usr/share/davical/dba need to be modified because PostgreSQL 9.1 uses port 5433 instead of 5432 as PostgreSQL did.

From the DAViCal Installation Docs

BUT Before you attempt to run this script to do the setup

/usr/share/davical/dba/create-database.sh

you need to modify

/usr/share/davical/dba/update-davical-database

Change this line under  ”Options variables” towards the start of the file to

my $dbport = 5433;

then you can run the create database script.

 

2. Adjust the DAViCAL Configuration in /etc/davical/

Under the DAViCal configuration area, you should change the port to 5433 as well for your setup config.

From the DAViCal Installation Docs

In the pg_connect line, change the port to 5433 to get it to work with PostgreSQL defaults.

After doing those items, I was able to get back up and running and hit the web interface for DAViCal (depending on how you setup the Apache stuff) and add users / groups / resources. Because we don’t have a lot of accounts, it wasn’t that big of a deal. DAViCal has been a great way for us to share dynamic calendars for personal events and sync OTA.

 


					
Nov 04

Blocking The Big Education (Edu-Junk) Spammers


There are two main organizations that I know must be dishing a thousands or millions of spam a day out to the school community. I have been watching the constant spam spewing from a few sources over the last couple of years and I have finally starting to look at some patterns to alleviate at least some of the junk our teachers are getting specifically from these junk engines. The two organizations I see as massive senders of edu-junk are Mindstreams / Lifetime Learning and Edupartners. I am sure there are many others out there you might be dealing with, but these two sources are prolific in the volume they spew daily.

Both Mindstreams / Lifetime Learning and Edupartners do put unsubscribe links on their junk, but the way they acquire the addresses would mean every single member of your faculty and staff would need to individually unsubscribe. This is not something any of us what to deal with so if you can, it is worth just getting some simple rules in at the server-side to inhibit this as much as possible. They seem to be immune to RBLs for some reason, so you will have to go it alone.

Here are some examples of the kind of junk they have servers pump to the school community.

EDUPartners SPAM

Lifetime Learning / Mindstreams SPAM

Except they pump thousands of these out and insert teacher names from the database, etc. This is nothing different than other spammers out there do daily either, but the difference here is a real volume increase and targeted audience for people that work in schools. They use multiple servers, outside spam vendors and tools like Silverpop Engage and probably a lot of other tools we don’t even know about. I finally had to do something on this.

If you want to inhibit this as well, here are a few items that have worked.

 

Block the entire routable IPs that Lifetime Learning / Mindstreams owns.

They have servers across their Class C ranges that do nothing but send and send. I have currently seen and blocked a couple of their ranges from even being able to send email to our networks. Here are the ranges I have seen and blocked outright because I have seen in the logs spam attacks across the entire ranges.

12.9.130.0/24
12.9.134.0/24

Just block it from even connecting to your network at all or at least at port 25 for SMTP. They are not (yet) doing SSL on port 465.

Here is a log showing a quick round from the second class c trying to send to us.

 

Anything from 208.85.51.183 is bad news.

This is a Silverpop-owned IP address. The whole block can probably be blocked, but I have consistently seen 208.85.51.183 do nothing but spam.

Here is there WHOIS lookup (as of 11/04/11)

#     “n 208.85.51.183″

NetRange:       208.85.48.0 – 208.85.55.255

CIDR:           208.85.48.0/21

OriginAS:       AS19795

NetName:        SILVERPOP-IP

NetHandle:      NET-208-85-48-0-1

Parent:         NET-208-0-0-0-0

NetType:        Direct Assignment

RegDate:        2007-12-03

Updated:        2008-02-22

Ref:            http://whois.arin.net/rest/net/NET-208-85-48-0-1

OrgName:        Silverpop Systems Inc.

OrgId:          SILVE-32

Address:        200 Galleria Pkwy

Address:        Ste 750

City:           Atlanta

StateProv:      GA

PostalCode:     30339

Country:        US

RegDate:        2007-02-22

Updated:        2011-08-03

Ref:            http://whois.arin.net/rest/org/SILVE-32

OrgTechHandle: NETWO1905-ARIN

OrgTechName:   Network Operations

OrgTechPhone:  +1-678-247-0500

OrgTechEmail:  InfrastructureTeam@silverpop.com

OrgTechRef:    http://whois.arin.net/rest/poc/NETWO1905-ARIN

OrgAbuseHandle: ABUSE1713-ARIN

OrgAbuseName:   Abuse Handler

OrgAbusePhone:  +1-678-247-0500

OrgAbuseEmail:  abuse@deliver.silverpop.com

OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1713-ARIN

OrgNOCHandle: NETWO1905-ARIN

OrgNOCName:   Network Operations

OrgNOCPhone:  +1-678-247-0500

OrgNOCEmail:  InfrastructureTeam@silverpop.com

OrgNOCRef:    http://whois.arin.net/rest/poc/NETWO1905-ARIN

RTechHandle: NETWO1905-ARIN

RTechName:   Network Operations

RTechPhone:  +1-678-247-0500

RTechEmail:  InfrastructureTeam@silverpop.com

RTechRef:    http://whois.arin.net/rest/poc/NETWO1905-ARIN

RAbuseHandle: ABUSE1713-ARIN

RAbuseName:   Abuse Handler

RAbusePhone:  +1-678-247-0500

RAbuseEmail:  abuse@deliver.silverpop.com

RAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1713-ARIN

RNOCHandle: NETWO1905-ARIN

RNOCName:   Network Operations

RNOCPhone:  +1-678-247-0500

RNOCEmail:  InfrastructureTeam@silverpop.com

RNOCRef:    http://whois.arin.net/rest/poc/NETWO1905-ARIN

 

Setup rules on your email server

Provided you still run your own email now that most schools seem to be going the Google Apps route while it is currently no charge.) I have a few rules that pick-off the current batches of junk from the Edu-Junk companies.

1. Anything received/sent from or has text string matching mkt5354.com

2. Anything received/sent from or has text string matching edupartners.com

3. Anything that gets a received from text string that has PowerMTA in it. This is a junk email sender they (and many others use constantly.

4. Block 208.85.51.183 outright as well. Crazy how much spam that IP is trying to send on behalf of edupartners.com.

208.85.51.183 Spam Attempts

 

I will continue to update as I can when new patterns emerge. Hope this helps.

Sep 29

Host Only Networking Setup With VMWare Fusion 4

 

I have used VMWare Workstation and Fusion for many years now on Linux, Windows and Mac OS X host operating systems. I have used the “host only” networking on Windows and Linux host operating systems, but never on OS X with VMWare Fusion until recently when I had the need to test some new firewall software setups.

On VMWare Workstation or Server, it is pretty easy to set network addresses for the virtual networks and hosts, but turns-out it is kind of a pain with VMWare Fusion (the Mac app.) For whatever reason, they didn’t include the configs in VM configuration GUI. This makes the whole setup more of a pain than it should be. I suppose they didn’t add this level of configuration because of the way the VMWare Tools may or may not integrate with the guest OS or something in OS X. Also, maybe Mac users just don’t really request the need to have this in a nice GUI due to lack of overall interest. Whatever the case, there are some great reasons to have it operational.

In testing the recently released IPCop 2, I needed to play around with settings and see how the configurations I use in production would and could work on the new build. VirtualBox, VMware and Parallels are great applications for these sorts of development testing situations. I have always had a preference for VMWare because of their commitment to have the vm images be able to move back and forth between host operating system applications versions of VMWare. It has come in handy many times when I have moved from Windows to Linux or back as I have changed my main operating system.

By default, a VMware Fusion guest OS will initial be setup with an initial network interface. You can set in the VMWare settings whether you want it to act as a NAT or Bridged. That is all standard, in the VMWare Fusion application host config settings. In my case, I need the VMWare guest to have at least two network adapters so I can test different network nodes as I try to mimic servers with multiple physical network cards running the Linux-based firewall. So, in my case, I added an additional network adapter in the guest settings interface.

VMWare Fusion 4 Guest OS Settings

At each of the network adapters, you can set the use setting. In my situation, I  wanted the first network adapter to be used to provide access to the real network my MacBook Pro is using to access the real network (wired or ethernet) on the machine.

It will want to make the first network adapter use NAT by default so nothing crazy here except, I did flip the “Advanced options” and generated a MAC address and kept generating addresses until I got an “A” in the final segment so when I am testing and looking and packets coming and going from device addresses, I can know that the host with the “A” is this first network adapter. You don’t need to do this, but if you can insert some sort of label to help troubleshoot or tag traffic/addresses/information in this sort of setup is useful to me. My VM is titled “ipcop2″ but it could have been titled “Linux” or something else.

VMWare Fusion 4 Network Adapter 1 Settings

The second network adapter is when I dip into virtual / host only world. I create it and designate it as a private network only available to the host mac I am running VMware Fusion 4 on, then keep generating a MAC address until I get one that has a “B” in the final segment to continue the configuration pattern of tagging the network interfaces.

VMWare Fusion 4 Network Adapter 2 Settings

I also had to go into the guest OS and assign the virtual network interface to the correct address that matched the one I will put in the VMware config for the host only. Because it was IPCop 2, it looks like this. But, your setup will differ if you are running something else and want a fixed ip across the configs.

Assigning Virtual Host Only MAC To IPCop Green

Assigning the NAT MAC To IPCop RED

Assigning the fixed IP to the virtual network host only adapter in the guest OS (IPCop)

Then I went in a edited the networking file where VMWare maps the IP addresses to the virtual network interfaces. In VMWare Fusion 4, they moved it to /Library/Preferences/VMWare Fusion from the previous location under Application support. I gave my private network adapter a fixed IP in the reserved space since I will also be assigning the address to one of the settings in the guest host as a fixed address. You can hit this via an OS X terminal.

$ sudo vi /Library/Preferences/VMware\ Fusion/networking

and modify to assign the interface a IP. My example is changing it from the default setting or DHCP and setting it as 10.111.1.1

editing /Library/Preferences/VMWare Fusion/networking

Anytime you modify this config, you need to restart the the VMWare Fusion application to get it to use the new settings. I would also restart and confirm the settings in the guest host on network addresses on any testing or modifications. After all settings and restarts of guest OS (if they were in a suspended state) and the VMWare Fusion app, make sure the ping the address. You can also arp -a the network from the OS X terminal to see if you get a bite. You should see the MAC address you generated and the IP you set in the networking config.

arp -a in OS X terminal confirms vm network address

This process will at least get you a basic host only networking between the host and guest OS in a contained way. It is my hope that VMWare makes this easier in later updates of VMWare Fusion 4 and regardless of what host OS you are running (Windows, Linux, Ubuntu, etc.) At the time of this post, we were at VMWare Fusion 4.0.2.

Sep 26

Great Amplified Classroom Speakers: Epson ELPSP02

One Epson ELPSP02 On A Classroom Wall

Amplified speakers for classroom use are tough to come by. We have gone through many models. If you get desktop speakers, you need to then get wall mounts. So, you can go cheap, but adding the cost of decent wall mounts and the time involved to install them spikes the price. There unfortunately are very few options out there under $200 that have decent wall mounting kits that come with them and that are really set for use in a classroom setting.

I was able to find the Epson ELPSP02 Active Speakers. They are a pair of speakers that were designed to be wall mounted and ready to go for teachers. They cost around $150 or so from CDWG or another distributor.

The treble and bass adjustments are also a nice touch. It also comes with a mounting bracket for the power adapter which is great for cabling organization. We have a few pairs of these in now, but will be using this as the new standard for classrooms. They are also white in color and the cases are durable, so I feel they will hold-up to the rough environment of the high school classroom.

Couple of points to note: RCA to 3.5 audio connector cables are NOT included, so you need to get those separately. Also, the cable that connects the powered speaker to the non-powered is not standard speaker wire, so you cannot have these more than about 12 feet apart from each other. But, there is plenty of length to put them above or around a standard dry-erase whiteboard.

All and all in our testing, we are finding they are holding-up well and provide decent sound for the rooms. The mounting brackets come with the units, so that is just a huge time-saver on getting third-party mounts from Peerless or something and then having to rig something crazy.

The Epson site product page actually doesn’t even do a decent job of giving you information or pictures of what they really look like so I have added some additional images here. For me, seeing the way the connections are located is super-important. These speakers are designed to hang on the wall so the cabling that comes with it works well with the wall mounted setup.