Subversion Is An Old Man's Tool.

As Joel Spolsky put it: "Distributed Version Control is here to stay, baby”. If you've read Joel's stuff, you know he has a way of making sense — a quality of writing which can be tough to find on the Internet. As a Git user, I can't say Joel converted me, but he did get me thinking about why I too hung on to familiar ol' Subversion long after it's obsolescence. Rather than boring you with that, herein lies a minimalist guide to getting started with distributed version control.

If you are wondering about the Git vs Mercurial (Hg) debate, don't bother. Both work well and can even be used in tandem. The focus here will be on Git because it has alphabetical priority, and Joel has already written Hg Init: a Mercurial tutorial.

For experienced developers, the hardest part about learning Git is unlearning Subversion or other legacy VCS. Here are a few things to keep in mind (if you get bored, just substitute "jedi" for "repository"):

• Any repository can be cloned.


• Any repository can be a master.


• Distributed VCS doesn't mandate distribution.


• Local changes: checkout, commit


• Remote changes: pull, push

A New Repository

Don't be put off the 'distributed' bit, git is perfectly happy to have just one folder — repository and working copy all rolled into one:

mkdir /srv/git/foo
cd /srv/git/foo
git init
# add some files
git add .
git commit -m'initial checkin'

So Git scales down nicely, but with shared repositories it is important to know that Git will grouse if asked to push changes to a destination where files are checked out. This problem is easily avoided with a bare repository, essentially a repository which cannot have files checked out locally:

mkdir /srv/git/foo
cd /srv/git/foo
git --bare init

Send in the Clones

Where git repositories already exist, new ones can be cloned; optionally, the new clone can be --bare:

# new working copy:
git clone ssh://user@gitserver/srv/git/foo
git pull

# bare clone:
git clone --bare ssh://user@gitserver/srv/git/foo
git pull

Go with the Workflow

Much of the Git workflow is straightforward, especially if your working copy was cloned from a (bare) master repository:

# get the latest changes
git pull

# make some changes
find . -type f -exec dd if=/dev/zero of={} count=1 \;

# oh crap! I just (sort of) Zeroed all my files
# no worries, just abandon the changes

git checkout .

# double check
git status

# make changes worth keeping
# ... then commit
git commit -a

# need to amend the last check-in message?
git commit --amend

# push local changes to master
git push

There's enough to jump in and get into trouble with git; to find out more, try the following resources:

• Git Documentation
• Git Tools & Hosting


• Why is it called "git"?

Linux Security: Denyhosts

If you've read my Open SSH series, perhaps even if you haven't, you are probably aware of the power SSH offers to those who know how to use it. There are many ways to protect the service from unauthorized usage, focusing on self-contained or single host solutions, one finds two common flavors: those which make use of the Linux kernel's packet filtering tools (netfilter and iptables), and those which rely on Wietse Venema's TCP Wrappers. Netfilter certainly offers power and flexibility, but this may be at the cost of simplicity and management ease. While no security measure ought to be implemented blindly, there is an undeniable benefit to simple measures which can be configured quickly and with little fuss — in this arena, TCP Wrappers stands tall.

Cloud Life: Kernel Upgrades

One thing not mentioned in EC2StartersGuide is how to apply kernel patches. Technically, this isn't currently possible in the Amazon cloud, which is to say that the boot loader (e.g. grub) within an EC2 instance cannot load an arbitrary kernel; nonetheless, official kernel updates are available via package updates, though cloud servers won't automatically load the latest installed kernel when booted.

Managing MySQL

Database management is one of those tasks where GUI tools can often be handy and occasionally critical. The history of Linux point-and-click tools for MySQL is a bit checkered, and prominently features MySQL Query Browser and MySQL Administrator, official tools formerly supported by MySQL. Early releases were buggy and crash-prone, but had progressed to merely flaky by late 2009, when MySQL announced they would pull the trigger on them in favor of MySQL Workbench. MySQL support for the GUI Tools Bundle officially ended in June 2010, but the tools are still available in Debian and Ubuntu repositories, while MySQL Workbench is conspicuously absent. While this may deter many users from test driving Workbench, they are missing out on a powerful tool for database management. Fortunately, MySQL publishes MySQL Workbench binaries.

Transatlantic Text Editing

Philip has posted a brief follow up to Managing Line Endings over at Armadillo. He's also got some articles which may be useful for anyone forced to use SSH on Windows.

3 Easy Steps to SSL Client Authentication

There are many resources on the Internet for correctly securing apache web sites with X.509 client certificate authentication. This isn't one of them. What follows is a three step guide to the fastest, easiest method for setting up self-signed server and client certificates. You are advised not to run any of the commands below in a production environment, they are presented only as an aid for those who learn kinesthetically.

“A good solution applied with vigor now is better than a perfect solution applied ten minutes later.”
- General George Smith Patton III (source)

Automount USB drives on Ubuntu servers.

In most cases, Ubuntu desktop systems will automatically detect and mount removable media, and this is largely done with software that is part of the X Windows system; for server systems without X Windows however, this sort of thing requires a bit of work.

Now some may ask, "Why automount removable media at all?" It is unwise to remove an active device, such as unplugging a USB drive without first unmounting it, and automounting may encourage this sort of recklessness. I don't contend this, but if one runs a server using an external USB drive, there are two words which should spark an immediate interest in automatic mounts: power failure.

Diagnosing Sound Problems in Ubuntu Linux

Sound problems fall in to three basic categories, and the first thing you want to do is determine which one you're dealing with. The easiest thing you can do is test your speakers with something else, using the same cable. If your speakers and cable are confirmed to be in good working order, then the problem must be either:

SSH Coolness ... even on Windows.

prerequisite concepts: prelude, basic config., port fwd, proxy conn.

I don't often have the opportunity to experiment on computers running Windows, but every once in a long while it simply cannot be avoided. I recently found myself wanting to look up a password in Revelation, a password manager for the Gnome Desktop on Linux; I have previously written about using OpenSSH's ProxyCommand directive to tunnel through a firewall and forward X11 (GUI) applications remotely from a an isolated workstation on a private LAN, the difference here was that I needed to forward that application to a Windows workstation.

OpenSSH: Environmental Override

prerequisite concepts: prelude, basic configuration

This post is as much about customizing the root shell as it is about SSH environment variables, but I'm adding this to my OpenSSH collection because it's applicable to any user.

I occasionally work on servers where, for a variety of reasons, I share an account with one or more other users; this is almost always suboptimal, but it does happen nonetheless. Over time I've grown somewhat partial to zShell, so one method I've used is to log in to a default shell, usually bash, then run zsh.

OpenSSH: Proxy Connections

prerequisite concepts: prelude, basic configuration, port forwarding

Network address translation (NAT) is a very common method of providing secure access to hosts on a private network. Given the limited amount of IPv4 addresses, computer networks with relatively few, very few, and even a single public IP address are common. A typical small business customer of my consulting practice has one or more Linux servers on an office network protected by a firewall. The following is a close look at Example Industries, the theoretical owners of example.com; this customer receives support for two Linux servers, a mail server and a PBX, but only one public IP address between them. Through NAT, public services (namely mail and VoIP) on both servers are accessible via example.com. This works well for inbound mail and phone calls, which only need to access one or the other host, but SSH access is the lifeblood of remote system administration, and there's the rub-- when I enter ssh example.com I land at the mail server. SSH access to the PBX would seemingly threaten to litter my command line with unsightly extra characters, if not subsequent commands outright.

My carpals are tunneled enough, I don't want to type more than ssh mail and ssh pbx to access these servers, and while I'm at it I want to have scripted log-ins as well-- securely, not those namby-pamby no-password keys. In fact, I don't even want to have private keys on either server.

Fear not! With the power of OpenSSH, I can fix this.

Open SSH: Port Forwarding

prerequisite concepts: prelude, basic configuration

Port forwarding is a versatile feature which informs several popular concepts, including X Forwarding and tunneling which are briefly explained below; more advanced port magic will be addressed elsewhere.

X Forwarding
At the end of the previous installment of this series is an example SSH client configuration file, usually located at ~/.ssh/conf; a more complete description of the global declarations shown was deferred until this section, where they are more relevant.

OpenSSH: Basic Configuration

prerequisite concepts: prelude

If you're not already using a config file (~/.ssh/config) you should peruse the documentation to see what it offers; an ongoing benefit I enjoy is that it allows me to accomplish more while typing less. Suppose, for example, you need to access two mail servers which are both behind a firewall and sharing a single public IP address. One server uses NAT (port forwarding) to provide user access via IMAP-SSL, POP3-SSL, and perhaps even webmail, all on default ports; similarly SSH can be accessed on port 22. The other server happens to be a mail relay, which handles all of the spam and virus scanning for inbound and outbound mail; while the SMTP, SMTPS, and submission services all enjoy a NAT configuration using default ports, SSH access is on port 23 because port 22 already forwards to the IMAP server and the sysadmin hasn't read this series of articles.

OpenSSH Prelude: Requisite Knowledge

This is a prelude to a series of articles focused on how the sophisticated power of OpenSSH may be harnessed to great advantage with less effort than one might think. Readers already familiar with OpenSSH and passwordless authentication may wish to skip ahead:



OpenSSH: Basic Configuration
OpenSSH: Port Forwarding
OpenSSH: Proxy Connections
OpenSSH: Environmental Override
SSH Coolness ... Even On Windows

Doctor, I've got audit complaints about my kernel log.

AppArmor, introduced to Ubuntu with Gutsy, is yet another security tool unleashed upon the infosphere. In part, AppArmor is intended as an alternative to SELinux, which can easily be seen as daunting to configure; unfortunately, many such projects are daunting for those admins forced to walk the plank of unfamiliarity above a sea of expectations. Despite a troubled history, the project seems to be here to stay so it is likely only a matter of time before audit messages crop up in one's kernel log. For those who find AppArmor unnecessary, unpalatable, or just untimely, herein lies a quick-and-dirty guide for telling AppArmor where to stick its audit complaints.

But I already have a router!

Verizon is a great company, doing great things, but that doesn't mean they're not evil. I've found that this is an effective maxim which allows me to extol the virtues of Verizon without sounding like I'm drinking the kool-aid. Today I'm hoping it works inversely as well.

When in doubt, test.

Shortly after I last upgraded my mail server, one user reported that his mail client was failing to connect with the message:

"Unable to connect to your IMAP server. You may have exceeded the maximum number of connections to this server..."

He was the only one known to be having this issue, so after a cursory check of the server with no obvious problems, I suggested that this might be an error on his end, such as connecting to the secure IMAP port without using SSL/TLS. Occam’s Razor suggests that a server error is more likely than a client error which just happens to coincide with a server upgrade, so I eventually decided to dig up some infrequently used commands and perform a thorough analysis.

Quick and Easy Caller ID on MythTV

I have resisted the urge to display caller id on my MythTV as somewhat obvious. I’m always looking for ways to demonstrate the freedom which comes from using open source software, but I prefer the zesty freshness of an original idea rather than anything that’s been done, redone, and done again. My wife, however, thought that Myth caller id sounded like a great idea and asked me to set it up. What follows is how I did this with the least possible effort.

Merry ChristMyth

This past Sunday I joined my brother-in-law in watching Christmas in Yellowstone, but we only caught part of the program, so I decided to record a later showing in high definition; unfortunately my MythTV box is about 360 km southeast of my current location. I thought MythWeb might be useful but I was not familiar with it, nor had I installed it. Now that I am, and have, I wish I had set this up earlier. Off site management access is just the beginning of MythWeb’s feature set.

Direct Inward Dialing with Asterisk and Broadvoice

When I wrote about building my own PBX, I mentioned that I set up Direct Inward Dialing (DID), a feature which allows virtual phone numbers to be routed directly to extensions while using shared trunks (phone lines). I figured out how to accomplish this after reading this discussion, but made improvements along the way.