Check your cron jobs...

Yesterday, a PAM security update was released. Unfortunately, it introduced a regression which caused the cron daemon to stop working with a "Module is unknown" error.

The updates were quickly pulled from the archive, and a regression fix has been released.

If you have servers or desktops configured with unattended updates, they may have gotten updated with the broken release. If so, cron jobs will have stopped and updates will no longer be automatically installed.

You may fix this problem by performing one of the following actions:

• Rebooting your machine
• Restarting your cron daemon ("sudo /etc/init.d/cron restart")
• Updating to the latest PAM packages (with Update Manager, or apt-get)

This is a rather unfortunate situation, and steps have been implemented to make sure a similar issue doesn't happen with PAM updates in the future.

We apologize for the inconvenience.

Self-Encrypting Hard Disks

I travel a lot with my laptop, and it can contain private information that shouldn't get disclosed if it's ever lost or stolen. For this reason, I've been using various types of disk encryption over the years, such as Ubuntu's encrypted home directory feature, to reasonably assure that my data remains private.

A few things have always bothered me with software encryption though. The first thing is the fact that software encryption is non-transparent. Although slight, there is a performance penalty in encrypting every read and write to your hard disk. Some people choose to only encrypt certain things to try and reduce that penalty. Do I only encrypt my home directory? What about my swap file or the /tmp directory? If I encrypt my swap file, do I give up hibernation, or do I make it ask me for a passphrase when I boot? What happens in case of disaster? Will I be able to boot a recovery cd and gain access to my data? Will I have saved the passphrase/encryption key somewhere safe in case an emergency arises?

Another issue is the fact that the decryption key necessary to access my encrypted volumes is located somewhere in RAM. There are a bunch of reasons why this is worrisome, from “Cold Boot” attacks, to hibernation, to simply having it leaked in some other way.

But the biggest gripe I have with software encryption is the “Evil Maid” scenario. Basically, every time I leave my laptop unattended, someone could boot off removable media, or physically plug my hard disk in another computer, and alter the software that is loaded before my encrypted volumes. The altered software could send them my encryption password as I type it, or could wait around for my volumes to be mounted before installing a back door. I need to stay physically present with my laptop at all times to make sure this scenario isn't possible, something I'm not always prepared to do. Although laptops are expensive, the loss or theft of an encrypted laptop is limited to the value of the hardware, not the incalculable value of its contents. Leaving my netbook in my hotel room is an easy choice to make if all I stand to lose is a couple of hundred dollars.

Since the hard disk that came with my Lenovo Thinkpad was a little small for my taste, I decided to replace it with a bigger one. In doing so, I specifically paid $20 more to get a model with FIPS 197 certified hardware encryption. These hard disks will encrypt everything that is stored on the physical platters with AES 128bit encryption, and a random key. When the disk is powered on, a standard ATA password is required to access it, and the password cannot be reset; if it is lost, the disk is no longer usable. A master password can be set that can be used to reinitialize the random key, so the disk is usable, but the data contained is lost.

Fortunately, most ThinkPad models come with the required BIOS support for disk encryption, so simply swapping the hard disk and setting a password in the BIOS screen was enough to get it working. Not all computer manufacturers have implemented the ATA security set, so you need to check carefully. Apparently MacBooks don't have it, for instance.

For under $100, I now have an encrypted 500GB hard disk in my laptop that asks for a passphrase when I boot. Is this solution perfect? No. But, it's better than what I had before, and is perfectly adequate for my piece of mind.

Netbook screen resolution

I love my Dell Mini 9.

I'm back from UDS in Orlando, and have once again spent a whole week on my Mini 9. It's got a webcam so I can call home, and has bluetooth so I can use an external mouse without plugging in a dongle when the need arises. Although I've tried netbooks with 92% keyboards, I'm not ready to sacrifice portability by adding the extra 2 inches required to fit them. The keyboard on the Mini 9 has the perfect feel for such a small keyboard, and I've gotten quite used to it.

The only thing I can't quite get used to is the native screen resolution: 1024x600 is not a lot of screen real estate to work with.

The other day I was looking at the xrandr documentation, and I noticed it supports screen scaling. I now regularly use the following command:

xrandr --output LVDS1 --scale 1.25x1.25

This scales my 1024x600 netbook screen to 1280x750, which is really cool when trying to view large web pages, or any other application that uses a lot of screen space. The downside of this is a slight blurriness that is, in my opinion, an acceptable trade-off.

Unfortunately it doesn't look like there's a way to set scaling in the GNOME Monitor Preferences tool.

Stuck on dial-up (Updated)

My mother has been a happy Ubuntu user ever since I installed Dapper to solve the countless problems she was having with Windows Me. Since her computer is starting to age, and she's a 5-hour drive away, I bought her a brand new computer for her birthday, which I've been installing with Lucid this week.

Problem is, she is still stuck on Dial-Up internet access no matter how hard she's tried to get broadband from the local phone and cable companies.

Unfortunately, NetworkManager still doesn't have 56K modem support, so a few steps are necessary to setup Ubuntu for dial-up.

Since her phone line is noisy, I purchased a reliable modem that doesn't need special drivers to work in Linux, along with an appropriate USB-to-serial adaptor.

Once I made sure the modem was visible by searching through dmesg for the right serial port, and testing it with minicom, I performed the following steps:

1. Installed the gnome-ppp package
2. Added her user to the "dip" group so gnome-ppp could spawn the pppd daemon
3. Configured gnome-ppp with the phone number, username and password provided by her ISP

Once that was done, connecting to the Internet worked great, except for a single problem: Firefox would always start up in "Work Offline" mode. It turns out Firefox uses NetworkManager to figure out if an Internet connection is available when it starts. To fix this:

1. Type "about:config" in the Firefox URL bar
2. Search for the "toolkit.networkmanager.disable" key
3. Switch it to "true"

I'm looking forward to seeing her go from Hardy to Lucid this weekend!

Updated 2010-10-22:

So, I ran into a couple of extra difficulties when I actually installed her new computer. It seems her ISP uses CHAP or PAP to authenticate which wasn't the case when I tried connecting with my ISP at home. Gnome-PPP uses WvDial to perform the actual dialing, and WvDial tries to add the necessary authentication information itself to the /etc/ppp/pap-secrets and /etc/ppp/chap-secrets files. Problem is, those files are owned by root and are 600 by default. The pppd man page states "this file should be owned by root and not readable or writable by any other user. Pppd will log a warning if this is not the case.", so this isn't an easy problem to solve. Since I didn't want her running gnome-ppp as root, I changed both files' ownership to root:dip and permissions to 660. This allowed gnome-ppp to authenticate to her ISP, even though pppd is logging a warning.

The second problem I encountered was that Evolution would always come up as offline. Like Firefox, it integrates with NetworkManager to check if the computer is online. Unfortunately, unlike Firefox, Evolution doesn't seem to have a way to disable NetworkManager integration. Since time was limited, and I knew she wouldn't be using the Ethernet port on her computer, I simply disabled NetworkManager entirely by editing the /etc/init/network-manager.conf file.

My stepfather owns a Dell Vostro laptop with Lucid on it, and uses it to connect to the high-speed wireless network at work. He asked me if I could get a modem for his laptop so he could use Dial-Up when at home. I'm not sure how I will be able to handle this for now, as disabling NetworkManager won't be an option in his case...

New GPG key!

In accordance to the Ubuntu Security team's GPG key transition plans, I now have a new GPG key capable of generating SHA-2 signatures.

If you've signed my old key (40B8CCDA) in the past, I would appreciate it if you could take a look at my transition statement, and sign my new key (A744BE93).

Thanks!

Trying to switch to Empathy

I try to dogfood as much as possible. I try to use the actual applications Ubuntu ships by default for everyday things like web browsing, email and IM. I believe this is the best way for applications to get tested properly, fixed, and improved. If developers don't use the default applications because they are buggy, or don't contain necessary features, how can we expect them to be appropriate for regular users?

I've been a Pidgin user for years. It's a great, but now there's a new kid in town: Empathy, which is now the default IM client installed in Ubuntu and other distros. This week, I am attempting to switch from Pidgin to Empathy. So far so good. It's working pretty great, except for one thing: I keep missing the notifications when people send me messages.

If I already have a chat window open with someone in Empathy, and the person sends me a new message, I get notified in three ways: I get a temporary notify-osd message, the Indicator Applet envelope turns green, and the window in my window list flashes for a few seconds and stays highlighted and bold.

Most of the time, I miss the notify-osd popup, as I'm typing something, and tend to always finish before looking up at the alert. Once I do, I rarely have time to read the whole thing before it disappears. My Indicator Applet envelope is green most of the day as I almost always have unread messages in my Inbox. But as soon as I finish the task I'm doing and go to switch windows with the window list, I notice the highlighted and bold window demanding attention.

The problem I have with Empathy is there is no way to tell it to open a new chat window automatically when a new message arrives and there isn't already a chat window open. When that happens, I don't have the highlighted window in the window list demanding attention, and often discover that I missed an IM an hour later when clicking on the green envelope to read my email.

What am I doing wrong?

Canadian tax software and Linux

Well, it's tax time again!

This used to be the part of the year I would dread. Not because I feared how much income tax I would need to pay, but because I knew I would have to get Windows running in a VM or on a spare computer in order to use tax preparation software.

I would get heartburn from wondering if the new flavour-of-the-day copy-protection mechanism the software used would actually work in a VM, and if it would let me open up my files again after reinstalling it if something went wrong. Top that off with the fact that trusting your important data to Windows is like locking your safe with duct tape, and I'd be popping Rolaids like candy.

Are all the security updates installed?
Every time I open "Windows update", it manages to find some more.

Is my antivirus software properly installed and working?
What if I got malware while purchasing the antivirus software online, before I installed it? Which one do I choose?

Oh great, the new version of the tax software uses Internet Explorer to update itself.

Luckily, a couple of years ago I discovered UFile.ca, a web-based tax preparation application. They even officially support Linux! It's quite refreshing to see a Tux logo right next to the Windows and Mac logos. It's even easier to use than the software I was previously purchasing!

Of course, it's web-based, so it's up to you to decide if you're willing to accept handing over your tax information to a third party. In my case, the decision was easy: I get to decide who can see my tax information, which is a lot better than hoping no one could see it.

Goodbye heartburn!