I've also grown up here. You can see from the image that I stared as a student back in the 90's. I've gradually climbed up the ranks into engineering and later leadership. It's given me some great experience and a hell of a resume. Thanks UAA!

Windows supports file and printer sharing traffic by using the Server Message Block (SMB) protocol directly hosted on TCP. This differs from earlier operating systems, in which SMB traffic requires the NetBIOS over TCP (NBT) protocol to work on a TCP/IP transport.

445 (SMB) is preferable over 137, 138, and 139 (old NetBIOS over TCP/IP aka NBT). In a nutshell SMB uses DNS and direct contact. NBT uses broadcasts and WINS.

So, NetBIOS isn't really necessary anymore. I have it turned off on all my windows clients. I just tested disabling it in the samba server at home and it works fine; even a little snappier. I'm not even running nmbd anymore. You must have domain resolution though; either FQDN or search domains.

Note no more 139 listening ports

styx:/var/log# netstat -anp | grep smbd
tcp        0      0 127.0.0.1:445           0.0.0.0:*               LISTEN     6128/smbd
tcp        0      0 192.168.0.2:445         0.0.0.0:*               LISTEN     6128/smbd

Then here's my smb.conf file. Some nice tricks in there.

[global]

# Biographical information
server string = %h server (Samba %v)
workgroup = SYMB

# winpopups suck
message command = /bin/true

# not a print server
load printers = no

# yeah! Netbios is over.
disable netbios = yes
smb ports = 445
#dns proxy = no
#local master = yes
#os level = 20
#wins support = true
#netbios name = styx
#netbios aliases = house household home

# Do something sensible when Samba crashes: mail the admin a backtrace
panic action = /usr/share/samba/panic-action %d

# security
passwd program = /usr/bin/passwd %u
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
security = share
max log size = 1000

# network options
socket options = TCP_NODELAY
bind interfaces only = yes
interfaces = lo 127.0.0.1/32 eth1 192.168.0.0/24

# logging
syslog = 2
syslog only = yes
log level = 2
log file = /dev/null

# locking
# technically, reduces performance, but no contention errors
oplocks = no
fake oplocks = yes
kernel oplocks = no
level2 oplocks = no

[homes]
   comment = Home Directories
   browseable = no
   writable = yes
   create mask = 0664
   directory mask = 0775
   hosts allow = 192.168.0.

[household]
 path=/mnt/family
 comment=communal
 browseable=yes
 writable=yes
 public=yes
 force user=smb
 force group=smb
 force create mode = 0664
 force directory mode = 0775
 hosts allow = 192.168.0.

He's most recent project legacy is Alice; learning software to teach programming through building virtual worlds. I love this! I spent so many hours playing Rocky's Boots [2] on the Commodore64. Rocky's Boots, a 2D "virtual reality" program, allowed you to run around a "dungeon room" environment. Each room had circuits and a written lesson on the circuit.

The trick with Rocky's Boots was to drag all the generators and circuits into the final room so that you could build really complicated machines. We would NOT reboot the computer so that we could keep the room's state. You can play it on an emulator still :)

I like engineering learning software. I cultivate fantasies of creating kinesthetic software for choreagraphers and first person shooter games for learning taxonomies (biology, chemistry, history...). This software was important to me where it was available; Rocky's Boots, Math Invaders, Letter Invaders. 2nd life is making its way into universities fast (including ours). I believe much of my learning all through school could have been massively accelerated. Quoting Dr. Pauschs's Lecture, "[...] particularly with middle school girls, if you present it as a story telling exercise, they are perfectly willing to learn how to write computer software." Being a boy, commanding "robots" around with the boot, was gratifying. But maybe stories and relationships are better for girls. It's about finding the right context; statistically for a group and individually for a person

Dr. Pausch was inspiring; dreams, life, learning, and engineering. He did it all and, I believe, left an indelible mark at the beginning of a great journey.

If you've played with intermmediate certificate authorities (like godaddy), then you probably know some of the pain of configuring certs for different applications. You usually test with your browser and are frustrated with continual "Invalid Certificate" prompts. Here's a command line way to check your SSL negotiation for HTTPS (or an SSL over TCP).

 echo GET | openssl s_client -connect www.google.com:443 -state

This sends and HTTP GET request to www.google.com on TCP port 443. The output helps you analyze the certificate chain and certificate contents. The output looks like this.

CONNECTED(00000003)
---
Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
 1 s:/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDITCCAoqgAwIBAgIQPI06ZO4Y3RtzC6GS7viYGzANBgkqhkiG9w0BAQUFADBM
MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg
THRkLjEWMBQGA1UEAxMNVGhhd3RlIFNHQyBDQTAeFw0wODA1MDIxNzAyNTVaFw0w
OTA1MDIxNzAyNTVaMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgSW5jMRcw
FQYDVQQDEw53d3cuZ29vZ2xlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAmxntXaVWr0lm23n9whx4Tk8RpYqs4pTu4+JLwAMlp5nMZeHslK6u8KeZvBDX
7YcwR81Q+a/T0/QLjUeKLuLOU5uRmX8eXPkb1umTZ+NK+M/EjAxo0ZdURw4KJDCn
gpSu3q4/v7oUxviykI42reHQvhaas15yOEnadKE//9KHge0CAwEAAaOB5zCB5DAo
BgNVHSUEITAfBggrBgEFBQcDAQYIKwYBBQUHAwIGCWCGSAGG+EIEATA2BgNVHR8E
LzAtMCugKaAnhiVodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlU0dDQ0EuY3Js
MHIGCCsGAQUFBwEBBGYwZDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhhd3Rl
LmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3d3dy50aGF3dGUuY29tL3JlcG9zaXRv
cnkvVGhhd3RlX1NHQ19DQS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUF
AAOBgQAxCmyinulUGRZomZHWQ8trtMxszLD78e6BvwArb1ASxq8CKjbBKN7FTFYg
bfU9QrkYgSCy3Vdd674yhFBFUW7N5C4qOIifUu0o//yNV7WtZK5NDg7ZPay4/mZM
FY9EUvp8PATtfzdhBP7V6bmwnv6lEWnJY9ZGgW8A2HIvgjdEwQ==
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
issuer=/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
---
No client certificate CA names sent
---
SSL handshake has read 1765 bytes and written 328 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-SHA
Server public key is 1024 bit
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-SHA
    Session-ID: FA90A39B0BD274C71247A40506D5BBA3B1107CB1C5FE7C246B0354D703ED405B
    Session-ID-ctx:
    Master-Key: 04DC328CB4B2D392FE9FFC5B85015311456C5EF6412F9A47BBFBB4D6E38B9721
51080984DD8A6E52872AE5E773C149E1
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1216690549
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

The Pwnie Awards is an annual awards ceremony celebrating the achievements and failures of security researchers and the security community. It is also very, very funny.

Wordpess was nominated for the "Mass 0wnage" category. Note the link to Common Vulnerabilities Exposure data. Wordpress has had like 50 in the last year. Movable type has had four in their entire history. This on the heels of my switch to MovableType is reaffirming.

for i in *.pdf;do echo $i
    convert -quality 100 $i `echo $i | sed -e 's/\.pdf/-%d\.jpg/g'`
done

It says for every PDF use convert at 100% JPEG quality. The nasty backtick echo at the end converts FILE.pdf to FILE-%d.jpg. %d is convert's way of numbering the pages. If you don't use %d you'll just get a single jpg from a multi page pdf.]]> http://jimweller.com/2008/07/convert-pdf-to-jpg-nice-little.html http://jimweller.com/2008/07/convert-pdf-to-jpg-nice-little.html Mon, 21 Jul 2008 17:30:00 -0900 Nial Kennedy has a nice post on setting up google site maps for your blog. I extended his example by including more than just the blogs. I added my own static pages to the XML feed. I also use the MT markup to include my MT pages (as opposed to entries). Here it is. If the code wrap is ugly on a smaller screen, then click the permalink.

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://google.com/schemas/sitemap/0.84">

<url>
<loc><$MTBlogURL encode_xml="1"$></loc>
<priority>1.0</priority>
</url>


<url>
<loc>http://jimweller.com/jim-weller/jim/dbsgmlqs/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>

<url>
<loc>http://jimweller.com/jim-weller/jim/java_proc_sched/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>

<url>
<loc>http://jimweller.com/jim-weller/jim/palmdevqs/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>
<url>
<loc>http://jimweller.com/jim-weller/jim/titrax/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>
<url>
<loc>http://jimweller.com/jim-weller/jim/lfw/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>
<url>
<loc>http://jimweller.com/jim-weller/jim/wedding/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>
<url>
<loc>http://jimweller.com/jim-weller/jim/vc98asmqs/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>
<url>
<loc>http://jimweller.com/jim-weller/jim/dbxmlqs/</loc>
<lastmod><$MTDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
</url>


<MTpages lastn="9999">
	<url>
	<loc><$MTPagePermalink encode_xml="1"$></loc>
	<lastmod><$MTPageModifiedDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
	</url>
</MTpages>


<MTEntries lastn="9999">
	<url>
	<loc><$MTEntryPermalink encode_xml="1"$></loc>
	<lastmod><$MTEntryModifiedDate utc="1" format="%Y-%m-%dT%H:%M:%SZ"$></lastmod>
	</url>
</MTEntries>

</urlset> 

If you wound up at this page from a fraudulent email. I apologize. My site was being used to try and harvest account numbers. I believe my hosting company and I have rectified the problem. If you recieve an email or have any questions email me.

I switched to wordpress back in the day because it was in active development compared to geeklog and it was much more secure than php-fusion. The last two weeks though, it has proven troublesome as nefarious folks have breached my wordpress sites. They used the breach to put up phishing files, mostly preying on Bank of America customers. First sleeplesstech.com and missioncriticalshirts.com got hit. I found out from my hosting company, bluehost, because they suspended my account. It's kind of a medieval process with a lot of support tickets.

Then, worse, I got emails from strangers in the community who were spammed with phishing emails that referenced files on my site. Here's a a picture of the email scam and some of the PO'ed notes I recieved. I don't think people understand that this just happens. It surprises me that they think the phishers are so naive as to use a single level of social separation. Like I'd phish with my own site.

What to do? Lock things down. There a number of sites on securing wordpress and the subject is very googlable. Here's what I came up with and some old ideas.

• php.ini, disable allow globals and error reporting
• disable "anyone can register"
• use .htaccess files to password protect /wp-admin, /wp-include and any sensitive php files
• delete extraneous users
• make passwords MUCH more complicated (saved in firefox anyway)
• rename xmlrpc.php to something else (old news)
• disable comments, pings & trackbacks (old news)
• use SSL which I can't right now until I shuffle some domains around

From: xxxx
Sent: Monday, June 30, 2008 5:33 AM
To: jim@jimweller.com

Sent: Monday, June 30, 2008 7:06 AM
To: jim@jimweller.com
Subject: RE: Set Your Online Security Preferences.

I really put some time and word smithing into organizing the information. All the content areas have introductions. The about page is really fleshed out and current. I added credits referencing all the software and media I use to make this site.

There's always things to do though. I'd like to polish up the gallery to use some nice jquery or mootools scripting. I should go through the gallery, label the galleries, and elliminate dupes. The sidebar doesn't look as good in IE because of spacing issues. The email gateway's are still pretty coarse and could use some polish. My bookmarks are a mess (but a searchable mess). The linking in the recent area needs some work. Oh...and my resume is a year out of date.

• painted all the sconces blue
• insulated the garage door
• install new outside motion detector lights
• jacked up and added supports to the rear porch
• insulated the "troll door" to the very cold attic door in the computer room closet
• decked out the guest room and draped it to keep it clean while unused
• setup webcams on the critters
• painted the downstairs window trim burgundy

Though I had thought I didn't want lop eared bunnies (or even new bunnies), I was really taken with the personalities of Mutt and Jeff. They were nice with each other and both presented to be petted (or fed, but didn't mind petting). They have been outside bunnies as you can see from the pictures. So I have built them a cardboard lined pen from medical boxes and propped up utility tables at the end of the living room next to Weeter. I'll use the small space to work them into reliable box training and house freedom. I renamed them to Poppy and Cardamom. They haven't complained. I've been learning a lot from the faqs from the House Rabbit Society. Very exciting!

Click on the images below to view the gallery of photos.