I have been using the tablet off and on since then, with most of the functionality available while logged in, but there have been a few rough edges.  With a tablet PC, how do I log into the tablet while it is undocked from the keyboard?  I have used a great on-screen keyboard/handwriting recognition tool called Cellwriter.  It requires a little training, but the tool is very accurate after training.  There are two instances where a user needs to enter a password, when logging in and when unlocking the screensaver.

• Login: I use Gnome, so GDM is the login manager I prefer on this tablet.  Changing the configuration was fairly wasy.  The configuration file, in Debian, is /etc/gdm/Init/Default.  I found that a single line, added above the final “exit 0″ line, was enough to add the keyboard: “cellwriter –keyboard-only –window-x 170 –window-y 568 &” and restart X by logging out.

• Screensaver: The screensaver was slightly more difficult, requiring two steps to configure within gconf-editor:

1. Enable the embedded_keyboard_enabled key in /apps/gnome-screensaver.
2. Edit the embeddes_keyboard_command to include: /usr/bin/cellwriter –keyboard-only –xid

I could have chosen one of a number of alternative keyboards, but Cellwriter works so well and looks so clean compared to the other tools I had tried.  There are two issues that I have been dealing with with little success…

First, the –keyboard-only flag is in both locations to run the keyboard without regards to the written input.  I expected to need that during login, as GDM has idea who is logging on until after they have logged on and GDM is no longer needed.  However, I did try to use it normally with the screensaver login, and I could not get gnome-screensaver to accept my known-good password while using the handwriting portion of the application.  While I would like to be able to write my password, your entire password remains on the screen in the input box until you accept the input.  So, I will try to get at working sometime, but it probably better that i have to type my password, keeping it hidden from view.

Second, each of the applications would randomly spam one of the input buttons as I was typing on the screen.  This forces me to have to simply hit the enter key and start again.  At some point, I will have to try using the native fpit driver within Xorg.  I might already be, now that I have upgraded my system to the post-Lenny testing version of Debian (Squeeze).  I haven’t otherwise updated the system’s overall configuration in several months.

So, hopefully, I can start getting even more utility out of this again, without the encumberance of this keyboard.  As much as I would like to try one of the new netbooks, like the Acer Aspire Once or the HP Mini 1000, the lack of a touch screen makes those devices a less-attractive form-factor that this handy piece of gear.

I began investigating by looking into the metadata for the voicemails which were left; all were from unusual phone numbers outside of our area code.  My next trip was to the CDR records and my provider’s call history.  These sources showed that over 1000 phone calls were attempted to be connected through our phone system to various communities around the country.  Two patterns emerged while looking at the details of the calls:

• The calls were being generated in a non-sequential pattern; clearly an unscrupulous telemarketer was war-dialing to South Carolina, Michigan, and Virginia.
• All of the outbound calls were originating with my girlfriend’s CallerID.

So, I knew what was going on, but I had yet to determine to how this incident occured.  Further digging revealed that the Linksys ATA being used internally was lagging significantly and intermittently.  It was a moment of epiphany; I understood where the problem was, and I could take action to address it.

Several years ago, I installed an Asterisk server to provide home phone service with a company that provided an IAX trunk.  At the time, all we were using softphones to make and receive calls.  Over time, I upgraded to a Cisco 7940 for myself and an analog cordless phone on a Linksys ATA for my girlfriend.  At the time I installed the ATA, I had not used a significant amount of security of the SIP peer registration, as the network was firewalled from the Internet.

Fast forward to 5 months ago…  I obtained a business phone service through a major provider using SIP.  Due to their configuration, I was required to open the SIP and RTP ports to the general Internet and forward them to my Asterisk server.

Now, we return to the present time.  Several days ago, this telemarketer scanned my router, found open SIP ports, and began to issue a brute-force attack against my Asterisk server.  The telemarketer scanned every possible 3 and 4 digit peer name, was able to find the Linksys ATA’s peer name, and was quickly able to brute-force the password.  With this information, the telemarketer was able to register as that peer and make calls outbound, according to the dialplan configured for my girlfriend.  My Cisco’s peer was not impersonated, but it would not be likely to be responsible for outbound calling due to the unique dialplan I am using.

With the understandng of what has happened, I could work to correct and block the means by which this telemarketer was using my phone system and service:

1. I unloaded chan_iax.so to remove the possibility of additional phone calls being made.
2. I then enabled a moderate amount of security, particularly a random password for each of my SIP devices.
3. Next, I modified my firewall configuration to drop all packets through my router which contained the IP address from which the attack came.
4. I then re-enabled the IAX phone service by reloading the chan_iax.so module.

After the initial security containment, I turned my focus to handling the inbound phone calls being returned based upon the messages left with the various victims around the country.  I recorded an announcement indicating what had happened and that the compromise was taken care of.  Finally, I crafted the dialplan to play this announcement to every caller not from a local phone number.

Overall, this breach was not as extensive as it could have been, but it does illustrate that security must be vigilantly monitored and maintained.  My complacency in the security of my network ultimately led to this incident.  Fortunately, it does not seem to have led to any major financial loss to any party, including myself.

For the most part, I would like to spend the time answering anyone’s Linux questions. But I thought I would include some weekly news, and I want to include two applications per week, one graphical and one text-based.

To get help with any conundrums, email len@nosbig.net. I want to hear from people before and during the podcast. I will probably post the rehearsal after I edit it down a little. There were a few spots where my ADD got the best of me and I repeated myself or I had to pause a moment to collect my thoughts. I thought I had prepared sufficiently for this episode, but clearly not.

My next challenge was to get the network card working. Keep in mind that this laptop does not have working PCMCIA sockets because it fell off the table…. Since this had been a laptop I had been previously using, I had already found a suitable USB network adapter, the D-Link. I first tried to install the drivers for the network card, but I could not get the provided 2.4.18 kernel source from the Debian CD’s to match the pre-compiled kernel. Since I had to compile a kernel from scratch, anyway, I went ahead and used my USB Zip drive to copy over the 2.4.24 kernel source code. Then, I extracted, configured, and compiled my kernel.

Next, I compiled and installed the drivers for the network interface, available from The Linux-WLAN Project. After installation of the drivers, the log file said that the device had no driver claiming it. So, I actually found the source code that links the product/vendor code to a driver and edited the prism2sta.c file to add the cod
es in. I recompiled the modules and reinstalled. At this point, the interface was recognized.

The next step was to get the kernel to set up the network interface automatically. On my home network, I have a DHCP server set up, but there are two commands that are needed to turn on the radio and associate with the Access Point. To get these to be executed automatically when you plug in the card, place the following two commands in /etc/network/interfaces:
pre-up wlanctl-ng wlan0 lnxreq_ifstate ifstate=enable
pre-up wlanctl-ng wlan0 lnxreq_autojoin ssid=”” authtype=opensystem

Once the network is configured, the next step is to install the streaming software. At slimdevices.com, I downloaded the tarball, rather than the RPM. After extracting the code, I
copied it into place and ran the software. It defaults to using port 9000, but that can be changed in the server interface. I changed it to port 80, for ease of access. At the same time, I changed the directory of the music library to point to my collection, once I got it copied to the server.

After getting the software laid out in the right locations, I decided I wanted to add it into the init system, so I needed to have a daemon startup and shutdown script. It turns out that the one for the sympa mailing list manager worked well for me, after some slight modifications. After creating the script for the init.d directory, I created the appropriate symbolic links in the rcX.d directories.

There are some last minute details that I am still working out, such as using NFS for native Linux mounting from other machines and Samba for Windows file sharing. The only other large project yet to conquer is a firewall. Of course, the Shorewall package will dramatically simplify that project.

In a matter of a couple of days of experimentation, I have set up my old laptop to stream and share my entire music collection to any machine that is on my network, giving me the freedom to listen to my music anywhere in the house or out in the yard, when it finally warms up in Ohio.

- Active Directory (a fundamental part of the Windows 2000 and XP environment) appears to be based on Novell’s NDS, which is in turn based on LDAP.
- Windows 2000 Native Mode Domains rely on DNS, another standards-based technology
- Roaming Profiles are the poor-man’s method of doing NFS for home directories

There are other eccentric quirks to Windows 2000 that I should cover in a future entry, should I not have more coming my way to interfere with writing it.

You can pick up a copy at http://gaim.sourceforge.net. And don’t worry if you are running Windows, there is a Windows port that also works very well.

This is just as surprising as the Christmas easter egg for WindowMaker. Another reason to love Linux, the authors love to throw in little bits and pieces of code in that surprise us from tie to time.

Anyway, I did post to the NCOLUG website that Debian 3.0 has arrived. This was several weeks ago. Since then I have ordered and received the CD’s, an 8 CD set. I will be looking forward to changing my distribution at some point. I will have to test it out on a seperate partition as a sacrificial lamb…

If anyone knows how, leave me an email or a comment on this entry, and I will have to try it out.

Anything that seriously changes the screen resolution or bit depth don’t seem to work, although I probably can tweak the configuration to fix that. Duke Nukem 3D and Liero won’t run, but I did get ZZT and Commander Keen functioning…..\n\n