ktdreyer

Typepad Antispam

2010-04-15T17:15:00.002-06:00

I've just set up Typepad's open-source Akismet backend, also known as "Serotype". This software internally uses Perlbal for communicating HTTP, Gearman to delegate instructions, and dspam for content-based spam filtering. Other software requirements are MySQL and memcached.

Documentation is pretty scarce; a README file is basically all you get. However, if you're familiar with Perl you should be good to go. I put the pieces together in a CentOS 5 VM. Many of the required Perl modules were already in EPEL, but I did have to get some things directly from CPAN.

Here are my initial thoughts:

Thank you TypePad for making this open source, and releasing it to the world!
Most of Typepad's software is in Perl, and they are the creators of Perlbal/Gearman, so no surprise that this software is based on that as well. Since it uses Gearman, this Serotype server should be able to scale massively.
Once I installed all the required Perl modules, the software essentially worked "out of the box". I did need to adjust the Gearman client timeout to fifteen seconds. I traced this delay to the yuidd daemon. I'm not sure why it can take up to ten seconds to give me a UID.
The handling of API keys is very loose; the web service accepts API key by default. However, only keys that are "blessed" are able to actually train the database.
I wish there were an easier way to "prepopulate" the database with spam.

Web forms are the spammers' new battlefields. Good thing the Akismet API even exists.

Life After Graduation

2009-12-01T12:00:00.009-07:00

Wedding in IL

Honeymoon in VA

Beach Trip with Dreyers in NC

Birthday in Littleton CO

Skillet concert in VA... in the rain

New nephew

laura-dreyer.com redesign

2009-05-30T21:24:00.002-06:00

Laura and I spent the past three days re-designing her website, adding a blog, re-vamping the gallery... it was hectic but fun!

6 days and counting till I'm married :-)

Last View from Moody

2009-05-15T17:00:00.000-06:00

I thoroughly enjoyed my time at MBI, and I won't forget the many memories from the school or the city.

new kenandaudrey.com coming up

2009-04-17T15:35:00.005-06:00

We're re-designing our wedding website to be more interactive, and it's getting a facelift in the process. Here's a sneak preview :)

Also, I've re-vamped the website for Gingrich Enterprises at www.gei-1.com.

RAID1 on nslu2

2009-04-17T15:28:00.004-06:00

Can RAID1 work on the nslu2 for big drives? Yes! I've got two 750 GB SATA drives hooked in, and it's humming along. I had to upgrade to SlugOS5 in order to be able to boot to the md device. Be ready for long RAID sync times though... it's taking about 21 hours to sync a 650 GB partition :)

Authenticating Wordpress with multiple domains in Active Directory

2009-03-29T20:02:00.004-06:00

Recently I've been working on a project involving authenticating Wordpress to Active Directory. There's a great plugin on wordpress.org for doing AD authentication, but I needed it to do a bit more than the author intended. The main thing I needed was support for authenticating users from many different domains.

In the original plugin, there is a single, universal "account suffix", stored in the Wordpress settings database. I'm guessing the intent here is to have a user simply enter their username, like "kdreyer", and have the suffix automatically appended to it ("kdreyer" + "@example.com"). Since we're using multiple domains, this won't work. I could have a "kdreyer@example.com", or a "jsmith@xyz.com", and I need to authenticate both.

So here is my hacked version of the Active Directory Authentication plugin. It pulls out the domain from the user's account using split('@', $username), and uses the user-supplied suffix instead of the universal suffix. This means I can get rid of the global Account Suffix and Default Email Domain settings altogether.

There are one or two other modifications here as well. I'm using SSL in my adLDAP instantiation... and so should you ;-) I've also added a bit to update the user's display_name to be "John Smith", instead of jsmith@xyz.com... the info's already there in AD, so, why not help our user out and put it in there for him :-)

I'm using Wordpress 1.7.1, and the patch is against Active Directory Authentication plugin 1.0.5.

Laura's website

2008-12-30T20:38:00.004-07:00

Just finished 1.0 of my sister Laura's website, www.laura-dreyer.com. Laura designed the whole thing in Inkscape, I carved it up with GIMP, put it into a custom Wordpress theme, and put the finishing touches with jQuery. It was really fun and I learned a lot along the way. Laura's a great designer (and sister :)

Going to pick Audrey up in a few hours from the airport... our final un-married New Year's :)

"trick" interviews

2008-12-10T19:21:00.007-07:00

Apparently giving "trick" interviews is as popular as it is unprofessional.

Ethically, is there a difference between what Michael Moore does to Charlton Heston in Bowling for Columbine and what certain creationists have done to Richard Dawkins?

Fedora 9 impressions

2008-06-09T19:51:00.003-06:00

I've been running Fedora 9 for a while now. Although some things in F8 felt half-baked to me (I had trouble with PulseAudio + Audacious), F9, like each Fedora release, feels more polished.

Improvements:

Yum is much faster - not as fast as apt, but getting there.
PackageKit is much more polished than the package manager GUI F8 used (Pirut and Pup).
Swfdec works pretty well!

Gripes:

Firefox 3 occasionally crashes, and many plugin authors haven't updated their plugins to version 3.
Gkrellm: I haven't seen an error window like this in a while :)

summer internship

2008-06-07T09:24:00.007-06:00

I'm interning this summer at Community Bible Church, at Pocono Lake, Pennsylvania. I drove up to the area on May 24, met the pastor that night, and met the church congregation on Sunday the 25th. They are a nice bunch of folks! I was so surprised to see the sign outside the church welcoming me.

So far I've been able to teach Sunday School on Sunday mornings, lead Bible study on Wednesday nights, and redesign the church website: poconolakechurch.org. Tomorrow I preach my first sermon there on the book of Esther.

My fiancée, Audrey, is on a plane to the Philippines for her internship this summer, where she'll be working with the missionaries there and discipling women in the church group.

first mac experience

2008-05-14T00:52:00.004-06:00

A friend gave me an old G3 to play around with today. It's my first Mac experience... and I promptly managed to hose Safari by installing the latest version from apple.com. Apparently OS X 10.3 doesn't support the newer versions of Safari or WebKit. After struggling around trying to downgrade back to Safari 1.3, I finally found good instructions for what I needed. Apparently I have to go back to Safari 1.2, then to 1.3 :) Also, Pacifist was necessary; simply installing 1.2 the regular way doesn't work.

big news

2008-05-12T11:26:00.000-06:00

I'm engaged :)

hacking the WGR614v7

2008-01-13T16:42:00.002-07:00

Netgear often builds a telnet daemon into their routers, but sometimes it can be a little tricky getting in. I was curious to see if my WGR614v7 has any way to access a command line interface, so I fired up nmap:

$ nmap 192.168.1.12

Starting Nmap 4.20 ( http://insecure.org ) at 2008-01-13 17:42 CST
Interesting ports on 192.168.1.12:
Not shown: 1694 closed ports
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
8080/tcp open http-proxy

Nmap finished: 1 IP address (1 host up) scanned in 1.355 seconds

All right! Let's try to log in...

$ telnet 192.168.1.12
Trying 192.168.1.12...
Connected to 192.168.1.12.
Escape character is '^]'.
Connection closed by foreign host.

Rats. For some reason we are kicked out as soon as we touch the daemon. A little hunting on the internet provides an explanation. Apparently the telnet daemon is disabled by default, but the Netgear staff have a Windows utility that will send a packet to the router in order to enable the telnet interface. A hacker has somehow reverse-engineered the encryption process and written it into a C program.

$ gcc -o telnetenable md5.c blowfish.c telnetenable.c

Now I use the program to construct the "unlock" packet with the IP and MAC address of my router, and the default username/password "Gearguy/Geardog":

$ ./telnetenable 192.168.1.12 00AABBCCDDEE Gearguy Geardog > modpkt.pkt

Then I send it to the router with netcat:

$ nc 192.168.1.12 23 < modpkt.pkt

Now I try to log in again...

$ telnet 192.168.1.12
Trying 192.168.1.12...
Connected to 192.168.1.12.
Escape character is '^]'.
Login: Gearguy
Password: *******
U12H06400>

And we're in! "?" gives a list of commands. I'm most interested getting the network statistics from this and putting the results into cacti... but I'll save that for another time! :)

--Edit--

Apparently seattlewireless.net, the original website that hosted the files and information, is down. I've put the C files up for grabs here:

http://ktdreyer.googlepages.com/telnetenable.c
http://ktdreyer.googlepages.com/md5.h
http://ktdreyer.googlepages.com/md5.c
http://ktdreyer.googlepages.com/blowfish.h
http://ktdreyer.googlepages.com/blowfish.c

Good luck!

Junior Year

2007-09-02T11:38:00.000-06:00

I'm back in Chicago for the semester. For classes, I've got Systematic Theology I, Communication of Biblical Truth (a preaching class), Greek Exegesis I, Interpersonal Communication, and Ministry and Staff Relationships. My PCM this year is at a nursing home where I'll be leading a Bible Study. It's awesome to be back on Dryer 2 and really great to start another year at Moody.

On the work side of things, I've quit using, or trying to use Cisco's VPN client on Linux. It was not very well maintained to begin with, and I couldn't even get it to compile against the kernel in Fedora 7. Now I'm using an opensource program for Cisco VPNs now called vpnc, and I really like it. It's 100% open, doesn't require a kernel module, runs as a daemon instead of an active program, and certainly feels faster. I had a great summer doing full time work and look forward to continuing part time for the rest of the year.

Speaking of Linux, my laptop has a Intel 3945ABG wireless card inside it, and Fedora 7 shipped with the new iwl3945 driver for this card. It is my understanding that the license is more open than the usual ipw3945 driver, and though the iwl3945 driver was new and kind of buggy, the Fedora devs had to decide to either bundle this one or none at all. I wasn't able to get the original iwl3945 driver on the CD to work, but when I updated to 2.6.22.4-65.fc7 I tried it again and it seems work well with both open and WPA networks.

Last Friday was the first "Programming Tonight" session I've attended (they started when I was in VA). It was a neat place, I had a good time, and learned something new about OpenLDAP - I didn't realize the registration dates were stored for each user! Pretty useful.

Done with school forever

2007-05-10T13:48:00.000-06:00

Just took my last exam this morning. I'm so relieved to be done; this week has been rather hectic. I'm sticking around Illinois for a week to go to a friend's wedding, then I'll be heading back to Virginia for the summer.

A few weeks ago my new Netgear router started acting up. I did a cold factory reset (holding the pin in the back while powering it on) but when it booted up all the lights stayed solid green. The device was inaccessible, and subsequent resets and reboots yielded no change. Thankfully the thing was still under warranty, so I sent it back to Netgear and just received the replacement in the mail this week. I had purchased a WGR614v6 International Version from newegg.com, but Netgear sent me back a brand new WGR614v7 North America Version! This version seems to have fixed the authentication bug I noticed in the v6. I also got to keep the old ethernet cable :) So even though I had to pay a few dollars to ship the old one out, I'm still satisfied with Netgear's quick response and their better-than-the-original replacement device. I'm using it now as I type this with no problems :)

Lastly, we've finally rolled out our LDAP creation tool on chicagolug.org. Sign up, or update your account info. This means our wiki is open to all who register!

ktdreyer.com

2007-04-20T16:14:00.000-06:00

I just registered ktdreyer.com with nearlyfreespeech.net. FreeBSD, SSH access, CGI, PHP, MySQL, unlimited subdomains... and you only pay for the bandwidth you use. Awesome. I'll probably use them for Laura's upcoming site as well. I'm still going to keep my email ktdreyer#gmail.com, although email forwarding with nearlyfreespeech.net is only $0.02 a day.

New wireless device

2007-04-18T23:32:00.000-06:00

I just got a Netgear WGR614 from NewEgg for $36.42 (including shipping). It's going to replace my aging Linksys BEFSW11S4, which I'll give to my sister to use at home. I haven't got a chance to test out the wireless capabilities of the Netgear since I don't have my new laptop yet, but the firmware options available on the WGR614 are much more advanced than the Linksys hardware I've used (the BEFSR41 and BEFSW11S4... but that's understandable since those devices are several years old :)

The only issue I have with WGR614's configuration is that they try to oversimplify things with their "Smart Setup Wizard". For example, if you go to the default page at http://192.168.1.1/, the WGR614 will automatically redirect your browser to http://www.routerlogin.com/welcome.htm, which is a 404 error. To get around this redirection, I took a look at the source of the redirect page on the firmware itself and noticed it had a string in a line of Javascript, "start.htm". I tried http://192.168.1.1/start.htm and it brought up the configuration page without the hassle of the "Setup Wizard". All is well... though it appears that this method bypasses whatever authentication method the WGR614 is supposed to have. Oh well. At least it tracks my IP so that only one IP can be "logged in" to the manager web app simultaneously. It's sufficient for my needs here, and maybe I haven't found the right setting in the config, but I think this is pretty insecure if it works this way out of the box.

In other news, I just found out that Dryer 2 Skip Day is going to be the same day that Mom and Grace are coming to visit! Another reason I can't wait till Thursday :)

New laptop on the way

2007-04-02T21:02:00.000-06:00

Just ordered a new computer from Dell... the Inspiron E1405. It's got an Intel Core 2 Duo T7200 (2.00GHz, 4MB L2 Cache, 667 MHz FSB), 14.1 inch Screen, 1GB DDR2 SDRAM at 533MHz, 80GB Sata Hard Drive, CD/DVD Burner, Intel PRO/Wireless 3945a/g wireless, 9-cell Battery, and most importantly... the 4 year warrenty :) Total was $1,587, and with a $450 off coupon, it was down to $1,193.85 (tax included). Incidentally, tax was about $25 more if I shipped to Chicago than to ship home, so my mom's going to bring it up when she comes in a few weeks. I'll need to think of a hostname for it in the meantime :)

chicagolug.org progress

2007-03-30T23:14:00.000-06:00

The work to rebuild chicagolug.org is moving along, slowly but surely. Last night I added the scuro theme to the ChiGLUG Planet. There's still some bugs to work out (the image borders need to match our background, and where is a good place to stick that RSS feed sidebar!?) but it's cool to see it in action. Special thanks to the Planet Gnome devs for the inspiration :) Of course the major project still to do is the LDAP account creation tool, which feels daunting but will be awesome when it's completed. The wiki authentication is already tied into our LDAP server, so when it's done the account creation tool will really open that up.

Back from Spring Break

2007-03-26T22:29:00.000-06:00

Audrey and I got back to school yesterday afternoon and found it to be a nice 72 degrees downtown. We walked around for a while, looked all around a mall, and ended up in a Waldenbooks store where I found an interesting book Death by Black Hole: And Other Cosmic Quandaries by Neil deGrasse Tyson. I read the first few chapters and would love to finish it up one of these days. The author does a good job of taking complicated scientific concepts and writes in a way that is interesting to the average person. I couldn't help but note the author's cheap shots at "foolish" things like intelligent design. The merits of I.D. aside, at the very least the cheap shots were a strike against the perception of purely scientific, rationalistic neutrality. Think not I am what I appear, eh? ;)

new chicagolug.org server

2007-03-02T16:54:00.000-07:00

We've got a new chicagolug.org server! Thanks Tristan for donating this one until the main machine arrives. It's hostname? "rebirth" :)

Message to Laodicea

2007-02-20T14:33:00.000-07:00

I read an interesting example in my Hermaneutics textbook this afternoon. In Revelation 3:14-22, John records a message to the church at Laodicea. He writes:

¹⁴"To the angel of the church in Laodicea write: The Amen, the faithful and true Witness, the Beginning of the creation of God, says this:
¹⁵'I know your deeds, that you are neither cold nor hot; I wish that you were cold or hot.
¹⁶'So because you are lukewarm, and neither hot nor cold, I will spit you out of My mouth.

This Laodicean church is useless; it is not like hot water (for taking a bath) or like cold water (for a refreshing drink). We must interpret the "hot" and "cold" water in light of the archaeological background. Laodicea was located close to the hot springs by Hierapolis and a cold stream by Colossae. Both hot water and cold water are desirable and useful. But the spiritual condition of Laodicea is neither. It is tepid and lukewarm. We have to guard against quick misinterpretations: Jesus is not saying that active opposition to him is better than being a lukewarm Christian.

Culby vs Dryer

2007-02-16T08:23:00.000-07:00

Thursday night a rumor floated around that a bunch of Culby guys were going to storm our floor with snow. A lot of Dryer 2 guys prepared to counter the attack by filling up tons of trash cans with water. After several false alarms, a number of Culby guys did rush up to the building. They stayed outside and threw snowballs at the lounge windows. Eventually people from all three Dryer floors went outside for a snowfight. Both sides had trashcans for heaving snow and several people got a lot of water and snow in the face!

This morning right after chapel started in Torrey-Gray Auditorium, some Dryer 3 guys hiding in the choir loft quickly pulled back a curtain to reveal a banner they had made. It had the names of all three Dryer floors and read:

"The next day, when Dryer searched the battlefield, they found Culby dead on Dryer Lawn. They cut off Culby's head and stripped off his armor. Then they spread the good news all through MBI country and among the Moodies. They displayed his armor in the shrine of Torrey. They nailed his corpse to the wall of Gray. 1 Samuel 31:8, Dryer Abridged Version"

Whoever made the banner had also collected a bunch of clothes which the Culby guys had dropped during the fight, and fashioned them into a headless dummy which hung from a rope next to the banner in front of the whole school during the whole of chapel!

What Happens After You Die

2007-02-10T22:29:00.000-07:00

I preach at a retirement home for my PCM, and when I get back from Spring Break, I'm going to be preaching a series on "What Happens After You Die." I'm pretty excited about it. I'm planning to read over Spurgeon's sermons on the subject, and if you can think of any other good sources good information, please reply :)

Back in business

2007-02-06T23:13:00.000-07:00

Audrey and I had a great time last Saturday. We went out to the Grand Lux Cafe on Michigan Avenue for dinner. It was nice to sit and talk with her. This week we are busy walking back and forth to Moody Church for MBI's Founder's Week. The weather is bitterly cold and we got about 4 inches of snow today. In these single-digit temperatures, I'm very thankful for the new scarf mom sent in the mail.

I finally got Cisco's Linux VPN client to connect and route the traffic appropriately. The firewall admin here at Moody had to open TCP port 3322 (and fix some kind of routing/subnet issue). Also, I got an 80GB IDE hard drive from a friend to put into ethne, and I'm backing up my home folder from kappa onto it. The ethernet jack has been flaky, but hopefully that wireless firmware holds out long enough to transfer everything over. I'm just excited to have everything more or less back in order. I'm thankful to God that I had another computer to use when kappa died!

ethne with FC6

2007-02-02T21:09:00.000-07:00

I've wiped ethne and installed Fedora Core 6 and Xfce 4.4. After a long hassle, I'm basically back to where I was with kappa, desktop environment-wise. Setting up my HP 1020 wasn't hard with foo2zjs drivers. The biggest challenge was the Cisco VPN client.

After installing kernel-devel, I downloaded vpnclient-linux-4.8.00.0490-k9.tar.gz and ran the vpn_install bash script. The script complained about some problems with the kernel source. After hunting around online I found a blog describing the necessary fixes to make the client compile with Fedora Core 6. After the client compiled and installed correctly, I started the service. The script in /etc/init.d complained that the kernel module wasn't valid. After more hunting around I read on FedoraForum.org that this was a result of the infamous FC6 kernel bug (FC6's anaconda installs the kernel for i586 when it should install i686). Once I replaced the kernel with the correct architecture I was good to go. I set up the profile to get into the VPN server in Reston, and... "Connection timed out". At that moment I remember noticing that Moody's network had gone down and all the dhcp leases were wiped out. This means ethne now has a new IP address, but Moody's firewall rule is presumably still using the old one. I rushed over to Crowell to see if someone in IS could change it, but the main engineers had already left for the weekend. What a bummer. But God is good to me. And hopefully this will be resolved soon so I can get back to work! :)

Oh, and it's Audrey's birthday today. We're going out to celebrate Saturday night :)

ethne with X

2007-01-26T08:04:00.000-07:00

Well, I cannot determine the problem with kappa, though I don't think it is just static electricity. It's getting harder and harder to get it to boot, so I'm going to put it away for now and try to get working later. I went ahead and installed X on ethne, though I'm really feeling the drop from Fedora Core 6 to CentOS 4.4. CentOS is wonderful for servers, but I'm going to need a number of things that aren't available for RHEL yet. I'm using Xfce 4.2 (yikes!) because RHEL is still at GTK+ 2.4.x... OpenOffice is still at version 1... etc. So things are kind of old here. I'm probably going to try to install FC6 later next week to get things up to speed, though I'll need to borrow a CD burner from someone...

In the meantime, I need to write my sermon for Sunday :)

Laptop troubles

2007-01-24T23:21:00.000-07:00

Today after I finished about five hours of work, kappa (my laptop) froze. Thankfully my work was screen'd away on ethne (my server here at Moody) so I wasn't too concerned about losing all that work - I could just reboot and reattach the screen session. Rebooting... that turned out to be a bigger issue than I planned.

Kappa has had some trouble recently coming out of hibernation - the light would come on but nothing would appear on the screen and I'd have to hard shut-down. I thought it was just a Windows problem, but it is a warning sign of deeper problems under the hood. Tonight, kappa was freezing up continually in Windows and I was having trouble even booting the machine. It looked like a bad RAM problem, as I couldn't even get the BIOS to show up, but I tried switching out both DIMMs (I have two 512s) and no noticeable results. Thankfully the problem is still intermittent and I was finally able to boot to Fedora.

One of the reasons I prefer Linux is that it actually tells you what's going on in your computer. When the freezes happened in Windows, there was no error message at all to give me a clue. When I first booted Fedora, there was an error about my ipw2200 firmware and then an error "psmouse.c: bad data from KBC - timeout bad parity". That must be it. On every subsequent keypress, the this psmouse.c error would appear on the commandline.

To Google we must go. About 300 hits for this error message, and one of the most informative is on the Linux kernel bugzilla. Several people have had this message and were probably referred here. They have common symptoms - laptops with intermittent freezes in both Windows and Linux. A few people debate whether it is a hardware or software problem, but I'm sure the intermittent nature of the problem and the fact that it exists in both Windows and Linux points to a hardware issue. One post in the bug report caught my attention: the idea that it is the result of an ESD - Electrostatic Discharge. Maybe this is it! I have definitely felt more static around me recently. That, combined with the particular clothes I'm normally wearing here in Chicago (my new coat, my scarf) may have contributed to the problem.

I'll let you know how things turn out. In the meantime I'm going to make sure to back up my school folders to ethne. If Kappa dies completely I can always install X on ethne and use it as a desktop in a pinch. "There are levels of survival we are prepared to accept."

Brilliance Bordering on Irrationality

2007-01-23T20:46:00.000-07:00

I don't really get Dr. McDuffee, though one thing is certain: he is unlike any teacher I have ever had. I don't think all the things I'd heard about him could have prepared me for his class, either. Though he and Dr. Litfin teach two halves of the same course, Christianity and Western Culture, they could not be more opposite in their teaching styles. Dr. Litfin could occasionally wax poetical at times, but overall his teaching style was straightforward, fact-oriented, linear, and concrete. Dr. McDuffee, on the other hand, thrives on rhetoric. Everything is interconnected with everything. I'm still trying to get a handle on how to learn from him, and his class has made me realize what a linear thinker I am. Dr. Litfin was easy for me to follow; Dr. McDuffee is not. However, I've met other people in the class who tell me that their experience is the opposite; Litfin was hard, and McDuffee makes more sense to them.

I've been thinking about this a lot, particularly since the class is still new to me. I think I'm finally beginning to understand that Dr. McDuffee's primary objective in class is not to transfer the course material into our brains; rather, it is to get us to think. This is his goal. CWC is merely a context. I suppose all of Moody is merely a context. Maybe I can learn more from him than I originally thought.

Another issue that this has brought to my mind is the issue of learning styles. If I am a linear thinker, I may have the propensity to leave the part of my audience behind - the part that more readily understands Dr. McDuffee's lectures than Dr. Litfins. I can't be all things to all people, but it did get me thinking: who do I isolate when I say such and such?

When I'm out of Moody, which of these teachers will I remember?

Kappa

2007-01-23T13:52:00.000-07:00

Xfce 4.4.0 final was released Sunday. I installed it on kappa (my laptop) yesterday and it went smoothly. I've been following the development of this project with some interest over the past year, so I've been testing out each development release and I've learned a lot about managing a project. I like Xfce's minimalist philosophy and the "snappiness" feeling of the environment. Thunar is a neat file manager that has plenty of convenient options like mouse gestures. Windows explorer even feels slower than Thunar. Speaking of which...

Over the past few months, my Windows XP Home install on kappa has been getting slower and slower lately. Boot time is getting longer and longer, and loading apps takes much more time. I have no idea what the problem is, as my Fedora Core 6 install has not slowed down at all. I'm planning on wiping the whole drive and reinstalling both OSes, but that will have to wait till I'm home again. Maybe Fedora Core 7 will be out by then :)

ChicagoLUG.org single sign-on

2007-01-23T13:46:00.001-07:00

For a while we've talked about implementing a single sign-on for the services on chicagolug.org. Here are some notes I jotted down about how to do this.

Services:

Mediawiki
phpBB
mailinglist?

Interface:
The user logs in to a customized form. Upon proper authentication with the LDAP database, the web application sets the login cookie(s?) for the various services. Clicking "Logout" on any one of the services logs the user out of all services.

Possible complications:

Mediawiki uses user id numbers as well as usernames. phpBB may do this as well.
phpBB (or others) may also need to set session ids in a database - potentially a problem if this expires based on user activity - can we remove this?
Mediawiki's database structure for user profile options is a minor headache
Where does the mailinglist store user information?

Possible implementations:

Create an application to set the proper cookies for each service (more complicated; not a very elegant solution)
Hack the existing services to handle a single "logged on" cookie. (more elegant, but potentially less secure. If there is a security flaw in our implementation this might render other services vulnerable. Also if there is any future upstream security vulnerabilities in one service it might affect other services.)
Note: Either of these will require carefully analyzing the implementations of the authentication mechanisms for each service. If we need to upgrade a service, we will have to carefully track what changes are made so that they can be "patched" into future versions. (Example: Let's say that we install version X of Mediawiki. If version X is later found to have a cross-site scripting vulnerability, we will need to upgrade to version Y, but we also need to make sure our customizations fit into version Y.)

Questions:
To what degree should the individual services' profile databases be merged into the LDAP database? One of the cool parts of this will be the ability to sync email address changes, etc. but is this going to be viable with every service, everywhere? Will we need to create a "single profile editor" in addition to the single-sign on? It'd be cool, just more work :) Basically we need to decide whether the LDAP will handle authentication only (just username/password) or an email address, or even other profile information.

Things to store in LDAP

Username
Password

Possible things to store in LDAP:

Email (confirmed?)
Group membership for each service (Admin, Moderator, etc.)
phpBB variables (id number?, signature, avatar, website, etc)
mediawiki variables (watchlist, etc.)
mailinglist variables (subscriptions, active/inactive, digest, etc.)

I don't have much experience with LDAP; in fact I've only briefly played around with PHP's LDAP functions. I guess I'll learn more if this project ever gets off the ground :)

Introduction

2007-01-23T13:28:00.001-07:00

My name is Ken Dreyer, and currently I'm a sophomore at Moody Bible Institute in Chicago, IL. I live in Northern Virginia and intern for a US Government agency. I plan to use this blog to post what's going on in my life, etc. Hope you enjoy reading :)