One thing that I’ve been unable to get working so far was the native OS application. The application allows you to map a drive directly to the drives connected to the appliance, hence the last article about installing a samba server on it. This issue probably won’t apply to most folks, my home network is a little unique compared to the average person buying a commercial router from Linksys, Belkin or the like. Skip to the bottom for the commands if you’re not interested in my reasons for splitting the networks.

So, I have two completely separate networks at the house. One is wired, and the other is wireless, they interconnect through some various switches but ultimately demarc on an IPCop firewall. The wired network is where my home servers and toys connect (SlingBox, ssh server, pogoplug) whereas the wireless is mostly computers or smartdevices.

With this setup, I don’t have any want or need to proxy traffic from the wired network as they’re essentially all services. From the wireless where we actually surf however, I like to run URLFiler and Advanced Proxy on the IPCop box to get filter out ad servers and malicious and adult websites. The problem with doing this is that the clients need an UNFILTERED direct connection to both the PogoPlug device and the main PogoPlug server out in internet land. Until today I mostly used the samba share to get around this, but it started bothering me and after some poking around I came up with a very easy solution.

You may be asking, why not just add an exception in squid? Well, it doesn’t seem to work through the IPCop interface. And modifying the actual config files would do the job, but the next time IPCop restarts or I add something in the web interface, it would wipe out the manual changes I made. So, lets fall back to good old iptables and prerouting!

By adding these two rules, we save a whole lot of headaches, and the software works perfectly:

The first line allows an unfiltered connection to sercvice.pogoplug.com which is the authentication server, the second line allows an unfiltered connection to the pogoplug device itself. Like I said, this probably won’t really impact too many people, since my traffic leaves the BLUE network and hits the GREEN network it gets filtered, and in this application that’s a bad thing.

Hope this helps someone else who’s been banging their head on the wall like I was.

Installation was pretty much straightforward, the instructions on their website were sufficient to get the server up and running. There was some confusion, however, getting some plugins to play nicely. So, to pick up where the official installation instructions left off, I’ll go over some of the issues and solutions I was able to come up with.

What you’ll need to know from the installation

• The location of the munin logfiles. You can set this in the munin.conf file. I used /var/log, seemed like the obvious choice. Your preferences may vary.
• The location of your munin config files, and plugins.
  • Config files are typically placed in /etc/opt/munin/
  • Plugin files are typically in /etc/opt/munin/plugins
  • Plugin special configs are typically in /etc/opt/munin/plugin-conf.d
• If you installed from source, you should have all that information in the installation scrollback. If you installed from an RPM, first try the paths above; if they’re not there then time to run the ‘ol trusty updatedb and do a locate.

Ok, so now that we have all that stuff taken care of, it’s time to dive right in. By default, there are no plugins enabled. In order to enable them we need to put them in the /etc/opt/munin/plugins directory. If you’d like some help determining what plugins to use, run the munin-node-configure script that came with the installation:

This gives you a general idea of what plugins are compatible with your server, and why others may not run. It’s a great tool to begin with. If you enable *all* the plugins munin comes with you’re going to be left with a lot of empty graphs and log messages complaining about errors. Instead, let munin do some work for you, it can move the ‘suggested’ plugins into the correct place and enable them for you by running this command:

Once that’s been done, look over the list of plugins that it didn’t suggest to see if there any additional ones you’d like to include. Usually the reason for excluding them is because a prerequisite wasn’t met, which most can be corrected.

The crontab

There’s a script that needs to run every five minutes to collect data from the node, /usr/bin/munin-cron This job must not be run as the root user, it should be in the munin users’ crontab. You can either su over to munin’s account or as root edit the users crontab with crontab -u munin -e. To have this job run every five minutes, simply insert this line:

The last part of that line keeps the cron daemon from sending the munin user an email each time the job runs, which will eventually fill his mailspool and use unnecessary disk space.

Now you’re ready to start up the munin-node. There’s a couple of ways to do it, the easiest is just to use the service command:

Once that’s running, go ahead and (as munin) kick off the /usr/bin/munin-cron from the command line. This should begin the data collection process and log any errors (and there will probably be some) to the update log, in my case that’s located in /var/log/munin-update.log.

In addition to the error logs, you can run each munin plugin individually with the munin-run command-line tool, which provides some details on why something may have failed. Can be run:

The plugins that gave me the most trouble were Apache (thanks to some necessary mod_rewrite stuff on this site), sendmail_mailstats and mysql_. I’ll go over the problems with each of those below.

apache_ plugins

This really should be the easiest plugin to enable, all you need to do is enable server-status in the configuration file, httpd-info.conf ( I use Apache2):

I had diis.net listening on it’s IP address and localhost and mod_rewrite was sending everything to /front (where this blog lives) so that really messed with the server-status URL. A simple change in the httpd.conf file fixed that right up.

sendmail_mailstats

This was a permissions issue. The user munin could run the mailstats program, but the /var/log/mail/statistics file it reads was owned by root. So the simple solution was to chown the file to root:munin, which made it start collecting data right away. I don’t really see any harm in making that change, albeit I’m not a big fan of changing default system permissions.

mysql_

Ok, for this plugin to work you need to create a new unprivileged MySQL user account. You also need to put some special directives in the config file /etc/opt/munin/plugin-conf.d/munin-node so munin knows how to use the mysqladmin program to get the stats:

This should have worked fine, but I believe there’s a limitation of what types of character you can have in the password since you’re passing the command from a config file into a variable and then as an exec to the shell. My password had some special characters in it, once it was simplified to numbers and letters the queries worked fine. There shouldn’t be any risk in a simple password for an unprivileged account. Especially if your server has a limited number of users that have shell access and you have MySQL’s port firewalled off from the internet. Note: That’s one dash in front of the ‘u’ variable and two in front of the ‘password’ variable.

And that’s pretty much it for now, I hope this helps someone stop pulling out their hair out. Got a tip or trick related to munin? Drop it in the comments below.

First, you need to install the OpenPogo base package. Very detailed and effective directions are available here.  A couple of notes about OpenPogo before you go running off though. First, it requires an external USB drive to install on, and run from. Second, if you remove the USB drive (perhaps mistakenly thinking you were done with it) the filesystem that was on there is dismounted and everything running from it stops. And finally, the USB stick will have to be reformatted into a linux ext2 or ext3 format which means you’ll lose any existing data on it. Best to find an older 1GB stick and use that for this as the packages seem rather small.

Ok, so once you’ve installed the OpenPogo software onto your external USB drive, rebooted, mounted, etc, what you’ll need to do is run ipkg to install Samba. You should be able to execute this command to kick it off:

This kicks off the download and installation process which I imagine under ideal circumstances should take care of the whole thing for you. If it did, skip this section and see the configuration part below. I’ll warn you though, the downloads were very slow for me, took about twenty minutes to download the seven meg file even though I was able to wget it to my linux box much faster.

The problem I had was an invalid MD5 checksum when using the automatic installer, so I resorted to manually downloading the file, then installing it.

Once the install has completed successfully, you should turn on the server by running this command:

After which you can verify that the server is running by checking the output of netstat

Now to verify that samba is working properly, execute this smbclient command:

The output is a bit more verbose if you have shares active, and other active workgroups, so I snipped them out of this example. Now we need users! Execute these commands to create a user account on the system:

Now run these commands to setup a samba user:

Now comes the part of defining the drive mappings. There are a couple of ways to map things out, you can separate each physical disk into a share, or share all disks under one. Just depends on what your requirements are.

For the first method, separating each disk into it’s own share, this is what you need to know:

By default, the external USB drives are mounted in /tmp/.cemnt/sdX1 where X is usually ‘a’ for the first disk, ‘b’ for the second disk, etc. You can look to see how yours are mounted by running the df command:

As you can see above, we have four external USB drives mounted. /dev/sdd1 is the external USB thumb drive that OpenPogo is installed on, and mounted to the /opt directory. sda1, sdb1 and sdc1 are all external USB drives with user data on them. Make a note of which disk is which, you should be able to tell by the disk size, or at least content.

Next we need to modify the samba configuration file. It should be located in /opt/etc/samba/smb.conf. Using a text editor such as vi or nano, edit this file and add the following text — this part is the global configuration:

NOTE: If you’re connecting to these shares from a Windows machine, you may need to set encrypt passwords = no in the above example. I’ve seen mixed results for that.

Now, if you chose to define each drive as it’s own share, you could add something like this to the config file. The text within the [] brackets is the name of the share:

The path - /tmp/.cemnt/mnt_sda1/ is the path to the first external drive. Keep in mind that this configuration has NO SECURITY other than that of your local area network. If you need per user security you will need to modify these directives.

Now, your other option is to share out ALL external disks under on mapping. To do this, use this configuration:

Keep in mind that this configuration has NO SECURITY other than that of your local area network. If you need per user security you will need to modify these directives.

Anytime that the samba configuration file has been modified, you must restart the service for the changes to take effect. Do that with a restart command:

Now that you’ve completed the configuration and restarted the service you should be able to connect to your pogoplug device directly, upload, download, delete and modify files. I must stress again that this is a very OPEN configuration for samba. If you require additional security for the shares (like on a corporate network) then you should really know more about samba configuration. If anyone wants to post some examples of securing the directories/disks using the accounts created in the beginning please do — I’m no samba expert.

Happy Networking!

Pogoplug is an appliance that you can connect to your home network which runs a custom version of linux. The device has a gigabit ethernet port, three USB 2.0 ports on the back and one on the front. Basically, you plug your external USB hard-drives into this thing and it makes your files available to you no matter where you roam.

Best part (for home users) is that there are no firewall rules that need to be put on your home router or custom firewall. The device heartbeats out to their servers in the cloud and make the whole thing possible without a lick of configuration being required. Caveat: UDP has to be unfiltered outbound for this to work, so “real” firewalls may have to have allow statements put in them.

So, with your purchase of the hardware, you get lifetime support and access to your personal “storage in the cloud”. This can be accomplished remotely (or locally) via the web client or samba/windows shares. You also have the option to share files and folders with the world, individual users, etc. There’s even a client that runs on the Mac, PC and iPhone to access files directly and see them as locally mounted drives. If you happen to be on the same network your connections go directly to the device and not through the Pogoplug servers.

From my iPhone, I’ve been able to stream movies over WiFI and 3G with great quality. The Pogoplug device will convert audio and video files on the fly to allow streaming to the iPhone/iPod/iPad/PC/Mac, etc. Sweet little deal, if you happen to have a bunch of movies or music on your external drive(s).

Through the use of OpenPogo you can even install custom software on the appliance like samba, squid, bittorrent, a webserver, etc! Since this little guy runs on linux, the possibilities are endless really.

Been using this for a couple of weeks now, and I’m really impressed. The company announced just a few days ago that a new firmware update would allow for printing through the device, and is being rolled out now to customers. This thing is becoming very versatile!

More later.

The application allows you to obviously browse your instant queue, watch whatever you like and resume where you left off should you change directions on them. One thing I was surprised to see when I first logged into the application was that I was using all six of my licenses. Very much akin to the iTunes “authorized computers” schema. I was directed to their website where I had the option to kill devices, some of which I had not streamed on in quite some time. The message on that screen said that devices can be added and removed pretty much at will, so no big deal there.

So, back to the app. The video quality is very good, comparable to a downloaded movie from the store (or one you ripped). WiFI was very fast obviously, but 3G wasn’t really too far behind it, took a few moments to load and buffer, but solid after that.

I’m really glad I stuck with my grandfathered unlimited data plan with AT&T, I could see how getting an application like this approved would benefit them greatly financially as users on a limited data plan burn through their megabytes and gigabytes without a second thought. Careful out there, oh limited bandwidth users. Everyone else, burn it up! Cheers.

So after mucking around with the graphical interface and figuring a few things out (which really isn’t difficult to do) I came up with a little routine that checks latency to the inside interface on my firewall. It’s really nothing special but I kind of like seeing it up there.

You can paste this into the command window in Geek Tool or put it in a file and call it as a shell script. Here’s the code (replace YOURIP with your real IP address obviously). You may need to modify the script slightly if your ping output isn’t the same as what I’m using.

I set the refresh rate for 60 seconds and have the status feedback image enabled, if the little green bubble turns red then it’s skipped a beat. I found a bunch of other really useful posts about scripting too, here’s a couple to get you started if you’re interested:

• http://www.macthemes.net/forum/viewtopic.php?id=16793954
• http://www.maclife.com/article/howtos/customize_your_desktop_geektool
• http://www.cattail.nu/mac/geektool/
• http://blogof.francescomugnai.com/2009/04/mega-roundup-of-geektool-scripts-inspiration-gallery/
• http://appmagezine.com/?p=8025

Sure does look like it’d be a lot of fun to build, but not at the cost that board is going for. I’m sure one could find something similar at a cheaper price. Worth checking out though.

Right now I’m evaluating (and by evaluating I mean I paid for a month of access) VPN services by the folks over at HideMyAss. Now, for the record, I hate the name and think they should call their professional VPN services by another name, but I guess what really matters is how the service functions.

So, for about $12/month (less if you pay for a longer subscription) you get to choose from 28 different VPN endpoints in nine different countries. Pretty handy I suppose if you’re in the UK and wanted to watch video that is restricted by region to the US. Not what I need it for, but the functionality exists.

I’m a Mac user and installation was really easy, even though I’m running an older operating system (10.4.11). They  have a client you can use that autoconfigures, or you can use PPTP VPN tunneling built into the OS and be up and running in minutes.

So far, so good. Speeds are really good. I can’t really see any notable difference in my connection speed while connected or disconnected. I’ll continue to play with it for a while, but will still be looking around for more options.

So, what say you, got some experiences or reviews you’d like to share? Jump in and leave a comment..

The machine streaming the audio got in a funky state and started handing of some very choppy and unreliable audio and needed a swift kick, which it got. Things are back up and running now, hopefully for a while.

Update: The Hampton Police Division feed is no longer being provided to Radio Reference or being carried by this site. The City of Hampton had decided to take advantage of P25 encryption on all police talkgroups (no longer just tactical channels) which unfortunately can’t legally (or otherwise) be decoded.