SELinux in RHEL 5: More enhanced, more security

Security Enhanced Linux (SELinux), an open source project sponsored by the National Security Agency to help implement mandatory access controls (MAC), was first introduced in Red Hat's distribution with Red Hat Enterprise Linux 4 (RHEL 4). In our review of RHEL 4 and SELinux in 2005, we were excited about the possibilities and the GUI interface that came with SELinux, but we were cautious about the software package's ability to capture the market. Despite the user-friendly GUI, SELinux was difficult to configure and hard to understand. The documentation wasn't much help either. Most administrators were just turning off SELinux.

Red Hat clearly understood that some changes were necessary. They were either intimidated by its complexity or feared the possible damage that a poorly configured system could do to their applications. On RHEL 4, there was no easy way to determine why, if an application stopped working, whether or not the problem was due to SELinux.

Red Hat hopes to change this with several new features and enhancements in RHEL 5. New monitoring tools, multilevel security integration, policy modules and utilities will provide RHEL 5 users the added security of SELinux with less difficulty.

SELinux Troubleshooter 
One of these enhancements is the new SELinux Troubleshooter. Written in Python, setroubleshoot is a tool that watches the audit log files for access vector cache (AVC) messages and sends reports when things go bump in the night. The daemon continuously watches audit logs for errors and then translates them into laymen's terms for you. SELinux denials were one of the most common problems that administrators reported, which is why most decided to deactivate SELinux. Another daemon, setroubleshootd, receives connections which examine the data and alerts listeners. This tool maintains its own log file, under /var/log/setroubleshoot, and includes the use of the sealert command. This is a GUI desktop notification function, which contacts setroubleshootd, the local server daemon, and essentially registers itself as an alert listener.

To begin, start the browser: 
# sealtert –b 

This system is made up of three components, including the alert feature, setroublesoot and the audit subsystem. The audit subsystem reports the actual AVC messages. When the kernel sends a message that SELinux denies authorization for something, it creates this AVC message. Each message is tagged into a denial event, which setroubleshoot can assemble into complete events. The tool merges all these independent messages into single denial events. 

New domains, policy modules
The extent that SELinux monitors the operations of services in RHEL 5 has significantly increased since the last version. In RHEL 4, only 15 services had domains defined, while in RHEL 5 more than 200 target services are governed by the SELinux system. It is recommended that every program shipped by Red Hat and started on boot should have a domain defined. The benefit here is that it is much less likely for processes governed under SELinux running on RHEL5 to be compromised, increasing the comfort of security administrators. Another benefit is the introduction of policy modules, which make the process of modifying SELinux policies much easier. In RHEL 4, one had to go through many steps (downloading source, editing code, using make) to rebuild the policy tools. With policy modules, these setups are not necessary. The audit2allow utility gives you the ability now to generate policy modules (allow rules) directly from audit.log messages. One can also configure these polices using the system-config-selinux utility. This much improved GUI lets you modify the policy you need changed from a set of pre-defined parameters. Also, it is very easy to change system policies. You no longer need to edit configuration files, you only need to check or uncheck boxes. This is available out of the box and is fully integrated with RHEL5.

You can also use the semanage utility to configure elements of these polices without any recompilation of policy sources. The semodule command is another useful one. For example, this command lists out the policies: 

[root ((Content component not found.)) _29_137_21 selinux]# semodule -l amavis 1.1.0 ccs 1.0.0 clamav 1.1.0 dcc 1.1.0 evolution 1.1.0 iscsid 1.0.0 mozilla 1.1.0 mplayer 1.1.0 nagios 1.1.0 oddjob 1.0.1 pcscd 1.0.0 pyzor 1.1.0 razor 1.1.0 ricci 1.0.0 smartmon 1.1.0 

Multi-level security integration
Another important enhancement is the multi-level security (MLS) integration into RHEL5. This model allows RHEL5 to get EAL4+ LSLPP certifications, which means that RHEL5 is now considered a trusted OS and can be sold to Government agencies which require the tightest security polices. MLS allows users to label files with categories. To turn the system into a trusted system in RHEL 5, install the policy (using the selinux-policy-mls utility) and make changes to the selinux config files to reference MLS. Prior to MLS, there was Type enforcement (TE), which is the primary mechanism and role based access control (RBAC). I'm still not thrilled about the fact that Red Hat still does not have a special SELinux guide for RHEL5. If Red Hat is really going to make SELinux an important part of its distribution, it needs to provide strong documentation so users do not have to fumble through the web looking for pieces of information. While there have been major improvements and tighter integration between RHEL5 and SELinux, Red Hat still has a way to go before it is user friendly enough for most IT departments. Better documentation will help in their efforts. The small chapter in the RHEL deployment guide (Chapter 43, Security and SELinux) isn't enough. 

Deploying SELinux 
Let's look at the Z parameter. Many utilities such as ps, lsof and netstat are optimized for SELinux, using the Z parameter. 

[root ((Content component not found.)) _29_137_21 selinux]# ps -aeZ | more LABEL PID TTY TIME CMD system_u:system_r:init_t 1 ? 00:00:01 init system_u:system_r:kernel_t 2 ? 00:00:00 migration/0 system_u:system_r:kernel_t 3 ? 00:00:00 ksoftirqd/0 system_u:system_r:kernel_t 4 ? 00:00:00 watchdog/0 system_u:system_r:kernel_t 5 ? 00:00:00 migration/1 system_u:system_r:kernel_t 6 ? 00:00:00 ksoftirqd/1 

Where SELinux is not installed, this is what you will see: 

[root ((Content component not found.)) _29_137_21 selinux]# netstat -Z SELinux is not enabled on this machine. 

We can also run the sestatus and genforce commands for further information on the status of SELinux on our system. 

[root ((Content component not found.)) [root ((Content component not found.)) _29_137_21 selinux]# sestatus SELinux status: disabled [root ((Content component not found.)) _29_137_21 selinux]#72_29_137_21 selinux]# [root ((Content component not found.)) _29_137_21 selinux]# getenforce Disabled [root ((Content component not found.)) _29_137_21 selinux]# 

How can we turn on SELinux when it is disabled? The simplest way is to edit the selinux config file and change the SELINUX parameter, which can take three values: enforcing, permissive and disabled. In our case, we made it permissive. This is the option where alerts will be sent, though polices will not yet be strictly enforced. I recommend this as a good first step towards SELinux deployment. 

# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - SELinux is fully disabled. SELINUX=permissive # SELINUXTYPE= type of policy in use. Possible values are: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection. SELINUXTYPE=targeted 

After editing this file you must reboot your system in order for the change to take effect. Let's look at the status now, after the reboot. 

[root ((Content component not found.)) _29_137_21 ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 21 Policy from config file: targeted 

Perhaps the best new utility available is the system-config-selinux utility. Almost everything can be displayed or configured from here. If you are using X, make sure that you turn on x11 forwarding on your ssh client. 

************************************************************* [root ((Content component not found.)) _29_137_21 ~]# system-config-selinux /usr/share/system-config-selinux/system-config-selinux.py:68: Warning: IA__g_object_get_valist: object class `GnomeProgram' has no property named `default-icon' xml = gtk.glade.XML ("/usr/share/system-config-selinux/system-config-selinux.glade", domain=PROGNAME) 

SELinux and RHEL5 are a better marriage than SELinux and RHEL 4 ever were. The utilities are more focused, more user-friendly and more powerful. Setting up policies and administering the systems are easy and MLS, allowing this Linux distribution to be certified as a trusted system, is icing on the cake. Red Hat should publish more detailed documentation on SELinux and RHEL5: until that happens, I fear that administrators will continue to shun SELinux. 

About the author: Ken Milberg is a systems consultant with two decades of experience working with Unix and Linux systems.

Build your own iSCSI SAN appliances, save money

Not every IT organization has enough money to buy a storage area network (SAN) appliance. Yet most companies need a SAN, because – in my opinion – it's probably the best way to avoid losing critical data when server storage crashes occur. You don't need to pay for a proprietary SAN appliance, because you can build your own SAN using open source software. In this four-part tip you'll learn how to set up such an appliance setup.

Before starting to build your own SAN appliances, you should determine what exactly you need. Typically, a SAN consists of different components of which highly available storage is the core. If your SAN consists of just one box, you are playing with fire. If this box fails, your data will be unavailable, and that will cost you.

With proprietary systems, it takes two boxes to build a SAN, and it is the same when building an open source SAN . That is where the Distributed Replicated Block Device (DRBD), a distributed storage system for Linux distributions, comes in. Using DRBD, you can build your own RAID 1 across the network, so that if one of the servers providing storage goes down, the other will take over this role immediately. We will talk about DRBD more in part two of this tip.

In a highly redundant SAN , you'll need one, unique point of access. Some SAN setups work with Fibre Channel. Because this involves an expensive fiber optics-based infrastructure, this option is not the best imaginable for an affordable open source SAN. Instead of using Fibre Channel, we'll use iSCSI. An iSCSI target will be used to provide access to the storage device.

One of the challenges of building such a flexible SAN setup is to make it as versatile as possible. That means that a failing component has to switch over automatically. So if the SAN box that currently hosts DRBD as well as iSCSI access goes down, the other box in the SAN needs to take over automatically. To do this, we'll use Heartbeat -- a portable, high-availability cluster management program -- to monitor and ensure availability of all critical resources in the SAN.

We will discuss Heartbeat in part three of this tip, and iSCSI in the fourth. Also, check out my Heartbeat how-to on this site.

Image 1: Schematical overview of the open source SAN

Required Software
To build such SAN appliances, you need the appropriate software. Typically, any Linux distribution will do, but in this article we'll use SUSE Linux Enterprise Server 10 SP2, which is available as a free download. One of the advantages of using SUSE is its position as the distribution used by the Heartbeat Software developers; Heartbeat plays a critical role in this setup. You'll therefore always be ensured from optimal integration between the operating system and the cluster software when working with SUSE. You could use the open source version of SUSE Linux as well, but to build a stable and reliable setup, I would always recommend working with the enterprise version.

When making your choice of softwares to install, keep it to a minimum. After all, you are building SAN appliances here and typically on a SAN you wouldn't run any services. From the list of installable software patterns, select the following:

• Server Base System
• High Availability
• Documentation
• GNOME Desktop Environment for Server
• X Window System

Apart from that, select the iSCSI target components as well. Then you don't need anything else. In fact, you can even do it with less and choose not to select the GNOME environment and X Window System, but since SUSE heavily relies on YaST to configure the box, I'd recommend - at least for as long you are still working on the installation - that you keep the graphical environment at hand. Once finished with the installation, you can still disable it. Of course, you're also free to start all graphical components from a desktop in case you would prefer that.

In addition to the software requirement, you should also think about the hard disk layout you want to use when building SAN appliances like this. No matter if you are setting up server hardware or two laptops to create a test environment, you should take into consideration that a storage device is needed as the SAN storage. In figure 1, I have used /dev/sdb as an example storage device, but this assumes that you have two (or even more) hard drives available. In case you do not have that, it may be a good option to create an LVM setup, and to make a large dedicated volume available for the SAN storage.

The LVM setup also allows you to work with a snapshot appliance - more about that later in this tip. On my test setup, where I use two laptops with a 160 GB hard disk , I've used the following disk layout:

• /dev/sda1: a 100 MB Ext2 formatted partition that is mounted on /boot.
• /dev/sda2: the rest of all available disk space, marked as type 8e for use in an LVM environment.
• /dev/system: the LVM volume group that uses the disk space available from /dev/sda2.
• /dev/system/root: a 10 GB Ext3 formatted logical volume for use as the root of the server file system.
• /dev/system/swap: a 2 GB logical volume used as swap space.
• /dev/system/DRBD: a 100 GB logical volume which is just allocated and not formatted.

To create such a disk layout, use the YaST integrated module while performing the installation.

Image 2: To configure the disk layout of your SAN, YaST can be of great help.

The last consideration to take when setting up your server is networking. I recommend putting your SAN on a network that is separated from normal user traffic. You don't want synchronization between the storage devices in the DRBD setup to be interrupted by a large file transfer initiated by an end-user, so if possible, create a dedicated storage network.

Normally, you would also want to configure a separated network for Heartbeat traffic, in order that a node won't get cast off the network when traffic is temporarily elevated. In this situation, however, I prefer not to do that. If Heartbeat packets don't come through over the normal network connection, it is likely that your DRBD device has also ceased communicating . You wouldn't want Heartbeat to ignore a failure in the communications link while your SAN is in a disconnected stage because a redundant link is still replying, would you?

You now have the basis of your SAN solution available: the two servers that are going to offer the iSCSI storage services. In the next part of this article, you'll learn how to set up a DRBD shared storage device on top of this configuration.

About the author:Sander van Vugt is an author and independent technical trainer, specializing in Linux since 1994. Vugt is also a technical consultant for high-availability (HA) clustering and performance optimization, as well as an expert on SUSE Linux Enterprise Desktop 10 (SLED 10) administration.

VMware upgrades Mac virtual machine software

 VMware Inc. today shipped Fusion 2.0, a major update for its virtualization software that lets Intel-based Macs run Windows, Linux and other operating systems. The upgrade is free to current Fusion users.

After a four-month stretch in beta, Fusion 2.0 is ready for prime time, said Pat Lee, a VMware group manager. "We want our customers to see that Windows really is better on a Mac," Lee said in a statement.

Version 2.0 adds multimonitor support and mirrored folders, as well as support for DirectX 9.0 Shader Model 2, which is crucial for 3-D game-playing under Windows XP. Users can now also take and manage multiple "snapshots," VMware's term for saved versions of a virtual machine (VM) -- originally, only a single snapshot could exist at any one time -- and back up existing VMs automatically with a new auto-snapshot tool.

Other changes to the virtualization software include improvements to Unity, the Mac-Windows integration that puts Windows applications in Mac-style windows. Fusion 2.0 also comes with a free 12-month subscription to McAfee Inc.'s VirusScan Plus antivirus software in any VM running Windows.

The upgrade can be downloaded and installed free of charge by owners of Fusion 1.x; the price for first-time buyers is $79.99 for a single license, $349.99 for five seats and $699.99 for 10. Currently, Fusion 2.0 is available only by electronic distribution from the company's site and several third-party online stores, including those operated by Apple Inc., Amazon.com and Best Buy.

Fusion is one of the several virtualization programs available for the Macintosh. In the commercial arena, it goes head to head with Parallels Inc.'s flagshipParallels Desktop for Mac. Another option is Sun Microsystems Inc.'s open-source VirtualBox, which can be downloaded at no charge.

source: Gregg Keizer

Android Winners

Late last year, Google Inc. announced that it would give $10 million in prizes to software development companies with plans for the most innovative and useful applications for its open-source mobile Android platform.

Roughly nine months later, Google has announced the winners. The applications it has selected help users do everything from calling the nearest taxicab or comparing sale prices at different stores to calculating their carbon footprints. Here are the winners:

Cab4me

Using Android's Google Maps application, cab4me lets a user call a cab to her location with a single click. By using GPS capabilities to locate not only the user's current location, but also the location of the nearest cab company, the application can initiate a call to the cab company with a mere click on the map. The application was developed by Konrad Huebner and Henning Boerger.

Locale

Ever get embarrassed at a company meeting when your cell phone unexpectedly goes off? With Locale, you can make sure your device knows to switch to vibrate mode the minute you step into your office. With Android's GPS capabilities, Locale adjusts your phone's settings to wherever you are. Thus, your phone will forward calls to different numbers based on whether you're at work or home, or it will send out a status message on Twitter letting people know where you're located. This application was developed by Carter Jernigan, Clare Bayley, Jasper Lin and Christina Wright, with additional contributions from Jennifer Shu.

PicSay

Essentially a drop-and-drag picture editor for your mobile phone, PicSay lets users spruce up their pictures with color correction, highlighting, word bubbles and distortion effects. It also can be used to create event invitations or holiday greeting cards that can be sent out to friends, family and associates. This application was developed by Eric Wijngaard.

Softrace

This application actually lets you set up real, live races with your friends and track their progress in real time while the race is going on. Whether the racers are on foot, bicycles or skis, Softrace uses Google Maps' location application programming interface to track each user's progress, and it can store statistics of the race on Android's SQLite database. This application was developed by Staffan Kjellberg and Thomas Kjellberg.

TuneWiki

An open-source music-based social network, TuneWiki lets users share what they're listening to with one another. They can also use Google Maps to find what users around the world are listening to. TuneWiki also plays audio and video for songs while scrolling synchronized lyrics as they play. The application creates a virtual library of songs that connects to the Internet and suggests similar-sounding songs or artists. This application was developed by TuneWiki, with additional help from Rani Cohen, Chad Kouse, Zach Jobbs, Jared Fleener and Amnon Sarig.

Wertago

Billing itself as "the mobile application nightlifers have been waiting for," Wertago is a social networking application that lets users coordinate social events with their friends, rate current hot spots and create personalized social networking profiles for users to share their favorite locations. Like many other Android applications, Wertago uses Google Maps' API to map out clubs, restaurants and theaters. This application was developed by Kelvin Cheung, Teresa Ko, Peter Ree, Robert Sarvis and Douglas Yeung.

Life360

This is a neighborhood-centric social networking application that keeps users up to date with their families and local communities. Life360 users can send or receive neighborhood emergency alerts. Whether you're holding a backyard barbecue or looking for help to find a lost pet, Life360 gives you quick access to your neighbors and your family. This application was developed by Chris Hulls Dilpreet Singh, Luis Carvalho, Phuong Nguyen and Steve Potell.

GoCart

The goal of GoCart is to help shoppers gather as much information as they need to make smart, informed decisions. Using GPS and Android's built-in camera to scan bar codes, the application will search both the Web and local stores to compare prices of any product. The application also lets users read other users' reviews of products and can set up price alerts whenever prices go down. This application was designed by Rylan Barnes, with contributions from Noah Labhart and ZXing Developers.

Ecorio

An application destined to warm Al Gore's heart, Ecorio uses Android's GPS capabilities to track a user's carbon footprint while driving. It also gives suggestions for carpooling and public transportation, and it lets users invest in carbon-reduction projects and purchase carbon credits over their phones. This application was developed by Jeff Kao, Gary Pong, Robert Lam and Taneem Talukdar, with additional contributions from Jason Wong

Compare Everywhere

This application is very similar to GoCart because it uses Android's built-in camera to scan bar codes and compare prices for products at different retail outlets. It also lets customers rate products and create shopping lists like those on Amazon.com. This application was created by Jeffrey Sharkey.

source: Brad Reed

Ubuntu 8.04 offers more than it is first thought

Life just got easier for users of the downloadable or boxed retail versions of the Ubuntu Linux 8.04 operating system who want easy and cheap ways of adding DVD playback and improved audio capabilities to their machines.

Inexpensive add-on applications that will provide audio codecs and a DVD player to expand the multimedia capabilities of the four-year-old Linux operating system are now available for purchase in the Ubuntu online store.

Previously, users of the freely downloaded or boxed versions of the Ubuntu Linux 8.04 could run into compatibility troubles while trying to play DVD movies or some types of audio tracks on their computers.

That was because many DVD player applications and audio codec files are proprietary, fee-based and owned by the vendors that created them, making them impossible to include for free in Ubuntu products.

Canonical Ltd., the commercial sponsor of Ubuntu Linux, said today that it has reached deals with two software vendors, Cyberlink and Fluendo, to sell their DVD player and audio codec applications directly to consumers through the online store. The products are already installed under previous licensing agreements for many laptop and desktop computers that are sold preloaded with Ubuntu Linux from hardware vendors, according to Ubuntu.

"It is important to us that no matter how you choose to access Ubuntu, pre-installed or as a free download, that you can have a similarly rich experience," wrote Gerry Carr, Canonical's marketing manager, in a blog entry today. "The vast majority of our current users will have installed Ubuntu themselves. These users should also be allowed legal DVD and media playback and so we have built a way of letting them do this."

Carr said in an interview that some open-source projects have tried to tackle the missing codec and DVD player issues but that such reuse of the codecs is not necessarily legal.

"They've found a technical work-around, but it hasn't been legally verified," he said. "This is a way to use your Ubuntu Linux distro and legally play back your music and DVDs. At some point, somebody's got to pay these codec providers" for use of their products.

The complications of trying to find, install and maintain the proper audio codecs for Linux operating systems like Ubuntu has long been one of the main consumer complaints about the open-source OS. In many cases, it can be discouraging to deal with the not-so-easy-to-configure audio capabilities, especially when compared with Microsoft Corp.'s Windows and Apple Inc.'s Macintosh computer operating systems.

The Cyberlink PowerDVD software sells for $49.95 in the Ubuntu store and allows users to play commercial DVDs on the latest version of Ubuntu Linux, v8.04. OpenGL driver support for graphics hardware is also required.

From Fluendo, two audio codec applications are available in the store. The basic Windows Media and MP3 Playback Pack provides plug-ins for the most common Windows Media formats, including Windows Media Audio Decoder (Windows Media 7, 8, 9, 10, Pro, Lossless and Speech), Windows Media Video Decoder (Windows Media 7, 8, 9 and VC1), Windows Media MMS Protocol Support, Windows Media ASF Demuxer and MP3 Audio Decoder. It retails in the store for about $25.

Also available is the Fluendo Complete Playback Pack, which adds a wider assortment of needed codecs for more file compatibility. The Complete Playback Pack retails for $39.95.

Ubuntu has been selling boxed versions of its Linux operating system inBest Buy stores since July.

The new Ubuntu store offerings will allow users to eliminate audio and movie compatibility problems on their computers with single-click installation procedures, Carr said. "This has been a problem for consumers in the past," he said. "With this, you can play anything ... with no restrictions at all."

This scenario doesn't mean that Ubuntu is looking to find ways to make consumers pay to use Ubuntu, Carr said. "We're never going to make you pay for anything that is fundamental to the operating system," he noted. "You do need this to play DVDs. You do need this to play certain types of audio.

"We are not diametrically opposed to anyone selling software" to add on for Ubuntu users, he continued. "We will be adding additional software to that store as we can. It's entirely optional. It's building that ecosystem."

source: Todd R. Weiss

How do I flush DNS?

Most DNS clients cache the results of name resolution requests. This speeds up name resolution if multiple lookups are done to the same address, such as is common when browsing the web.

Sometimes a bad DNS entry will be cached and you will need to either flush the DNS cache to get rid of it, or wait up to 24 hours for it to be dropped from the cache automatically.

How to Flush DNS in Microsoft Windows

In Microsoft Windows, you can use the command ipconfig /flushdns to flush the DNS resolver cache:

C:\>ipconfig /flushdns  Windows IP Configuration  Successfully flushed the DNS Resolver Cache. 

You can also use the command ipconfig /displaydns to view the DNS resolver cache.

Turning off DNS Caching under Microsoft Windows

If you experience frequent issues with DNS caching under Microsoft Windows, you can disable client-side DNS caching with either of these two commands:

• net stop dnscache
• sc servername stop dnscache

This will disable DNS caching until the next reboot. To make the change permanent, use the Service Controller tool or the Services tool to set the DNS Client service startup type to Disabled.

Tuning DNS Caching under Microsoft Windows

You can modify the behavior of the Microsoft Windows DNS caching algorithm by setting two registry entries in theHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters registry key.

The MaxCacheTtl represents the maximum time that the results of a DNS lookup will be cached. The default value is 86,400 seconds. If you set this value to 1, DNS entries will only be cashed for a single second.

MaxNegativeCacheTtl represents the maximim time that the results of a failed DNS lookup will be cached. The default value is 900 seconds. If you set this value to 0, failed DNS lookups will not be cached.

How to Flush DNS in Mac OSX

In Mac OSX Leopard, you can use the command dnscacheutil -flushcache to flush the DNS resolver cache:

bash-2.05a$ dnscacheutil -flushcache 

In Mac OSX versions 10.5.1 and before, the command lookupd -flushcache performed the same task:

bash-2.05a$ lookupd -flushcache 

How to Flush DNS in Linux

In Linux, the nscd daemon manages the DNS cache.

To flush the DNS cache, restart the nscd daemon.

To restart the nscd daemon, use the command `/etc/init.d/nscd restart`.

Lenovo halts online sales of Linux-based PCs

 Lenovo Group Ltd. is cutting back on sales of desktops and laptop systems with the Linux operating system pre-installed.

The PC maker said yesterday that it will no longer take online orders for computers pre-loaded with any flavor of Linux. Ray Gorman, a spokesman for the company, said that it will continue offering such machines only through its own or partner direct sales teams.

"Our commitment to Linux has not changed," said Gorman in an e-mail to Computerworld. "What's changed is that customers will no longer be able to order Lenovo ThinkPads and ThinkCentres with pre-installed Linux via the lenovo.com Web site."

Gorman said the most orders for pre-loaded Linux software had come through their sales teams or business partners. Their online sales for pre-installed Linux weren't hitting big enough numbers, he added.

Lenovo has been offering Linux-based machines since 2000.

The company will continue to pre-certifyNovell and Red Hat Linux on ThinkPad laptops and ThinkCentre desktops. Lenovo is also adding Ubuntu certification for new ThinkPad and ThinkCentre PCs, according to Gorman.

He also noted that Lenovo is slated to deliver Linux-based servers and IdeaPad netbook models in September and October, respectively.

London Stock Exchange suffers .NET Crash

It should have been a great day on the London Stock Exchange. The U.S. government had announced on the Sunday before that it was coming to the rescue of Freddie Mac and Fannie Mae. Trading would have been extremely brisk, but then, at 9:15 AM GMT, the Exchange's software failed due to "connectivity issues."Six-hours and 45-minutes later, the London Exchange, along with the Johannesburg Stock Exchange, which uses the LSE's trading platform TradElec, were finally back up.

That was no consolation to traders. As Reuters reported, "We have the biggest takeover in the history of the known world ... and then we can't trade. It's terrible," one trader said.

So what happened? Officially, the LSE first said that, "We will be investigating this and will do everything we can to make sure this doesn't reoccur." Laterthe LSE gave the vague explanation, that "It was software-related, a coincidence, due to two processes we couldn't have foreseen," and not caused by high-volume. The spokesperson added, "We've introduced a fix and we're confident it will not happen again."

Somehow "we couldn't have foreseen" and "we're confident it will not happen again" don't fit very well together.

So what really happened? I doubt we'll ever get a detailed, nitty-gritty explanation, but I have friends in London and... Well, let me just make the following points about TradElec. First, TradElec runs on more than a 100 HP ProLiant servers in several locations in London. These servers are running Windows Server 2003.

On top of this runs the TradElec software itself. This is a custom set of C# and .NET programs, which was created by Microsoft and Accenture, the global consulting firm. Its back-end databases, believe it or not, run on Microsoft SQL Server 2000. The goal was to maintain sub-ten millisecond response times. In short, it's meant to be a real-time system.

The programmers and serious database administrators in the audience can already see where this is going. Sorry, Microsoft, .NET Framework is simply incapable of performing this kind of work, and SQL Server 2000, or any version of SQL Server really, can't possibly handle the world's number three stock exchange's transaction load on a consistent basis.

I'd been hearing from friends who trade on the LSE for ages about how slow the system could get. Now, I know why.

What I find really amazing is that the LSE's software stack hadn't blown its top earlier. Even setting aside my feelings for Linux, there's simply no way I'd recommend Server 2003, .NET and SQL Server for a job even a tenth this size. If a customer of mine insisted that they didn't want open source - more fool them - I'd recommended Sun Solaris, JEE (Java Enterprise Edition) and Oracle or IBM AIX or z/OS, WebSphere and DB2.

What I'd really prefer to see is RHEL (Red Hat Enterprise Linux), JBoss, and MySQL or Oracle or Novell's SLES (SUSE Linux Enterprise Server), JEE, and, again MySQL or Oracle for the DBMS engine. In any case, though, the real moral of this story is that if you really want HA (high availability) or HPC (high performance computing), Microsoft's products should be at the bottom of your list. Unix, mainframes, and, yes Linux, are far, far better for companies that need fast and reliable computing.

You don't have to believe me though. The New York Stock Exchange has already started to use Linux on its servers.

Red Hat mystifies with Qumranet purchase

Less than a week after Red Hat Inc.’s surprise $107 million purchase of Qumranet Inc., I remain mystified by this acquisition. Qumranet is the Israeli-based creator of the KVM open source hypervisor, which is incorporated into the Linux kernel; SolidIce virtual desktop, which Qumranet launched earlier this year but has yet to gain serious traction, and Spice, a super-fast communications protocol for transmitting bandwidth-heavy multimedia content at high speed that other vendors currently can’t match.

.
The first person to raise questions about this buy to me was George Weiss, executive vice president of Stamford, Conn.-based Gartner Inc., who said this dual hypervisor strategy would make life more difficult for Red Hat customers, who would have to buy a management console to control the two hypervisors, Xen, which is already in Red Hat Enterprise Linux (RHEL) 5, and KVM, which will be added in subsequent versions.

Burton Group analysts Chris Wolf and Richard Jones pointed out that KVM enters a crowded market late in the game. Despite a solid architecture, KVM is still immature and lacks the momentum and multi-vendor support of more-established Xen, Wolf said. To be the No. 2 virtualization vendor based on KVM, Red Hat must end its isolation from the Microsoft camp and attain certification under Microsoft’s Server Virtualization Validation Program so its hypervisor will be optimized for Microsoft guests, he said.

KVM needs the support of another big vendor or two, added Jones. The Qumranet acquisition will pull Red Hat in the direction of desktop virtualization while Xen will continue to dominate the server market, he predicted.

Tech blogger Jason Perlow said Red Hat told him that it plans to open source the Spice protocol and other components of the SolidIce desktop virtualization. If so, Red Hat will have positioned itself as a solid competitor to VMware and Citrix’s desktop and server virtualization, assuming an attractive pricing model, Perlow predicted. “At the end of the day, it’s not about raw technical merit. It’s about how well the vendor markets the solution and how palatable it is to end users,” he said.

Daniel Kusnetzky, principal analyst of Osprey, Fl.-based Kusnetzky Group, who recently counted Qumranet as a client, raised another rationale for Red Hat’s purchase of Qumranet: control over the hypervisor. Red Hat lost leverage over Xen when Xen was bought by Citrix; this acquisition gives Red Hat control over KVM, he said. Good point.

The bottom line: Maybe it’s just that I’m a frugal New England Yankee, but I wouldn’t pay $107 million for a giveaway hypervisor and a promising-but-wannabe desktop virtualization product. Especially since desktop virtualization is not yet ready for mainstream adoption since it shifts storage to the data center, which is more costly. This acquisition is all the more surprising since Red Hat hasn’t done much with the desktop to date. Kusnetzky may have hit the bull’s eye on Red Hat’s motivation but Wolf also is correct that it’s time for Red Hat to mend fences with Microsoft if it wants to be relevant to the overwhelming majority of the computing universe, desktop or server.

source: Pam Derringer, News Writer

Ubuntu Landscape systems management tool set to launch

After a six-month beta period, Canonical Ltd. is adding management muscle toUbuntu Linux servers and desktops in the form of its Landscape systems management tool.

Early next month, Canonical will officially release the Landscape suite, enabling IT managers to install, monitor, upgrade and manage servers and/or desktops with a single click. Adding users, fixing security problems and monitoring system performance are a few of the tasks that administrators can now perform centrally instead of on individual machines. Additional functions include auditing, inventory and organization.

Gerry Carr, Canonical's marketing manager, said Landscape is expected to make it much easier to integrate Ubuntu machines into organizations. "It's not good enough to have technology," Carr said. "Businesses need services to manage and run [machines]."

Following a brief trial in which the Landscape was offered for free, the new service will be incorporated into Canonical's support package. Landscape will compete with Red Hat Network and Novell Zenworks Suite.

It's not good enough to have technology. Businesses need services to manage and run [machines].  Gerry Carr, Marketing manager, Canonical Ltd.

Although Ubuntu is more widely used on desktops than on servers, Canonical expects the latter to equal its desktop community within four or five years, until Canonical is "at least a peer player" in that market, Carr said. The Landscape package manager creates an incentive for business users -- who can download the software for free -- to convert into paying support customers, he added.

Stephen O'Grady, an analyst at Red Monk, said that Landscape is a solid "lightweight, out-of-the-box" offering but not as fully functioning or complex as products from Red Hat, Novell and other larger vendors.

"It's not trying to be all things to all people," he said. "But it makes it easy to aggregate metrics of individual machines, uptime, processes and temperatures … and gives management the ability to use the data to make decisions."

Annual pricing for Landscape is $750 per server for support between 9 a.m. and 5 p.m. and $2,570 per server for 24/7support. For desktops, support is $250 per machine between 9 a.m. and 5 p.m. and $900 for 24/7 support.

source: Pam Derringer, News Writer

Hottest - How to buy a mini laptop

Minilaptops are among the hottest new products this year and with the back-to-school sales season upon us, I created a list of items to help you choose the right one.

The devices, which are becoming popularly known as netbooks, or my favorite term, "laptots," have caught on because they offer people a mobile, easy way to wirelessly access the Web.

They come with 7-in. to 10-in. LCD screens and are about half to two-thirds the size of a mainstream laptop. They weigh around 2.2 lbs each, carry batteries that last up to eight hours and generally cost between $199 and $699.

I've written several netbook reviews and after some consideration, offer these tips for your first netbook.

1. Know what you want to use it for and how much you're willing to spend.

This is a cliche in reviews and doesn't tell you much, but it's actually very important. What do you want this for? Do you want a lightweight device for easy Internet access? Or are you really looking for a full-featured laptop computer? Don't buy a netbook if you're really looking for a laptop, it would be a mistake.

To ensure longer battery life, some key components on a netbook, such as the microprocessor, are far less powerful than common laptops. That's why they're good for surfing the Internet, doing homework on a word processing program, and working on spreadsheets, presentations and other Office-like work.

Anyone looking for a gaming laptop or one for video editing or other multimedia work should shop for true laptops, not netbooks.

2. Buy a netbook with an 8.9-in. screen or larger.

I tried out an Eee PC with a 7-in. screen and the annoying part is not being able to see an entire Web page because the screen is too small.

That's less of a problem on the slightly larger-size screens and in the 8.9-in. screen size; the weight and size of the netbook is nearly the same as devices with 7-in. screens.

3. Make sure you get a 6-cell battery for your netbook, although you may have to pay $50 more and the device will weigh more.

Most companies are offering netbooks with 3-cell batteries as the standard, but that doesn't offer a whole lot of run time, just two to three hours. A 6-cell battery doubles that, and in some devices designed around a 6-cell battery, such as Asustek Computer's Eee PC 1000 andEee PC 901, you can get up to eight hours.

In a mobile device, battery life is vital. You don't want to always be looking around for plugs, nor fighting over the last one.

Most vendors are now following Asustek's lead with 6-cell batteries. Micro-Star International recently announced a line of Wind netbooks with 6-cell batteries, and Acer recently put out a formal version of its Aspire One with a 6-cell battery and larger hard disk drives (HDDs) to boot.

Vendors generally offer 6-cell batteries for all models. But most devices come standard with a 3-cell or 4-cell battery, so if you want a 6-cell, then you have to ask for it and expect to pay a bit more.

Another benefit of the larger battery is that it props up the back of the device, putting it on a slight angle that makes typing easier. Keypads on netbooks are smaller than normal keypads, and comfortable typing was one area I was not willing to compromise on.

4. Try out the keypad and make sure it's right for you.

None of the devices I tested had a better typing pad on a cheaper netbook than Intel's ClassMate PC, which has a keypad far smaller than the Eee PC 1000. Keys on the ClassMate PC's keyboard are raised and there is a lot of space between them, making them easy to find by touch.

By contrast, the Eee PCs, Wind and Elitegroup Computer Systems'G10IL designed their keypads with flat keys and little or no space between the keys because, I was told by Elitegroup staff, it makes them look nice.

The trouble is, it also makes typing more difficult.

I really liked the keypads on Acer's Aspire One and Everex's CloudBook Max, but the best keypad was on Hewlett-Packard's Mini-Note.

5. Software: See what it comes with and consider trying the Linux OS.

There are two lessons on software.

First, some vendors have skimped on including software in their netbooks on the pretense that users can download a lot for free on the Internet. That's true, but it's a bogus excuse. Who wants to spend time downloading when many netbook makers have added lots of software so users can play with their new netbook right away?

Asustek included a lot of useful software on its Eee PCs 1000, 1000H and 901, as has Acer, which also added a nice opening screen that boots up in just 12 seconds.

Second, it may be time to the give the Linux operating system a try.

The Acer opening screen I just referred to is based on Linux, and Aspire One comes with the Linpus Linux Lite operating system, which is very user-friendly. I've used Windows for most of my life but switching to Linux to try out Aspire One was smooth and easy.

Most of the netbooks I tested with Linux operating systems booted up far faster than Windows XP or Windows Vista (I would not buy a netbook with Vista, it's just too slow).

There are also free Linux-based word processing programs, spreadsheets and so on available on the Internet such asOpen Office, Google Pack, which includes Sun's StarOffice or Web-based software such as Google Apps.

Of course, it would be nice to see a Web site devoted to netbooks, with software specifically designed for low-power devices and smaller screens. Netbookdownload.com, anyone?

6. Price: If it costs more than $500, start looking at a regular notebook computer.

Companies have started promoting a wide range of netbooks at higher prices, but once you pass $500, netbooks start to compete with laptops, and a laptop will almost always give you more value for your money in that case.

Laptop computers have far more powerful microprocessors and other components than netbooks, and sport DVD drives. There are no DVD drives on netbooks.

If size and weight are your main concerns, there are plenty of small, full-featured laptops, including the Sony Vaio VGN-TZ340, Lenovo IdeapadU110-23042BU, and, of course, Apple's lightweight MacBook Air.

7. Look around at what's available.

There were a lot of devices that impressed me and that are worth considering.

Giga-byte's M912, is the netbook that has by far the coolest technology on board with its touch screen. The screen can also swivel around so you can show someone else what you're working on or looking at on the Net.

But I was quoted a price of $632 for the device, and since I'm not really sure how much I'd use the touch screen, I figured it wasn't right for me.

I almost decided on one of the netbooks with the bigger, 10-in. screens. My top choices were Asustek's Eee PC 1000 with the Xandros Linux OS and a 40GB solid-state drive for storage and 6-cell battery, or Micro-Star's Wind with a 6-cell battery.

Both devices are very nice to use but were a little bigger and more expensive than what I was looking for. Size is important to consider in terms of weight. Ten-inch screens, HHD and 6-cell batteries add a lot of extra weight to a netbook.

All of the netbooks I tried out include wireless Internet access through Wi-Fi 802.11b/g, but only Asustek's Eee PCs 1000, 1000H and 901 offered speedier 802.11b/g/n as of this writing.

The CloudBook Max will be sold with subscriptions for WiMax wireless networking, and some netbooks will also be sold with built-in 3G modules so mobile phone service providers can offer them with third-generation telecommunications contracts, so people can access the Internet from anywhere on their mobile phone network.

People can also buy add-on 3G or WiMax cards for any netbook.

8. And finally, the best netbook available is. ...

I tested several different netbooks and published reviews on them all, and after trying out some pretty cool devices, I decided to buy the one that's right for me: Acer's Aspire One.

Based on the criteria above, here's why:

I already have a laptop PC, so I don't need a powerful netbook. I just wanted a smaller, lighter device easier to carry around that I can use to surf the Web and write outside my office.

Aspire One comes with an 8.9-in. screen and a 3-cell battery, standard, but I will pay a little more for a 6-cell battery. I get stranded in airports sometimes, often take trains and simply like to sip my coffee very slowly. I need a long-lasting battery.

The keypad on the device is quite comfortable, and the software it comes with is easy to use, especially the Linpus Linux Lite operating system.

The price sealed my decision.

Last Friday, Acer slashed prices on three Aspire One models in the U.S., to $399 for an Aspire One with Windows XP, a 160GB HDD and 6-cell battery. An Aspire One with Windows XP, a 120GB HDD and 3-cell battery costs just $349, and a similar device running on Linpus Linux Lite is just $329.

I plan to buy the $329 Linux-based Aspire One, which has an 8.9-in. screen, a 1.6-GHz Intel Atom microprocessor, 512MB of DRAM and 8GB of flash memory storage and a 3-cell battery. I'll add more DRAM and buy an additional flash card, as well as trade up to a 6-cell battery, which will likely raise the price to around $420, in all.

source: Dan Nystedt