Tag: Tools

Linux

SourceForge Enterprise Edition

If, like me you spend a lot of time on SourceForge and wish you could harness the SF functionality in your own development environment then this is for you. SourceForge has released SourceForge Enterprise Edition 4.3.

This is a VMWare Virtual Appliance that allows for up to 15 free users. I haven’t put it to use yet, but I will be implementing a test of it (hopefully) sometime this summer at work to see how well it meets our development, project and bug-tracking needs.

If it is all it promises to be this may be one of the most useful tools for small-team distributed development ever.

Development

Smart Testing

Scott Sehlhorst (developer.*)has written a concise article on how to do smart software testing. While I have worked with non-technical people who wanted “full-coverage” testing of all builds, and have also worked with non-technical people who wanted to skip testing and just go live and “fix it in the field,” I have not previously had the numbers to say “yes, this has been tested and we are 99% confident that the application is 99% bug free.” Without having the numbers and formulae at hand the best I could previously say was “I am pretty confident that it is mostly bug-free.” Well, I know that the 99/99 numbers sound a lot more confident than that, and I am less likely to spend a week running tests to get as close to full coverage as possible now that I have this bit in my tool-belt.

Music

Feeling the itch to compose

While I have been incredibly busy at work and busy with other projects, I find that I am missing composing. So I think that it may be time to get back to working on music.

With that in mind, I will no doubt be giving a few of my favorite online tools a workout. For things like modifying samples I use the audio tools at thewhippingpost.co.uk quite a bit. For things like finding odball sounds to work with of course I turn to Google. When it comes time for percussion inspiration I go to SHARE for African rhythms and Jas‘s Middle Eastern Rhythms FAQ. I use Anvil Studio for creating bass, melody and spheres, and then pull them into TiMidity to convert them to sampled wav files. Now, if I could just find an online idea generator . . ..

Development

When to upgrade?

I have a minor (or possibly major) problem with my favorite Java IDE, NetBeans. It seems that even though version 5.5 Q-build has been promoted to Build 1, I still have issues with using version 4.

I was much more comfortable with the workings of version 3 and earlier, where setting up projects and working within projects seemed much simpler. I still find myself frustrated with version 4 and the need to explicitly import the libraries I routinely use. With version 3 and earlier I imported those libraries generically for all projects. I still haven’t figured out how to do that in version 4 or 5. So now that the world is moving on what am I to do? I guess I will just have to upgrade and bite the bullet.

Tools

Syntax highlighting with nano

Ok, I will be the first to admit that this is nothing new, however I just found out it about today! It seems that all this time I have been using nano for my default linux editor, completely unaware that it has the capacity for syntax highlighting. (DOH!)

It seems that with a simple .nanorc file you can set the highlighting colors for just about any kind of file. I found a very good example at http://osx.hyperjeff.net/MyApps/nanorc, although the Python highlighting he has uncommented has a mal-formed regex in the first line. (I just deleted that one and uncommented the one above and it works great.)

There are two examples at the bottom of the page at http://article.gmane.org/gmane.linux.gentoo.user.german/9565 – the page is in German but the .nanorc files are there. The first is for use with a black screen, the second for use with a white screen. (The hint here is don’t use black on a black screen or brightwhite on a white screen, and brightyellow is unreadable on a white screen as well.)

There are enough examples to get you started, and it shouldn’t be too difficult to come up with your own color schemes that fit the way you work best.

Open Source

Simpler iptables firewalls with firehol

As everyone knows, security depends on defense-in-depth. (And if you didn’t before, you do now!) The idea being that defense should take place in layers, from the edge of the network to the heart of the system. That’s why we have firewalls, anti-virus, intrusion detection, anti-spam and kernel and compiler hardening mechanisms. But just because you have a firewall at the edge of the network doesn’t mean you can skip the host-based firewall.

The most common Linux host-based firewall is probably iptables. Unfortunately, iptables can be incredibly complex to configure correctly. There are lots of tools to help with this. My favorite has to be firehol. Both from an ease of use standpoint, and from a “don’t kill me while I’m testing” sort of operation. If you are not careful while editing iptables rules it is actually fairly easy to lock yourself out.

Say you are remote in your server via ssh. You edit your iptables firewall rules and disable shh port 22 by placing a comment marker in the wrong line. You HUP the firewall and BANG you’re locked out. The way firehol gets around this is to generate a rule to accept all ESTABLISHED and RELATED connections. So you’re connected via ssh, change the firehol configs, restart the service and you are still connected. Now you start another shell and try to log in and when you find that you can’t you can return to the open connection, fix the error and restart, and so on.

In the interest of showing how firehol works, here is a sample firehol.conf and the generated iptables firewall rules that it created.

interface eth0 internal src "192.168.1.0/24" dst 192.168.1.10/32
  	policy drop
  	server ICMP accept
  	server dns accept
  	server ftp accept
  	server ident accept
  	server microsoft_ds accept
  	server mysql accept
  	server samba accept
  	server time accept
  	server ssh accept
  	server http accept
  	server https accept
  	server ntp accept
  	server vnc accept
  	server webmin accept
  	server smtp accept
  	server pop3 accept
  	client all accept
  interface eth0 outside src not "${UNROUTABLE_IPS} 192.168.1.0/24" dst 192.168.1.10/32
  	policy drop
  	server ICMP accept
  	server dns accept
  	server ftp accept
  	server http accept
  	server https accept
  	server ntp accept
  	server smtp accept
  	server pop3 accept
  	client all accept
  interface lo loopback src "127.0.0.0/8" dst "127.0.0.0/8 192.168.1.10/32"
  	policy accept

Generated rules:

# Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *mangle
 :PREROUTING ACCEPT [7340:1260938]
 :INPUT ACCEPT [7296:1245746]
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [7454:4772446]
 :POSTROUTING ACCEPT [7468:4775764]
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005
 # Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *nat
 :PREROUTING ACCEPT [340:49114]
 :POSTROUTING ACCEPT [19:2454]
 :OUTPUT ACCEPT [19:2454]
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005
 # Generated by iptables-save v1.2.11 on Wed Dec  7 14:49:09 2005
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT DROP [0:0]
 :in_internal - [0:0]
 :in_internal_ICMP_s1 - [0:0]
 :in_internal_all_c14 - [0:0]
 :in_internal_dns_s2 - [0:0]
 :in_internal_ftp_c16 - [0:0]
 :in_internal_ftp_s3 - [0:0]
 :in_internal_http_s10 - [0:0]
 :in_internal_https_s11 - [0:0]
 :in_internal_ident_s4 - [0:0]
 :in_internal_irc_c15 - [0:0]
 :in_internal_microsoft_ds_s5 - [0:0]
 :in_internal_mysql_s6 - [0:0]
 :in_internal_ntp_s12 - [0:0]
 :in_internal_samba_s7 - [0:0]
 :in_internal_ssh_s9 - [0:0]
 :in_internal_time_s8 - [0:0]
 :in_internal_webmin_s13 - [0:0]
 :in_loopback - [0:0]
 :in_outside - [0:0]
 :in_outside_ICMP_s1 - [0:0]
 :in_outside_all_c9 - [0:0]
 :in_outside_dns_s2 - [0:0]
 :in_outside_ftp_c11 - [0:0]
 :in_outside_ftp_s3 - [0:0]
 :in_outside_http_s4 - [0:0]
 :in_outside_https_s5 - [0:0]
 :in_outside_irc_c10 - [0:0]
 :in_outside_ntp_s6 - [0:0]
 :in_outside_ssh_s7 - [0:0]
 :in_outside_webmin_s8 - [0:0]
 :out_internal - [0:0]
 :out_internal_ICMP_s1 - [0:0]
 :out_internal_all_c14 - [0:0]
 :out_internal_dns_s2 - [0:0]
 :out_internal_ftp_c16 - [0:0]
 :out_internal_ftp_s3 - [0:0]
 :out_internal_http_s10 - [0:0]
 :out_internal_https_s11 - [0:0]
 :out_internal_ident_s4 - [0:0]
 :out_internal_irc_c15 - [0:0]
 :out_internal_microsoft_ds_s5 - [0:0]
 :out_internal_mysql_s6 - [0:0]
 :out_internal_ntp_s12 - [0:0]
 :out_internal_samba_s7 - [0:0]
 :out_internal_ssh_s9 - [0:0]
 :out_internal_time_s8 - [0:0]
 :out_internal_webmin_s13 - [0:0]
 :out_loopback - [0:0]
 :out_outside - [0:0]
 :out_outside_ICMP_s1 - [0:0]
 :out_outside_all_c9 - [0:0]
 :out_outside_dns_s2 - [0:0]
 :out_outside_ftp_c11 - [0:0]
 :out_outside_ftp_s3 - [0:0]
 :out_outside_http_s4 - [0:0]
 :out_outside_https_s5 - [0:0]
 :out_outside_irc_c10 - [0:0]
 :out_outside_ntp_s6 - [0:0]
 :out_outside_ssh_s7 - [0:0]
 :out_outside_webmin_s8 - [0:0]
 -A INPUT -i lo -j ACCEPT
 -A INPUT -s 192.168.1.0/255.255.255.0 -d 192.168.1.10 -i eth0 -j in_internal
 -A INPUT -d 192.168.1.10 -i eth0 -j in_outside
 -A INPUT -s 127.0.0.0/255.0.0.0 -d 127.0.0.0/255.0.0.0 -i lo -j in_loopback
 -A INPUT -s 127.0.0.0/255.0.0.0 -d 192.168.1.10 -i lo -j in_loopback
 -A INPUT -m state --state RELATED -j ACCEPT
 -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "IN-unknown:"
 -A INPUT -j DROP
 -A FORWARD -m state --state RELATED -j ACCEPT
 -A FORWARD -m limit --limit 1/sec -j LOG --log-prefix "PASS-unknown:"
 -A FORWARD -j DROP
 -A OUTPUT -o lo -j ACCEPT
 -A OUTPUT -s 192.168.1.10 -d 192.168.1.0/255.255.255.0 -o eth0 -j out_internal
 -A OUTPUT -s 192.168.1.10 -o eth0 -j out_outside
 -A OUTPUT -s 127.0.0.0/255.0.0.0 -d 127.0.0.0/255.0.0.0 -o lo -j out_loopback
 -A OUTPUT -s 192.168.1.10 -d 127.0.0.0/255.0.0.0 -o lo -j out_loopback
 -A OUTPUT -m state --state RELATED -j ACCEPT
 -A OUTPUT -m limit --limit 1/sec -j LOG --log-prefix "OUT-unknown:"
 -A OUTPUT -j DROP
 -A in_internal -j in_internal_ICMP_s1
 -A in_internal -j in_internal_dns_s2
 -A in_internal -j in_internal_ftp_s3
 -A in_internal -j in_internal_ident_s4
 -A in_internal -j in_internal_microsoft_ds_s5
 -A in_internal -j in_internal_mysql_s6
 -A in_internal -j in_internal_samba_s7
 -A in_internal -j in_internal_time_s8
 -A in_internal -j in_internal_ssh_s9
 -A in_internal -j in_internal_http_s10
 -A in_internal -j in_internal_https_s11
 -A in_internal -j in_internal_ntp_s12
 -A in_internal -j in_internal_webmin_s13
 -A in_internal -j in_internal_all_c14
 -A in_internal -j in_internal_irc_c15
 -A in_internal -j in_internal_ftp_c16
 -A in_internal -m state --state RELATED -j ACCEPT
 -A in_internal -m limit --limit 1/sec -j LOG --log-prefix "IN-internal:"
 -A in_internal -j DROP
 -A in_internal_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_all_c14 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_c16 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_internal_http_s10 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_https_s11 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ident_s4 -p tcp -m tcp --sport 1024:65535 --dport 113 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_irc_c15 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_internal_microsoft_ds_s5 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_mysql_s6 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ntp_s12 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p udp -m udp --sport 1024:65535 --dport 138 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_samba_s7 -p tcp -m tcp --sport 1024:65535 --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_ssh_s9 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_time_s8 -p tcp -m tcp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_time_s8 -p udp -m udp --sport 1024:65535 --dport 37 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_internal_webmin_s13 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_loopback -m state --state RELATED -j ACCEPT
 -A in_loopback -j ACCEPT
 -A in_outside -s 0.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 2.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 5.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 7.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 23.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 27.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 31.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 36.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 39.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 41.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 42.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 73.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 74.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 76.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 89.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 90.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 92.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 96.0.0.0/224.0.0.0 -j RETURN
 -A in_outside -s 173.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 174.0.0.0/254.0.0.0 -j RETURN
 -A in_outside -s 176.0.0.0/248.0.0.0 -j RETURN
 -A in_outside -s 184.0.0.0/252.0.0.0 -j RETURN
 -A in_outside -s 189.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 190.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 197.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 223.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 240.0.0.0/240.0.0.0 -j RETURN
 -A in_outside -s 10.0.0.0/255.0.0.0 -j RETURN
 -A in_outside -s 169.254.0.0/255.255.0.0 -j RETURN
 -A in_outside -s 172.16.0.0/255.240.0.0 -j RETURN
 -A in_outside -s 192.0.2.0/255.255.255.0 -j RETURN
 -A in_outside -s 192.88.99.0/255.255.255.0 -j RETURN
 -A in_outside -s 192.168.0.0/255.255.0.0 -j RETURN
 -A in_outside -s 192.168.1.0/255.255.255.0 -j RETURN
 -A in_outside -j in_outside_ICMP_s1
 -A in_outside -j in_outside_dns_s2
 -A in_outside -j in_outside_ftp_s3
 -A in_outside -j in_outside_http_s4
 -A in_outside -j in_outside_https_s5
 -A in_outside -j in_outside_ntp_s6
 -A in_outside -j in_outside_ssh_s7
 -A in_outside -j in_outside_webmin_s8
 -A in_outside -j in_outside_all_c9
 -A in_outside -j in_outside_irc_c10
 -A in_outside -j in_outside_ftp_c11
 -A in_outside -m state --state RELATED -j ACCEPT
 -A in_outside -m limit --limit 1/sec -j LOG --log-prefix "IN-outside:"
 -A in_outside -j DROP
 -A in_outside_ICMP_s1 -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_all_c9 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_dns_s2 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_dns_s2 -p tcp -m tcp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 21 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 20 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_c11 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ftp_s3 -p tcp -m tcp --sport 1024:65535 --dport 1024:4999 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A in_outside_http_s4 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_https_s5 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_irc_c10 -p tcp -m tcp --sport 6667 --dport 1024:4999 -m state --state ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ntp_s6 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_ssh_s7 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A in_outside_webmin_s8 -p tcp -m tcp --sport 1024:65535 --dport 10000 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal -j out_internal_ICMP_s1
 -A out_internal -j out_internal_dns_s2
 -A out_internal -j out_internal_ftp_s3
 -A out_internal -j out_internal_ident_s4
 -A out_internal -j out_internal_microsoft_ds_s5
 -A out_internal -j out_internal_mysql_s6
 -A out_internal -j out_internal_samba_s7
 -A out_internal -j out_internal_time_s8
 -A out_internal -j out_internal_ssh_s9
 -A out_internal -j out_internal_http_s10
 -A out_internal -j out_internal_https_s11
 -A out_internal -j out_internal_ntp_s12
 -A out_internal -j out_internal_webmin_s13
 -A out_internal -j out_internal_all_c14
 -A out_internal -j out_internal_irc_c15
 -A out_internal -j out_internal_ftp_c16
 -A out_internal -m state --state RELATED -j ACCEPT
 -A out_internal -m limit --limit 1/sec -j LOG --log-prefix "OUT-internal:"
 -A out_internal -j DROP
 -A out_internal_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_all_c14 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_c16 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_internal_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_http_s10 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_https_s11 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ident_s4 -p tcp -m tcp --sport 113 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_irc_c15 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_microsoft_ds_s5 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_mysql_s6 -p tcp -m tcp --sport 3306 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ntp_s12 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 137 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 137 --dport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 138 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p udp -m udp --sport 138 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p tcp -m tcp --sport 139 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_samba_s7 -p tcp -m tcp --sport 445 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_ssh_s9 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_time_s8 -p tcp -m tcp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_time_s8 -p udp -m udp --sport 37 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_internal_webmin_s13 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_loopback -m state --state RELATED -j ACCEPT
 -A out_loopback -j ACCEPT
 -A out_outside -d 0.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 2.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 5.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 7.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 23.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 27.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 31.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 36.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 39.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 41.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 42.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 73.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 74.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 76.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 89.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 90.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 92.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 96.0.0.0/224.0.0.0 -j RETURN
 -A out_outside -d 173.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 174.0.0.0/254.0.0.0 -j RETURN
 -A out_outside -d 176.0.0.0/248.0.0.0 -j RETURN
 -A out_outside -d 184.0.0.0/252.0.0.0 -j RETURN
 -A out_outside -d 189.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 190.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 197.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 223.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 240.0.0.0/240.0.0.0 -j RETURN
 -A out_outside -d 10.0.0.0/255.0.0.0 -j RETURN
 -A out_outside -d 169.254.0.0/255.255.0.0 -j RETURN
 -A out_outside -d 172.16.0.0/255.240.0.0 -j RETURN
 -A out_outside -d 192.0.2.0/255.255.255.0 -j RETURN
 -A out_outside -d 192.88.99.0/255.255.255.0 -j RETURN
 -A out_outside -d 192.168.0.0/255.255.0.0 -j RETURN
 -A out_outside -d 192.168.1.0/255.255.255.0 -j RETURN
 -A out_outside -j out_outside_ICMP_s1
 -A out_outside -j out_outside_dns_s2
 -A out_outside -j out_outside_ftp_s3
 -A out_outside -j out_outside_http_s4
 -A out_outside -j out_outside_https_s5
 -A out_outside -j out_outside_ntp_s6
 -A out_outside -j out_outside_ssh_s7
 -A out_outside -j out_outside_webmin_s8
 -A out_outside -j out_outside_all_c9
 -A out_outside -j out_outside_irc_c10
 -A out_outside -j out_outside_ftp_c11
 -A out_outside -m state --state RELATED -j ACCEPT
 -A out_outside -m limit --limit 1/sec -j LOG --log-prefix "OUT-outside:"
 -A out_outside -j DROP
 -A out_outside_ICMP_s1 -p icmp -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_all_c9 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_dns_s2 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_dns_s2 -p tcp -m tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 20 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_c11 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A out_outside_ftp_s3 -p tcp -m tcp --sport 1024:4999 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_http_s4 -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_https_s5 -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_irc_c10 -p tcp -m tcp --sport 1024:4999 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 123 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ntp_s6 -p tcp -m tcp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_ssh_s7 -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 -A out_outside_webmin_s8 -p tcp -m tcp --sport 10000 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
 COMMIT
 # Completed on Wed Dec  7 14:49:09 2005

Tools

The best tools for the job – part 3

Programming:

I work in a couple languages and develop everything from full-blown applications to web applications to scripts for server maintenance. These are my top picks for whatever language I am working in at the moment.

Java:
I have been using (for several years) and am partial to NetBeans [Linux – BSD – Windows – OSX]. This Java IDE has progressed into a full-featured environment including the following integrated pieces:

Tomcat server
local Pointbase database
Javadoc Index search
Internationalization
refactoring engine
JUnit testing

I haven’t really tested Eclipse [Linux – BSD – OSX – Windows] more than to install it and run it for a short while. Truthfully, I just didn’t feel like overcoming the learning curve, since I already know how to do what I want to do in NetBeans.

Bash Scripting:
Of course it is always best to do Bash scripting in a bash shell, preferably in XEmacs [Linux – BSD – OSX – Windows] or Nano [Linux – BSD – OSX – Windows (DOS)].When I can, that is exactly what I do. Often, however, I am forced at work to develop Bash scripts for servers from my desktop (Windows) PC. For this I have found evolvEd [Windows] to be the tool of choice. It provides syntax highlighting and code completion hints which help a great deal when you are unable to paste a line of code into a terminal window and see how it runs. Of course, I can test those scripts (at least partially) in Cygwin [Windows] which I make sure to install on every Windows box I am expected to work with, but those tests are limited in that calls to other programs don’t work if those programs aren’t installed in Cygwin.

Python:
Python is fairly new to me still, for anything beyond server scripts, and large text file parsing, which is what got me started in Python. (Python can do a line-by-line parse of a 280MB text file, determining the interesting non-empty lines by the characters in the 12th – 20th position and writing them out to a series of 1200 line files in a matter of a couple minutes – as opposed to the constant hung process I was getting with a Bash script to do the same thing.) Being new to Python I have really only worked with IDLE [Linux – BSD – Windows – OSX] which is included with the current distribution of Python. There may be better things out there – perhaps jEdit [Linux – BSD – Windows – OSX] or something else, but I am still too new in the game to make that decision, even for myself.

Tools

The best tools for the job – part 2

Music Creation and Editing

When it comes to music creation/editing software and tools there are rabid fans of just about anything you can find. These tools are by no means the only thing available, and there might even be some that don’t do the job as well as others. These (as all the picks in this series) are just the ones I happen to like.

Sequencing:
For sequencing (MIDI) work I like Anvil Studio [Windows]. I have been using it for several years now, (since around ’99 or ’00 or so) and it works great for composing music. I generally create a complete melodic piece, and then split it into ‘chunks’ which I can use in my loop composition package. I then work out the harmonic tracks based on the whole, figure out the thematic elements and work that into a set of harmony ‘chunks’ which are (mostly) interchangeable throughout the melody line.

Using MIDI pieces directly in a loop composition package is generally not such a good idea. You’re generally stuck with whatever MIDI interpreter is built into the package. Which is why I then take my ‘chunks’ and convert them to wav files using TiMidity++ [Windows – Linux – BSD – OSX]. Since TiMidity++ uses Gravis Ultrasound compatible patch files and/or SoundFonts (essentially sample libraries) to convert to wave, you get the benefits of a sampling board, and you can turn your MIDI files into well-voiced wavs.

Of course, well-voiced wavs still aren’t completely ready to pull into a loop composition. They need to be edited, manipulated, sometimes warmed and riched, sometimes fuzzed and occasionally pitch-shifted or time-stretched (when the piece starts to deviate radically from what I started with – which happens more often than you may think). Plus there are those direct recorded samples (usually done with something like the built-in Windows sound-recorder) of things like hand drums, didgeridoo, or some weird sound that I thought would be cool. All of these need to be edited before importing and for that I currently use WavePad [Windows]. I used to use Syntrillium CoolEdit (which has now become Adobe Audition) but I couldn’t keep up with the ever rising license costs. So far, WavePad has been able to do everything I need it to do, so I’m not feeling too bad about it. I have also tried Audacity which I love under Linux, but feel the interface of WavePad suits better.

Once I have all my chunks and loops, it’s time to assemble them. For this I use eJay Music Director Gold [Windows]. I have tried other packages (like Acid and FruityLoops) but so far have been pleased with what I can do in Music Director. I may try other packages again some time in the future – but for now I am sticking with what works!

Tools

The best tools for the job

I am often asked by my Linux-using friends why I am using Windows, while my my Windows-centric friends wonder why I am using Linux or BSD and my Mac-user friends ask why I’m not using Mac at all. The answer to the last is easiest – I don’t have a Mac.

As to the other questions, it depends on what I am doing at the moment. I don’t think that Windows is inherently better or worse than Linux or BSD, nor do I think that all software that costs money is evil. I think it all comes down to asking the question: “What is the best tool for the job I am doing?”

With that in mind, here is the first installment in the list of my picks:

Web Development (HTML/PHP/JavaScript): Adobe HomeSite (previously Macromedia HomeSite, previously Allaire HomeSite). [Windows]

I have been using HomeSite for several years now, and despite the changes in company ownership, it continues to be the best tool available for general web development.

In the realm of rapid development, HomeSite has a built-in ftp client, and you can also set it to use a server running locally to see PHP pages and Perl CGI in action. For that I prefer Xampp from ApacheFriends, because of its ease of installation on Windows and the fact that it makes creating a local Apache/PHP/MySQL setup a snap.

The down side to HomeSite is that it doesn’t understand Python/PSP, and changing the tab settings to use spaces instead of tabs seems to be broken in the latest version. I thought it used to do that, but I may be mistaken.

The only tool that comes close is Bluefish [Linux] which seems to be improving in great strides. When I need to whack out a quick web document while in Linux that is the tool for which I reach.

Although Bluefish understands Python it still doesn’t quite work the way I would like it to when highlighting and parsing PSPs. Maybe, when I have the time I can write a plug-in for HomeSite to do just that.

Tomorrow: Music Editing/Creation Tools

evardsson.com: stuff that w0rks