The Suretec Blog - Open Source

Asterisk RealTime LDAP Driver Guide

nospam@example.com (Gavin Henry) — Fri, 25 Jul 2008 20:25:18 +0100

W. Michael Petullo has published a very detailed article for Red Hat Magazine about using the Asterisk RealTime LDAP^[?] Driver and Fedora Directory Server.

It's well written and a good read, but just so you know, OpenLDAP can easily be used and should have been the first choice as I'm sure our partners in crime Symas would point out too

But hey, it's a Red Hat Magazine so you can't blame them really...

Voice over Internet Protocol (VoIP) has emerged as a popular technology for modern voice communications. Many organizations have replaced their analog or proprietary digital telephone systems with VoIP-based solutions. This allows the consolidation of telephone services into an existing IP infrastructure. In addition, using IP to host voice services lets the organization leverage existing expertise–while retaining all of the network’s management advantages. Though not without its disadvantages, VoIP provides a compelling option to those looking for a telephone solution.

This article will present a simple VoIP solution using Asterisk, an open source private branch exchange (PBX) product. It will show you how to install Asterisk, configure it using its LDAP backend, and connect to it using the Ekiga software VoIP client and a Cisco 7900 Series VoIP telephone to make calls.

The first comment about the article is right though:

In general experienced users from the Asterisk community advise against purchasing Cisco phones for business deployment with Asterisk and recommend Polycom, Aastra or Snom instead. Cisco phones are very expensive, difficult to setup, technical documentation is not easily accessible for the end-user, their SIP firmware has some nasty surprises and as far as I know that cheap SmartNet contract is still quite difficult to get.

The LDIF Schema and normal LDAP schema are available in non-FDS format and are contributed to the Asterisk Project by Suretec and maintained by Suretec.

Thanks,

Gavin.

RT: Request Tracker 3.8.0 is Out!

nospam@example.com (Gavin Henry) — Sun, 13 Jul 2008 20:53:05 +0100

Shh. Don't tell anybody, but you can download RT 3.8.0...RIGHT NOW

RT 3.8.0 will be officially released on Monday, but a careless release
engineer seems to have uploaded the final release of RT 3.8.0 somewhat
in advance of the announcement. Now's your chance to be the first
person on your block to deploy the new RT.

On Monday, you'll likely see email and a blog post about all the great
new
features in RT 3.8 - including:

- a redesigned visual style.
- the ability to "star" your favorite tickets, just like
Firefox 3's bookmarks
- comprehensive support for signing, verifying, encrypting
and decrypting email with the Gnu Privacy Guard
- dashboards built out of saved searches, graphs and charts,
which you can share on the web and subscribe to by email
- new saved settings to control how often RT emails you
- pretty visual charts showing the relationships between
sets of tickets
- a WYSIWYG editor for composing replies to tickets
- calendar feeds of task due dates
- per-user timezone settings

...and a whole bunch more neat stuff.

You can download RT 3.8.0 at:

http://download.bestpractical.com/pub/rt/release/rt-3.8.0.tar.gz
http://download.bestpractical.com/pub/rt/release/rt-3.8.0.tar.gz.sig

Best,
Jesse

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitted by a community of users.

Replacing Slurpd using OpenLDAP 2.4

nospam@example.com (Gavin Henry) — Thu, 10 Jul 2008 20:15:26 +0100

I updated the replication section of the OpenLDAP Admin guide last night to the final version discussing Push Based Replication, i.e. what slurpd does in OpenLDAP 2.3 (dropped for various reasons, but since the docs won't be available properly until 2.4.11 is out I'm posting it here.

Read on for more....
Basically with OpenLDAP 2.4 you have two choices:

1. A Master directory, which as you know can have multiple database definitions, therefore a LDAP^[?] Proxy included:

Your slapd.conf or cn=config can list your normal LDAP database and also a back-ldap^[?] database which sucks in data via Syncrepl pointing to the main URI and pushes changes out via the back-ldap uri, hence "Push-based".

2. If you don't have access to the master directory or you aren't setting up a new deployment, you can create a standalone LDAP Proxy that does the same as above:

So, for method 1.:

CODE:

####################################################################### # Standard OpenLDAP Master/Provider ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats database hdb suffix "dc=suretecsystems,dc=com" directory /usr/local/var/openldap-data checkpoint 1024 5 cachesize 10000 idlcachesize 10000 index objectClass eq # rest of indexes index default sub rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw testing # syncprov specific indexing index entryCSN eq index entryUUID eq # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database monitor database config rootpw testing ############################################################################## # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap ############################################################################## database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=suretecsystems,dc=com" rootdn "cn=slapd-ldap" uri ldap://localhost:9012/ lastmod on # We don't need any access to this DSA restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=suretecsystems,dc=com" credentials=testing syncrepl rid=001 provider=ldap://localhost:9011/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=testing searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" overlay syncprov

Corresponding Slave config:

CODE:

####################################################################### # Standard OpenLDAP Slave without Syncrepl ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats database hdb suffix "dc=suretecsystems,dc=com" directory /usr/local/var/openldap-slave/data checkpoint 1024 5 cachesize 10000 idlcachesize 10000 index objectClass eq # rest of indexes index default sub rootdn "cn=admin,dc=suretecsystems,dc=com" rootpw testing # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited updatedn "cn=replicator,dc=suretecsystems,dc=com" # Refer updates to the master updateref ldap://localhost:9011 database monitor database config rootpw testing

Possible ACLs:

CODE:

# Give the replica DN unlimited read access. This ACL may need to be # merged with other ACL statements. access to by dn.base="cn=replicator,dc=suretecsystems,dc=com" write by break access to dn.base="" by read access to dn.base="cn=Subschema" by read access to dn.subtree="cn=Monitor" by dn.exact="uid=admin,dc=suretecsystems,dc=com" write by users read by none access to by self write by * read

Method 2:

CODE:

####################################################################### # Standard OpenLDAP Master/Provider ####################################################################### include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/slapd.acl modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload syncprov.la moduleload back_monitor.la moduleload back_ldap.la pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args loglevel sync stats ############################################################################## # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap ############################################################################## database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=suretecsystems,dc=com" rootdn "cn=slapd-ldap" uri ldap://localhost:9012/ lastmod on # We don't need any access to this DSA restrict all acl-bind bindmethod=simple binddn="cn=replicator,dc=suretecsystems,dc=com" credentials=testing syncrepl rid=001 provider=ldap://localhost:9011/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=testing searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" overlay syncprov

And point the above to the same kind of slave using the already listed config.

Anyway, more explaination will be in the Admin Guide when 2.4.11 comes out.

Thanks,

Gavin.

Suretec Systems.

LDAP, Mark Spencer and Asterisk

nospam@example.com (Suretec) — Thu, 26 Jun 2008 20:13:37 +0100

In Interview With Asterisk Founder, Mark Spencer:

3) What improvements would you personally like to see in any upcoming releases? Perhaps Active Directory or LDAP^[?] integration?

LDAP, Clustering Events, and Video are three areas I'm especially interested in in terms of the core of the software. I'm also interested in ways to make Asterisk even more approachable for new developers of either core functionality or new systems utilizing Asterisk.

Suretec agree and are trying to help.

[...]I think a low-cost Asterisk unified communications solution is a perfect opportunity for Digium. Thus, perhaps something called Asterisk UC Edition might be a good name. Your thoughts on this idea?

[....]we want the core of Asterisk to remain Open Source and as such encourage the development of Open Source technologies wherever possible. I believe it would be foolish to attempt to make Asterisk's innovation only available as a proprietary product when clearly it is its Open Source foundation that made it so successful and continues to do so[...]

Excellent to hear!

[...]Mark didn't take my idea of offering a "premium" UC (closed) version of Asterisk, that I felt would give Digium a potentially strong revenue source, I found it very fascinating that Mark continues to hold the "open source" mantra flag high. This only re-confirms Mark's (& Digium's) strong commitment to keeping Asterisk 100% open source that Mark stressed to me[...]

Of course, as it should.

I have to commend Digium for sticking to their 100% open source guns, but honestly, I don't think anyone would begrudge them if they copied the SugarCRM/MySQL/Movable Type model where they offered an open source version and a premium (closed) version. Ok, maybe some open source zealots would.

Suretec would, as would everyone else. Keep it 100% Open Source.

Why BBC is Microsoft Media (Video)

nospam@example.com (Suretec) — Wed, 25 Jun 2008 22:25:31 +0100

Very interesting - Why BBC is Microsoft Media (Video)

Schools Open Source Project farce roundup

nospam@example.com (Suretec) — Mon, 16 Jun 2008 11:52:46 +0100

Open Source UK attacks schools quango

Educational open-source contract "a sham"

Flexi Time Manager Shortlisted for National Business Award

nospam@example.com (Suretec) — Fri, 13 Jun 2008 13:59:56 +0100

Flexi Time Manager "in the pink" after shortlisting for National Business Award

Entrepreneur Louise Wreathall has been shortlisted for the ‘Best Mumpreneur’ award at the National mother@work awards 2008. Louise, creator of Flexi Time Manager, which offers an online flexi time recording service, launched her business last year and has seen it go from strength to strength. She will attend a reception at 11 Downing Street on 18th June, where the winners will be announced.

Louise says, “Being shortlisted for this award means so much to me. Of course I’d be thrilled to win, but reaching the final stage itself shows that my work in getting the business where it is today has paid off.”

As a working mother who returned to work after a career break, Louise knows how important flexi time can be. Working in the HR department of a charitable organisation, she was responsible for administering a time consuming flexi time system for 30 staff, using scraps of paper and mental arithmetic to calculate hours worked. When staff numbers doubled, she knew something had to change, and set about creating an electronic timesheet system. By 2005, Louise had set up the business and set about trialling her own online time management system. With the help of Enterprise North East Trust, and local networks Women Into Business and Aberdeen Entrepreneurs, she learned the fundamentals of business management, finally launching the fully tested web application in November 2007.

Suretec designed and implemented the Flexi Time Manager Solution.

Becta schools deal stuns British open-istas

nospam@example.com (Suretec) — Fri, 13 Jun 2008 13:58:51 +0100

The open source community is up in arms today following Becta’s decision to award its open source schools project to a little-known consultancy firm.

Solutions for creating a Samba4 OpenLDAP backend

nospam@example.com (Gavin Henry) — Thu, 12 Jun 2008 15:16:43 +0100

Things are looking better for the future of Samba and OpenLDAP working together:

If we get this much done, then I think Samba4 and OpenLDAP can continue
the forward march. I look forward to having Samba4 'powered by
OpenLDAP', because without it (or a Fedora DS backend, with whom I'm
having a similar discussion) Samba4 does not have a replicated
deployment modal.

[asterisk-biz] Open letter to digium, asterisk developers and consultants

nospam@example.com (Suretec) — Wed, 11 Jun 2008 21:39:06 +0100

There an interesting thread going on just now over on the Asterisk Business List:

I am writing this letter to Digium and all those that use or develop
software for Asterisk. Asterisk is released under a dual license, the
one I will focus on is the GPL license.

Digium maintains a trademark on the word Asterisk, along with other
words. The trademark policy they have forbids marketing a product with
the asterisk word if it is not "Genuine Digium Software". If you modify
software, apply a patch, add 3rd party modules, this trademark policy
prevents you from distributing that software saying that its based on
asterisk, or even using the name asterisk within the program.

The most interesting part is that there is an unofficial response from Digium's john Todd and an official one coming:

I would agree that we have failed to make this as obvious as we
should, and that will be a topic of discussion and possibly
clarification in the document. Our intention has never been to lock
the word "Asterisk" so that it is impossible to use - that is not our
goal, nor is it possible legally. If you are a consultant who works
with Asterisk, by all means please put that on your website and in
your CV! We encourage that type of use; it broadens the Asterisk
ecosystem. Using the word "Asterisk" in a statement of factual use
is not prohibited - you can say "My company works on developing code
and systems which utilize Asterisk." However, when it becomes used
as a descriptive term such as "Asterisk Enabled" then that does seem
like it is an infringing use. More on this in the follow-up reply to
this soon to come.

We'll keep you posted on just how you can use the word Asterisk^®

Vote OpenLDAP for the 2008 Community Choice Awards!

nospam@example.com (Gavin Henry) — Tue, 10 Jun 2008 16:11:55 +0100

To vote for the OpenLDAP Project click the following:

LDAP Roundup

nospam@example.com (Gavin Henry) — Thu, 05 Jun 2008 20:30:09 +0100

Some interesting reading in the LDAP^[?] Sector tonight that is worth noting:

- Excel LDAP Search 0.56

This is actually pretty cool. Does OpenOffice.org have one? Almost.

- Windows Server 2008 - Active Directory certified for the BC-LDAP-USR Directory Interface for User Management

I find this post funny, as SAP already say "SAP's directory interface lets you consolidate user data from SAP systems with data from directories that implement the Lightweight Directory Access Protocol (LDAP)."

Active Directory, implement LDAP? They don't even get it right with ADAM^[?].

So why is it certified when any Directory Server will do?

- OpenLDAP Configuration Automation

Why is this interesting? Well it's already on an OpenLDAP TODO list.

- Six Questions on building Identity Enabled Applications...

Here some quick answers, I'm sure others will have deeper replies:

- Protocols:Nowadays, the folks over at the Burton Group such as Bob Blakely, Dan Blum and Gerry Gebel have put together the most wonderful XACML interoperability events. The question that isn't addressed is if I am building an enterprise application from scratch, should I XACML-enabled, think about integrating with STS, stick to traditional LDAP invocation or something else?

I would ask what problem is the application addressing? What protocols are actually needed for it to provide a solution and what does the customer want?

Anyway, I'm not sure how industry wide XACML has been adopted (that's mainly due to my lack of exposure to it and doesn't imply that it's not), but LDAP isn't going anywhere.

- Virtual Directories: What role should a virtual directory play in an Identity metasystem? Should virtual directory be a standalone product in the new world and simply be a feature of an STS? If an enterprise were savage in consolidating all directory information into Active Directory, why would I still need virtualization?

Point by point: Virtual Directories help with data consolidation, that is their role. I think yes, standalone where it is needed. I don't think any enterprise should be that dumb.

- Entitlements: One missing component of the discussion is authorization and their is somewhat too much focus on identity. Consider the scenario where if you were to ask my boss if I am still an employee, he would say yes as he hasn't fired me yet. Likewise, if you ask him what are all of the wonderful things I can access within the enterprise, he would say that he has no freakin clue, but as soon as you figure it out, please let him know. Honestly, even in my role, there are probably things that I can do but shouldn't otherwise have access to. So, the question becomes how come the identity conversation hasn't talked about any constructs around attestation and authorization?

I think because it always comes down to what the application is trying to do and the fact that these applications tend to do it all internally. There's more discussion over at SAML and Federated Identity Part 2 - Identity Management

- Workflow: Have you ever attempted to leave a comment on Kim Cameron blog? You will be annoyed with the registration/workflow aspects. The question this raises in my mind is what identity standards should exist for workflow? There are merits in this scenario for integrating with the OASIS SPML standard, but I can equally see value in considering BPEL as well.

I think there are too many XXXL all seem similar BPEL and SPML. Trying to keep up with these let alone write applications that use them would be a nightmare.

- Education: Right now the conversation regarding identity is in the land of geeks and those who are motivated to read specifications. There is a crowd of folks who need things distilled, the readers digest version if you will. Traditionally, this role is served by industry analysts such as Gartner and Forrester. What would it take for this guys to get off their butts and start publishing more thoughtful information in this space?

Time, Money? Won't it still be the geeks that read them anyway? The people that make the decisions don't have time

- Conferences: When do folks think that the conversation about identity will occur at other than identity/security conferences? For example, wouldn't it have been wonderful if Billy Cripe, Craig Randall and Laurence Hart where all talking about the identity metasystem in context of ECM?

Sometimes it's hard to talk in the short time conferences last. What do you suggest? Maybe worth trying to get the ball rolling.

That's all I have time for tonight, not much but something for a quick read.

Gavin.

Resist Software Patents in the UK

nospam@example.com (Suretec) — Sun, 25 May 2008 21:53:32 +0100

We the undersigned petition the Prime Minister to ensure that the UK resists any attempt by the European Patent Office to introduce software patents.

Running a business on desktop Linux

nospam@example.com (Gavin Henry) — Mon, 12 May 2008 13:26:24 +0100

There is much more to cost equation than the up-front price you pay. Microsoft has done an outstanding job of hiding the true costs of its software from consumers. Linux eliminates these hidden costs from Windows:

Fewer security and privacy problems

No loss of support as systems age

No problems running current software on older computers

No forced software and hardware upgrades every couple years

No system slowdown over time (due to Registry bloat, malware, or other causes)

No forced upgrade of one product due to artificial coupling with another ("Installing this product requires IE 8!")

No need to re-install the operating system due to software corruption

No performance costs from built-in digital rights management (Vista Content Management)

No worry about whether you understand the legalistic license terms

No buying multiple licenses for desktop and laptop, or for primary and backup systems

No risk that the software CD you purchased in good faith is counterfeit

No system outages due to inaccurate license checks by Windows Genuine Advantage

No errant "piracy pop-ups" when you're running legal software due to Microsoft's Office Genuine Advantage

No restrictions on computer upgrades (no Windows Product Activation / Windows Genuine Advantage)

No restrictions on disk image backups (no WPA/WGA or Registry problems)

No restrictions on moving disks between computers during upgrades (no WPA/WGA or Registry problems)
Linux empowers you to run your business on low-cost computers that are deemed worthless within the distorted perspective of "Windows world." I'm writing this article, for example, on a Pentium III. It runs Ubuntu just fine, and it runs Puppy Linux fast as a scalded greyhound.

Original article

London council dumps Microsoft

nospam@example.com (Gavin Henry) — Sat, 19 Apr 2008 20:05:57 +0100

Flagship contract failed to deliver, Vista partly to blame