Pycharm 3.02 on OpenIndiana

The IDE

Working on the Ajax module of Brython (and multilingual documentation)

Requirements

PyCharm, the free community edition and the professional versions simply require a Java JDK. I use the Oracle (Sun) JDK7 on OpenIndiana.

Installation

The only challenge is downloading the tar.gz file. By faking the user agent to firefox for linux, the download link appears:

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0

Then it's a matter of gunzip and tar -xvf and moving the directory to /opt and running pycharm.sh in the bin folder.

Francois
@f_dion

Illumos on RaspberryPi

Starting point

I have now dedicated two Raspberry Pi to work on some bare metal (C, assembler, no operating system) code. I'm hoping that publishing some of this work will help to start somekind of an effort to get the OpenSolaris ARM code out of the mothballs.

IllumOS

Obviously, long term will be to get the IllumOS kernel booting, but there is a lot of work between now and then.

On this blog

So, usually I post all the Raspberry Pi stuff on the Raspberry Pi Python Adventures blog, but I want to keep it mostly Python, with the occasional C code (swig etc). Since we are going bare metal, I think it'll be better if I track this stuff here.


@f_dion

Git error setting certificate verify location

Problem

Under OpenIndiana, you might have  tried a git clone https://github.com/something....

and got this:

Cloning into something...
error: error setting certificate verify locations:
  CAfile: /etc/curl/curlCA
  CApath: none
 while accessing https://github.com/something....

fatal: HTTP request failed

Solution

The  fix is easy:

su
Password:

mkdir -p /etc/curl && cat /etc/certs/CA/*.pem > /etc/curl/curlCA

Glassfish 3.1.2

Have you installed Glassfish 3.1.2 on a Solaris variant? For one thing, it has SMF integration, that is, it creates (optionally) a service that can be controlled by svcadm. And then there are the functionalities that are available on all platforms. For example, clustering (both on the open source edition and oracle supported versions). So, basically, it is just a matter of downloading the file and then, as root (or sudo or pfexec depending how you are set up):

# sh glassfish-3.1.2-unix-ml.sh

Extracting the installer archive...

Extracting the installer runtime...

Extracting the installer resources...

Extracting the installer metadata...

Welcome to GlassFish installer

Using the user defined JAVA_HOME : /

Entering setup... SwixML 1.5 (#144)

This will bring up the usual GUI installer (assuming you are installing in the global zone, or you ssh -X to your zone). Make sure you select custom instead of express install. Now, this is pretty straightforward, and wouldn't merit a blog entry, but I wanted to bring up at least one thing that might stump you if you are installing in a solaris container / zone. The web admin (port 4848) expects localhost, as in http://localhost:4848, else it will error out. If we are in a zone, it is not too convenient. Sure, you could do an ssh -X zone_name and then run firefox from the zone:

# ssh -X server1

Oracle Corporation SunOS 5.11 11.0 May 2012

user@server1:~$ firefox -no-remote

This will launch firefox from the zone. Without the -no-remote, firefox will run in the global zone, and the login to the admin console will fail: Error Configuration Error Secure Admin must be enabled to access the DAS remotely. Again, you could do that... A better approach is to enable access through the host (zone) name instead of localhost. How?

cd /opt/glassfish3/bin

./asadmin --host server1 --port 4848 enable-secure-admin

Replace server1 by the hostname of the zone and you are almost there. For the change to take place, a restart of the app server is required. Easiest is reboot of the zone, but hold on! We have to make sure the service is enabled:

user@server1:~$ svcs domain1Service

STATE STIME FMRI disabled 13:35:17 svc:/application/GlassFish/domain1Service:default

user@server1:~$ su

root@server1:~# svcadm enable domain1Service

root@server1:~# svcs domain1Service

STATE STIME FMRI offline* 15:15:10 svc:/application/GlassFish/domain1Service:default

root@server1:~# svcs domain1Service

STATE STIME FMRI maintenance 15:15:19 svc:/application/GlassFish/domain1Service:default

The first time around it will be in maintenance, because glassfish is already running. We issue a reboot command in the zone and once it comes back up:

user@server1:~$ svcs domain1Service

STATE STIME FMRI online 15:18:11 svc:/application/GlassFish/domain1Service:default

That is it. We can now access http://server1:4848

Sun Studio 12 is now available

The Sun Studio 12 software suite delivers high-performance, optimizing C, C++, and Fortran compilers. Studio 12 marks a really important jump from Sun Studio 11 as far as the environment itself is concerned. This is based on the more recent Netbeans 5.5+ and is an incredible tool. Through the Sun Studio Express program, and then through the Early Access program, I was able to experience firsthand all the enhancements and new features over the course of the last 5 months. The performance of the resulting compiled applications is really phenomenal, even on 64 bit AMD and Intel processors.

It is now the development environment to beat when it comes to native applications, under Solaris or Linux. Although there are currently no version under windows, I wouldn't be surprised if one did materialize. We've ditched MS Windows and MS Visual Studio on all desktops, and now enjoy increased productivity. Sun Studio 11 did provide the performance, but it didn't provide the level of user friendliness that Sun Studio 12 now provides. It is not perfect, but it is a really solid product.

Sun is on a roll, providing once again best in class software, but at a surprisingly low cost: free.

In the coming weeks, I will mention some specific tools or aspects of Studio 12, stay tuned.

As of today, you can download it here:
Sun Studio Download

or request a media kit here, for free (I will have to confirm if this includes the just released Sun Studio 12 or 11):
developers.sun.com

Solaris Express Developer Edition (2/07)

Well, it is finally available. I had mentionned before on SunQuebecthat the next release of Solaris Express would be interesting, and the reason is: the DVD now includes Sun Studio 11 and Netbeans 5.5. So it is now a complete environment.

It can be found here:
http://developers.sun.com/solaris/downloads/solexpdev/

This build also includes firefox 2, star office 8, and Sun is trying to appeal to LAMP developers with SAMP (Solaris, Apache, MySQL et PHP). Sun Web Server 7 is available and Postgresql has been included for a while now, so it's not a huge addition, but it makes for a pretty complete distribution.

Currently it is only x86/x64, but you can get equivalent functionality under Sparc with Solaris Express Community Edition B55 and above. I have B56, but B57 is now available.

The next Community Edition to keep an eye out for will be B60. This will include bootable ZFS for x86/x64, and I would guess it might appear in Solaris Express 4/07 if I understand the revision cycle, altough I now read that Solaris Express will now be quarterly so that might be 5/07.

François

Secure By Default

Learn to love SBD.

When doing the initial install of Solaris 10, select the secure by default (SBD) option. If this is Solaris Nevada, no option is given, it will be (mostly) secure by default. If the install is an upgrade, then it will not change the previous install. To activate the secure profile, run the following:

# /usr/sbin/netservices limited

Note that this will only allow local smtp and rpc, and only ssh remotely, so be careful if you are on a production box, everything else is tight.

Why should you care? Because you are safe from the latest Solaris 10 hack. If you haven't heard of it yet, you might want to search the web and learn more. Basically, it enables an attacker to telnet into a Solaris 10 machine.

I decided to head over the OpenGrok OpenSolaris source code browser, and look at login.c:
In login.c:

524 /* ONC_PLUS EXTRACT START */
525 /*
526 * validate user
527 */
528 /* we are already authenticated. fill in what we must, then continue */
529 if (fflag) {
530 /* ONC_PLUS EXTRACT END */
531 if ((pwd = getpwnam(user_name)) == NULL) {
532 audit_error = ADT_FAIL_VALUE_USERNAME;
533
534 log_bad_attempts();
535 (void) printf("Login failed: unknown user '%s'.\n",
536 user_name);
537 login_exit(1);
538 }
539 /* ONC_PLUS EXTRACT START */
540 } else {
541 /*
542 * Perform the primary login authentication activity.
543 */
544 login_authenticate();
545 }

So as long as the f flag is set, it never does the login_authenticate(). If that option was somewhat injected in a string...

1399 case 'f':
1400 /*
1401 * Must be root to bypass authentication
1402 * otherwise we exit() as punishment for trying.
1403 */
1404 if (getuid() != 0 || geteuid() != 0) {
1405 audit_error = ADT_FAIL_VALUE_AUTH_BYPASS;
1406
1407 login_exit(1); /* sigh */
1408 /*NOTREACHED*/
1409 }
1410 /* save fflag user name for future use */
1411 SCPYL(user_name, optarg);
1412 fflag = B_TRUE;
1413 break;

Quite the punishment for trying, no? This is similar to an old rlogin issue.

Sun Studio now has a thread analyzer that does race detection and other similar complex detection of problems in your code. Maybe security hole detection should be next? :)

So why did this come back?

54 * -f : This flag was introduced by PSARC 1995/039 in support
55 * of Kerberos. But it's not used by Sun's Kerberos implementation.
56 * It is however employed by zlogin(1), since it allows one to tell
57 * login: "This user is authenticated." In the case of zlogin that's
58 * true because the zone always trusts the global zone.

So if you are running Solaris secure by default and have not re-enabled telnet, you are safe.

Learn to love SBD.

______________________________________

Update:

For Tpatches and details from the sausage factory, see this blog:
Alan Hargreaves - the in.telnetd exploit