Set Up Ubuntu-Server 6.10 As A Firewall/Gateway For Your Small Business Environment

Set Up Ubuntu-Server 6.10 As A Firewall/Gateway For Your Small Business Environment

This tutorial shows how to set up a Ubuntu 6.10 server (“Edgy Eft”) as a firewall and gateway for small/medium networks. The article covers the installation/configuration of services such as Shorewall, NAT, caching nameserver, DHCP server, VPN server, Webmin, munin, Apache, Squirrelmail, Postfix, Courier IMAP and POP3, SpamAssassin, ClamAV, and many more.

Link to Set Up Ubuntu-Server 6.10 As A Firewall/Gateway For Your Small Business Environment

I am almost curious enough to try this. Throw in a little Samba and you have a pretty good SBS competitor although it might be a tossup to use an inexpensive NAS box for the file sharing instead. The turn-off was the 11 pages of cut-and-paste instructions. Of course, the entire installation is done via the geek’s old friend, the command line. I guess my age is showing. I am spoiled with the ease of using Wizards to install and maintain computer systems.

VMware Delivers Free VMware Server

VMware Delivers Free VMware Server

I have become a fan of VMware. I have used VirtualPC in the past but became interested in their products when they offered VMPlayer for free. When they offered free usage of the server product and encouraged the VMTN appliance community, I switched.

My use has generally been in two areas:

  1. Testing new slipstreamed installations of Win XP.
  2. Playing with pre-built appliances.

The first appliance I started playing with was Asterisk at Home or now know as Trixbox. I have downloaded several versions over the last couple of months using BitTorrent. There is a bit of learning curve for this product and I did not want to waste time setting up a test box. There is a market for supporing this product but I do not have a customer right now.

The second appliance I have started playing with is a couple of Nagios/Groundworks variants. Nagios is an open source network monitoring program and Groundwork Open Source is a free version of a commercial variant of Nagios. Due to some recent discussions I had with my son in which he maintained that our internet access sucked, I decided to investigate the matter further. I originally downloaded a prebuilt Groundwork Open Source system by Tony Su of Su Network Consulting. The good news is that he had built it. The bad news is that he released it as a virtual disk drive rather than a virtual appliance. As a result it was a little harder to set up than Trixbox. To compound the problems the network adapter needed to configured before it would do anything. Trixbox configured the network adapter during startup so this was new territory for me since this was a SUSE box.

Along the way I found a posting about baywatchos. It was a Groundwork Open Source system built upon Centos which is the same operating system used by Trixbox. My familiarity with Centos and the fact that it had Webmin already installed were pluses for me. The author even provided a nice Getting Started document in English. After a brief configuration I had it working. Gianluca, you did a fine job!

My next project will be to move these virtual appliances to my ghetto box and see how well they run. This should be amusing. Groundwork has some pretty stiff hardware requirements.

Helix – Incident Response and Computer Forensics Live CD by e-fense™, Inc.

Helix – Incident Response & Computer Forensics Live CD by e-fense™, Inc.

I was researching the Linux command, dd, and GParted because I wanted to migrate some data on old disk drives to my new disk drive and to see if I could copy a drive and debug a hardware/software problem on a PC I am working on. There are existing Windows solutions but I was curious about the state of the art on Linux.

I originally tried Ubuntu but GParted did not copy the partition for me?! I then went to Gparted Live CD and it worked for the NTFS partition I was playing with. The Linux partition was a bit more complicated. It is the LVM partition I used for my Fedora Core 4 installation and Gparted will not copy LVN partitions. Hmm…bummer!

I briefly tried the LVM commands to add a new LVM physical drive to the volume group and move the data from the existing LVM physical drive to the new drive. It did not work for me and with some more work I am pretty sure I could make it work since that is one of things LVM should be able to do. However, my interests in cloning the drive were very similar to copying the drive for forensic work so I decided to see what the Pros use for creating copies of disk drives. That led me to Helix.

I had previously downloaded and played with Helix 1.5 and 1.6. Helix 1.6(Knoppix) had problems with correctly recognizing my CD-ROM so I downloaded the newest version to see if it did a better job with the CD-ROM and to see if they had a frontend tool for dd/dcfldd. The CD-ROM worked and I found a frontend acquisition tool called Adepto. Adepto is an improved version of AIR – Automated Image and Restore which is also on the disk. So I cloned the old hard drive.

Mounting cloned drive was a little hard under Helix. I had to:

sudo vgscan
sudo vgchange -a y

before I could:

sudo mount /dev/VolGroup00/LogVol00 /media/sda3

Mounting the partition under Ubuntu was much easier. Now to go clone a copy of the PC’s disk drive I want to troubleshoot.

RE: Linux vs. SBS: Switch!

Excellent point brought up in the comments section today by Josh:

For example, Microsoft wants to argue about stability vs. Linux. In nearly all Linux servers we manage that comparison is laughable. Now, compare RPC-over-HTTP functionality with Linux? You can’t, no such thing on Linux! Where is that among the facts?

This is something that I’ve tried to make very painfully clear in my Linux presentations for SBSers in Florida groups. Here is the thing about winning in small business, you have to know your customers. You also have to know your Microsoft and understand certain “facts”. So here is a little competitive howto on Linux vs. SBS.

Watch Where You Get Your Facts

First and most important thing to understand about Microsoft’s Get The Facts site is that those reports have been paid for by Microsoft and are to a large extent questionable at best and outright false in many respects. Second thing to remember is that those reports are not written or targeted for the SMB market at all – they are written to discourage enterprise and high-end markets from moving their commodity-line servers to Linux and discourage Unix-shops from going to Linux instead of Microsoft. If you’re an SBSer, you will not find your facts there.

Know Your SWOT

Know your strenghts, know your weaknesses… but more importantly know what is not your weakness.

Price

When bidding against Linux you are really competing against this: “Joe Consultant told us that Linux is free.” They are correct, many Linux distributions are free. So in most cases, it will be $599 vs. $0. For the purchase price that is. So on the face of things, Linux wins because its free.

When you dig a little deeper you find out that the “free” is the acquisition cost. If you are losing a client over $599 this is likely a client that you do not want as your business to begin with. If the server costs $1,800 and your labor to set them up and train them for a week will cost them another $4,000 that up-front licensing cost of $599 is going to be less than 10% of the total solution. This is generally what Microsoft talks about when they mention their TCO, total cost of ownership.

But we know our small business owners, don’t we? The same folks that will sign up for a plan with a “free cell phone” (MSRP $99) but agree to a two year contract that costs $20 a month more. If you really want to compete against Linux give them a 10% discount on your labor which will outright displace the licensing costs. Show them that they will be paying the Microsoft penalty anyhow as its very hard to impossible to buy a PC without a Microsoft OS to begin with. 

Upgrades and Migrations

When you bid against Linux you bid against free upgrades, forever, and easy migrations. Thats at least what gets put on the paper and what the Linux guy will say. The truth is much different. Here are a few facts that you might want to consider about some of the most popular Linux distributions out there:

Fedora – Fedora is a free version of Redhat Linux. Redhat Enterprise Linux is a full tested and supported distribution of Linux that retails between $350 and $3000 per server. So whats the difference? Redhat uses Fedora as their bleeding edge distribution, they use it to roll out experimental packages and see what breaks. The software itself is solid, but it is not elegant by a long shot. For example, consider that there is no migration path from version 3 to 4 to 5 – if you Google for “upgrade from FC3 to FC4” you will find a number of hacks that show you how to fool the dependancy checks and hack your way up. Not that it won’t work, but what happens if it fails? Remember, unsupported. There is literally nobody you can call.

Debian – Used to be most popular but recently displaced by its Ubuntu cousin. The trick with Debian is that they are so fanatical about being free that they eliminate any commercial or restricted software (or non GNU) from the base distribution. It is a severly outdated technology (in terms of even years) that nearly everyone seriously running Debian is doing so with the untested– or experimental– branches of the code. Even if you’re not a Linux person you can imagine what thats like. Again, virtually unsupported except for the MVP-like effort.

Gentoo – The concept here is that this is the most optimized version of Linux you can get because virtually everything from kernel on up is upgraded by running an emerge command. What emerge actually does is pretty cool – it downloads the source code along with a spec and compiles it against your hardware – so on a fairly loaded box you are constantly affecting the performance by rolling out your own code. Do you trust that your security patches are deployed as full recompiles of the source code? I don’t even trust most binary patches.

Ubuntu – The darling of the Linux world at the moment. Built on the Debian core with the pretty integrated interfaces and its claim to fame is the ability to roll out LAMP (Linux, Apache, MySQL and PHP) in 15 minutes. Pretty, but unsupported.

Those are the basics of Linux and distributions you will likely come up against. Every now and then someone will propose an Enterprise Linux version, a free community recompile of the popular Redhat Enterprise Linux. Distributions such as CentOS and WhiteBox Enterprise Linux. They are free, but again, unsupported as well.

So here is a real world scenario for you. The upgrade for the above is free– in all cases. They will download an ISO, burn it, stick it in a Linux server and after the reboot the system will be upgraded. All free! Yay.

As far as the technical discussion is concerned, they are right. Here is the dirty secret behind this though that nobody talks about: For most scenarios Linux doesn’t migrate, Linux overwrites. Now lets say your consultant tweaked the /etc/rc.d/rc.local file to automatically delete specific files on the server – generally a Linux distro upgrade would put in the new file in the place and make the original one a rc.local.bak. Let’s say you wanted something special done with your web server – your /etc/httpd/conf/httpd.conf file would have two options – it would get overwritten, or they would copy an httpd.conf.orig or tweak it in another way.

So yes, the upgrade is free. But the time to get this done is not. More importantly, because these migrations are generally done on per-site basis (ok, these guys have Redhat, these are on Fedora, these are on Gentoo) the migration checklist is all but nonexistant.

The truth about Linux deployments is that they are very much done on a per-case, needs basis. The beauty of the system (unlimited flexibility) is also its dagger because by endlessly tweaking the system the documentation part of the setup goes out the window. And when the migration goes bad with the freebies above you will likely have only newsgroups and mailing lists to turn to.

Finally, migrations nearly always include more than the base OS. The reason you deploy a Linux system is to get a flexible, fast and cost effective server. Well, Linux developers don’t think the same way business owners do. Linux developers try to adapt new technology, provide the newest features, create a system that is easiest and fastest to develop for. So when that new distribution comes with MySQL 5.0 and PHP 5.0 – will your PHP 4 script designed on MySQL 3.1 work? Maybe, maybe not. Who do you contact to find out – the webmaster that took the script from some random site? Nope. The commercial software developer? Unlikely, they only support official distributions like Redhat Enterprise Linux and SuSe. Who do you turn to? Good question to ask while providing a competitive bid.

How do you do application migration compatibility tests on Linux? You install the new version and try to hack it into working. If you’re lucky, it will just work. If you’re not lucky, whats the alternative? Another question for the stack. This is not the U part of FUD in uncertainty, this is something that there is no good, reliable, documented process in Linux. For years Linux distributions have tried to fight amongst themselves to develop a unified way that Linux is deployed – with same file system layout, dependancy checks, package management. Today you’re more likely to find multiple package management systems (yum up2date, apt).

Features

For the most part this is your biggest strength. Small business owners and business people in general have habbits that are hard to change. Going from a Windows world to a Linux world is a big transition in anything more complex than a P2P environment. Its easy to replace a pop3 server with an onsite dovecot deployment. But when you’re selling a new server you are selling new functionality. Here are things that you will not find in Linux.

Exchange – Biggest advantage. There are no decent webmail programs for Linux – the best one to date is Scalix and it costs about as much as Exchange does. It does not provide RPC-over-HTTP, it does not provide cached mode, it does not provide advanced connectivity to mobile devices.

ISA – For the most part almost all Linux firewalls are connection based firewalls, nothing provides application-level security. So yes, if you want to block people from going to certain sites, Linux will cut it. Try to set those restrictions in place per employee per hour (ie, no espn updates for Joe between 9AM and Noon) you’ll be SOL.

WSUS – Exists on commercial Linux distributions as a Satellite server but almost all are desktop triggered up2date updates via cron – no ability to see which software is running on which system and no ability to restrict what goes on which workstation without manually adjusting workstations on per-case basis. No grouping. No reporting on which patches failed and no reporting on what may be out of compliance. These could be hacked together but do you really want to hack your security solutions together? Do you think your customers would?

IIS – The biggest reason to deploy LAMP is to get PHP and a free SQL server. Both of those run quite reliably on Windows as well and you can install WAMP on Windows. My personal dev environment for Linux is based on Vertrigo server which rolls out as a single install. So if thats all you need to deploy a new forum, blog, or a survey package your customer saw somewhere – this is the way to do it. And it’s free too. But feature is an advantage here – you have a choice. ASP or PHP? On Linux you have no ASP advantage (they use Chilisoft, Sun’s poor hack of ASP) nor do they have any .NET compatibilities without hacking in mono – but skip back to migrations and upgrades – whats the guarantee that your app will run on a hacked server? Now compare that with IIS. If you’re really familiar with IIS this is almost impossible to do. The cost of a second IIS server is not that great to begin with, Windows 2003 Server Web Edition retails for less than $300 which is likely less than two hours of any consultants time. You’d end up charging them more to download an ISO and read the intro parts of the Apache documentation.

Bus Features

When I worked at Dial ISDN I used to write “If Vlad Gets Hit By A Bus” documentation for everything I did. Why? Because all of our Linux servers were so heavilly tweaked that in case something happened there was no way on earth someone would be able to figure out how I’ve implemented my patch management, version control, monitoring, account creation and race conditions.

How much documentation will the Linux deployment come with? How long will it take someone else to replicate the setup on a new system? What commercial contacts do you have that will validate what you say about Linux? How many “user-geared” books are there on Linux that can get me going with this server immediately? SMB owners are DIY-centric, how much of this can I do through a GUI?

Final question: Give me a place to find other professional Linux consultants.

Where you have hundreds of Windows guys in every area there are only a few Linux solution shops. Most of the “Linux guys” will be people with careers and full time jobs that do consulting on the side and are saving your money out of the goodness of their heart. These are also the types you turn to for support. Do you want to run your business on goodness of strangers or do you want a contract? If you want a contract the savings will go out the window.  

Conclusion

Linux provides a cost effective, flexible and powerful server operating system and Microsoft’s FUD about it is largely a collection of paid distortions, some quite well documented as outright lies. Microsoft will not offer competitive sales support to SMB solutions that are under $10,000 in licensing so you’re on your own. They will also not discuss any of the above because of the irrational fear that if you experience a competitive solution you might find enough in it that you like to leave Microsoft.

On the other end of the fence you have, by comparison, a relatively innovative but young solution that lacks the standardization, unity and certainty with many of its supposed solutions. While the core of it is solid the biggest lacking factors for small businesses are in the areas of available expertise and support systems to fall back on when there are problems. In the areas of affordable business intelligence Linux is behind enough to make it unattractive beyond file servers, basic pop3/imap mail servers and popular web applications. 

In the end, both sides will lie, cheat and FUD to get their points accross. Your advantage is in knowing your customer, knowing their needs, and showing them the solution that will not only solve their problems but be ready for the problems they will encounter as they grow. For what its worth, I’ve been a Linux system administrator for three years longer than I’ve been a Windows guy and work on both platforms daily. 

[Via Vlad Mazek - Vladville Blog]

RE: Distribution Release: Ubuntu 6.06 LTS

Right on schedule, Ubuntu 6.06, a distribution with long term support features, has been released: “Ubuntu, which has become one of the world’s most popular Linux distributions in recent years, launched its latest version on June 1 following months of intense testing. The new release is titled Ubuntu….

[Via DistroWatch.com News]

Yup! I downloaded this puppy. I have been pretty happy with Ubuntu 5.10 so I was curious what 6.06 would bring. Actually I have not found anything significant to me. In fact it seemed a little slower. I used azureus and left it on for an additional four hours till I have given as much as I had received.

Ophcrack 2 — The fastest Windows password cracker

Ophcrack 2 — The fastest Windows password cracker
The Ophcrack LiveCD is a bootable Linux CD-ROM containing ophcrack 2.2 and a set of tables (SSTIC04-10k). It allows for testing the strength of passwords on a Windows machine without having to install anything on it. Just put it into the CD-ROM drive, reboot and it will try to find a Windows partition, extract its SAM and start auditing the passwords.

I downloaded the iso, burned the CD, and tried it on my son’s PC(W2K Pro), my laptop(XP Home) and my desktop(XP Pro). It was impressively fast at figuring out my local Administrator passwords. Naturally it does not know about the network password since it is not stored locally. I had to run it manually with my desktop since it is a dual boot machine and Ophcrack did not detect the NT partition with windows on it.

Fixing more PC problems

I use son’s old PC(AMD 900 circa 2000) as a test box. It is set up to dual boot W2K server and Fedora 4.  Over the Christmas holidays both systems crashed on me and I assumed I had a hardware failure. Since I had recently fixed my son’s new PC and my mind was in a PC troubleshooting mode, I decided to give the old PC some attention. The W2K side was showing a BSOD with a registry file failure. Switching to the last known good configuration did not help. The Fedora side would not run Firefox. Nothing happened. Now I could not logon to my mere mortal account. The message it showed said “gdm could not write authorization file”.

My first guess was that something was wrong with the disk drives. It was odd that both disk drives would show errors if that truly was the source of failure. So I decided to run Ubuntu Live and test the other components. This was easy. Just put the CD-ROM in the drive and boot. Everything came up fine and Firefox ran perfectly. So then I ran a search on the gdm message. The replies indicated most people thought this was a disk full indicator. Hmmm….I know I was playing around with downloading ISO’s using Fedora. So I booted into Fedora and deleted the ISO’s using the administrative account. Yea, I remembered to empty the trash. Fedora works fine.

Fixing the W2K registry problem was more complex. I went into the Recovery Console and restored the initial registry created during the installation. I rebooted and started the update process(e.g. applying the service pack and patches). Somewhere after applying the service pack and before switching over to Microsoft Update, the system took a trip to Neverland. Microsoft Update got caught in a loop trying to update components. Windows Update sent me to Microsoft Update. My “Add or Remove Programs” panel would not come up. It was time to go Plan B.

So I went back and repaired the system files using the Server CD-ROM. Then I let Windows Update lead me through the process of updating the system, IE 6 rollup and then Service Pack 4. Microsoft Update kicked in after the Service Pack update and tried to install Installer 3.1. For some reason Installer 3.1 would not install via Microsoft Update so I installed it manually. It appears to be running fine and my reason to buy a new PC has diminished again. Darn!

Linux and ISA2004

I have a special ISA2004 firewall policy rule for my linux box and another for the BitTorrent listener. The first rule allows anonymous access selected protocols for the specified host, my linux box. The anonymous access door is open on my ISA2004 firewall but not to wide. Since I want the linux box to be a full BitTorrent client I created a web publishing rule for a port in the 49152-65535 range as recommended here. For a variety of reasons I assigned a static IP address to the linux box. The rule allows the following protocols:

  1. BitTorrent(TCP 6868 Outbound, 6881-6882 primary Outbound and secondary inbound)
  2. BitTorrent Server(TCP 49999 Primary Inbound and secondary Outbound, UDP 49999 primary Receive Send and secondary Send Receive)
  3. FTP
  4. HTTP
  5. HTTPS
  6. NTP(UDP)

After monitoring the startup and download of a torrent with the monitoring feature of ISA2004, I think I have the rules set up correctly. My download speed runs at max download speed. I found Firestarter to be a really nice gui for linux firewall side. It is pretty simple to use and has some monitoring capability. If you have Fedora you can install it using YUM from the Extras repository. I have port 6868 in the rule since that is the port Azureus uses to check for azureus.aelitis.com for updates. Adding it to the rule sped up the Azureus startup. I have 6882 in the range even though technically Azureus should not use it. My ISA2004 firewall says Azureus at least tries to use it.

Fedora Core 4 Installation Notes

Fedora Core 4 Installation Notes

Here is a nice set of instructions for customizing Fedora 4. I found this page by searching for Azureus and fedora. I used the instructions to update the Java JRE and install Azureus and the BitTorrent GUI. I had to modify the iptables instructions since I used a different port and my ISA2004 firewall was denying port 6868. Azureus uses 6868 to look for program updates. Startup was taking a real long time since it was waiting for the program update check to complete or timeout.

Ubuntu – Ubuntu 5.10 Released

Ubuntu – Ubuntu 5.10 Released

The Ubuntu team is proud to announce Ubuntu 5.10. This is the official Ubuntu 5.10 release, and includes installation CDs, live CDs, and combination DVDs for three architectures.

I downloaded the latest x86 version this week for kicks. I liked the previous version but I seem to remember having trouble booting the live version on one of my PCs. This version did not have a problem with my PCs. It did seem to run slowly on the AMD3000 PC but I suspect the AMD version would be much faster. The menus are almost identical to my version of Fedora FC4.

To mount my existing Fedora LVM I used the following commands:

sudo mkdir /media/hdb
sudo lvdisplay
sudo mount /dev/VolGroup00/LogVol00 /media/hdb

To mount my existing NTFS partition I used the following commands:

sudo mkdir /media/windows
sudo mount /dev/hda1 /media/windows/ -t ntfs -o nls=utf8,umask=0222

Booting Linux

Since I was in an updating mood I went ahead and updated my Fedora 4 distribution. When I rebooted I went into W2K and copied the linux.bin file from the floppy over. When I rebooted and selected Linux it hung up going into GRUB. So I recreated my boot floppy using the Fedora rescue cd and the following commands:

grub-install /dev/fd0
mkdir /mnt/floppy
mount -t msdos /dev/fd0 /mnt/floppy
dd if=/dev/hdb1 of=/mnt/floppy/linux.bin bs=512 count=1

I copied the linux.bin over to my c drive under w2K and modified the boot.ini file. Now when I boot I get a MS boot menu with a linux option.

Trials of Linux and changing monitors

I know there must be an easier way to do this but I gave up trying to get my new Samsung LCD monitor to stop complaining about not running at 1280×1024. I tried several things to fix the problem but it actually made it worse. So I re-installed Fedora. Since I dual boot that PC I forgot my procedure to set up the boot sector correctly. As a reminder to me, I need to check the advanced boot options. When I get to the Advance Boot Options screen I can tell it save the boot information on the first sector of /dev/hdb1(i.e. /boot). This way I can leave the MBR on /dev/hda untouched. The new installation is running fine with the new monitor and the default settings. I eventually did reconfigure Fedora for 1280×024.

Another problem I had was remembering the correct network settings again. I use ISA on my SBS server as my firewall and it requires authentication. I had this working so I knew the correct configuration existed. I remembered to set up my Fedora box as a static IP but I forgot how to setup the proxy correctly. In Fedora you need to go into the Desktop-Preferences-Network Proxy-Details and enter the userid and pasword. Then Yum and Yum Extender will work through the firewall. You can use Firefox to go through the firewall by setting the preferences but that does not help you with Yum. Environmental variables did not work for me. Once you have the Network Proxy set up correctly, everything thinks they have a direct connection.

My new monitor and Fedora

My new Samsung LCD monitor is nice but it has an annoying habit of telling me I need to run at a higher resolution. For my windows workstations I just changed the resolution and move on to other things. With I cranked up Linux(FC4), linux locked up. That’s not good! I guess I have to go find my rescue disk.

Fedora and SBS

Last Friday I got Fedora FC4 to communicate with my SBS network. I have some bugs I am still working on. I had found several recent articles on the subject and it looked fairly easy. Setting up Keberos was fairly easy and I got my ticket. I setup Winbind and SMB but I am not happy with the configuration screen for Winbind since it doesn’t do anything. I had to configure the smb.conf file manually. I have been able to browse the Windows shares from Linux and transfer files okay but my single signon and access from my windows client is broken. I would kind of like these last two things to be working but it is a low priority. Ultimately I would like to see how hard it is too integrate a Linux file server into a network and it use it for a QuickBooks company file. So far it looks like SBS is an easier solution.

Re: Safe way to remove old kernels

redhat.com | Red Hat, Inc.

On Tue, Jul 19, 2005 at 02:16:09AM -0230, Shane Lahey wrote:

> MM> Install the “yum-utils” package from Fedora Extras, and run:
> MM> sudo package-cleanup –oldkernels
> MM> (assuming you have sudo privileges, of course).
>
> Im still new to Fedora Core myself, diden’t realize there was a
> package-cleanup. Would it be better to use the package-cleanup rather
> than ‘rpm -e’, or do they both do the same thing?

yum-utils is new, so it’s no surprise it’s not widely known. Ultimately, it does the same thing as rpm -e, but it’s less prone to typos (oops! I removed all my kernels!) and has more features. Well, one feature — it can conveniently remove all kernels but the latest N (defaults to 2) in one swoop.

Changing screen resolution on Fedora Core 4

I finally got the higher resolution to work on my mere mortal userid. The higher resolution worked for the root userid but I would get blank gnome panels at the higher resolution with my mere mortal userid. The problem is probably related to the “Save current setup” check box you see when you logoff. I guess that gnome freaks out when it finds a configuration saved at a lower resolution. To get out of this problem, I created a new panel and added the Preferences application. I found that if I changed the resolution to something else and then changed it back to the right resolution it would refresh the screen correctly. Once I had the screen formatted correctly, I could then log off and check the box to “Save current setup”. The next time I logged on everything would be correctly formatted for the higher resolution.

While I was playing with the screen resolution I went ahead and installed foo2zjs so I could print to my Magicolor 2200 printer.

More on Fedora Core 4

I am still fiddling with Fedora Core 4. Yesterday I finally gave up on trying to pass authentication credentials from Fedora to the firewall and opened up anonymous access for http and https. It is a little of a defeatist attitude but I thought that Core 4 would be easier in this area and I needed to move on. The bottom line was that I needed yum to work. Yum was giving me somewhat misleading error messages about the repos and the base url when it actually was getting a html error 407. I tried a variety of supposed fixes. Ntlmaps looked the most promising but I could not get it to work.

Once I got Yum working I installed the Evolution connector for Exchange. It kind of worked. It cratered with a big old error message the first time I tried to use it but seemed to work anyway. I was able to read my email, look at contacts, and view the calendar. The error message bothers me. It is not ready for prime time in this state.

I also tried to change to a higher screen resolution. The gnome menus do not appear at the higher resolution on my mere mortal userid. It works with the root userid. Now that is a mystery.