I first met Cody J. Hamilton Pace at the NPMA's Going Green Leadership Conference in Denver last November. He approached me with a smile, a firm handshake and an enthusiasm for the industry. He approached me and told me he was launching Hamilton Environmental Solutions (a name I could never seem to get right). He asked me if I would be interested in having him write a column for us along the lines of Start-Up Diaries, with the slant of being an entirely green company.

We were the first magazine to cover the issue and planned to follow it, so I said yes and Green Start-Up was born.

Unfortunately, Cody only got two columns on paper before he tore both anterior cruciate ligaments playing with his two delightful children. It put him out of commission for months and prevented him from building his business in Houston the way he'd hoped.

Through hard work and perseverance, he managed to recover and has just started to build his business. He had worked feverishly to build his business over the last two months, and it was poised to take off.

And then Hurricane Ike took it away from him.

Not only did the winds and rain take away the physical building, but it also convinced his investors that they couldn't afford to wait until Houston made its way back. So he texted me over the weekend to say he was driving back to Arizona (where he hails from) with the equipment in the back of his car to return it to his investors. He will return shortly to pack up his house and meet his wife Chelsea and his two sons while he ponders what he's going to do for the immediate future.

So here's my plea: Cody is only 27, loves the industry and will enthusiastically work hard for anyone willing to hire him. While I'm a little biased, I believe Cody would be a marvelous addition to anyone's staff. He informs me he's willing to relocate to anywhere and is absolutely ready to work at a moment's notice.

If you're interested in getting a hold of Cody, please contact me as soon as possible. I know that you'll like him as much as I do, and I'd love to put you in contact with him. Email me at fandorka@questex.com if you're willing to talk to him.

Thank you so much for your time and patience with me - and I look forward to hearing from you.

• Se compara siempre con cada línea de la lista en orden secuencial, del inicio al fin.
• Se compara hasta que se produce un match.
• Existe un deny implícito al final de la lista, es decir si no hace match con ninguna de las líneas, el paquete se descarta.

Tipos

• Standard ACLs: usan sólo la ip de origen del paquete para la condición. No distinguen entre el tipo de tráfico.

• Extended ACLs: evaluan muchos de los otros campos en la capa 3 y 4 de la cabecera ip. Evaluan origen, destino, protocolo, puerto etc,

Las access-list han de ser aplicadas a una interfaz, y puede referirse al tráfico de entrada o salida:

• Inbound access lists: los paquetes son procesados por la ACL antes de que se enruten a la interfaz de salida. Los paquetes descartados no seran enrutados.
• Outbound access lists: los paquetes son enrutados a la interfaz de salida, y entonces procesados por la ACL antes de ponerse en la cola.

Es recomendable cuando tratamos de proteger una red de Internet aplicar estas reglas:

• Negar cualquier dirección de la red interna.
• Negar cualquier dirección local host (127.0.0.0/8)
• Negar cualquier dirección reservada privada.
• Negar cualquier dirección del rango multicast (224.0.0.0/4).

Wilcard masking

Las wilcards se usan en las access lists para especificar un host, una red o un cierto rango de red o redes. Un 0 en la wildcard indica que ha de coincidir exactamente con la red y un 1 que no importa. Ex: 1.0.0.0 0.255.255.255 nos da el rango: 1.0.0.0-1.255.255.255.

Truco: para saber la wildcard correspondiente a una red, basta con mirar la máscara de subred, calcular el tamaño del bloque y restar uno. Ex: 192.168.10.64/28 es un tamaño de bloque de 2^4=16. Wilcard= 0.0.0.15

Acess lists avanzadas

• Named  ACLs: permiten usar nombres para identificar las ACLs estándar y extendidas.
• Switch port ACLs: se pueden aplicar a las interfaces de nivel2 de los switches. Sólo se pueden usar como tráfico inbound y en named ACLs. Soporta además de listas estándar y extendidas, MAC extended ACLs que usan direcciones físicas como origen y destino. Permiten controlar el tráfico en vlans (configurando la lista en la interfaz trunk).
• Dynamic ACLs: combina acceso remoto o local mediante telnet, con ACLs extendidas.
• Reflexive ACLs: con los paquetes salientes se crean reglas de filtrado para aceptar el tráfico de respuesta a una conexión TCP o UDP iniciada desde nuestra red.
• Time-based ACLs: permite activar o desactivar ACLs según el día y la hora.
• Remarks: permite incluir comentarios en las entradas de las ACLs estándar y extendidas. Se pueden poner antes o después de un permit o deny.
• Context-based access control (Cisco IOS Firewall): CBAC examina el tráfico del firewall para controlar la información del estado de las sesiones TCP y UDP. Es decir, a diferencia de las ACLs convencionales no sólo examina el nivel de red y transporte, sino que también examina la capa de aplicación. Esta información se usa para permitir tráfico de retorno, y conexiones  adicionales de datos, para sesiones originadas desde la red interna.
• Authentication Proxy: para poder activarlo en un router, es necesario tener  el Cisco IOS Firewall activo. Los usuarios entrantes o salientes bloqueados por una ACL, pueden autenticarse mediante un navegador en el servidor TACACS+ o RADIUS de la red, y se añaden entradas temporales para dar acceso.

A man of immense integrity  and strength, he tells Flight Nurses where to go! As well as the occasional Paramedic, Police Officer, Sheriff, and Fire Chiefs! Most often because they are lost, but that is a subject for another day! :)

My friends, this is the man that you want when things get tough! Such as when he was doing a ride along with me, and a rather large drunk at the old Jeffco Detox decided that I would look much better if my nose was sticking out of the back of my head. I simply looked at Chris, and said "Sick'Em!."  A single glance at Chris, and things with the drunk suddenly became easier.

I also know the mans family, and his Father ( May he rest in peace for all eternity, and Mother have always been proud of this country's heritage. Heck! I mean, his Father used Browning shotguns to hunt with!

Chris Smith

for

President

Yes, this is posted in jest. But in all seriousness folks? I can think of a lot worse people being President of these not so United States of America. I could start with Barak Obama, and John McCain.

My name is Patrick Sperry

Once upon a time I was a passing fair Paramedic from Saint Anthony's Paramedic Program, Cycle 32... God bless you Gerry, where ever you are!

For some reason, I can't find a link about the Father of Pre-Hospital Emergency Medicine right now. I suppose that it is the tears in my eyes. In any case? Vote for Chris Smith for President of the United States of America! Hell, Tom Tancredo doesn't even answer emails any more...

( Klik gambar untuk memperbesar )

]]> http://acarakedokteran.wordpress.com/?p=66 Sun, 29 Jun 2008 16:17:08 +0000 Astri http://acarakedokteran.wordpress.com/2008/06/29/acls-banjarmasin-2008/

Waktu : 22 - 24 Agustus 2008

Tempat: Hotel Bandara Juanda

Biaya: Rp 2.500.000,-

Informasi dan Pendaftaran hubungi:
IDI Sidoarjo  (031) 8055221
dr. Eddy  081221467058
dr. Rahmat  08123592166

Sigh, why did I say V-Tach. I knew it was V-Fib!

And now I am overwhelmed with the number of things that I need to do before I start work. Moving between provinces is such a big deal. I have to get a new driver's license, new car insurance, new car registration, change my bank information, get new health care, get internet, buy a bed, get my car from the shipper... and the list goes on.

Being without a car has been really hard as well. Buying groceries takes careful consideration when you only have 2 hands. I bought an ironing board, laundry hamper, iron, and some other items from Loblaws but I needed to take a taxi to get it all home.

Having a Loblaws nearby is nice though: it feels much like Superstore back home. I bought all the things I had back home so my current living situation is starting to feel a little more homey.

Though I am sad to be here so early, I am glad that I've had a few days to prepare for all the things I have to do. God I hope I don't make a V-Tach/V-Fib mistake again!

Note: With 8.04.1 some of these issues like LVM2 have been updated, the original install DID NOT have LVM2.

RAID
If you want to create RAID on Ubuntu you will need to install RAID tools before you can do so.  Now I am talking about software RAID.  You do have access to tools to install RAID during installation but the mdadm program is not installed by default.  So if you want to install RAID after the installation you need to add it so you have the tools.

sudo apt-get install mdadm

If you would like to see a tutorial on installing RAID on Ubuntu CLICK HERE.

Install LVM2 on Ubuntu

Ubuntu does not have LVM2 installed by default...why?  If Ubuntu wants to move to the server market why not have lvm2 intalled by default like RHEL 5 or CentOS 5? Now it can easily be upgraded with this command:

sudo apt-get install lvm2

If you want to see a tutorial on how to install and configure LVM2 on Ubuntu 8.04 CLICK HERE.

Access Control Lists
Access Control Lists (ACLs) allow you to provide different levels of access to files and folders for different users. The Red Hat Enterprise 5 / CentOS 5 have implemented ACLs in the file system by default. This new feature will allow you to set a file where one user can read, other users cannot read and yet other users are able to read and write to the same file. This was not possible previously.

sudo apt-get install acl
If you would like to see a tutorial on installing and configuring acls CLICK HERE.

Summary:
If Ubuntu really wants to break into the server market, they will need to install by default features that the server market really wants to use, specifically RAID tools, LVM2 and acls.  Until they make this transition many will not take them seriously in the server arena.

We've got dinner at church tomorrow night before TeamKID.  Hubby has baseball practice.  Thursday night and Friday night we have ballgames, if it doesn't rain.  And let me just interject here that I am tired of rain!  It would be nice to have a few pretty days in a row!  The kids are outside right now enjoying this gorgeous weather.

I have a couple of tests laying beside me on the couch that I need to finish to renew my ACLS (Advanced Cardiac Life Support) and PALS (Pediatric Advanced Life Support) certifications.  They expired last month - boy am I a procrastinator!  It seems like all of my certification renewals come due at the same time each year and it's such a pain trying to get everything done!  But it's a must if I want to keep working.

So, that's the summary for the week.  Not exciting, but definitely busy!  I'm fighting a slight cold that I've felt coming on for a couple of days.  I need some time to rest, but I don't see that happening anytime soon, so I'll trudge on putting one foot in front of the other, taking things one moment at a time.  Hope you all are having a great week!  God bless!

ACLs are useful in situations when you have multiple individuals or groups working on collaborative projects because they override the single-user, single-group restriction that is the default of Mac OS X client and traditional Unix operating systems. Nevertheless, unless you run OS X Server or want to share the same iPhoto or iTunes library amongst multiple users of the same machine, you may never have a need to configure an ACL.

That being said, Apple's developers, for whatever reason, have not yet addressed an annoying quirk that only affects Leopard (10.5) users who repair permissions using Disk Utility. Even after applying the recent 10.5.1 software update, Leopard users will have to wait an extended period for repair permissions to identify a number of files that unexpectedly contain ACLs.

In my tests that I documented using the Console utility, it took Disk Utility almost 19 minutes to repair permissions on my 120 GB laptop.

2008-01-09 10:19:35 -0800: Repairing permissions for “w”
2008-01-09 10:24:14 -0800: Permissions differ on "private/var/log/secure.log", should be -rw------- , they are -rw-r----- .
2008-01-09 10:24:16 -0800: ACL found but not expected on "System/Library/User Template/English.lproj/Sites".
2008-01-09 10:24:23 -0800: ACL found but not expected on "System/Library/User Template/English.lproj/Desktop".
2008-01-09 10:24:23 -0800: ACL found but not expected on "System/Library/User Template/English.lproj/Documents".
2008-01-09 10:24:23 -0800: ACL found but not expected on "System/Library/User Template/English.lproj/Downloads".
2008-01-09 10:38:23 -0800:
2008-01-09 10:38:23 -0800: Permissions repair complete
2008-01-09 10:38:23 -0800:

Acknowledgements:
Take Control of Permissions in Mac OS X, by Brian Tanaka, Ebook: $10.
http://www.takecontrolbooks.com/permissions-macosx.html

To test for yourself, download the source, extract the source, cd into the extracted directory, run ./configure, run make, and then make install. You'll find the new rsync installed at /usr/local/bin/rsync. View the man page using man -M /usr/local/share/man rsync.

Use -X for extended attributes ( and resource forks )
Use -A for ACLs
Don't use -E, which was Apple's flag for these as it is used for executability

Here are my test results:

Resource Fork Handling: For testing resource forks, I used to keep a copy of SimpleText around as it is all resource fork and no data fork, but a text clipping, which is also all resource fork is a great test. rsync 3 syncs the resource fork exactly the way you'd like. It retains the fork during the initial copy, and only re-copies the file if the fork has changed. This is quite awesome since Apple's bundled rsync always copies the fork causing major speed hits even when no files have changed. I haven't looked at the source code to see how rsync determines if the resource fork changed, but it seems efficient so far, though they may be doing checksums because using the -X flag adds time to the compare phase.

I dragged a text clipping into my source folder. I verified its resource fork using cat somefile/rsrc. I ran rsync and verified the destination's resource fork. I re-ran rsync and no files were copied. I appended some data to the fork and rsynced again. rsync detected the file as changed and re-copied it with the changed resource fork. You can test it yourself. Using the --stats or -v option, try running Apple's rsync, then rsync 3 and you'll see the number of files transferred.

Metadata tests: I recently found backup bouncer, which runs a multitude of tests on metadata preservation.

------------------ rsync-3.0pre7 ------------------
This copier exited with error code 23
This copier produced log output in:
/Volumes/Dst/11-rsync-3.0pre7/log
Verifying: basic-permissions ... ok
Verifying: timestamps ...
Sub-test: modification time ... ok
ok
Verifying: symlinks ... ok
Verifying: symlink-ownership ... ok
Verifying: hardlinks ... ok
Verifying: resource-forks ... ok
Verifying: finder-flags ... ok
Verifying: finder-locks ... FAIL
Verifying: creation-date ... FAIL
Verifying: bsd-flags ... ok
Verifying: extended-attrs ...
Sub-test: on files ... ok
Sub-test: on directories ... ok
Sub-test: on symlinks ... ok
ok
Verifying: access-control-lists ...
Sub-test: on files ... ok
Sub-test: on dirs ... ok
ok
Verifying: fifo ... FAIL
Verifying: devices ... FAIL
Verifying: combo-tests ...
Sub-test: xattrs + rsrc forks ... ok
Sub-test: lots of metadata ... ok
ok

Overall it fares pretty well.

The lack of support for finder-locks (aka flags like uchg) is unfortunate. Files on the destination are simply unlocked. This solves the problem of rsync not being able to delete locked (uchg) files, but it is kind of worse because that metadata is just plain lost and a lot of old time Mac users are accustomed to using that feature since it is right there in the GUI Finder Get Info panel.

I suppose a workaround would be to find all the files that have the flag and create a transcript of them before running rsync for later re-locking.

I need to do some performance testing compared to rsyncx, but so far, rsync 3 looks good to me.