Kubuntu Hardy Heron Upgrade

On Friday afternoon I upgraded my desktop PC to the KDE4 version Kubuntu Hardy Heron from the KDE 3.5 version of Gutsy Gibbon

Overall I have to say the process was very smooth and by far the most trouble free upgrade I have done. There were one or two funnies and these are outlined below.

Note: I decided to upgrade by downloading the alternate CD images and doing a cdromupgrade rather than doing an upgrade over the ‘net. I did this as I thought the Kubuntu sites might be a bit busy still, it being only one day after Hardy was released.

Overall the process took just 40 minutes including one false start.

Allow upgrades from the network hung

One of the options at the start of the CD ROM upgrade is to allow the system to connect to the ‘net to get the latest downloads. I decided to allow this figuring there wouldn’t be many updates to get. However maybe it was because the site was busy but the upgrade just seemed to hang. So after 10 minutes I cancelled and restarted it and chose not to get the upgrades from the net.

This restart initially hung with an error saying it could not get the lock file:

/var/lib/apt/lists/lock

This was because the aborted upgrade had left the lock file behind. I deleted this file with

sudo rm /var/lib/apt/lists/lock

The upgrade process then started itself automatically without me having to go back out.

Remove the CD before rebooting

At the end of the upgrade the systems says it is going to reboot once you press OK. However I didn’t notice any warning to remove the CD before doing this. As my system is set to boot from CD ROM first the result was my system started the live CD on reboot and asked me to select a language.

I ejected the CD and rebooted my machine and all was fine.

KDE4 Not Installed when upgrading from KDE 3.5

After the upgrade was complete and the login screen came up I checked the available sessions and only KDE was listed. There was no option for KDE4 so I thought maybe it will automatically login to KDE4 and there is no KDE3.5 option.

However when I logged in all I saw was the KDE 3.5.9 desktop ( upgraded from 3.5.8 ).

Thinking about this, it kind of makes sense. Although I was using the KDE4 CD the system is an upgrade and since I’ve never had KDE4 on this machine before it just upgraded what was there.

I was able to easily solve the problem by using adept to install the package kubuntu-kde4-desktop, from the command line the same can be achieved with.

sudo apt-get install kubuntu-kde4-desktop

The upgrade took about 10 minutes and interestingly used the alternate CD ( which I had re-instered after the reboot ). I was fully expecting to to start pulling down the package from the ‘net but it didn’t.

This just leaves me with the lingering doubt that I’m not going to get updates for KDE4 over the ‘net. I need to check my sources.list to see if there is anything else I should be adding in there to get the KDE4 updates.

The installation of kubuntu-kde4-desktop asked me what login manager I wanted to use, KDM or KDE4-KDM. I chose the KDE4-KDM version.

Once the kubuntu-kde4-desktop package was installed I logged out and back in again and under the options for sessions I had KDE and KDE4.

Choosing KDE4 did exactly what it says on the tin.

No Sound

In both KDE 3.5.9 and KDE4 initially I had no sound at all. After a couple of dead ends with installing the pulse audio server the problem turned out to be the channel to my speakers was muted in kmix.

I had to choose Kmix from the Multimedia menu and then click on the speaker icon that appeared in the status bar and choose “mixer” to bring up the full mixer panel. For some reason there were two “Front” channels showing and one of them was muted. Un-muting this gave me my sound back. (Click the pic below to embiggen)

No Sound in Firefox for Realplayer plugin

Although sound was now working in KDE4 in general in Firefox the BBC Radio Player was going through the motions of playing but not producing any sound using Realplayer. This turned out to be the fact that the plugins directory had changed for firefox3 and I had to copy in the relevant plugins from /usr/lib/mozilla/plugins to /usr/lib/firefox-3.0b5/plugins

sudo cp /usr/lib/mozilla/plugins/nphelix* /usr/lib/firefox-3.0b5/plugins

NB: This is a bit of a sloppy way of doing this I should really use softlinks to the orginal plugin files rather than making a copy. Also it should be possible to set this up in your home directory .mozilla directory rather than the global /usr/lib

Virtual Box

I use VirtualBox to run an XP virtual machine for connecting to the VPN and work. When I fired this up after the upgrade I got an error message about the VirtualBox kernel drivers not being loaded. The new version of the main Linux kernel was the reason.

Cleverly the error message told you exactly what to do, run “/etc/init.d/vbdrv setup” as root so for Kubuntu this just meant:-

sudo /etc/init.d/vbdrv setup

I really like VirtualBox and much prefer it to VMWare server. The way it handled this error message just confirms it’s the best choice for me for running a VM.

Hotkeys not loaded by KDE Autostart

The hotkeys application I use to set up my multimedia keys was not loaded when I logged in to KDE4. This was because the Autostart directory for KDE4 is in a different place to KDE3.5

In KDE3.5 is it ~/.Kde/Autostart but for KDE4 it is ~/.kde4/Autostart

So all I had to do was recreate my soft links:

cd ~/.kde4/Autostart

ln -s /usr/bin/hotkeys  hotkeys

I am not sure if .kde4 is the official directory for KDE4 files or if this has been set up by Kubuntu because they are allowing you to run both KDE3.5 and KDE4

Skype Not Working

This is the only issue I have yet to resolve. After the upgrade Skype was completely uninstalled. I tried installing it from apt-get but this gave an error saying there was no valid install candidate.

I still had the .deb package I had downloaded from the Skype website so I just re-installed this using dpkg -i

This gave me Skype back on the menu and it ran ok but whenever I try to make a call it just fails.

I suspect this might be something to do with the sound system and the fact in fixing my lack of volume I installed the pulse audio server.

I will try un-installing pulse audio and see if it makes any difference. Though I would like to use pulse audio to see what it is like and what all the fuss is about.

KDE4 Save Current Session - DBUS to the Rescue

Executive Summary

To cut to the chase, if you want to save your current sessions in KDE4 run the following command from a command line ( or put it in a script that you can call from a desktop shortcut ):

dbus-send --dest=org.kde.ksmserver /KSMServer org.kde.KSMServerInterface.saveCurrentSession

The Details

Now for how I got here in the first place:

I’ve just upgraded to Kubuntu Hardy Heron and decided to give KDE4 a go. I’ll be posting about the upgrade process and KDE4 in general over the coming days but one thing that has kept me “amused” today is the lack of a “Save Current Session” button in KDE4

Rather than have the desktop returned to how it was when I last logged out ( “Restore Previous Session” under KControl ) I like to return to a standard set of applications so I use the “Restore Manually Saved Session” option under KDE 3.5.

In KDE4 KControl there are the same options for the session manager. The snag is that there is no button anywhere to actually save the session when you want to. Thus choosing this option effectively logs you back in to a blank session. This has been reported as a bug in KDE but does not seem to be making any progress.

Flushed with my success with dcop recently I was hoping I could use it with the ksmserver object ( the session manager ) but in KDE4 dcop is not used and the dbus interface is used instead which is a bit more complicated to use.

There is a tool you can install called kdbus that does a similar job to kdcop but I found a much better tool called qdbusviewer along with a useful overview of KDE and dbus here.

To use qdbusviewer you need to install the package qt4-dev-tools then run qdbusviewer from a command line:-

sudo apt-get install qt4-dev-tools

qdbusviewer

You can use qdbusviewer to browser what objects are available and execute methods on them just like kdcop and kdbus ( but kdbus is rather slower )

Internet Hotkeys - Amarok dcop play/pause

Well the solution to getting my Play/Pause button to actually work as a play/pause toggle was pretty easy.

Amarok supports a playPause() method that is registered to the dcop server so in my hotkeys.conf file the command for the Play button became

dcop amarok player playPause

dcop is the command line based client to talk to the dcop server, amarok is of course the application I want to talk to.

player is the section of the amarok services and playPause is the function/method I want to call.

To find this out I used kdcop the graphical interface and explored what it offered under the amarok application.

Internet Hotkeys

My keyboard is a Logitech Internet Pro and it has 7 keys at the top for special functions that I’ve never really made use of in Kubuntu, but now I’ve got them all functioning using the handy application “hotkeys”.

Here’s what I did to get them working:

First the actual keys are labelled

Media ,Play/Pause,Mute,Vol +,Vol -,Favorites,Email,WWW

I tried to use KDE keyboard variants to get them working but this didn’t really work that well so I installed the application hotkeys:-

sudo apt-get install hotkeys

The hotkeys application intercepts keys and processes actions according to a couple of configuration files.

The first config file is the definition of the keycodes that are generated by your keyboard and what hotkeys command name to map them to. There is one definition file for each type of keyboard that hotkeys supports. To see the list of supported keyboards run the command

hotkeys -l

This actually reads the contents of various .def files from the config directory ( /usr/share/hotkeys in Kubuntu)

The second config file defines what action or programs are run when the various keys are pressed. By default in Kubuntu this is installed as /etc/hotkeys.conf. The best way to customise this is to create a directory in your homedir called .hotkeys and copy /etc/hotkeys.conf into there.

mkdir ~/.hotkeys

cp /etc/hotkeys.conf ~/.hotkeys/hotkeys.conf

The hotkeys.conf file consists of simple key/value pairs and you can edit it to launch the applications you require. The setting for Kbd defines what keyboard definition file is loaded when you run hotkeys.

Here is the final version of my hotkeys.conf ( note that Kbd is set to logitech-internet-pro which is not a standard definition, it’s one I created myself. More of which anon.)

############################################################
# Global configuration for hotkeys #
############################################################

# These are the default values.
# A line starting with # is a comment.

### Specify the default keyboard (without the .def extension) so you
### don’t need to specify -t every time

#using my own definition based on itouch
Kbd=logitech-internet-pro

Play=amarok –pause

WebBrowser=firefox
Email=firefox gmail.com
Favorites=dolphin

# osd_font=-arphic-ar pl kaitim big5-bold-i-normal–0-250-0-0-c-0-*-*
### For the color, you can either use the strings in /etc/X11/rgb.txt,
### or use the RGB syntax #RRGGBB, e.g. ##A086FF
# osd_color=LawnGreen
# osd_timeout=3
### osd_position is either ‘top’ or ‘bottom’
# osd_position=bottom
# osd_offset=25

The syntax is pretty obvious, when the WebBrowser key is pressed the command firefox is executed. To test the config just run the command

hotkeys

You’ll see a splash screen appear briefly and the application is now running. Press a key and you see an on screen display in green telling you what is happening and the relevant action will be executed.

You’ll notice I haven’t mapped anything for mute, volume etc. these all work with the defaults.

To get hotkeys to always be loaded when I am running KDE I added a link to the hotkeys executable to the .kde/Autostart directory:-

cd ~/.kde/Autostart

ln -s /usr/bin/hotkeys hotkeys

The Play/Pause keys executes “amarok –pause” , unfortunately from the command line this is not a toggle thus I can press the “Play/Pause” key and it will pause amarok but a second press won’t restart it. The command for that is “amarok –play” so I have mapped this to my Media key at the moment.

The “Media” key is not a standard hotkeys command name but the keyboard definition files allow you define commands to executed directly in there. The “key” (pun intended) to the keyboard definition files are the keycodes your keyboard generates.

I started with the itouch.def file and found it worked for most of they keys. Using the excellent application “xev” I was able to discover what keycodes my keyboard was generating and create my own variant called logitech-internet-pro.def the contents are reproduced below. I shall have to see if there is anywhere appropriate I can upload the file to make it available for others.

<?xml version=”1.0″?>

<definition>

<config model=”Logitech Internet Pro”>

<Play keycode=”162″/>

<VolUp keycode=”176″ adj=”2″/>
<VolDown keycode=”174″ adj=”2″/>
<Mute keycode=”160″/>

<WebBrowser keycode=”178″/>
<Email keycode=”236″/>
<Favorites keycode=”230″/>

<!– Feel free to customize this - the media key –>

<userdef keycode=”237″ command=”amarok -p”>Amarok</userdef>

</config>

<contributor>
<name>Simon Stanford</name>
<email>sjs atraetsel dot co dot uk</email>
</contributor>

My next task is to see if I can get the Play/Pause button to actually act as a toggle and for this I think I am going to need to use dcop to interrogate the state of amarok and/or pass it the appropriate command.

Snmpd filling up /var/log/messages

At work we have a central monitoring system for servers called Solarwinds Orion Network Manager, this uses standard snmp connections to servers to get their status, disk usage, CPU performance.

On my RHEL5 linux servers the standard snmpd daemon works well with Solarwinds but the monitoring server seems to make a lot of connections to the system and each one gets logged via the syslog daemon to /var/log/messages giving rise to lots of lines saying things like

snmpd[345435]: Connection from UDP: [10.225.46.136]:135

last message repeated 8 times

last message repeated 13 times

These are only information messages saying a connection has been established. This is rather annoying when you are trying to read other things in /var/log/messages. The way to turn off these messages is to change the logging options of the snmpd daemons.

On Redhat ( and Ubuntu) the default logging ( the -L options ) show:–

-Ls d

Meaning log to syslog using the facility of daemon ( see syslogd and syslog.conf for more information on what that means in detail, for now suffice it to say it means all messages are written to /var/log/messages ).

The man pages for snmpcmd ( common to all net-snmp programmes ) explain you can set this to only log messages above a certain priority.

Using priorities 0-4 means warning messages, errors, alerts and critical etc messages are logged but notice info and debug level messages are ignored.

The manual pages are not that clear, to me at least at first, hence this blog.

So if we change the -Ls d to the following this will stop those messages but still allow important messages to get through:–

LS 0-4 d

The capital S is crucial to the syntax.

So where and how do we set these options? Well the snmpd daemon is started by a standard init script /etc/init.d/snmpd

In both RHEL5 and Ubuntu the scripts have some default options but also read in settings from a config file. In Ubuntu the relevant portion of the script is:-

SNMPDOPTS=’-Lsd -Lf /dev/null -p /var/run/snmpd.pid’
TRAPDRUN=no
TRAPDOPTS=’-Lsd -p /var/run/snmptrapd.pid’
#Reads config file (will override defaults above)
[ -r /etc/default/snmpd] && . /etc/default/snmpd

So this sets the variable SNMPDOPTS to the default value and then if the file /etc/default/snmpd is readable it “sources” the content of that file.

Thus if /etc/default/snmpd contains the line

SNMPDOPTS=’-LS 0-4 d -Lf /dev/null -p /var/run/snmpd.pid’

Then stopping and starting the snmpd daemon will make it run with the new logging options we want.

sudo /etc/init.d/snmpd restart

In RHEL5 the equivalent file is /etc/snmp/snmpd.options and the equivalent variable is OPTIONS rather than SNMPDOPTS

Now there could be security implications to not recording the IP address of every SNMP request on your server in case some other system is connecting that shouldn’t be, but there are ways with community strings and other authentication options for SNMP to reduce the risk of that.

All in all the I think the risk of missing an important message in /var/log/messages outweighs the risks from not logging the snmpd messages.

Hey look a whole post and I never mentioned FTP once :o)

WordPress Annoyances and Answers.com Take 2 - #^$@! thing

Well as you can see in the previous post, the answers.com link screwed my paragraphs. I’ll see if I can get some support help from wordpress or the community, in the meantime here is the post formatted as I intended.

The post yesterday about using spaces in samba sharenames highlighted an annoyance with WordPress.

For some reason the backslash 040 was causing the zero to be stripped out so instead of seeing My\ 040Documents it was showing jusing My40Documents. (Note I’ve put a space between the \ and the 0 just now to stop it stripping it out.)

I tried putting the fstab entries inside a < code > , < /code > block but that made no difference. What I ended up doing was using the extended html codes and put in an ASCII character code in for zero.

ASCII/Unicode values can be used in HTML by using the following format ( note however there should be no spaces in the following):-

& # x30 ;

This is the hexadecimal ASCII code for a 0, I could have done it in decimal making it & # 48 ; but by accident or design the ASCII codes for the digits 0 to 9 are easy to remember in hex as they run consecutively from decimal 48 which is 3 times 16

Thus a ‘1′ is decimal 49 or hex x31 , 2 is x32, etc.

Using the extended HTML codes was ok but it was sort of a one shot deal. If I saved the post it displayed with \ & # x30 ; showing as \ 0 but if I went back to edit the saved draft then the next save passed the post through the WordPress interpreter and the \ 0 was stripped out. So for each edit I had to go back and put in all the & # x30 ; codes back in.

If I missed a trick with WordPress here, please let me know.As I say a < code > < /code > block didn’t help.

Having battled with that I then came to mark up the links in my post. I always like to have links in my post to any technical terms or specific products that I mention and I find this a rather laborious task. I therefore tried the WordPress answers.com button which is a quick way to pick out key words from a post and automatically link them to an entry in answers.com

Unfortunately for some reason doing that stuck a whole bunch of < div > </div > entries in my post that screwed up all the paragraph formatting. So the time I saved in referencing my post was lost reformatting it, (and typing in all those damn & # x30 ; codes again!)

I’m going to try the answers.com link on this post and if it does it again I shall not be using that method of referencing until I’ve asked wordpress.com what the deal is.

As for whether answers.com is an appropriate referencing tool well I always check the links confirm what I understand a term to mean. I was a bit dubious about answers.com just leaching of wikipedia and also answers.com having ads but they have an advertising revenue split deal with wikipedia ( or so wikipedia says in 2006…….) .

The ads I have seen so far don’t seem to intrusive and annoying so I’ll see how it goes.Right now to press the answers.com button and see what happens to the formatting. Brace yourself………

WordPress Annoyances and Answers.com

The post yesterday about using spaces in samba sharenames highlighted an annoyance with WordPress. For some reason the backslash 040 was causing the zero to be stripped out so instead of seeing My\ 040Documents it was showing jusing My40Documents. (Note I’ve put a space between the \ and the 0 just now to stop it stripping it out.)I tried putting the fstab entries inside a < code > , < /code > block but that made no difference. What I ended up doing was using the extended html codes and put in an ASCII character code in for zero. ASCII/Unicode values can be used in HTML by using the following format ( note however there should be no spaces in the following):-& # x30 ;This is the hexadecimal ASCII code for a 0, I could have done it in decimal making it & # 48 ; but by accident or design the ASCII codes for the digits 0 to 9 are easy to remember in hex as they run consecutively from decimal 48 which is 3 times 16Thus a ‘1′ is decimal 49 or hex x31 , 2 is x32, etc.Using the extended HTML codes was ok but it was sort of a one shot deal. If I saved the post it displayed with \ & # x30 ; showing as \ 0 but if I went back to edit the saved draft then the next save passed the post through the WordPress interpreter and the \ 0 was stripped out. So for each edit I had to go back and put in all the & # x30 ; codes back in.If I missed a trick with WordPress here, please let me know. As I say a < code > < /code > block didn’t help.Having battled with that I then came to mark up the links in my post. I always like to have links in my post to any technical terms or specific products that I mention and I find this a rather laborious task. I therefore tried the WordPress answers.com button which is a quick way to pick out key words from a post and automatically link them to an entry in answers.comUnfortunately for some reason doing that stuck a whole bunch of < div > </div > entries in my post that screwed up all the paragraph formatting. So the time I saved in referencing my post was lost reformatting it, (and typing in all those damn & # x30 ; codes again!)I’m going to try the answers.com link on this post and if it does it again I shall not be using that method of referencing until I’ve asked wordpress.com what the deal is.As for whether answers.com is an appropriate referencing tool well I always check the links confirm what I understand a term to mean. I was a bit dubious about answers.com just leaching of wikipedia and also answers.com having ads but they have an advertising revenue split deal with wikipedia ( or so wikipedia says in 2006…….) . The ads I have seen so far don’t seem to intrusive and annoying so I’ll see how it goes.Right now to press the answers.com button and see what happens to the formatting. Brace yourself………

Samba Shares, Spaces and fstab (With a bit of Octal thrown in)

It is a necessary evil at work that I have to get my laptop that runs Kubuntu to interact with the rest of the Windows systems at work.In order to show that Linux can hold its own I’ve not asked for any special changes to be made to the way the windows servers are set up. I just make Linux work with what the Windows PCs use.

The main area of interaction is the mounting of Samba shares to get at my network storage.

In general this is fine but I have found one little gotcha if you are using /etc/fstab to mount shares at boot up and the share names in question have spaces in them.

The problem is that spaces are delimiters in /etc/fstab and trying to avoid getting the space interpreted by usng quotes or backslashes won’t work with /etc/fstab.

The answer is to use the octal code for the ASCII number of the space character. (Wow so much jargon in one short sentence)

So first here are two lines from an /etc/fstab for mounting two windows shares. The windows shares on a server called nas001 and the share names are “Backup” and “My Documents”

# /etc/fstab: static file system information.#
# <file system> <mount point> <type> <options> <dump> <pass>
//nas001/Backup /mnt/backup cifs credentials=/home/raetsel/creds 0 0
//nas001/My\040Documents /mnt/mydocs cifs credentials=/home/raetsel/creds 0 0

So after the comments the first line shows mounting a share without a space, the second line shows mounting a share with a space where space is replaced with \040

So what’s with \040? Well the and a three digit code is interpreted as an ASCII value of a character in octal (base 8).

In an Linux command shell type man ascii to see a list ofASCII codes and their octal, decimal and hexadecimal equivalents.

Space is decimal 32 which is octal 40 ( but we need 3 digits for the interpretation to work so it is 040)

In a similar vein \134 is the octal code for a \ backslash so if you want to have a domain username pair in the options of the line in fstab you could do it with username=mydomain\134raetsel

Be careful what you wish for, it may come true

After almost three years of guerilla linux advocacy at my company they finally agreed to deploy some Linux servers. One of which is to be the replacement for my beloved HP-UX ftp server.

So I’m having to port the users, data and all important scripts over from the HP-UX korn shell to the Red Hat RHEL5 korn shell.

I’ve found a couple of gotchas in doing this, not with the korn shell per se but with other seemingly innocuous command line utilities that are just a little different between HP-UX and RHEL5. So I thought I would share these with you:-

tail

In HP-UX you can use tail -2 filename to show the last 2 lines of a file or tail +2 filename to start showing a file from line 2 through to the end.

In RHEL5 you have to use the -n option. Thus to show the last two lines of a file it is tail -n -2 filename (no need for the minus sign but it makes it more obvious to me) and tail -n +2 filename to show from line 2 onwards.

Kubuntu rather nicely puts up a warning if you don’t use the -n option saying the other method is deprecated but it still works.

wc

In a script if you want to have in a variable the number of lines in a file in HP-UX I would do:-

NUMLINES=$(wc -l /etc/passwd | cut -d” ” -f1)

The wc command counts the umber of characters words and lines in a file and by itself produces output like

simon@constance:~$ wc /etc/passwd
   32   47 1465 /etc/passwd

Note there are leading spaces before the different counts but when you use just one of the counts such as the number of lines with -l there are no leading spaces:-

simon@constance:~$ wc -l /etc/passwd
32 /etc/passwd

So you can use the cut command with a delimiter of a space ” ” to get the first field from the wc -l command and thus have the number of lines. This is what cut -d” ” -f1 means.

The snag with wc -l when you use it in a pipe in a script or output it to a file (i.e. whenever not run directly from the command line) it still puts the leading spaces in meaning you would need a cut -d” ” -f6 or -f7 depending on how many leading spaces there are. This obviously is not usable when you don’t know how many leading spaces there are.

So I use awk instead in the following way:-

NUMLINES=$(wc -l /etc/passwd | awk ‘ { print $1 } ‘)

Uses any (and all) whitespace as a single delimiter so it works regardless of how many leading spaces there might be. It’s just a bit longer to type and I always think it is a lot of overhead to fire up the full power of awk just to cut out one field.

Interestingly the info page for wc on RHEL5 specifically says there is a GNU standard to ensure no leading spaced when a single count such as -l is used. So perhaps the fact this does not work in a script is in fact a bug. Certainly here onKubuntu wc -l works “as advertised” with no leading spaces even when used in a script.

cd ~ (tilde expansion)

You can use cd ~ to change to your home directory and you can use cd ~username to change to the home directory of username as extracted from /etc/passwd

However on RHEL5 (and Kubuntu) using cd ~$SOMEVAR in a script does not work as it gets executed as a literal of cd ‘~username’. See the following example:

simon@constance:~$ cd ~gareth
simon@constance:/home/gareth$ pwd
/home/gareth
simon@constance:/home/gareth$ cd ~
simon@constance:~$ pwd
/home/simon
simon@constance:~$ USER=gareth
simon@constance:~$ cd ~$USER
bash: cd: ~gareth: No such file or directory

The only way round this I have found is to put an eval in front of the cd command

simon@constance:~$ eval cd ~$USER
simon@constance:/home/gareth$ pwd
/home/gareth

I suspect this behaviour is related to a security feature to stop arbitrary code being executed if the contents of a variable is set by a user to something potentially malicious, a bit like SQL injection attacks.

So I have ways round the gotchas I have found so far and I only have 30 or so scripts to check for things like this and adjust but I must admit I wasn’t expecting to be caught out by such subtle changes from HP-UX to Linux RHEL5.

FTP Bounce 227 = 22_ means SmartDefence not so Smart

A quick update to my post about using Python to test FTP. I am indebted to Kevin for his comment on that post saying that he found the issue was related to the FTP Bounce protection in Checkpoint SmartDefence product.

Kevin jogged my memory to say that our Network Security team did find that the change made to the firewall that broke my FTP service was the enabling of the FTP Bounce protection. Having looked up what FTP Bounce is, it does indeed seem like something that should be protected against but clearly there seems to be a problem with the SmartDefence inplementation of it. At present FTP Bounce protection is turned off and my FTP service has been fine since.

I haven’t quite got the bottom of how SmartDefence ends up corrupting ports with a 4th quad of 227 but it appears to related to the fact that 227 is the status message for an FTP server entering passive mode.

This is all way beyond my area of expertise so I will leave it at that, other than to say if you get strange FTP behaviour check out if you are protecting against FTP Bounce with SmartDefence.