New-formula-starburst

Create an Encrypted Partition on Mac OS X using Truecrypt

5

My new Macbook Pro just arrived and I’m spending a good part of the day setting her up. As I write this, I’m in the process of using Truecrypt, which is only recently available for Mac OS X, to create an encrypted partition on my mac hard drive. I’ve done this before on my Ubuntu laptop, and it has worked great. What follows is a summary of my experience with Truecrypt on the Mac and a step-by-step for you to try at home.

An encrypted partition provides you with a high amount of security, with very little inconvenience or impact on performance. Truecrypt has two ways of creating encrypted storage, a file container, or a whole partition. An encrypted file container is nice because it’s easy to move around … i.e. put on a SD card or thumb drive … for small amounts of sensitive data. For my purpose, I want to encrypt ALL my personal stuff like documents, code, tax returns and records, photos, etc., so an encrypted partition is the way to go.

Encrypting a partition is more of a seamless integration with your Macbook, too. I’ve also read reports that it’s faster to access encrypted files from a partition than file containers. Basically, the encrypted partition looks like a second hard drive in finder, once you mount it and provide your Truecrypt passphrase on bootup. It looks and acts just like any drive or folder, you can store files, run applications, create links, etc … just like any drive. Truecrypt encrypts and decrypts everything on the fly, with virtually unnoticeable overhead. If your laptop ever turns up in the hands of a bad guy or rogue customs agent, they wouldn’t be able to access any of your data

Sounds good? Read on to find out how …

I. Create a new Partition

Your Macbook comes with a pretty big hard drive (mine is 200GB), but it’s probably configured as just one big volume … that’s how most laptops are. You can use Disk Utility to resize your main “Macintosh HD” partition to allow some space for your new encrypted one.

WARNING: Disk utility is not supposed to destroy any data in this process, and it worked fine for me. However, I still recommend you back stuff up anyway, in case of a problem or failure. Disk partitions gone wrong can be disastrous to your data.

  1. Insert your Mac OS X install CD
  2. Choose the Install Mac OS X app from the CD, and click the restart button
  3. Your Mac will boot from the CD. After you select your language, don’t continue with the installation. Instead, look up to the menu bar and choose Disk Utility from the Utilities menu.
  4. Highlight your hard drive and then click over to the Partition panel
  5. Now you can resize your “Macintosh HD” to make room for a new partition. Click the little resize handle in the bottom right of the graphic, and drag your HD smaller. I shrank my Macintosh HD to leave about 80GB for my encrypted partition … should be enough for all my stuff.
  6. Now that you have some space, click the plus icon to add a new partition in the freed space. You can tweak the sizes of the two partitions to your liking, and create a name for your new one (I called mine just “Data”). Be careful not to make any other changes to Macintosh HD … we don’t want to risk data loss.
  7. Leave the Format setting at the default, Truecrypt will reformat the drive later anyway, and click Apply.
  8. Hold your breath … and you’ve just repartitioned your hard drive!
  9. Now exit Disk Utility, then go back to Utilities -> Startup Disk and change the boot disk back to “Macintosh HD” and reboot. If everything goes as planned, you should be back at your desktop, and a new hard drive called “Data” shows up right there next to “Macintosh HD”.

II. Install Truecrypt and Encrypt the Partition

Now we have to set up the encrypted volume. There are a few options here, and I recommend that you read and understand the TrueCrypt documentation first.

  1. Eject the empty “Data” drive by right-clicking on it on the desktop
  2. Download Truecrypt and install it. I wrote this guide using TrueCrypt 6.0a.
  3. Launch TrueCrypt from Applications, and click the Create Volume button
  4. Choose the second option, “Create a Volume within a Partition/Device”
  5. Select your new partition (you should be able to identify it by the size and the device, mine was on /dev/rdisk0s3)
  6. Now there are several options to choose. I did not need the crazy security of a hidden volume, so I went with the standard encrypted volume. I also stuck with the AES encryption default. Go through the dialogues to create your encryption keys and passphrase or keyfile.
  7. Next, you need to reformat the drive. This will take a while, mine took about an hour. I may have been able to get by with a “Quick Format” but I wasn’t sure, so I did the full format. Click through all the scary warning messages and get it started …

IV. Mount your Encrypted Drive

Once the formatting is done, you’re ready to start saving your encrypted files. You’ll be brought back to the main Truecrypt screen where you can now mount your new encrypted drive.

You’ll have to do this after every time you boot your computer to re-mount your encrypted partition.

  1. Click on the first “Slot” and click Select Device.
  2. Choose your encrypted partition (i.e. /dev/rdisk0s3) and OK and Click Mount
  3. In the Mount dialogue, click the Options button and you can change the Mount Location. To be more Mac-like, I called it ”/Volumes/Data”
  4. Type in your passphrase and click OK

After a couple of seconds, your new encrypted drive should pop up on your desktop and in Finder and you’re ready to go!

How-To Update Ubuntu Servers to Close Ruby Vulnerabilities

4

It was announced the other day that some arbitrary code execution vulnerabilities were discovered in almost all production versions of Ruby out in the wild. I’m not sure how vulnerable your typical Ruby on Rails application servers would be, but I’m taking no chances. I run this blog, and all my other production sites on Ubuntu. Updating to the latest patched version of ruby was easy:

$ sudo apt-get install build-essential libssl-dev libreadline5-dev zlib1g-dev
$ wget ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz
$ tar zxvf ruby-1.8.7-p22.tar.gz
$ cd ruby-1.8.7-p22
$ ./configure --prefix=/usr/local --with-openssl-dir=/usr --with-readline-dir=/usr --with-zlib-dir=/usr
$ make
$ sudo make install

And you’re done. The only sorta tricky part there is the ./configure command, which requires those options to tell the compiler to enable Readline and OpenSSL support which are most often needed in a Ruby on Rails environment. To check and make sure it’s working, type these commands and verify that the output looks like this:

$ which ruby
/usr/local/bin/ruby
$ ruby --version
ruby 1.8.7 (2008-06-20 patchlevel 22) [i686-linux]
$ ruby -ropenssl -rzlib -rreadline -e "puts :success"
success

Now, run your tests, restart mongrels, and you’re safe. Phew.

The Ultimate Iced Tea: Juicetea

0

I have always been a lover of iced tea … not that sugary, syrupy stuff that beverage companies sell in bottles or cans … the kind you brew yourself. Over the past couple of hot summers, I have perfected the ultimate iced tea recipe. I call it Juicetea.

  • 8 tea bags of Good Earth Green Tea with Lemongrass
  • Your favorite 100% (no sugar added) cranberry juice blend. Pure cranberry juice will give the tea a nice tangyness, or choose a blend of berry juices for different flavors. I like R.W. Knudsen brand cranberry raspberry blend lately, but I switch it up from time to time.
  • Water

Fill a teakettle with purified or filtered water, and bring to a full boil. Remove the kettle from the heat, and then submerge all 8 tea bags in the hot water. Close the lid, and let it steep for 30 minutes to an hour.

Then, fill a 2 quart pitcher about two-thirds full of ice cubes. Pour the still warm tea over the ice and most of the ice cubes will melt. Keep the pitcher in the fridge for at least 20 minutes before serving.

When serving, fill a glass halfway with ice, followed by the iced tea … but leave at least 2 inches at the top of the glass and top it off with juice.

For hot summer nights, try adding some premium vodka and use a little bit more juice for a refreshing Juicetea Cocktail.

Install Pidgin from repositories for Ubuntu Feisty

0

Pidgin is a great free multi-protocol instant messaging app with a cute purple pigeon logo. I use it to connect to my AIM, MSN, Google Talk (x2), and Yahoo! IM accounts, but it also is compatible with lots more. Pidgin is the new name of the Gaim project, which was an earlier version of the same tool.

On Ubuntu Feisty, you can install Pidgin yourself by downloading it from pidgin.im or other sites, but it won’t be included in the official Ubuntu repositories until the Gutsy release. I prefer to use Aptitude instead of download stuff to install, mainly so it automatically stays updated. Pidgin for Ubuntu Feisty is available by adding this repository to /etc/apt/sources.list

deb http://repository.debuntu.org/ feisty multiverse
deb-src http://repository.debuntu.org/ feisty multiverse

Add the repository key:

wget http://repository.debuntu.org/GPG-Key-chantra.txt -O- | sudo apt-key add -

Then update and install Pidgin:

sudo apt-get update
sudo apt-get install pidgin

You’ll see that Pidgin has replaced Gaim on the Applications > Internet launcher menu. You may get a notification for an updated Gaim transitional package after the install. If so, go ahead and install it.

Generic actions for Rails subclasses

1

Single Table Inheritance in Ruby on Rails is cool, and has made my code oh so beautiful in several cases. I ran across an interesting problem yesterday with inheritance classes, and I thought I’d share my solution.

Imagine you have parent class NinjaTurtle, and four subclasses Leonardo, Donatello, Michaelangelo and Raphael.

class NinjaTurtle < ActiveRecord::Base
end

class Leonardo < NinjaTurtle
  has_many :katana
end

class Donatello < NinjaTurtle
  has_one :bo
end

class Michaelangelo < NinjaTurtle
  has_many :nunchaku
end

class Raphael < NinjaTurtle
  has_many :sai
end

So a typical new or create action in any turtle’s controller would look like a bit like this

@donatello = Donatello.new

What if you want one inherited action called new that will create any type of NinjaTurtle, depending on who’s controller handled the request?

The straightforward way would be to just write an action called new in each of the subclasses controller, but that’s a lot of repetition of basically the same thing.

The solution? Make sure your subclass controller inherits its parent class controller, then you can write a generic new action in the parent controller.

class NinjaTurtleController < ApplicationController
  def new
    @ninja_turtle = params[:controller].camelcase.constantize.new
  end
end

class LeonardoController < NinjaTurtleController ; end
class DonatelloController < NinjaTurtleController ; end
class MichaelangeloController < NinjaTurtleController ; end
class RaphealController < NinjaTurtleController ; end

Now, any request to /leonardo/new would create a new Leonardo object and assign it to @ninja_turtle. Similarly, a request to /donatello/new would create a new Donatello object. The beauty is that there is really only one new method that is flexible enough to create the right type of object depending on the controller that handled the request.

How it works

I discovered yesterday that Ruby’s class names are constants. That means that there is a constant named Leonardo that refers to the Leonardo class.

If we’re using Rails convention, which we should be, the controller name that corresponds to the Leonardo class is leonardo. We can grab the controller name from request parameters.

  params[:controller]                        #=> "leonardo" 
  params[:controller].camelcase              #=> "Leonardo" 

and then we use the Rails built-in method constantize to convert our string into a constant, and invoke the new method on the object that we’re trying to create. It essentially evalutates to Leonardo.new, which is exactly what we wanted!

References:
Programming Ruby
Infovore – Getting a class object in Ruby from a string containing that class’s name

DreamHost Your Own Packages and Gems

29

UPDATE SEP 24, 2007: Almost a year later, this is by far the most popular article on my blog. Thanks to everyone who has contributed their feedback and helped make this guide really work. I have updated the article to reflect some new versions of some software and filled in a few holes that may have tripped some people up.

DreamHost has become a pretty popular choice for many people looking for a reliable Ruby on Rails host. I’ve been with DreamHost for about six months now, and I’d say they’re pretty stellar. This blog is hosted on DreamHost, as well as my Wamily project (while we’re in development and light testing—hopefully we’ll outgrow the shared host soon) and things are running well. They also offer a ridiculous amount of disk space and bandwidth for the price.

One of the best things about DreamHost is that they allow you to manage pretty much every aspect of your environment. You have the ability to log in to the server via SSH and compile and install any of your own packages or Ruby gems. DreamHost does have a centrally controlled version of most of the basic things (including Ruby and Rails), but a lot of times they’re a little slow on the upgrade path when the latest new versions come out.

For that reason, and also for practice when I really have to maintain my own server, I’ve decided to manage all of my own versions of Ruby, Rails, and most of my gems.

Here’s a quick how-to be a control freak on DreamHost after the fold …

Log In Using SSH

I use PuTTY for all of my SSH needs. Fire it up and connect to your domain using SSH. After you enter your password, you’re at your home directory (replace nateclark here with your username). Its worth mentioning that you should log in with the same username that your web application runs as (whatever you set in the DreamHost control panel when creating your domain).

[/home/nateclark]$ 

Create a Directory for Compiled Packages and Gems

To keep things neat, I created a directory called .packages under my home directory for any compiled packages. You could download and compile stuff right in your home directory, but that could quickly get cluttered. The . in front of the directory name makes it a hidden directory, so it won’t be listed in a regular ls command. You have to use ls -a to list all directories including hidden ones.

In my ~/.packages directory, I currently have installed my own versions of Ruby 1.8.6, Trac 0.10, Python 2.4.3, ImageMagick 6.3.0, Subversion 1.3.2 and a few other smaller things.

I also have a ~/.gems directory to store all of my own gems.

Set Up Your Paths

Ok, this is the important part—your path variables tell the shell where to look for executables and gems. We’ll set these up in your ~/.bashrc file, which is executed by bash for non-login shells. For regular login shells, you want to use the same path variables, and ~/.bash_profile sets this up. I’ve chosen to source ~/.bashrc at the end of ~/.bash_profile. For Linux newbies, ~ is a shortcut for your home directory.

My ~/.bash_profile looks like this:
# ~/.bash_profile: executed by bash(1) for login shells.

umask 002
PS1='[\h:$PWD]$ '
alias ll="ls -l" 
EDITOR="/usr/bin/vim" 
. .bashrc
And my .bashrc looks like this:
# ~/.bashrc: executed by bash(1) for non-login shells.

export TZ=EST5EDT # Sets my timezone to Eastern U.S. time
export LD_LIBRARY_PATH="$HOME/.packages/lib" 
export PATH="$HOME/.packages/bin:$HOME/.gems/bin:${PATH}" 
export GEM_HOME=$HOME/.gems
export GEM_PATH="$GEM_HOME:/usr/lib/ruby/gems/1.8" 

NOTE: Some people (including me) have had problems with Dreamhost’s shared gems conflicting with gems that you install locally. To force your environment to use ONLY your local gems and not the Dreamhost managed gems at all, change the last line above to:

export GEM_PATH="$GEM_HOME:/usr/lib/ruby/gems/1.8" 
Now that these paths are set, simply log out and log in again to get them to work. Or, you can just source the file at the prompt:
. ~/.bash_profile
To test if it worked, just echo your path. You should see something like this:
$ echo $PATH
  > /home/nateclark/.packages/bin:/home/nateclark/.gems/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
$ echo $GEM_PATH
  > /home/nateclark/.gems:/usr/lib/ruby/gems/1.8

The paths that point to your directories are listed first, and then the DreamHost shared location is next. Sweet.

Configure Your Rails Environment

In your Rails applications, you’ll also have to tell Rails where to look for your gems. Add this line to the top of your config/environment.rb, file:
ENV['GEM_PATH'] = '/home/nateclark/.gems:/usr/lib/ruby/gems/1.8'

Install Your Packages

Ok, now you’re ready to install your packages into your ~/.packages directory. You can do this just like you would manually compile a package normally, with the only difference that you need to use the --prefix=$HOME/.packages option when you configure. For example, here’s how I installed Ruby 1.8.6:

First, install readline. This is required if you ever want to use script/console on your Dreamhosted rails app.

$ cd ~/.packages
$ wget ftp://ftp.cwru.edu/pub/bash/readline-5.2.tar.gz
$ tar zxvf readline-5.2.tar.gz
$ cd readline-5.2
$ ./configure --prefix=$HOME/.packages
$ make
$ make install
Now, download and compile the latest version of Ruby:
$ cd ~/packages
$ wget ftp://ftp.ruby-lang.org/pub/ruby/ruby-1.8.6.tar.gz
$ tar zxvf ruby-1.8.6.tar.gz
$ cd ruby-1.8.6
$ ./configure --prefix=$HOME/.packages --with-readline-dir=$HOME/.packages
$ make
$ make install

Occasionally, Dreamhost will kill a process that is using a lot of CPU or memory and would be bogging down the server. A few times, they have killed my make command. If this happens, just run it again until it completes successfully.

Then, make sure you’re actually using the new version:

$ which ruby
  > /home/nateclark/packages/bin/ruby
$ ruby -v 
  > ruby 1.8.6 (2007-03-13 patchlevel 0) [i686-linux]

Update: Some of you had problems with gem. That’s cause I left out the part about installing rubygems. Oops.

$ cd ~/.packages
$ wget http://rubyforge.org/frs/download.php/20989/rubygems-0.9.4.tgz
$ tar zxvf rubygems-0.9.4.tgz
$ cd rubygems-0.9.4
$ ruby setup.rb config --prefix=$HOME/.packages
$ ruby setup.rb setup
$ ruby setup.rb install

Install Your Gems

Installing gems is just as simple as always. Since your $GEM_HOME is set, all your gems will go into the directory that you specified. For example, install your own version of Rails:
$ gem install rails --include-dependencies
And make sure that you’re using the right one:
$ which rails
  > /home/nateclark/.gems/bin/rails

Thats it! Now you can manage your own versions of pretty much any package, library or gem. Of course with that comes the responsibility of keeping everything patched and up to date.

Let me know if I’ve missed anything. Good luck.