Novell OES2 SP1 is now out of Beta. In conjunction with this release we’re also very pleased with the stability of PaperCut on OES and are now happy to support releases from version 8.5 build 6739 in production environments. e.g. PaperCut is now also out of Beta!

We’ve had no show-stopper bugs raised in the past 2 weeks. I must say however we’ve had lots of good feedback. The list of bugs may be short, but the requests for features is growing fast :-). We’re busy preparing for the up coming version 9 release. After I’ve helped get this out the door, I’ll be moving back on to Novell features with the immediate goals of:

• 64-bit support (we currently only support i686)
• Documentation for setting up a Novell OES system as a Secondary Server
• Document and test running on an OES cluster

I’m also working to ensuring that the Novell OES releases remain in sync with all other platforms and hence benefit from the new general features that will be added to version 9.0. Once again, a bit thanks to all the organizations that have tested. We’re been very pleased with the support the Novell community has offered both in terms of testing and in sales. We’ve already had a few of the test sites commit and purchase licenses even while PaperCut was still in Beta! A bit thanks to all the testers!

Cheers,

Chris

Climate change and pollution are major issues that concern all countries across the globe. At present, it is imperative that more environmentally conscious practices are incorporated into everyday routines.

More importantly, the urgency to continuously act on current environmental problems has never been more emphasized. One such example that many people can relate to is saving paper.

Environmental campaigns have taught consumers to recycle paper, but the damage doesn’t stop there. The goal should be to stop use in the first place! With the widespread problem of pollution, saving paper and curbing wastage is now a more pressing concern, because of the harmful pollutants released during the manufacturing process, and the chain of negative effects associated with this.

During the manufacturing process there are many area’s that for different reasons, produce pollution. In paper manufacturing, pollution begins with pulp pills, where wood chips are made into thick fibreboards, which are later sent to paper mills for further processing.

The process of burning bark so it can be transformed into usable fibre releases toxic greenhouse gases, which eventually can cause acid rain, destroying marine life, crops, and polluting drinking water.

The process of bleaching pulp to create various finishes on paper also involves draining water that contains bleach chemicals and harmful dioxins, which instantly pollute water catchments.

In addition, transporting mass quantities of wood chips by sea cargo is often the most cost-effective, but has recently been scrutinized for the high levels of CO2 produced by ships and their associated long distance travel.

Hence, saving paper and making the most of daily usage in homes and the workplace is important not only to save on unnecessary extra spending, but also to cut down on the unnecessary harmful effects unleashed into our environment.

Now seeing we’re on the PaperCut website, we have to say that the obvious: To help cut down the paper usage in your school or business, take a look at PaperCut. It’s easy to install and to use. With handy features like printing charge and control, print quotas, real-time environmental impact reporting, and seamless function across various operating systems and multiple servers, using PaperCut for your print management is the easy step in your paper-saving efforts.

We host a number of web services and applications on the servers in here in the PaperCut office. We’ve always planned on hosting these on an isolated server inside a demilitarized zone (DMZ) to ensure public applications are isolated from internal servers. This usually requires separate dedicated servers, however with the recent growth in virtualization technology, we decided to see if we could accomplish the same in a virtual environment. There was not a lot of information out there so I embarked on a project to develop our own. The solution has worked very well over the past 6 months so I’ve decided to open source the configuration and control script so others in the Linux community can benefit. (One of my Friday projects when I’m not working on print accounting software!).

The crux of the script is to host a Qemu or KVM virtual machine on an independent subnet via a tun/tap interface. iptables on the host (Dom0) is used to ensure that connections can not be instigated from the VM in the DMZ to any system in the internal network. They say a picture is worth a thousand words, so here’s a diagram:

The key items are:

• The host (dom0) hosted the VM on a tun/tap interface.
• The VM is on a separate subnet.
• A firewall on dom0 (important) prevents access to the internal network.
• A static route has been added to the router so internal network can “find” the systems in the DMZ.
• Public ports (e.g. port 80) on the router are forwarded into the server in the DMZ.

This strategy will provide an extra layer of protection as a compromise on the server in the DMZ (say hosting your website) will not automatically mean a compromise on your internal network. There are however come caveats to this: It may be possible to “jailbreak” from the VM into the host by exploiting vulnerabilities in the hypervisor/host. For example, some exploits were found in QEMU in 2007.

The control script and its brief setup procedure should work on most modern Linux distributions.

file: dmz-vm-controller

#!/bin/sh
### BEGIN INIT INFO
# Provides:          vm-dmz-controller
# Required-Start:    $local_fs $network
# Required-Stop:     $local_fs $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: VM Management in a DMZ
# Description:       QEMU/KVM VM Management in a semi-secured DMZ.
### END INIT INFO

##############################################################################
#
# VM-DMZ-Controller is a wrapper script written to help with the management
# and setup of a VM running inside a secured demilitarized zone (DMZ).  The
# objective is to ensure the host/vm inside the DMZ are firewalled in a way
# that ensures connections from the DMZ to the internal network are not
# possible.
#
# Brief summary:
#
#   1. Install QEMU or KVM, and socat, iptables and tun/tap tunctl
#      (uml-utilities).
#
#   2. Create non-privileged user on your system called "vm".
#
#   3. Create a sub-directory in the VM user's home directory to host your VM
#      files.
#
#   4. Create your disk images (e.g. qemu-img) in this sub-directory.
#
#   5. Copy this script into the directory and modify configuration section
#      below.
#
#   6. Link in this script into /etc/init.d/ and configure runlevels as
#      appropriate.
#
#   7. Add a static route in your internal network default router so internal
#      systems can connect to the VM.
#
#   8. Start your VM and test.  Confirm that the VM is unable to access your
#      internal network.
#
# See here for details:
# http://www.papercut.com/blog/chris/2008/11/14/using-kvm-to-securely-host-servers-in-a-dmz/
#
#
# Copyright (c) 2008, PaperCut Software International Pty. Ltd.
# http://www.papercut.com/
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above copyright
#       notice, this list of conditions and the following disclaimer in the
#       documentation and/or other materials provided with the distribution.
#     * Neither the name of the  nor the
#       names of its contributors may be used to endorse or promote products
#       derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY PAPERCUT SOFTWARE ”AS IS” AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL  BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
###############################################################################

###############################################################################
# VM Configuration - modify below as appropriate
###############################################################################

# The name of the VM instance (should be unique if hosting multiple VMs)
#
VM_NAME=external-web-server

# The non-privledged user ID used to run the VM.
#
VM_USER=vm

# The VM kernel module to load (e.g. kvm-intel, kvm-amd, qemu). Leave blank if
# using QEmu as a kernel model is required.
#
VM_MODULE=kvm-intel

# The name of the virtual network tap to bind/host to the DMZ network on.
#
IFNAME=tap0

# The .1 gateway address that denotes the DMZ subnet.
#
DMZ_IP=192.168.100.1

# The subnet range of the internal network (the range to firewall/protect)
#
INTERNAL_SUBNET=192.168.1.0/24

# Your DMZ system may need DNS access provided by your internal network.
# Set this if required. This will leave a hole in the firewall allowing
# DNZ access (UDP source port 53).
#
INTERNAL_DNS_IP=

# The directory with disk images (and pid files, etc.) are hosted
#
VM_DIR=/home/${VM_USER}/${VM_NAME}

MONITORFILE=${VM_DIR}/.${VM_NAME}.monitor
PIDFILE=${VM_DIR}/.${VM_NAME}.pid
LOGFILE=${VM_DIR}/${VM_NAME}.log

# VM Start command-line. No need to define:
#    -pidfile, -net, or -monitor
# as these are all appended as part of this script.
# Add -cdrom and -boot d to boot and install your VM off a CD.
#
VM_START_CMD=”kvm 
        -hda disk1.qcow2 
        -m 384 
        -vnc :0″

# The maximum time to provide the VM to conduct a graceful shutdown.
#
SHUTDOWN_TIMEOUT=20

###############################################################################
# End Configuration - DO NOT MODIFY BELOW THIS LINE
###############################################################################

start_vm() {

    echo_n “Starting VM ${VM_NAME}…”
    if isrunning; then
        echo “ALREADY RUNNING”
        exit 0
    fi

    setup_networking
    start_firewall

    if [ ! -z “${VM_MODULE}” ]; then
        modprobe “${VM_MODULE}”
    fi
    cd “${VM_DIR}”
    su “${VM_USER}” -c “${VM_START_CMD} 
                -net nic -net tap,ifname=${IFNAME},script=no 

                -pidfile ${PIDFILE} 
                -monitor unix:${MONITORFILE},server,nowait 
                >> ${LOGFILE} 2>&1 &”

    for i in 0 1 2 3; do
        sleep 2
        if isrunning; then
            echo “Started ${VM_NAME} at: `date`” >> ${LOGFILE}
            echo “started.”
            exit 0
        else
            echo_n “.”
        fi
    done

    echo “ERROR”
    exit 1
}

stop_vm() {

    echo_n “Stopping VM ${VM_NAME}…”
    if isrunning; then
        # Send nice powerdown command
        echo “system_powerdown” | socat - UNIX-CONNECT:${MONITORFILE} 
                >/dev/null
        clean_shutdown=
        for (( i = 0 ; i <= ${SHUTDOWN_TIMEOUT} ; i++ )); do
            sleep 1
            if isrunning; then
                echo_n "."
            else
                clean_shutdown=y
                break;
            fi
        done

        if [ -z "${clean_shutdown}" ]; then
            echo_n "forcing..."
            kill -TERM "${pid}"
            sleep 2
        fi

        if isrunning; then
            echo "problem stopping!"
            exit 1
        fi

        rm ${MONITORFILE}
        rm ${PIDFILE}
        stop_firewall
        stop_networking
    fi
    echo "Stopped ${VM_NAME} at: `date`" >> ${LOGFILE}
    echo “stopped.”
}

status() {

    if isrunning; then
        echo “Running (pid: ${pid}).”
    else
        echo “Not Running.”
    fi
}

forcekill() {

    if isrunning; then
        kill -9 “${pid}”
    else
        echo “Not running!”
    fi
}

isrunning() {

    if [ -r ${PIDFILE} ]; then
        pid=`cat ${PIDFILE} 2>/dev/null`
        if [ ! -z “${pid}” -a -d /proc/${pid} ]; then
            return 0 #Success - running
        else
            return 1 #Failure - not running
        fi
    else
        return 1 #Failure - not running
    fi
}

setup_networking() {

    tunctl -u ${VM_USER} -t ${IFNAME} >/dev/null

    ifconfig ${IFNAME} ${DMZ_IP} netmask 255.255.255.0 up >/dev/null

}

start_firewall() {

    modprobe ip_tables
    modprobe iptable_nat

    echo “1″ > /proc/sys/net/ipv4/ip_forward

    #
    # Deny new connections to internal network (forwarded) and Dom0 (input)
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p tcp –syn 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p tcp –syn 
            -j DROP

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p tcp –syn 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p tcp –syn 
            -j DROP

    # Also need to protect the DMZ side of host box.
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p tcp –syn 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p tcp –syn 
            -j DROP

    #
    # Allow DNS UDP packets to DNS server (required if on internal network)
    #
    if [ ! -z “${INTERNAL_DNS_IP}” ]; then
        iptables -A FORWARD -p udp -d $INTERNAL_DNS_IP 
            –dport 53 -i $IFNAME -j ACCEPT
    fi

    #
    # Deny UDP packets to internal network
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p udp 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p udp -j DROP

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p udp 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p udp -j DROP

    # Don’t log Windows/Samba name broadcasts as they will occure often
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp –dport 137 -j DROP

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp 
            -m limit –limit 6/h –limit-burst 5 -j LOG

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp -j DROP

    #
    # Deny selected ICMP to internal network
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type echo-request -j DROP
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type redirect -j DROP
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type router-advertisement -j DROP

    iptables -A INPUT  -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type echo-request -j DROP
    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type redirect -j DROP
    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p icmp 
            –icmp-type router-advertisement -j DROP

    iptables -A INPUT  -d $DMZ_IP -i $IFNAME -p icmp 
            –icmp-type echo-request -j DROP
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p icmp 
            –icmp-type redirect -j DROP
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p icmp 
            –icmp-type router-advertisement -j DROP

    #
    # Deny spoofed packets from DMZ
    #
    iptables -A INPUT -s ! ${DMZ_IP}/24 -i $IFNAME -j DROP
    iptables -A FORWARD -s ! ${DMZ_IP}/24 -i $IFNAME -j DROP

}

stop_firewall() {

    #
    # Remove all rules added on the IFNAME interface
    #
    iptables -S | 
            egrep “${IFNAME}” | 
            egrep “^-A ” | 
            sed “s/-A //” | 
            while read rulespec; do
                iptables -D ${rulespec}
            done
}

stop_networking() {

    tunctl -d ${IFNAME} >/dev/null

}

# Hack for POSIX echo -n support on all platforms
if [ “X`echo -n`” = “X-n” ]; then
    echo_n() { echo ${1+”$@”}”c”; }
else
    echo_n() { echo -n ${1+”$@”}; }
fi

#
# Begin Main
#

userid=`id | sed “s/^uid=([0-9][0-9]*).*$/1/”`
if test “${userid}” -ne 0; then
    echo “Error: You must be root to run this program” 1>&2
    exit 1
fi

if [ -z `which iptables` ]; then
    echo “Error: Please install iptables.” 1>&2
    exit 1
fi

if [ -z `which socat` ]; then
    echo “Error: Please install socat.” 1>&2
    exit 1
fi

if [ -z `which tunctl` ]; then
    echo “Error: Please install tunctl.” 1>&2
    exit 1
fi

case “${1}” in
    start)
        start_vm
        ;;

    stop)
        stop_vm
        ;;

    forcekill)
        forcekill
        ;;

    restart)
        stop_vm
        sleep 1
        start_vm
        ;;

    stopfirewall)
        stop_firewall
        ;;

    startfirewall)
        start_firewall
        ;;

    status)
        status
        ;;

    *)
        echo “Usage: vm-dmz-controller start|stop|restart|status” >&2
        echo “Advanced Options: stopfirewall|startfirewall|forcekill” >&2
        exit 1
        ;;
esac

A quick thanks to all the beta testers helping us with testing our new PaperCut version for iPrint on OES Linux. We’ve had a series of bugs/suggests reported and I’ve actioned most of these in today’s release. The 8.5.6708 release contains:

• Support for a various username formats seen on Novell networks (e.g. username@macadd, .username.domain, username\domain).
• Improved auto detection of eDirectory LDAP settings.
• Added warning if installing on any 64-bit OS. The beta release is currently targeting 32-bit only but we’ll support 64-bit on final release. (We’re just trying to minimize variables during the beta program!)
• Documented the need to open ports 9191 and 9192 in the firewall. OES has strict firewall defaults!
• Miscellaneous documentation improvements that should make installation a little easier and/or more “the Novell way”.

The remaining suggestion not actioned in this release is the auto-registration of printers. At the moment a single print job is required on each printer to trigger of the registration of the printer. I’m conducting some R&D in this area and hope to have a better solution soon.

You’ll find the latest release on the PaperCut NG downloads page.

Thanks again to all the testers and please continue to email me with your ideas (and dare I say, “bugs”!).

Here is another “behind the scenes” post of the happenings here at PaperCut. Last Wednesday was National Ride To Work Day. This is an initiative of our local bicycle association to raise awareness and get more people riding to work around the country. Tom, Matt and myself already regularly ride to work (at least on the sunny days!) and we decided to put the invitation out to all to join us. Priyanka took up the challenge even though she has not ridden a bike in many years.

Here are some pictures of the day. Tom, Priyanka and myself met in Glen Iris and did the 30 minute ride along the Gardiner’s Creek trail through to our office in Mount Waverley. I’m sure Priyanka now has a good appreciation of the word “Mount” in Mount Waverley after tackling the climb for the first time!

Matt, Priyanka, Chris and Tom after the morning ride

Priyanka and Tom climbing the “mountain”!

Hope you all find the behind the scenes look interesting, and yes, we don’t just work on printer log software all the time!

While using our print management system is an obvious paper saving tool, here are some other handy ideas to reduce your impact on the environment and save paper.

1. Print duplex or two to a page- Print on both sides of the page or print two pages to a single side (also called N-Up printing). Combine both of these to print four pages on only one piece of paper! Not only save paper but also take longer to reach your print quota!
2. Use PDF and go digital- Send business documents by e-mail in PDF format rather than printing and then faxing/mailing them. You no longer need to print, sign and send. Use an electronic signature and email documents that require a signature. While you’re at it, consider an FAX-to-email gateway so your inbound faxes arrive in your inbox.
3. Use an electronic diary- Install a program on your laptop or computer and record all appointments and diary entries electronically. Google Calendar is our program of choice.
4. Send e-cards- Save money and save the planet. Personalised season’s greetings can be sent quickly and easily by email. Save on stamps, cards and envelopes. Note: Some may thing you’re “cheap” doing this so make it known that your driver is not cost savings but the environment!
5. Use a whiteboard- Forget sticky notes and note pads. Use a white board to record all those quick and temporary notes.
6. Electronic memo’s and bulletins- Communicate in the office electronically. Invitations, instructions and important notices can be sent via email or viewed daily on an updateable document on your intranet.
7. Be selective- Print only what you need to print. Cut and paste relevant information from longer documents and print only when and what you absolutely need to.
8. Proof work on screen- some people prefer to print documents for proofing as it’s difficult and taxing to do so on the screen. Be kind to your eyes and simply enlarge the text temporarily while you proof.
9. Promote awareness- place signs around your office or study encouraging these and other paper saving ideas. (Laminate them so you don’t have to reprint them!) Gentle and polite reminders are all you need.
10. Recycle, recycle, recycle- have recycle bins in prominent places so people remember to use them, use the back of old documents as scrap paper etc. Lead by example and watch others follow!

Did you know, that today, 10% of the world’s population, including Western Europe and North America, are responsible for over half of the world´s paper consumption, more than six times the world average. Paper consumption in Europe alone has increased six-fold since 1950. Some 10,000 sheets of paper are used each year by your average office worker in western industrialized countries. (information and more tips published by the WWF)

OK. It’s been a frustrating month for me (and all the prospective Novell testers). I’ve been in regular correspondence with Dean Giles at Novell with very little progress. The frustrating thing is that we have a copy (under NDA) of the “new iPrint”, fully working and running fine in here. However due to internal politics on the Novell side it has not been possible to make this publicly available to others (i.e. our test sites) because of an NDA. Instead we’ve had to wait until OES2 SP1 was publicly available. It finally looks like there is some light at the end of the tunnel. I receive an email from Novell letting me know that SP1 is not in a public (non private) beta period. Yet to see any post on their website but I’m sure it’s only a day or so away. Finally it looks like we can start official testing and we’ll all have a proper print management solution on iPrint!

Please check out this page for more information on the PaperCut Novell OES Linux testing program, download information, etc. I assume the OES 2 SP1 download will be located here when live. Fingers cross the train will be rolling again soon.

Update: The word from Novell, “The beta has been approved by the core team, but may take a day or two to get posted.”

A big hello to the world and PaperCut’s customers. As a new developer on the PaperCut team I am excited to be part of the new directions in which development of PaperCut’s Print Management Software is progressing. So many things to sort out on the first day! Where is the coffee? Where is the stationery supply cabinet? And where are the umlauts and accents on the keyboard?

Wait a minute, umlauts? That’s correct, I am looking forward to catering especially to our German- and French-speaking customers’ concerns. So please hold for these important messages:

Guten Tag! Ich freue mich, unseren deutschsprechenden Kunden als direkter Ansprechpartner im Team von PaperCut zur Verfügung zu stehen.    

Bonjour à nos clients français et francophones. N’hésitez pas de me contacter avec vos besoins et soucis. 

Stay tuned to this frequency for more news from myself in the upcoming weeks.

Oh well, we didn’t win but it was a fantastic night all round. It was a great experience for us all and we’re very proud to have been a finalist in among a great group of businesses. It was a great night with good food, media running around doing interviews, and some dancing to end off the night. Obviously the judges didn’t find our print monitor software as “sexy” as the Wild Action Roaming Zoo for children! Here are some photos of the night.

We’re very proud to announce that we’ve been made state finalists in the Telstra Business Awards 2008.

It’s a great honor be a finalist amongst so many other great companies in the country’s most prestigious business awards. It is recognition of all the hard work the PaperCut team has put into developing a great printer control product and providing great support to our customers world-wide.

Running a business is hard work, and you don’t often get time to reflect on the how far we’ve come and what we’ve achieved. These awards have allowed us to do that, and be proud of these achievements.

The winners will be announced at a formal dinner tonight (19th September 2008). The whole team and partners are coming along. It should be a fun and exciting night.

Wish us luck!!

PS: We’ll post some photos of the night here next week.