stressfree - novell

Transparent Squid Authentication to eDirectory

David — Tue, 07 Oct 2008 10:36:45 +0000

This post explains how to setup a Squid HTTP proxy to transparently authenticate users against a Novell eDirectory. In the Novell eco-system Border Manager is the venerable choice for an internal firewall and proxy but it is showing its age. This guide is based on this Novell Cool Solution. Unlike Border Manager, which requires the CLNTRUST client-side tool, the setup described works without the need for any desktop client software.

How it works

Within a Novell managed network the eDirectory stores authenticated user's I.P. addresses. Squid performs an LDAP search against eDirectory using the incoming I.P. address of the client. If successful the authenticated username is returned and a proxy session established. If the search comes up empty Squid prompts the client to manually enter their credentials for authentication against the eDirectory. If this too fails the proxy request is denied.

eDirectory 8.8 incompatability

This solution currently only works with eDirectory < 8.8 because Novell has slightly changed the format they store network addresses in newer versions. At the time of writing I have not been able to test against eDirectory 8.8 so I cannot determine the required code changes or test results. Hopefully in the near future this situation will change.

Squid's external_acl_type option

Transparent authentication is made possible thanks to Squid's external_acl_type configuration option. This allows external identities and groups to be identified via any external script. Once Squid is installed setting up transparent eDirectory authentication is a two step process:

Create and tweak the squid_edir_iplookup.pl file.
Edit the squid.conf configuration file

The engine room: squid_edir_iplookup.pl

To begin create a file named squid_edir_iplookup.pl. This file can be anywhere on your system as long as the Squid process can access it. In this example I have created the file in /usr/lib/squid/ as this is where Red Hat stores all of Squid's authentication related scripts.

/usr/lib/squid/squid_edir_iplookup.pl

#!/usr/bin/perl
use Net::LDAP;
use Net::LDAP::LDIF;
use File::Path qw(rmtree);
use File::Basename qw(basename);

$HOST = 'your.edirectory.server';
$PORT = 389;
$ADMIN = "cn=squid,ou=tech,o=company";
$PASSWD = "squidpassword";
$BASEDN = "o=company";
@SITES = qw(ou=groups);

$|=1;

START: while (<>) {

($IP,$GROUP) = split(/ /,$_);
# $SITE =~ tr/\n//d;
$GROUP =~ tr/\n//d;
$group_filter_string="";
for $site (@SITES) {
$group_filter_string=$group_filter_string."(groupMembership=cn=$GROUP,${site},$BASEDN)";
}

$netaddress = "1\#";
@octets = split(/\./,$IP);
foreach $octet (@octets) {
# The IP address is stored in eDirectory as four unsigned chars. ASCII 40, 41, 42 and
# 92 are characters ( ) *\ which are known tokens in LDAP search filters If you dont
# escape these with a backslash they will cause LDAP errors and he script will fail.
if ((($octet >= 40) && ($octet <= 42)) || ($octet == 92)) {
$netaddress = $netaddress.sprintf("\\%c",$octet)
} else {
$netaddress= $netaddress.sprintf("%c",$octet);
}
}
$filter="(&(objectclass=user)(|$group_filter_string)(networkAddress=$netaddress))";
$attnames=['CN'];

#connect to the server
until($ldap = Net::LDAP->new($HOST, port => $PORT)) {
die "Can not connect to ldap://$HOST:$PORT/" if ++$count > 10;
sleep 1;
}

$r = $ldap->start_tls();

$r = $ldap->bind($ADMIN, password => $PASSWD, version=>2);
die $r->error if $r->code;

$r = $ldap->search(base => $BASEDN,
scope => 'sub',
filter => $filter,
attrs => $attnames);

$count = $r->count;
if ($count == 0) {
print "ERR\n";
} else {
foreach my $entry ($r->entries){
my @values = $entry->get_value(CN);
foreach $value (@values) {
# Many users in eDirectory have multiple CN values - usually from the user template
# used to create them - sometimes their maiden name is noted in the Other Name
# attribute in ConsoleOne we want to report the proper CN to squid not these bogus
# values.
if ($value =~ m/template|previously/i) {
next;
} else {
$value =~ tr/- //d;
print "OK user=$value\n";
next START;
}
}
}
}
$ldap->unbind;
}

At the beginning of this file you want to change the $HOST, $PORT, $ADMIN, $PASSWD and $BASEDN parameters to ones that are relevant for your internal network. The @SITES array is not important as this is used in the Cool Solution example to define different groups of users (something we are not concerned about here).

Once you have saved the file make it executable:

chmod a+x /usr/lib/squid/squid_edir_iplookup.pl

The trickiest step is making sure you have the correct Perl libraries installed on your system for the script to run. These libraries are defined at the top of the file (the USE statements). The easiest way of testing whether the script is working is to run it:

/usr/lib/squid/squid_edir_iplookup.pl

The Perl interpreter will soon tell you if something is not right. If a required library is missing you will need to install it using your system's package management tool or directly from source (CPAN is useful).

All going well when the script is run you will be presented with a new, blank line. Test the LDAP lookup by typing an I.P. address and pressing enter. After a brief delay a success/fail message will be returned:

/usr/lib/squid/squid_edir_iplookup.pl
192.168.1.10
ERR

In the above example no valid user was found in the eDirectory at this I.P. address. If the look-up was successful the relevant username will be returned. To quit the script press CTRL+C.

Editing squid.conf

With the squid_edir_iplookup.pl script in place and working it is now time to edit the Squid configuration. The exact location of this file will vary depending on your operating system, but in the case of Red Hat this is:

/etc/squid/squid.conf

http_port 3128
http_port 8080
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
access_log /var/log/squid/access.log squid

external_acl_type IPUser ttl=3600 %SRC /usr/lib/squid/squid_edir_iplookup.pl

auth_param basic program /usr/lib/squid/squid_ldap_auth -b "ou=users,o=company" -u cn your.edirectory.server
auth_param basic children 5
auth_param basic realm Squid Web Proxy
auth_param basic credentialsttl 1 hours

# Used to pull LDAP group membership based on a supplied username - not currently used
# external_acl_type ldap_group %LOGIN /usr/lib/squid/squid_ldap_group -D cn=squid,ou=tech,o=company -w squidpassword -b o=company -s sub -f "(&(objectclass=inetOrgPerson)(cn=%u)(groupMembership=%g))" -h your.edirectory.server

refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl localnet src 192.168.1.0/255.255.255.0
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT

acl edirectory_users external IPUser Everyone
acl authenticated_users proxy_auth REQUIRED localnet

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost

http_access allow edirectory_users
http_access allow authenticated_users
http_access allow localhost
# http_access allow localnet
http_access deny all

http_reply_access allow all

icp_access allow all

coredump_dir /var/spool/squid

debug_options ALL,1
# For debugging ACLs
# debug_options ALL,1 33,2 28,9

You will need to change the relevant parts in this file to suit your eDirectory and internal network settings (i.e. the localnet setting).

The Squid configuration file is a tricky beast, but what is listed above is fairly standard. The first highlighted section is where the external squid_edir_iplookup.pl script is referenced. If this check fails an LDAP-backed HTTP BASIC authentication request is made.

The second highlighted area identifies two Access Control Lists, the first based on the result of the eDirectory I.P. lookup and the second on the HTTP BASIC authentication response. If the incoming request is from someone authenticated within the eDirectory OR by the HTTP BASIC process then outbound access is granted.

It is possible to use LDAP group information to form ACLs that further limit Web access. The above example does not utilise this functionality, but the Novell Cool Solution goes into it in further detail. My advice is get the Squid/eDirectory authentication working at a very basic level and then make it more complicated. Starting at the most complicated scenario will only lead to failure and frustration.

If you are encountering authentication issues then enable the debugging options at the bottom of the configuration file. This is fairly verbose but can be very useful in identifying configuration mistakes.

Reviewing HTTP access logs with Webmin & SARG

SARG (Squid Analysis Report Generator) is a handy tool for reviewing Squid access files. There is a very good Webmin module for this application, so rather than struggling with the command line install Webmin on the proxy. By the way, while you are at it install my Webmin theme, your eyes will thank you for it.

The SARG module within Webmin (click to enlarge)

Borders' subtle statment about Novell's relevance

David — Tue, 19 Aug 2008 02:03:47 +0000

I took this photo at Borders' Auckland store yesterday afternoon.

Are Borders trying to position themselves as the subtle industry analyst with their shelving labels? Should Gartner be concerned that people will stop reading their reports and start scanning Borders' shelf names?

Noticing this shelving good did lead me into purchasing 'Don't Make Me Think'. I read it on the flight back to Wellington and it was pretty good and quite funny. The content was all common sense, but sometimes it just takes very clear communication for common sense to make sense.

I guess it is just a shame that 'hey, don't make me think' is probably the response of Novell's marketing department when questioned by their CEO...

novell

At what point is it cheaper for MS to just buy Novell?

David — Tue, 18 Mar 2008 03:27:02 +0000

The U.S. Supreme Court has cleared the way for Novell to continue their Wordperfect anti-trust suit against Microsoft. Novell's argument is that anti-competitive operating system issues caused their once mighty Wordperfect suite to come tumbling down. This turn of fortune cost Novell to the tune of $1 billion. The lawsuit Novell has filed against Microsoft is for damages potentially in the order of $3 billion.

Whilst everyone agrees Microsoft is no saint the fact of the matter is Novell and Wordperfect got beaten by aggressive pricing and marketing rather than significant operating system level anti-competitive action. Microsoft gained market share by aggressively dropping the price of Office to the point that it was less than half that of its competitors. Rather than following suit and matching dollar for dollar these moves Novell blindly followed their original pricing structures inherited from when they purchased Wordperfect.

Novell's past business blunders aside, given Microsoft's recent showing in the courts you would have to say its an even money bet that some financial compensation arises from this case. Whether it is in the order of $3 billion is unlikely but even a quarter of that amount is still a hefty sum. Does there come a time when Microsoft executives look at Novell and decide it is cheaper to buy them outright than cough up massive legal fees and reparations?

A few years ago the idea of Microsoft buying Novell would be dismissed on anti-competitive grounds, but these days Microsoft faces stiff competition from the likes of Red Hat, IBM, Sun, Oracle and of course Google. Even in recent years the two companies have hardly been competing against each other. The controversial agreement struck a few years ago between the two has seen them in coopetition rather than competition without so much as a mumble from regulatory bodies.

Given Novell's current financial position if a $3 billion payout were on the cards it is not a huge leap to suggest that Microsoft simply buy them out rather than buy their forgiveness. Whilst it would take more than $3 billion to buy the company it would not take much more (relatively speaking) considering Novell has a current market cap of $2.1 billion. Also from a shareholder's perspective an acquisition is much better than a payout as their investment is preserved and built upon instead of going to lawyers and the opposition.

From a technology perspective Novell have two things to offer Microsoft - SUSE and Identity Management. Microsoft currently resell SUSE and have a comparatively weak Identity Management business so both assets could be put to good use. Netware, Novell's other technology is at end of life but this customer base is currently having to weigh up a tricky migration to SUSE or Windows Server. As a consequence owning both end points of this decision would not be such a bad thing from a sales point of view.

Perhaps the biggest hurdle to get over is the general idea that Microsoft cannot sell Linux because it invented Windows. Given the recent announcements at Mix'08 in cloud computing and advertising it would seem that Microsoft no longer sees itself as simply a Windows company. Arguably another indication of this is their determination to buy the LAMP-centric (Linux/Apache/MySQL/PHP) Yahoo. Instead of migrating all the tried and tested Yahoo services over to a Windows server infrastructure, wouldn't it be simpler to establish Microsoft Linux through the acquisition of Novell?

The case for splitting Novell

David — Sun, 03 Jun 2007 23:56:55 +0000

Phil Windley in a recent Between the Lines posting entitled 'Split Novell?' mused that Novell's relatively poor identity management business performance (in comparison to the industry in general) was perhaps a result of poor strategic synergy between their operating system (Suse) and IDM product lines. Not being a financial follower of the IDM market I cannot say for certain whether he is right or wrong, but I do agree with his basic assertion that Novell should be split in two. For a while now I have felt that their emphasis on Suse Linux is to the detriment of their excellent product offerings in the identity and network services markets such as eDirectory/iManager, IDM, iFolder and ZenWorks.

Commoditising the operating system

The success of Novell during the 80's and early 90's was due in no small part to their tried and tested Netware operating system. Unfortunately the operating system market has changed, Windows has matured and Linux has gained a strong foothold as a ubiquitous, free platform for reliably hosting network services. With the gradual demise of Netware, Novell had an opportunity to step out of the low-level operating system market and focus on the aspects of their business that where going strong. In this process they could have left the grunt work of maintaining the base operating system to partners such as Red Hat, Suse and even Microsoft. This would have provided a clean and relatively open migration path for existing Netware customers who are committed to a Novell infrastructure (i.e. eDirectory/Groupwise/Zenworks) and for the most part ignore the underlying operating system so long as it was stable and supported by a reputable party.

Instead of adopting a lightweight approach Novell opted to maintain their tried and true business model through the purchase Suse Linux as a straight replacement for Netware in their product arsenal. This meant that instead of placing development emphasis on getting their network and identity products seamlessly working on a range of partner operating systems attention was focused on fusing Novell's existing identity and network services into Suse Linux. The culmination of these efforts has resulted in Open Enterprise Server (OES), an excellent Netware 6.5 replacement that continues with the Novell tradition of marketing a tightly bound operating system/network services stack. Unfortunately this focus on a closed server/services model has been to the detriment of the network and identity services' deployment flexibility and marketing appeal as these valuable offerings must be coupled to and marketed alongside their related server products.

A fuzzy cross-platform commitment

Many of the identity and network services produced by Novell are technically cross-platform to one extent or another. Traditional products like eDirectory can run on just about any hardware/software combination whilst many of their other services run within inherently cross-platform run-time environments such as Java or Mono. Unfortunately the difference between technically cross-platform and a practical reality whilst relatively small is significant. In general the problems are in the details or related to how difficult a Novell service is to install, setup and maintain on a non-Novell system. However in extremes cases it can result in the service not working at all, for example even though the iFolder Server/Client is Mono-based (and technically Linux distribution agnostic) it doesn't yet compile or run correctly on significant distributions such as Debian/Ubuntu. Even though tailoring and packaging these services to run on non-Novell systems is not difficult, the fact of the matter is Novell views their services running on anything other than their operating system as second class citizens. Such capability is kept around for marketing purposes to say how it 'might' be done, but realistically what needs to happen is something significantly different and less flexible. If you doubt this try setting up a suite of basic Novell network services (eDirectory, iFolder and Groupwise) on a Red Hat server. Whilst it can be achieved it is overly time consuming and the result not nearly as seamless as a pure OES. At a system level very little is different between the two approaches but the significant different lies in the automated installation steps provided for the Novell operating system.

A separation of power

Another argument for the delineation of Novell between its services and operating system business would be in clearing up its relationship with open and closed source partners. Presently Novell occupy a difficult place as they attempt to straddle the closed and open source worlds with their closed identity and service products on one side and Suse on the other. Given this schizophrenia it is not unsurprising that many feel they are not doing a good job at managing either side of their businesses, especially when it comes to public relations and marketing. As a consequence of this difficult market position they are seemingly destined to loose no matter what; deals made with Microsoft are viewed in a poor light whilst at the same time future legal threats to Linux/open source cast a potentially menacing shadows over their core business. In contrast an identity and network services orientated Novell would be free to make deals with Microsoft and work with the popular Linux distributions simultaneously without publicly having to present a split personality. This would be a far more flexible position to be in than the place they are at the moment; sandwiched between the open source community and Microsoft, all the while being attacked and cheered by both sides.

Could Novell survive without an operating system?

The underlying logic that belies this hypothetical argument is that a software company focused on high-quality identity and network services can survive without the need for a dedicated and tightly controlled operating system platform. For 99.99% of the software companies around this logic holds true, so why this should not be the case for Novell is a matter of debate. On one hand is the argument that only a tightly integrated services/operating system stack will enable Novell to provide the level of support and stability business customers demand. However whilst there are some definite advantages to this model the majority of software vendors provide services just as reliable as Novell's without the need to control every facet of the operating environment. The tantalising fact is that the majority of Novell's own services are designed with this level of flexibility in mind, it is only the self-imposed ball and chain of their operating system commitment that keeps this from flourishing. Perhaps the greatest barrier to realising such a company is psychological rather than practical as two separate entities centered around identity/network services (Novell Services) and operating systems (Suse Linux) would individually be smaller than the current 5,000 employee company Novell is today.

A Novell unburdened by an operating system would be leaner and more dependent on operating system partners such as Red Hat, Suse, Ubuntu and Microsoft to provide a full range of services. Whilst not as grand as their current strategy this focused approach would give the customer the ability to immediately deploy the Novell services they require on the platforms they trust. This at the end of the day should be the goal of an identity and network service-centric company rather than preserving server market share or establishing desktop domination.

suse
novell

First Allison now Haeger, is there any personality left in Novell?

David — Thu, 26 Apr 2007 23:13:49 +0000

Today Ted Haeger announced on his personal blog that he has left Novell and taken up a position at Bungee Labs, a Web 2.0 startup focused on creating a purely Web-based application development environment and deployment platform.

Ted founded the Novell Open Audio podcast which did an excellent job of humanising the image of Novell, especially within the Linux community. In general Novell's formal marketing is pathetic but thanks to Ted's leadership Novell Open Audio created an isolated bright point. The podcast provides an excellent conduit for information about Novell products minus the 'doublespeak' that normally accompanies their P.R. attempts. Whilst Ted was not too explicit over the future of the podcast I am sure if Novell management continue to support the show its co-host Erin Quill will do an excellent job as lead.

Ted's departure from Novell removes yet another prominent personality from its ranks after Jeremy Allison's recent move to Google. Together the pair expressed rare qualities for Novell figureheads; honesty and an air of confident casualness quite unlike the suited and boring party line image normally attributed to the company. Sure Miguel de Lcasa and Nat Friedman are still around but as a Linux user I would prefer they concentrate on their respective technology fields. I hope we see a couple of new up and comers stand up to take their place, unless of course Novell plan on subcontracting their P.R. out to Microsoft...

novell

A funny little video from Novell

David — Tue, 20 Mar 2007 10:58:16 +0000

With Novell's Brainshare well underway they have released a very unique 'will it blend?' video onto YouTube. Ted Haeger's been talking about this for a while now and I can see why, it does a very good job of simulatanoeously being funny whilst remaining stuffy enough to be instantly identified as a Novell video. Sure it is no Apple advert but it is good to see even if you are just interested what would happen if you put a Windows CD, a Mighty Mouse and a helping of Red Bull into an industrial strength blender...

linux
novell

Jeremy Allison speaks out on Novell

David — Mon, 15 Jan 2007 22:22:41 +0000

On December 29th Jeremy Allison officially left Novell and was able to speak openly about the Novell-Microsoft deal. He provided answers to questions posed Mary Jo Foley of ZDNet and Boycott Novell although it would appear that his answers to the later source were for the most part copied and pasted from his ZDNet interview. What is interesting from the interviews is that the controversial patent deal was included by Microsoft at the last minute (5 days before the announcement). This would suggest Novell was setup by Microsoft, or even worse intentionally withheld information from people within their own company that understood the most about the issues at hand. Whichever was the cause it does not bode well for Novell as it was a lot of negative publicity they could have seriously done without and even avoided if managed more effectively.

Jeremy Allison leaves Novell in protest

David — Fri, 22 Dec 2006 10:22:02 +0000

Lead Samba developer and vocal open source figure Jeremy Allison has left his position at Novell in protest of their recent patent-protection agreement with Microsoft. It is a great move from Jeremy who has made it clear in the past that his principles (and tongue lashings) will not be bent by corporate pressure.

In a parting shot Jeremy made public a letter he had sent to Novell management. Within it he made a brilliant point regarding the patent agreement and the often misunderstood reaction to it by the Free Software community:

"Do you think that if we'd have found what we legally considered a clever way around the Microsoft EULA so we didn't have to pay for Microsoft licenses and had decided to ship, oh let's say, "Exchange Server" under this "legal hack" that Microsoft would be silent about it - or we should act aggr[i]eved when they change the EULA to stop us doing this?"

It is an excellent point that brings into question people's willingness to accept theft and wrong doing as something that can only occur to an object with a defined monetary value. The components that form GNU Linux have a value, they are Free in all senses of the word. Yet when Novell and Microsoft found a way around the GPL2 license to 'sell' their patent-protection alongside GNU Linux many in the industry viewed it as completely honest and worthwhile. This even though the agreement broke in spirit, but not in practice, the licensing terms of the GPL2.

UPDATE: CNET News.com is reporting that Jeremy Allison will be joining Google in the new year.

Novell officially pulls plug on Hula

David — Tue, 28 Nov 2006 20:32:03 +0000

Novell has officially ended development of Hula, its open source email server stack. For those involved in the Hula community the news was not unexpected but it will be a shame to see go what once promised to bring a breath of fresh air into the rather staid life of open source email and webmail services.

History

In its prior, closed source life Hula was named NetMail and was sold as a lite alternative to GroupWise for webmail users. Back in early 2005 Novell open sourced Hula to great fanfare and pitched the project as a concise and up to date alternative to the postfix/imapd/Squirrelmail stack dominant amongst most Linux email solutions. The idea was a good one, the existing stack is a pain to configure, disjointed and the Squirrelmail component is really showing its age. Hula offered a complete, concise and functional alternative that was well tested and had an exciting development path plotted out.

Unfortunately for Hula problems began to rise very quickly. The underlying mail storage engine had significant problems requiring a complete rewrite and the 'Web 2.0' style interface which promised to blow people away took forever to emerge. The consequences of these problems set the project back significantly. The rewritten engine whilst significantly improved lacked a stable migration path for existing Hula users, trapping many in older versions and causing others to think twice before deploying or even testing the system. Delays in the interface put Hula significantly behind in terms of user experience when compared to its competitors like GMail, Yahoo Mail, Zimbra, Scalix and RoundCube.

At the beginning of 2006 with the services component of Hula in trouble and the interface lost in limbo-land it was not a good time for Novell to hit financial troubles resulting in staff cutbacks and a refocusing of efforts. These changes shifted Hula's development priorities, gone was a complete email server stack and in its place was the concept of Hula-Lite, a Webmail/Calendar interface which could talk to numerous email back-ends. This concept seemed promising but again a lack of development progress brought on by a limited commitment from Novell and almost zero community developers stalled the project once more. The writing was on the wall for Hula when its lead developer, Dave Camp recently left Novell. The nails were finally put in the coffin when on the 28th November Peter Teichman announced on the Hula mailing list that Novell would no longer be committing development resources to the project.

What went wrong?

The greatest unresolved issue that surrounded Hula from its conception was how Novell expected to concurrently develop two separate email systems (GroupWise and Hula). If Novell saw an opportunity for an open source email stack then it would have made more sense to open source aspects of GroupWise. This would have allowed them to bask in the feel good glow of the open source community whilst allowing themselves to concentrate efforts on a single server stack. Such a move would also have made better financial sense as a simple migration path from a 'free' open source service to license-based closed source model could have been offered to users. Such a strategy is what Zimbra and Scalix offer and for the most part it appears to be working very well for the two companies concerned. By dividing their efforts Novell sent out mixed messages about the two products and created inefficiencies within the company by effectively having two teams doing the same thing.

Another major factor in Hula's demise was the manner in which its launch was handled and the resulting troubles which ensued. Confidence is a key factor in any software and is very difficult to get back once it is lost. Initially following Hula's launch hundreds (if not thousands) of interested people downloaded the binaries and tested the software. By and large everyone was impressed and for a while the community was very strong. Unfortunately during this time news of the email storage redesign was made public. For users it was like getting a car and then finding out the engine was no good and had to be replaced with a completely different one that didn't quite fit the space available. Consequently many people, including myself, left Hula in search of an alternative rather than face the problematic and painful task of being guinea pigs during the storage migration period. Novell would have fared better if they had addressed these significant architectural issues before Hula's public launch or terminated the entire project then and there if the task was deemed too difficult.

The future

Novell's relationship with Hula maybe dead but the project will continue to live on. How things progress (if at all) will be interesting to see. Alex Hudson is the most vocal community member and he has already begun to rally Hula supporters to see if Hula can get back on some sort of track again. I have my fingers crossed that he and what remains of the community can make some progress in this endeavor.

novell
hula

A wrap up of the weeks Novell/Microsoft action

David — Fri, 24 Nov 2006 23:20:41 +0000

This week the Free Software Foundation (FSF) announced that it would not be taking Novell to court over their patent deal with Microsoft and its potential infringement of the GPL version 2. Instead the FSF's general counsel, Eben Moglen, announced that they would be pushing through with the finalisation of GPL version 3 which resolves many of the ambiguities present in GPL version 2. This strategy effectively takes the high road in the altercation, a costly and dirty lawsuit brought by the FSF against Novell right now would only harm both camps and potentially leave Novell without a viable operating system if they were to loose. By taking the less confrontational GPL version 3 approach the FSF does not condone Novell's actions but they do give everyone involved some breathing room in order to resolve the issue more constructively.

Once the GPL version 3 is finalised and the majority of GNU Linux codebase (including the kernel) has adopted it Novell will once again be left in a difficult situation. The onus will be on their engineers to back-port all new functionality and security fixes to their existing GPL version 2 compliant code bases rather than incorporating patches from the community which the current process. This is a complex and expensive proposition which could potentially leave them in the dust when it comes to GNU Linux operating system development. Fortunately for Novell given the GPL version 3 time line the effects of the problem will not be experienced for at least a year (if not more), so this is really an issue for the Suse Linux Enterprise Server/Desktop 11 team to ponder and will not seriously impede Novell's current crop of products.

This week also saw a range of announcements by parties related to or effected by the deals.

Novell was quick to release a statement rejecting Steve Balmer's claim that anyone who used Linux effectively owed Microsoft. Considering patents are a fundamental issue in the Novell/Microsoft deal this very public disagreement was baffling to most observers and a sign that the deal was rushed or not fully worked through before it was announced. At the end of the day Microsoft left the issue in the air by stating they agreed to disagree on the matter with Novell. The Gillmor Gang podcast "The Thanksgiving Gang" has a very good section related to the deal that is worth listening to. In it Doc Searls continues to flesh out the humorous idea that Microsoft is now just a legal company masquerading as a software vendor.

Key people within IBM, Red Hat and Ubuntu have also weighed in on the deal. IBM's Scott Handy in an interview with Linux Watch was pleased to see Microsoft finally acknowledge Linux and viewed their promise to work towards interoperability as good for the entire community. On the other hand was adamant that Microsoft's patent claims were baseless, so hopefully this is a sign that we won't be seeing a similar IBM/Microsoft agreement in the near future. In a more controversial blog posting Mark Webbink of Red Hat obliquely compared the deal with Chamberlain's 1938 agreement with Hitler just prior to the commencement of World War II. He goes to point out what in his opinion are the hidden messages behind the deal and how it maybe an indication that Novell's once strong commitment to open source is now fading. Just to throw the cat amongst the pigeons Mark Shuttleworth of Ubuntu fame recently welcomed any disenchanted Suse developers into the Ubuntu camp ahead of the Ubuntu Developer's Week.

Meanwhile Novell marketing is beginning to shift its emphasis following the deal. Groklaw has a good rundown of how Novell are using the patent agreement as a marketing tool in Europe. Also this week Groklaw posted an excellent article that highlights the fact that anti-Microsoft marketing on the Novell website (such as the 'Unbending the Truth: Things Microsoft Hopes You Won't Notice' page) have mysteriously disappeared or been reworded to take the sting (and meaning) out of the message.

linux
novell

Microsoft rattling the patent case cage

David — Sat, 18 Nov 2006 08:34:29 +0000

Microsoft's silent threat of patent lawsuits against Linux users is beginning to solidify in the last couple of days. Since the announcement with Novell, Microsoft have been busy trying to establish similar patent protection deals with other Linux vendors. However their attempts have not been greeted warmly by Red Hat who's deputy general counsel ruled out any need for such an agreement on the grounds that "we do not believe there is a need for or basis for the type of relationship".

Fortunately for Microsoft they are not easily deterred by such confidence with CEO Steve Ballmer (in the words of Boing Boing) painting Linux users as patent crooks during a Q&A session on Friday. Although Ballmer did not say it so bluntly he did openly threaten businesses running Linux by stating that the Novell patent protection is crucial otherwise:

"We (Microsoft) believe every Linux customer basically has an undisclosed balance-sheet liability."

Source LinuxWorld - Linux Users Owe Microsoft

These are definitely fighting words but at some stage they are going to have to do more than just rattle their hypothetical sabres and actually sue. If (when) that day comes it will be a very interesting moment in open source history and be a pivotal moment in the future of Microsoft.

The Samba Team responds to Novell's actions

David — Mon, 13 Nov 2006 08:38:17 +0000

A few weeks after the Novell/Microsoft announcement the Samba Team have officially requested Novell reconsider their stand on patents. The Samba project is an important (if not crucial) piece of open source software that is allowing a wide variety of platforms (but mainly Linux) to compete head to head with Microsoft solutions in the workplace. Jeremy Alison co-heads the Samba project and is an employee of Novell but obviously this has not stopped the team from taking a moral stand against software patents and the actions of Novell and Microsoft.

This stance is completely opposite to the Mono team leader Miguel de Icaza's official support of the deal, but this is not surprising considering 99% of Mono development is funded and directed by Novell. I doubt Novell will heed Samba's request but at least its good to see such a prominent project take such a decisive stand on the matter.

Novell Open Audio on the state of iFolder

David — Sun, 12 Nov 2006 10:12:07 +0000

Ted Haegar of Novell Open Audio fame is doing a great job addressing some of the points I raised earlier this year about the podcast. Not only is he managing to keep up his jet-setting lifestyle but in between jaunts to all four corners of the world he is managing to interview some really great Novell people like Jason Williams on the future of iFolder.

iFolder for those who don't know is an easy to use file synchronisation tool. Unfortunately iFolder is one of those (all too many) Novell products that is brilliant in concept but hasn't quite made it when it comes to execution or industry uptake. A good analogy to describe iFolder would be that of an Olympic high diver from a small ex-Soviet block state attempting a dive that would surely win the gold but because of lack of preparation, brought on by the fact they couldn't afford to practice full-time and instead were milking cows, they just don't quite pull it off when it counts.

What do I mean by this? iFolder 2 was nice but it was heavily tied into Netware, offered only a Windows client and had a restrictive usage model. iFolder 3 promised to fix these shortcomings but instead (prior to version 3.6) it seems to have lost its direction and paid the price for certain architectural decisions that in hindsight are questionable. In both cases the potential was there but the focus and determination to pull off the task seemed to wane as time progressed.

It would appear as if internally Novell realised this and drew iFolder development to a halt for a period of soul searching. This is all well and good but it needed some indication to the public (i.e. the open source users) that this was happening. Conventional business processes can afford to go silent as customers are only expecting news about the next big release. In the open source world I am afraid user expectations are slightly different, we (Joe public) are interested in developer progress right down to every SVN commit. The reason why this is the case is simple, an open source project's biggest proponents and knowledge base is its users, more precisely the users interested enough to join the mailing lists and follow the developers blogs.

Why are these users so important you may ask? Because when it boils down to it these are the people that are going to sell Novell products better than Novell's marketing department could ever hope. The people in these communities are typically the ones with a great influence on corporate purchasing decisions, and even when they can't they have a knack of getting the products used anyway. So when Jason Williams talks about balancing the 'corporate' and 'open source' worlds of iFolder he'd better be careful because it indicates that maybe he does not understand or appreciate how closely these two worlds are interconnected.

Novell respect your users and they will respect you. Please in the future if a project is off the tracks and needs some alone time to think about life just tell us. Robert Scoble of ex-Microsoft fame was very good at this and it gained him the respect of nearly everyone, even ardent Microsoft bashers. Do not treat your open source projects and users as second class citizens, sure they may not pay the bills like the corporate cats but they will be your biggest supporters when you get things right and won't threaten you with lawsuits or a migration to Microsoft when you are wrong.

Oh and Ted and Jason, in the future don't throw the term 'Web 2.0' around in the same sentence as AJAX and Ruby on Rails, they are definitely not at all semantically related and if iFolder is done right it can be so much better than all of those things.

How things are shaping up with the Novell/Microsoft deal

David — Wed, 08 Nov 2006 23:01:29 +0000

If you are part of the Linux/Novell community last week you would have no doubt heard of the Microsoft - Novell agreement. When it was first announced it looked materially very boring on the surface comprising of a couple of virtualisation developments and a promise by the two companies to work on OfficeXML and directory system interoperability. All this is fairly trivial but what made the deal controversial was the promise from Microsoft not to sue Novell customers for using Linux.

The two 'problem' technologies that fall under this legal cloud is Mono, an implementation of Microsoft's .Net runtime for Linux and Samba, a SMB compatible client/server capable of mimicking the network functionality within Microsoft products. Whether or not there is any real legal grounds for patent infringement is a matter for debate. Neither break copyright laws and the extent of patent infringement by either project has never been described by any party. Nonetheless Microsoft has successfully created and maintained a cloud of uncertainty over these products, a feat helped in no small part by their support of the long running SCO vs IBM/Novell lawsuit (which boils down to the copyright status of some Linux code).

This agreement between Microsoft and Novell whilst not affirming any patent infringement claims does imply there are legitimate grounds. Both parties benefit from the Fear Uncertainty and Doubt (FUD) created from this agreement. Microsoft clouds the Linux legal waters forcing CEO's and CIO's to hesistate on purchases whilst Novell benefits financially and increases Linux sales thanks to the official support of Microsoft and their ability to preach that they are legally the safest Linux option. Unfortunately with a scenario like this there are always losers, the biggest in this case being Red Hat which was already staggering after Oracle's Unbreakable Linux moves a week earlier. There is also a question mark hanging over how this will effect the Linux community as a whole. The issue of patents is very significant yet up until this agreement the community, along with companies like IBM, Sun and Novell, have been able to present a united front against Microsoft threats.

Just to add fuel to the fire is the effect of the agreement on the GPL and Novell's ongoing ability to distribute GPL licensed software (e.g. Linux) as pointed out by Eben Moglen. Section 7 of the GPL states that GPL software cannot be sold for patent royalties. Up until this point Novell has always 'sold' Linux support and kept the software 'free', but the agreement with Microsoft implies that some of this revenue is actually being paid to Microsoft as royalties. This would violate the terms of the GPL and stop Novell from redistributing Linux (now effectively their primary operating system).

Yesterday Novell cleared this matter up through a series of public statements. In essence the media releases established that individual Novell customers were in fact creating a separate agreement with Microsoft when purchasing Novell Linux support and that Novell had nothing whatsoever to do with this covenant except they 'assisted' their customers by paying Microsoft on their behalf. Groklaw soon pointed out there are some considerable legal issues surrounding the move that may still invalidate the terms of the GPL. Although still not legally validated this is an interesting move by Novell/Microsoft as it sidesteps section 7 of the GPL, effectively allowing royalty payments for GPL software. No doubt the Free Software Foundation (FSF) will take a very close look at this agreement and there will be a strong desire among many in the Free and Open Source Software (FOSS) community to have it struck down in court.

If the terms of distribution are proven to violate the GPL then Novell will face some significant problems. They will not be able to redistribute Linux or taut their legal superiority over other distributions. In fact in such as scenario they would loose most of the reputation they have in the industry, forcing into question their very existence. If proven to be violating the GPL Novell will have no choice but to either withdraw from the Microsoft agreement (at a cost of millions) or devise a means of making money from Linux in a way that does not entail actually distributing it.

Distributing just the closed source binaries (the secret sauce) that differentiate Suse Linux Enterprise and Open Enterprise Server from the community driven OpenSUSE distribution maybe an alternative. In my opinion this would not be a bad option, the value in Novell's products have for a long time existed in the tiers above the operating system, for example eDirectory, Groupwise, the Novell Client, Zenworks and Identity Services. By forcing the company to focus on easy distribution of these valuable services across a range of distributions it would actually open up new markets and business opportunities which their current, self-contained Enterprise distributions are not allowing.

No matter what happens I am sure the next few months will be very interesting, not just for Novell but for the entire Linux and FOSS community in general....

To open source or not open source, that is the question

David — Thu, 14 Sep 2006 11:16:04 +0000

Thanks to Ted Haegar I came across a piece by Tony Whitmore on a similar topic to my Novell Open Audio review. Tony raises a couple of good ideological questions about the development models at work within Novell, more precisely around the AppArmor and XGL products. Whilst each software project is unique in its own way his questioning of the strategies employed by Novell does beg the difficult question, how open source should product development be?

When I mull this issue around in my head it is like there are a couple of little devils sitting on my shoulders whispering sweet nothings. On one side sits the 'hardcore' open source evangelist devil who looks surprisingly like a drunk fluffy penguin dressed in dirty, well-worn clothes. He whispers in my ear that all software development should be free and open to ensure clean, secure code and a strong community both supporting the product and the FOSS community at large. However on the other shoulder sits a clean cut, black turtleneck wearing cat that seems to go by a different name each year. He presents a flashy keynote on the benefits of developing software products with a clear vision and a small, well controlled development team. What is confusing is that they both have some very good points along with vocal opposition in some quarters.

Novell at present are threading a tricky needle between the opinions of both devils. Their challenge lies in creating a strong community of well supported and stable products whilst at the same time introducing a number of "gee-wiz" features that are unique so to generate enough buzz to outshine their competitor's alternatives. Open source is great for building strong communities and stable products because everyone can see and take part in development. Unfortunately this same model makes marketing a nightmare because it has a high 'yawn' factor. Take for example XGL, it made a huge splash a few months ago mainly because Novell came out of nowhere to introduce it into their Suse Linux Enterprise Desktop line. This splash put the spotlight on SLED like never before and really pushed it into the forefront of viable Linux desktop alternatives. However if XGL development had been undertaken in a purely open source manner with its conception well publicised and discussed the eventual product and marketing potential would have been considerably different. Not only would it have probably taken a different evolutionary path but more importantly its marketing pull on SLED's launch would have been insignificant.

Whilst closed development is arguably better in the early stages of development from an efficiency and marketing perspective over the long-term an open source approach is far superior. Now that XGL has gone through its silent phase and emerged to an eager audience it is good to see Novell have open sourced the code and are focusing on getting the technology mature and broadly accepted. Personally I would like to see eDirectory open sourced mainly because it lost its 'wow' factor a long time ago and could stand to gain a significant amount by being accepted by the wider open source movement. A significant part of this acceptance would be seamless integration into existing Linux distributions in the same manner as Apache, MySQL and PHP have achieved. There is a real need for a robust, high-quality, open source directory server as it is the centrepiece around which nearly all office networks are built. A few years ago Red Hat open sourced the Fedora Directory Server but I have not been impressed when I have experimented with it. This is mainly because FDS is OpenLDAP on steroids rather than a stable, scalable and industry proven directory server alternative that can go toe to toe with Microsoft's Active Directory.

The other factor to take into account with eDirectory is that Novell does not really make any money out of it yet it is the cornerstone of nearly all their income streams. Consequently open sourcing this key piece of infrastructure and encouraging its adoption and integration in other platforms will broaden's Novell's potential market. This will mean when the next 'gee-wiz' product gets released it is just that little bit easier to sell to prospective customers because a considerable portion of the puzzle is already in place. To open source or not open source is not a clean cut strategy but one that seems to hold most potential when used equally in appropriate portions. It would be nice in the ideal world to have a completely open development model, but deep down I think we all want to get marketed to by at least one flashy, out of the blue product that makes us wonder how we got so far through our lives without it. Novell with XGL (and to a lesser extent AppArmor) achieved both goals with an intelligent, balanced approach and for that they should be commended.