ECE Information Technology Services - User contributions [en]

File:Poweredby mediawiki 88x31.png

2009-05-15T23:25:33Z

Jazminl:

IT:About

2009-05-15T23:24:41Z

Jazminl: New Page

This website is powered by [http://www.mediawiki.org MediaWiki]

[[Image:Poweredby_mediawiki_88x31.png]]

How To Configure Thunderbird

2009-05-15T23:22:47Z

Jazminl: New Page

These instructions are for
[http://www.mozilla.com/thunderbird/ Mozilla Thunderbird] 2.0.
Before performing the steps below, ensure that your account has been
configured to use [[Mbox to Maildir Conversion|Maildir]].

==The New Account Wizard==
To enter the New Account Wizard, use the ''Tools'' menu to select ''Account
Settings...''. Click the ''Add Account...'' button. (The first time you
launch Thunderbird, you will enter the New Account Wizard automatically.)

[[Image:Thunderbird_wiz_newacct.png]]

Enter your real name and your e-mail address
(which is '''username'''''@ece.ubc.ca'').

[[Image:Thunderbird_wiz_identity.png]]

Then instruct Thunderbird to use the ECE mail servers, ''imap.ece.ubc.ca'' and
''mail.ece.ubc.ca''.

[[Image:Thunderbird_wiz_server.png]]

Enter your username twice.

[[Image:Thunderbird_wiz_usernames.png]]

Give a name under which to save the configuration. You can call it whatever
you wish; the suggested default works.

[[Image:Thunderbird_wiz_acctname.png]]

==More Configuration Steps==
Since the New Account Wizard does not prompt you for the required
encryption settings, the first attempt to connect to the server will fail.
You will need to enter these settings manually through the
Account Settings screen (which you can bring up using ''Tools'' >
''Account Settings...'').

Under ''Server Settings'', choose ''SSL''. This will automatically change the
port number to 993.

[[Image:Thunderbird_settings_server.png]]

Under ''Outgoing Server (SMTP)'', select the ''mail.ece.ubc.ca'' server and
click ''Edit...''. In the dialog, select ''TLS'' and change the port to
''587''.

[[Image:Thunderbird_settings_smtp.png]]

==See Also==
* [[Email Quick Start]]
* [[Mbox to Maildir Conversion]]
* [[How To Configure Your Email Client]]

How To Configure Outlook Express

2009-05-15T23:22:28Z

Jazminl: New Page

These instructions are for Outlook Express 5.5 and 6.0. In the screenshots
below, you should use your real name and username in place of mine.

==Setting up an Account in Outlook Express==
* From the 'Tools' Menu, select the 'Accounts' menu item. The 'Internet Accounts' dialog box will appear.
* Click on the 'Add' button and select 'Mail...'.
* The Wizard will step you through the process of creating an email account. Unfortunately, the Wizard is not sufficiently intelligent to help you set up your account to use SSL-enabled services like [[SMTP|SMTPS]], [[IMAPS]], or [[POP3S]].
* Once the Wizard is finished, your new account will appear in the list of accounts in the 'Internet Accounts' dialog box. Select the new account and click on the 'Properties' button. Make the various tabs look like the screen shots below (choose the appropriate set).
* Close all the windows by clicking OK or Close, and restart Outlook Express (just to be on the safe side).

==Using Outlook Express with SMTPS and IMAPS==
Account Settings - General Tab

[[Image:Oe_general_imap.png]]

Account Settings - Servers Tab

[[Image:Oe_servers_imap.png]]

Account Settings - Advanced Tab

[[Image:Oe_advanced_imap.png]]

Account Settings - IMAP Tab

[[Image:Oe_imap.png]]

==Notes==
# You may get a message "Fatal error: no directory: Maildir" until you receive your first email.
# The use of Outlook Express is prefered over Outlook for the following reasons:
:* Outlook Express supports many of the enhanced IMAP features
:* Outlook doesn't allow to delete folders under the IMAP folder tree

==See Also==
* [[Email Quick Start]]
* [[Mbox to Maildir Conversion]]
* [[How To Configure Your Email Client]]

How To Configure Eudora

2009-05-15T23:22:01Z

Jazminl: New Page

Only the version 5.2.1 of Eudora supports the latest Secure Socket Layer
implementations used by our mail server. You must upgrade to 5.2.1 or newer.

==Using Eudora with SMTPS and IMAPS==
From the ''Tools'' menu, choose ''Personalities''.
Right click on the Person/Account you wish to configure; choose ''Properties''.

[[Image:Eudora_persona.png]]

From the ''Generic Properties'' tab, ensure that:
* ''SMTP Server'' is set to ''mail.ece.ubc.ca''
* ''Authentication allowed'' is ticked
* ''Secure Sockets when Sending'' is set to ''Required, STARTTLS'' or ''Required, Alternate Port''

[[Image:Eudora_account_settings1.png]]

From the ''Incoming Mail'' tab, ensure that:
* ''Server'' is set to ''imap.ece.ubc.ca''
* ''Configuration'' is set to ''IMAP''
* ''Secure Sockets when Receiving'' is set to ''Required, Alternate Port''

[[Image:Eudora_account_settings2.png]]

Eudora (as of version 7.1) does not recognize the certificate authority
that issued the SSL certificates for ''imap.ece.ubc.ca'' and
''mail.ece.ubc.ca''. Therefore, the first time you send or receive mail,
you will encounter a "Certificate Error: Cert Chain not trusted" dialog.
Answer "Yes" to trust the certificate.

==See Also==
* [[Email Quick Start]]
* [[Mbox to Maildir Conversion]]
* [[How To Configure Your Email Client]]

How To Configure Apple Mail

2009-05-15T23:21:38Z

Jazminl: New Page

These instructions are for Apple Mail 2.1.2, the version included with Mac OS X
10.4 ("Tiger"). Before performing the steps below, ensure that your account has been configured to use [[Mbox to Maildir Conversion|Maildir]].

==The New Account Wizard==
To enter the New Account Wizard, select the ''Mail'' > ''Preferences'' menu
item, select the ''Accounts'' pane, then click the ''+'' button. (The first
time you launch Mail, you will enter the New Account Wizard
automatically.)

Select ''IMAP'' for the Account Type. The Account Description can be anything
you want. Also enter your real name and your e-mail address
(which is '''username'''''@ece.ubc.ca'').

[[Image:Applemail_tiger_wiz_geninfo.png]]

The Incoming Mail Server is ''imap.ece.ubc.ca''. Enter the username and
password of your ECE account, and click ''Continue''. It will try to connect
to the IMAP server, then fail after a few seconds. This is normal, since
the ECE server requires SSL, which you have not configured yet.

[[Image:Applemail_tiger_wiz_incoming.png]]

Click ''Continue'' again, at which point it asks you about using SSL for
incoming mail. (Had the application been properly designed, it would have
asked '''before''' trying and failing to connect without SSL.)

[[Image:Applemail_tiger_wiz_incomingsec.png]]

Configure the Outgoing Mail Server as ''mail.ece.ubc.ca''. Tick ''Use
Authentication'', and enter your ECE username and password. Again, click
''Continue'', wait for it to fail, then click ''Continue'' again.

[[Image:Applemail_tiger_wiz_outgoing.png]]

To finish the configuration, select SSL for outgoing mail.

[[Image:Applemail_tiger_wiz_outgoingsec.png]]

==See Also==
* [[Email Quick Start]]
* [[Mbox to Maildir Conversion]]
* [[How To Configure Your Email Client]]

How To Configure Your Email Client

2009-05-15T23:21:10Z

Jazminl: New Page

* [[How To Configure Apple Mail]]
* [[How To Configure Eudora]]
* [[How To Configure Outlook Express]]
* [[How To Configure Thunderbird]]

SMTP

2009-05-15T23:20:52Z

Jazminl: New Page

==What Is SMTP?==
The Simple Mail Transfer Protocol (SMTP) is the protocol used by clients to
send mail to servers to deliver to recipients. It is also used between servers
to transfer mail from one server to another.

==How To Use SMTP==
Configure your mail client to send mail through the departmental SMTP server,
which is ''mail.ece.ubc.ca''. The port number, authentication, and encryption
settings depend on where you connect from.

===Clients Within the ECE Network===
If your mail client '''always''' connects to the mail server from within the ECE
network, authentication is not required. Use the following settings
(which are usually the default):

* Port: 25
* Encryption: none
* Authentication: none

Laptops that sometimes connect from the ECE network and sometimes from the
Internet should be configured as external/roaming clients.

===External/Roaming Clients===
If your mail client sends mail through the ECE mail server from outside the ECE
network, the ECE mail server requires your username and password. (This
authentication requirement, which is standard practice, protects the mail
server from being used as a spam relay by external parties.) Furthermore, to
avoid transmitting cleartext passwords, TLS or SSL encryption is required.

Use the following settings:

* Port: 587
* Encryption: ''TLS'' (or ''STARTTLS'')
* Authentication: ''PLAIN''

Outlook Express, which does not support the TLS standard for securing SMTP
connections, requires these settings instead:

* Port: 465
* Encryption: ''SSL''

==See also==
* [[IMAPS]]
* [[POP3S]]
* [[How To Configure Your Email Client]]

IMAPS

2009-05-15T23:18:57Z

Jazminl: New Page

==What Is IMAPS ?==
Internet Message Access Protocol (IMAP) is the protocol used by clients to
retrieve mail from servers. It differs from [[POP3S|POP3]] in that the
mail is stored on the server and synchronised to the client. This means that a
user can use a variety of clients from a variety of locations and always have
a consistent view of their mail folders.

IMAP servers require clients to authenticate with a username and password.
Unfortunately, IMAP is not a secure protocol, so the username and password are
transmitted in the clear.

IMAPS is IMAP over Secure Sockets Layer. This provides an encrypted connection
for the Internet Message Access Protocol. More importantly, it provides an
encrypted connection over which the username and password may be transmitted
for authentication purposes.

The departmental mail server provides IMAPS access both internally and
extrernally. Unencrypted IMAP access is not provided.

==How To Set Up Your Account For IMAPS==
Your account must be configured to use the Maildir rather than the mbox
e-mail storage format. See [[Mbox to Maildir Conversion]] for more information.

==How To Configure Your Client==
Once you set up your account to, you need to configure your preferred client to
use IMAPS. The required settings are:

{| class="wikitable"
|-
! Setting
! Value
|-
| Protocol / Server type
| IMAP
|-
| Email address
| '''username'''<code>@ece.ubc.ca</code>
|-
| Server hostname
| ''imap.ece.ubc.ca''
|-
| SSL/TLS encryption
| SSL
|-
| Port
| 993
|-
| Authentication type
| Password (Secure authentication = No)
|-
| Username
| '''username'''
|}

Error When Using MATLAB Symbolic Math Toolbox on Linux

2009-05-15T23:18:22Z

Jazminl: New Page

Users of MATLAB 7 on Linux have reported that any attempt to perform symbolic
calculations results in "Invalid MEX-file" error, as in this session:

<pre>
syms a b;
a+b;

??? Invalid MEX-file '/opt/matlab7/toolbox/symbolic/maplemex.mexglx': /opt/matlab7/bin/glnx86/libmaple.so: symbol errno, version GLIBC_2.0 not defined in file libc.so.6 with link time reference.

Error in ==> maple at 104
[result,status] = maplemex(statement);

Error in ==> sym.maple at 85
[result,status] = maple(statement);

Error in ==> sym.plus at 22
X = maple(A(:),'+',B(:));
</pre>

This bug is due to an incompatibility between the Maple library code and the
C library on your system.

If you are using ''tcsh'' as your shell, the workaround is to set an
environment variable when invoking MATLAB:

<pre>
setenv LD_ASSUME_KERNEL 2.4.19
matlab
</pre>

If you are using ''bash'' as your shell, the workaround is:

<pre>
LD_ASSUME_KERNEL=2.4.19 matlab
</pre>

How To Use the MATLAB Compiler

2009-05-15T23:17:58Z

Jazminl: New Page

The MATLAB compiler invokes the command ''cc'' to compile C code. The proper
''cc'' command is not in the standard path as the normal compiler on the system
is ''gcc''. There is a ''cc'' in ''/usr/ucb/cc'' but it is not Sun's C compiler.
To make sure that Sun's C compiler is found by the Matlab compiler, add the
following to your ''.cshrc.solaris'' file:

<pre>
set path=(/usr/local/applic/WorkShop6.2/SUNWspro/bin $path)
</pre>

How To Prepare PDF From LaTeX

2009-05-15T23:17:35Z

Jazminl: New Page

LaTeX documents typically use the Computer Modern font. This font is not
resident in printers and must be downloaded to the printer in order for LaTeX
documents to be printed. The usual representation for the downloaded font is a
bit-mapped raster. It is designed for printing and the results usually look
good.

Instead of printing documents, however, it is common to distribute them
electronically. The most common format for this is the Portable Document Format
(PDF). Many journals and conference proceedings require submissions in this
format and it is commonly used on the web.

The usual procedure to create a PDF version of a LaTeX document is to first
convert it to \PostScript and then use Adobe Distiller or ''ps2pdf'' to convert
it to PDF. A problem with this is that the bit-mapped Computer Modern Fonts do
not scale well and the resulting PDF file does not look good when viewed on the
screen and sometimes does not look good when printed.

The solution is to use a scalable version of the Computer Modern font. This is
available on the Solaris systems by adding the flag ''-Ppdf'' to the ''dvips''
command. If your LaTeX source is in the file ''file.tex'', then the following
commands will produce ''file.pdf'' which will look good at any magnification on
the screen and will print with crisp characters.

<pre>
latex file.tex
dvips -Ppdf -o file.ps file.dvi
ps2pdf file.ps
</pre>

Another way to get scalable fonts is to use the pslatex package. If you do
this, then you don't need the ''-Ppdf'' option on the ''dvips'' command.

List of Available MATLAB Toolboxes

2009-05-15T23:17:07Z

Jazminl: New Page

The department has two licenses of MATLAB: one for Research use and one for
Classroom use. The Research License can be installed on any department Solaris,
Linux or Windows workstation. The Classroom License may be installed only on
PCs used for undergraduate instruction.

"Included" indicates product is included in the given license

"X" indicates product is not included in the given license

{| class="wikitable"
|-
! Toolbox
! Research License
! Classroom License
|-
| Communications Blockset 2.1
| Included
| Included
|-
| Communications Tlbx 2.1
| Included
| Included
|-
| Control System Tlbx 5.1
| Included
| Included
|-
| DSP Blockset 4.1
| Included
| Included
|-
| Data Acquisition Tlbx 2.1
| Included
| Included
|-
| Frequency Domain Sys Id Tlbx 2.0.3
| Included
| X
|-
| Fuzzy Logic Tlbx 2.1.1
| Included
| X
|-
| Image Processing Tlbx 3.1
| Included
| X
|-
| MATLAB 6.1
| Included
| Included
|-
| MATLAB C/C++ Graphics Library 2.3
| Included
| X
|-
| MATLAB C/C++ Math Library 2.2
| Included
| X
|-
| MATLAB Compiler 2.2
| Included
| X
|-
| MU-Analysis and Synthesis Tlbx 3.0.6
| Included
| Included
|-
| Neural Network Tlbx 4.0.1
| Included
| X
|-
| Optimization Tlbx 2.1.1
| Included
| X
|-
| Partial Differential Equations 1.0.4
| Included
| X
|-
| Real-Time Workshop 4.1
| Included
| Included
|-
| Robust Control Tlbx 2.0.8
| Included
| X
|-
| Signal Processing Tlbx 5.1
| Included
| Included
|-
| Simulink 4.1
| Included
| Included
|-
| Statistics Tlbx 3.0
| Included
| X
|-
| Symbolic Math Tlbx 2.1.2
| Included
| Included
|-
| System Identification Tlbx 5.0.1
| Included
| X
|-
| Wavelet Tlbx 2.1
| Included
| Included
|-
| xPC Target 1.3
| Included
| Included
|}

OPNET 9.0 User Variables (Windows)

2009-05-15T23:15:14Z

Jazminl: New Page

In order to be able compile modules in \OpNet enviroment on Windows platform it
is required to set variables. Below is a list of required variables to be set.

<pre>
DevEnvDir=C:\Program Files\Microsoft Visual Studio .NET\Common7\IDE

FrameworkDir=C:\WINNT\Microsoft.NET\Framework

FrameworkSDKDir=C:\Program Files\Microsoft Visual Studio.NET\FrameworkSDK

FrameworkVersion=v1.0.3705

INCLUDE=C:\Program Files\Microsoft Visual Studio .NET\VC7\ATLMFC\INCLUDE;C:\Program Files\Microsoft Visual Studio .NET\VC7\INCLUDE;C:\Program Files\Microsoft Visual Studio .NET\VC7\PlatformSDK\include\prerelease;C:\Program Files\Microsoft Visual Studio .NET\VC7\PlatformSDK\include;C:\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\include;

LIB=C:\Program Files\Microsoft Visual Studio .NET\VC7\ATLMFC\LIB;C:\Program Files\Microsoft Visual Studio .NET\VC7\LIB;C:\Program Files\Microsoft Visual Studio.NET\VC7\PlatformSDK\lib\prerelease;C:\Program Files\Microsoft Visual Studio .NET\VC7\PlatformSDK\lib;C:\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\lib;

MSVCDir=C:\Program Files\Microsoft Visual Studio .NET\VC7

Path=C:\Program Files\Microsoft Visual Studio .NET\Common7\IDE;C:\Program Files\Microsoft Visual Studio .NET\VC7\BIN;C:\Program Files\Microsoft Visual Studio .NET\Common7\Tools;C:\Program Files\Microsoft Visual Studio .NET\Common7\Tools\bin\prerelease;C:\Program Files\Microsoft Visual Studio .NET\Common7\Tools\bin;C:\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\bin;C:\WINNT\Microsoft.NET\Framework\v1.0.3705;

VCINSTALLDIR=C:\Program Files\Microsoft Visual Studio .NET

VSCOMNTOOLS="C:\Program Files\Microsoft Visual Studio .NET\Common7\Tools\"

VSINSTALLDIR=C:\Program Files\Microsoft Visual Studio .NET\Common7\IDE
</pre>

You can download the code above as
[http://www.ece.ubc.ca/~andreyv/opnet/vs.bat vs.bat].
You cannot use this file to set variables and you have to add them manually
through "Control Panel".

This information registered on \OpNet support site under [http://www.ece.ubc.ca/~andreyv/opnet/ FAQ 783].

The Departmental Mailing List Hierarchy

2009-05-15T23:14:51Z

Jazminl: New Page

The Department's mailing list server provides mailing lists for the Department
and for research groups.

The Departmental mailing lists are organised into the following hierarchy.
Please note that ''ece.ubc.ca'' must be appended to each mailing list's
address. Also, all of these lists either are moderated or require
non-subscribers to confirm their postings. Finally, subscription to these
lists is closed.

* dept@
** faculty@ - All Regular Faculty
*** fullprof@ - Professors
*** assocprof@ - Associate Professors
*** assistprof@ - Assistant Professors
*** instructors@ - Instructors
** otherfac@ - All Other Faculty
*** emeritus@ - Emeritus Professors
*** sessionals@ - All Sessional Instructors
**** winter1@ - Sessional Instructors for Winter Session - Term 1
**** winter2@ - Sessional Instructors for Winter Session - Term 2
**** summer@ - Sessional Instructors for Summer Session
*** adjunct@ - Adjunct Professors
**** visiting@ - Visiting Scholars
*** staff@ - All Departmental Staff
**** aso@ - Administration Services Staff
**** sso@ - Student Services Staff
**** technicians@ - Technical Staff (Electrical and Electronics Technicians + Machinists)
**** professionals@ - Professional Staff (IT + Managers)
** otherstf@ - All Other Staff (Research Staff, Former Departmental Staff, etc.)
** grads@ - All Graduate Students
*** phd@ - <nop>PhD Students
*** masters@ - Masters (MASC + MENG) Students
** undergrads@ - All Undergradate Students [1]
*** year4@ - 4th Year Undergraduate Students
*** year3@ - 3rd Year Undergraduate Students
*** year2@ - 2nd Year Undergraduate Students

Most commonly, the following are used:

* for information relevant to all deparmental users: dept@
* for information relevant to departmental employees: faculty@ + staff@
* for information relevant to all faculty: faculty@ + otherfac@
* for information relevant to all staff: staff@ + otherstf@
* for information relevant to all students: grads@ + undergrads@
: '''The ECE Undergraduate student body rarely read their @ece.ubc.ca email. Faculty members attempting to reach the undergraduate student body are encouraged to approach the Student Services Office for assistance in transmitting information via the Faculty Service Center (FSC) and the Student Service Center (SSC).'''

How To Sort Email

2009-05-15T23:14:33Z

Jazminl: New Page

* [[How To Sort Email Using Address Extensions]]
* [[How To Sort Email Using Procmail|How To Sort Email Using Procmail (For Advanced Users)]]

Procmailrc-imap.txt

2009-05-15T23:13:25Z

Jazminl: New Page

[[File:Procmailrc-imap.txt]]

Procmailrc-pop.txt

2009-05-15T23:13:03Z

Jazminl: New Page

[[File:Procmailrc-pop.txt]]

How To Filter Out Spam

2009-05-15T23:12:26Z

Jazminl: New Page

==Why doesn't the mail server filter out spam?==
No filtering mechanism, algorithm or tool is perfect. A global solution to the
spam problem will, invariably, cause some users' legitimate email to be
deleted. Therefore, we leave the decision as to whether to filter email to
each individual user. To help users filter their email, we have deployed
Spam Assassin.

==What is Spam Assassin?==
[http://spamassassin.apache.org Spam Assassin] is a classifier. Its only
purpose is to classify email as potential spam. It does '''NOT''' filter in and
of itself. You need to use procmail to do the actual filtering.

Spam Assassin uses a combination of heuristics, realtime black-hole list (RBL)
lookups, and a per-user Bayesian filters to classify email. Each rule that is
matched adds to the points of a particular email. The default threshold is
5.0: emails with a score of more than 5.0 points are classified as spam.

==How do I filter my email?==
First, you need to read and understand [[How Received Email Is Processed]]. Second, you need need to add the following
procmail recipes to your ''.procmailrc'' file (see [[How To Sort Email Using Procmail]]). These recipes will cause your received email to be (stage 1) classified by Spam Assassin and (stage 2) filtered.

===Stage 1 - Classification===

<pre>
### Stage 1: classification
# send the email to Spam Assassin for classification
:0fw:spam.lock
* < 256000
| spamc -f

# handle errors from Spam Assassin gracefully
:0e
{
EXITCODE=$?
}
</pre>

The above procmail recipe pipes your received email to Spam Assassin for
classification. Spam Assassin will add headers containing the results of the
classification to the email. For example,

<pre>
X-Spam-Flag: YES
X-Spam-Status: Yes, hits=6.1 required=5.0
X-Spam-Level: ******
</pre>

===Stage 2 - Filtering===
<pre>
### Stage 2: filtering (IMAP)
# example: put spam email into a subfolder named 'spam'
:0
* ^X-Spam-Flag: YES
${MAILDIR}/.spam/
</pre>

The above procmail recipe is useful for IMAP (Maildir) users. It filters based
on the ''X-Spam-Flag'' header. Email classified as spam is placed into
the Maildir-format mail folder: ''~/Maildir/.spam/''.

<pre>
### Stage 2: filtering (POP)
# example: forward spam to some other address
:0
* ^X-Spam-Flag: YES
! nobody@example.com
</pre>

The above procmail recipe is useful for POP (spool file) users. It filters
based on the ''X-Spam-Flag'' header. Email classified as spam is forwarded to
another address, ''nobody@example.com''.

Mail that is not caught by the Spam Assassin processing is stored in the
default location, ''~/Maildir/'' for IMAP (Maildir) users and
''/var/spool/<username>'' for POP (spool file) users.

Remember that your ''~/.forward'' file gets processed before ''~/.procmailrc''
(see [[How Received Email Is Processed]]);
therefore, if you fail to delete your ''~/.forward'' file, then your mail will
simply be forwarded, bypassing the procmail and Spam Assassin processing.

==I use POP. Is there an example ''.procmailrc'' file for POP users?==
Yes. See this example [[procmailrc-pop.txt|procmailrc-pop.txt]] file.

Please note the extensive comments describing various options for filtering the
email classified as spam by Spam Assassin

Please note the additional directives to handle going on 'vacation'.

If you choose to use this example [[procmailrc-pop.txt|procmailrc-pop.txt]] file, be sure to copy
it to ''~/.procmailrc'' and to change its mode to 644 or 600.

====Important Note:====
Some Windows browsers automatically append DOS EOL=characters to lines in text files. This is a '''*bad thing*'''. Ensure that the
[[File:Procmailrc-pop.txt|procmailrc-pop.txt]] file is saved with Unix EOL!! To convert from DOS to
Unix EOL, use the ''dos2unix'' command on the Solaris or Linux departmental
workstations. If the [[procmailrc-pop.txt|procmailrc-pop.txt]] file contains DOS EOL characters
(^M), then spamc will fail and you will lose mail!

==I use IMAP. Is there a complete example ''.procmailrc'' file for IMAP users?==
Yes. See this example [[procmailrc-imap.txt|procmailrc-imap.txt]] file.

Please note the extensive comments describing various options for filtering the
email classified as spam by Spam Assassin

Please note the additional directives to handle going on 'vacation'.

Please note the additional directives to handle sorting email sent to address
extensions into separate folders.

If you choose to use this example [[procmailrc-imap.txt|procmailrc-imap.txt]] file, be sure to copy
it to ''~/.procmailrc'' and to change its mode to 644 or 600.

====Important Note:====
Some Windows browsers automatically append DOS EOL=characters to lines in text files. This is a '''*bad thing*'''. Ensure that the
[[procmailrc-imap.txt|procmailrc-imap.txt]] file is saved with Unix EOL!! To convert from DOS to
Unix EOL, use the ''dos2unix'' command on the Solaris or Linux departmental
workstations. If the [[procmailrc-imap.txt|procmailrc-imap.txt]] file contains DOS EOL characters
(^M), then spamc will fail and you will lose mail!

How To Sort Email Using Address Extensions

2009-05-15T23:11:36Z

Jazminl: New Page

Email can be addressed to you in one of two ways:
* to your standard email address: '''username'''''@ece.ubc.ca'' (e.g., ''johns@ece.ubc.ca'')
* to an extended email address: '''username'''''+'''''extension'''''@ece.ubc.ca'' (e.g., ''johns+foobar@ece.ubc.ca'')

Both address forms are recognized as being for you. The difference is that the
mail server can be told to do different processing for mail addressed to your
extended email address based on the extension. The delimiter separating your
username and the extension is the ''+'' (plus) character. You can use as many
different extensions as you like: all the email will still be delivered to you.

One particularly handy use of extended usernames is automatic sorting of your
incoming email. (Please note: this will only work for those people who have
chosen to use [[Mbox to Maildir Conversion|Maildirs]]).

Suppose you are interested in subscribing to the [http://www.securityfocus.com/ bugtraq mailing list]. If you subscribe with
'''username'''''+bugtraq@ece.ubc.ca'', and you place a file named
''.forward+bugtraq'' file in your home directory containing:

<pre>
~/Maildir/.bugtraq/
</pre>

Then email from the bugtraq mailing list would be sorted into your bugtraq
folder automatically. No more bugtraq emails cluttering your normal inbox!

'''NB''': the trailing slash on ''~/Maildir/.bugtraq/'' tells the mail server to
deliver to a Maildir-formatted mailbox.

==See Also==
* [[Mbox to Maildir Conversion]]
* [[How To Sort Email Using Procmail]]

Email Forwarding

2009-05-15T23:10:02Z

Jazminl: New Page

Suppose that you use another email account as your primary account and that you
would like all your ECE email to be delivered there.

There are two ways to accomplish this:
* with directives in ''.forward'' files or
* with directives in ''.procmailrc'' files.

Please read [[How Received Email Is Processed]] to understand the difference between using ''.forward'' and ''.procmailrc''.

====Using ''.forward'' To Forward Email====
<pre>
somebody@example.com
</pre>

====Using ''.procmailrc'' To Forward Email====
<pre>
:0
! somebody@example.com
</pre>

How Received Email Is Processed

2009-05-15T23:09:32Z

Jazminl: New Page

==Overview==
The mail server processes incoming email addressed to your account by checking
for directives in files in your home directory. If no directives are found,
then it will use the destination of last resort.

==Processing of Forward Files==
First, the mail server looks for and honours the contents of the file named
''.forward'' in your home directory. Directives in this ''.forward'' file tend
to be relatively simple, such as as asking the mail server to forward your mail
to some other account (please see [[How To Forward Email]]).
If this file is found, the search for the next file, ''.procmailrc'', is not
undertaken and the destination of last resort does not to be used.

==Processing of Procmailrc Files==
If no ''.forward'' file was found, then the mail server looks for and honours
the contents of the file named ''.procmailrc'' in your home directory.
Directives in this ''.procmailrc'' file might be as simple as asking the mail
server to forward your mail to some other account but can be as complicated as
filtering for spam (please see [[How To Filter Out Spam]]).
If this file is found, the destination of last resort is not used.

==Destination of Last Resort==
If no ''.forward'' file nor ''.procmailrc'' file was found in your home
directory, then the mail server appends the incoming email to your
mbox-formatted spool file: ''/var/mail/'''''username'''. This is the so-called
destination of last resort.

==Interaction with POP==
If you want to use POP (POP3S, actually), then you should have a ''.forward''
file or ''.procmailrc'' file that causes the mail server to redirect yourmail
into your spool file, or neither of these files (so that the destination of
last resort is used). The POP server expects to find your new mail in your
spool file. Please see [[POP3S]] for more information.

==Interaction with IMAP and Webmail==
If you want to use IMAP (IMAPS, actually) or Webmail, then you should have a
''.forward'' file or a ''.procmailrc'' file that causes the mail server to
redirect your mail into a folder called ''Maildir'' in your home directory.
The IMAP server expects to find your new mail in your ''Maildir''. Please see
[[IMAPS]] for more information.

==Interaction with Disk Quotas==
Mbox spool files have a quota of 100MB.

Maildir folders in your home directory are limited to your quota on the file
server volume where your home directory resides or the size of the volume,
whichever is filled first.

Once you reach your quota or the disk is full, email will queue for up to four
days before being bounced back to the originator.

Please ensure that you remain below your quota to ensure that email is
delivered to you.

Email Quick Start

2009-05-15T23:09:12Z

Jazminl: New Page

ECE accounts come with the ability to send and receive e-mail. Your e-mail
address is '''username'''''@ece.ubc.ca''. (If you need a departmental account,
please see [[How To Get An Account]].)

Although the department supports several methods for sending and receiving
e-mail, most users will find that the recommendations below will suit
their needs.

==Enable Maildir For Your Account==
'''The instructions below assume that your account is configured to use Maildir
as the mail storage format.''' Accounts created since 2008 already use Maildir
by default. If you have an account created in 2007 or earlier, or if you are
unsure whether you are using Maildir, please refer to Maildir Conversion.

==Webmail==
Access your mail using a web browser through https://webmail.ece.ubc.ca/.

==Configure Your Email Client==
To read your mail using an e-mail client such as
[http://www.mozilla.com/thunderbird Mozilla Thunderbird],
[http://www.eudora.com/ Eudora], or
[http://www.microsoft.com/windows/ie/ie6/using/oe/default.mspx Microsoft Outlook Express], use the settings below.

===Receive Mail Via IMAPS===
{| class="wikitable"
|-
! Setting
! Value
|-
| Protocol / Server type
| IMAP
|-
| Email address
| '''username'''''@ece.ubc.ca''
|-
| Server hostname
| ''imap.ece.ubc.ca''
|-
| SSL/TLS encryption
| SSL
|-
| Port
| 993
|-
| Authentication type
| Password (Secure authentication = No)
|-
| Username
| '''username'''
|}

===Send Mail Via SMTP===
{| class="wikitable"
|-
! Setting
! Value
|-
| Protocol / Server type
| SMTP
|-
| Server hostname
| ''mail.ece.ubc.ca''
|-
| SSL/TLS encryption
| TLS
|-
| Port
| 587
|-
| Server requires authentication
| Yes
|-
| Authentication type
| Plain (Secure authentication = No)
|-
| Username
| '''username'''
|}

Exception for Outlook Express: Use SSL on port 465 instead of TLS on port 587.

[[How To Configure Your Email Client|Specific instructions]] for configuring common email
clients are also available.

==For More Information==
Variations on the recommendations above are possible. For more information,
see [[SMTP]], [[IMAPS]], and [[POP3S]].

How To Display X Applications On Windows

2009-05-15T23:08:20Z

Jazminl: New Page

==Background==
In order to display an X application running on a Unix/Linux box on your
Windows workstation, you need to do two things:

# when you connect to the Unix/Linux box with ssh, you must do so with the 'tunnel X11 connections' option turned on; and
# you must run an X server on your Windows workstation with appropriate permissions.

Below, you will find instructions on how to use X-Win32 as your X server for
Windows. The demo of the latest version of X-Win32 is limited to only 30
minutes of operation at a time, at which point you must restart it and your ssh
connection. X-Win32 is probably the most intuitive of the X servers available
for Windows, but others do exist (see [[#Notes|Notes]], below). Instructions
for these other X-servers is not provided.

Note that the terminology may be confusing: the "X server" (such as X-Win32)
runs on your workstation, and the "X client" (the program you want to run,
such as ''xclock'') runs on the remote machine. Just remember that the X
server is providing input and display services for the X client programs.

==X-Win32 and SSH==
===Install and Configure X-Win32===
# Install X-Win32: [http://mirrors.ece.ubc.ca/#starnet Download X-Win32] and install it. ECE has a site license for research use on certain subnets. Without the license, X-Win32 will run for a maximum of 30 minutes at a time in demo mode; you will need to purchase the product if you find this limit unacceptable.
# Configure X-Win32: Launch X-Config (Start Menu | Programs | X-Win32 5.4 | X-Config) and select the Security tab. Add 127.0.0.1 to the xhost list as shown in this image.

[[Image:Xapps_xwin32-config.png]]

===Download and Configure SSH===
You may use either the commercial SSH Secure Shell client or PuTTY, as
described in [[How To Use SSH]].

# To configure SSH Secure Shell: Launch the Secure Shell Client (Start Menu | Programs | SSH Secure Shell | Secure Shell Client) and open the settings dialog box (Edit | Settings). Select Tunneling and enable "Tunnel X11 connections" as shown in this image: [[Image:Xapps_ssh-config.png]]

# To configure PuTTY: Launch PuTTY. In the initial dialog box, under Connection | SSH | X11, select "Enable X11 forwarding": [[Image:Xapps_putty-x11fwd.png]]

===Usage===
# Launch X-Win32.
# Launch the SSH client (SSH Secure Shell or PuTTY) and connect to the Unix/Linux server of your choice.
# In the SSH Secure Shell, enter an X command to launch the X application. (e.g.: type ''xterm &'' to launch an xterm)

==Notes==
* Another, cheaper X-Server for Windows is [http://tnt.microimages.com/www/html/freestuf/mix/ MI/X].
* Cygwin, a free unix-like environment for Windows, includes the free [http://x.cygwin.com/ Cygwin/X] X server.
* Consider using Linux or Mac OS X instead of Windows. (The Mac OS X installation disc includes an X server, but it is not installed by default.)

==See Also==
* [[How To Tunnel Connections Through SSH]]

Debian: Weak Cryptographic Keys

2009-05-15T23:06:59Z

Jazminl: New Page

On May 13, 2008, a security advisory was issued, warning that Debian 4.0
("etch") Linux distribution contained a crippled random-number generator. As a
result, most cryptographic functionality was severely weakened. Unlike
most security vulnerabilities, simply updating the software on affected
machines is insufficient to close the security hole -- weak cryptographic
keys generated on the affected machines also need to be replaced.

ECE IT Services has taken the following precautions:

# Some servers have obtained new SSH host keys, resulting in warnings visible to users.
# Effective immediately, weak SSH keys are no longer accepted for authenticating to SSH servers. Affected users will need to regenerate their SSH RSA keys if they wish to log in user RSA keys instead of passwords.
# '''New 2006-06-10''': DSA keys are no longer accepted for authenticating to SSH servers, even if they were created using a random number generator. Due to the way the Digital Signature Algorithm works, if a DSA key is ever used from a machine with a weak random number generator, an evesdropper can derive the DSA private key. If you have been using a DSA key, please create an RSA key instead, as the RSA algorithm does not have this weakness.
# We have re-issued all SSL certificates that contain weak keys. If you have [[How To Install The Root Certificate|installed the ECE Root Certificate]], this should result in no visible change. Otherwise, your web browser will warn you about connecting to uncertified servers.

==Actions Required of Users==
Since Debian is widely used in the ECE Department, and this security hole
affects even users who normally do not use a Debian 4.0 workstation, please
feel free to ask ''help@ece.ubc.ca'' if you need guidance on what actions you
need to take.

# If you use RSA or DSA keys to authenticate to SSH servers, and your key no longer works, check your ''~/.ssh/authorized_keys'' file. If ECE IT Services has determined that your ''authorized_keys'' file contains a weak key or a DSA key, there will be a comment in that file indicating so. In that case, you should remove the key from ''~/.ssh/authorized_keys'', run ''ssh-keygen'' to generate a new RSA key, and add your new RSA public key to ''~/.ssh/authorized_keys''.
# If your SSH client warns you that the host key of the server you are connecting to has changed, you will need to accept the new host key.

The OpenSSH warning looks like this:

<pre>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
01:23:45:67:89:ab:cd:ef:01:23:45:67:89:ab:cd:ef.
Please contact your system administrator.
Add correct host key in ~username/.ssh/known_hosts to get rid of this message.
Offending key in ~username/.ssh/known_hosts:123
RSA host key for server.ece.ubc.ca has changed and you have requested strict checking.
Host key verification failed.
</pre>

If you use PuTTY as your SSH client, then the warning looks like this:

[[Image:DebianWeakKeys_PuTTYHostKeyWarning.png]]

Normally, you should heed the warning as an indication that an attacker
may have intercepted your SSH session, but in this case the host key changes
are legitimate. Use a text editor to remove the offending line from your
''known_hosts'' file.

For your convenience, ECE IT Services has already removed weak SSH host keys
from all users' ''~/.ssh/known_hosts'' files in their ECE home directories.
As a consequence, you will see this (if using OpenSSH):

<pre>
The authenticity of host 'server.ece.ubc.ca (137.82.1.1)' can't be established.
RSA key fingerprint is 01:23:45:67:89:ab:cd:ef:01:23:45:67:89:ab:cd:ef.
Are you sure you want to continue connecting (yes/no)?
</pre>

Please check that the fingerprint matches the ones given below. Then and
only then answer "yes" to continue.

{| class="wikitable"
|-
! SSH Server
! Fingerprint of RSA Host Key
|-
| ssh-linux.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| atwell.ece.ubc.ca
| ''94:de:32:58:95:57:65:26:91:d7:d3:26:ea:75:91:df''
|-
| blake.ece.ubc.ca
| ''7d:b6:7d:d6:34:1e:a1:7a:e4:c2:02:f2:eb:77:f1:7b''
|-
| commlab32.ece.ubc.ca
| ''28:6c:22:85:6a:1a:c9:a6:d5:0b:cf:3b:9f:ce:0e:fc''
|-
| commlab33.ece.ubc.ca
| ''00:c1:e6:49:3e:2c:a4:d3:c1:5a:61:ba:cd:99:0c:76''
|-
| dellped.ece.ubc.ca
| ''e4:75:c7:56:ad:16:bf:22:0c:02:9c:63:a1:1b:9a:80''
|-
| golomb.ece.ubc.ca
| ''6a:2c:d7:c0:3f:c7:f2:97:93:a5:78:df:a3:8a:b7:70''
|-
| gould.ece.ubc.ca
| ''94:79:ae:07:15:6e:a9:83:a6:f4:36:c4:0d:96:cc:3e''
|-
| hct0.ece.ubc.ca
| ''49:34:b1:2b:97:be:02:cb:45:75:00:da:9d:62:68:07''
|-
| isp-pc01.ece.ubc.ca
| ''d2:63:1d:84:76:06:72:dc:9c:8a:09:b3:9d:62:a5:72''
|-
| ito1.ece.ubc.ca
| ''67:5f:40:a0:11:de:77:41:14:52:2c:6e:d8:eb:cb:98''
|-
| ito4.ece.ubc.ca
| ''c2:ab:8b:63:b5:8d:08:a0:7e:7f:32:d2:a4:c9:8d:bc''
|-
| ito5.ece.ubc.ca
| ''d5:af:b3:2b:0c:13:8c:d9:d0:46:92:5f:78:ba:b2:8c''
|-
| ito6.ece.ubc.ca
| ''56:85:16:7a:84:5d:e3:c3:76:60:ca:df:c6:cf:53:e0''
|-
| jerry.ece.ubc.ca
| ''26:1c:72:bc:3e:9a:39:93:32:c5:47:42:2a:51:f0:2e''
|-
| kramer.ece.ubc.ca
| ''02:e2:65:09:b5:dd:6d:fd:0e:16:0b:a0:75:2a:70:c5''
|-
| lampe1.ece.ubc.ca
| ''9f:5d:2f:19:ad:7c:bb:cc:ca:de:ac:8b:78:1f:27:3b''
|-
| lersse0.ece.ubc.ca
| ''07:af:7f:01:e7:ed:a1:fa:30:fb:28:fa:cc:b7:69:14''
|-
| lvs1-r2.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| lvs1-r3.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| lvs1-r4.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| lvs1-r5.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| mach1.ece.ubc.ca
| ''80:96:e7:47:fb:1e:11:d8:3e:e3:1e:9c:df:5a:74:d8''
|-
| mach13.ece.ubc.ca
| ''a0:b8:a4:d8:be:ec:2f:23:1b:39:4e:f6:a4:b4:e4:4c''
|-
| mirabbasi2.ece.ubc.ca
| ''3c:64:ed:f4:96:ae:b4:b8:ba:e6:87:ba:f9:d3:be:2d''
|-
| morty.ece.ubc.ca
| ''08:5a:37:8a:ee:79:2e:47:74:7a:08:c3:72:ea:20:5e''
|-
| psserv.ece.ubc.ca
| ''f0:29:7c:01:63:09:ea:52:67:d9:b9:c2:ad:57:63:32''
|-
| rafeef1.ece.ubc.ca
| ''b9:2f:5f:6c:4c:8b:3b:5a:85:f1:42:cc:c7:d0:b3:f7''
|-
| rs-dell01.ece.ubc.ca
| ''d1:88:0f:2e:1d:20:c5:ad:c1:19:46:ce:e3:24:67:48''
|-
| rs-dell02.ece.ubc.ca
| ''78:25:8c:17:93:a6:87:9a:ca:79:93:6a:b2:11:08:72''
|-
| rs-dell03.ece.ubc.ca
| ''c6:63:85:34:9a:78:82:eb:b0:93:2d:04:dc:8c:5a:c0''
|-
| rs-dell04.ece.ubc.ca
| ''e1:89:02:0c:d1:b3:eb:fc:14:06:15:c2:0b:9a:ee:2c''
|-
| rs-dell05.ece.ubc.ca
| ''6b:db:9c:00:18:f9:56:d6:d1:f8:d3:f2:0f:37:1c:28''
|-
| rs-dell06.ece.ubc.ca
| ''d3:b5:1b:1e:1c:06:19:2a:9b:dc:7d:f7:40:4a:cd:50''
|-
| rs-dell07.ece.ubc.ca
| ''e6:17:8a:9e:84:8b:c4:68:29:d2:82:01:4a:90:fb:1e''
|-
| seal-hct.ece.ubc.ca
| ''7a:df:40:a6:ec:c6:94:bc:6a:36:a1:51:a5:34:b1:3d''
|-
| shannon1.ece.ubc.ca
| ''6a:3d:90:4d:87:6c:6c:60:8c:b3:60:95:48:a2:40:62''
|-
| shannon2.ece.ubc.ca
| ''9f:e6:0d:77:d9:b3:be:06:51:55:90:37:fc:7d:9b:03''
|-
| shannon3.ece.ubc.ca
| ''88:02:03:31:2a:06:52:e9:d9:c5:2f:54:41:4d:6f:5f''
|-
| shannon4.ece.ubc.ca
| ''04:4a:25:b5:5e:9b:aa:b0:a3:ed:38:ec:41:56:af:79''
|-
| solomon.ece.ubc.ca
| ''9b:15:c5:95:0b:96:3d:50:ed:a4:20:06:da:a6:74:6d''
|-
| ssh-linux.ece.ubc.ca
| ''8e:95:cc:cf:66:9b:da:0f:67:72:28:94:a1:f7:33:1a''
|-
| vikram.ece.ubc.ca
| ''eb:a7:91:1b:a1:da:49:20:ad:c0:dd:c3:47:e9:0a:7a''
|-
| vklinux1.ece.ubc.ca
| ''55:19:d5:fc:40:f0:8d:28:3f:96:3e:38:3f:28:a6:df''
|-
| vklinux3.ece.ubc.ca
| ''ed:0f:a0:46:08:c3:df:36:ce:6f:b8:47:d7:e9:ce:15''
|-
| vklinux4.ece.ubc.ca
| ''f7:d3:d9:49:d0:13:ce:c9:77:2e:94:01:01:40:df:4e''
|-
| vklinux5.ece.ubc.ca
| ''43:ac:ca:8a:b1:e7:d1:7f:5d:ad:85:63:d7:e1:6c:d9''
|-
| vwong-pc01.ece.ubc.ca
| ''9f:f1:d3:65:cb:92:78:49:e9:be:6f:dd:49:74:e7:fa''
|-
| xena4.ece.ubc.ca
| ''82:a0:50:16:5c:ec:a1:53:4d:46:21:ee:2d:19:0e:f5''
|-
| xena6.ece.ubc.ca
| ''6f:0a:96:3a:aa:2c:ab:4b:60:0d:b6:2d:55:33:f7:69''
|-
| zark4.ece.ubc.ca
| ''3c:03:56:5d:87:cf:59:c8:ea:41:2b:c2:fc:d3:a9:02''
|-
| zark6.ece.ubc.ca
| ''77:bc:10:03:d5:d2:23:54:c3:40:c5:ba:cc:b0:b3:9b''
|-
| zark7.ece.ubc.ca
| ''a1:cc:85:d0:c7:44:ac:1c:fc:62:5e:3f:14:7f:89:4a''
|-
| zark10.ece.ubc.ca
| ''b2:dd:6b:3c:94:f7:f3:05:17:d7:61:17:d8:7a:38:03''
|}

==Background==
The principle behind cryptography is that the communicating parties share a
secret key known only to them. If an attacker is able to guess what the secret
key is, then he or she can decrypt the communications or impersonate one of the
communicating parties. Therefore, secure cryptography requires random-number
generators that generate keys that are hard to guess.

Normally, SSH keys are 1024 or 2048 bits long. An attacker taking the
brute-force approach, trying every single possible key, would require 2{^1023}
or 2{^2047} attempts on average before finding the right key.

It was recently discovered that Debian 4.0 ("Debian etch") and Debian-derived
Linux distributions (such as Ubuntu) shipped with an OpenSSL package that
was mistakenly modified in such a way that its random-number generator produced
extremely predictable output. The random-number generator only had 16 bits of
randomness, and 2{^16} is much much smaller than 2{^1024}. In Linux, most
services rely on the OpenSSL library for cryptographic functionality.

The greatest risk to ECE servers is that an attacker could try logging in with
all of the known weak keys resulting from the crippled random-number generator
and have a high probability of finding one of the 2{^16} keys within minutes,
without having to guess account passwords or SSH key passphrases. Therefore,
ECE IT Services has disabled known weak keys in ''~/.ssh/authorized_keys''
files.

Another possible risk is that an attacker could set up rogue servers pretending
to be ''ssh-linux.ece.ubc.ca'' or ''www.ece.ubc.ca''. This is a more difficult
attack to execute, but ECE IT Services is taking the precaution of changing
weak SSH host keys and SSL certificates.

There are also less likely risks. If an attacker had been evesdropping on
network traffic, he or she could decrypt SSH or HTTPS sessions that took place
in the past. Also, any DSA SSH keys that have ever been used with vulnerable
SSH servers could be compromised due to the way the DSA protocol works.

==See Also==
* [http://wiki.debian.org/SSLkeys Discussion of security implications on Debian Wiki]
* [http://www.debian.org/security/2008/dsa-1571 Debian Security Advisory 1571-1]
* [http://www.ubuntu.com/usn/usn-612-1 Ubuntu Security Notice 612-1]
* [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166 Common Vulnerabilities and Exposures: CVE-2008-0166]

How To Use SSH

2009-05-15T23:06:30Z

Jazminl: New Page

==Background==
SSH (Secure Shell) is a protocol that can be used to:

* obtain a shell prompt on a remote computer to execute command-line programs
* [[How To Display X Applications On Windows|forward X11 connections]] to execute graphical programs remotely
* establish encrypted data tunnels to act as a makeshift VPN
* transfer files between computers using the associated SFTP (Secure File Transfer Protocol) or SCP (Secure Copy) protocols

SSH accomplishes all of these tasks using encrypted connections, preventing
other network users from evesdropping on your communication and impersonating
you. SSH replaces the older rsh, rexec, telnet and ftp protocols, which are
not permitted on departmental servers because they transmit usernames and
passwords unencrypted.

SSH utilities are available for all common operating systems.

==Available SSH Clients==

===Departmental Windows Workstations===
The departmental Windows workstations have the commercial (but free for
University use) "SSH Secure Shell" version installed, as well as
[http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY].

===Personal Use on Windows Workstations===
There are two Windows-based clients that you may wish to try:

# [http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY] is a free Win32 Telnet/SSH client.
# [http://winscp.sf.net/eng WinSCP] is a free graphical client for transferring files using SCP/SFTP.

===Departmental Solaris / Linux Workstations===
The departmental Solaris / Linux workstations have the
[http://www.openssh.org OpenSSH] version of the ssh, scp, and sftp tools
installed.

===Mac OS X===
Mac OS X includes ''ssh'', ''scp'', and ''sftp'' as commands accessible
through the Terminal. You may also find these graphical utilities helpful:

* [http://rsug.itd.umich.edu/software/fugu/ Fugu] is a free graphical client for transferring files using SCP/SFTP.
* [http://www.sshkeychain.org/ SSHKeychain] helps manage SSH tunnels and keys.

How To Use VPN

2009-05-15T23:06:04Z

Jazminl: New Page

==Background==
UBC IT Services offers a VPN service so that members of the UBC community can
access UBC services that would otherwise be inaccessible from outside the UBC
network. For example, you can access the various student records, financial
records and human-resource records systems. Additionally, you can access the
library's systems, including e-journals, without using the library's proxy
server.

UBC IT Services offers the ability to create 'pools' of users within their VPN
service so that users who log into the VPN service can be granted additional
access rights.

ECE IT Services has established several pools:
* ''ece.prof'' for ECE Faculty and Staff [active deployment]
* ''ece.grad'' for ECE Graduate Students [pending deployment]
* ''ece.ugrd'' for ECE Undergraduate Students [pending deployment]
* ''ece.othr'' for ECE Guests and Visitors [pending deployment]

Membership in one pool or the other is determined by ECE IT Services and is not
automatic. '''Please note that, at this time, only the ''ece.prof'' pool is in
active deployment.'''

[Aside: Why ''ece.prof'' rather than something more descriptive such as
''ece.faculty_and_staff''? The pool's name consists of two parts: an
organizational unit name, ''ece'', and a group name, ''prof''. The group name
is limited to four characters by the VPN system's software.]

==Steps to Using Pool-Based VPN==
===First, Ensure Normal VPN Connectivity===
To use [http://www.it.ubc.ca/security/VPN UBC IT
Services' VPN service], you will need a [http://cwl.ubc.ca CWL ID] and you
will need [http://www.itservices.ubc.ca/security/VPN/accessvpn.html to
configure your computer].

===Next, Attempt Pool-Based VPN Connectivity===
To use a pool, connect to the VPN service as before but use a slightly
different, qualified username: ''<cwl_id>.<pool>''. For example, if you
successfully logged into the VPN service with a username of ''lucaf'' and you
are a member of the ''ece.prof'' pool, then you would use the qualified
username of ''lucaf.ece.prof'' to log into the pool.

Using this qualified username will log you into the pool and your VPN tunnel
endpoint will be given an IP address from a specific, exclusive range. The ECE
firewall is configured to allow this IP address range to access services
normally only accessible from within the ECE network. For example, by using
the pool, you will no longer need to run an ssh tunnel to access license
servers and you will be able to access ECE file servers (e.g.,
''\\\\foo.ece.ubc.ca\\lucaf'') directly.

===Restrictions===
Please note that the only pool that is active is the ''ece.prof'' pool. The
other pools are pending decisions regarding firewall access rules and the
larger task of automating the process of adding / deleting students from the
ece.ugrd and ece.grad pools (or, at least, automating our side if UBC IT
Services can't automate theirs; many systems at UBC are in need of
interconnection and automation).

Since we have to manually inform UBC IT Services about which CWL IDs should be
moved into the pools, if you are able to use VPN service with an unqualified
CWL ID but not with a qualified CWL ID (e.g., ''lucaf'' works but ''lucaf.ece.prof'' doesn't), please [mailto:help@ece.ubc.ca email help@ece.ubc.ca] requesting that we add your CWL ID to the appropriate pool. Please ensure that you provide us with your CWL ID as we are not able to look
them up ourselves. Again, the only pool that is active is the ''ece.prof''
pool so please don't email us regarding the other pools.

==Some Additional Considerations==
If you use UBC IT Services' Wireless service, you will know that you are
required to authenticate with an authentication gateway before you are able to
send traffic to the UBC network and the Internet. You have two choices for
authenticating with the gateway: one is to use the web login form (the actual
gatway) and the other is to use the VPN service (which bypasses the gateway).
If you use the VPN service with the qualified username, then you can send
traffic to the ECE network, also.

Whether you are at home or on the road using an ISP's network with VPN, at UBC
using IT Services' wireless network with VPN, or in your office/lab using ECE's
network without VPN, you can have (almost) the same access.

==See Also==
* [[How To Tunnel Connections Through SSH]]

How To Install The Root Certificate

2009-05-15T23:05:17Z

Jazminl: New Page

Some of ECE's SSL-encrypted departmental and research group websites each have
server certificates which have been signed by the Department's Certficate
Authority (CA). Being self-signed, the Department's Root Certificate is not
recognized by any web browser, be it Mozilla Firefox, Internet Explorer or
other. Therefore, your web browser will warn you that it cannot the identity
of the webserver when when accessing these websites.

To avoid these warnings, you should add the ECE Department's Root Certificate
to your browser's list of trusted certificate authorities. After adding the
Root Certificate, you should no longer receive warnings about our server
certificates (until the ECE Root Certificate expires in May 2009).

To install the Root Certificate, please find application-specific instructions
below. Please note that you may need to delete the previously installed ECE
Certificate Authority certificate (aka Root Certificate) before installing the
new one. Instructions on managing certificate authorities is included below.

Please ensure that the certificate you retrieve has the following
fingerprint(s):
* SHA1 Fingerprint=03:41:BF:BF:06:6C:CD:8B:6C:38:73:4B:5C:DD:5C:F5:15:C9:70:5F
* MD5 Fingerprint=0C:15:56:8D:04:A5:9B:FF:D0:A1:F5:AE:06:C4:14:87

===Internet Explorer on Windows and Safari on Windows===
To install the Root Certificate:

# Click here, [[CA.ece.ubc.ca.crt]].
# If using Internet Explorer, click on the "Open" button in the dialog that appears. If using Safari, double-click the ''CA.ece.ubc.ca.crt'' file that is saved to your Desktop to open it.
# In the "Details" tab, verify that the SHA1 thumbprint matches the one listed shown above.
# In the "General" tab, click on the 'Install Certificate...' button in the window that opens.

To manage already installed certificates (so that you can delete the old one,
if necessary):

# In the Windows Control Panel, select "Internet Options" to open the "Internet Options" dialog box. (In Internet Explorer, the "Internet Options" dialog box can also be accessed via the "Tools" menu.)
# Select the "Content" tab and click on the "Certificates..." button to open the "Certificates" dialog box.
# Select the "Trusted Root Certification Authorities" tab.
# Find the certificate you wish to manage / remove. Our certificate appears as "ECE Certificate Authority".

===Mozilla (verified with Mozilla version 1.7 and Netscape 7.1)===
Note: The Netscape browser (6.0 and above) is a rebranded Mozilla browser.

To install the Root Certificate:

# Click here, [[CA.ece.ubc.ca.crt]].
# On the dialog box that appears, check all three boxes:
::* Trust this CA to identify web sites.
::* Trust this CA to identify email users.
::* Trust this CA to identify software developers.
# Click on the "View" button and verify the SHA1 and MD5 thumbprints with those above.
# Click the "OK" to install the certificate.

To manage already installed certificates (so that you can delete the old one,
if necessary):

# From the "Edit" menu, select "Preferences..." to open the "Preferences" dialog box.
# Expand the "Privacy & Security" group and select the "Certificates" panel.
# Click on the "Manage Certificates..." button to open the "Certificate Manager" dialog box.
# Select the "Authorities" tab.
# Find the certificate you wish to manage / delete. Our certificate appears under "University of British Columbia."

===Mozilla Firefox (verified with Mozilla Firefox 2.0)===

To install the Root Certificate:

# Click here, [[CA.ece.ubc.ca.crt]].
# On the dialog box that appears, check all three boxes:
::* Trust this CA to identify web sites.
::* Trust this CA to identify email users.
::* Trust this CA to identify software developers.
# Click on the "View" button and verify the SHA1 and MD5 thumbprints with those above.
# Click the "OK" to install the certificate.

To manage already installed certificates (so that you can delete the old one,
if necessary):

# From the "Tools" menu, select "Options..." to open the "Options" dialog
box.
# Click on the "Advanced" icon, then click on the "View Certificates" button to open the "Certificate Manager" dialog box.
# Select the "Authorities" tab.
# Find the certificate you wish to manage / delete. Our certificate appears under "University of British Columbia."

===Safari and Mac OS/X 10.3 (verified with Mac OS/X 10.3)===
To install the Root Certificate:

# Click here, [[CA.ece.ubc.ca.crt]], and download the file to your Desktop.
# Double click on the ''CA.ece.ubc.ca.crt'' file. The "Keychain Access" application will open and a certificate import dialog box will appear.
# Select X509 Anchors from the drop down list in the import window.
# Click on the 'Install Certificate...' button.

To manage already installed certificates (so that you can delete the old one, if necessary):

# Open the "Keychain Access" application (usually found in ''/Applications/Utilities/'')
# If X509Anchors is not one of the keychains listed in the right hand pane, select "Add Keychain..." from the "Open" menu. From the "File Open" dialog box, select ''/System/Library/Keychains/X509Anchors''.
# Find the certificate you wish to manage / delete. Our certificate appears under "ECE Certificate Authority."

How To Password Protect Personal Web Content

2009-05-15T23:04:27Z

Jazminl: New Page

You already know [[How To Publish Personal Web Content]], but you want to
restrict web surfers' access to certain pages. This can be accomplished by
requiring users to authenticate with the web server to access these
password-protected pages.

The HTTP protocol has the ability to prompt a user for a username and password.
You can require users to enter the username/password of their departmental
account or check the username/password against your own password file.

Unfortunately, the HTTP authentication mechanism transmits this information
unencrypted. Therefore you '''must''' enforce the use of HTTPS (HTTP+SSL) to
protect the username/password between the web surfer's browser and the
departmental web server, as instructed below.

==Syntax Changes in Apache 2.2==
In version 2.2 of the Apache webserver, the syntax for configuring password
protection [http://httpd.apache.org/docs/2.2/upgrading.html changed].
Although the new syntax is more logical and flexible, it is not
backwards-compatible.

Currently, ECE course websites, research group websites, and personal websites are
running on Apache 2.2. (Personal websites were upgraded March 27, 2008. If you
encounter Internal Server Errors when accessing password-protected content in your
personal website, you will need to
[[How To Password-Protect Web Content (Instructions for Apache 2.0 or Earlier)|update your configuration]].)

==Directory Layout==
First you need to set up an area in your document tree that you wish to make
private. These instructions follow the convention that the ''~/etc/www/priv/''
directory is the one containing the password-protected content, but it could be
any directory within the ''~/etc/www/'' document tree.

{| class="wikitable"
|-
! File or Directory
! Minimum Filesystem Permissions
! Comment
|-
| ''~/''
| ''rwx--x--x'' (''chmod a+x'')
| Your home directory
|-
| ''~/etc/''
| ''rwx--x--x'' (''chmod a+x'')
| Your etc directory
|-
| ''~/etc/www/''
| ''rwx--x--x'' (''chmod a+x'')
| Your document root
|-
| ''~/etc/www/index.html''
| ''rw-r--r--'' (''chmod a+r'')
| Your public home page
|-
| ''~/etc/www/public.html''
| ''rw-r--r--'' (''chmod a+r'')
| Another public document
|-
| ''~/etc/www/priv/''
| ''rwx--x--x'' (''chmod a+x'')
| Directory for password-protected files
|-
| ''~/etc/www/priv/protected.html''
| ''rw-r--r--'' (''chmod a+r'')
| A password-protected document
|-
| ''~/etc/www/priv/.htaccess''
| ''rw-r--r--'' (''chmod a+r'')
| Apache config file
|-
| ''~/etc/www/priv/.htpasswd''
| ''rw-r--r--'' (''chmod a+r'')
| Apache file for \AuthUserFile
|-
| ''~/etc/www/priv/.htgroup''
| ''rw-r--r--'' (''chmod a+r'')
| Apache file for \AuthGroupFile
|}

All of these files need to have world-readable filesystem
permissions (''chmod a+r'') and all of these directories need to be marked
world-executable (''chmod a+x'') to allow the webserver to access them.

The key to getting this setup to work is the ''.htaccess'' file in the ''priv''
directory. There are three basic variations for this file:

==Variation 1: Authenticate Departmental Users Only==
Use the following ''.htaccess'' file:

<pre>
# Force the use of SSL...
SSLRequireSSL
# ... and redirect non-SSL requests to the corresponding HTTPS URL
ErrorDocument 403 /cgi-bin/ssl-redirect

# Use HTTP Basic Authentication
AuthType Basic
# Validate usernames/passwords against the ECE account database
AuthBasicProvider ece
# The AuthName is incorporated in the username/password prompt
AuthName "ECE Account"
# Allow any authenticated user
Require valid-user
</pre>

You can restrict access to specific ECE users and groups by changing the
''Require valid-user'' line. For more information, see
[[#The All-Important Require Directive|The All-Important ''Require'' Directive]] below.

==Variation 2: Authenticate Non-Departmental Users Only==
With this ''.htaccess'' configuration, only users listed in your ''.htpasswd''
file may access the private pages. To create and manage your ''.htpasswd''
file, use the ''htpasswd'' utility.

<pre>
SSLRequireSSL
ErrorDocument 403 /cgi-bin/ssl-redirect

AuthType Basic
AuthBasicProvider file
AuthUserFile <path to home directory>/etc/www/priv/.htpasswd
AuthName "my private page"
Require valid-user
</pre>

The ''AuthBasicProvider file'' line may be omitted.

Please ensure that value for ''<path to home directory>'' that you use is
identical to that reported by the command ''getent passwd '''''username'''.
It must be a full path (starting with ''/ubc/ece/home/...'' or
''/usr/home/...''); ''~username'' will not work.

==Variation 3: Authenticate Non-Departmental and Departmental Users==
With this ''.htaccess'' configuration, the webserver will authenticate
the user against both your ''.htpasswd'' file and the ECE account database.

<pre>
SSLRequireSSL
ErrorDocument 403 /cgi-bin/ssl-redirect

AuthType Basic
AuthBasicProvider file ece
AuthName "ECE or Other Account"
AuthUserFile <path to home directory>/etc/www/priv/.htpasswd
Require valid-user
</pre>

==The All-Important ''Require'' Directive==

The ''Require'' directive is the means by which you can restrict access to your
password-protected personal web content to a specific set of users. The
following table of examples should help to understand how the directive can be
used.

{| class="wikitable"
|-
! To restrict access to...
! ... use this ''Require'' directive
|-
| any authenticated user
| ''Require valid-user''
|-
| specific users (e.g., ''lucaf'' and ''robr'')
| ''Require user lucaf robr''
|-
| specific groups (e.g., ''robotics'')
| ''Require group robotics''
|}

For more information on the ''Require'' directives, please see
http://httpd.apache.org/docs/2.2/mod/core.html#require .

==See Also==
* [[How To Password-Protect Web Content (Instructions for Apache 2.0 or Earlier)]]
* [http://httpd.apache.org/docs/2.2/howto/auth.html Apache Documentation]

How To Publish Personal Web Content

2009-05-15T23:03:56Z

Jazminl: New Page

Create the following directory tree in your home directory:

{| class="wikitable"
|-
! Directory
! Description
! Command To Change Permission
|-
| ''~/''
| your home directory
| chmod o+x ~/
|-
| ''~/etc/''
| your ''etc'' directory
| chmod o+x ~/etc/
|-
| ''~/etc/www/''
| your document root
| chmod o+x ~/etc/www/
|-
| ''~/etc/www/index.html''
| your public home page
| chmod o+r ~/etc/www/index.html
|}

Ensure that ''~/'', ''~/etc/'', ''~/etc/www/'', and all subdirectories of
''~/etc/www'' are world executable and that all files in ''~/etc/www/'' and
below are world readable. See the above table for the commands to use to
change the permissions. You may wish to read
[[How To Secure Your Home Directory]].

Populate your ''~/etc/www/'' directory with the web content that you wish to
publish to the web. The file served up the Apache web server as your personal
web site's home page is ''~/etc/www/index.html''.

You can access your personal web site using the following url:

<nowiki>http://www.ece.ubc.ca/~<your username></nowiki>

For example, if your username is janedoe, then your personal web site could be
accessed using:

<nowiki>http://www.ece.ubc.ca/~janedoe</nowiki>

You may be interested in reading [[How To Password Protect Personal Web Content]].

How To Keep Your Profile Small

2009-05-15T23:03:21Z

Jazminl: New Page

By default Internet Explorer will save a huge amount of Temporary Internet
Files in your profile. This is a huge waste of disk space and it results in a
long time to login and logout of Windows.

If you want to start from scratch with a new profile see [[How To Reset Your Profile]].

To keep your amount of Temporary Internet Files small:

# Start Internet Explorer
# Click on Tools on the menu bar
# Click on Internet Options
# Click Delete Files... under Temporary Internet Files on the General tab to remove the existing files
# Click on Settings... under Temporary Internet Files
# Change the Amount of disk space to use: to 1 MB
# Click OK to get back to Internet Options
# Click on the Advanced tab
# Scroll down and check the box beside "Empty Temporary Internet Files folder when browser is closed"
# Click OK to finish the settings

Also, don't put large files on your desktop as it is part of your profile and
profiles are not saved reliably. Please save the files to your Z:-drive.

This should keep your profile small and keep it from getting corrupt.

How To Reset Your Profile

2009-05-15T23:02:44Z

Jazminl: New Page

The ''UBC_ECE'' domain is provisioned using some older technology. Plans are in
place to upgrade this service but, until that time, you may experience what can
be described best as "corrupt profile" problems. The solution to these
problems is to reset your profile.

To reset your profile, you need to:

# logout from Windows
# login to UNIX system (use your neighbour's computer for a second to ssh to ssh-linux.ece.ubc.ca)
# rename your profile directory with ''mv profile profile.save''
# logout from UNIX
# login to Windows; you will get a warning about your profile; ignore it
# logout from Windows; logging out is what actually creates the new profile
# login to Windows and restore files from profile.save directory, if necessary; delete profile.save to free up disk space

At this point problems with downloading files, surfing the Internet,
assigning the default printer and printing PDF files should be gone. If you still have a problem, let us know by emailing ''help@ece.ubc.ca''.

If this is too complicated, email ''help@ece.ubc.ca'' and we will remove your
profile (brute force, but it works).

Please do not save any files on the "Desktop" or in "My Documents". Files
stored in these locations are copied between the PC and file server every time
you log in or out. Having a large number of files in these locations will
cause login times to increases. Most importantly, files left in these
locations may not be reliably saved to the file server. At all times, you
should store your files in your Z:-drive.

Please consider changing your settings in Windows to store the minimum number
of files on the "Desktop" and in "My Documents". For example, please change
the settings for IE to reduce the cache to 10-20MB. Large caches will take a
very long time to copy from the server, increasing login times to several
minutes. Please see [[How To Keep Your Profile Small]].

Keys and Keyless Entry

2009-05-15T23:02:14Z

Jazminl: New Page

==Background==
The ICICS Access Control Management System (ACMS) is used to manage access into
several buildings. The ACMS grants access to Users based on the Roles that
have been assigned to them. Ultimately, whether you are able to get through a
door depends on whether the access control system (the actual electronics
controlling the doors) thinks your FOB should be granted access. Managing
access lists on a fob by fob and on a door by door basis is untenable, so we
have developed a tool to help us manage access to our buildings from a more
useful, abstracted perspective:

* '''Access Controlled Doors (ACDs)''' are doors equipped with card readers and electrified door hardware.
** ownership: ACDs are owned by Buildings.
** forward relationship: ACDs control access into one or more Zones.
* '''Zones''' are logical representations of areas in a building that are accessible via one or more ACDs.
** ownership: Zones are owned by Organisational Units.
** reverse relationship: Zones can be accessed through one or more ACDs.
** forward relationship: Zones are associated to one or more Roles.
* '''Roles''' are logical representations of a User's relationship with an Organisational Unit.
** ownership: Roles are owned by Organisational Units.
** reverse relationship: Roles grant access to one or more Zones.
** forward relationship: Roles are assigned to Users.
* '''Users''' are people like you!
** ownership: system
** reverse relationship: Users have one or more Roles assigned to them.
** forward relationship: Users have one FOB issued to them.
* '''FOBs''' are the access control tokens issued to Users (either a card or a fob).
** ownership: system
** reverse relationship: FOBs are owned by zero (not issued or lost) or one User (issued).

By walking the reverse relationships from FOBs to ACDs, we are able to provide the access control system with access lists detailing which FOBs should be granted access through which doors.

At this point, you are probably asking, "Why tell me all this?" Primarily so that we can more easily explain the three steps involved in your gaining physical access to a door.

==Specific Instructions==
===Get an User Profile===
* If you are a UBC Student (i.e., you have a UBC Student Number), then the system already knows about you. Go to the next step.
* If you are a UBC Faculty or Staff member or a Registered Guest (e.g., Visiting Scholar or Visiting Student), then a User profile should have been created in the ACMS by your primary organisational unit when a UBC Human Resources Appointment Form was completed. Go to the next step.

===Get an Access Token===
* Please visit ECE Stores in MCLD 112B to pick up your FOB.
* If you are a UBC Student, please bring your UBC Student Card.
* For all others, please bring government-issued photographic identification (e.g., Passport or Driver's License).
* In all cases, a CAD $20.00 deposit is required. If/when you return your FOB, your deposit will be returned.
* If you are told that your User profile does not exist,
** and your primary organisational unit is ECE, then please email access@ece.ubc.ca requesting assistance.
** and your primary organisational unit is *not* ECE, then please visit the administration office of that organisation.

===Get Roles Assigned===
* If you are a UBC Student taking ECE courses, then ECE Roles granting you access to ECE-controlled space will be assigned to you automatically based on information from the Student Information System. These Role assignments are updated nightly so it may take up to one business day before a recent course add/drop is reflected in the system.
* For all others cases, you will need to contact the controlling organisational unit requesting that they grant you an appropriate Role as per the following:
** If you want access to space in the [http://www.maps.ubc.ca/PROD/index_detail.php?locat1=164 Dempster Pavilion], please contact
*** the [http://www.cs.ubc.ca Department of Computer Science] at access@cs.ubc.ca
** If you want access to space in the [http://www.maps.ubc.ca/PROD/index_detail.php?locat1=165 ICICS/CS Building], please contact
*** the [http://www.icics.ubc.ca Institute for Computing, Information & Cognitive Systems] at access@icics.ubc.ca
*** the [http://www.cs.ubc.ca Department of Computer Science] at access@cs.ubc.ca
*** the [http://www.mech.ubc.ca Department of Mechanical Engineering] at access@mech.ubc.ca
** If you want access to space in the [http://www.maps.ubc.ca/PROD/index_detail.php?locat1=313 Kaiser Building], please contact
*** the [http://www.ece.ubc.ca Department of Electrical and Computer Engineering] by emailing access@ece.ubc.ca
*** the [http://www.mech.ubc.ca Department of Mechanical Engineering] at access@mech.ubc.ca
*** the [http://www.apsc.ubc.ca Faculty of Applied Science] at access@apsc.ubc.ca
** If you want access to space in the [http://www.maps.ubc.ca/PROD/index_detail.php?locat1=312 MacLeod Building], please contact
*** the [http://www.ece.ubc.ca Department of Electrical and Computer Engineering] by emailing access@ece.ubc.ca

How To Obtain A Network Connection

2009-05-15T23:01:25Z

Jazminl: New Page

You can connect your computer to the network using an Ethernet or wireless link.

==Ethernet Link==
If you work in an ECE office or lab, please register your computer with us.
You will then be able to connect your device directly to the ECE network
using an Ethernet cable.

Please submit a service request (see
[[How To Report A Problem]]) containing the following
information:

* Supervisor\'s Name: ['''SUPERVISOR\'S NAME''']
* Your Name: ['''FULL NAME''']
* [[How To Get An Account|ECE Account ID]]: ['''ACCOUNT ID''']
* Building and Room: ['''BUILDING NAME AND ROOM NUMBER''']
* Wall Jack\'s CCT Number: ['''CCT NUMBER''']
* Computer\'s ECE Asset Number (if applicable): ['''ASSET NUMBER''']
* Computer\'s MAC Address: ['''MAC ADDRESS''']
* Prefered Hostname: ['''HOSTNAME''']
* Machine Type: ['''DESKTOP / LAPTOP / PRINTER / OTHER''']

We may issue dynamic IP addresses. If you need a static IP address for your
machine, briefly explain why.

MAC addresses (6 pairs of hexadecimal digits of the form xx:xx:xx:xx:xx:xx or
xx-xx-xx-xx-xx-xx) can be found via one of the commands listed below:

* Windows 95/98: ''winipcfg ''
* Windows 2000/XP: ''ipconfig /all''
* Linux, Mac OS X: ''/sbin/ifconfig -a''

==Wireless Link==
Alternatively, you can connect to the
[http://www.it.ubc.ca/internet/wireless.html UBC wireless network]. The
wireless network is managed by UBC IT, so please contact them if you need
assistance.

When connected wirelessly, your computer will be outside the ECE network.
Therefore, ECE-only services, such as our
[http://intranet.ece.ubc.ca/ intranet] site, will not be available to you
unless you use a [[How To Use VPN|VPN]].

How To Change Your Password

2009-05-15T23:00:54Z

Jazminl: New Page

You may change your own password through a Windows workstation in the
''UBC_ECE'' domain or one of the ''ssh-linux'' servers. Whichever method
you use, the new password will apply for Windows workstations in the
''UBC_ECE'' domain, Unix/Linux servers and workstations, and ECE mail
servers.

The system will reject any password that is not sufficiently complex. Select a
password that:

* is composed of at least 3 of the 4 of the following types of characters:
** Upper-case letters, lower-case letters, digits, and punctuation.
** Upper-case letters at the beginning of your password and digits at the end of your password do not count towards meeting this requirement.
* is different from your previous password
* is at least six characters in length
* is not similar to a word
* is not similar to your name or username

These requirements are based on
[http://technet2.microsoft.com/windowsserver/en/library/d406b824-857c-4c2a-8de2-9b7ecbfa6e511033.mspx Microsoft's built-in rules].

==Using a Windows Workstation in the ''UBC_ECE'' Domain==
# Press ''Ctrl''-''Alt''-''Del''
# Click on ''Change Password...''
# Ensure that ''Log on to'' is set to the ''UBC_ECE'' domain. (Changing the password for your account in any other domain, such as ''UBC_ECE_STAFF'', does not affect your Unix / mail password.)
# Enter your old and new passwords

==Using One of the ''ssh-linux'' Servers==
# Use [[How To Use SSH|SSH]] to connect to ''ssh-linux.ece.ubc.ca''
# At the shell prompt, run the ''passwd'' command
# Enter your old and new passwords when prompted

==If You Forget Your Password==
You can stop by the [[How To Contact Us|ECE IT Services office]] in KAIS 3070 to
change your password. Photo ID required.

How To Secure Your Home Directory

2009-05-15T23:00:25Z

Jazminl: New Page

All ECE accounts have their home directories stored on Unix/Linux file servers.

The default [http://en.wikipedia.org/wiki/File_system_permissions file system permissions] for home directories is 755, which means that other users can
read the contents of your home directory. Additionally, the default
[http://en.wikipedia.org/wiki/Umask umask] is 022, which means that any
files/directories that you create will be readable by others.

Many users consider this to be a security risk. However, some unix processes,
specifically the email system's anti-spam tools and the department's web
server, need to be able to access files within your home directory in order to
read your resource files. Since some users find it challenging to set the
correct permissions on their home directories to get the right combination of
security they desire and correct access for system processes, the recommended
method to secure your home directory is to create a subdirectory -- something
like ''~/work'' -- in which to keep your work. Then, you can
[http://en.wikipedia.org/wiki/Chmod set the permissions] on this
subdirectory to something more restrictive (i.e., 700).

ECE IT Services considers the securing of one's home directory to be the
responsibility of the user. In addition to setting the permissions on your
''~/work'' directory (see examples below), you may wish to adjust your umask.

====Example 1: setting permission on your ''~/work'' directory only====
<pre>
chmod 700 ~/work
</pre>

====Example 2: setting permission on your ''~/work'' directory and everything below====
<pre>
find ~/work | xargs chmod go-rwx
</pre>

How To Get An Account

2009-05-15T22:59:10Z

Jazminl: New Page

==Undergraduates==
If you are an undergraduate student registered in an ECE course, we will
automatically create an account for you. At the end of the first week of
classes, your username and initial password will be sent to the e-mail address
in UBC's records. If you do not receive this notification by the end of the
first week of classes, please stop by the
[[How To Contact Us|ECE IT Services Office]] in KAIS 3070.

'''You must [[How To Change Your Password|change your password]] promptly and at least once every term to prevent it from being deactivated.'''

If you are also taking [http://www.cs.ubc.ca/ Computer Science] courses,
your username will be the same as the username in Computer Science. However,
your ECE and CS accounts are distinct -- they have independent passwords and
separate home directories.

==All Others==
All other accounts are created upon receipt of appropriately authorized
application form.

# Print the [[Application For An Account On Departmental Computing Facilities | account application form]]. Both you and your supervisor need to complete and sign it. For your convenience, you can fill in the PDF before printing.
# Bring the form to the [[How To Contact Us|ECE IT Services Office]] in KAIS 3070.
# When we create your account, you will be asked to choose a sufficiently [[How To Change Your Password|complex password]], and enter it on a keyboard.

The use of all department computing resources is subject to UBC's [http://universitycounsel.ubc.ca/policies/policy104.pdf Acceptable Use Policies].

How To Report A Problem

2009-05-15T22:56:57Z

Jazminl: New Page

==Before Contacting Us==
Please try using the information contained on the pages of this website to
solve your problem before sending your request.

==How To Report A Problem==
To report a problem or to request service from departmental IT staff, please
send an email to help@ece.ubc.ca. In the subject line of the email, briefly
describe the type of problem (e.g.: "can't change password"). In the body of
the email, list as many details as possible

You will receive an automated reply from the trouble ticket system shortly
after you report your problem or request. Save this email because it will
contain an automatically assigned ticket identification number. The
departmental IT staff will be notified of the new ticket and one of us will
respond to you.

===Details To Include===
When you report problems, include this information in the body of the email:
* Subject: [SHORT_PROBLEM_DESCRIPTION]
* Login name: [LOGIN_NAME] ([AFFILIATION])
* Supervisor: [FULL_NAME]
* Computer: [NAME] [OS]
* Location: [BUILDING] [ROOM/LAB/OFFICE]
* Problem description: [DESCRIPTION]
* Error message: [ERROR_MESSAGE]
* Note: [NOTE]

===Examples===
====Example 1:====
* Subject: Can not access drive Z:
* Login name: johnm (undergrad)
* Supervisor: Dr. Paul Horowitz
* Computer: Burnaby Win2000
* Location: MCLD LAB 258
* Problem description: Can not access drive Z:
* Error message: Can not connect to server

====Example 2:====
* Subject: Can not install PDF995 software
* Login name: johnm (grad)
* Supervisor: Dr. Paul Horowitz
* Computer: stellar Win2000
* Location: CISCR LAB 388
* Problem description: Can not install PDF955 (free software)
* Error message: You do not have administrator access
* Note: Software can be downloaded from <nowiki>http://www.pdf995.com/</nowiki>

Site Licensed Software

2009-05-15T22:56:24Z

Jazminl: New Page

The following packages are available for installation on departmental machines.
Please email ''help@ece.ubc.ca'' if you would like one or more of these
installed on your workstation.

{| class="wikitable"
|-
! Package
! Windows
! Solari
! Linux
! Notes
|-
| Eset NOD32 Anti-Virus
| Available
| N/A
| Available
|
|-
| Maplesoft Mapl
| Available
| Available
| Available
|
|-
| Mathworks MATLAB
| Available
| Available
| Available
| See [[List of Available MATLAB Toolboxes]]
|-
| Microsoft Office
| Available
| N/A
| N/A
|
|-
| Microsoft Project
| Available
| N/A
| N/A
|
|-
| Microsoft Publisher
| Available
| N/A
| N/A
|
|-
| Microsoft Visual Studio 6 & .NET
| Available
| N/A
| N/A
|
|-
| Microsoft Visio
| Available
| N/A
| N/A
|
|-
| Microsoft Windows 2000/XP Pro
| Available
| N/A
| N/A
| You '''must''' purchase an operating system license for your workstation '''prior''' to upgrading the operating system using the departmental Microsoft Campus Agreement.
|-
| National Instruments \LabView
| Available
| N/A
| Available
|
|-
| SSH's Secure Shell
| Available
| Available
| Available
| While SSH's Secure Shell is available for Solaris and Linux, we recommend using OpenSSH's version, already installed on all Solaris and Linux workstations.
|-
| N/A-Win32 N/A-Server
| Available
| N/A
| N/A
|
|}

Limitation Of Responsibility

2009-05-15T22:55:30Z

Jazminl: New Page

ECE IT Services is able to take responsibility for ensuring software license compliance on those workstations in undergraduate labs and on those assigned to staff, only. Ensuring software license compliance on workstations in research laboratories or in faculty offices is beyond the scope of responsibility of ECE IT Services.

Please refer to the policy on [http://intranet.ece.ubc.ca/FacultyMemberResponsibilityWithRespectToSoftwareLicenses.shtml Faculty Member Responsibility With Respect To Software Licenses].

Recommended Workstation Hardware

2009-05-15T22:54:35Z

Jazminl: New Page

The recommended configuration for workstations is as follows.

{| class="wikitable"
|-
! Category
! Description
|-
| Case
| vendor's standard case
|-
| Motherboard
| ASUS or Abit (with no onboard video or Ethernet or sound)
|-
| Processor
| Intel Pentium4
|-
| RAM
| minimum 256MB non-ECC non-registered
|-
| Video card
| any nVidia \GeForce card (see Notes)
|-
| Ethernet card
| any Intel Pro/100 Desktop Adapter (see Notes)
|-
| Sound card
| Creative \SoundBlaster Audigy (see Notes)
|-
| Floppy drive
| 1.44MB 3.5"
|-
| CDROM drive
| LG GCE-8480B CDRW
|-
| Hard drive
| Western Digital 40GB/9ms/8MB (WD400JB)
|-
| Keyboard
| Fujitsu 8729
|-
| Mouse
| Microsoft \IntelliMouse Optical (see Notes)
|-
| Operating system
| Microsoft Windows XP Home (see Notes)
|-
| Monitor
| \ViewSonic 17" CRT
|}

The IT Support Group will install, at no charge, the departmental Windows and Linux images on workstations that match these specifications. Work required to install your workstation beyond the deployment of the standard departmental image may be charged at standard shop rates, pending a decision by the Department Head regarding charge-backs.

Additional hardware, such as DVD drives and Firewire cards, can be added. However, the departmental Windows and Linux images are not preconfigured to support these.

==Important Notes==

# We suggest that you purchase an initial license of a Microsoft operating system. The departmental Microsoft Campus Agreement allows us to upgrade your operating system to Windows 2000 Professional or Windows XP Professional, but you need to have purchased at least Windows XP Home with your system, originally.
# We suggest that you purchase the following hardware if you wish to avoid support charges for image installation. The departmental Windows and Linux images are pre-configured for this general set of hardware. If you purchase alternate hardware, our image will not work. Also, when we push software updates, our updates may not work on your non-standard workstation.
:* any nVidia \GeForce-2 (or better) based video card
:* any Intel Pro/100 Desktop Adapter Ethernet card
:* any EMU101K-compabile sound card (Creative \SoundBlaster Audigy)
:* Microsoft \IntelliMouse Optical mouse

Services For Research Groups

2009-05-15T22:53:56Z

Jazminl: New Page

Here is a partial list of services available to research groups.

==Web Site (Virtual Host)==
The department can provide a URL for the group's website of the form <nowiki>http://somegroup.ece.ubc.ca/</nowiki>. The website can be hosted on an
IP-based virtual host.

==Group Account==
Research groups need an account that persists longer than those of graduate
students and/or faculty members. This group account can be used to house the
group's website content, demos, CVS repositories, etc.

==Network-Attached Storage==
The department has disk space available on a Network Appliances file server,
which offers numerous advantages from a manageability perspective:
* Server will be setup and administered by the IT staff
* Data is fully backed up and archived off-site
* Data snapshots are made periodically; users can retrieve recent versions of files without intervention from the IT staff
* Server is hosted in the server room with uninterruptible power supplies
* System is fully redundant, and can continue working even if components fail
* Additional storage capacity can be easily allocated as needed

Due to the ease of administering the Network Appliances file server, we
strongly discourage researchers from using their workstations as NFS or SMB
file servers. (Workstations are generic things. One should be able to throw
one workstation out the window, replace it with another one, and have nobody
panic. This is the "workstations-are-not-servers" philosophy.)

==Print Server==
Following the workstations-are-not-servers philosophy, we discourage the
use of workstations in research labs as print servers. Research groups
should purchase TCP/IP networkable printers. If necessary, the department
can provide a print server for accepting print jobs to your network-aware
printers.

==IP Subnet + VLAN + DHCP==
Members of a research group want their workstations to be part of the same
logical work group. Also, they want to be able to move their workstations
between their office and labs withouth needing to reconfigure their IP address.

To accomplish this:
* Research groups will be allocated an IP Subnet (e.g., 137.82.56.0/25).
* All the switches/routers in the department will be configured with a VLAN (Virtual LAN) tied to the research group's IP Subnet.
* All members of the research group will have their workstations configured to be on the Group's IP Subnet, regardless of their workstation's physical location (\MacLeod, CICSR, Brimacombe).
* DHCP will be enabled within the IP Subnet. Members of the research group will be able to move their desktops and/or laptops between their offices and research labs without concern of IP address allocation.

How To Maintain Course Websites

2009-05-15T22:52:37Z

Jazminl: New Page

==Course Instructor's Responsibilities==
As the course instructor, you are responsible for maintaining the official
course website. Your '''minimum''' responsibility is to ensure that the
''index.html'' for the official course website contains sufficient information
to direct students to the web-based repository for course information.
Certainly, you are welcomed and encouraged to use the official course website
as '''the''' web-based repository for course information, but you could equally
use UBC's [http://www.elearning.ubc.ca WebCT] service or your personal web
site. In either of the latter two cases, since these are not the official
course website, you are required to provide instructions on the official course
website informing students on how to reach this course information.

==Motivation==
The primary motivation for this requirement is this: there must be a
consistent and logical mechanism for students to reach web-based repositories
for course information. This mechanism is the official course websites
available via URLs of the form <nowiki>http://courses.ece.ubc.ca/XXX</nowiki> where XXX is
the course number.

==Accounts and Websites==
Associated with every EECE course is a 'course account' on the departmental
computing infrastructure. For example, associated with the course 'EECE XXX'
is the course account 'eeceXXX'.

From the web server's perspective, a course account is no different than a
personal account: the URL <nowiki>http://courses.ece.ubc.ca/XXX</nowiki> references the
''etc/www/'' directory in account ''eeceXXX''\'s home directory.

==Detailed Instructions for Course Instructors==

===Gain access to the course account===
During the transition between terms, send an email to ''help@ece.ubc.ca''
indicating that you are the instructor assigned to a course for the upcoming
term. We will change the password for the associated course account to be the
same as your personal account.

If the course is currently being taught by another instructor, please wait
until after the final exam to request the transfer of control.

===Clean the course account===
At this point, you are the owner of the course account and it is your
responsibility to clean the account of previous, potentially obsolete, content.
Be sure to clean files both in the home directory of the account (e.g.,
''~eeceXXX/'') and in the web site directory of the account (e.g.,
''~eeceXXX/etc/www/'').

===Publish web content to the official course website===
Follow the instructions at [[How To Publish Personal Web Content]] to publish web content for the official course website.
Be sure to log in using the course account and NOT your personal account.

If you do not intend to provide a web-based repository for your course, then
you must create, at a minimum, an ''index.html'' file providing the course
syllabus.

If you intend to use another web service to host the web-based repository for
your course, then you must create, at a minimum, an ''index.html'' file
providing a link to this other web service. Examples of alternate web services
might be UBC's [http://www.elearning.ubc.ca WebCT] service or your personal
web site.

If you intend to use the official course website as the web-based repository
for your course, then, in addition to index.html, you may wish to create a
'private' subdirectory from where you could distribute content in a secure
manner. Please follow the instructions at
[[How To Password Protect Personal Web Content]]
to do this.

HOWTOs For Instructors

2009-05-15T22:51:37Z

Jazminl: New Page

* [[How To Maintain Course Websites]]

HOWTOs For Researchers

2009-05-15T22:51:08Z

Jazminl: New Page

==General Information==
* [[Services For Research Groups]]

==Hardware==
* [[Recommended Workstation Hardware]]

==Software==
* [[Site Licensed Software]]
* [[Limitation Of Responsibility]]

HOWTOs For Users

2009-05-15T22:50:36Z

Jazminl: New Page

==Problems?==
* [[How To Report A Problem]]
* [[How To Contact Us]]

==Computer / Network Access==
* [[How To Get An Account]]
* [[How To Secure Your Home Directory]]
* [[How To Change Your Password]]
* [[How To Obtain A Network Connection]]

==Physical Access==
* [[How To Gain Physical Access]]

==Profiles==
Read this if you have problems with downloading files, surfing the Internet,
assigning the default printer and printing PDF files from Windows workstations.
* [[How To Reset Your Profile]]
* [[How To Keep Your Profile Small]]

==Email==
* [[Email Quick Start]]
* [[How Received Email Is Processed]]
* [[How To Forward Email]]
* [[How To Sort Email Using Address Extensions]]
* [[How To Sort Email Using Procmail|How To Sort Email Using Procmail (For Advanced Users)]]
* [[How To Filter Out Spam]]
* [[How To Set A Vacation Auto-Reply]]
* [[The Departmental Mailing List Hierarchy]]

==Web==
* [[How To Publish Personal Web Content]]
* [[How To Password Protect Personal Web Content]]
* [[How To Install The Root Certificate]]

==Remote Access==
* [[How To Use VPN]]
* [[How To Use SSH]]
* [[Debian: Weak Cryptographic Keys]]
* [[How To Tunnel Connections Through SSH]]
* [[How To Display X Applications On Windows]]

==Applications==
* [[How To Prepare PDF From LaTeX]]
* MATLAB
** [[List of Available MATLAB Toolboxes]]
** [[How To Use the MATLAB Compiler]]
** [[Error When Using MATLAB Symbolic Math Toolbox on Linux]]
* [[OPNET 9.0 User Variables (Windows)]]

File:Xapps xwin32-config.png

2009-05-15T22:48:04Z

Jazminl:

File:Xapps ssh-config.png

2009-05-15T22:47:49Z

Jazminl:

File:Xapps putty-x11fwd.png

2009-05-15T22:47:35Z

Jazminl:

File:Thunderbird wiz usernames.png

2009-05-15T22:47:20Z

Jazminl: