Charles N Wyble blog http://blog.knownelement.com Just another WordPress site Mon, 30 Apr 2012 07:04:53 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 2012 Q1 Reviewhttp://blog.knownelement.com/2012/04/30/2012-q1-review/ http://blog.knownelement.com/2012/04/30/2012-q1-review/#comments Mon, 30 Apr 2012 07:04:53 +0000 charlesnw http://blog.knownelement.com/?p=945 It’s been a while since I have done a blog post.  Current situation report:

1) Still in the same apartment (a mile from the office)

2) Still happily employed at the same employer (it’s been over a year now)

3) Still working away as co founder and CTO of the Free Network Foundation. This is my only personal project at this time, and it’s a second full time job! :)

I see my last post was a task list. How did I do?

1) FNF NOC is operational in Kansas City. You can read about that at this FNF blog post.

2) FNF lab is built and on standby to be shipped to Kansas City. The wifi related gear (used for continuous integration) will remain here. You can read the details in this mailing list post. The lab turned out a bit different then envisioned in my last post, but over all it’s pretty similar. All of the same applications will be deployed. Just that some are now in a production instance, some are in KC, some are in ATX.

3)  I’ve yet to root my Android phone. However I have a G1 and a MyTouch3g which will be getting rooted in the near future.

4) One time passwords and token security hardening. This is finally getting under way. It’s now called FreedomTunnel.

(I’ve branded my various personal projects as FNF initiatives, and now a lot of them are moving forward under the auspices of the FNF). It’s really great to find folks who share my passion, and want to see us succeed.

5) Disaster recovery. We are deploying a backup server in Dallas which will mirror the one in KC.

It’s been a very exciting year so far!

]]> http://blog.knownelement.com/2012/04/30/2012-q1-review/feed/ 0 Tasks between now and end of Februaryhttp://blog.knownelement.com/2011/09/25/tasks-between-now-and-end-of-september/ http://blog.knownelement.com/2011/09/25/tasks-between-now-and-end-of-september/#comments Sun, 25 Sep 2011 18:33:11 +0000 charlesnw http://blog.knownelement.com/?p=895 1) Finish FNF production NOC setup

2) Finish FNF lab setup

Dev box tasks: ( this will be used for all my security research, financial modeling etc). It will also monitor my production system in the colo (via AlienVault)

1) Setup smartmon/smartd monitoring/alerting
2) setup LXC
3) Setup Alienvault LXC instance
4) Setup GNS3
5) Setup Marketcetera
6) Setup uDig
7) Setup kismet IDS
8) Setup snort
9) Setup clamav
10) Setup osiris
11) Setup logwatch
12) Setup root e-mail forwarding
13) Setup vlans
14) Setup openvas
15) Setup warvox
16)  install GPU SDK/drivers/tools etc

3) Root android phone so I can use it for Serval development and other fun things

 

So what are the outstanding tasks to finish the reference implementation?

 

Phase 1: FreedomNode and FreedomLink work

 

3) Infrastructure support services

Status: Not yet started

This set of tasks encompasses all of the necessary services a production network requires. This includes things such as backups, logging, security, user authentication and monitoring/alerting.

Storage system setup

  • Setup UPNP streaming for media (pictures/music)  << in progress
  • Setup Samba share for media (pictures/music) << in progress

Monitoring/alerting:

I have good coverage of all my prod systems at a basic level, but need to add more detail. Development/research is in a very early state, with almost no coverage. Currently using sureping.com for external monitoring of various production systems/services (apache/smtp etc) and this is working quite well. Internally I’m using opsview to monitor all of my systems (production and development). I also get traffic graphs etc.

Netflow exports to NTOP

MRTG via opsview

RANCID

Planned items: Network traffic visualization (snort/snorby/sguil/secviz.org tools)

Network Security:

  • LDAP
  • Kerberos
  • RADIUS
  • PacketFence
  • One Time Password System
  • Setup security test bed system
    • Setup OpenVAS
    • Setup Metasploit
    • Setup Nessus
    • Setup armitage
    • Setup various other pentest tools etc (network hacking, ssl, mitm etc)
    • Setup sshfs/git/cifs for laptop to work off of server
  • token security hardening
    • Keep up to date on patches for OS and applications
      • automate OS updates
      • alert when new security updates are available for my LAMP apps
    • Monitoring syslog (octopussy is used for this)
    • Monitoring file integrity (ossec is used for this)
    • Running SNORT with automated signature updates (pfsense)
    • Check various DNS/mail blacklists and dshield.org for my IP addresses (manual process at the moment. could easily automate it)
    • moving virtual machines to appropriate vlans (malware research, development as production stuff is all one vm at media temple)

After the above tasks are completed, I’ll be shifting focus to advanced security posture tasks. This will support my further goals (linux and windows malware research, high frequency trading systems for virtual currencies, overall parallel systems development).

So what will this security system be composed of, beyond standard data center/enterprise type network security items in my above list?

The first end product of the system will be a one time password server. This will be utilized network wide (windows/linux login, web app login, vpn authentication etc).

The second end product will be an openvz virtual machine image for hosting financial applications (bitcoin vault, virtual currency trading).

I’ve got some ideas about how to go about building these systems. Rough draft below. More to come later.

GENODE? Barrelfish? Striped down linux image?

Integrity monitoring

0 exposed ports

Centralization vs decentralization vs hybrid

  • Complete security project planning and preparation
    • blog post (high level, give folks a good overview of the problem space)
    • wiki article (more tactical. lots of links etc. will probably be several wiki pages)
    • 3d work space setup

OTP

Stored certs

Other 2 factor systems

 

4) Documentation

  • Pictures of racks on blog/wiki << in progress
  • Documentation of physical gear  (make/model, mac addresses, power/ethernet port mappings, power usage) on the wiki << in progress
  • Documentation of services configuration/setup on wiki << not started
  • Documentation of everything
Hope to have section 3/4 completed by 5PM CST Monday August 29th 2011.

5) Ensure all web services on wiki are operational

  • Hookup cordless phone base station to knel-prod-ap1 via ATA << in progress
  • Hookup Nortel VOIP phone to knel-prod-ap1 via wireless
  • Ensure all items have an associated URL for access to the service and to the software homepage
  • Setup antispam
  • Setup collaboration systems

Now that I’m wrapping up my data ownership project, I find myself taking on a couple larger projects:

1) Working with folks on the Free Network Foundation road map. Been using e-mail / wiki / skype screen sharing for this but want a better tool.

Working with folks on the security aspects of data ownership as it relates to providing a secure infrastructure for financial transactions. This is a really big project and I want to capture all aspects of it for archival purposes. People like that for security related things.

Here is what I have deployed so far:

1) Freeswitch (an open source Voice over IP server). This will let us have secure voice/video communications without using Skype.

2) Jabber (an open source text chat server). This will let us have secure text chats. I am investigating the use of http://jitsi.org/ to provide a single, open source client for Windows/Mac/Linux that will let us have voice/video/text chat using freeswitch/jabber and also share our screens.

3) Etherpad (an open source collaborative text editor). Self explanatory. This eliminates the use of google docs

4) Redmine/Tracks (open source project management tools). I also am reviewing some open source scrum tools like icescrum.org.

5) Git (open source source control system integrated with redmine) This is used for tracking changes to code and documentation.

6) Drupal (open source content management system)

Needed tools:
What are the awesome tools in this space? They must be open source and able to be self hosted. Prefer things in python/ruby/php but can also run Java applications.

1) Shared whiteboarding tool (quick and dirty drawings, temporary todo list capture)
2) Shared diagramming tool (for network and complex project diagrams)
3) Better discussion tool then e-mail. Especially for things like this e-mail, where it really should be a document with revision tracking etc. I’m still in the process of getting etherpad deployed. I have eyeOS deployed which has some document editing tools. Need to see if these tools will provide google docs functionality or if I need to use other tools.

 

6) High availability (primary at RH VPS, secondary at Debian VPS)

  • LinuxHA
  • PowerDNS
Hope to have section 5/6 done by end of September
8) FreedomTower/FreedomLink work
  • Setting up guest wireless access SSID/DHCP subnet/bandwidth limiting etc << not started
  • Setting up honeypot wireless SSID/DHCP subnet/bandwidth limiting etc << not started
  • Setting up mesh link between two parts of apartment complex << not started
  • Setup SPAN port on access and distribution switch for AlienVault use
  • Setup channel bonding and STP between access/dist switch
B)  Home network services:
  • Install AlienVault << done (deployed as a VM on proxmox machine. Needs lots of configuration, which will be done in section 3)
  • Setup DNS server  << done (PowerDNS with PowerAdmin. Authoritative and recursive)

September

]]> http://blog.knownelement.com/2011/09/25/tasks-between-now-and-end-of-september/feed/ 0 2011 Status updatehttp://blog.knownelement.com/2011/07/27/2011-rest-of-year-todo-list/ http://blog.knownelement.com/2011/07/27/2011-rest-of-year-todo-list/#comments Wed, 27 Jul 2011 19:22:44 +0000 charlesnw http://blog.knownelement.com/?p=747 What have I gotten done so far in 2011?

1) Shipped a working mesh at the end of my previous engagement. This was a very exciting milestone for me, and closed out a multi year effort of on again/off again work on mesh networks.

2) Shipped several major milestones of my data ownership stack. This was an 18 month effort, that led me on a journey through infrastructure deployment and optimization, storage and server infrastructure assessment/evaluation/burn in, sustainability review. I went from a 2 rack deployment in my garage to running everything at my new $dayjob (large hosting provider) and a backup VPS at systeminplace. This took me from a month over month operations cost of $300 to about $70.00.

3) Relocated to Austin TX to work at one of the worlds largest shared hosting companies. This was quite an adventure and represented a huge improvement in my quality of life. I thoroughly enjoyed the last 8 months of contracting, which allowed me to detox from the horrible corporate environment in Los Angeles and find a perfect opportunity.

4) Finished up some major personal projects in my life, (mentoring someone and preparing them for a successful career in IT, putting my health/wellness as my number one priority, finding a deeply fulfilling place of work.

5) Completed several lingering data ownership tasks. My data ownership wiki page is now up to date with all the aspects that I’ve been working on for a couple of years on and off. From blogging/wiki/photos/accounting/centralized address book/project management functionality, to digital economy and security. It’s been a long journey but it’s finally complete!

6) Founded the FreeNetworkFoundation and found a way to fit my data ownership work into a milestone in the FNF roadmap/operations plan.

Been a very productive and enriching first half of the year!

So what’s ahead for the rest of 2011? 

1) Finish setup of physical infrastructure for home (development and very minimal production services) network, home security and  home entertainment services.

Status: 100% completed. New consolidated production system is ready for shipment to co-location center. All other gear is on standby for further configuration/deployment to other co-location centers. 

This set of tasks encompasses the physical setup of all hardware/services for home use. It includes tasks such as networked power distribution unit installation, network cabling, console hookup, optimizing gear layout across two racks , cable organization etc.

I’m moving production related services to a co location box. Moving off my $dayjob VPS to a dedicated server for about the same monthly price.

I’ll be running the first FreedomTower off my home network.

Detailed break down:

  • Pull everything off of production rack and re rack gear (necessary to clear space for build out of consolidated server) << done
  • Consolidate drives/ram/peripherals to FreedomLink system (server consolidation. good stuff) << done
  • Optimize gear distribution/layout on production rack << done
  • Optimize air flow on all gear << done

Re-rack all gear:

2 post rack (FreedomTower rack):

  • Install PDU for later use << done
  • Connect all network gear to Cisco terminal server << done
  • Make cables beautiful << done
  • Label all gear << done
I’ll be coming back to this rack in a big way in October.

AV rack (production rack):

  • Install PDU for later use << done
  • Install, power up, configure 3650 distribution layer switch and 2950 access layer switch << done (overkill for a home network? perhaps. however I do plan to run a small production wireless ISP and so need a bit of infrastructure to support that.)
  • Connect all network gear to console << done
  • Connect all gear to network << done
  • Set up gear for mesh link between two parts of apartment complex (installing gear on both ends of link,  running power/networking cabling) << done
  • Setup security cameras << done
  • Make cables beautiful << done

2) Base configuration of network gear, home network services, research/development/production servers.

Status: 100% completed

This set of tasks encompasses all of the basic network/server/support infrastructure configuration tasks for my development/research and home services network to be usable.

At this time, all of my gear is on the network (via wired or wireless connection) and reachable for management purposes. I have a dedicated management network (10.10.6.0/24) for all gear. Now that all the physical gear is setup, it needs to have foundational setup completed.  On the server side, this means running a virtual machine farm, on the network side this means multiple VLANs for all my future projects.

Detailed break down:

A) Physical infrastructure related tasks:

  • Optimize power usage of all systems << done (via cpufreq on Linux. Hardware I’m running pfSense on has some stability issues with powerd)
  • Setup ZoneMinder for home security << done (camera hooked up, video capture card working, feed into zoneminder working.).
B) Network core:
  • Setup ipv6 on pfsense << done
  • Setup all virtual lans in pfsense (interface define/assign/label, subnet) << done (research operations will be done on home network. As such I need decent amount of infrastructure (software/server side) to support those projects.
3) Finish personal projects 
  • Migrate personal e-mail archive collection into online memex (i have a few hundred e-mails to take public). I need to up on the net so others can benefit from them. They are already nicely categorized. This collection will feed into the FNF roadmap. It represents several years of collected knowledge about large scale network operations.
  • Write blog post on fitness “Culture Shock: from free soda to free gym, how I have built the life I want”. This will cover past status, present status and future plan. Might have to start a fitness blog or something. At least a web page to track progress. << health is my top priority in 2011. It’s why I contracted for several months and waited for the right opportunity to come along which let me live a healthy and balanced life. I want to share what I did and how I did it so others can benefit. Post started and well underway
  • Setup security research/testing lab
4) Finish FNF production network deployment
]]> http://blog.knownelement.com/2011/07/27/2011-rest-of-year-todo-list/feed/ 0 My current home network detailshttp://blog.knownelement.com/2011/05/20/my-current-network-details/ http://blog.knownelement.com/2011/05/20/my-current-network-details/#comments Fri, 20 May 2011 16:39:54 +0000 charlesnw http://blog.knownelement.com/?p=729 Here is a quick write up on my current home network.

Production Network:

1) pfSense on a Dell Optiplex x86 (connected to my TimeWarnerCable connection).

2) Cisco 3548 switch. This is the switch that everything else ties into it. My network core switch. It also provides POE for when I’m messing with various POE devices.

3) 1 Villagetelco mesh potato providing WPA2 wifi to the entire apartment.

The above setup is rock solid. It also lets me support a lab network on same set of gear. I can do multi vlan/multi ssid/multi gateways. All without affecting my production network (that’s key!)

Development network consists of:

  • Cisco 2600 router
  • Cisco 2500 router (console server for everything else in lab)
  • 2 Cisco 2950 switch and 1 Cisco 2924 switch (3 switches covers just about every cisco cert topology)
  • Cisco 3640 router
  • Cisco AS5200 (not much use and might get donated)
  • Cisco 6509 (my pride and joy)
  • Dell optiplex desktop for lxc (all sorts of hacking here)
  • Dell optiplex desktop for freedombox dev (freedombox0. will run genode and linux guests etc.)
  • PS3 (parallel development)

This gear is being used at the Free Network Foundation development and test lab.

]]> http://blog.knownelement.com/2011/05/20/my-current-network-details/feed/ 0 Eating healthy in the month of May for less then $200.00http://blog.knownelement.com/2011/05/03/eating-healthy-in-the-month-of-may-for-less-then-200-00/ http://blog.knownelement.com/2011/05/03/eating-healthy-in-the-month-of-may-for-less-then-200-00/#comments Tue, 03 May 2011 17:57:58 +0000 charlesnw http://blog.knownelement.com/?p=706  

So I got back from Los Angeles yesterday and needed to go shopping. Went to the local walmart and got food for the entire month.

 

What did I get?

Main dish:

  • 8 boxes of 6 rib eye steaks for 9.95 each (main dish for most meals of the month)
  • 13 sausages (main dish when I get tired of steak)
  • Chicken / beef fajitas strips (main dish when I get tired of steak)
  • 4 corn on the cob (1 for each weekend)

Garnish elements:

  • Rice
  • Salmon (cut into little pieces)
  • 5 lbs chicken (cut into little pieces)
  • Shredded lettuce
  • Mushrooms
  • Potatoes
  • Onion
  • Tomatoes

This gives me breakfast/lunch/dinner for an entire month. Steak is the main meal. I garnish the steak with a pre cooked mix of potatoes/onion/salmon/chicken/lettuce/tomato (refrigerated and stored in Tupperware). It’s quite tasty. Make that mix about twice a month or so.

Pretty cheap and very healthy.

]]> http://blog.knownelement.com/2011/05/03/eating-healthy-in-the-month-of-may-for-less-then-200-00/feed/ 0 Releasing my memexhttp://blog.knownelement.com/2011/04/17/releasing-my-memex/ http://blog.knownelement.com/2011/04/17/releasing-my-memex/#comments Sun, 17 Apr 2011 15:37:16 +0000 charlesnw http://blog.knownelement.com/?p=679 Ok. This is a quick and dirty release of a tool I’ve built over the past several days. If it breaks you can keep all of the pieces. :)

Seriously though, this is a very quick and dirty release. I make no guarantees. It should work but it might not.

My Personal Memex ( Tech note:  DOWNLOAD BITS It’s a docroot and sql dump.)

Steps to install:

  1. Unpack the downloaded archive. It will uncompress into a new directory (memex_bits_release-1.0).
  2. In that directory are two files: memex_docroot.tar.gz memex_dump.sql.gz)
    • So unpack memex_docroot.tar.gz into an apache directory.
    • Edit the sites/default/settings.php mysql connection line.
  3. Load up the memex_dump.sql.gz into an empty MySQL database. Names/credentials should match what’s in the config.php file. You’ll need to uncompress the SQL file first, maybe you can stream it straight into mysql command. Dunno.
  4. Login to the site. admin/memexpw is the credentials.

I haven’t tested doing an installation. If you find any bugs let me know. Contribute patches! :)

So what do you get?

  1. Drupal installation with all my customizations to support my personal knowledge collection.

 

Hopefully this is useful to folks.

]]> http://blog.knownelement.com/2011/04/17/releasing-my-memex/feed/ 0 How I defined data ownership and how close I am to reach thathttp://blog.knownelement.com/2011/04/15/how-i-defined-data-ownership-and-how-close-i-am-to-reach-that/ http://blog.knownelement.com/2011/04/15/how-i-defined-data-ownership-and-how-close-i-am-to-reach-that/#comments Fri, 15 Apr 2011 05:49:51 +0000 charlesnw http://blog.knownelement.com/?p=619 When I started my data ownership journey I had a goal: reduce the number of logins I need to one, and back it with a one time password system. That is the ultimate goal and will take me another 6 months to reach beta 1.

In the meantime I have settled on a compromise: reduce the number of logins I have that aren’t under my complete control.

I have a number of logins still (across all my various LAMP applications), but I control them all.

Here are the logins I still don’t control:

  1. Google (I only use google groups). I maybe able to use OpenID here not sure.
  2. Hosting control panel/billing system and dynamic DNS provider (could do dyndns myself on my VPS if I wanted to)

 

  1. Skype (still looking for a replacement for Skype. Have hopes for GNU free call.) Or just move to Jabber.
  2. Yahoo/AIM/IRC (all bridged to my Jabber server on my VPS). Once enough people move to Jabber (Gtalk is acceptable here) I can just federate with them. There is an OpenFire plugin to federate with skype. Have yet to get it working.

 

  1. Chase.com/Citi.com/AA.Com/Amex
  2. Netflix/Hulu
  3. Power and electric company
  4. Online property management portal at my apartment complex (I could choose not to use this, but it’s really convenient)

Not too bad. Pretty much the bare minimum (things related to finance/utilities). These folks usually have pretty good security, but not always.

Where are other folks in their data  ownership journeys? Tell me in a comment.

]]> http://blog.knownelement.com/2011/04/15/how-i-defined-data-ownership-and-how-close-i-am-to-reach-that/feed/ 0 My roadmap for the emergent technology initiative.http://blog.knownelement.com/2011/04/14/my-roadmap-for-the-emergent-technology-initiative/ http://blog.knownelement.com/2011/04/14/my-roadmap-for-the-emergent-technology-initiative/#comments Thu, 14 Apr 2011 18:49:35 +0000 charlesnw http://blog.knownelement.com/?p=615 Here are two mailing list posts I’ve done in the past couple weeks. It’s an overall roadmap for a vision I’ve been working on for the past few years.

Enjoy.

Phase 1: FreedomBox

Hello all,

I want to share with folks what my idea for the freedombox is and how I’m continuing to work on achieving that goal. I’m a systems guy and so I am a very practical, feet on the ground kind of person. As such this e-mail will be somewhat low level and tactical, hopefully that will lead to some productive discourse. :)

I have thoroughly enjoyed the numerous deep, if not somewhat theoretical conversations on this list about security,encryption,naming system changes,p2p etc. I do have a test lab and am looking forward to playing with this stuff as it comes into fruition.

To contribute to that , I’m currently thinking through how to utilize things like GENODE for a trusted code base on the bottom and run various pieces inside Debian guests. As I work more with that idea I’ll post up my adventures.

As for my idea of the FreedomBox:

In a nutshell I want to create a debian meta package called ownyourdata and in one single apt-get command have it build,deploy,defend an integrated free software stack that provides secure (anonymity, defensibility), encrypted (storage and transit), sustainable (encrypted local and friend cloud backups), federated (can’t be an island) data ownership capabilities.

This would make it available to anyone running a Debian system on whatever hardware platform they
choose. It would also make it easy for anyone performing integration tasks (tech savy folks setting this up for their social network, hardware/software vendors that we might partner with, NGOs etc).

The overall meta package would consist of some sub meta packages:

dataown-web (LAMP frontend applications mentioned on my wiki. Easily re mixed with whatever LAMP apps folks choose to substitute).

I’ve been working on this pieces for the past 18 months or so, and the current incarnation of my idea is documented at http://wiki.knownelement.com/index.php?title=Data_Ownership

That page covers the process of getting off the cloud and onto ones own server. I’ve gotten all my data off the cloud, though I do utilize a hosting provider, as I’m no longer interested in maintaining a server/network farm at home for production use. :)

I am happy with the software choices I’ve used for that migration. It’s taken a few iterations to find the software I like.  That’s the beauty of free software, having those choices and being able to easily change between them.

I think most of us are already at this point (data migrated off of cloud onto LAMP stack under various degrees of our control). I want to make a debian package that can allow anyone to get to that same point very quickly. I feel that I’ve used these packages enough that I can strongly recommend them to other people.

dataown-backends Package up various support daemons (XMPP/LDAP/Gnump3d)

This is additional functionality that most people would want to utilize. It’s something that is on my very near term todo list for my own use. Should be pretty easy to package up.

dataown-backups (Tahoe-lafs, maybe duplicity?)

This is where I am now focused. Working on bullet proof automatic, network local backups using duplicity and dumping into a Tahoe-lafs grid, as well as p2p cloud backups with friends utilizing Tahoe-lafs and maybe Phanthom/n2n. It’s certainly a work in progress. I’ll keep track of the work on my wiki at http://wiki.knownelement.com/index.php?title=BlueJacket It’s actually proving to be a somewhat difficult problem to wrap my head around. Well the problem is simple, but numerous solutions exist that require detailed analysis.

Once I’ve got the backups solid I will move on to security work. I’m hoping to post a complete write up on my backup solution by the end of April.

Ideally I can create all 3 above packages sometime in May.

dataown-security (Kerberos/One Time Password generation bits/TOR/Phanthom/I2P)

This is something that will require substantial attention, analysis, testing, user feedback etc. In short I feel it’s where the FreedomBox will truly shine. I don’t expect it to be easy, and in fact expect the first beta incarnation to take 6 months or so. We can bring “enterprise grade” security to everyone at a vastly lower cost (no additional cost beyond hardware)/complexity then existing solutions.

What do folks think of this idea?

 

Phase 2: Network architecture for the freedombox to communicate over

 

Hey folks,

I have really enjoyed the discussion on the list over the past few days. Great stuff. Got me thinking.

I suppose I owe you folks a big long post on what I think the “next net” should look like, just like I posted my vision and work towards implementing the FreedomBox vision. My vision is mostly focused on utilizing the existing networks until we have enough systems deployed to build our own. These systems will need to be built with a vision towards interop and joining a larger p2p cloud at  some future point.

Keep in mind I’m not really able to implement any of this “next net’ vision until I’m done with my FreedomBox work (backups/distributed system/security). I’ve made a commitment to myself to get that stuff shipped.

This is where you fine folks come in. Hopefully we can all proceed in parallel and rapidly release a coherent system that can be deployed in a grassroots manner.

I’m targeting beta 1 release of my security stack stuff for ContactCon October 20th 2011. *waves at Vanessa*. Having a date/conference really focuses me and drives me to produce something that I can toss out for folks to hack on.  Would love to have some slides in my presentation that talk about the progress on the network portion of our overall vision. Not sure if I’ll be able to make it to the con, but I can certainly participate virtually.

Essentially I don’t want all the work folks are doing on FreedomBox to be obsolete due to a centrally administered network that can take them out. In short the parallel/alternative/nextnet network is the most important piece.

This is kind of rough but here goes my vision/roadmap…

Phase 1:  access layer and the distribution layer via mesh networks. Using 802.11a/g/n and 3650mhz.
It will be different region by region. I have a good idea how to cover most of Southern California (where I was born and lived for 25 years). I have war driven a fair amount and done lots of GIS type research. You can get a 1gig .shp file of LA county for $8.00 on a DVD. Then you can do all sorts of things with it, in programs like UDIG ( http://udig.refractions.net/ ) The FCC provides .shp files as well, if you want to know where towers and licensed links are etc. USGS has data on topography etc. NASA, Microsofts TerraEarth etc etc. Lots of GIS data out there for free. Use things like http://www.qsl.net/kd2bd/splat.html to do link planning. I’ve been doing this stuff for a while now and have been focused on building real networks. It’s great to talk about theory, perfect world, IP is broken, replacing TCP/IP etc, but in the end it’s really not practical. However I’m not opposed to replacing layer2 in wifi. See http://tier.cs.berkeley.edu/drupal/wireless for folks who are building a TDMA based layer2 on openwrt/wrt54gl boxes.

Other regions have different geography and that needs to be taken into account. Perhaps folks can start finding local organizations that will give roof space etc?

I am thinking of building a localized advertising network, so the below bits include revenue percentages. They add up to 50%. This keeps costs way down, because neighborhood folks are keen to keep the network up and running to maintain advertising cash flow. Capitalistic, mod me down etc etc. :)

SoCal Region Network/Revenue Plan (feel free to take this and adapt to your region). It was original written from a proprietary perspective. I’ve done minimal editing here to make it less so. It’s available under the public domain. All rights assigned to everyone etc etc.

OSS:
This is a highly available system with primary hosting at a regional HQ of sorts
(probably a local hackerspace) and fully
redundant backup on two ec2 or other IASS provider availability zones.
It contains the network  command and control systems used for provisioning,
billing,monitoring,authentication, ad delivery etc.

Packet pushing:

The packet pushing functions of the network are split into 5 layers:

1) Network core POP location (horizontal/distributed network core layer)
These are located in computer rooms on mountain tops throughout southern
California. These locations terminate bridged Black Diamond PtP back haul
links over 3650 and whitespace frequencies.

These points of presence consist of:

A) vyatta based x86 rack mount systems
B) switching gear
C) UBNT.com 3650 and 700mhz antennas

2) Network Aggregation POP Location (horizontal/distributed network aggregation layer)
(Black diamond nodes) (30% revenue sharing)
These are located in peoples houses that have been early adopters and are willing to take on the
burden of a nascent network.

They host an AP/switch, iboot, ups, sheeva plug, x86 ad server. All contained in a locked box
with only the antennas/connectors exposed.

3) Network Distribution POP Location (horizontal/distributed network distribution layer)
(Green diamond nodes) (15% revenue sharing)
mesh gateway ap

4) Neighborhood POP
(Blue diamond nodes – mesh client ap) (4% revenue sharing)

5) Block POP
(Red diamond nodes in home ap) (1% revenue sharing)

Phase 2: Linking up regional networks (at least one per state, probably one per city/county). By this I mean one regional network. There will be many many many meshes setup, in varying degrees of coverage, bandwidth, backhaul characteristics etc. They will rapidly converge into regional networks and interconnect via some sort of external gateway protocol (probably BGP but maybe not). This allows the individual networks to stay small, agile, independent (avoiding becoming a conglomerate that can be easily shut down), but to interconnect/peer with each other to implement regional traffic flow etc.

I would like to see a network wide system utilizing:

n2n for tunneling traffic between local and regional networks across the existing backbone in a transparent method as possible. Some MTU hit would be taken, but I think this is acceptable.

Phanthom/Tor/I2P for full end to end encryption/privacy/anonymity. No one should be more powerful
or trusted then anyone else. Some centralization might be required (for example hosting a distributed hash table with a directory of nodes). I would like to avoid that, and I can certainly make it optional.  So a network could operate on a pure localized peer to peer basis. A wizard could ask something like “do you wish to connect your cloud with other clouds on a global basis?” Dunno. Something to think about. I feel that a small amount of centralized infrastructure that leads to rapid boot strapping is a useful thing.

MPLS for making the back bone scale. Not sure if this is strictly necessary, but it seems like a cool idea. I’ve not done enough with MPLS in a pure software routing environment to know if it’s a workable state or not. Google did a presentation at the last NANOG on the subject that seemed to make it look like it was workable for them at a large scale http://nanog.org/meetings/nanog50/abstracts.php?pt=MTYzNSZuYW5vZzUw&nm=nanog50 <http://nanog.org/meetings/nanog50/abstracts.php?pt=MTYzNSZuYW5vZzUw&nm=nanog50>

Phase 3: Linking up with the rest of the world. Not sure how to go about this. This is where the global entity comes in. The rest of the world uses BGP to send route announcements around. We would need
an entity for the AS and IP space to be assigned to.

So that’s about the totality of my vision for now. It’s how I plan to implement the road map that Isaac laid out the other day. Please attack each and every aspect of this and make it awesome!

]]> http://blog.knownelement.com/2011/04/14/my-roadmap-for-the-emergent-technology-initiative/feed/ 0 Tahoe on Ubuntuhttp://blog.knownelement.com/2011/04/03/tahoe-on-ubuntu/ http://blog.knownelement.com/2011/04/03/tahoe-on-ubuntu/#comments Sun, 03 Apr 2011 19:23:10 +0000 charlesnw http://blog.knownelement.com/?p=581 This is on ubuntu 11.04. Quick notes. I presume you know how to use apt-get etc.

1) Download the tahoe dist zip

2) Install deps first round. (sudo apt-get install build-essential libpython2.7-dev )

3) As root python setup.py build   && python setup.py install

4)  Install deps second round: ( sudo apt-get install python-pycryptopp  python-mock python-asn1 python-nevow python-foolscap )

]]> http://blog.knownelement.com/2011/04/03/tahoe-on-ubuntu/feed/ 0 ipv6 – no excuse to not be on it (or ipv6 in 10 minutes)http://blog.knownelement.com/2011/01/26/ipv6-no-excuse-to-not-be-on-it-or-ipv6-in-10-minutes/ http://blog.knownelement.com/2011/01/26/ipv6-no-excuse-to-not-be-on-it-or-ipv6-in-10-minutes/#comments Wed, 26 Jan 2011 21:14:10 +0000 charlesnw http://blog.knownelement.com/?p=536 I now have ipv6 connectivity at my house. It took about 10 minutes.

I run pfsense 1.2.3 as my routing platform. Have a mix of Windows/Linux workstations and servers. I simply followed the howto at http://www.xaero.org/index.php/archive/tag/tunnelbroker/ and http://tuts4tech.net/2010/07/18/ipv6-tunnel-on-pfsense/ for the setup.

I’m now fully operational from a connectivity perspective.  I checked at http://test-ipv6.com/ and http://www.delong.com/cgi-bin/areyouv6.cgi

Next step is to enable v6 delivery of my www/smtp/xmpp/sip services. more on that as it happens.


]]> http://blog.knownelement.com/2011/01/26/ipv6-no-excuse-to-not-be-on-it-or-ipv6-in-10-minutes/feed/ 0