ssh uses ~/.ssh/identity as the default filename for the private key when using version 1 of the ssh protocol and it uses ~/.ssh/id_rsa and ~/.ssh/id_dsa as the default filenames for the RSA and DSA private keys when using version 2 of the ssh protocol. However there are several ways of changing this behaviour.

Command line

ssh allows you to provide a different identity/id file using the -i option on the ssh command line as follows:

$ ssh -i /path/to/id_rsa user@some.domain.org

Where id_rsa can be substituted with id_dsa or identity.

This is the simplest method. And when used in conjunction with a subversion client you can create a [tunnel] in the subversion configuration file like so:

[general]
ssh = ssh -i /path/to/identity_file

If you want to support different identity/id files create a new [tunnel] ‘alias’ for each identity file. You can also use the -p option if you want to specify a different port at the same time.

Config file – first method

Another method is to use the ssh config file. The global file is found in /etc/ssh/config however you can also provide config files on a per user basic in ~/.ssh. In the config file you can restrict declarations using the Host declaration. Per the man page:

Host
   Restricts the following declarations (up to the next Host
   keyword) to be only for those hosts that match one of the
   patterns given after the keyword.  If more than one pattern
   is provided, they should be separated by whitespace.  A
   single `*' as a pattern can be used to provide global defaults
   for all hosts.  The host is the hostname argument given on
   the command line (i.e. the name is not converted to a
   canonicalized host name before matching).

The declaration IdentityFile allows you to specify the private key file that ssh should use. By using Host and IdentityFile you can let ssh pick the identity/id file itself based upon the host name. The following example will pick ~/.ssh/id_dsa for any host other than my.specific.host.org and my.other.host.com. In those cases the specified private key files are used.

# General settings
IdentityFile ~/.ssh/id_rsa
IdentifyFile ~/.ssh/id_dsa
IdentityFile ~/.ssh/identity

Host my.specific.host.org
IdentityFile ~/.ssh/my_specific_key_file

Host my.other.host.com
IdentityFile ~/.ssh/my_other_key_file

Note how the config file allows you to specify more than one file at once. When you do ssh will try each of the files in turn or as appropriate.

Config file – second method

The problem with the above method is that you have to keep adding new entries to the config file for new hosts. IdentityFile is actually very powerful and allows you to have wild cards in the path specification. The full man page definition says:

IdentityFile
   Specifies a file from which the user's RSA or DSA
   authentication identity is read.  The default is ~/.ssh/identity
   for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa
   for protocol version 2. Additionally, any identities
   represented by the authentication agent will be used for
   authentication.

   The file name may use the tilde syntax to refer to a user's
   home directory or one of the following escape characters:
   `%d' (local user's home directory), `%u' (local user name),
    `%l' (local host name), `%h' (remote host name) or `%r'
   (remote user name).

   It is possible to have multiple identity files specified in
   configuration files; all these identities will be tried in
   sequence.

So I have set up my config file as below. It basically tries ~/.ssh/idents/hostname/username/id_* first, then ~/.ssh/idents/hostname/id_*, then the defaults before giving up.

# SSH config file

IdentityFile ~/.ssh/idents/%h/%u/id_rsa
IdentityFile ~/.ssh/idents/%h/%u/id_dsa
IdentityFile ~/.ssh/idents/%h/id_rsa
IdentityFile ~/.ssh/idents/%h/id_dsa
IdentityFile ~/.ssh/id_rsa
IdentityFile ~/.ssh/id_dsa

This allows me to support a new server/key file combination just by putting the key file in the appropriate place in the ~/.ssh without having to edit config files.

Installation

I am currently running Ubuntu 9.10 so installed subversion as follows:

$ sudo apt-get install subversion

If you don’t have ssh installed (why not?) install it similarly.

Users and groups

Once you have subversion and ssh installed you can set up the SVN server. Firstly you need to create a suitable users group, an admin user and a repository.

Create the group like so:

$ sudo groupadd -g 127 svnusers

The group id (127 above) needs to be unique so unless you know a free group id value check to see the last id used in the groups file as follows:

$ tail /etc/group

Then create an SVN admin user using useradd as below:

$ sudo useradd -c "SVN Admin" -u 2000 -g 127 -d /home/svnadmin -m -s /bin/bash svnadmin

Again the user id (2000 above) needs to be unique. This time look at /etc/passwd to find out the last id used. The group id (127 above) should be the same value as the group you created. The rest of the options tell useradd to create a home directory and to set the default shell to be bash.

Set the password for the SVN admin user like so:

$ sudo passwd svnadmin

Finally add any other users to the svnusers group by editing /etc/group and adding the additional users in a comma separated list on the end. For example:

svnusers:x:127:svnadmin,melanie

Server setup

Now its time to create a repository. Firstly create the directory where all the repositories will be stored. I put mine in /var since my /var is on separate partition (to protect from disk full issues). However you can put them where you want. So create the directory and set the permissions as below:

$ mkdir -p /path/to/subversion/repositories
$ chown -R root.svnusers /path/to/subversion/repositories
$ chmod -R 770 /path/to/subversion/repositories

When using ssh, svnserve is used as the SVN server. svnserve requires the full path to repository to be provided by the client to access the repository. You may not want to expose your file system that much so you can write a small script to modify the behaviour. Use which to find out where svnserve is and rename it.

$ which svnserve
/usr/bin/svnserve
$ sudo mv /usr/bin/svnserve /usr/bin/svnserve.bin

Then using your favourite editor create the script below and save it under the old svnserve name.

#!/bin/bash
exec /usr/bin/svnserve.bin -r /path/to/subversion/repositories "$@"

Finally set the execute permissions.

$ sudo chmod 755 /usr/bin/svnserve

Creating a project

Now its time to create a project. Change to the svnadmin user and enter the password.

$ su - svnadmin
password:

Now create a project and turn off other access so that only members of the svnusers group and the admin user can access it.

$ svnadmin create /path/to/subversion/repositories/my_first_project
$ chmod -R o-rwx /path/to/subversion/repositories/my_first_project

Finally you need to configure the project’s access permissions by editing

/path/to/subversion/repositories/my_first_project/conf/svnserve.conf

In the [general] section uncomment or add:

anon-access = none
auth-access = write

Now save the file.

Testing

Now you should be able to access the svn repository from anywhere provided the user is in the svnusers group. Test as follows from a client.

$ svn list svn+ssh://user@some.domain.org/my_first_project

You will be asked for the ssh password for the machine running subversion. And that’s it. You should be able to use your project. You can add new projects using the svnadmin user.

Further tweaks

There a couple of additional things you may want to do. Firstly my subversion server is behind a firewall. The machine it is on is accessed using ssh on a different port to the default. Secondly keep being asked for the ssh password can become quite a pain. Using public key authentication does make things somewhat easier.

Using an alternative ssh port

Annoyingly SVN does not understand the ‘username@domain:port’ syntax. It doesn’t know what to do with the port. However you can use svn’s configuration files to create a custom ‘protocol’. This allows you to add support for an alternative port through the configuration file.

You client user should have a file

~/.subversion/config

If not, create it. In it there should be a [tunnels] section. To that you can add a new ‘protocol’. I created sshhome as follows:

[general]
sshhome = ssh -q -p 1234

The -q option prevents the “Killed by signal 15″ message that you see with some versions of subversion. You can then use sshhome instead of ssh as the protocol and it will use the specified port. E.g.

$ svn list svn+sshhome://user@some.domain.org/my_first_project

Public key authentication

Finally to save having to enter your password all the time you can create a public key and install it on the server. On the client change to the ~/.ssh directory. Now if there’s already a file in it called id_dsa or id_rsa STOP. I’m not sure how to support multiple keys yet and create a new key will over write these files. If all is well create a set of keys as below. Do not use an empty passphrase. It’s also good security not to use your password as the passphrase.

$ ssh-keygen -t dsa -C "username@some.domain.org"
Generating public/private dsa key pair.
Enter file in which to save the key (/Users/username/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /Users/username/.ssh/id_dsa.
Your public key has been saved in /Users/username/.ssh/id_dsa.pub.
The key fingerprint is:

Now you need to put the public key on to the server. Copy the file in to your home directory on the SVN server. You can use scp for that.

$ scp id_dsa.pub username@some.domain.org:/path/to/home/directory/.ssh

Then log in to the SVN server and change to the ~/.ssh directory. In that directory add the public key to the file of authorized keys and set the permissions. Then delete the public key file. See below:

$ cat id_dsa.pub  >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ rm id_dsa.pub

And that should be it. Try listing your project directory again. This time for the first time it will ask you for your password but then it will only ask for the password infrequently.

When DPC 2010 announced the call for papers I submitted both a proposal for a tutorial on PHP extensions and one for a talk on web services. Both were excepted. I had proposed both half day and full day versions of the tutorial the organisers chose the full day version. This turned out to be a lot of work. Basically I would be talking for 6 hours in four 90 minute slots.

The web services talk was to be trailed at the PHP NW group in May. Unfortunately being stuck in the US due to the Icelandic Volcano and its dust cloud didn’t give me much time to prepare for it. However by the time of the group meeting I had a basic talk. This meant I could devote the rest of the time up to DPC preparing the tutorial.

Since it is still early in my speaking career I don’t yet have the experience to accurately judge how long a talk will take. I had never done a tutorial before so I had no experience to base it on. In the end I came up with a plan where I had some ‘optional’ sections which I could add on the end if I ran short. It was scary to see how much content I required and took me several weeks to prepare in odd evenings. In the end it came in at over 100 slides together with four example extensions.

I flew to Amsterdam courtesy of KLM’s direct flight from Leeds Bradford Airport to Schipol. Since the hotel was right by Amsterdam Centraal train station it was a simple train ride from the airport and a short walk. After meeting other attendees and speakers in the hotel foyer I headed up to my room to finish preparation for the Friday. It turned out that I wasn’t by the station, my room was in a building over the station. It straddled two platforms and a set of tracks.

The following morning I got up early and Lornajane helped me, and others, get to the conference venue. I was extremely nervous. This wasn’t helped by finding out that many of iBuilding’s own staff would be in my Extensions tutorial. In the end the day went very quickly. As usual when I’m nervous I spoke to quickly. Luckily I could answer all questions and also had a chance to talk about some side projects. I finished early so I turned the last session in to a workshop to any who wanted to try their hand at writing an extension. I was very pleased at how well it had been received.

That evening a whole bunch of us were going to an Indonesian fusion restaurant. Unfortunately due to our guide getting a little lost and my impractical shoes I arrived tired with sore feet. The food was great but I wanted to get back to the hotel and sleep. As I was still nervous about the talk the following day I didn’t sleep well. I also had the dilemma of either being too warm or it being too noisy with the trains.

The following morning I woke very tired. I met with some friends and fellow conference people at breakfast and we all headed off for the first of the two days of conference talks. It was an awesome Friday keynote from Kevlin Henney. I had seen him speak before an PHP NW 2009 and he did not disappoint. Following talks were equally impressive. My slot was on after afternoon tea which is always hard work and by then I was tired out. It was not a great talk. Although fine for the PHP NW group meeting it was a little basic for an international conference. I will know for next time.

That evening was the Speakers dinner which was thoroughly enjoyable. I got to talk to Kevlin and others and since by then I had given all my content I could have a bit of a drink and not worry about having to make it the following morning although since the Saturday keynote was being given by Chris Shiflett who I had also seen before and thoroughly enjoyed I was too late to bed so that I could be there on time to see him.

Sunday provided another day of great speakers and talks. Thoroughly enjoyable. Then the conference wound down. Those of us who were staying the Saturday night headed off for pancakes. Marcus and I got completely lost in Amsterdam due to confusing instructions from Ivo (it was the wrong social he was talking about) and eventually turned up about an hour later than everyone else. However the pancakes were well worth it. It was followed by some more drinking and then bed.

Since Lornajane and I live in the same city we were on the same KLM flight back from Amsterdam so we became travel partners. Sunday was spent mostly hanging out in Amsterdam followed by an unstressed journey to the airport, a couple of beers waiting for our flight, and an uneventful flight home.

DPC 2010 was really good fun. I learnt a lot, both from the talks and giving the tutorial and the talk. I met many good friends and made lots of new ones. Too many to have a check list here. I’m now looking forward to my ‘home’ conference, PHP NW 2010 in October.

PHP Extensions

This tutorial covered writing PHP extensions from the very beginning right through to writing objects and classes in C. I think this went well. Its a lot for beginners to cover so naturally some people got lost towards the end but I have had some good feedback. Links to the slides and examples are below.

Web Services For Consumer Devices

This talk covered what to consider when writing a service to be used by an application on a consumer devices. I agree with the commenters who felt it was a little light. Yes it needs revision before it gets reused.

WebServicesForConsumerDevices-20100612.pdf

I will be running a tutorial Writing a PHP extension in C and speaking about Web Sevices for Consumer Devices. I look forward to seeing you there.

Framegrab adds two classes to PHP. FrameGrabDevice represents a video capture device and FrameGrabImage an image captured with a FrameGrabDevice.

You can create a new FrameGrabDevice for the default video capture device as follows:

	$device = new FrameGrabDevice();

The extension will iterate through available video devices until it finds one that supports video capture. A FrameGrabDeviceException will be thrown either if no video devices are available or if the available video devices do not support video capture.

You can supply an argument to the constructor (see below) if you want to initialise a specific video device. In this case the FrameGrabDeviceException will be thrown if that specific device does not exist or does not support video capture.

	$device = new FrameGrabDevice('/dev/video1');

Once you have a device you can then grab an image using the grab() method. The method takes no arguments and returns a FrameGrabImage object or false on error. As the FrameGrabImage constructor is a protected method you cannot create objects directly using new.

Once you have the image you can either save the image to the file in PNG format or have it returned as a string in PNG format using the writeAsPNG() and toStringAsPNG() methods respectively. The former takes a filename as the sole argument and returns false on error. The latter takes no arguments and returns either the PNG data as a string or false on error.

The two objects also support a number of properties. The code below demonstrates the extension in use. It returns an image captured from the default video device as a PNG. The image has capture device and image meta data embedded in it visible in the top left corner of the image.

<?php
 
try {
	// Get the default frame grabber device.  Throws an exception if a device
	// cannot be found.
	$device = new FrameGrabDevice();
 
	// Grab am image.
	$fgimage = $device->grab();
	if ($fgimage) {
		// Create a GD image from a frame grab image
		$gdimage = imagecreatefromstring($fgimage->toStringAsPNG());
 
		// Output data about the image on to the image
		$font  = 1;
		$black = imagecolorallocate($gdimage, 0, 0, 0);
		$fh    = imagefontheight($font);
		$x     = 10;
		$y     = 10;
		imagestring($gdimage, $font, $x, $y, "Device: ".$device->device, $black);
		$y += $fh;
		imagestring($gdimage, $font, $x, $y, "Card: ".$device->card, $black);
		$y += $fh;
		imagestring($gdimage, $font, $x, $y, "Width: ".$fgimage->width, $black);
		$y += $fh;
		imagestring($gdimage, $font, $x, $y, "Height: ".$fgimage->height, $black);
		$y += $fh;
		imagestring($gdimage, $font, $x, $y, "Format: ".$fgimage->format, $black);
		$y += $fh;
		imagestring($gdimage, $font, $x, $y, "Bytes per line: ".$fgimage->bytes_per_line, $black);
 
		// Output the image
		header('Content-Type: image/png');
		imagepng($gdimage);
		imagedestroy($gdimage);
	}
} catch (Exception $e) {
	// Handle the FrameGrabDevice exception here.
}
 
?>

The extension is available at the PECL site.

To make control of modems easier over twenty years ago the Hayes Corporation developed a serial command protocol, the Hayes or AT command set. Many other modems adopted the protocol and now its a de-facto standard. Over the years as modem functionality expanded so did the command set. Now it supports FAX, cell phone address books, SMSes and so on. The AT command set comprises a set of text based commands terminated with CRLF. The responses are similarly text strings terminated with CRLF. Typically the modem responds with “OK”, “ERROR” or a setting value.

DIO currently provides two stream types raw and serial. Raw streams provide low level access to operating system devices. Serial streams provide access to, and abstract, serial ports. DIO stream support is accessed just like any other PHP streams. The appropriate URI is fopened. The relevant URIs are:

dio.raw://[device]

for raw streams and

dio.serial://[device]

for serials streams. In both cases [device] is the device name to open. For example this could be /dev/random for the random device on Linux; or /dev/ttyS0 for a comms port on Linux; or COM1 for a comms port on Windows. We’ll be using the later form of the URI as we’re opening a serial port.

The example code opens the serial port as follows:

$f = fopen("dio.serial:///dev/tty.ZTEUSBATPort_", "r+", false, $c);

The first argument is the device to open. In this case a serial port to the USB 3G modem connected to my MacBook. The second is the open mode, in this case read/write. The third is an optional argument that comprises a flag that indicates whether to search the include path for the file to open. We don’t want this. The final optional argument is a stream context which is a collection of stream specific additional parameters.

A stream context is created using stream_context_create(). The code in the example that creates the context, prior to opening the port, is shown below.

$c = stream_context_create(array('dio' => 
	array('data_rate' => 9600, 
		  'data_bits' => 8, 
		  'stop_bits' => 1, 
		  'parity' => 0, 
		  'flow_control' => 0,
		  'is_blocking' => 0,
		  'canonical' => 1)));

The first four context options are pretty obvious. The serial port is being configured for 9600 bits per second, 8 bits per byte with 1 additional stop bit per byte and no parity checking.

The next option disables hardware flow control. Serial ports are relatively slow so they often have hardware control lines which indicate when there is data ready to be sent and space in the buffer ready to receive data. My USB modem does not have these so the hardware flow control is disabled.

Next we turn off blocking. With blocking function calls the operating system waits for data and only returns when it is ready to return the data that was requested i.e. the operating system blocks on the data. Non-blocking function calls return whether there is data or not. The POSIX open call also blocks on the state of the Data Carrier Detect (“DCD”) hardware control line. Some modems have this control line and use it to indicate there’s a carrier signal on the telephone line. Again since the USB modem does not have this we disable it.

Finally we enable canonical mode. Canonical IO on POSIX means that the serial port driver will wait for a line of text ending in a newline (or the internal buffer being full) before returning. If less characters than were entered on the line were requested the driver buffers the data for subsequent reads until the entire line is returned. In canonical mode you can actually connect a terminal to the serial port as line editing is supported. Since Windows does not have a canonical mode DIO provides an implementation on top of the Windows driver. The alternative to canonical mode is byte mode where by DIO waits until the requested number of bytes have been read and returns regardless of whether there are more bytes available.

If all that sounds a little complicated think of it like this. If you’re reading strings terminated with a new line use canonical mode otherwise use byte mode.

Remember that blocking was disabled so that opening the serial device did not block. This isn’t desirable when actually reading data. Blocking mode can be re-enabled on an open stream using stream_set_blocking as follows:

stream_set_blocking($f, true);

Once the serial port has been opened with the appropriate port settings and blocking re-enabled the port can be written and read using the standard fprintf and fgets PHP functions.

There are two AT commands related to sending an SMS. The first is “AT+CMGF=1″ which tells the modem to operate in SMS text mode. This should respond with “OK”. The second is “AT+CMGS=” which is followed by a string comprising a telephone number. This accepts the text of an SMS which is sent when CTRL-Z is entered.

There’s a little bit of additional work in the example as the modem echos data sent to it back to the sender so the PHP code consumes data after a command is sent until it sees the sent command echoed back. The full example follows.

<?php 
 
define('PHONE_NUMBER', '5551234');
define('SMS_TEXT', 'Hello world!');
 
/**
 * Sends data to the modem
 */
function send_data($f, $string) {
	echo "< $string\n";
	fprintf($f, "$string\r\n");
}
 
/**
 * Reads lines from the serial port.  It reads until a non blank line is
 * received then returns it.
 */
function get_string($f) {
	do {
		// remove carriage returns, line feeds and excess white space
		$response = trim(str_replace(array("\r\n","\r","\n"), '', fgets($f)));
	} while ($response == '');
 
	return $response;
}
 
/**
 * Waits for OK to be sent back by the modem.
 */
function wait_for_ok($f) {
	do {
		$response = get_string($f);
		echo "> $response\n";
	} while ($response != "OK");
}
 
// MAIN CODE
 
// Create the context
$c = stream_context_create(array('dio' => 
	array('data_rate' => 9600, 
		  'data_bits' => 8, 
		  'stop_bits' => 1, 
		  'parity' => 0, 
		  'flow_control' => 0,
		  'is_blocking' => 0,
		  'canonical' => 1)));
 
// Open the port
$f = fopen("dio.serial:///dev/tty.ZTEUSBATPort_", "r+", false, $c);
 
if ($f) {
	// Re-enable blocking
	stream_set_blocking($f, true);
 
	// Set SMS text entry mode
	send_data($f, "AT+CMGF=1");
	wait_for_ok($f);
 
	// Send an SMS
	send_data($f, "AT+CMGS=\"" . PHONE_NUMBER . "\"");
	send_data($f, SMS_TEXT);
	// Send CTRL-Z to end SMS text entry
	fprintf($f, chr(26));	
	wait_for_ok($f);
 
	// Close the port
	fclose($f);
}
?>

The original DIO API is very basic and POSIX oriented. Serial support is not very configurable and doesn’t work at all on Window platforms. So I have been working on implementing PHP stream extensions that allow you to do raw and serial IO via streams. Anyway its ready for testing by people other than me on POSIX (Linux, OS X etc) and Windows platforms so I’m looking for beta testers.

Where to get it

The release candidate is downloadable as a package from:

http://www.cyberspice.org.uk/downloads/dio-0.0.4rc3.tgz

And directly from SVN at:

http://svn.php.net/repository/pecl/dio/tags/RELEASE_0_0_4RC3

Documentation

While I write proper PHP documentation below is a brief over view of how you use DIO.

Streams

DIO streams are just PHP streams. You use fopen() to open them and fread(), fwrite(), fgets(), stream_set_blocking() etc. There are two DIO streams, dio.raw and dio.serial.

dio.raw is as it sounds, raw streams. It uses the low level OS streams such as open(), read(), write(), close() etc. on POSIX and CreateFile(), OpenFile(), ReadFile(), WriteFile(), CloseFile() on Windows. It does not buffer except the internal PHP buffering.

dio.serial is full serial support. It allows setting of data rates, data size, stop bits, handshaking and raw/canonical modes etc.

Both stream types support timeouts and blocking/non-blocking use.

Example code

Below is a small example that opens a serial port, configuring it with a stream context, and then reads and writes from it before closing it.

<?php 
	// Create a stream context that configures the serial port
	// And enables canonical input.
	$c = stream_context_create(array('dio' => 
		array('data_rate' => 115200, 
		      'data_bits' => 8, 
		      'stop_bits' => 1, 
		      'parity' => 0, 
		      'is_canonical' => 1)));
 
	// Are we POSIX or Windows?  POSIX platforms do not have a
	// Standard port naming scheme so it could be /dev/ttyUSB0
	// or some long /dev/tty.serial_port_name_thingy on OSX.
	if (PATH_SEPARATOR != ";") {
		$filename = "dio.serial:///dev/ttyS0";
	} else {
		$filename = "dio.serial://COM1";
	}
 
	// Open the stream for read only and use it.
	$f = fopen($filename, "r+", false, $c);
	if ($f) {
		echo "Writing to port...\n";
		fprintf($f,"Hello world\n");
		echo "Reading from port...\n";
		$data = fgets($f);
		if ($data) {
			echo $data;
		}
		fclose($f);
	}
?>

Stream context

DIO uses the stream context to obtain the port configuration settings. There are settings which are common to all DIO streams and settings which are sub-stream specific. The common settings are:

Both the blocking setting and the timeout settings can changed after the stream is open using the PHP functions stream_set_blocking() and stream_set_timeout() respectively.

The serial stream has the following additional configuration settings.

Finally

So there you are. Any results, good or bad, are useful. DIO has error checking and will return useful warnings if you try and feed it silly values. Logs, PHP versions, etc. would be useful diagnosing issues. Thanks.

I will be bringing a long several Arduino-a-likes together with a variety of components and CDs of the IDE so that we can get together in groups, code and play.