text:
OpenSSH/Cookbook/Certificate-based Authentication

Certificates are keys which have been signed by another key. The key used for such signing is called the certificate authority. It is made in advance and set aside, reserved for signing only. Other parties use the signing key's public half to verify the authenticity of the signed key being used for server identification, in the case of a host certificate, or for login, in the case of a user certificate .

In the interest of privilege separation, make separate certificate authorities for host certificates and user certificates if both are going to be used. As of the time of this writing, either of the elliptical curve algorithms are a good choice.

Overview of SSH Certificates
When using certificates either the client or the server are pre-configured to accept keys which have themselves been signed by another key specially designated and set aside for just the purpose of signing the keys actually used for work. That other key is known as a certificate authority, or CA for short. As with normal keys, certificates are used to generate signatures used in authentication. However, rather than looking up the matching public key in a file, the public key is filed with a signature and the signature is used to verify the public key and then the public key is used to ensure that the negotiations are happening with a client in possession of the matching private key. So a prerequisite for using certificates is at least a passing familiarity with normal SSH. See the chapter on Public Key Authentication. The mechanics of normal key-based authentication are described briefly there in the introduction. SSH uses its own simpler certificate format and not the X.509 certificate format.

Two of the main advantages of certificates over keys are that they can use an expiration date, or even a date range of validity, and that they eliminate need for trust-on-first-use or complicated key verification methods. Mostly they facilitate large scale deployments by easing the processes of key approval and distribution and provide a better option than copying the same host keys across multiple destinations.

User certificates authenticate users to their accounts on the servers. Host certificates authenticate servers to the clients, proving that the clients are connecting to the right system. The use of a principals field to designate users versus hosts is the main difference between host and user certificates. In host certificates, the principals field refers to the server names represented by the certificate. In user certificates that field refers to the accounts which are allowed to use the certificate for logging in. Additional limitations just as specific source addresses and forced commands are available for user certificates. Date and time of validity are possible for both. Host certificates and user certificates should use separate certificate authorities. For a more authoritative resource, see the "CERTIFICATES" section of ssh-keygen(1).

SSH User Certificates
User certificates authenticate the user to a server or other remote device, in other words they allow people and scripts to log in. Authenticating the client to the server by means of user certificates means that the authorized_keys file on the server is no longer needed. Instead the user certificate, really a signed key, is checked against the certificate authority to verify if the signature is valid. If it is, then the login process can proceed. Another advantage is that the signatures can be designated as valid only for a range of dates. So in practice, it is possible to have an expiration date. User certificates are also tied to specific accounts, referred to as 'principals'. The principal(s) allowed to use the signed key must be designated or the server will not accept use of the authentication key even if it is properly signed.

It is even possible to restrict the source of incoming connections or force specific commands using options like force-command and source-address similar to normal SSH public keys. These restrictions are set at the time of signing. If those options are to be changed, the key must be resigned or else become invalid.

Files Associated with SSH User Certificates
There are five files associated with user certificates. The Certificate Authority must be kept safe and stored out of band. If it is lost then no new user accounts can be added to the pool and a new certificate authority must be established. If it falls into the wrong hands then an attacker could use it to pass their accounts off as legitimate users:

 * Certificate Authority - a private SSH key generated for signing other keys

The next one is kept on the server itself:

 * Certificate Public Key - the public component of the certificate authority

The last three files are kept on the client systems:

 * Private SSH Key - the private key used for authenticating to the server or remote device
 * Public SSH Key - the matching public key which has been signed by the Certificate Authority
 * User Certificate - the signature made for the User Public Key using the Certificate Authority

Optionally, the user certificate and its key can be associated permanently with a remote server or device using the | ssh_config file, either globally or per-account, via the CertificateFile and IdentityFile directives.

Steps for Working with SSH User Certificates
There are four steps in working with user certificates. Step one, creation of a certificate authority, is done just once per pool of users or scripts. Step two, adjusting the servers' configurations, can be repeated for as many server systems or remote devices as are needed. Step three, signing the user keys, is done once per user account. Step four, deploying the user certificate, can be done for as many clients as allowed by the principals and any source-address limitations that might be included.

1. Creating a Certificate Authority
It is a very good idea to keep separate certificate authorities for hosts and users. So, in the interest of privilege separation, make a separate certificate authority for user certificates even if you already have one for host certificates.

The private key created here should be kept somewhere other than the servers. However, the servers will have access to the public component so as to be able to verify the signature that will be put forth by the clients.

2. Storing the Public Component of the Certificate Authority on the Server
The server needs to be able to look up the matching certificate in order to validate the signature on user keys. That is set in the SSH daemon's configuration. Copy the host certificate to the same place the host keys are stored. Then point the OpenSSH server to the certificate authority's public component using the TrustedUserCAKeys directive in |sshd_config(5)

Double check to make sure the file permissions are correct.

Then any number of accounts can be used with that certificate authority.

3. Processing an Existing Public Key
The users must have a key pair already made and then submit the public key component of the pair for signing. Sign it and transfer the signed copies back to the right person. Delete any artifacts of this process immediately, since extra public keys lying around can only cause clutter at best. Here a public key named server01.ed25519.pub has been accepted and a certificate is made with it.

The resulting certificate will be named server01.ed25519-cert.pub and will have the internal ID "edcba" and an internal serial number "2". Both the ID and the serial number must be calculated externally. For successful logins the certificate's id and serial fields will be included in the log. See the section Logging and Troubleshooting for more depth on the topic. It is a very good idea to list a principal for the certificate, even for user certificates. The principal listed in the certificate does need to match the account it will log in to.

Even though the public key itself is not strictly needed after that on the client side for logging in, it can be good for the client to keep. But if the public key has been lost, a new one can be regenerated from the private key, though not the other way around. When the private key is gone, it is gone. So keep a proper backup schedule. If a file exists with the name the public key should have, it had better be the public key itself or else the login attempt will fail.

The logistics for getting the public key and delivering the certificate are outside the scope of this book. But at this point, the resulting certificate should be transferred back to the person working with the key that was submitted.

4. Logging in Using an SSH User Certificate
On the client side, both the user certificate and the private key it corresponds to are needed to log in.

Once things are working manually a shortcut can be made using ssh_config(5) on the client. Use of IdentitiesOnly might also be needed if an agent is used and there are multiple keys in the agent.

With those settings, running  on that client will try to apply both the designated key and its corresponding user certificate and designated principal.

SSH Host Certificates
One of the main uses of keys by OpenSSH is the authentication of a remote host to a client so that the client can verify that it is connecting directly to the right system and not an impostor of via an intruder in between. For that, once acknowledged, the known_hosts file usually keeps a copy of the public key in a register of host keys paired with host names or IP addresses.

The difficulty with host keys in general is in populating the known_hosts file on clients for large pools of client machines or when connecting to new systems for the first time. In a data center or lab or Internet of Things deployment, machines are always coming and going. That means new SSH host keys each time. If there are a lot of hosts involved, then that adds up to a lot of keys in the register. Using a host certificate instead, an arbitrarily large pool of hosts using the same certificate authority need only one entry in the known_hosts register, even as new hosts are added to the pool. By signing the host keys which a new server or device uses to identify itself, it is still possible to roll out new systems with unique keys but have them recognized correctly and safely by clients on the first try without risking the potential for a man-in-the-middle.

By using host certificates, these identifying host keys are signed and the signature can be verified against the agreed upon certificate authority, thus greatly easing the otherwise involved process of collecting and verifying the host's public key when making the first connection.

Files Associated with SSH Host Certificates
There are five files involved in using host certificates. Like with user certificates, the certificate authority must be kept safe. The same precautions apply as for user certificates but for hosts rather than the accounts on them:

 * Certificate Authority - a private key generated for signing other keys

The next three files are kept on the server itself.

 * Certificate public key - the public component of the certificate authority
 * Host Public Key - the actual key that the SSH daemon uses to identify itself to the clients
 * Host Certificate - the signature made for the Host Public Key using the Certificate Authority

Then on the clients, either in the client's register or the system-wide register of recognized hosts:

 * known_hosts - contains a reference to the host certificate and its principals

When the clients find and use a valid host certificate, no entry for the individual host will be added to the known_hosts register.

Steps for Using SSH Host Certificates
There are four general stages in working with host certificates. Step one, creation of a certificate authority, is done just once per server or pool of servers or devices. Step two, signing the host keys, is done once per server device as is step three. Step four, configuring the clients, can be repeated for as many client machines or individual login accounts as needed.

With each step, mind the paths. There is no one-size-fits-all solution, so it will be necessary to decide where the files should go.

1. Creating a Certificate Authority
Again, a certificate authority, or CA, is just another SSH key. However rather than using it for authenticating the servers or clients directly, it is used to sign and then validate the other keys which are then actually used for authentication.

The private key created here should be kept somewhere other than the servers where they will be used.

The public key in this step must be distributed out of band to the clients which will then use it to verify host identities upon first connection.

2. Fetching and Signing the Host Key
Only the public key gets signed. Fetch the remote host's public host key via a reliable method, sign it, and then upload the resulting certificate to the server. The -h option indicates that this shall be a host certificate and the -s option points to the key used to do the signing. Here a copy of the host key ssh_host_ecdsa_key.pub has been acquired from its server and will be worked on locally:

The validity interval set by the -V option is time span relative to the date and time when the key signed. So it would be possible to make a certificate valid for only an hour tomorrow using the formula. If no start time is set, then the value is interpreted as the stopping time. If a specific stopping time or date is required, that is best done by having a script calculate that and then call | ssh_key-gen(1). If no time is given at all, the certificate will be considered valid indefinitely.

The -I option assigns a label for the purpose of identifying the certificate.

The -z option manually assigns a serial number to the certificate. That serial number must be extracted from the old certificate and then incremented if it is to be kept in sequence. The default is to not have a serial number. The -n option assigns a set of principals, that would be which hosts may use the certificate in the context of host certificates.

The contents of the certificate can be reviewed using the -L option.

The certificate for the public host key must be transferred over to where the server can use it. That usually means the same directory where the regular public host key is found, which is/etc/ssh/ by default. Check to be sure that the certificate has the right permissions after copying it in place.

3. Publishing the Host Certificate.
Once the host certificate is in place, the SSH daemon on the remote host must be pointed at the host certificate. See sshd_config(5) for more.

The SSH daemon must then be instructed to reload its configuration file. The exact method varies from sytem to system but ultimately the daemon will receive a HUP signal.

4. Updating Clients to Acknowledge the Designated Certificate Authority
Finally add a reference to the certificate authority in the client's known_hosts file:

That's it. However, it is important to realize that each of the above steps will fail more or less silently and the client will fall back to the usual approach of verifying the host's identity without reporting any error for its part. Any useful debugging information will be in the daemon's logs and even that will be of limited nature. See the chapter on Logging and Troubleshooting for examples.

Orchestration of Certificate Deployment
Automatically deploying certificates, either user certificates or host certificates, is beyond the scope of this book. There are many ways to do it and many factors involved. The details depend not only on which orchestration software is used, but also which specific distro or operating system is in place at the end points. In short, figure out how to do it manually and then figure out how to automate that process using the work flow allowed by the deployment scripts or software.

However, it is important to note that the certificate authority can be kept in an agent. Investigate about the -U option for signing.

Limiting User Certificates
Various limitations can be bound to a user certificate inside the certificate itself. These are mostly specified using the -O option when signing the key and include a validity interval, a forced command, source address ranges, disabling pseudo-terminal allocation, and others. See the manual page for ssh-keygen(1) for an authoritative list. These limitations can be combined or used separately. The examples below will address them separately for clarity.

Time Limitations for User Certificates
The certificate can be made valid for a planned time period, called here as a validity interval. The validity interval can have a specific starting date and time, ending date and time, or both. However, each certificate may have only a single validity interval.

Validity intervals are specified with the -V option and can use an absolute date and time range or a relative one. Using the key example from the user certificate section above, the following would limit when the certificate would be valid. Specifically, it is good for a five minute period on June 24, 2020 from 1:55pm through 2pm.

Be sure to look closely at the resulting output to ensure that the range is what it needs to be.

Relative intervals can be used, too. Here is a certificate which is good for only five minutes, starting right away:

Note that the seconds are included and are counted from when the signing is initiated not when the passphrase is eventually entered and the signing finally completed. So if the certificate signing is initiated at 35 seconds past the top of the minute, the expiration time will also be at 35 seconds past the fifth minute. And, again, look closely at the resulting output.

Forced Commands with User Certificates
A user certificate can be tied to a specific command on the server by using the -O option as it is created. In this example, the certificate which only ever show the time and date whenever it is used to connect to the SSH server:

If there is a forced command in both the certificate and sshd_config(5), then the latter takes precedence. Any command that was passed as a run time argument is overridden, yet can be found in the SSH_ORIGINAL_COMMAND environment variable. Commands that come from inside the certificate won't affect the SSH_ORIGINAL_COMMAND variable and will have to be parsed from the certificate itself, which will be held in the ephemeral file pointed to by the SSH_USER_AUTH environment variable.

The file will only exist while the session is still open. The SSH_USER_AUTH variable itself will only be set if the SSH server's configuration has ExposeAuthInfo set to 'yes' and the default is 'no'.

Source Address Restrictions on User Certificates
A certificate can be limited to a specific CIDR range.

The CIDR range must be valid.

Viewing Limitations on User Certificates
If the certificate is at hand, it is possible to look at it in detail and see which limitations apply, certificate-side. Below is an example certificate for the account 'fred', two LAN ranges, and just over one hour of access.

Obviously the certificate itself cannot show any additional restrictions made server-side in the SSH server's configuration.

If the user certificate is not at hand, but is used for authentication, then limitations and all other embedded characteristics can be gleaned by using the SSH_USER_AUTH variable provided by the ExposeAuthInfo option in sshd_config(5) to fetch the certificate from the server. The certificate itself will leave the SSH_ORIGINAL_COMMAND variable alone, so the temporary file will be the only way to see what was actually in the certificate. Again, the certificate file pointed to by the SSH_USER_AUTH variable will only exist while the session is open.


text:
Talk:Department:Engineering

Dear Editor Greetings of the day. As i have browsed through all the available departments, i was amazed to see the missing department "Management" would you add it, so that we can post few subjects like Project management, Work study, Supply chain and management under this category — Preceding unsigned comment added by Ben.rajesh (talk • contribs) 09:04, 7 May 2020 (UTC)

 * Hi, Ben.rajesh. We have a Shelf:Management, under Shelf:Business, in Department:Social sciences. --Pi zero (discuss • contribs) 12:18, 7 May 2020 (UTC)

,IS IT PROFESSIONALS TO THE CHILDREN TO FALL PREGNANT?
No BECAUSE AS THE CHILD YOU NEED TO PARTICIPATE AT SCHOOL. Snolwazi (discuss • contribs) 17:50, 13 November 2022 (UTC)

ইন্ডিয়ান
মোঃ আব্দুল আজিজ 23.158.56.183 (discuss) 17:24, 9 June 2024 (UTC)

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Talk:Department:Engineering


text:
Making a Programming Language From Scratch/Comparing Two Values

Comparisons
Comparisons in programming are the logical comparison between two data types of the same type to determine which is larger, or which is smaller or if both are equal. Based on the result thus derived which is a Boolean value ( 1 or 0 ) certain statements are executed or not.

Whole number comparisons
Whole numbers include chars and ints of all types. The basic format for all comparisons is the same.

CMP [ operand1 ] [ operand2 ]

The conditional jumps based on this result are :

JL or jnge for lesser than Jle or jng for lesser than equal to JG or Jnle for greater than Jge or Jnl for greater than equal to Je for equal to Jne for not equal to

Floatational comparisons
The syntax for floatational comparisons are more complex.

Fld [ operand1 ] Fld [ operand2 ] Fcompp Fstsw ax Sahf

Comparisons based on this are: Jc for lesser than Jce for lesser than equal to Je for equal to Jne for not equal to Ja for greater than Jae for greater than equal to

Logical appendations
Logical appendations are when two or more conditions are logically connected such that the result of one influences the result of the other.

For example: If(a>b&&b>c){ This condition depends on both the logical relations of a,b and c. If any one of the double conditions are false the resultant output is false.

The counterpart the || operator is used for or relations, i.e if any one of the double conditions are true then the resultant is also true.

Note that these logical operators can be used for more than two conditions.


text:
Making a Programming Language From Scratch/Localizing

Functions and scope
Before we do anything with functions we must localize the variables. Note that in case of procedures variables are not local but are global.

Scope
Anything that is declared within a function remains within the function. This essential rule called the Scope rule has governed the creation of programming languages since the time of C.

In the case of automatic or local variables it is easy. All variables that are declared with the LOCAL keyword are by default limited to the procedure only. Thus parameters are also to be declared as LOCAL however this is already done by the PROC keyword

For static variables there is no such facility and thus the localizing must be done manually. One cheap and easy method is to simply append the name of the function to the variable. But this method requires that you must convert the name of each and every static variable every where it is used. The final algorithm totally depends on you.


text:
Making a Programming Language From Scratch/Function Definitions

Function definitions
There is nothing called functions in assembly. However, there is a mildly resembling counterpart called procedures. However procedures do not return any values. This critical problem will be discussed later on.

Syntax of function definition using PROC
It is not a necessity to use the PROC keyword for all your function declarations. However it is much easier to do it this way instead of its counterpart method involving code segment pointers. The syntax for function definitions using PROC is as follows:

[ Func name ] PROC [param1] [param2]... . . . [ Func name ] ENDP

All functions have to be declared this way.


text:
Making a Programming Language From Scratch/Complex Expressions

Parenthesizes
The previous chapter deals with the processing of expressions devoid of parenthesizes. However in real-world model, usually more than one level of expressions are used, and that obviously means the usage of parenthesizes.

Syntax ...Expression...(...Expression...More parenthesizes...)...

Algorithm for dealing with Parenthesis. 1.Go through the entire line. Increment index of array until element is ';' or ')'. (This assumes that the expression has gone through function call processing, which is dealt with later.) 1.1 If ';' terminate process  1.2 If ')' continue. 2. While element not '(' decrement index. 3. Remove segment thus isolated by '(' and ')'. Store in separate array. Replace by 'pa(pnum)'. 4. Replace ')' by ';' and append to start 'pa(pnum)=' (replace pnum by actual value of variable) 5.Send to previous algorithm. Repeat step 1.

Sample Expression Conversion
i p=(p*r*t)/100; the i signifies that it is going to be an integer expression.

Result: Mov eax,p IMUL r,eax MOV eax,eax MOV eax,eax IMUL t,eax MOV eax,eax MOV va1,eax MOV eax,va1 MOV pa1,eax MOV eax,pa1 CDQ IDIV pa1/100 MOV p,eax

Now, this isnt the best of results, but this result works. However, there are huge opportunities for optimization. As you can see, nearly a third of this code is garbage with meaningless instructions like: MOV eax,eax Other times there are cases that the compiler loads the value onto eax and then dumps it onto another variable. (On my system it was intentional as the instructions did not work with two memory operands.

Try to optimize this algorithm by yourself before moving forward.

Finally Some Advantages!!
Here we have an advantage over general market languages. Because they are made for portability, they usually use what is known as a 'Emulator' which does NOT use the math co-processor but uses the CPU to integer emulate float calculations. In our case we use direct float commands, which reduces portability but increases execution speed by almost 100 times!!


text:
Cookbook:Chocolate Chip Cookies I

| Cuisine of the United States | Dessert

Ingredients

 * 2 sticks (½ lb / 225 g / 1 cup) butter, softened
 * ¾ cup (180 ml) granulated white sugar
 * ¾ cup (180 ml) packed brown sugar
 * ¼ teaspoon vanilla extract
 * 2 standard (100 g) eggs
 * 2 ¼ cups (600 ml / 290 g) all-purpose flour
 * 1 teaspoon baking soda
 * 1 teaspoon salt
 * 1 teaspoon dry ground lemon or orange peel (optional)
 * 2 cups (480 ml / 12 oz) semi-sweet chocolate morsels / chips
 * 5 oz (150 g) chopped nuts, such as groundnuts (optional)

Procedure

 * 1) Preheat oven to, or   if you want chewy cookies.
 * 2) Cream butter, granulated sugar, and brown sugar in a large mixer bowl.
 * 3) Add eggs one at a time, beating until fully incorporated.
 * 4) Add vanilla extract and beat in.
 * 5) In a small bowl, sift together the dry ingredients (except chocolate and nuts). Add to the wet mixture in two parts and fold until combined. If you beat this too long, you may get some gluten formation which will change the cookie texture.
 * 6) Stir in chocolate morsels (chips), and nuts if using.
 * 7) Drop dough by rounded tablespoons onto ungreased baking sheets. There should be enough fat in the cookie dough to prevent sticking, but using parchment paper or non-stick pans may help if you find this not to be the case.
 * 8) Bake in the preheated oven for 10–12 minutes or until golden brown (cooking times may vary). Let stand for about 1 minute and remove from hot baking sheet to cool on a wire rack.

Ingredients

 * Use cake flour instead of all-purpose, replace granulated sugar with brown sugar and use butter instead of margarine. Using cake flour and brown sugar allows you to use butter without fear of your cookies becoming puddles (which is the only reason to use margarine in the first place).
 * Use some vegetable shortening in place of butter/margarine to reduce "spread" (cookies will be thicker).
 * Add some vegetable oil (no more than 1/5 of total fat) in place of butter/margarine to increase spread, resulting in thinner cookies.
 * Using chocolate with a cocoa content greater than 65% will result in a significantly different taste than the "traditional" recipe. In general, if you find the raw chocolate to be too bitter or not enjoyable to eat, you may not like them in the cookies (no matter the quality).
 * Adding a few shakes of ground cinnamon with the dry ingredients also gives more flavor.
 * If you want to use regular flour as well as butter, the trick is to increase the amount of flour to 3+ cups, which should result in a fairly stiff dough that will not spread out very much. This trick even works with whole wheat flour.
 * The proportion of granulated to brown sugar may be adjusted to suit taste. More brown sugar will result in chewier cookies. More white sugar will result in crisper cookies.
 * Adding a greater quantity of vanilla extract (between ½ and ¾ of a teaspoon, rather than ¼) gives the cookie a more pronounced flavor.
 * If vanilla extract is not readily available, substitute two teaspoons of vanilla sugar for granulated sugar.
 * Add a small amount of oatmeal to give cookies more flavor and mouth-feel.

Method

 * Some people also recommend chilling dough before baking, though this is usually not necessary. Chilling dough may help to reduce spread, resulting in thicker cookies.
 * Use an ungreased, non-stick baking sheet instead of a greased sheet to help reduce spread, for thicker cookies. Conversely, grease your sheet if you like thinner (crispier) cookies.

 * The quality of the flavoring ingredients makes a great difference in the outcome. Using top-quality butter, chocolate, and vanilla will produce a superior cookie.
 * Using chopped bar chocolate instead of pre-formed chips will result in a more rustic texture -- just make sure the pieces are small enough to eat comfortably.
 * Do not stack hot cookies otherwise they will bend out of shape and not cool as quickly. Use a cooling rack instead for the best results.
 * For a stronger nut flavor, toast the nuts. Spread them evenly on a baking pan and set them in the 350°F oven for ten minutes. Take them out and let them cool before adding them to the dough.
 * If you like a soft and squishy middle in your cookie, take them out one minute sooner for a nice soft middle.

title: Cookbook:Chocolate Chip Cookies I


text:
Cookbook:Chocolate Chip Balls

These chocolate chip balls are a baked good similar to chocolate chip cookies.

Ingredients

 * 2 sticks (1 cup) butter, softened
 * 1 cup (240 ml) granulated white sugar
 * 1 cup (240 ml) packed brown sugar
 * 2 extra-large eggs
 * 1 teaspoon vanilla extract
 * 2 cups (480 ml) all-purpose flour
 * 2 cups (480 ml) oat flour
 * ½ teaspoon salt
 * 1 teaspoon baking soda
 * 1 teaspoon baking powder
 * 2 cups (480 ml / 12 oz) semi-sweet chocolate morsels or chocolate chips
 * 4 oz (120 g / ½ bar) grated milk chocolate
 * 3 cups (720 ml) chopped nuts (optional)

Procedure

 * 1) Preheat oven to 375°F (around 200°C).
 * 2) Cream butter and both sugars in a large mixer bowl.
 * 3) Beat in eggs and vanilla extract.
 * 4) Sift together the flour, salt, oat flour, baking powder, and baking soda.
 * 5) Stir in chocolate morsels, grated chocolate bar, and nuts.
 * 6) Roll into balls and place 2 inches apart on a cookie sheet.
 * 7) Bake for 10 minutes or until golden brown (cooking times may vary). Remove and let stand for about 1 minute before moving cookies to a plate or cooling sheet.

Notes, tips, and variations

 * Instead of a cookie sheet, you can also use a pizza stone.

title: Cookbook:Chocolate Chip Balls


text:
Cookbook:Blondies

| Desserts

A blondie is essentially a brownie variant - a dense cake with butterscotch being the predominant flavor instead of chocolate. Characteristics to strive for include a rich, buttery flavor with good balance between sweetness and saltiness, moist texture, and a golden blonde appearance.

Plain

 * Blondies I

For Special diets
None so far

Variations

 * Blonde Almond Toffee Brownies

title: Cookbook:Blondies


text:
User:MtPenguinMonster

Hello. I'm not sure what to put here.

title: User:MtPenguinMonster


text:
User:Mothjuice

Hi

title: User:Mothjuice


text:
Cookbook:Taboon Bread

Taboon bread, also spelled tabun bread, is one of the various baked flatbreads found primarily in the areas surrounding the Palestinian village of Al-Jabal. It is traditionally baked in a clay oven called a taboon oven, the bottom of which is lined with smooth beach stones.

Ingredients

 * 2 cups all-purpose wheat flour
 * 1 cup whole-wheat flour
 * 1 tsp salt
 * 1 tsp dried yeast
 * 1 tbsp olive oil
 * Water

Procedure

 * 1) Mix the dry ingredients together.
 * 2) Add olive oil, then gradually knead in enough water to make a dough. Knead for 10 minutes.
 * 3) Divide the dough into balls, and allow them to rest for an hour until risen.
 * 4) Sprinkle a flat working surface with flour, and roll the dough balls into flat, circular-shaped patties.
 * 5) Preheat an oven containing a bed of smooth beach stones to 200°C (400°F). Alternatively, you can place the stones on a tray or pan in the oven.
 * 6) Place the flat dough upon the stones, and bake for about 8 minutes until it produces bubbles.
 * 7) Serve hot.

Notes, tips, and variations

 * Taboon bread can be served by topping the bread with a spicy condiment, cheese, or sweet drizzle of grape syrup or honey.

title: Cookbook:Taboon Bread


text:
User:Sultan bin Robinson

Wow!I go by the name sultan bin Robinson ,am glad to be in Wikipedia,basically am a student learning computer science. This site has helped me learn programming inc++,Java and  python,am glad and read to provide  necessary information from this country side kenya.

title: User:Sultan bin Robinson


text:
Oberon/A2/Oberon.QuotedPrintable.Mod

(* ETH Oberon, Copyright 2001 ETH Zuerich Institut fuer Computersysteme, ETH Zentrum, CH-8092 Zuerich. Refer to the "General ETH Oberon System Source License" contract available at: http://www.oberon.ethz.ch/ *) MODULE QuotedPrintable IN Oberon; (* ejz, *) 	IMPORT Files, Fonts, Strings, Texts, Oberon; 	VAR 		W: Texts.Writer; 	PROCEDURE HexVal(ch: CHAR): SIGNED32; 	BEGIN 		IF (ch >= "0") & (ch <= "9") THEN 			RETURN ORD(ch)-ORD("0") 		ELSIF (ch >= "A") & (ch <= "F") THEN 			RETURN ORD(ch)-ORD("A")+10 		ELSIF (ch >= "a") & (ch <= "f") THEN 			RETURN ORD(ch)-ORD("a")+10 		END 	END HexVal; 	PROCEDURE decodeText*(T: Texts.Text; beg: SIGNED32; F: Files.File; binary: BOOLEAN): BOOLEAN; 		VAR 			R: Texts.Reader; 			Ri: Files.Rider; 			ch, ch1, ch2: CHAR; 		PROCEDURE ReadWrite(c: CHAR); 		BEGIN 			Texts.Read(R, ch); 			IF ~R.eot & (R.lib IS Fonts.Font) THEN 				Files.Write(Ri, c) 			END 		END ReadWrite; 	BEGIN 		Files.Set(Ri, F, 0); 		Texts.OpenReader(R, T, beg); 		Texts.Read(R, ch); 		WHILE ~R.eot & (ch <= " ") & (R.lib IS Fonts.Font) DO 			Texts.Read(R, ch) 		END; 		WHILE ~R.eot & (R.lib IS Fonts.Font) DO 			IF ch = "=" THEN 				Texts.Read(R, ch1); Texts.Read(R, ch2); 				IF Strings.IsHexDigit(ch1) & Strings.IsHexDigit(ch2) THEN 					ch := CHR(HexVal(ch1)*16+HexVal(ch2)); 					IF ~binary THEN 						ch := Strings.ISOToOberon[ORD(ch)] 					END; 					ReadWrite(ch) 				ELSIF ch1 = Strings.CR THEN 					ch := ch2 				ELSE 					Files.Write(Ri, "="); Files.Write(Ri, ch1); 					ReadWrite(ch2) 				END 			ELSE 				ReadWrite(ch) 			END 		END; 		RETURN TRUE 	END decodeText; 	PROCEDURE Decode(binary: BOOLEAN); 		VAR 			S: Texts.Scanner; 			F: Files.File; 			T: Texts.Text; 			beg, end, time: SIGNED32; 	BEGIN 		Texts.OpenScanner(S, Oberon.Par.text, Oberon.Par.pos); 		Texts.Scan(S); 		IF S.class IN {Texts.Name, Texts.String} THEN 			Texts.WriteString(W, S.s); 			F := Files.New(S.s); 			Texts.Scan(S); 			IF (S.class = Texts.Char) & ((S.c = "@") OR (S.c = "^")) THEN 				T := NIL; 				time := -1; 				Oberon.GetSelection(T, beg, end, time); 				IF T = NIL THEN 					RETURN 				END 			ELSIF S.class IN {Texts.Name, Texts.String} THEN 				NEW(T); 				Texts.Open(T, S.s); 				beg := 0 			ELSE 				beg := Texts.Pos(S); 				T := Oberon.Par.text 			END; 			IF decodeText(T, beg, F, binary) THEN 				Files.Register(F); 				Texts.WriteString(W, " done") 			ELSE 				Texts.WriteString(W, " failed") 			END; 			Texts.WriteLn(W); 			Texts.Append(Oberon.Log, W.buf) 		END 	END Decode; 	PROCEDURE DecodeText*; 	BEGIN 		Decode(FALSE) 	END DecodeText; 	PROCEDURE DecodeFile*; 	BEGIN 		Decode(TRUE) 	END DecodeFile; BEGIN 	Texts.OpenWriter(W) END QuotedPrintable.

title: Oberon/A2/Oberon.QuotedPrintable.Mod


text:
End-user Computer Security/Main content/Mind-reading attacks

 = 𓆉 ≅  End-user Computer Security Inexpensive security

=   Mind-reading powers may at first appear to you as something confined only to the realm of science fiction and fantasy. However, technology has now advanced so much that it is now literally possible to read the minds of others (using technology), as is evident from the Wikipedia page on brain-reading.  It is left up to the reader to decide whether the psychics described to us in fiction, exist at all in reality. However, you should consider the principle that dictates that, if there is a chance that they do exist, then it may well be prudent mitigating against such risk, even if in reality such risk does not exist. Also, it’s worthwhile to consider that phenomena such as levitation that was previously associated with the miraculous, now can possibly be explained away using the discovered scientific phenomena of invisible forces such as those involved in magnetism, electric fields, etc.  Please refer to the earlier section entitled "Psychic spying of password", for information on mind-reading attacks related to the psychic spying of passwords, and on how they can be overcome.

 Psychic attacks may take the form of trying to crack passwords and security credentials by entering one's dreams (like the film “Inception”). To mitigate against this security risk, it may in fact be preferable not to memorise passwords. It might be better to store them in computer files or on paper, and then only call them to mind when entering them. Also, the use of security tokens (such as USB security tokens ) as well as the use of password encryption, can overcome such psychic attacks.

   Footnotes


text:
Talk:End-user Computer Security/Main content/Mind-reading attacks

Broaden chapter so as to include mind-reading performed using psychological techniques (such as reading behavioural cues)?
The legacy of focusing on psychic powers, has meant that when the chapter name was broadened to "Mind-reading attacks", a vacuum came to exist in respect of other forms of mind-reading; in particular, psychological mind reading is not mentioned at all. Therefore, it might be a good idea to add some information on psychological mind reading. MarkJFernandes (discuss • contribs) 17:11, 8 May 2020 (UTC)

The distinction of 'psychic' within the broader topic of 'thought reading and control' is perhaps pointless?
All psychic phenomena (defined as mind-to-mind activities mostly without the use of technology) can be mimicked using technology. Therefore, referring specifically to psychic things perhaps narrows things unnecessarily, and degrades the material. Also, reference to 'thought reading and control' which includes primarily using technology for such, will perhaps have more credibility as it is disputed as to whether psychic phenomena really do exist.

Same also applies to "Passwords and digital keys" chapter.

"Also, the use of security tokens (such as USB security tokens) ... can overcome such psychic attacks." → "Also, the use of MFA ... can overcome such psychic attacks."?
More general, and potentially more useful.


text:
Template:Wikipedia doc

 Template documentation in Wikipedia  For template documentation, you can see the same name one in Wikipedia, because it has the same usage, syntax and parameters.

title: Template:Wikipedia doc


text: User:Dejan Alempijevic

title: User:Dejan Alempijevic


text:
User talk:Sgiani

I want to learn this stuff, although I can't find any practicle application...
Hey, I think this project is a good Science subject [Applied Chemistry / lab essentials], yet I caution people, this topic can quickly narrow, and not help most people.

title: User talk:Sgiani


text:
Talk:High School Earth Science/Planet Earth

High School Earth Science / Planet Earth: Flat Earth vs Sphere debate
Thanks for this content rich article.

I am interested in the current / ancient debate between people who claim the planet is in the shape of a sphere, and those who claim that the planet is flat. This seems special, because people have deduced flatness, or sphericalness, without access to super electronic telescopes. I would like to see more, again thanks for this rich-content article!


text:
User talk:Peyton09

Welcome
Welcome to Wikibooks, Peyton09!

 First steps tutorial Wikibooks is for collaborative development of free textbooks.

You do not need technical skills to contribute. You can easily change most books. Please introduce yourself, and let us know what interests you.

If you already contribute at other Wikimedia projects, our Wikimedia Orientation should quickly get you started. (Would you like to provide feedback on this message?)

  Getting help   Made a mistake?   Goodies, tips and tricks
 * Read the Using Wikibooks book for a friendly introduction to the project, or our help pages for more information.
 * You can get friendly help from the community in the user assistance room or our IRC channel.
 * Upload freely licensed files to Wikimedia Commons. You may request permission to upload fair use files locally. Please include author and source information and a non-free use rationale for non-free files.
 * You can restore a previously saved version.
 * Pages should follow the  naming convention.
 * Need to rename a page? Use the move tab (is available once your account is 4 days old - until then, ask for help).
 * To request a page be deleted, add to the top of the page.
 * Was a page you made deleted? Please read the deletion policy, and check the deletion log to find out why. Also check the RFD archives if applicable. You can request undeletion at WB:RFU, or ask the administrator who deleted the page.
 * Please fill in the edit summary and preview your edits before saving.
 * Sign your name on discussion pages by typing ~~~~
 * User scripts can make many tasks easier. Look at the Gadgets tab of my preferences; check off the boxes for the scripts you want, and hit save!

--Pi zero (discuss • contribs) 21:46, 8 May 2020 (UTC)

Poem by Omar Khayyám
Q: How do I give the proper credit to the poet of this untitled poem?

I sent my Soul through the Invisible, Some letter of that After-life to spell, And by and by my Soul returned to me, And answered, I Myself am Heav'n and Hell: Heav'n but the Vision of fulfill's Desire, And Hell the Shadow from a Soul on fire Cast on the Darkness into which Ourselves, So late emerg'd from, shall so soon expire. ~ Omar Khayyám ~

Like A Splinter In Your Mind [The Matrix film]
Current thoughts: responding to "he had not found himself...". I have used this type of "identity loss" in my own FICTION, yet, I was never serious about the subject, because I did not understand what "ego death" was about. I was using the idea ironicly, writing a fictional lie, for how can any person claim the can't find themselves? While reading a analysis of "House Made of Dawn" for Wikibooks, I had this flash: like a scar on one's minds, then I decided to share this fictitious idea with any one who happens across this page. The idea was that some drugs scar one's mental mind, leaving pain, like a scar on your mind. What if a individual is exposed to many psychedelic drugs at once, completely un-prepared. No, I do not think people should do this, yet yes, I do think exposure to certain drugs will cause a "ego loss" without the individual becoming unconscious. This is related to lucid dreaming, yet is more about people hallucinating, experience a lack of their self-realizing "I," without any way to explain what is happening to them. People who have been warned, like the character Neo, [ The Matrix film] MAY BELIEVE THEY ARE HAVING A DRUG-RELATED MENTAL BREAKDOWN. Yet people who have no previous preparation, may experience "ego-death," then upon their recovery, a "ego-rebirth" as they have to explain what they can not explain. Some people detach, suggestion possible reasons for their shift in realization, in their personal journal pages. What if people who are not prepared, obsess about things that happened to them? Although they may seem like the same person, they may seem to have a different personality. They may question aspects of their non-dreaming reality. I think about this when I analyse Neo's character [ The Matrix ]. He seemed changed, convinced that something was 'different" about his reality. From unpleasant experiences, I can relate. This is not something drug-seller brag about, or want other people to learn about. The reality of having a mental breakdown, without being prepared, due to over-exposure to drugs is more like a chemical burn on your mind. Peyton09 (discuss • contribs) 20:58, 21 May 2020 (UTC)

Sky Library?
Does Wikibooks seem like a virtual library? Maybe a home library accessed with one's personal computer? Levar Burton of Reading Rainbow television fame, spoke of connections and bookfiles creating 'sky libraries." I can relate. Why not create a "chat room" with local libraries? The community in the Reading Room seems similar to a chat room, yet much more similar and kind, maybe because of individual personal experiences. If Public Libraries gave computer rooms and computer space to "READING CHAT ROOMS," people who are polite, and value information sharing, sharing book recommendations, and using the written language to politely communicate with other people online, will probably recommend library books to special chatters in chat rooms, donate books, and encourage new writers who visit the school or public library. They may even volunteer to help local NANOWRIMO [national novel writing campaigns], a campaign I read makes efforts to reward local youth for attempting to write a 50,000 word book in 30 days, and other writer's challenges.

START A PAGE? [A SECTION FOR NEW PAGE CREATIONS...]
Greetings, I have a new idea for beginning writers interested in creating "original" vampire, ghost, and angelic characters. We could start a new section encouraging beginners to start a new page "Create A Page" [...from your perspective]. First: I assume that if we at Wikibooks have shared a good guide explaining the historic, and cultural importance of vampires, ghost, angels...ect, then we can be "helpful" and share useful information, and links, to help people quickly start by visiting "Create A Page." Critics? Peyton09 (discuss • contribs)
 * What you're describing sounds, at first blush anyway, like original research. Original research is listed at What Wikibooks is not. --Pi zero (discuss • contribs) 20:34, 24 November 2020 (UTC)

Hello Pi zero! I have returned, and I am happy to have been noticed by other people. Thank you for taking the time to comment. I think you are right, because you are a non-profit Writer / Editor interested in sharing a free textbook [open source] for the public [people all around the world]. Because the volunteers on this website have good intent, I'm going to quickly agree. Although...I have been thinking, and I shared my proposal for a new-type-of-textbook for people who are creative. I suggest we create "new textbooks" for creative writing Teachers and students. Yep, a original type of textbook for creative people. Although I am stubborn, I did change my perspective after researching the topic. If Wikibooks promises "traditional" textbooks [old style informative books], then I move to open the first chapters of Create Vampires with a introduction to FOLKLORE. Why do people collect folk stories? Is there a cultural significance? What is the History, and modern use? As a guide, I admit that this is a better direction. Thanks for sharing your time. Peyton09 (discuss • contribs) 18:51, 1 December 2020 (UTC)

 * Truthfully, it's not a question of "old-style" versus "new-style". Our definition of "book" is pretty minimal and subject to variations if someone has an innovative approach in mind, but there are some fundamental principles.  One of which is, no original research.  That's not what this project is for.  We could certain host a book about how to write creative fiction, in general or of some particular kind; but hosting original works of fiction is outside our scope. --Pi zero (discuss • contribs) 20:44, 1 December 2020 (UTC)

THANK YOU PI!!! THAT IS [NOW] WHAT I AM [PARTLY] TALKING ABOUT! I'll summarize: I have responded to my critics by modifying my original idea for a Wikibook about original works of fiction, beginning with the vampire. As I understood more about Wikibooks, their mission statement and PURPOSE, I had to modify my plan. This is  now  my BIG OUTLINE PLAN: History: Folklore of Vampires English Literature: The Most Important Questions Critics Ask About Vampires [SECTIONS FROM POPULAR LITERARY CRITICS] Self-Instructional: How To Write Creative Fiction About Vampires [and where to publish your ORIGINAL WORKS]. This IDEA is better, because of WIKIBOOK VOLUNTEERS! I am learning how to link, make info-boxes, ad upload pictures / illustrations.

Thanks Peyton09 (discuss • contribs) 19:57, 17 December 2020 (UTC)

https://commons.wikimedia.org/wiki/File:CreateVampire_Flowchart_Illustration.jpg

PROTECTING PEOPLE?
Would people please discuss their reason, or the reason for discouraging original research on Wikipedia, Wikibooks and online in general? I have a idea, that time-sensitive material is not to be shared with other people, meaning, in fairness, we should allow people to check their original ideas before posting their ideas, dreams and use of their imaginations in public view.

Although this seems restrictive, this could be protective of creative individuals, and a better guide. I admit, I assume other people would cheer to own a virtual Wikibook copy of my / our book, sharing our passions for stories, filled with tips and guidelines. I assume Art analysis [in LANGUAGE ARTS] would be informative, and interesting, if it is about the Fiction that is popular with students, and book lovers. Many people do support deconstructive efforts in Language Arts [Language is a common means of communicating with other people. People do reconstruct language]. I also admit that careful reflection, plot consideration, and time is needed to develop good books. I started Create Vampires, because I think research can be interesting, and entertaining, as well as informative. I also think language and writing can be creative, and should be encouraged by most people who lai-ca reading. Contributions? Peyton09 (discuss • contribs) 19:09, 1 December 2020 (UTC)

Young Adults may develop better communication skills, and better writing skills in creative writing classes in High schools. If student skills do not increase, then students will probably benefit by getting introduced to books used by creative writers [A thesaurus, dictionaries...]. Although most people think encyclopedias have a high information content, other types of books do attract different students. These resources should get introduced in schools that support creative writing lessons. Peyton09 (discuss • contribs) 19:16, 1 December 2020 (UTC)

Written Entertainment?
Do people lai-ca reading entertaining stories? Did people hope to share clean entertaining books [for young people] for free? Are we the "dreamers" following the open-book textbook guides on Wikipedia, hoping to change the perspective?

I do appreciate sharing a learning experience as the reward for the time and efforts put into writing a book. I think creative people are similar, and may appreciate sharing a pleasing experience, a original prespective, or a novel idea as a reward for getting other people to listen, take time out and share the reading experience.

The original impulse for Create Vampires was to share stimulating new designs for creating vampire stories. Sharing techniques and tips would be the advantage. Learning the history and value of folklore became a important reason to communicate, and inform the public.

I thank all volunteers at Wikibooks who have contributed, and encourage more discussion! Peyton09 (discuss • contribs) 19:41, 1 December 2020 (UTC)

Post-dreamy False Reality Fiction
Hello wikibookians! I want to share this personal note from my essay "Post-Dreamy False Reality Fiction" because I am a spiritual person disturbed by current political responses. The only semi-mythological, semi-historical figure that modern readers follow, and think was sacrificed, then was risen on the third day, is Jesus of The Bible. This story, the greatest story ever told, is complicated. ...the mythological origin of the Vam-Pai-Yers, the Egyptian origin inspired by the gods in "Dancing Near The Fai-Yer / Fire" although oddly flawed, does not rival The Bible as a spiritual guide. ...I may write a longer article about "False Reality" as a popular literary genre, replacing older classifications such as "horror," "Gothic," or "post-apocalyptic" as formulaic genre guides.

title: User talk:Peyton09


text:
Wikibooks:Reading room/Administrative Assistance/Archives/2020/March

Please protect User:Killarnee
Please protect so that this page can only be created by administrators. Thanks, --Killarnee ( T•1•2 ) 17:29, 19 March 2020 (UTC)
 * Done. --Pi zero (discuss • contribs) 18:37, 19 March 2020 (UTC)


text:
High School Probability and Statistics/Events, Sample Spaces, and Probability

Introduction:
Consciously or unconsciously all of us sometimes use phrases like: ‘most likely’, ‘almost uncertain’, ‘most probably’, ‘no chance at all’, etc. If we read these carefully, we will find that all of them involve an element of uncertainty. The measure is called the theory of probability.

Experiment :
A process that results in some well-defined outcome is known as an experiment. For example:
 * 1) (i) When a coin is tossed, we shall be getting either a head or a tail i.e its outcome is a head or a tail, which is well-defined.

Random Experiment:
Random experiment means all the outcomes of the experiment are known in advance, but any specific outcome od he experiments is not known in advance. For examples:
 * 1) (i) Tossing a coin is a random experiment because there are only two possible outcomes, head or tail, and these outcomes are known well in advance. But the specific outcome of the experiment i.e whether a head or a tail is not known in advance

Sample Space:
The set of all possible outcomes of an experiment is called sample pace and is, in general, denoted by letter S For example: (i) When a coin and a dice are tossed together, the corresponding sample space for the random experiment is  as given below:

S={(H,1), (H,2), (H,3), (H,4), (H,5), (H,6),(T,1), (T,2), (T,3), (T,4), (T,5), (T,6)}.

An Event:
An outcome of a random experiment is called an event. In other words, an event is something that happens. On tossing a coin, the possible outcome is head (H) or a tail (T). Here, getting ahead or a tail is an event of the experiment.


text:
User:Onalennakatleho

Question:How are we survive the corona pandemic?

The corona pandemic didn't really do well will all the South Africans,we really had to have limited time to shopping,limited distance between our loved ones and ext... Maphosa didn't really too had nothing to do but put us on a lockdown asp,to help stop the spread of corona virus.

title: User:Onalennakatleho


text: Category:Book:Wikijunior:Entrepreneurial learning


text:
Create Vampires/Factual Basis For Vampires

Create Vampires: Factual Basis For Vampires
People have offered factual explanations for the "un-dead," probably the reasons for vampires found mostly in folklore. Folk-stories were based on people buried alive, then mistaken for un-dead creatures when they clawed and crawled their way from their premature graves. The appearance of actual people, mistaken for dead, crawling from graves, started warnings that evolved into what we call the vampire stories and folklore that influences our modern popular culture. LINK: Create Vampires/Original Fictional Creations LINK:Create_Vampires/Scientific_Evidence LINK:Create_Vampires/Scientific_Evidence_For_Vampires


text:
Talk:OpenSCAD User Manual/List Comprehensions

In the third example for "each", is the result incorrect?

A = [-2, each [1:2:5], each [6:-2:0], -1]; echo([ for (a = A) 2 * a ]); // ECHO: [-4, 2, 6, 10, 12, 8, 4, 0, -2]

Why isn't it? // ECHO: [-4, 2, 4, 10, 12, -4, 0, -2]

Because [1:2:5] is a range producing values 1, 3, 5 and [6:-2:0] gives 6, 4, 2, 0.


text:
User:Skershiv

Shiv Kumar Choudhary, a B.Tech Graduate working as Market Research Professional.

title: User:Skershiv


text:
Talk:Create Vampires/Factual Basis For Vampires

Hello All, I have a question, move the "Factual Basis For Vampires" to the section [Scientific Evidence] or keep "Factual Basis For Vampires" in both [Introduction] and [Scientific Evidence] sections what do u'all think?

Would this subject make a good book?
I think that particular topic, is more the TRUE CRIMES version of vampire tales and folklore, and I find this type of story more a warning, and much more relevant. I know that some people are frauds, so looking for "true crime" stories shouldn't be hard to find if people do research. There is a massive amount of evidence that suggests that the nature of vampirism was / is directly linked to criminal behavior, especially in Eastern Europe. Writing this type of less fictional account, based on actual events, seems difficult.


text:
Making a Programming Language From Scratch/Function Call

Function calls
Functions need to be called if they are to be of any use. There are two types of calling a function.

Non void call: A non void call is used for all functions that return a value. These functions are called and the returning value used for expressions or for logical processing.


text:
Making a Programming Language From Scratch/The Braces Problem

The big bad braces problem
One of the most fundamental problems that I faced during the creation of my language was the braces problem. Thus I devoted this chapter to this problem and it's solution.

In most modern languages block statements are terminated by the braces{}. However, multiple statements share the braces, such as if,while,else,elseif,functions,e.t.c.

Thus the problem I faced was this: How do you recognize the end brace } as belonging to which statement. Remember that in the line by line input method we will only get "}" as our line. After thinking for many days I finally came upon a solution.

Solution
We need to open the generated output file in read more. We then search for a comment of format !!? [Block statement name]

And if that statement is not terminated by ??! [Block statement name]

Then it is our required statement. Note that the required statement is the last open statement.

We close this statement by the above mentioned format and also include in the code the necessary instructions.


text:
User talk:Nelile

March 2020
— Jeff G. ツ 13:22, 10 May 2020 (UTC)

title: User talk:Nelile


text:
Oberon/ETH Oberon/hcl

Page index: [ Motherboard | Processor | RAM | Device drivers | Disk | Display | Communication | Modem | PCMCIA | Mouse | Sound | USB | Example machines ]   PC Native Oberon Hardware Compatibility List This page is under construction and will be used for installation information and user installation reports. Please send your installation reports for inclusion on this page. The information contained herein applies to the most recent Alpha / Beta versions.

Subjects treated in linked documents:
 * BIOS support
 * Diskette support
 * Keyboard support
 * Printer support
 * Sound support
 * Speaker support
 * Frequently Asked Questions on the Native Oberon OS (beta version)

You will find a good support for hardware and software considerations not directly related to Native Oberon in the Operating System resource centre documents maintained by Chris Lattner.

Motherboard and expansion slots Native Oberon runs on single processor motherboards of all brands, even on older ones, with ISA, PCI and AGP expansion slots in any combination. AGP expansion cards are similar to PCI cards from the software point-of-view. USB too is supported, but to a lesser extent. IrDA is not supported.

Oberon's PCI analyser tool

The PCI analyser command PCITools.Scan is designed to obtain all the required information on the installed PCI and AGP devices. The PCI bus is scanned and all the devices found are listed, along with a textual description extracted from an ancillary file. Some of the most valuable informations displayed are: bus number, device number, device class and subclass, vendor name and code, device name and code, IRQ assigned to the device. Keep in mind that non-PCI devices may also use IRQs and that IRQ conflicts may be at the origin of installation problems (e.g. black screen when the display device IRQ is in conflict) or other malfunctioning (e.g. network card IRQ conflict).

A full-fledged Oberon system is not required to use the tool. Booting from an Oberon-0 diskette is enough and can be of great help even to non-Oberon users. Alternatively, use the Oberon Utility Disk.

Installed hardware inspection

The needed information about the installed hardware can ideally be collected in advance of an Oberon installation with the facilities of an installed operating system. This can be useful when the manufacturer's documentation is not available or for a noname computer.

 * Windows 2000/NT: follow "Start -> Programs -> Administrative Tools -> Diagnostics"
 * Windows 95/98: follow "Start -> Settings -> Control Panel -> System"
 * Linux: view or print /var/log/boot.msg

Besides that, there exists a profusion of published and downloadable software for analyzing, diagnosing and performance testing of hardware components. E.g.

Processor Native Oberon runs on these 32-bit architecture processors
 * PC Analyser [expired] - DOS
 * Dr. Hardware - "2002" for Win9x/ME/NT/2000/XP or Sysinfo for DOS
 * Intel processors, starting from the i386, and equivalent processors offered by other manufacturers such as AMD and Cyrix. Native Oberon has been reported to work on AMD K5 and K6 series chips, Cyrix MII-333. If no coprocessor is found, the emulator module FPA.Mod will take its function over.
 * Transmeta processor TM5400 as reported by Thomas Kistler.
 * StrongARM processors based on the ARM Architecture Version 4: SA 110, SA 1110. Theoretically, it should run on Intel PCS Application Processors, but that was not tested.

For more information, see ETH Oberon Compilers. RAM Native Oberon supports maximally 128MB, because of the way page tables are allocated in low memory. This could be improved in procedure Kernel.InitMemory. If more than 128 MB are installed, only the first 128MB are used. Device drivers Device drivers must be installed for the various device categories reviewed in this document. Depending on the device's importance, a driver installation may have to take place immediately at system start or may be delayed to a later time:
 * A disk driver (ATA/EIDE or SCSI), located on the boot device, is installed straight from the start by the boot loader.
 * At system start, a VGA driver is installed which is soon replaced by a display driver specified in the Display= and associated configuration strings. Other strings may command the installation of further drivers.
 * At a later time, a driver module is dynamically loaded when needed, just like any other Oberon module, by executing an appropriate Oberon command. The installation command depends on the controller. A driver is immediately operational: no reboot is needed. To automate the installation, it suffices to edit a line containing the appropriate installation command in the System.InitCommands group of Oberon.Text. Commenting out the line is enough to bar the installation.

Drivers dynamically loaded on demand remain in memory during the entire session. Consequently, a driver must not be uninstalled, in principle. Exceptionally, say for test purposes, a driver may have to be unloaded (the modules importing it must be unloaded first). Disk Cfr. Disk support

(1): one problem reported, card hangs while booting (as soon as interrupts are switched on, scsi selection time-out interrupts are raised, and the interrupt cannot be cleared or is set again by the card)

The documentation for programming the 53C8xx chip is found at http://www.lsilogic.com/techlib/ [expired].

Example: The add-on ASUS PCI-SC200 SCSI controller is based on the NCR/Symbios 53C810 chip. Display Cfr. Display support

VESA and PCITools.Scan information contains detailed information on the video modes of some of the video subsystems listed below.

Communication The drivers are listed with the name they are given in Oberon.Text, which is edited from the [Configure] button in System3.Tool.

Modem Only modems with a serial (V24/RS232) port interface are supported. Modems of the type "WinModem" have a proprietary interface to the operating system driver. Normally, they work only with Windows.

The safest is to buy an external modem with a serial interface, that understands the "AT" command set. Spending a bit more for a good modem (e.g. a 3COM US Robotics) is also worth it, because you will get better connections. PCMCIA No support yet. Mouse Cfr. Mouse support

Examples of mice known to work (Mouse type is described in "Mouse support"): Sound Cfr. Sound support USB Cfr. USB support

Chip sets compatible with the Universal Host Controller Interface (UHCI) 1.1 are supported, e.g. VIA's T83C572. OHCI is being investigated. Examples of machines known to work with Oberon The alpha version is working on:

[Top]

''4 Aug 2002 - Copyright © 2002 ETH Zürich. All rights reserved.''

E-Mail: oberon-web at inf.ethz.ch

Homepage: http://www.ethoberon.ethz.ch

title: Oberon/ETH Oberon/hcl


text:
ORCL/Eye tracking

The source code can be found at https://github.com/XiangGuo1992/ORCL_VR_EyeTracking.

The Tobii Eye Tracking is integrated in HTC VIVE Eye Pro in Unity, Which is a part of projects from Omni-Reality and Cognition Lab in University of Virginia (https://engineering.virginia.edu/omni-reality-and-cognition-lab).

There are several Prerequisite for using these code:

1. [HTC VIVE Eye Pro](https://www.vive.com/us/product/vive-pro/) with Tobii Eye Tracking system

2. [Unity](https://unity.com/) version 2018.4.16 or 2018.3.14

3. [Python](https://www.python.org/) 3.6.3 ([Anaconda](https://www.anaconda.com/) version recommended)

4. [SteamVR](https://store.steampowered.com/steamvr)

5. Finish the [Set up for the HTC VIVE Eye Pro](https://enterprise.vive.com/eu/setup/vive-pro/)

6. [Tobii Pro SDK](http://developer.tobiipro.com/index.html) for your platform

The HTC VIVE Eye Pro hardware (headset, controller) is from HTC VIVE, the integrated eye tracker is from Tobii, they have provided multiple ways to get access to the eye tracking data:

- [Tobii Pro SDK](http://developer.tobiipro.com/index.html): A general SDK for getting eye tracking data. This repository will use Python and Unity only.

- [Tobii XR SDK](https://vr.tobii.com/sdk/develop/unity/): SDK for Unity, developed by Tobii too, to get started, follow the steps in this [link](https://vr.tobii.com/sdk/develop/unity/getting-started/vive-pro-eye/). Tobii XR requires a analytical license to get the raw data, otherwise, eye tracking can only be used for interactive use.

- [Vive Eye Tracking SDK](https://developer.vive.com/resources/knowledgebase/vive-sranipal-sdk/) : SDK for eye tracking from HTC. The forum for it can be found [here](https://forum.vive.com/forum/78-vive-eye-tracking-sdk/).

This repository includes sample code and tutorials for Python and Unity API of Tobii Pro SDK only.

title: ORCL/Eye tracking


text:
Gothic/3/Adjectives

Gothic Adjectives
Gothic adjectives can be declined as strong or weak. They are declined according to gender, number, and case. As a rule of thumb, the strong forms are used without a demonstrative pronoun, and the weak forms are used with a demonstrative pronoun. However, certain adjectives are always declined in the weak forms or the strong forms.

Gothic strong adjectives take many of their endings from the declension of pronouns.

braid daur jah rums wigs (Mt 7:13)

"broad (is) is the door and roomy the way".

Weak adjectives take the endings of -n stem nouns, regardless of the underlying stem class of the adjective. Their primary use in Gothic is appositional. The following contrast is most informative:

ik im hairdeis gods

"I am shepherd good"

hairdeis sa goda saiwala seina lagjiþ. (Jn 10:11)

"the shepherd, the good, lays down his soul.

Weak adjectives also accompany a noun in the vocative:

atta weiha (Jn 17:11)

"holy father"

Strong a-stem Adjectives
A-stems are subdivided into pure a-stems, ja-stems, and wa-stems. The endings of a-stem adjectives reflect the endings of a-stem nouns. Wa-stem adjectives decline just like pure a-stems. The adjectives blinds (blind) will serve as a model.

Ja-stems
Ja-stem adjectives are subdivided into two classes like the corresponding declension of nouns: ja-stems with a short syllable and ja-stems with a long syllable.

Ja-stems With a Short Syllable
The adjective midjis (middle) will serve as a model.

Ja-stems With a Long Syllable
This declension is built out of long-stemmed -ja masculine and neuter nouns and long-stemmed -jō feminine nouns. The adjective wilþeis (wild) will serve as a model.

This declension is built out of long-stemmed -ja masculine and neuter nouns and long-stemmed -jō feminine nouns.

Strong i-stem Adjectives
Adjectives of this class have replaced most forms with forms taken from the -ja declension. The adjective hrains (clean) will serve as a model.

U-stem Adjectives
The u-stem adjectives decline like their corresponding noun declension. The genitive and dative of all genders are wanting. The adjective hardus (hard) will serve as a model.

Weak Declension of Adjectives
The weak declension of adjectives agrees exactly with the three nouns hana (cock), hairto (heart), and tuggo (tongue). All adjectives have the same endings, regardless of the underlying stem class of the adjective. The only difference is that ja-stems, i-stems and u-stems have a -j- at the end of the stem.

title: Gothic/3/Adjectives


text:
User:Garnetskull

See my user page on Wiktionary

title: User:Garnetskull


text:
Talk:Mathematica

Roadmap?
Was there a roadmap for this book? What direction to go into and such. These days we already have version 12.1, however the last edit seems to be from 2018. Ytrog (discuss • contribs) 07:27, 11 May 2020 (UTC)

title: Talk:Mathematica


text: User:Thanavathi C

title: User:Thanavathi C


text:
User Manual for OpenClinica

Securing OpenClinca
Installing, configuring and securing the OpenClinica [OC] Community Edition [CE] is definitely an adventure and requires knowledge in a variety of aspects of computer science. With extensive googling and dedication, however, it can be done by anyone who has some affinity working with Linux. I am no computer scientist by trade, but nevertheless took on the path of deploying OC on a webserver and, in the end, managed to get it running successfully. There were points though, where I wished there was an extensive guide on how to manage with the process. With this post I would like to fill this gap, at least with the security aspect of OC, to give a helping hand to anyone attempting the same task.

The list of measures I took are what I could find from numerous sources and I cannot claim responsibility that they are exhaustive of everything that can be/should be done when securing OC. As I mentioned already, I am not an expert in the field, this guide is merely a result of a lot of searching and trial-and-error. Take everything you see here with a grain of salt, and, if you feel you know better, don't hesitate to change aspects of it. Please also feel free to suggest improvements/additions to this process so we can all benefit from this collective knowledge.

I took security as seriously as possible as the software required by the CE of OC is long out-of-date as of 2020, therefore doing everything possible to make it secure is of great importance, especially when working with patient data.

My setup-of-choice was the following:

 * OpenClinica CE 3.15
 * CentOS 8
 * PostgreSQL 8.4.22
 * Tomcat 7.0.52
 * JVM 1.7.0

I followed this installation guide as I could not find one for v3.15. Getting some of the specific software version listed above was quite a challenge and if I had to restart I would consider going with CentOS 6 instead, as this version is natively supporting some of these older dependencies. CentOS 6 is also out of support as of this year, therefore consider carefully when opting in for it.

As per instructed by the above mentioned guide, the root folder to all the components required to run OC is at: /usr/local

Without further adue, here we go:

SSH
First and foremost accessing the webserver (if it is a remote one) should be secured. There are hundreds of attempts made each day to log-in to webservers using common usernames, therefore this really should be your first line of security.

Modifying the sshd_config file
This file can be found under `/etc/ssh/sshd_config` and controls ssh access to your server. Before making any changes to it, make sure you that you have it backed up. In the file, modify the following parameters:

Only allow the usernames which will need to have access to your server
 * AllowUsers

Disable root logins
 * PermitRootLogin no

 * ChallengeResponseAuthentication no

After copying your ssh key to the server (with ssh-copy-id or manually, by copying your public key and pasting it in the `~/.ssh/authorized_keys` file on your server) you should disable password authentication. This way signing in is only possible by ssh key authentication.
 * PasswordAuthentication no

For added security, UsePAM can be also set to `no`, however, this messed with my ssh authentication process and had to set it back to `yes`.

After everything is configured restart the sshd service:

fail2ban
This package provides added SSH security by banning IPs which failed ssh authentication x number of times. Here is a great guide to configuring fail2ban.

Installation
Under `/etc/fail2ban` create a file named `jail.local` and paste the following in (use your own e-mail address):

Creating this file instead of configuring directly in `jail.conf` is preferred as a fail2ban update would override your configuration otherwise. Now you will receive e-mail notifications when an IP was banned after 5 failed log-in attempts or when fail2ban was stopped/started.

Restart the fail2ban service:

If you would like to receive additional information of the banned IP-s, you can install the `whoami.x86_64` package.

You can check the sshd jail status by:

Passwords
While it might sound obvious, it is nevertheless vital to maintain strong and unique passwords on your server. I recommend using KeePass to keep track of them as it also allows you to auto-generate seriously strong passes.

Tomcat
Securing Tomcat is just as vital as securing your webserver, as this is your point of contact with the outside world. I gathered the below listed security measures from the following sites

Access control
This is to make sure that even if an attacker can get hold of the webserver, there is only minimum damage she can do. First and foremost never run your webserver as the root user, create a new user called `tomcat` which has the minimum necessary privileges to run the server.

Make the folder `tomcat` and all its contents owned by the user tomcat and group tomcat:

(without the -R flag you only change the ownership of the folder, but not the contents)

Give the owner of the folder read write and execute permissions:

(Guide on using chmod: https://www.lifewire.com/uses-of-command-chmod-2201064) Word of caution: to be able to open a folder you need to have execute permission on it. I learned it the hard way as well.

Remove write and execute permissions from the configuration folder. This prevents an attacker to modify the configuration files of Tomcat:

However, Tomcat needs to be able to open the folder, therefore add execute permission TO THE FOLDER ONLY (=without the -R flag):

Remove read permission from the openclinica.config and openclinica-ws.config (if installed) folders:

Remove read permission from the logs folder:

Remove all permissions from the oldwebapps folder, as during deployment Tomcat will not have to do anything with these:

Set the `datainfo.properties` file to read-only (do the same of OpenClinica-ws if installed):

With this you are done with the access control aspect of Tomcat.

One additional thing you can do is to add your user to the tomcat group and grant read write execute privileges to group for the usr/local/tomcat folder. This way you can still conveniently edit everything without having to use root/sudo. I am really unsure about the security aspect of it and use it at your own risk. And do not forget to remove yourself from the group and remove the privileges once everything is configured.

HTTPS
As referenced above already, Tomcat's guide on setting up SSL should be the first step you do (https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html). You will have to make sure that all the steps laid out in this guide are done using the user `tomcat`, as if it is done otherwise, the .keystore file will be created under that other user's home directory and tomcat won't be able to find and read it. Theoretically you could also probably comment out the HTTP connector as enforcing using HTTPS for OC is good practice. Port forwarding will be enabled on a firewall level, therefore in theory Tomcat should never receive a request to port 8080, but I haven't tested this in action yet.

After this is configured you should be able to use HTTPS to communicate with your webserver (on https://localhost:8443/OpenClinica). If you are using a self-signed certificate your browser will complain, but you can nevertheless access the site. You can enforce using HTTPS within Tomcat, by adding the following at the end of your web.xml file under `tomcat/conf` (before the  tag):

Cookies, Custom Error Pages, Disabling listings ..
These are good to have practices, but not must haves. These include hiding server version from error pages or disabling file system listings to better protect you from DDoS attacks.

All of the following will need to be added to the `web.xml` file.

Secure and HTTP only cookies to prevent XSS attacks
(paste before the  tag)

Custom Error pages
(paste before the  tag) (No error page will be displayed as Tomcat won't be able to locate the error page file, but it does get the job done by hiding the version number. If this is an issue for you skip this step.)

Read-only resources and no listings
(paste within the DefaultServlet part of the file)

Removing server banner
If you add the parameter `Server=" "` to the parameter-list of a connector, this hides the version number in HTTP headers. It should look something like this:

Changing shutdown command
To prevent attackers from being able to shut-down your server you should consider changing the shutdown port as well as the shutdown command. This you can do in the beginning of your server.xml file within the  tag:

AJP connector
If OC is the only webapp that will be deployed in Tomcat, you can safely comment out the AJP connector line, as OC is not using this connector.

Disabling autodeployment
To prevent someone from auto-deploying their own, malicious, webapps in your Tomcat instance, you can turn auto-deployment off within the server.xml file by setting the following parameters to false within the  tag.

This way if you restart your server you manually have to deploy OC, which you will have to figure out how to do.

Secure container
With tomcat you have the option to start your instance in a container which ensures that if anyone compromises the server, even in the worst-case scenario, they can only access resources and files within this container. It is, however, something you will have to spend time on to make work for OC, as it is known to (and have, for me) break an installation. It is probably worthwhile to do if you have the time and knowledge to make it work.

The usage is otherwise really simple, when starting the webserver add the -secure flag:

That's it for Tomcat.

PostgreSQL
There is not a lot you can configure for PostgreSQL in terms of security, but a little bit of access control can be done here as well.

Change the ownership of the pgsql folder:

Change priviliges:

You also should be carefully configuring the pg_hba.conf file at `/usr/local/pgsql/data/`. This file controls the different access rights to your database. You need to give access to the openclinica database for the clinica user connecting locally, but block all other connection attempts. The authentication method should be set to `md5`, never used `password` as it sends these in clear text form. If you will be accessing the database directly from remote machines you will have to add the appropriate line here for that.

This configuration is also important for the automated backups, which will be described below.

Note: if you changed the content of this file you need to restart your postgres server in order for the changes to take effect.

Firewall
Setting up a firewall is a must for any webserver. This allows you to limit and monitor all traffic happening between your server and the outside world. The main goal here is to leave only those ports open which are necessary for your webapp to function. In this case it means:

 * port 80/tcp, where incoming http traffic is expected,
 * port 443/tcp, where incoming https traffic is expected,
 * port 22/tcp, where ssh traffic is taking place.

You will might have to do some trial-and-error to see if closing a certain port breaks anything, but for me allowing only these 3 open did the trick.

FirewallD
If you already are comfortable using FirewallD, you can skip to the next section (Setting up FirewallD).

CentOS comes with FirewallD preinstalled which is a powerful tool to manage these connections. There are plenty of resources online to learn more about it, such as this.

(Update: one phenomenon described in this article is outdated. Packets which could not be handled by their assigned zone are not "kicked-up" to the next zone (the notion of "zone-drifting"). It is considered insecure and will be removed in future releases of FirewallD. If you really would like to have this behaviour you can enable zone drifting in FirewallD-s config file)

First make sure that firewalld is installed and enabled on your system. The default zone enabled is `Public` which you can keep this way for our purposes. You can check which services are enabled by default in this zone:

Services are not some special entities, they are merely representing the ports the given service needs open to be able to function. These are defined under `/usr/lib/firewalld/services` as self-explanatory xml files. If you would like to define your own services, you can do this by copying one of these xml files to `/etc/firewalld/services` and customising it to your own needs. You can add any service to your firewall zone by:

And you can remove any unnecessary services by:

You can also add/remove directly the ports you need:

Without the permanent flag the changes will be reset once FirewallD is reloaded or restarted. You can experiment with rules without the flag and once you found out what works for you, you can finalise these rules by adding the --permanent flag.

Setting up FirewallD
The below configuration assumes that you are using ssh to access your remote server, however, if this is not the case, you can skip setting up an internal zone.

There will be three zones set up for the firewall: public, internal and trusted. The public should handle all http/s requests from any requesting IP address. The internal zone should have a source added with either your IP or MAC address, therefore (in theory) only when your machine is communicating with the server should this zone handle the data transfer. This is also the zone with the ssh service enabled (=having port 22 open).

Before you start with the configuration of FirewallD you should make sure that iptables is disabled and stop it from ever starting by masking it. Otherwise it might interfere with FirewallD and lead to some odd behaviour.

First start by removing any unnecessary services from the public and internal zones. Use the --list-all flag to see what is allowed at the moment. You should only leave (or add, if necessary) http/https there. In the internal zone also add the ssh service.

You should assign your outward facing network interface to the public zone (so all request arriving from outside will be handled by this zone). You can list all the available interfaces by:

You can add an interface by using the  flag.

Unfortunately the naming of these interfaces is non-trivial (at least for me, mine is called `ens192`) so you'll might have to do some research to see what's what.

You should also add your own IP/MAC to the sources of the internal zone, so only request coming from this IP/MAC address will be handled by this zone, e.g.:

You can also make this IP more general if you want ssh to be available e.g. from a certain VPN:

Which will allow anyone from 154.112.0.0-154.112.255.255 to use ssh. (Note that zones are only active if there is at least 1 interface or source assigned to them!)

The target of the zone public should be set to DROP, which returns no message upon a request arriving to an invalid port, instead of transmitting a reject message. This is considered more secure.

Next, create port-forwarding rules to limit communication to https as well as to accommodate to Tomcat's port conventions (it uses 8080 instead of 80 and 8443 instead of 443):

For port-forwarding to work you need to also enable masquerading (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-port_forwarding):

Now this step is something I am less sure about as I could not find a lot of info about it. I assigned the lo (loopback) interface to the trusted zone. This is the interface for communicating with your webserver from the same machine (localhost, 127.0.0.1). Ideally this is inaccessible from the outside world, therefore I assumed that the trusted zone is appropriate for it, but again, I might be wrong here.

If you need pinging to work, run this (replace zone by the zone in which you need pinging to work):

You have to reload firewalld for the changes to take effect:

Now you have FirewallD configured to only allow http/s communication with the outside world, but still allow ssh connections from your personal machine / your VPN network.

You can test your firewall using the nmap package to see which ports are open.

OpenClinica
You have done most of what you can do to make OC secure already, but there are a few things you can still do within OC itself. If you sign in as root to the web interface, navigate to `Tasks/Administartion/Users/Configure Password Requirements`, there will be a few options which you can turn on/off and tweak to suit your needs. You should also definitely enable user lockout after x number of tries (`Tasks/Administartion/Users/Lockout`). As root you can unlock these accounts on the web interface if they get locked. Another measure I myself took, but unsure if it is a necessity: asked the users of my OpenClinica instance to set their password challenge question to a long (unguessable) string. This I did, as I am unsure how OC sends out the password reset e-mail and if this e-mail could be hijacked by a potential attacker. A much safer (although admittedly more inconvenient, even impractical if you have too many users) solution is to, as root, reset their password from the web interface and send them yourself.

Backups
This also really should be a must. The solution I share here is just one way of doing it, if you know better, don't hesitate to do it your way.

Here is a guide is a guide on how backups should be implemented in OC. Basically you want to periodically save your OC configuration file, your study directory ($TOMCAT_ROOT/openclinica.data) and your PostgreSQL database.

I have attached a script which, if executed, should backup all of these, wrap them up in a tarball file and save it to `/usr/local/OpenClinica_backups`. You can (and should) change the backup location to be outside of your server by editing the BCKP_path variable in the script. Additionally you will have to create a .pgpass file for it to work, more details below.

My addition to the above linked guide is to make these backups happen automatically, e.g. on a daily basis. For this I used the `cron` service, which comes preinstalled on CentOS 8.

To make your script execute daily, place it under `/etc/cron.daily/`. Normally, to be able to get a pg_dump you would need the password for your openclinica database. To allow automatic updates you need to create the .pgpass file under `/var/lib/pgsql/`. The content of it should be as follows:

For Postgres to be able to use this file it HAS to be owned by postgres:

and the permissions on it HAVE to be set to 0600:

Should you have any problems with authentication, see the documentation of pgpass.

To be able to create the pg_dump, postgres needs to be able to write into your backup folder. Change the group of the folder to be postgres and give group rwx permissions:

Restoring the postgres database from a backup
The backup created by pg_dump is actually a long list of SQL commands that, when executed recreate the backed-up database. You can either create a new (empty) database to restore your back-up to, or drop the openclinica database and recreate it as an empty one. Note: if you choose to create a new database, you might run into permission issues because of the way the pg_hba.conf (in /usr/local/pgsql/data/) file was set up (see above). For you to be able to access the newly created database, you need to add a line which gives access to a specific user to a specific database, e.g.:

To create the new empty database, you need to connect to the Postgres database by:

Create a new empty database to which you will restore your backup:

Then you need to execute the SQL commands stored in the backup dump file by:

One Last Crumble
Just to make a clear job, it's a good idea to disable logins for the tomcat, clinica and postgres users:

That's it
Well done, you just made your OpenClinica installation a lot more secure! Unfortunately, you have to keep in mind that the software we have been hardening is outdated software (very outdated), so you can only do so much and hope for the best. The best advise I can give is to, if possible, do not include information of your subject which allows the identification of them. This way, even if everything fails, at least your subjects do not have to worry over personal identity thefts.

title: User Manual for OpenClinica