COMMUNITY Brave GNU World The Monthly GNU Column BRAVE GNU WORLD This column looks into projects and current affairs in the world of free software. This month we focus on better security with Firestarter, a tool that helps you set up a firewall. We also look at a distributed computing project for animation or visualization. BY GEORG C. F. GREVE irewalls are more important now allows users to complete a basic configu- attempts as events, giving you details on than ever, so a free tool that helps ration with the focus on distributed the origin, service, and time (Figure 2). Fusers manage their firewalls is Internet connections for multiple com- You can click to add a filtering rule to always welcome. puters using dynamic IP address assign- allow a service or a host – or to allow ments. exactly this service from exactly this Firewalls The default packet filter settings allow computer. Simple management is one of A firewall operates at the network con- any outgoing connections and deny any Firestarter’s strongest points. Instead of nection level, analyzing, monitoring, external packets that attempt to access wading through tables of port numbers and controlling the traffic that enters or the computer, with the exception of to discover the services assigned to leaves a computer. On Linux with kernel packets that belong to existing connec- them, users can simple check the Event 2.4 or later, this is the domain of ipta- tions. Firestarter has three tabs called tab to allow access. And the Policy bles. Network traffic is represented by IP Status, Events, and Policy for normal allows you to remove any unwanted data packets, and the kernel specifies operations. The Status tab in Figure 1 rules. what should happen to specific types of not only shows you the current firewall packets. Firewalls of status, but also gives you Priorities this type are known information on current Firestarter also supports ICMP packet fil- as packet filters. connections, including tering. ICMP was originally designed for Firestarter [5] is a the applications and ser- network diagnostics, but it is often mis- graphical firewall vices responsible for used for Denial-of-Service attacks. Addi- administration pro- those connections. It is tionally, the Type of Service feature gram by Tomas Jun- also possible to modify allows you to prioritize services and thus nonen. The program settings made using the optimize network traffic for throughput, aims to make the job wizard and to enable or reliability, or interactivity. One of of setting up a Linux disable the firewall. Firestarter’s neatest features is that it firewall more simple, Firestarter also has a sin- displays the firewall status in the panel convenient, and gle-click detach feature and alerts you to specific events. transparent. that prevents any commu- Tomas started work on Firestarter When a user first nication with the outside. back in 2000 while he was waiting for a launches the pro- place at the university after completing gram, a firewall wiz- Access national service. At the time, he noted ard takes the user Figure 1: Firestarter displaying an Monitoring that none of the available programs did through an initial overview of the current firewall The Event tab displays exactly what he wanted it to do. In other setup. The wizard status. blocked connection words, Firestarter, like many other pro- 94 ISSUE 52 MARCH 2005 WWW.LINUX-MAGAZINE.COM Brave GNU World COMMUNITY grams, started life with the famous dependencies between tasks. hacker mantra: “That can’t be too diffi- Additionally, the program groups cult.” slaves in pools and allows granu- Firestarter is a free, GPLed application lar control of the number of CPUs that was written in C using the GTK+ assigned to a job. DrQueue also toolkit. As the program was recently assigns processing work based on added to the Gnome CVS tree, the pro- the operating system, the system ject’s translation team has added local- load, and several additional para- ized versions, and errors are handled by meters. the Gnome bugtracker. The master program maintains One of the issues the team faced was Figure 3: Dr Queue controls CPU capacity for ren- status information concerning the small but important differences dering individual images within a digital animation. crashes or system resets, allowing between distributions. However, a team The GUI gives users an overview of the network processing to pick up from where of volunteers, including Netfilter guru nodes. it left off after an interruption. Paul Drain, brought the project to matu- Users can access these parameters rity, seeing the release of version 1.0 in Blender [7] and Pixie [8]. You can add via the GUI while processing is in November 2004, and providing binary more rendering tools provided they have progress and tell the program to packages for a number of distributions. a default profile that matches DrQueue’s reprocess individual frames, remove For Tomas, Firestarter’s major strengths requirements. A simple shell script han- computers from the pool, or add com- are its ease of use and good supporting dles task distribution. puters to the pool. documentation – although he admits As the current version already has all that, like many other free projects, Easily Ported the features that Jorge Daza planned for Firestarter could benefit from more pro- The program itself was mainly written in version 1.0, there is nothing to prevent fessional graphics. C, with a few lines of C++ and TCSH the release from going ahead. However, Firestarter really does take the fear for scripting thrown in for good mea- Jorge is looking to improve usability and factor out of iptables configuration for sure. DrQueue uses Scons [9] to support the help feature. The author also intends normal users, although it does not cur- configuration and compilation, and this to simplify the install and add binary rently support the full range of firewall means you can run the program on packages for major distributions. configurations and may not cover some Linux, FreeBSD, Irix, and Mac OS X. complex scenarios. The resource manager has three major Documentation elements known as the master, slave, Documentation is a major prerequisite to Distributed Processing and drqman. The master assumes the usability. Unfortunately, the existing Let’s move on now to part two of this server role, handling task distribution documentation is incomplete and not up month’s column and look at distributed and coordinating the results, whereas to date. Jorge would appreciate your processing, more specifically, at the ren- the slave runs on the individual nodes to feedback. If you are interested and have dering manager DrQueue [6]. The pro- handle processing as stipulated by the the required technical skills, please gram’s author, Jorge Daza, first released master program. drqman provides a con- check out the project and help where this GPLed tool about a year ago. venient GUI for users based on the you can. ■ DrQueue distributes the task of render- GTK+ toolkit. ing multiple individual images or anima- INFO tions over a pool of computers. Central Data Repository [1] Send ideas, comments, and questions The interesting thing is that the com- The program collects results and logfiles to Brave GNU World: puters can use different rendering tools. on a Network File System (NFS) export, [email protected] DrQueue supports both proprietary pro- which is mounted by all the computers [2] GNU project homepage: grams such as Maya, Mental Ray, and in the group. As NFS is a fairly ancient http://www.gnu.org/ Blue Moon Rendering Tools (BMRT), protocol that does not provide a lot in [3] Georg’s Brave GNU World homepage: and free software applications such as the line of security or cryptography, and http://brave-gnu-world.org as the queue manager does not add [4] “We run GNU” initiative: these capabilities, it makes sense to iso- http://www.gnu.org/brave-gnu-world/ late this kind of setup from the rest of rungnu/rungnu.en.html your network or hide it behind a [5] Firestarter homepage: securely configured firewall. It might http://www.fs-security.com also be a good idea to make sure the [6] DrQueue homepage: http://www.drqueue.org computers involved can only exchange data within the group; the Firestarter [7] Blender homepage: http://www.blender.org tool we just looked at would be the ideal [8] Pixie homepage: http://pixie.sf.net tool to handle this. [9] Scons homepage: Figure 2: The overview has an entry with the One of DrQueue’s major strengths is http://www.scons.org/ connection details for each denied packet. its ability to priorize tasks and specify WWW.LINUX-MAGAZINE.COM ISSUE 52 MARCH 2005 95.