US Airports KML file updated. That's 13,632 airports.

There are 13,632 airports in the FAA database. That does not count balloonports, seaplane bases, gliderports, heliports, or ultralight facilities. That's also a huge number of placemarks for a KML file, so your Google Earth machine will need some processing power.

If you pan out, the placemark icons will cover the continental United States. It also drives home the point that if you're flying high enough and your engine dies, you should be able to glide to an airport.

Improvements: Public airports are in blue; private airports are in red. AWOS data is included where applicable. (If airports have an AWOS, it's included. Note that ATIS is not the same as AWOS.)

Code improvements: All output code is Python. The database is still Microsoft SQL, and the API is adodb for Python. Next: Porting output code to Linux (need a new database connection) and keeping back end MS SQL for now. Long-term: cleaning up and uploading data via python into MySQL.

Random Comments on Python: String manipulation in python is the same as in visual basic script, but different. If statements have no end, just an indent and and end of indent.

The KML file is in the KML archive, as usual. DO NOT USE FOR NAVIGATION.

New KML File: Radiological Air Samples from the US DOE/NNSA Response to the 2011 Fukushima Incident

The US Government makes available many data sets free. This is in contrast to the UK where public government data is the property of the crown and is sold to the public. US citizens still pay for the data in taxes.

One of those data sets is Radiological Air Samples from the US DOE/NNSA Response to the 2011 Fukushima Incident. You can see more free data sets on the Data.Gov web site.

Since the set included latitude and longitude, I created a KML file. I have no idea exactly how dangerous those levels of radiation are, but it's still interesting to see what was found and where they sampled.

Tide Prediction Locations in Google Earth and Google Maps

I love xtide, the Unix tide prediction server. I have it serving web pages and serving a telephone dial-in number in Asterisk for the beach I visit. I finally got around to writing the KML file that links placemarks to the URL for my copy of the Xtide web server. Click on the placemark to see the URL for the location's tide prediction page.

Also, you can now view KML files in Google Maps by typing in the URL to the KML file in the search bar. You'll end up with a URL in Google Maps that looks like this: http://www.google.com/maps?q=http%3A%2F%2Fcw.sampas.net%2Fkml%2Fxtide.kml&hl=en&ll=37.439974%2C-131.660156&spn=101.116429%2C158.027344&sll=37.0625%2C-95.677068&sspn=54.357317%2C79.013672&vpsrc=6&t=h&z=3&source=gplus-ogsb .

The xtide.kml file is in the usual place.

Military Training Routes KML: Is this really what they look like?

This entry is obsolete. For the latest MTR KML, go here.

I used the same math from previous kml files to create a US master list of Military Training Routes. VFR routes are in green, and IFR routes are in red. Some segments overlap. Overall, they just look weird, so I'm wondering if its at all accurate. (Note: DO NOT USE FOR NAVIGATION.) Placemarks are waypoints that are along the route lines. Line descriptions contain route descriptions, while placemarks contain point lead-in and depart information. I don't think kml has a good way of displaying lines and points as the same object with different descriptions.... but what do I know about KML anyway?

See the KML in the KML Archive. The sheer number of lines and placemarks may use up all your memory.

Special Use Airspace KML: Boy was my KML invalid!

I have updated my KML output script so that the KML it outputs is valid, thanks to the KML Validator. The latest version of Google Earth is not nearly so tolerant of poorly written KML, which I only recently noticed when I tried to open my KML files that had worked just fine previously.

The main problems were my coordinate lists, where instead of delimiting by a space between tuples, I had delimited with a newline. I also did not close the coordinate sets with the first coordinate. The FAA doesn't either, because it's obvious. You draw a line from the last coordinate to the first. After the loop, I do a recordset.movefirst and write the first coordinate pair AGAIN.

Anyhow, you can see the new file in the KML archive. I may get around to doing more than just the SUA files. I'm also considering migrating the entire codebase to Python for portability. And because all the cool kids are writing in Python, and I can't stay in vbscript forever...

This KML file contains the FAA's special use types of airspace: alert areas, military operations areas, prohibited areas, restricted areas, and warning areas.

Snom, pfSense, OpenVPN, and Asterisk: Cheaper than Cisco

VOIP and SIP have made calling cheaper than ever, but security is only just catching up. The idea of a secure, transportable (hard) phone has been around for a while. Just look at the STU-III or the KY-3. Cisco is moving away from the phone proxy on its ASA devices and towards an IPSec client in the phone with its associated licensing. Snom, OpenVPN, and Asterisk can do the same for less. The Snom 370, 800-series, and 7x0 series phones have the OpenVPN client in the firmware.

Asterisk's built-in encryption is only just starting to work in 1.8, and it would require you to open ports to your Asterisk server from the Internet. Enter OpenVPN, an open-source user-space VPN that's lighter weight than IPSec. Better yet, no per-client licensing fees like Cisco. (Unless you want commercially supported OpenVPN @ $10/client.) Asterisk itself isn't quite ready for the enterprise, but we're all hoping Asterisk 10 is ready for prime time.

Using the built-in OpenVPN server in pfSense 2.0, you can connect your Snom phone across the internet to your internal network, and Asterisk securely. (Although it does not do end-to-end encryption, even if you run OpenVPN on your Asterisk server.)

Part 1: pfSense OpenVPN config


In the pfSense OpenVPN server page, choose the following parameters: (DISCLAIMER: this is certainly not the only way to do this, nor the most secure.) I'm also going to assume you've already used the pfSense Cert Manager to create a CA and issue a client certificate for the your Snom phone.

OpenVPN | Server

General
Disabled: Not checked.
Server Mode: Remote Access (SSL/TLS).
Protocol: UDP
Device Mode: tun
Interface: WAN
Local Port: 1194 (default)
Description: SnomPhoneVPN

Crypto Settings:
TLS Authentication: Checked (pfSense should populate the box with an OpenVPN Static Key.)
Peer Certificate Authority: InternalCA (What you set up in pfSense's CA Page.)
Peer Certificate Revocation List: (leave default for now.)
Server Certificate: OpenVPNServer (CA: InternalCA)
DH Params Length: 1024
Encryption Algorithm: AES-256-CBC (256-bit)
Hardware Crypto: No Hardware Crypto (Unless you've got a card...)

Tunnel Settings:
Tunnel Network: Choose a private IP space that's not 192.168.x.x, so it doesn't conflict with every NAT home network. (10.1.0.0/24) should work most places.
Redirect gateway: Checked if you want it to be more secure, but you'll lose local access to the phone.
Local Network: Enter yor local LAN IP space here, e.g. the one you Asterisk server is on.
Concurrent connections: 1 or more.
Compression: unchecked.
Inter-client Communications: not checked.
Duplicate connections: leave this checked for testing only.

Client Settings: The only one that needs to be checked is "Provide a virtual adapater IP addresss to clients."

Advanced: Nothing is required here.

Part 2: Client OpenVPN config

Use the OpenVPN client export utility (0.9.6). Export the Configuration Archive. Unzip the files. Rename the x.ovpn file to vpn.cnf and edit it to add /openvpn/ in front of the cert and key file names. Then place it in a dir/folder called openvpn and tar it from within the folder, per SNOM.

Keep in mind that the two other files in there, the personal certificate (x-.p12) and the OpenVPN TLS key (x-tls.key) are the keys to your network, so protect them. (If your certificate file is compromised, you'll need to create a certificate revocation list pronto.) When we selected Remote Access (SSL/TLS) in step one, that means certificate only, and then added the TLS key. So no username and password required. (You can try adding them, but you'll need to hard-code them in another file in the config tarball, so it won't make much difference.)

vpn.cnf after editing:
#----------
dev tun
persist-tun
persist-key
proto udp
cipher AES-256-CBC
tls-client
client
resolv-retry infinite
remote x.x.x.x 1194
tls-remote OpenVPNServer
pkcs12 /openvpn/pfsense-udp-1194.p12
tls-auth /openvpn/pfsense-udp-1194-tls.key 1
#----------
where x.x.x.x is your WAN IP Address, or preferably, your dynamically updated DNS name if your IP is subject to change.

There should be three files for you to place in the tarball: vpn.cnf, the .p12 certificate (with key), and the xtls.key. Once you have the tarball, follow SNOM's instructions to get it onto the phone. (Hint: you'll need to place it on a webserver, but preferably not one that's publicly available or unauthenticated.)


Gotchas:

1. This client config leaves you vulnerable to man-in-the-middle attacks where someone says they're your server. I'm still working on server authentication that works with the pfsense openvpn config.


2. The phone's NTP server needs to be available on whatever network you plug in to.


3. You need to follow Snom's instructions on how to create the tar file, which may be different than what you're used to.


4. You need netcat running to see OpenVPN logs. They don't go to the phone's syslog server.


5. If you blow up your Snom phone (can't connect to it any more), be sure to have the firmware image available on a local tftp server so you can start all over.


6. Don't forget to add your OpenVPN network to Asterisk's sip_nat.conf or you'll drop calls.


7. Be aware that the Snom phones can also route packets from devices behind it via the PC port. You'll need to consider how to secure your internal network from the vpn phones.


8. If your Snom phone doesn't grab the tarball after boot, you'll need to put a dummy file on the webserver that's referenced on the advanced | update | Setting URL: parameter called "snom370.htm". Then the phone should start grabbing the tarball again. This may be a bug in snom370-SIP 8.4.32, the version tested.


9. You'll need to test on a subnet that doesn't have access to your Asterisk box without the VPN. E.g. not on your internal network.

VBScript: MD5 sum and file details into CSV

Some things are trivial in Linux/Unix and more complex in Windows. In Linux, it's md5sum filename. In Windows, there are free tools from Microsoft (fciv.exe), but no built-in commands that are super-easy to script.

So what are you to do if you need to collect file details and hashes for every folder within the subfolders of a directory? If you're doing it with VBScript, you'll need a free library available from XStandard. Once you register, you'll get a dll that you'll need to register. (It's 32-bit only, so if you're on a 64-bit box, you'll need to do this:
C:\WINDOWS\SysWOW64\regsvr32.exe XMD5.dll
and then to execute the script:
c:\windows\SysWOW64\cscript.exe FolderReportMD5.vbs )

Anyhow, this script is derived from the Sapien sample scripts. (While there are many free editors out there, I think Sapien's PrimalScript is worth every penny if you'll be doing a lot of Windows scripting.)

And since my MT template doesn't handle code well, here's a link to the text file.

'**************************************************************************
' File: FileListMD5.vbs
'
' Comments: This script uses the MD5 library available here:
' http://www.xstandard.com/en/documentation/xmd5/#api1
' This script runs through a directory tree and writes file attributes to a csv file.
' To run on x64 use C:\WINDOWS\SysWOW64\regsvr32.exe XMD5.dll and then execute via
' c:\windows\SysWOW64\cscript.exe FolderReportMD5.vbs
' Based on Sapien's sample script for FolderProperties.
'**************************************************************************
Set objFSO2 = createobject("scripting.filesystemobject")
'where to put the file list?
Set objFile = objFSO2.createtextfile("c:\scripts\" & "FileList" & ".csv")
q = """"
'write the header line of the CSV file.
objFile.WriteLine(q & "FilePath" & q & "," & q & "FileName" & q & "," & q & "DateCreated" & q _
& "," & q & "DateLastAccessed" & q & "," & q & "DateLastModified" & q & "," & q & "FileSize" & q &_
"," & q & "MD5Hash" & q & "," & q & "FileAttributes" & q)

'where to start
strSource="C:\folder"

Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objFolder=objFSO.GetFolder(strSource)

Call ProcessFiles(objFolder)

Sub ProcessFiles(objFolder)
Set colFiles=objFolder.Files


For Each file In colFiles
'it's a good idea to clear out the vars on each loop
strFingerPrint = "blank"
strPath = File.Path
Set objMD5 = CreateObject("XStandard.MD5")
strFingerPrint = objMD5.GetCheckSumFromFile(strPath)
Set objMD5 = Nothing
wscript.Echo strFingerPrint
wscript.Echo "File Name:" & vbTab & File.Name
wscript.Echo "Short File Name:" & vbtab & File.ShortName
wscript.Echo "File Path:" & vbtab & File.Path
wscript.Echo "Date Created:" & vbtab & File.DateCreated
wscript.Echo "Date Last Accessed:" & vbtab & File.DateLastAccessed
wscript.Echo "Date Last Modified:" & vbtab & File.DateLastModified
wscript.Echo "File Size:" & vbtab & File.Size
wscript.Echo "File Attributes:"
strFileAttributes = " "
if File.Attributes AND 0 Then wscript.Echo " Normal"
If File.Attributes And 0 Then strFileAttributes = strFileAttributes & " Normal"
if File.Attributes AND 1 then wscript.Echo " Read-only"
If File.Attributes And 1 Then strFileAttributes = strFileAttributes & " Read-only"
if File.Attributes AND 2 then wscript.Echo " Hidden"
If File.Attributes And 2 Then strFileAttributes = strFileAttributes & " Hidden"
if File.Attributes AND 4 then wscript.Echo " System"
If File.Attributes And 4 Then strFileAttributes = strFileAttributes & " System"
if File.Attributes And 8 Then wscript.Echo " Volume"
If File.Attributes And 8 Then strFileAttributes = strFileAttributes & " Volume"
if File.Attributes AND 16 then wscript.Echo " Directory"
If File.Attributes And 16 Then strFileAttributes = strFileAttributes & " Directory"
if File.Attributes And 32 Then wscript.Echo " Archive Bit is set"
If File.Attributes And 32 Then strFileAttributes = strFileAttributes & " Archive Bit is set"
If File.Attributes AND 1024 then wscript.Echo " Alias"
If File.Attributes And 1024 Then strFileAttributes = strFileAttributes & " Alias"
if File.Attributes AND 2048 then wscript.Echo " Compressed"
If File.Attributes And 2048 Then strFileAttributes = strFileAttributes & " Compressed"

'finally, write the line to the csv file
objFile.WriteLine(q & File.Path & _
q & "," & q & File.Name & q & "," & _
q & File.DateCreated & q & "," & q & File.DateLastAccessed & q & "," & q _
& File.DateLastModified & q & "," & q & File.Size & q & "," & q & strFingerPrint & q & "," & q & strFileAttributes & q)

Next
'process Subfolders
Call ProcessSubFolders(objFolder)

End Sub

Sub ProcessSubFolders(objFolder)
Set colSubs=objFolder.SubFolders
For Each folder In colSubs
ProcessFiles(folder)
Next

End Sub

Upgrading to Gallery3

So far, so good for the upgrade from Gallery2 to Gallery3. The new Google Earth feature integrates even better than the semi-supported ad-on for Gallery2. It makes it worth it to get a GPS attachment for your camera.

Still tough: mod_rewrite rules to make search engines happy. It also requires a PHP pagination code update, and navigation is still broken on one return link.

All in all, I've done far less syncing of directories and hand-editing of files to upgrade from 2 to 3 than I did from 1 to 2. Then again, I'm not all there yet.