text:
Find commute times to your work, school, gym and more.
AMLI on Maple
Contact this property
Floor Plans
Prices, specials, features and availability subject to change.
Contact for details (469) 291-8912
Alarm, Business Center, Clubhouse, Controlled Access, Elevator, Emergency Maintenance, Extra Storage, Fitness Center, Gated Access, Green Community, Media Center, On Site Management, Swimming Pool
Conference/Meeting room, Electric car charging stations, Expansive clubhouse, Fully equipped fitness center, Grilling & picnic area, Landscaped Courtyard, LEED SIlver certified, Parking Garage, Pet park, Resident business center, Resort-style swimming pool, Short Term Available, Wi-fi Access
Property Details
AMLI on Maple's luxury Dallas apartments are located just minutes from the newly revitalized Medical District of Dallas. This community is also close to a myriad of upscale shopping, dining and entertainment options and is LEED Silver Certified.
AMLI on Maple's luxury Dallas apartment rentals are located just minutes away form the Medical District of Dallas, which encompasses the newly revitalized hospitals and medical centers. The active Dallas Central Business District is also in close proximity, making our apartments convenient to a myriad of upscale shopping, dining and year round entertainment options.
Leasing Terms
Our lease terms are: 3-13 months (Please note that lease terms may vary, are subject to change without notice, and are based on availability. Inquire with property staff for complete details)
Pet Policy: 100 Pound Weight Limit. Maximum 2 pets per apartment. $10.00 pet rent. $200 pet deposit. Restrictions: Non-aggressive breeds only. Over 50 lbs restricted to first floor.
Pet Policy
Dogs Allowed. Cats Allowed. Pets Accepted. Call for service animal policy.
Community Information
341 units
Building Type
Contact Property
Check Availability or call
Similar Properties
Neighborhood Info
location | time | miles |
Contact Property
Contact this property
Office Hours
Monday-Saturday: 10:00am-6:00pm
Sunday: 12:00pm-5:00pm
Managed by
JLB Partners


text:
If your fuel system is acting up and causing you problems on the roads and highways, better check it right away to determine if you just need to purchase a brand new Bmw 530i fuel filter to fix the glitch. This particular component is an important part in your fuel assembly 'cause it makes sure that your vehicle is able to breathe properly. When your automobile has a good fuel filter installed, your assembly can work properly and this is going to supply you with enough power when you drive.
You'll find numerous methods to identify if you've got a badly broken Bmw 530i fuel filter and one is through blowing it; a good filter will have air resistance while a busted one will allow air to pass right through. A ruined fuel filter will usually cause drivability problems since the engine of your vehicle will have poor performance. Fix the problem of your car by restoring or replacing the faulty components inside your assembly very soon.
Find all the stuff that you should have to get your vehicle up and running again at Parts Train-the most excellent source of car parts and accessories on the market. Parts Train is definitely the best option when it comes to car components as we source our products from the reliable brand names in the automobile world such as Replacement, Hebmuller, and Febi. Search for most suitable Bmw 530i fuel filter that will complement your car, van, or truck's specifications here at Parts Train.
Market Price :$168.61
Discount Price :$130.25
Total Savings :$38.36
Market Price :$31.99
Discount Price :$31.99
Total Savings :$0.00
Market Price :$88.95
Discount Price :$88.95
Total Savings :$0.00
Market Price :$13.77
Discount Price :$7.50
Total Savings :$6.27
Market Price :$65.29
Discount Price :$46.46
Total Savings :$18.83

subset: commoncrawl


text:
Sidwell, David and Strayhound, and Knights of the Dub Table, and Hawkins, Anna and Cooper, Ashley and Coddington, Anna and Eshalon, (2010) Wintec Hothouse. [Performance]
PDF (Hamilton Gardens Arts Festival Programme)
1005Kb |
Abstract or Summary
Curate and manage the festival performance: Wintec Hothouse. 21 February 2010, Roger's Rose Garden, Hamilton Gardens. Featuring bands, duos, solo performers; Strayhound, Knights of the Dub Table, Anna Hawkins, Ashley Cooper, Anna Coddington, Eshalon
Item Type: | Performance |
Keywords that describe the item: | Hamilton Gardens Arts Festival, Wintec Hothouse, Knights of the Dub Table, Anna Hawkins, Anna Coddington |
Subjects: | M Music and Books on Music > M Music |
Divisions: | Schools > School of Media Arts |
ID Code: | 2013 |
Deposited By: | |
Deposited On: | 11 Jun 2012 23:05 |
Last Modified: | 11 Jun 2012 23:05 |
Repository Staff Only: item control page


text:
- Musician's Friend Best Selection, Price & Service. Guaranteed.
Call our Gear Heads
at: 800-449-9128
Call our Gear Heads
at: 800-449-9128
Find a similar product below or contact our experts for a recommendation of great alternatives. Call us at 800-449-9128.
Similar Items:Find a similar product below or contact our experts for a recommendation of great alternatives. Call us at 800-449-9128.
Similar Items:A hot little horn! One you'll want
to own once you've tried it!
The 416 features a .460-inch bore with a 3.7-inch bell and has the same pitch level as a full size trumpet. The 416 Series is very free blowing and fun to play. It can truly fit right into your pocket!!
Displaying reviews 1-2
Best Uses
Comments about Jupiter 416 Series Bb Pocket Trumpet:
Really, nothing to compare this too, as I heard it was a great little horn and so I purchased it. I'm very happy I did!
Comments about Jupiter 416 Series Bb Pocket Trumpet:
Both my band director and a fellow musician own this trumpet, and I have used it. At first it felt a little weird, because it is much closer to your face, but it does not affect your playing. It has the same sound you could get out of most trumpets, and the best part in my opinion would have to be how portable it is. You can take it pretty much anywhere! Now for the bad news; the tuning. It was rediculous how hard it was for my friend to tune it. All in all, it's good for practice, but use your main trumpet for concerts
Displaying reviews 1-2
Our product catalog varies by country due to manufacturer restrictions. If you change the Ship-To country, some or all of the items in your cart may not ship to the new destination.


text:
- Shopping Bag ( 0 items )
From the Publisher
"This collection of essays deals with the effects of national identity on the regional politics of the Middle East. As the editors point out in the introduction to this volume, although many experts are aware of the importance of national identity, they have not taken it sufficiently into account in their attempts to understand how the foreign policies of Middle Eastern countries are shaped."—Middle East Journal, Vol. 56, No. 2, Spring 2002"The one undoubted strength of this book is the quality of the country-specific contributions. All the authors are well-known specialists on Middle Eastern politics and provide complex and sensitive analyses of how the multiple identities of the peoples of the region interact with their rulers' domestic and foreign political objectives. . . . This is an engaged, well-focused, and stimulating set of contributions which achieves a coherence through focusing on the question of identity in Middle East politics."—Roland Dannreuther, University of Edinburgh. Contemporary Political Theory, 2002, Vol. 1
"By addressing the question of the role of identity in foreign policy-making, this volume places itself at the heart of one of the great IR debates at the moment, and this is by no means incidental."—Morton Valbjorn, Corporation and Conflict: Journal of the Nordic International Studies Association. 38:2
"Identity and Foreign Policy in the Middle East would make an excellent text in IR and Middle Eastern studies for either upper-division undergraduate or graduate courses. Its most obvious strength is that it problematizes both identity and national interest, challenging the usual givens assumed by traditional IR approaches."—Abdalla M. Battah, Minnesota State University, Mankato, Perspectives on Politics 1:2, June 2003
"This book marks an important and strong contribution to the scholarship of the Middle East. More geared for a scholarly audience with some background in the Middle East, it is written coherently enough to remain accessible to a motivated general reader. The analyses are deep, the theoretical context is consistent, and the questions addressed are relevant to both current affairs and recent history. Furthermore, the breadth of literature cited by authors is impressive, adding more weight to the conclusions they reach."—Scott Rothstein, Arab Studies Journal, Fall 2003/Spring 2004
"It will come as no surprise that 'identity matters' in the foreign policies of Middle Eastern states. The authors of Identity and Foreign Policy in the Middle East grapple with the difficult questions of just how identity matters: How are identities formed? How do they affect foreign policy? Which of the menu of possible identities becomes salient in a state's foreign policy during a particular period? Why do identities change over time? This book provides a new and more rigorous framework for reconsidering the old question of how ideas affect and are affected by foreign policy decisions in the Middle East."—F. Gregory Gause, III, University of Vermont
"Identity and Foreign Policy in the Middle East is a useful book, exploring the realist-constructive debate in the Middle East - a region which has been used in the past to illustrate both the power -political and ideational basis of international alignment and foreign policy behavior."—Rex Brynen, McGill University


text:
tick2tock's wall
tick2tock has no statuses yet.
tick2tock's friends
No friends added yet.
tick2tock's photos
No photos yet.
Forum topics tick2tock participated in
No posts.
tick2tock's recipes
No posts.
tick2tock's product ratings
King Arthur Unbleached Self-Rising Flour- 5 lb.
Rating: 5 Recommend: Y
Comments: Thanks for this product return!! Can't wait for it to get to the stores in Virg...
Buttermilk Pancake and Waffle Mix 16 oz.
Rating: 2 Recommend: N
Comments: Several years ago I used this mix and loved it. This time - not so much. The p...
Brioche Yeast Bread Mix
Rating: 5 Recommend: Y
Comments: Fantastic! Used the bread machine to mix and for first rise. Placed dough in ...
tick2tock's recipe ratings
Easy Self-Rising Biscuits
Rating: 5 Recommend: N
Comments: These biscuits were very good. The first time I made them I measured flour with...


text:
Hooks News & Notes: 08.09.07
no worries
Houston Astros general manager Tim Purpura sat 10 rows behind home plate on Saturday night for Brian Bogusevic's nightmarish Hooks debut.
But after seeing his 2005 first-round pick give up six earned runs in only two-thirds of an inning, Purpura was non-plussed.
"That's why they call it player development," said Purpura, the Astros' former farm director.
Hooks manager Dave Clark attributed some of Bogusevic's showing to nerves.
"It was his first taste at this level and it was probably the biggest crowd he's pitched in front of in a while," Clark said. "He's going to be all right."
The Hooks have announced their top players for July. Catcher J.R. Towles repeated as offensive player of the month, infielder Edwin Maysonet was the top defensive player and German Melendez was pitcher of the month.
Maysonet was a candidate to win both offensive and defensive player, but Towles edged him out.
Maysonet hit .462 with a .491 on-base percentage in July, but Clark said Towles' power numbers during the month (6 homers, 23 RBI) were the deciding factor.
"It was a tough call," Clark said. "If there was a way to do co-players of the month, I would have."
Melendez went 4-1 in nine july appearances with a 1.61 ERA and 25 strikeouts in 27 innings of work as a starter and reliever.
Fresh off Hunter Pence appreciation night, the Hooks will be honoring another current Astro, albeit one with considerably more big-league time.
The team will fete Craig Biggio during its Aug. 28 home game against Frisco. In addition to being an Astros institution, Biggio also is a investor in Ryan-Sanders Baseball, the Hooks' ownership group.
Biggio, who reached the 3,000-hit mark earlier this year, is retiring at season's end after 20 years with the Astros.
Who's hot
High-A Salem outfielder Billy Hart has heated up so far in August. In his first six games this month, Hart hit .476 (10 for 21) with a homer and five runs batted in.
Who's not
Low-A Lexington catcher Max Sapp, the Astros' first-round pick in 2006, hit only .179 with 2 RBI in the past 10 games.
Greg Rajan
Subscribe to the Caller-Times
Need Help? Call us at 1-800-566-8098.
Monday-Friday: 5am-8pm / Saturday: 7am-12pm / Sunday: 6am-1pm


text: FOR IMMEDIATE RELEASE PR- 332-04 December 03, 2004 STATEMENT BY MAYOR MICHAEL R. BLOOMBERG ON THE NOMINATION OF BERNARD B. KERIK AS SECRETARY OF HOMELAND SECURITY "Bernie Kerik is an excellent and inspired choice to succeed Tom Ridge as Secretary of Homeland Security. He not only has superb law enforcement experience on many different levels, but he also displayed remarkable leadership in the days that followed the worst terrorist attack in our nation's history. He knows what and where the threats are and how to best protect our country. Simply put, he is the right man for the job. "Since our City will always be a prime target for terrorists, having a New Yorker as Secretary of Homeland Security, who spent so many years protecting this City and who is so knowledgeable about our strengths and vulnerabilities, will serve us well as we continue to make the case that homeland security funds and resources must be distributed by threat and by threat only. I urge the Senate to move expeditiously in confirming his nomination." MEDIA CONTACT: Edward Skyler/Robert Lawson (212) 788-2958 |


text:
Today, the 3rd of August, the Basque Culinary Center, the San Sebastián Film Festival and the Berlin International Film Festival have presented the programme for the "Culinary Zinema: Film and Gastronomy" section. Thomas Struck, head of the "Culinary Cinema" section at the Berlin Film Festival, Joxe Mari Aizega, director of the Basque Culinary Center, and José Luis Rebordinos, director of the San Sebastián Film Festival attended the press conference.
After the excellent reception that the "Culinary Zinema: Film and Gastronomy" section got, which started running last year, the 60th San Sebastián Film Festival has programmed a selection of seven full-length films and one short film that focus on gastronomy. The screenings will be accompanied by themed dinners prepared by some of the most important chefs and restaurants.
"Culinary Zinema: Film and Gastronomy" is a collaboration between the San Sebastián Festival and the Berlin International Film Festival and the Basque Culinary Center, and its main aim is to combine cinema and gastronomy in a city and region that not only have a competitive festival in the top category of the FIAPF, but also the highest concentration of Michelin stars per square metre in the world.
The programme this year includes eight films: the premiere of six full-length films and a short film, and the recovery of Babettes gaestebud (Babette's Feast, 1987), the film by Gabriel Axel that won the Oscar for Best Foreign Film in 1988.
22 | COMME UN CHEF (EL CHEF) | Basque Culinary Center | Aizpea Oihaneder & Xabi Díez from the Xarma restaurant in Donostia and Roberto Ruiz from the Frontón de Tolosa restaurant |
23 | ENTRE LES BRAS | ni neu | Mikel Gallo |
24 | LUPE EL DE LA VACA (LUPE OF THE COW) | Mirador de Ulía | Rubén Trincado from the Mirador de Ulía restaurant and Bruno Oteiza from the Biko restaurant in Mexico City |
25 | JERUSALEM ON A PLATE | Illarra | Josean Eizmendi |
27 | LES SAVEURS DU PALAIS (HAUTE CUISINE) | Iñigo Lavado (Irún) | Iñigo Lavado |
27 | BABETTES GAESTEBUD (BABETTE'S FEAST) | Bokado Aquarium | Mikel Santamaría |
28 | PERÚ SABE: LA COCINA, ARMA SOCIAL | Basque Culinary Center | Luis Arévalo from the Nikkei 225 restaurant in Madrid |
Aizpea Oihaneder & Xabi Díaz from the Xarma restaurant
Aizpea and Xabi have been working together for more than ten years in a career that has taken them from the sophisticated Rocamador in Badajoz, where they won a Michelin star, to Donostia, with a project where they create a subtle, state-of-the-art cuisine, with highly sound basic elements and total concern for the excellence of their produce.
Roberto Ruíz from the Tolosa's Frontón restaurant
Chef for the last 20 years at Tolosa's Frontón, the pelota court restaurant celebrated as a temple of produce. Roberto studies the origin of dishes, working with producers to achieve the qualities he proceeds to transform with the finest of culinary skills.
Mikel Gallo from ni neu restaurant
Mikel runs a kitchen that aims to be accessible. He achieves this perfectly with cooking based on nods to tradition but which is totally backed up by modern highly personal techniques. The result is magnificent, easily understood and perfectly in keeping with ni neu's unique setting: accessible excellence.
Rubén Trincado from the Mirador de Ulía restaurant
Owner and chef of the Mirador de Ulía restaurant. Holds a Michelin star since 2010. Seriously cutting edge cuisine from a chef who leads the way in things to come.
Bruno Oteiza from the restaurant Biko (Mexico City)
He started working in the kitchen when he was very young and there are few chefs with his training and career with great chefs in great restaurants. He is probably closest to Juan Mari Arzak as he has worked on projects in Mexico. Bruno currently owns the D.O. restaurants together with Pablo San Román, and the Biko, considered to be among the top 50 in the world, all of them in Mexico.
He is a media-friendly TV chef, but above all, a benchmark and a genuine bridge between Mexican and Basque cultures.
Josean Eizmendi from the Illarra restaurant
Today the Illarra restaurant is a must in the world of the grill, an evolving technique sending strong ripples through the sector of which Josean is a recognised, prizewinning author. An inquisitive, outgoing chef who loves to teach those who delight in his food and refuses to offer anything but the best.
Iñigo Lavado from the Iñigo Lavado restaurant (Irún)
A chef young in years yet already boasting an excellent professional career. Having trained in top establishments, his is a solid project. Always eager to explore new ways of working and managing. His trademark is a model of restaurant taking the forefront in all fields.
Mikel Santamaría from the Bokado Aquarium restaurant
Mikel officiates at the Aquarium's Bokado eatery, a place of spectacular views and excellent gastronomy. Backed by long experience in modern and avant-garde cuisine, Mikel is also highly skilled in carrying off events of truly extraordinary quality.
Luis Arévalo from the Nikkei 225 restaurant in Madrid
The Peruvian Luis Arévalo works in a restaurant that is exceptional due to its location in Madrid as well as its architecture and decor.
Luis Arévalo's cooking is a personal, highly refined style, deeply-rooted in Peruvian tradition and culture, but fused with Japanese elements. There is an authentic, highly personal touch in his creations. A personal, constantly evolving proposal offering what is known as Nikkei cuisine.


text:
Background Strategy Fortunately, there is a more elegant option. Take a look at the password column in the view DBA_USERS: So how can you use this information? It's simple. If you create the default users with default passwords, you will come to know the hash values of those passwords. Then you can build a table of such accounts and the hashed values of the default passwords and compare them against the password hashes stored in the data dictionary. In January 2006, Oracle made a downloadable utility available for identifying default passwords and their users. This utility, available via a patch 4926128 is available on OracleMetaLink as described in the document ID 361482.1. As of this writing, the utility checks a handful of default accounts in a manner similar to that described above; by the time you read this, however, its functionality may well have expanded. Furthermore, security expert Pete Finnigan has done an excellent job of collecting all such default accounts created during various Oracle and third-party installations, which he has exposed for public use in his Website, petefinnigan.com. (Standard disclaimer: Oracle does not validate the content of third-party Websites.) Rather than reinvent the wheel, we will use Finnigan's work and thank him profusely. I have changed his approach a little bit, however. First, create the table to store the default accounts and default password: The vulnerability varies across versions. In Oracle Database 10g and later, the database installation has a prompt that asks what the password should be, instead of assuming it to be change_on_install or something else. Because the user is forced to make a decision, it is likely that the password will be a nondefault one. However, if the user chooses something as predictable as oracle, then the point is moot. (Perhaps oracle was chosen when the database was being built prior to production as a convenience for the DBAs. After it went to production, the password stuck around.) In versions prior to Oracle Database 10g, the password is not prompted to be entered, and hence it is likely that the default password—for example, change_on_install for SYS and manager for SYSTEM—is active. This tool will help you identify such cases. Also note that the userid SCOTT—the demo account for learning SQL techniques—may be fine for a development database but not for a production one. It is a potential back-door entry for intruders, and you should immediately drop it. Accounts like CTXSYS, DMSYS, and OLAPSYS are required for Oracle tools. The best strategy is to drop these users if you are not using these options. If you are not sure you are using them, or you just want to reserve the opportunity, you can keep these accounts but lock them from connections. To lock an account and expire the password, you would issue this SQL alter user dmsys account lock expire password; which will set the account status to EXPIRED & LOCKED. When the user tries to log in, the following error will be raised: Implications Action Plan For the used accounts, change the password if the default password is being used. Background Since Oracle Database 11g Release 1, case-sensitive passwords are available. So, abc123 and Abc123 are not deemed the same. If the user sets the password as Abc123, then abc123 will not work. Here is a demonstration: Implications Suppose the password of a user called ARUP is dream1ng. Most likely, the user enters the password in SQL*Plus, SQL Developer, and so on as dream1ng. However, some tools may convert it to all uppercase making the password DREAM1NG. When this password is passed to the database, authentication will be refused. This will occur right after the database upgrade, so most likely the reason will be attributed to a bug in Oracle Database 11g or something similarly esoteric. Often users make mistakes too. Because in pre–Oracle Database 11g they were not required to differentiate between case-sensitive passwords, they may continue to enter their passwords in whatever case they feel comfortable with, failing authentication. Either way, it might not be possible to change the code quickly to pass the password as is or change user behavior. Therefore you should take a phased approach to changing this particular behavior; otherwise, it may cause application outages. If users connect to an Oracle Database 11g database via db link, they must now use the password in right case otherwise, it will be rejected. Action Plan If this is a brand-new database, you should turn on the case-sensitive feature (leave the default). Make sure the users know about this feature so that they will be careful in entering the password in right case. If you are upgrading the database from Oracle Database 10g, you should be little bit more flexible. Follow the steps shown below: Make sure the audit_trail initialization parameter is set to db before the database is restarted: Make sure you have session auditing turned on. Issue the following command: Instead of turning the case-sensitive feature on immediately, leave it off by setting the parameter explicitly in the parameter file after you upgrade the database: Make your users aware of the case-sensitive feature and encourage them to enter passwords in the proper case. Note: Due to the parameter being false, they can still enter passwords in any case and be authenticated. Make the applications pass passwords in the proper case. The passwords will still be authenticated if they don't, but at least applications will be ready. During a change window, issue this statement: If you see any record, from the host and terminal, you can determine the source of these logins, allowing you to take corrective action. Background Note the permission on these files. For instance, in UNIX, you may see something like this. The first position indicates the type of the file. In UNIX, everything—regular files, directories, and devices—is considered a file. This is a true file, hence the first position shows "-." Had it been a directory, this position would have shown "d"; in the case of a character special device, it would have shown "c," and so on. The second position onward shows the permissions given on the file. The permissions are shown in blocks of three, indicating the status for the Read, Write, and Execute respectively. The first three positions show the permissions for the owner, the next three show the permissions given to the group the file belongs to, and the last three show the permissions provided to all others. Position 1 2 3 4 5 6 7 8 9 10 Value - r w s r - s - - x Owner Group Other Note the last three positions, which indicate the permissions for the Others (not the owner, oracle, or the users belonging to the group dba). From the permissions, you can see that Others can simply execute this file but not read it or write to it. This explains "r," "w," and "x"—for Read, Write and Execute, respectively—but what about the character "s" in the place where there should have been an "x"? This is an interesting twist to the Execute privileges. The presence of this "s" on the permission above indicates that this program is setuid enabled. When the program runs, regardless of who runs it, it will run as the user who owns it, i.e. oracleThis is one way in which the program can be owned by Oracle software but run by anyone who would connect to it. Thus, the program can operate under the privileges of oracle and not the user who runs it, which makes it possible to open database files and so on. Two-Task Architecture. Recall how Oracle Database processes operate, by decoupling the user process from the server process. If you don't remember this completely, I highly recommend rereading the first few chapters of the Oracle Database 10g Concepts Manual. Below is a highly distilled version of the interaction, which merely lays the foundation for understanding the permissions; it's not a substitute for reviewing the contents of the manual. When a user connects to an Oracle database—say, with SQL*Plus—Oracle creates a new process to service this user's program. This new process is called the Oracle server process, which differs from the user's process (sqlplus, sqlplus.exe, TOAD.exe, or whatever it else it may be). This server process interacts with the memory structures such as the System Global Area (SGA) and reads from the datafiles; if the data is not found in the buffer cache in the SGA, and so on. Under no circumstances is the user's process (sqlplus) allowed to directly interact with the Oracle database datafiles. Because there are two processes (the user process and the server process) working in tandem to get the work done, this is sometimes known as two-task architecture. If a user process does something potentially disruptive, such as violating the memory management in the host machine, the Oracle database itself is not affected and the damage is limited to the user's process. (Note that the above applies to Oracle connections in a dedicated server environment. In a multithreaded server environment, this model is a little different in the sense that a single server process can service more than one user process. It's still two-task, but instead of a 1:1 relation between the server and user processes, it's 1:many.) The server processes are run under the user who owns the Oracle software. Here's an example. Suppose the user logs into the database using SQL*Plus: Note the process id (6339). Now if you search that process ID: The process name is oracleDBA102 (DESCRIPTION=(LOCAL=YES) (ADDRESS=(PROTOCOL=beq))), which tells you several things. First, the presence of the clause LOCAL=YES indicates that this process started due to another process that is running locally, on the same server as the database itself. It also shows PROTOCOL=beq, which means that the connection was made through a bequeath connection. You can also find the information about the server process from the dynamic views: Now, assume that the user connects through a slightly modified manner. Instead of connecting directly on the server, she uses the TNS string. Assume that your TNS string looks like this (on the server oradba): To understand the answer, you have to understand how different Oracle server processes are created. In the first case, when the user did not use a TNS connect string, the connection was routed directly to the database without going to the listener first. The database created a user process and then handed the control of the process to the process owner, a process known as bequeathing—hence the term bequeath process, which showed up in the process name. In the second case, when the user was still on the same server but connected through the listener, the listener created the process for the user—which is known as forking. Similarly, if the user process were running on a different machine (such as a laptop), the connection would have to be made to the listener and the listener would have created the process. The process was created by a remote server, hence the process name contains the clause LOCAL=NO. Even if the SQL*Plus session was running on the same server, the fact that it was a non-bequeath connection made it a non-LOCAL one. (Note: Depending on the OS, you may not see the parent ID of the server process in the same way that you see the SQL*Plus session in bequeath connections. In some cases, even though the connection is bequeath, the parent ID will show as 1. Therefore, don't rely on the parent ID to determine what type of server process it is; use the process name instead.) Now that you understand the two-task model, let's see if you get the salient point in this discussion. The database creates and runs the server process, not the user who started the client process such as SQL*Plus. The server process uses the executable oracle or oracle.exe, so only the Oracle software owner, named orasoft (named so as to avoid confusion with the term "oracle," which is the name of the executable), should have privileges to execute them—no one else. So why do you need permissions for the others? The short answer is, you don't. You can remove the unnecessary permissions by issuing this command: Strategy For example, suppose the UNIX user ananda logs in to the same server the database is on and connects locally: So, how can ananda connect to the database? There are two options. One is to make all the user processes run on a different server than the database server itself—thus there are no bequeath connections to the database, only non-LOCAL ones. Because the non-LOCAL connections go through the listener process and the listener spawns a server process for them, the server process is owned by orasoft (the Oracle software owner) and not by the user who is running the client process. There is no permission to issue. Alternatively, if you must run some user processes on the database server itself, you can connect through the listener with DBAs with individual OS IDs will not be able to shut down or start up the database using the command connect / as sysdba, even if they belong to group dba. They can do so with Action Plan • Simply asking • Searching for processes on the server to see if you find something as obvious as SQL*Plus • Checking the column MACHINE of V$SESSION: Action IF no programs connect from the server, THEN Change the permissions of the oracle executable ELSIF some program connects from the server Change the connection from UserID/Password to UserID/Password@Connect_String END IF Change it to use DBAUser/Password@Connect_String END IF Background Some of these files—such as tnslsnr, the utility that the listener process runs, or dbsnmp, which was used in Oracle Intelligent Agent—are not directly touched by the end user. To properly secure them, you must understand what they do and take appropriate action. Recall that if the SUID bit is set for a file, then regardless of who runs the file it runs under the privileges of the owner, not the executor. You also learned that setting the SUID can be dangerous and should be discouraged. There are several other files that have the SUID set to on. Let's find them. Program Description ./bin/oracle This file is a copy of the executable oracle. When you recompile the oracle executable using the relink command, the old copy is saved as oracleO. This is a potential security hazard; most DBAs ignore it, and it can be an avenue for hackers. Therefore you should take action to remove the permissions. The best option is to have no permissions for it to anyone other than orasoft: $ chmod 600 oracleO Now, if you check the permissions: $ ls -l oracleO ./bin/oradism Used for Dynamic Intimate Shared Memory. May be in use on your platform. May not be present in all cases. If present, leave as is. ./bin/emtgtctl2 Used for Oracle Enterprise Manager agent. There is no need for it to be set with SUID. The justification is the same as the oracle executable. Remove the permissions: $ chmod 0700 emtgtctl2 ./bin/nmb Used for Oracle 10g Grid Control agent to collect statistics on the target server. Leave as is. ./bin/nmo Used for Oracle 10g Grid Control agent to collect statistics on the target server. Leave as is. ./bin/extjob This is the executable for the EXTJOB (External Jobs, which allow you to execute OS-based programs from within Oracle Enterprise Manager). This is something you should be careful about. Do you use external jobs a lot? If not, then you should not even have this executable. In such a case, you can leave it in the directory but change the permissions and the ownership. The owner can be the Oracle software owner (orasoft, in our case), and the permissions should be rwx------: $ chown orasoft:oinstall extjob There may be another program present, extjobO, which was a previous compilation of the same program. Change the permissions of that too: $ chown orasoft:oinstall extjobO The other executable to consider is tnslsnr, which is the Oracle Net Listener. There are two executables: • tnslsnr—the actual listener executable If you look at the permissions: Strategy Remove all permissions to others from the files that are not needed—for example, lsnrctl0. Restrict permissions for executables to Oracle software only. Remove the SUID bit if the Oracle software owner starts the processes. So, you want to change the permissions of the listener-related files as follows: Verify the result: Changing the oracleO executable has no impact on the operation of the database. If you ever face an issue that points to a corrupt oracle executable, your best bet is to rename the oracleO file to "oracle." If you do so, make sure you reset to permissions to 700. The same goes for lsnrctl0 and tnslsnr0 executables. Changing the emtgtctl2 permissions will have no impact if you use the Oracle software owner userid as the Oracle Enterprise Manager OS credentials. If you use a different userid (not orasoft, for example), the SUID must be reset to the old value and the permissions must be set as they were. The executable dbnsmp is used by Oracle Enterprise Manager Intelligent Agent, but only up until Oracle9i Database Release 2. Again, if you use the Oracle software owner as the OS credentials, there is no impact from changing the permissions. If you use a different userid, you must reset the permissions to the previous value. Action Plan Change permissions of oracleO, tnslsnr0, and lsnrctl0 to 0600. Change permissions for tnslsnr and lsnrctl to 0700. Do you use external jobs in Oracle Enterprise Manager? IF no THEN change the permissions of extjob to 0000 Change the permissions of extjob to 0700 and change the owner and group to orasoft and oinstall (or whatever the user and group of the Oracle software owner are). END IF IF you are on Oracle9i Database THEN Are you using Oracle Intelligent Agent? IF no THEN Change ownership of dbsnmp to orasoft ELSE No change needed END IF Note: If you apply a patch or upgrade the database, the permissions will be reset, so you need to re-examine them after the upgrade. Background When the database is created, the password of DBSNMP] is also set to dbsnmp. This user has some powerful privileges, such as UNLIMITED TABLESPACE, SELECT ANY DICTIONARY (which allows the user to select from dynamic performance views and data dictionary views), and ANALYZE ANY DICTIONARY (which allows analyze of the system objects). Many intruders use this userid and password for back-door entry into the database. Needless to say, this is a huge security hole. Strategy First change the password of the user DBSNMP to something else—for example, TopSecret: SQL> alter user dbsnmp identified by topsecret; Go to the directory where the Oracle Agent Home is installed (not ORACLE_HOME)—for example, /u01/app/oracle/10.1/gridc. Go to directory <hostname>/sysman/emd , where <hostname> is the name of the host or server. For instance, if the name of the server is prolin1, then the directory should be prolin1/sysman/emd. Here you will find a file named targets.xml. Copy it under a new name (for example, targets.xml.old). Open the file targets.xml and search for the word "dbsnmp"; the contents should be similar to: If this is a RAC database, this line will occur twice in the file. Make sure you change both occurrences. Search the file for the word "password" to locate these two instances Now stop the agent by issuing this command Now the agent is configured with the new password. If you use the standalone Database Console instead of Oracle 10g Grid Control, then the procedure is similar—except that in Step 2, you would go to ORACLE_HOME, not where the Agent Home is located. Implications Action Plan 1. Change the password of the user DBSNMP. 2. Update the agent files to reflect the new password. Background Strategy Implications If you ever lose the SYS password, don't worry. You can comment the line in the file SQLNET.ORA and then connect the old-fashioned way: / as sysdba. Action Plan IF you use SYS connections in scripts THEN Change / as sysdba to sys/<SysPassword> as sysdba ELSE No change needed END IF Background To do that, the hacker might attempt to change the attributes of the listener. A popular tactic here is to list the various services handled by the listener via the services command. Note how much information is displayed—possibly enough for the hacker to gain illegitimate access: Another hacker trick is to shut down the listener. New connections will be refused, again effectively creating a denial-of-service attack. In addition, the listener can be remotely administered. Using this technique, the hacker can remotely stop a listener by attacking another vulnerable machine. How do you protect yourself from these threats? Strategy Setting the password works the same way in all versions of Oracle Database, but the enforcement mechanism varies: In Oracle9i Database Release 2 and earlier, all users need a password. In Oracle Database 10g Release 1 and later, the OS user who owns the database software does not need a password. All others need a password. Here's how to set the password: In Oracle Database 10g, this process is a little different. In that release, the listener is set to be executable by the Oracle software owner only without a password. If you have set a password, then other users can execute it after supplying the password. Here is the status display: Implications Action Plan IF Oracle Database 10g or later THEN Remove the permissions from all except the owner ELSE Remove the permissions from all except the owner END IF Background Strategy Even if you use a password to protect the listener, you should still use this technique to further restrict the hacker's ability to administer the listener. This is particularly true in Oracle Database 10g, where a listener password is not required for the Oracle software owner. Implications Note, however, that it will no longer be possible to use remote listener control to administer a listener on a different server. Instead, you have to log onto the server to make the change in listener.ora and then reload the listener, which is best practice anyway. Action Plan Reload the listener by issuing lsnrctl reload. Background One example of a powerful privilege is CREATE ANY TABLE, which lets the user create a table in any schema, not just its own. Rarely do users need this privilege; you can safely revoke it. On the other hand, a privilege like QUERY REWRITE, which allows the users sessions to rewrite a query to take advantage of a function-based index or materialized view, is relatively innocuous. Strategy set pages 50000 break on privilege skip 1 select privilege, grantee, admin_option from dba_sys_privs where privilege not in ( /* list any other privilege here you don't find "sweeping" */ 'ALTER SESSION', 'QUERY REWRITE', 'CREATE DIMENSION', 'CREATE INDEXTYPE', 'CREATE LIBRARY', 'CREATE OPERATOR', 'CREATE PROCEDURE', 'CREATE SEQUENCE', 'CREATE SESSION', 'CREATE SNAPSHOT', 'CREATE SYNONYM', 'CREATE TABLE', 'CREATE TRIGGER', 'CREATE TYPE', 'CREATE USER', 'CREATE VIEW', 'UNLIMITED TABLESPACE' ) and grantee not in ('SYS','SYSTEM','WKSYS','XDB', 'MDSYS','ORDPLUGINS','ODM','DBA') /* Place all the user names you want to exclude */ order by privilege, grantee / Here is part of a sample output: IMP_FULL_DATABASE is a role used to do a full database import, usually granted to the DBA or to any other user needed in the import. The privilege is probably necessary. QCO refers to Quest Central for Oracle, a popular tool for managing databases. The privilege is probably necessary; but you have to be careful to make sure no one except the DBAs have the access to the QCO userid.. The users CNSMP and ATHOTANG, unless they are DBAs, do not appear to need any sweeping privileges. The privilege should be revoked. Implications If you have doubts, the best course of action is to interview the people behind the userids. For example, perhaps ATHOTANG does not really need to drop tables but was assumed to do so. (Don't be surprised—such assumptions are common.) Action Plan Background Therefore, you should move these tables into a special tablespace—say, AUDIT_TS—as shown below: Implications Important: If the tablespace is offline, you will get an error for auditable actions. Here is an example where a user is trying to connect (an event that is audited) but fails because the audit table is not available: Action IF Oracle Database is earlier than 11g Release 2 THEN Don't do anything ELSE Create a new tablespace END IF Go on to Phase 2 | Read the Project Lockdown TOC and Security Primer
It's Phase 1 of your security and compliance project. Let's see what you can do within 24 hours to lock-down your infrastructure.
Updated August 2010
Download: Phase 1 Checklist (PDF)
Covered in this Installment:
1.1 Remove Default Passwords
During Oracle software installation and database creation, it is common for accounts to be created and then forgotten. These accounts, which often carry default passwords (such as "tiger" for SCOTT), are favored entry points for intruders. You would be shocked to hear how many production database installations I have audited that use change_on_install or oracle as the password for SYS. Your first line of action should be to immediately identify and remove these default passwords.
In Oracle Database 11g, this activity has become extremely easy, almost to the point of being trivial. The database has a special view, dba_users_with_defpwd, that lists the usernames with the default passwords. Here is an example usage:
SQL> select * from dba_users_with_defpwd
2 /
… output truncated …
The output clearly shows the usernames that have the default password. You can join this view with DBA_USERS to check on the status of the users:
1 select d.username, account_status
2 from dba_users_with_defpwd d, dba_users u
3* where u.username = d.username
------------------------------ --------------------------------
… output truncated …
In versions prior to Oracle Database 11g, how do you identify the accounts with default passwords? One option is to try to log into the account using the default password—but this is definitely a cumbersome approach, not to mention a time-consuming one.
SQL> select username, password
2 from dba_users
3 where username = 'SCOTT';
------------------------------ ------------------
The password is hashed and thus undecipherable, but we know that SCOTT's password is tiger. Therefore, the hash value for tiger when userid is SCOTT is F894844C34402B67. Now, if SCOTT's password changes, this hash value also changes. You can then confirm in the view DBA_USERS to see if SCOTT's password matches this hash value, which will verify the password as tiger. Note, however, that the hash value is not a hash value of the password itself; if another user has the password tiger, that hash value will be different.
SQL> create user scott2 identified by tiger;
User created.
SQL> select username, password
2 from dba_users
3 where username = 'SCOTT2';
------------------------------ --------------------
Note the different hash value (C44C11D4C34DB67D), even though the password is identical.
CREATE TABLE osp_accounts
product VARCHAR2(30),
security_level NUMBER(1),
username VARCHAR2(30),
password VARCHAR2(30),
hash_value VARCHAR2(30),
commentary VARCHAR2(200)
Then you can load the table using data collected by Finnigan. (Download the script at petefinnigan.com/default/osp_accounts_public.zip.)[ After the table is loaded, you are ready to search for default passwords. I use a very simple SQL statement to find out the users:
col password format a20
col account_status format a20
col username format a15
select o.username, o.password, d.account_status
from dba_users d, osp_accounts o
where o.hash_value = d.password
--------------- -------------------- --------------------
Here you can see some of the most vulnerable of situations, especially the last line, where the username is SYS and the password is oracle (as is that of SYSTEM)! It may not be change_on_install, but it's just as predictable.
ORA-28000: the account is locked
Warning: You are no longer connected to ORACLE.
Change the password for all accounts that you cannot lock. One such account is DBNSMP, but we'll discuss that later.
The locking of unused accounts shouldn't cause any problems.
Identify the unused accounts. Lock them and expire their passwords.1.2 Use Case-Sensitive Passwords
Passwords in Oracle Database have historically been case insensitive; in other words, the passwords abc123 and "Abc123 were deemed identical. This led to consternation in some circles. Many regulations and security mandates require that passwords be of mixed case (have at least one uppercase letter).
SQL> alter user sh identified by Abc123;
User altered.
Here's what happens if you try to connect with abc123:
SQL> conn sh/abc123
ORA-01017: invalid username/password; logon denied
Warning: You are no longer connected to ORACLE.
The password is not accepted. Now let's try the actual mixed-case password:
SQL> conn sh/Abc123
A database parameter sec_case_sensitive_logon controls the behavior. If set to TRUE, the Oracle database differentiates between abc123 and Abc123. Setting it to FALSE ignores the case sensitivity, reverting to the pre–Oracle Database 11g approach. Here is a demonstration of setting it to FALSE:
SQL> alter system set sec_case_sensitive_logon = false;
System altered.
SQL> conn sh/abc123
SQL> conn sh/Abc123
Note how the database didn't differentiate between the passwords.
Should you set the value to TRUE or FALSE? That's an important question. In Oracle 11g Release 1, if you used DBCA to create the database, you were asked whether you wanted to keep the Oracle Database 10g–style case-insensitive password or apply the new Oracle Database 11g–style security. If you accepted the default—in other words, Oracle Database 11g–style—the parameter was set to TRUE and the passwords were checked for case. In Oracle 11g Release 2, DBCA doesn't ask; it sets the values by default.
If the database is not subject to a condition that requires case-sensitive passwords, you may not care about it. Still, it is always a good idea to make passwords case sensitive so the database will be compliant with any regulations yet to come. Besides, it makes passwords more secure.
audit_trail = db
This turns on the audit trail. (Oracle Database 11g already has this on by default.)
SQL> audit session;
It enables auditing by session. (Oracle Database 11g already has this on by default; so if you didn't disable it explicitly, it's on.)
sec_case_sensitive_logon = false
This reinstates the Oracle Database 10g behavior; in other words, it lets the database ignore the case of passwords.
SQL> alter system sec_case_sensitive_logon = true;
This enables case sensitivity in passwords. Immediately afterward, check for invalid login attempts in the audit trail:
select username, userhost, terminal
from dba_audit_trail
where returncode = 1017;
If any user failed authentication, they would have received an error message "ORA-01017: invalid username/password; logon denied" and this fact would have been recorded in the audit trail with the returncode value as 1017. The above query would have shown those invalid login attempts.
1.3 Configure Oracle Binary Permissions
Oracle Database uses several binary files. The most important is the executable oracle in UNIX and Linux flavors and oracle.exe in Windows.
# cd $ORACLE_HOME/bin
# ls -l oracle
-rwsr-s--x 1 oracle oinstall 69344968 Jun 10 14:05 oracle
The permissions (the same in all relevant Oracle versions) are the default. Let's see what they mean. (If you are familiar with the UNIX permissions, you can skip this subsection and proceed to the subsection "Two-Task Architecture.")
In each permission set, the permissions are shown as either a value or "-." If a "-" appears in the place, it indicates that the permission is not granted on that privilege. For instance, in the above case, note the sixth position, indicating that the Write permission for the Group is set to "-," which indicates that the group "dba" (the group the file belongs to) cannot write to this file. If the permission is granted, then the value is set to the corresponding letter. Again, in the above example, the Read permission for the Group (denoted by the fifth position) shows "r," indicating that the group "dba" can read this file.
$ sqlplus arup/arup
After this, if you search for this process:
$ ps -aef|grep sqlplus
it shows this:
oracle 6339 6185 0 13:06 pts/0 00:00:00 sqlplus
This, of course, assumes that no other SQL*Plus sessions have been running on the server.
$ ps -aef|grep 6339
You will get two processes:
oracle 6339 6185 0 13:06 pts/0 00:00:00 sqlplus
oracle 6340 6339 0 13:06 ? 00:00:00 oracleDBA102
The first one you've seen before (the process for the SQL*Plus session). The second one—process ID 6340—is the server process that Oracle creates for the user. Note the Parent Process ID of the process; it's 6339, which is the process ID of the SQL*Plus session.
select spid
from v$session s, v$process p
where s.sid = (select sid from v$mystat where rownum <2)
and p.addr = s.paddr;
The value returned by the above query is the process ID of the server process. This is the only way to get the process ID if the client process is on a different server, such as someone running SQL*Plus on a laptop connecting to the database.
(ADDRESS = (PROTOCOL = TCP)(HOST = oradba)(PORT = 1521))
Now the user connects (on the same server, oradba) as follows:
sqlplus arup/arup@dba102
Check the process ID from the dynamic views:
SQL> select spid
2 from v$session s, v$process p
3 where s.sid = (select sid from v$mystat where rownum <2)
4 and p.addr = s.paddr
5 /
The process ID is 6428. Search for this on the server:
$ ps -aef|grep sqlplus | grep -v grep
oracle 6426 6185 0 13:20 pts/0 00:00:00 sqlplus
Now when you search for the server process on the database server:
$ ps -aef|grep 6426 | grep -v grep
oracle 6426 6185 0 13:20 pts/0 00:00:00 sqlplus
you don't see the server process. There is no child process of the user process 6426. But you know from the dynamic performance views that the server process is 6428, so what is the parent process of that?
$ ps -aef|grep 6428 | grep -v grep
oracle 6428 1 0 13:20 ? 00:00:00 oracleDBA102 (LOCAL=NO)
The parent process is 1. But why isn't it 6426?
$ chmod 4700 $ORACLE_HOME/bin/oracle
After executing the command, the permissions will look like this:
-rws------ 1 orasoft oinstall 248754168 Oct 8 07:11 oracle
Now we can move on to strategy—via the SUID bit. In this case the SUID bit is set to ON (indicated by rws permissions for the owner).
Because you don't need anyone other than the Oracle software owner (orasoft, in this case) to run the Oracle executable, you should remove the SUID bit from the executable and make it accessible by only the owner—no one else:
$ chmod 0700 $ORACLE_HOME/bin/oracle
The permissions now look like this:
-rwx------ 1 orasoft oinstall 248754168 Oct 8 07:11 oracle
This is a major change, and it's important that you understand its impact. When a user (not the Oracle software owner) on the server tries a local connection, the executable oracle is run on his behalf as if the user orasoft is running it. Because the server process will open the datafiles (owned by orasoft), either it must run as orasoft or the user must have permissions to open the datafiles.
$ sqlplus arup/arup
The user will immediately get an error:
ORA-12546: TNS:permission denied
Enter user-name:
The reason why is very simple: you removed the SUID permission on the file oracle. When the user executes a local connection, he essentially tries to run the executable oracle, but because the SUID is not set, it's not tried as user orasoft but rather as ananda. As user ananda does not have permission to run this file, it will not be executed—hence the ORA-12546 error.
$ sqlplus arup/arup@dba102
which has the same effect as a user connecting from outside the server. Now only the user who owns the Oracle software (in this case, orasoft) can connect to the database through a bequeath connection.
$ sqlplus /nolog
SQL> connect sys/Password_of_SYS@dba102 as sysdba
Yes, this approach makes use of the SYS password, but that's a better practice compared to / as sysdba. A much better practice yet is to create Oracle userids for individual DBAs:
connect ANANDA/Password_of_ANANDA@dba102 as sysdba
A favorite hacker trick is to get into the server using any account and then try to force into the database. (A typical "loose door" is the user "nobody.") Even if the hacker does not get into the database, he can create a denial-of-service attack by buffer overflow of the oracle executable. If the ability to execute the file is removed, then the effectiveness of the attack is severely limited. At the same time, as you saw, you have not removed any functionality from legitimate users. Most users connect to the database using the listener anyway, and they will not be affected much.
See if any other user on the system makes a bequeath connection. You can accomplish this by
select program
from v$session
where machine = '<machine_name>';
If something comes up, you can identify the exact program running by turning on auditing (which you will learn about in the subsequent phases of this article series)[ and capturing any program coming from the server.
chmod 0700 $ORACLE_HOME/oracle
IF you frequently connect from shell scripts as sqlplus / as sysdba THEN
1.4 Secure Other Executables
Take a look at the other executables in the $ORACLE_HOME/bin directory; some may look familiar, such as sqlplus or lsnrctl (the utility to start the listener); others may not.
$ cd $ORACLE_HOME
$ find . -type f \( -perm -2000 -o -perm -4000 \) -exec ls -l {} \;
In Oracle Database 10g Release 1 and later, the above should return only the following executables (Oracle Database 11g should return only a subset of this):
-rwsr-s--x 1 orasoft dba 93300507 Jul 22 11:20 ./bin/oracleO
-r-sr-s--- 1 root dba 0 Jul 1 23:15 ./bin/oradism
-rwsr-s--x 1 orasoft dba 94492 Jul 22 11:22 ./bin/emtgtctl2
-rwsr-s--- 1 root dba 18944 Jul 22 11:22 ./bin/nmb
-rwsr-s--- 1 root dba 20110 Jul 22 11:22 ./bin/nmo
-r-sr-sr-x 1 nobody nobody 58302 Jul 22 11:23 ./bin/extjob
Let's see what these files are:
-rw------- 1 orasoft oinstall 248823320 Sep 15 13:27 oracleO
$ chmod 0700 extjob
$ chmod 0600 extjobO
In Oracle9i Database Release 2, you will find a different file, ./bin/dbsnmp, which is the Oracle Intelligent Agent executable file. The permissions are set as such:
-rwsr-s--- 1 root dba 2986836 Jan 26 2005 dbsnmp
The problem with this file is that it needs root privileges to work properly, hence the SUID bit must be set to on. However, because this file is owned by root, hackers typically exploit it to gain access as root. The best advice is to eliminate it, or make it owned by the Oracle software owner and set the permissions to 700. You will lose some functionality, but it's worth it to eliminate the risk.
• lsnrctl—the utility that is used to manage the listener, such as starting, stopping, and so on
$ ls -l *lsnr*
-rwxr-x--x 1 orasoft oinstall 214720 Oct 25 01:23 lsnrctl
-rwxr-xr-x 1 orasoft oinstall 214720 Oct 1 18:50 lsnrctl0
-rwxr-x--x 1 orasoft oinstall 1118816 Oct 25 01:23 tnslsnr
-rwxr-xr-x 1 orasoft oinstall 1118816 Oct 1 18:50 tnslsnr0
the files have execute privileges for all. Like the executable oracleO, when a new file tnslsnr is created by relinking the Oracle software, the existing file tnslsnr is renamed to tnslsnr0. This is done because if the process needs to be rolled back, the old executable can be copied over the new one. Because it's the copy of the old executable, the file tnslsnr0 may contain the same functionality as the original tnslsnr. The same goes for lsnrctl0.
Now that you understand the purpose of each executable, let's see how you can secure your database infrastructure. Most of the strategy has been discussed in the above section on background information. So, in essence, your strategic moves are all these actions
$ chmod 700 lsnrctl tnslsnr lsnrctl0 tnslsnr0
$ chmod 600 lsnrctl0 tnslsnr0
$ ls -l *lsnr*
-rwx------ 1 orasoft oinstall 214720 Oct 25 01:23 lsnrctl
-rw------- 1 orasoft oinstall 214720 Oct 1 18:50 lsnrctl0
-rwx------ 1 orasoft oinstall 1118816 Oct 25 01:23 tnslsnr
-rw------- 1 orasoft oinstall 1118816 Oct 1 18:50 tnslsnr0
There are a few implications in this case:
Change permissions to 0700 1.5 Change DBSNMP Password
As you may know, Oracle Intelligent Agent communicates with Oracle Enterprise Manager to pass on information about components such as the database, the listener, and the server itself. To get data about the database, it needs to connect to the database using some userid. By default, the userid used is DBSNMP.
You have to change the password of this user to something other than dbsnmp. However, you can't just change the password at the database level, because that password is also stored in the agent configuration files. You need to update the configuration files to use the new password as well. Here's the procedure for Oracle Database 10g:
<Target TYPE="oracle_database" NAME="PROPRD1_prolin1">
<Property NAME="MachineName" VALUE="192.168.101"/>
<Property NAME="OracleHome" VALUE="/u01/app/oracle/10.1/db1"/>
<Property NAME="Port" VALUE="1521"/>
<Property NAME="Role" VALUE="NORMAL"/>
<Property NAME="SID" VALUE="PROPRD1"/>
<Property NAME="ServiceName" VALUE="PROPRD"/>
<Property NAME="UserName" VALUE="dbsnmp"/>
<Property NAME="password" VALUE="3797cf30e7c4a9c6" ENCRYPTED="TRUE"/>
<MemberOf TYPE="rac_database" NAME="PROPRD" ASSOCIATION="cluster_member"/>
Note this line (in bold type, above):
<Property NAME="password" VALUE="3797cf30e7c4a9c6" ENCRYPTED="TRUE"/>
This is where you will set the value of the password. Replace the above with
<Property NAME="password" VALUE="topsecret" ENCRYPTED="FALSE"/>
Note that you changed the value of ENCRYPTED to FALSE.
/u01/app/oracle/10.1/gridc/bin/emctl stop agent
Restart the agent:
/u01/app/oracle/10.1/gridc/bin/emctl stop agent
When you restart the agent, the cleartext password in the configuration file is encrypted. If you check the above line in the targets.xml file again, you will see something similar to the following:
<Property NAME="password" VALUE="3797cf30e7c4a9c6" ENCRYPTED="TRUE"/>
Note how the cleartext value has been converted to an encrypted value.
There are no user implications here.1.6 Limit SYSDBA Login
You might have noticed that any *nix user who is the member of the group dba can log in as the SYSDBA user by issuing this command:
sqlplus / as sysdba
This is usually taken as a matter of convenience, because you don't need to remember or enter the password of the user SYS. However, this also creates a vulnerability: Any user who can log in as a dba group member can log into the database as SYS. The fortified password of SYS is not of much use then. If you have a strong SYS account, you should perhaps protect that as well as the dba group users so that the password of SYS is necessary to log in as SYS. This approach does not eliminate the risk of infiltration but does reduce it considerably.
This process is controlled by the parameter SQLNET.AUTHENTICATION_SERVICES in the file SQLNET.ORA. If this parameter is set to NONE, then the auto login of the SYSDBA role is disabled. To disable it, place the following line in the SQLNET.ORA file located in the $ORACLE_HOME/network/admin directory.
From that point on, if a *nix user belonging to the group dba wants to connect using this familiar login:
$ sqlplus / as sysdba
they will get this:
ORA-01031: insufficient privileges
To connect, you must provide the SYS password:
$ sqlplus /nolog
SQL> connect sys/oracle as sysdba
This protects against someone who still does not know the SYS password from gaining access to the dba accounts.
As shown above, the biggest implication is the use of SYS passwords. You may need to make some changes to the scripts that connect to SYS.
Place SQLNET.AUTHENTICATION_SERVICES=(NONE) in the file SQLNET.ORA
1.7 Create a Listener Password
One of the most popular hacker tricks is to inject a large amount of text into the listener, thereby causing it to abort. The database could still be up, but since the listener is down, no new connections can be established—which in effect is a denial-of-service attack.
LSNRCTL> set displaymode verbose
LSNRCTL> services
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)
Services Summary...
Service "PROPRD" has 1 instance(s).
Instance "PROPRD1", status READY, has 1 handler(s) for this
"DEDICATED" established:0 refused:0 state:ready
ducts/10.1/db1/bin/racgmain,_USR_ORA_CONNECT_STR=/ as
application for
The best option is to remove all permissions from the executable files tnslsnr and lsnrctl except those for the owner. (This method has been described in the previous section.) This way no one except the Oracle software owner can start or stop the listener. The executables look like this:
-rwx------ 1 orasoft oinstall 214720 Oct 25 01:23 lsnrctl
-rwx------ 1 orasoft oinstall 1118816 Oct 25 01:23 tnslsnr
In some cases, you may want to grant the authority to start and stop the listener. In such a case, you have to turn on the permissions:
$ chmod 0711 lsnrctl
However, in such a case, you should prevent unauthorized use by enforcing a password. When you set a password, all commands—except some benign ones such as HELP—are disabled.
$ lsnrctl
LSNRCTL> change_password
Old password: <OldPassword> Not displayed
New password: <NewPassword> Not displayed
Reenter new password: <NewPassword> Not displayed
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=prolin1)(PORT=1521)(IP=FIRST)))
Password changed for LISTENER
The command completed successfully
If you are setting the password for the first time, you can press ENTER when asked for the "Old Password." After making the change, save it in the parameter file:
LSNRCTL> save_config
This command encrypts the password and places it in the listener parameter file. You can examine it later:
When you decide to use a command, you have to supply the right password (in Oracle Database 10g and later, the OS user who owns the software does not need a password):
LSNRCTL> services
Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
TNS-01169: The listener has not recognized the password
To pass the correct password, issue these commands:,
LSNRCTL> set password mypassword
The command completed successfully
LSNRCTL> status
Connecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))
STATUS of the LISTENER
Alias LISTENER
If you pass the wrong password, you will receive this error:
TNS-01169: The listener has not recognized the password.
If you do not pass the password and try executing a powerful command, you will receive this error:
TNS-01190: The user is not authorized to execute the requested listener command
To confirm that the password is in effect, view the setting in the STATUS display of the listener. To do so, issue this command:
$ lsnrctl status
The output varies between versions. For Oracle9i Database, here is a partial output:
STATUS of the LISTENER
Alias LISTENER
Version TNSLSNR for Solaris: Version 184.108.40.206.0 - Production
Start Date 25-OCT-2005 10:26:47
Uptime 0 days 13 hr. 8 min. 36 sec
Trace Level off
Security ON
Note the last line (Security ON), which indicates that the password is set.
STATUS of the LISTENER
Alias LISTENER_ODSPDB02
Version TNSLSNR for HPUX: Version 10.1.0.4.0 - Production
Start Date 16-OCT-2005 05:58:35
Uptime 9 days 17 hr. 44 min. 41 sec
Trace Level off
Security ON: Local OS Authentication
Note the last parameter, ON: Local OS Authentication which indicates that the password has not been set. When the password is set, the display will show that line as
Security ON: Password or Local OS Authentication
Note the additional clause above—Password— which indicates that a password has been set. In Oracle Database 11g Release 2, the password in listener.ora has been deprecated, so you shouldn't set a password at all. In other words, you should not issue any listener commands using any userid other than the Oracle Database software (or the Oracle Grid Infrastructure software) owner.
In Oracle Database 10g and later, there are no implications. OS authentication is used to authenticate the user, and there is no need to provide a password to start or stop the listener. In Oracle9i Database and earlier, you have to provide a password, and hence the script requires a password.
Set a password for the listener operations 1.8 Protect the Listener
Creating a buffer overflow—crashing the listener by sending a large string to be executed—is a common intruder tactic. Another popular one is to see the various components using SET DISPLAYMODE VERBOSE from the lsnrctl utility. In this case, the hacker may manipulate the settings by running lsnrctl on a vulnerable machine to administer the listener on the target server. Here's an example:
LSNRCTL> set trc_level support
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=prolin1)(PORT=1521)))
LISTENER parameter "trc_level" set to support
The command completed successfully
LSNRCTL> set trc_directory /tmp
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=prolin1)(PORT=1521)))
LISTENER parameter "trc_directory" set to /tmp
The command completed successfully
Because the trace level is SUPPORT, the listener generates a lot of information that you may not want the hacker to know. Also, because the trace files are written to the directory /tmp, he can easily see them as well. All this can be learned without even being on the server.
To protect the listener, the best option is to set a password. In addition, you can employ another approach: restricting the ability to set various parameters of the listener using the lsnrctl utility. In that case, the only way to change parameters is to set them in the listener configuration file and then reload it. To set these restrictions, you can place the following line in the listener.ora file:
and then restart the listener. Now, you can no longer use the SET command in the lsnrctl prompt to change a value. For example:
LSNRCTL> set trc_directory /hacker_dir
Connecting to (ADDRESS=(PROTOCOL=IPC)(KEY=PROPRD1))
TNS-12508: TNS:listener could not resolve the COMMAND given
Note the TNS-12508 error. From now on, to change a value of a parameter you must do so in listener.ora and then use the reload command:
LSNRCTL> reload
This is true for all Oracle versions discussed in this series.
The implications are negligible. Few users edit parameters online anyway; rather, they edit listener.ora and then reload the listener. Thus, this change will not affect them at all.
Place the parameter ADMIN_RESTRICTIONS_LISTENER = ON in the file listener.ora.
1.9 Trim Sweeping Privileges
A typical user needs privileges that are important to perform his or her job—nothing more nor less. As this policy may prove unrealistic, however, you may need to adopt a middle-of-the-road approach: removing the most-powerful privileges the users do not need.
First, identify all the privileges you consider innocuous (CREATE TYPE, CREATE SESSION, and so on). Here I have included UNLIMITED TABLESPACE as a nonsweeping privilege, but you may disagree:
set pages 50000
break on privilege skip 1
select privilege, grantee, admin_option
from dba_sys_privs
where privilege not in
/* list any other privilege here you don't find "sweeping"
and grantee not in
/* Place all the user names you want to exclude */
order by privilege, grantee
Here is part of a sample output:
--------------------------- ------------------------------ ---
_ and so on _
Note some of the key lines of the output. Some sweeping privileges—DROP ANY TABLE, for instance—probably shouldn't have been granted to anyone. In this case, let's see which users have this privilege.
This is one action you can't execute immediately. Before revoking any privilege from any user, you have to carefully analyze its impact.
This task requires some planning, so reserve any action for the next phase. Until then, collect the required information.1.10 Move Audit Trails to a Different Tablespace
When the audit trail is set to database and for fine-grained auditing trails, the trail records are stored in regular database tables—AUD$ and FGA_LOG$ under the SYS schema. They are located in the SYSTEM and SYSAUX tablespaces, respectively. Because records in these tables simply keep growing as activity increases, the space consumed by these special tablespaces also increases, which may not be desirable. If the system tablespace runs out of space, the database will abort.
create tablespace aud_ts
datafile '+DATA'
size 10M
segment space management auto
In Oracle Database 11g Release 2, moving these tables to a different tablespace is supported. Prior to this release, the move is officially not supported. This section pertains to Oracle Database 11g Release 2 only.
Move the AUD$ table to that tablespace:
audit_trail_type => dbms_audit_mgmt.audit_trail_aud_std,
audit_trail_location_value => 'AUD_TS');
If you want to move the FGA_LOG$ table as well, you can do so by executing the above PL/SQL block but replacing the parameter as shown below:
audit_trail_type => dbms_audit_mgmt.audit_trail_fga_std
Once executed, the tables will be moved to the AUD_TS tablespace.
The advantages are obvious—the audit trails are the only items that keep growing in the database based on usage, and hence moving it out of the SYSTEM and SYSAUX tablespaces is a desirable move.
SQL> conn arup/arup
ORA-00604: error occurred at recursive SQL level 1
ORA-00376: file 7 cannot be read at this time
ORA-01110: data file 7: '+DATA/d112d1/datafile/aud_ts.293.698028255'
ORA-02002: error while writing to audit trail
ORA-00604: error occurred at recursive SQL level 1
ORA-00376: file 7 cannot be read at this time
ORA-01110: data file 7: '+DATA/d112d1/datafile/aud_ts.293.698028255'
Warning: You are no longer connected to ORACLE.
To resolve it, you should bring the tablespace online (after fixing the underlying issue, of course). But what if the underlying issue is not resolvable immediately? Then you have no choice but to remove the audit settings. For instance, you can turn off auditing on session
SQL> noaudit session;
Noaudit succeeded.
Now if you try connecting, you will be successful:
SQL> conn arup/arup
Move the audit trail(s) to the new tablespace
Make sure that tablespace is online.
The content provided here is for instructional purposes only and is not validated by Oracle; use it at your own risk! Under no circumstances should you consider it to be part of a consulting or services offering.


text: (912) 634-1219 (912) 638-7673 WelcoWelcome to Capt. Mark Noble's Fishing Report. February 1, 2001 (912) 634-1219 (912) 638-7673 produced some very nice catches. We took a 3-man limit (45 fish) on three different days and came very close on others. The worst day we had was 17 fish. The Red Drums are also an addition on some days. These fish are holding near or in the same areas as the Trout. About 3 ½ pounds is the largest trout we have taken and 10 pounds on the Red fish. (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 (912) 634-1219 (912) 638-7673 The primary way to fish Tarpon here is by chumming with fresh pogies. After a chum slick is established, one never knows what might show up. I guess it's just like Christmas. Just the other day a 43 pound King fish was the gift of a good chum slick as well as other Kings in the 15 to 25 pound class on other days. Sharks, Jacks, and Spanish Mackerel also find this very attractive. We have been seeing large numbers of fish moving across the sand bars near the channels. Some fish have even taken bait at arms length from the boat and sky rocketing into the air and soaking you on re-entry. If you've never seen this before, I can think of nothing more exhilarating than a 190-pound chrome plated monster five feet in the air in side of your rod tip. I often have clients ask me when fighting these fish for a prolonged period of time, "Do these fish ever give up?" Unfortunately the answer is "NO". Many people give out before many large fish are caught. Once these fish get close to the boat, they will some time leap out of the water and dump a half of spool of line again so you have to start all over. If you want to try out this type of fishing, be prepared. This is not a Jane Fonda work out. The shark fishing is also peaking now. Fishing behind shrimp boats can yield some unbelievable action. Black Tips and Spinner Sharks make up the bulk of action with Browns and Bull Sharks filling in when the Black Tips are not paying attention and get beat to the bait. Fish size range from 35 lbs to 200 lbs, plus. This can be fast and furious action with multiple hook ups. A 100 to 200 yard run is common and a fast motor for a fish with a bad attitude is a must. Some fish don't know when to stop running and line becomes limited in a flash. This is not "powder puff fishing", just like the Tarpon. Get your mind set on a fight and your body ready. Once again I had a client say, "I've never had a fish put a whipping on me!" Well, this client had never met Mr. Black Tip. An hour and a half later my client put this statement behind him. I didn't even say, "I told you so". The look one gets on his face is self evident like an understood language where words are not used. Well for the less adventurous angler the Trout, Red Drum and Flounder bite is on. Twenty to 60 fish days are common, but many trout and reds are undersized. These trips are action packed which often produce Jacks, Lady Fish and Sharks, spicing up the bite. For the fly fisherman, good action can be found targeting Jacks, Spanish Mackerel and Blue Fish. If you have never seen the backing on your reel before, bring it and we will be more than happy to show you that it is on your reel. Tarpon are also a possibility so bring a 9-weight and a 12-weight rod and plenty of flies. Clousers in the glass minnow pattern or a shrimp pattern works well. Green and white, pink and blue/white with Mylar works also. The best areas to fish have been on bars and rips. Chumming is an option, and the Lady Fish, Jacks, and Blue fish have a hard time ignoring a fly in this situation. If you want to fly fish here, come with only your fly rod and flies and structure the entire trip for this type of fishing for best results. The offshore fishing for King Mackerel has slowed down somewhat. The bottom fishing still remains good. B-liners, Red Snappers and some nice Grouper are being caught now. As for me lately, I have been targeting the near shore action because there is less running time and more fishing time. Well that's a quick run down on what is happening now. I hope this report is somewhat disturbing to the ones who read it that have not been fishing in awhile. And if it is, give me a call and let's see if we can scratch that itch "The fishing itch". If you are planning to come to St. Simons Island, Georgia, stop by Capt. Mark Noble's Fishing Center and meet the staff. Also check out some great fishing t-shirts. All shirts are on special and make a great Christmas gift. Let us take care of your fishing needs. Keep a tight line. (912) 638-7673 e can sure tell that summer has arrived in the Golden Isles. The thermometer is rising and so is the water temperature. The fish can feel it too! The action has really picked up over the past few weeks. Big tarpon have arrived in this area and the bite has been great. We've been catching fish anywhere from 60 to 180 pounds. These fish will really test your fishing skills with spectacular jumps and fast, long runs. Tarpon are a premier game fish, so be sure to bring along a camera. At the same time we're tarpon fishing, we have been catching a vast array of sharks of all sizes. The average size has been about 150 pounds with some big brutes in excess of 300 pounds being hooked. Black tip sharks, bonnet heads, brown, and bull sharks are the main species being caught. We've been fishing behind the shrimp boats for black tips and the waters behind the boats are usually loaded with them. They are acrobatic and real tackle busters. The sharks will test the stamina of any angler. If it's eating fish you're after, very few fish fry up as good as whiting. While whiting don't get huge, they put up a good fight on light spinning tackle using shrimp for bait. We've also been catching a large quantity of spanish mackerel. The fish are real fighters on light tackle. Because of their sharp teeth, a wire leader is advisable. Silver spoons have been working real well for these fish. Spanish average 2 to 3 pounds but fish over 5 pounds have been caught this month. As with the whiting, spanish make an excellent meal either fried or grilled. We don't want to leave out our fine inshore fishing. We've had good success catching hard fighting speckled sea trout and flounder. Fighting these fish on light tackle is an adventure and cooking and eating them is almost as enjoyable as catching them. Live shrimp are the best bait, but these fish have been more than eager to strike various jigs, too. I'll be fishing every day and will keep you posted. If you would like to fish with me or would like more information, give me a call. Capt. Mark Noble (912) 634-1219. Good fishing and keep a tight line. (912) 634-1219 ishing report for St. Simons Island, Sea Island and Jekyll Island Georgia. |


text:
Please use this identifier to cite or link to this item:
Title: | Unlikely Marriages: An Examination of Customer-Visible Partnerships Between Prestige Brands and Mass-Market Distributors |
Authors: | Fetherstone, Julia Discipline of International Business |
Issue Date: | 23-Jul-2009 |
Abstract: | The prestige goods industry is founded on exclusivity and premium pricing. The challenge for the industry is extracting that premium from the greatest possible number of consumers (the mass-market), while retaining the exclusivity that permits the extraction of that premium. Prestige / mass-market partnerships (PMMP) – one-off, co-branded partnerships between prestige designers and mass-market clothing retailers are increasingly used by participants in the industry to negotiate that precarious balance between volume sales and premium pricing. Exclusivity is the key source of competitive advantage for prestige brands; that exclusivity would appear to be prima facie compromised by undertaking a PMMP. A review of the literature in branding, strategy and organisational research, it was found that none of these schools would direct a prestige partner to undertake a PMMP. Yet PMMPs persist and proliferate in the fashion industry. Either the prestige partners need a new strategy or researchers need a new paradigm, or both. The question is: which is it? This thesis has used a single case narrative to get inside a PMMP through the voice of the designer. It then provided three separate expert readings of that narrative. Those expert readings were found to have some explanatory power in relation to PMMPs but were unable to capture the rich tapestry of drivers on the prestige partner side. The dominant paradigms neglect the entrepreneur as a unit of analysis, over-rely on rational, linear models to explain a phenomenon that defies such categorization, and fail to appreciate the highly-specific context of the prestige fashion industry. iv To achieve this end, the literature on entrepreneurial opportunism was introduced. From the prestige side, PMMPs can be conceived of as four related opportunity events – creative, business, learning and personal. Next, structuration theory was introduced as a means to analyse the context surrounding PMMPs. It was found that the designers is both constrained and enabled by the prestige fashion context; some counter-orthodox behaviour is permitted, and indeed encouraged, but the limits of acceptability are still clearly defined by the community of practitioners. To capture the interaction between the entrepreneur, the opportunity and the context analysis, a model of drivers based on Sahlman's (1996) PCDO model was proposed. This thesis has found that the drivers motivating prestige designers to enter PMMPs are significantly more nuanced and less linear than convention structure-strategy analyses might wish. Starting with the entrepreneur as the central unit of analysis is the most effective way to capture the range of drivers that stimulate a designer towards a PMMP. |
URI: | http://hdl.handle.net/2123/5314 |
Department/Unit/Centre: | Discipline of International Business |
Rights and Permissions: | The author retains copyright of this thesis |
Type of Work: | Thesis, Honours |
Appears in Collections: | Honours Theses |
This work is protected by Copyright. All rights reserved. Access to this work is provided for the purposes of personal research and study. Except where permitted under the Copyright Act 1968, this work must not be copied or communicated to others without the express permission of the copyright owner. Use the persistent URI in this record to enable others to access this work.
File | Description | Size | Format | |
ughons08_fetherston_305177990_VOL I.pdf | Part I | 1.65 MB | Adobe PDF | View/Open |
ughons08_fetherston_305177990_VOL II.pdf | Part II | 1.44 MB | Adobe PDF | View/Open |
Items in Sydney eScholarship Repository are protected by copyright, with all rights reserved, unless otherwise indicated.


text:
Place a classified ad online
Classified Categories Happy Ads Announcements Auctions Autos/Vehicles Employment Free/Lost & Found Garage Sales Legal Notices Misc. for sale Pets/Animals Real Estate Rentals Services Wanted
Classified Rates & Info
[click on Real Estate ad for more info about advertiser]
All real estate advertised in the Lincoln Daily News is subject to the Fair Housing Act for 1968 which makes it illegal to advertised "any preference, limitation, or discrimination based on race, color, religion, sex or national origin, or intention to make special preference, limitations, or discrimination."
We will not knowingly accept any advertising for real estate which is in violation of the law. All persons are hereby informed that all dwellings advertised are available on an equal opportunity basis.
Real Estate [see Publisher's Notice)
319 N. Mason St., Mason City
4 Bedroom, 2-Story Home on 2 Large Lots
Coldwell Banker Cornerstone 217-732-8353 To see all our listings click here [click on image for larger version]
415 N. Mason St., Mason City
3 Bedroom, 2-Story Home. $34,900.
Coldwell Banker Cornerstone 217-732-8353 To see all our listings click here
225 Regent Drive
Open House Saturday February 2, 2013 11:00 AM - 12:00 PM
LOVELY 2-3 BEDROOM, 2 FULL BATH MAYFAIR RANCH Main Floor living: beautiful living room with open staircase leading to finished lower level; two bedrooms with hardwood; updated full hall bath; abundant storage; large kitchen/dining; Lower level: fantastic living quarters; finished full bath; third bedroom/den area; monstrous family room; abundant storage; laundry facilities; Features; finished breezeway with front and rear entrances connects home to garage; privacy fence; roomy backyard; storage shed; mature trees; Updates: newer vinyl siding, windows, roof, and improved landscaping.
To see more of this home and other listings visit my website! www.sethsellslincoln.com
202 N Drewley Street, Atlanta
Open House Saturday February 2, 2013 1:00 PM - 2:00 PM
ABSOLUTELY ADORABLE 3 BEDROOM, 1.5 BATH HOME! Main floor: large living room; formal dining room; efficient kitchen (range/oven and refrigerator to be installed prior to closing -- will remain upon settlement); bedroom/den area; rear laundry/back porch area; remodeled full bath; Upstairs: two bedrooms; half bath; Solid six panel interior doors; 58X130 lot; Features; partial basement for storage; covered back patio; attached garage with ample storage space; Updates: roof, newer vinyl windows throughout, updated light fixtures, some flooring; interior plumbing, interior trim, fresh paint throughout;
News | Sports | Business | Rural Review | Teaching & Learning | Home and Family | Tourism | Obituaries
Community | Perspectives | Law & Courts | Leisure Time | Spiritual Life | Health & Fitness | Teen Scene Calendar | Letters to the Editor


text:
- //Home
- //DVDs
- //Reviews
- //Mike Patton | John Erik Kaada
"I think it's time for a round of applause for the composer, Mr. John Kaada. It's his world: we just live in it." —Mike Patton during the live performance
If there's any act that warrants the live performance DVD treatment, a one-off side-project by Mike Patton and Kaada is probably one of the last possibilities that comes to mind.
Patton, of course, is the former frontman of rap-rock pioneers Faith No More, later setting up defiantly avant-garde label Ipecac Recordings in the wake of FNM's demise. John Erik Kaada, meanwhile, is a well-regarded film composer in Norway who then released one of the most fascinating mash-ups of samples and electronica in recent memory with his 2003 debut album Thank You For Giving Me Your Valuable Time. That excellent album was released on Ipecac, and it was quite obvious that Patton saw what the immensely talented Kaada was capable of.
The two made an album together—2004's Romances—and it turned out to be abstract even for Ipecac's usual standards: swooping orchestral sounds reminiscent of a 1940s horror film, the occasional appearance of hard rock guitars, time-signature changes that would make even the Mars Volta envious, and—most notably—practically no lyrics to speak of (the times they did appear, they were in short, repeated phrases like "One is for the money / They say two is for the show / Three to get ready / But I don't want to go"). It's the definition of a niche album, yet Patton felt compelled to document its one-time-only performance of it at the 2005 Roskilde Festival (where Patton himself was also busy performing with Fantomas and Rahzel).
The most remarkable thing about the live performance is how the duo—along with Kaada's longtime backing band Cloroform—actually manages to replicate the album near perfectly on stage. Every note, ghostly sound effect, and slide-guitar intro is there in full glory. Yet even though the compositions are almost entirely written by Kaada, it's Patton who steals the show. Still regarded as one of the best rock vocalists working today, Patton drives every single song home, largely because he has the inhuman capability of hitting every single note with perfection, often sounding exactly like he does on the studio recording. The live DVD does an excellent job of capturing Patton at his peak, and is worth the price of admission if not just for that alone.
Yet there's something odd about the performance of Romances: because it is a reenactment of the original LP, the performance actually inherits all of the downsides that the album was cursed with from the start. Mainly: elliptical song structures.
Though there are significant changes in the beginnings and endings of each piece, the songs are still largely based on a single repeated melody line that often spirals out into the ether, never fully landing on the listener's ears. This is particularly apparent on "Crepuscule", in which—due to any sort of rising action—it feels as if the song is re-starting itself again and again and again.
Though "Pitie Pour Mes Larmes" has an opening that sounds oddly like a lost track from great '90s pop-rockers Jellyfish, the track soon gets lost in its own introverted world of bell clicks and chain rattles. The Hawaiian slack guitar that opens "Viens, Les Gazons Sont Verts" soon gives way to an abstract national anthem of some country that has yet to exist.
Ultimately, the whole thing would come off as some long, indulgent jam-session if it wasn't so meticulously planned to begin with. The songs by themselves work fine, but as a performance, we never get any sort of climax or even a proper resolution. Even the set-closing piece, "The Cloroform Theme", feels like just another song the group happened to pull out of their catalog.
For those who want a glimpse into the creative process of these two musical juggernauts, there are at least a few things than can be taken away from the short rehearsal film included. Much like the concert movie itself, the rehearsal footage is filmed entirely in a grainy black-and-white, furthering the haunting/nostalgic vibe of the music. The band is tight to begin with, and Kaada appears to only want to resolve any transition problems that may come up during the performance itself (amending keyboard melodies to give Patton more of a proper lead-in, for example).
Occasionally we break to see Patton and Kaada chatting with each other, and their conversations are inexplicably subtitled (Kaada speaks fine English – English language viewers only really need subtitles when he's speaking in his native tongue with his band). At one early point, Patton asks, "What do you think, Maestro?" to which Kaada humbly replies, "I'm surprised it works at all. The album [Romances] is based more on sounds than melodies." And Kaada is correct in this statement: it does work, but only as individual moments. As an album, it's quite a demanding listen.
Ultimately, Kaada/Patton Live is an intriguing DVD that will easily fulfill the desires of Patton fans, avant-garde appreciators, and those who just enjoy the flat-out weird. For everyone else, a listen of Romances is in order before you can consider giving Live a watch. It's certainly not for everybody, but as Patton & Kaada both acknowledge, it was never intended to be.
Call for Essays About Any Aspect of Popular Culture, Present or Past
// Announcements
"PopMatters seeks essays (1,200 to 3,000 words, usually) about any aspect of popular culture, present or past.
READ the article


text:
PDF Signet allows you sign PDFs with your X.509 certificate without any hassle -- simply pick the certificate from your Keychain and sign. Verifying existing signatures is even simpler: just drop a PDF on the app.
- Digitally sign PDFs documents with X.509 certificates
- Verify and validate already present signatures
- Use your certificate directly from Keychain
- Automator support -- sign documents automatically as you create them
What's New
Version 1.3.2:
- Fixed compatibility with certificates without Common Name.
- OS X 10.7 or later
Similar Software
Open Comparison
Suggest Other Similar Software


text:
FreeBSD Man Pages
home | helpTUNEFS(8) FreeBSD System Manager's Manual TUNEFS(8) NAME tunefs -- tune up an existing file system SYNOPSIS tunefs [-A] [-a maxcontig] [-d rotdelay] [-e maxbpg] [-f avgfilesize] [-m minfree] [-n enable | disable] [-o space | time] [-p] [-s avgfpdir] [special | filesystem] DESCRIPTION Tunefs is designed to change the dynamic parameters of a file system which affect the layout policies. The parameters which are to be changed are indicated by the flags given below: -A The file system has several backups of the super-block. Specify- ing this option will cause all backups to be modified as well as the primary super-block. This is potentially dangerous - use with caution. -a maxcontig Specify the maximum number of contiguous blocks that will be laid out before forcing a rotational delay (see -d below). The default value is one, since most device drivers require an inter- rupt per disk transfer. Device drivers that can chain several buffers together in a single transfer should set this to the max- imum chain length. -d rotdelay Specify the expected time (in milliseconds) to service a transfer completion interrupt and initiate a new transfer on the same disk. It is used to decide how much rotational spacing to place between successive blocks in a file. -e maxbpg Indicate the maximum number of blocks any single file can allo- cate out of a cylinder group before it is forced to begin allo- cating blocks from another cylinder group. Typically this value is set to about one quarter of the total blocks in a cylinder group. The intent is to prevent any single file from using up all the blocks in a single cylinder group, thus degrading access times for all files subsequently allocated in that cylinder group. The effect of this limit is to cause big files to do long seeks more frequently than if they were allowed to allocate all the blocks in a cylinder group before seeking elsewhere. For file systems with exclusively large files, this parameter should be set higher. -f avgfilezsize Specify the expected average file size. -m minfree Specify the percentage of space held back from normal users; the minimum free space threshold. The default value used is 8%. This value can be set to zero, however up to a factor of three in throughput will be lost over the performance obtained at a 10% threshold. Settings of 5% and less force space optimization to always be used which will greatly increase the overhead for file writes. Note that if the value is raised above the current usage level, users will be unable to allocate files until enough files have been deleted to get under the higher threshold. -n enable | disable Turn on/off soft updates. An unmounted filesystem is required. -o space | time The file system can either try to minimize the time spent allo- cating blocks, or it can attempt to minimize the space fragmenta- tion on the disk. Optimization for space has much higher over- head for file writes. The kernel normally changes the preference automatically as the percent fragmentation changes on the file system. -p Show a summary of what the current tunable settings are on the selected file system. More detailed information can be obtained in the dumpfs(8) manual page. -s avgfpdir Specify the expected number of files per directory. ERRORS If tunefs -n is run to enable/disable soft update on an unmounted file system after booting single-user then tunefs will output the warning reload: Invalid argument preceded by the raw device name. This occurs because the filesystem is not currently mounted read-only. tunefs is trying to reload the incore (r*) device, but it was never loaded to begin with. When you boot single user, only ``/'' is mounted, so all other filesystems will give you that warning. It is completely harmless. SEE ALSO fs(5), dumpfs(8), newfs(8) M. McKusick, W. Joy, S. Leffler, and R. Fabry, "A Fast File System for UNIX", ACM Transactions on Computer Systems 2, 3, pp 181-197, August 1984, (reprinted in the BSD System Manager's Manual, SMM:5). BUGS This program should work on mounted and active file systems. Because the super-block is not kept in the buffer cache, the changes will only take effect if the program is run on dismounted file systems. To change the root file system, the system must be rebooted after the file system is tuned. You can tune a file system, but you can't tune a fish. HISTORY The tunefs command appeared in 4.2BSD. FreeBSD 10.1 December 11, 1993 FreeBSD 10.1
Want to link to this manual page? Use this URL:


text:
Discover our solution in video
We offer you a learning solution at the edge of Technology.
Choose one of our specific and tailored-made training that suits you the best.
English has become essential and is generally used as the international language in a leisure and working environment. Please discover it, learn it, and improve your English language skills.
There is nothing certain, but French remains a major language in the world and this is why we are offering French courses for beginners, advanced students and improvers.
Today, we can count more than 28 million people speaking Deutsch on earth. Join them and discover this language mainly used in Belgium, in Netherlands, in the north of France and in Suriname.