text:
Difference between revisions of "Sudo"
m (→Display User Privileges: - edited to fit 1280x1024 monitors without overflow)
m (changed editor from vim to nano -- new user is more likely to have this, and it is easier to use)
|Line 55:
|Line 55:
The default editor for visudo is {{ic|vi}}. It will be used if you do not specify another editor, by setting either VISUAL or EDITOR environment variables (used in that order) to the desired editor, e.g. {{ic|vim}}. The command is run as root:
The default editor for visudo is {{ic|vi}}. It will be used if you do not specify another editor, by setting either VISUAL or EDITOR environment variables (used in that order) to the desired editor, e.g. {{ic|vim}}. The command is run as root:
# =visudo
You can permanently change the setting for your user to e.g. {{ic|vim}} by appending:
You can permanently change the setting for your user to e.g. {{ic|vim}} by appending:
export =
to your {{ic|~/.bashrc}} file. Note that this won't take effect for already-running shells.
to your {{ic|~/.bashrc}} file. Note that this won't take effect for already-running shells.
|Line 68:
|Line 68:
Defaults env_reset
Defaults env_reset
# Set default EDITOR to vim, and do not allow visudo to use EDITOR/VISUAL.
# Set default EDITOR to vim, and do not allow visudo to use EDITOR/VISUAL.
Defaults editor=
Defaults editor=, !env_editor
=== Example Entries ===
=== Example Entries ===
Revision as of 00:03, 30 October 2013
zh-CN:Sudo Template:Article summary start Template:Article summary text Template:Article summary heading Template:Article summary text Template:Article summary end
sudo ("substitute user do") allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.
- 1 Rationale
- 2 Installation
- 3 Usage
- 4 Configuration
- 5 Tips and tricks
- 6 Troubleshooting
Sudo is an alternative to su for running commands as root. Unlike su, which launches a root shell that allows all further commands root access, sudo instead grants temporary privilege escalation to a single command. By enabling root privileges only when needed, sudo usage reduces the likelyhood that a typo or a bug in an invoked command will ruin the system. Sudo can also be used to run commands as other users; additionally, sudo logs all commands and failed access attempts for security auditing.
Install the sudo package, available in the official repositories:
# pacman -S sudo
To begin using
sudo as a non-privileged user, it must be properly configured. So make sure you read the configuration section.
With sudo, users can prefix commands with
sudo to run them with superuser (or other) privileges.
For example, to use pacman:
$ sudo pacman -Syu
See the sudo manual for more information.
View current settings
sudo -ll to print out the current sudo configuration.
Using visudo
The configuration file for sudo is
/etc/sudoers. It should always be edited with the
visudo command.
visudo locks the
sudoers file, saves edits to a temporary file, and checks that file's grammar before copying it to
sudoers be free of syntax errors! Any error makes sudo unusable. Always edit it with
visudo to prevent errors.
The default editor for visudo is
vi. It will be used if you do not specify another editor, by setting either VISUAL or EDITOR environment variables (used in that order) to the desired editor, e.g.
vim. The command is run as root:
# EDITOR=nano visudo
You can permanently change the setting for your user to e.g.
vim by appending:
export EDITOR=nano
to your
~/.bashrc file. Note that this won't take effect for already-running shells.
To change the editor of choice permanently system-wide only for
visudo, add the following line to
/etc/sudoers where
vim is your prefered editor:
# Reset environment by default Defaults env_reset # Set default EDITOR to vim, and do not allow visudo to use EDITOR/VISUAL. Defaults editor=nano, !env_editor
Example Entries
To allow a user to gain full root privileges when he/she precedes a command with
sudo, add the following line:
To allow a user to run all commands as any user but only the machine with hostname HOST_NAME:
To allow members of group
wheel sudo access:
%wheel ALL=(ALL) ALL
To disable asking for a password for user USER_NAME:
Defaults:USER_NAME !authenticate
Enable explicitly defined commands only for user USER_NAME on host HOST_NAME:
USER_NAME HOST_NAME=/usr/bin/halt,/usr/bin/poweroff,/usr/bin/reboot,/usr/bin/pacman -Syu
%wheel line if your user is in this group.
Enable explicitly defined commands only for user USER_NAME on host HOST_NAME without password:
USER_NAME HOST_NAME= NOPASSWD: /usr/bin/halt,/usr/bin/poweroff,/usr/bin/reboot,/usr/bin/pacman -Syu
A detailed sudoers example can be found here. Otherwise, see the sudoers manual for detailed information.
Sudoers default file permissions
The owner and group for the sudoers file must both be 0. The file permissions must be set to 0440. These permissions are set by default, but if you accidentally change them, they should be changed back immediately or sudo will fail.
# chown -c root:root /etc/sudoers # chmod -c 0440 /etc/sudoers
Password cache timeout
Users may wish to change the default timeout before the cached password expires. This is accomplished with the timestamp_timeout option in
/etc/sudoers which is in minutes.
Set timeout to 20 minutes.
Defaults:USER_NAME timestamp_timeout=20
Tips and tricks
File example
This example is especially helpful for those using terminal multiplexers like screen, tmux, or ratpoison, and those using sudo from scripts/cronjobs:
Cmnd_Alias WHEELER = /usr/bin/lsof, /bin/nice, /bin/ps, /usr/bin/top, /usr/local/bin/nano, /usr/bin/ss, /usr/bin/locate, /usr/bin/find, /usr/bin/rsync Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/nice, /usr/bin/ionice, /usr/bin/top, /usr/bin/kill, /usr/bin/killall, /usr/bin/ps, /usr/bin/pkill Cmnd_Alias EDITS = /usr/bin/vim, /usr/bin/nano, /usr/bin/cat, /usr/bin/vi Cmnd_Alias ARCHLINUX = /usr/bin/gparted, /usr/bin/pacman root ALL = (ALL) ALL USER_NAME ALL = (ALL) ALL, NOPASSWD: WHEELER, NOPASSWD: PROCESSES, NOPASSWD: ARCHLINUX, NOPASSWD: EDITS Defaults !requiretty, !tty_tickets, !umask Defaults visiblepw, path_info, insults, lecture=always Defaults loglinelen = 0, logfile =/var/log/sudo.log, log_year, log_host, syslog=auth Defaults email@example.com, mail_badpass, mail_no_user, mail_no_perms Defaults passwd_tries = 8, passwd_timeout = 1 Defaults env_reset, always_set_home, set_home, set_logname Defaults !env_editor, editor="/usr/bin/vim:/usr/bin/vi:/usr/bin/nano" Defaults timestamp_timeout=360 Defaults passprompt="Sudo invoked by [%u] on [%H] - Cmd run as %U - Password for user %p:"
Enabling Tab-completion in Bash
Tab-completion, by default, will not work when a user is initially added to the sudoers file. For example, normally john only needs to type:
$ fire<
and the shell will complete the command for him as:
$ firefox
If, however, john is added to the sudoers file and he types:
$ sudo fire<
the shell will do nothing.
To enable
Tab-completion with sudo, install the bash-completion package from the official repositories. see bash#Tab_completion for more information.
Alternatively, add the following to your
complete -cf sudo
Run X11 apps using sudo
To allow sudo to start graphical application in X11, you need to add:
Defaults env_keep += "HOME"
to visudo.
Disable per-terminal sudo
If you are annoyed by sudo's defaults that require you to enter your password every time you open a new terminal, disable tty_tickets:
Defaults !tty_tickets
Environment variables
If you have a lot of environment variables, or you export your proxy settings via
export http_proxy="...", when using sudo these variables do not get passed to the root account unless you run sudo with the
-E option.
$ sudo -E pacman -Syu
The recommended way of preserving environment variables is to append them to
Defaults env_keep += "ftp_proxy http_proxy https_proxy no_proxy"
Passing aliases
If you use a lot of aliases, you might have noticed that they do not carry over to the root account when using sudo. However, there is an easy way to make them work. Simply add the following to your
~/.bashrc or
alias sudo='sudo '
Users can configure sudo to display clever insults when an incorrect password is entered instead of printing the default "wrong password" message. Find the Defaults line in
/etc/sudoers and append "insults" after a comma to existing options. The final result might look like this:
#Defaults specification Defaults insults
To test, type
sudo -K to end the current session and let sudo ask for the password again.
Root password
Users can configure sudo to ask for the root password instead of the user password by adding "rootpw" to the Defaults line in
Defaults timestamp_timeout=0,rootpw
Disable root login
With sudo installed and configured, users may wish to disable the root login. Without root, attackers must first guess a user name configured as a sudoer as well as the user password.
The account can be locked via
# passwd -l root
A similar command unlocks root.
$ sudo passwd -u root
Alternatively, edit
/etc/shadow and replace the root's encrypted password with "!":
To enable root login again:
$ sudo passwd root
kdesu may be used under KDE to launch GUI applications with root privileges. It is possible that by default kdesu will try to use su even if the root account is disabled. Fortunately one can tell kdesu to use sudo instead of su. Create/edit the file
[super-user-command] super-user-command=sudo
When disabling the root account, it is necessary to change the PolicyKit configuration for local authorization to reflect that. The default is to ask for the root password, so that must be changed. With polkit-1, this can be achieved by editing
/etc/polkit-1/localauthority.conf.d/50-localauthority.conf so that
AdminIdentities=unix-user:0 is replaced with something else, depending on the system configuration. It can be a list of users and groups, for example:
For more information, see
man pklocalauthority.
Even with the above PolicyKit configuration you still need to configure a policy for NetworkManager. This is documented on the NetworkManager page of this wiki.
SSH TTY Issues
SSH does not allocate a tty by default when running a remote command. Without a tty, sudo cannot disable echo when prompting for a password. You can use ssh's
-tt option to force it to allocate a tty (or
-t twice).
Defaults option
requiretty only allows the user to run sudo if they have a tty.
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear text. You have to run "ssh -t hostname sudo <cmd>". # #Defaults requiretty
Display User Privileges
You can find out what privileges a particular user has with the following command:
$ sudo -lU yourusename
Or view your own with:
$ sudo -l
Matching Defaults entries for yourusename on this host: loglinelen=0, logfile=/var/log/sudo.log, log_year, syslog=auth, firstname.lastname@example.com, mail_badpass, mail_no_user, mail_no_perms,env_reset, always_set_home, tty_tickets, lecture=always, pwfeedback, rootpw, set_home User yourusename may run the following commands on this host: (ALL) ALL (ALL) NOPASSWD: /usr/bin/lsof, /bin/nice, /usr/bin/su, /usr/bin/locate, /usr/bin/find, /usr/bin/rsync, /usr/bin/strace, (ALL) /bin/kill, /usr/bin/nice, /usr/bin/ionice, /usr/bin/top, /usr/bin/killall, /usr/bin/ps, /usr/bin/pkill (ALL) /usr/bin/gparted, /usr/bin/pacman (ALL) /usr/local/bin/synergyc, /usr/local/bin/synergys (ALL) /usr/bin/vim, /usr/bin/nano, /usr/bin/cat (root) NOPASSWD: /usr/local/bin/synergyc
Permissive Umask
Sudo will union the user's umask value with its own umask (which defaults to 0022). This prevents sudo from creating files with more open permissions than the user's umask allows. While this is a sane default if no custom umask is in use, this can lead to situations where a utility run by sudo may create files with different permissions than if run by root directly. If errors arise from this, sudo provides a means to fix the umask, even if the desired umask is more permissive than the umask that the user has specified. Adding this (using
visudo) will override sudo's default behavior:
Defaults umask = 0022 Defaults umask_override
This sets sudo's umask to root's default umask (0022) and overrides the default behavior, always using the indicated umask regardless of what umask the user as set.
Defaults Skeleton
The authors site has a list of all the options that can be used with the
Defaults command in the
/etc/sudoers file.
The full list of options (parsed from the version 1.8.7 source code) is below in a format optimized for copying and pasting into your sudoers files for quick editing.
#Defaults always_set_home # If enabled, sudo will set the HOME environment variable to the home directory of the target user # (which is root unless the -u option is used). This effectively means that the -H option # always_set_home is only effective for configurations where either env_reset is disabled or HOME is present # in the env_keep list. Default: OFF #Defaults authenticate # If set, users must authenticate themselves via a password (or other means of authentication) # before they may run commands. This default may be overridden via the PASSWD and NOPASSWD #Defaults closefrom_override # If set, the user may use sudo's -C option which overrides the default starting # point at which sudo begins closing open file descriptors. Default: OFF #Defaults compress_io # If set, and sudo is configured to log a command's input or output, the I/O logs will be # compressed using zlib. This flag is on by default when sudo is compiled with zlib support. #Defaults env_editor # If set, visudo will use the value of the EDITOR or VISUAL environment variables before falling back on the default # editor list. Note that this may create a security hole as it allows th separated list of editors in the editor # variable. visudo will then only use the EDITOR or VISUAL if they match a value specified in editor. On by default. #Defaults env_reset # If set, sudo will run the command in a minimal environment containing the TERM, PATH, HOME, MAIL, SHELL, LOGNAME, # USER, USERNAME and SUDO_* variables. Any variables in the caller's env in the file specified by the env_file # option (if any). The default contents of the env_keep and env_check lists are displayed when sudo is run by # root with the -V option. #Defaults fast_glob # Normally, sudo uses the glob(3) function to do shell-style globbing when matching path names. # However, since it accesses the file system, glob(3) can take a long time to complete for som (automounted). # The fast_glob option causes sudo to use the fnmatch(3) function, which does not access the file system to do # its matching. The disadvantage of fast_glob is that it is unable to ma names that include globbing characters # are used with the negation operator, '!', as such rules can be trivially bypassed. As such, this option should # not be used when sudoers contains rules that #Defaults fqdn # Set this flag if you want to put fully qualified host names in the sudoers file. I.e., instead of myhost you # would use myhost.mydomain.edu. You may still use the short form if you wish (and sudo unusable if DNS stops # working (for example if the machine is not plugged into the network). Also note that you must use the # host's official name as DNS knows it. That is, you may not use a all aliases from DNS. If your machine's # host name (as returned by the hostname command) is already fully qualified you shouldn't need to set fqdn. # Default: OFF #Defaults ignore_dot # If set, sudo will ignore '.' or '' (current dir) in the PATH environment variable; the PATH # itself is not modified. Default: OFF #Defaults ignore_local_sudoers # If set via LDAP, parsing of /etc/sudoers will be skipped. This is intended for Enterprises that wish to prevent # the usage of local sudoers files so that only LDAP is used. /etc/sudoers does not even need to exist. # Since this option tells sudo how to behave when no specific LDAP entries have been matched, this sudo # Option is only meaningful for the cn=default #Defaults insults # If set, sudo will insult users when they enter an incorrect password. Default: OFF #Defaults log_host # If set, the host name will be logged in the (non-syslog) sudo log file. Default: OFF #Defaults log_input # If set, sudo will run the command in a pseudo tty and log all user input. If the standard # input is not connected to the user's tty, due to I/O redirection or because the command is part Input is logged # to the directory specified by the iolog_dir option (/var/log/sudo-io by default) using a unique session ID that # is included in the normal sudo log line, prefixed with TSID=. Note that user input may contain sensitive # information such as passwords (even if they are not echoed to the screen), which will be stored in the log file # unencrypted. #Defaults log_output # If set, sudo will run the command in a pseudo tty and log all output that is sent to the # screen, similar to the script(1) command. If the standard output or standard error is not connec is also captured and # stored in separate log files. Output is logged to the directory specified by the iolog_dir option (/var/log/sudo-io # by default) using a unique session ID that is included in the normal sudo log line, prefixed with TSID=. The Output # logs may be viewed with the sudoreplay(8) utility, which can also be used to list or search the available logs. #Defaults log_year # If set, the four-digit year will be logged in the (non-syslog) sudo log file. Default: OFF #Defaults long_otp_prompt # When validating with a One Time Password (OTP) scheme such as S/Key or OPIE, a two-line # prompt is used to make it easier to cut and paste the challenge to a local window #Defaults mail_always # Send mail to the mailto user every time a users runs sudo. Default: OFF #Defaults mail_badpass # Send mail to the mailto user if the user running sudo does not enter the correct password. # Default: OFF #Defaults mail_no_host # If set, mail will be sent to the mailto user if the invoking user exists in the sudoers # file, but is not allowed to run commands on the current host. Default: OFF #Defaults mail_no_perms # If set, mail will be sent to the mailto user if the invoking user is allowed to use sudo # but the command they are trying is not listed in their sudoers file entry or is explicitly denied #Defaults mail_no_user # If set, mail will be sent to the mailto user if the invoking user is not in the sudoers file. # Default: ON #Defaults noexec # If set, all commands run via sudo will behave as if the NOEXEC tag has been set, unless overridden # by a EXEC tag. See the description of NOEXEC and EXEC below as well as the "PREVENTING SHE #Defaults path_info # Normally, sudo will tell the user when a command could not be found in their PATH environment # variable. Some sites may wish to disable this as it could be used to gather information on t the executable is # simply not in the user's PATH, sudo will tell the user that they are not allowed to run it, which can be confusing. # Default: ON #Defaults passprompt_override # The password prompt specified by passprompt will normally only be used if the password prompt provided by # systems such as PAM matches the string "Password:" #Defaults preserve_groups # By default, sudo will initialize the group vector to the list of groups the target # user is in. When preserve_groups is set, the user's existing group vector is left unaltered. #Defaults pwfeedback # By default, sudo reads the password like most other Unix programs, by turning off echo # until the user hits the return (or enter) key. Some users become confused by this as it appears to the user # presses a key. Note that this does have a security impact as an onlooker may be able to determine the length of # the password being entered. Default: OFF #Defaults requiretty # If set, sudo will only run when the user is logged in to a real tty. When this flag is set, # sudo can only be run from a login session and not via other means such as cron(8) or cgi-bin #Defaults root_sudo # If set, root is allowed to run sudo too. Disabling this prevents users from "chaining" sudo # commands to get a root shell by doing something like "sudo sudo /bin/sh". Note, however, that real additional # security; it exists purely for historical reasons. Default: ON #Defaults rootpw # If set, sudo will prompt for the root password instead of the password of the invoking user. # Default: OFF #Defaults runaspw # If set, sudo will prompt for the password of the user defined by the runas_default option # (defaults to root) instead of the password of the invoking user. Default: OFF #Defaults set_home # If enabled and sudo is invoked with the -s option the HOME environment variable will be set # to the home directory of the target user (which is root unless the -u option is used). So set_home is only # effective for configs where either env_reset is disabled or HOME is present in the env_keep list. Default: OFF #Defaults set_logname # Normally, sudo will set the LOGNAME, USER and USERNAME environment variables to the name # of the target user (usually root unless the -u option is given). However, since some programs ( may be desirable # to change this behavior. This can be done by negating the set_logname option. Note that if the env_reset option # has not been disabled, entries in the env_keep list will override #Defaults set_utmp # When enabled, sudo will create an entry in the utmp (or utmpx) file when a pseudo-tty is # allocated. A pseudo-tty is allocated by sudo when the log_input, log_output or use_pty flags are e the tty, time, # type and pid fields updated. Default: ON #Defaults setenv # Allow the user to disable the env_reset option from the command line via the -E option. # Additionally, environment variables set via the command line are not subject to the restrictions impo variables # in this manner. Default: OFF #Defaults shell_noargs # If set and sudo is invoked with no arguments it acts as if the -s option had been given. # That is, it runs a shell as root (the shell is determined by the SHELL environment variable if is off by default. #Defaults stay_setuid # Normally, when sudo executes a command the real and effective UIDs are set to the target # user (root by default). This option changes that behaviour such that the real UID is left as the systems that # disable some potentially dangerous functionality when a program is run setuid. This option is only effective on # systems with either the setreuid() or setresuid() function. This flag #Defaults targetpw # If set, sudo will prompt for the password of the user specified by the -u option (defaults to root) instead # of the password of the invoking user. In addition, the timestamp file name will passwd database as an argument # to the -u option. Default: OFF #Defaults tty_tickets # If set, users must authenticate on a per-tty basis. With this flag enabled, sudo will # use a file named for the tty the user is logged in on in the user's time stamp directory. #Defaults umask_override # If set, sudo will set the umask as specified by sudoers without modification. This makes # it possible to specify a more permissive umask in sudoers than the user's own umask and match user's umask and what # is specified in sudoers. Default: OFF #Defaults use_pty # If set, sudo will run the command in a pseudo-pty even if no I/O logging is being gone. # A malicious program run under sudo could conceivably fork a background process that retains to the u that impossible. # Default: OFF #Defaults utmp_runas # If set, sudo will store the name of the runas user when updating the utmp (or utmpx) file. # By default, sudo stores the name of the invoking user. Default: OFF #Defaults visiblepw # By default, sudo will refuse to run if the user must enter a password but it is not possible to disable echo on the # terminal. If the visiblepw flag is set, sudo will prompt for a password even when it would be visible on the screen. # This makes it possible to run things like "rsh somehost sudo ls" since rsh(1) does not allocate a tty. Default: OFF #Defaults closefrom # Before it executes a command, sudo will close all open file descriptors other than standard # input, standard output and standard error (ie: file descriptors 0-2). #Defaults passwd_tries # The number of tries a user gets to enter his/her password before sudo logs the failure # and exits. The default is 3. #Defaults loglinelen # Number of characters per line for the file log. This value is used to decide when to wrap # lines for nicer log files. This has no effect on the syslog log file, only the file log. #Defaults passwd_timeout # Number of minutes before the sudo password prompt times out, or 0 for no timeout. # The timeout may include a fractional component if minute granularity is insufficient, for example 2 #Defaults timestamp_timeout # Number of minutes that can elapse before sudo will ask for a passwd again. The timeout # may include a fractional component if minute granularity is insufficient, for example 2.5. timestamp will never expire. # This can be used to allow users to create or delete their own timestamps via sudo -v and sudo -k respectively. #Defaults umask # Umask to use when running the command. Negate this option or set it to 0777 to preserve # the user's umask. The actual umask that is used will be the union of the user's umask and the value o running # a command. Note on systems that use PAM, the default PAM configuration may specify its own umask which will # override the value set in sudoers. #Defaults badpass_message # Message that is displayed if a user enters an incorrect password. The default is Sorry, # try again. unless insults are enabled. #Defaults editor # A colon (':') separated list of editors allowed to be used with visudo. visudo will choose # the editor that matches the user's EDITOR environment variable if possible, or the first editor in #Defaults iolog_dir # The top-level directory to use when constructing the path name for the input/output log # directory. Only used if the log_input or log_output options are enabled or when the LOG_INPUT or L directory. # The default is "/var/log/sudo-io". The following percent (%) escape sequences are supported: # %{seq} - expanded to base-36 sequence number, such as 0100A5, to form a new directory, e.g. 01/00/A5 # %{user} - expanded to the invoking user's login name # %{group} - expanded to the name of the invoking user's real group ID # %{runas_user} - expanded to the login name of the user the command will be run as (e.g. root) # %{runas_group} - expanded to the group name of the user the command will be run as (e.g. wheel) # %{hostname} - expanded to the local host name without the domain name # %{command} - expanded to the base name of the command being run In addition, any escape sequences supported by # strftime() function will be expanded. To include a literal % character, the string %% should be used. #Defaults iolog_file # The path name, relative to iolog_dir, in which to store input/output logs when the log_input or log_output options are # enabled or when the LOG_INPUT or LOG_OUTPUT tags are present for a See the iolog_dir option above for a list of # supported percent (%) escape sequences. In addition to the escape sequences, path names that end in six or more Xs will # have the Xs replaced with a unique combination of digits and letters, similar to the mktemp() function. #Defaults mailsub # Subject of the mail sent to the mailto user. The escape %h will expand to the host name of # the machine. Default is *** SECURITY information for %h ***. #Defaults noexec_file # This option is no longer supported. The path to the noexec file should now be set in the /etc/sudo.conf file. #Defaults passprompt # The default prompt to use when asking for a password; can be overridden via the -p option or the SUDO_PROMPT # environment variable. The following percent (%) escape sequences are supported: # %H - expanded to the local host name including the domain (only if the host name is fqdn or fqdn option is set) # %h - expanded to the local host name without the domain name # %p - expanded to the user whose password is being asked for (respects the rootpw, targetpw and runaspw flags) # %U - expanded to the login name of the user the command will be run as (defaults to root) # %u - expanded to the invoking user's login name # %% - two consecutive % characters are collapsed into a single % character # The default value is Password:. #Defaults runas_default # The default user to run commands as if the -u option is not specified on the command line. This defaults to root. #Defaults syslog_badpri # Syslog priority to use when user authenticates unsuccessfully. Defaults to alert. # alert, crit, debug, emerg, err, info, notice, and warning. #Defaults syslog_goodpri # Syslog priority to use when user authenticates successfully. Defaults to notice. See syslog_badpri for the priorities. #Defaults sudoers_locale # Locale to use when parsing the sudoers file, logging commands, and sending email. # Note that changing the locale may affect how sudoers is interpreted. Defaults to "C". #Defaults timestampdir # The directory in which sudo stores its timestamp files. The default is /var/db/sudo. #Defaults timestampowner # The owner of the timestamp directory and the timestamps stored therein. The default is root. #Defaults env_file # The env_file option specifies the fully qualified path to a file containing variables to # be set in the environment of the program being run. Entries in this file should either be of the f quotes. # Variables in this file are subject to other sudo environment settings such as env_keep and env_check. #Defaults exempt_group # Users in this group are exempt from password and PATH requirements. The group name specified should not include # a % prefix. This is not set by default. #Defaults group_plugin # A string containing a sudoers group plugin with optional arguments. This can be used to implement support for the # nonunix_group syntax described earlier. The string should consist of configuration arguments the plugin requires. # These arguments (if any) will be passed to the plugin's initialization function. If arguments are present, the # string must be enclosed in double quote For example, given /etc/sudo-group, a group file in Unix group format, # the sample group plugin can be used: Defaults group_plugin="sample_group.so /etc/sudo-group" # For more information see sudo_plugin(5). #Defaults lecture # This option controls when a short lecture will be printed along with the password prompt. The default value is once. # It has the following possible values: # always - Always lecture the user. # never - Never lecture the user. # once - Only lecture the user the first time they run sudo. # If no value is specified, a value of once is implied. Negating the option results in a value of never being used. #Defaults lecture_file # Path to a file containing an alternate sudo lecture that will be used in place of the standard lecture if the named # file exists. By default, sudo uses a built-in lecture. #Defaults listpw # This option controls when a password will be required when a user runs sudo with the -l option. # It has the following possible values: # all - All the user's sudoers entries for the current host must have the NOPASSWD set to avoid entering a pass. # always - The user must always enter a password to use the -l option. # any - At least one of the user's sudoers entries for the current host must have the NOPASSWD set to avoid pass. # never - The user need never enter a password to use the -l option. # If no value is specified, a value of any is implied. The default value is any. #Defaults logfile # Path to the sudo log file (not the syslog log file). Setting a path turns on logging to a file; # negating this option turns it off. By default, sudo logs via syslog. #Defaults mailerflags # Flags to use when invoking mailer. Defaults to -t. #Defaults mailerpath # Path to mail program used to send warning mail. Defaults to the path to sendmail found at configure time. #Defaults mailfrom # Address to use for the "from" address when sending warning and error mail. The address should # be enclosed in double quotes (") to protect against sudo interpreting the @ sign. #Defaults mailto # Address to send warning and error mail to. The address should be enclosed in double quotes # (") to protect against sudo interpreting the @ sign. Defaults to root. #Defaults secure_path # Path used for every command run from sudo. If you don't trust the people running sudo to have a sane PATH environment # variable you may want to use this. Another use is if you want to option are not affected by secure_path. # This option is not set by default. #Defaults syslog # Syslog facility if syslog is being used for logging (negate to disable syslog logging). Defaults to auth. # authpriv (if OS supports it), auth, daemon, user, local0, local1, local2, local3, local4, local5, local6, and local7. #Defaults verifypw # This option controls when a password will be required when a user runs sudo with the -v option. # It has the following possible values: # all - All the user's sudoers entries for the current host must have the NOPASSWD flag to avoid pw. # always - The user must always enter a password to use the -v option. # any - At least one of the user's sudoers entries for the current host must have NOPASSWD to avoid pw. # never - The user need never enter a password to use the -v option # If no value is specified, a value of all is implied. Negating the option results in a value of never being used. # The default value is all. #Defaults env_check # Environment variables to be removed from the user's environment if the variable's value contains % or / characters. # This can be used to guard against printf-style format vulnerabilities value without double-quotes. The list can be # replaced, added to, deleted from, or disabled by using the =, +=, -=, and ! operators respectively. Regardless of # whether the env_reset option is ena they pass the aforementioned check. The default list of environment variables # to check is displayed when sudo is run by root with the -V option. #Defaults env_delete # Environment variables to be removed from the user's environment when the env_reset option is not in effect. The # argument may be a double-quoted, space-separated list or a single value w +=, -=, and ! operators respectively. # The default list of environment variables to remove is displayed when sudo is run by root with the -V option. #Defaults env_keep # Environment variables to be preserved in the user's environment when the env_reset option is in effect. This # allows fine-grained control over the environment sudo-spawned processes will r quotes. The list can be replaced, # added to, deleted from, or disabled by using the =, +=, -=, and ! operators respectively.


text:
Wednesday, 31 July 2013
The Beatles & Bournemouth Exhibition
Beacon Hotel, Bournemouth
Opens 15 August
To mark the 50th anniversary of The Beatles' first shows in Bournemouth, on 19 August 1963 when they opened a six-day residency at the Gaumont (now the Odeon) cinema on Westover Road, a new exhibition celebrating their many connections to the town is to open.
The Beatles played more shows at the Gaumont than in any other UK theatre outside London, notching up no less than 16 shows between August 1963 and their final visit on 2 October 1964.
The exhibition, at the Beacon Hotel on Priory Road, Bournemouth, includes dozens of photos of The Beatles in Bournemouth, as well as posters, handbills, reviews and programmes from the group's four visits to the town. There are various other photos from Robert Freeman's photo shoot of the boys at the Palace Court Hotel on Westover Road that produced the iconic half-shadow sleeve shot for their second album, With The Beatles. Also at the Beacon Hotel you can find the main venue sign, a section of stage and some seats from the historic Winter Gardens theatre where The Beatles played on 16 November 1963 and were filmed for US television – the first footage America was to see of the Fab Four.
Much interest is bound to fall on the remarkable photo of John Lennon with his young son Julian and his Aunt Mimi at Sandbanks Ferry, just yards from the harbourside bungalow he bought for Mimi in 1965 and where he visited her many times before he left these shores for good in 1971.
The exhibition tells an incredible story of how a small resort on the south coast of England came to play a significant part in the history of the greatest rock 'n' roll group of them all.
In conjunction with the exhibition there is a new restaurant opening at the Beacon Hotel in August.
The Bournemouth Rock Cafe uses Harry Taylor's iconic 'Stick of Rock' photo as part of its logo and will be serving gourmet burgers and a full menu in rooms that are adorned with Bournemouth music memorabilia from all eras and genres.
For more information please contact Dave Robinson at the Beacon Hotel on 01202 553319; or Nick Churchill, author of the book Yeah Yeah Yeah; The Beatles & Bournemouth on 01929 472621.
Useful links
Half a chocolate bar started the Beatles
"Here's a story. Matt Damon told it. But it's not about Matt Damon. It's about Bono. But it's not really about Bono, either; it's about Paul McCartney. But Damon heard it from Bono. One day, Bono flew into Liverpool. Paul was supposed to pick him up at the airport, and Bono was shocked when Paul picked him up at the airport alone, behind the wheel of his car. "Would you like to go on a little tour?" Paul said. Sure, Bono said, because Bono, you see, is a fan of Paul's, in the same way that Damon is a fan of Bono's. "Bono's obsessed with the Beatles," Damon said at the table in the lobby of the gated hotel in the little town in Germany.
"He's, like, a student of the Beatles. He's read every book on the Beatles. He's seen every bit of film. There's nothing he doesn't know. So when Paul stops and says 'That's where it happened,' Bono's like, 'That's where what happened?' because he thinks he knows everything. And Paul says, 'That's where the Beatles started. That's where John gave me half his chocolate bar.' And now Bono's like, 'What chocolate bar? I've never heard of any chocolate bar.' And Paul says, 'John had a chocolate bar, and he shared it with me. And he didn't give me some of his chocolate bar. He didn't give me a square of his chocolate bar. He didn't give me a quarter of his chocolate bar. He gave me half of his chocolate bar. And that's why the Beatles started right there.' Isn't that fantastic? It's the most important story about the Beatles, and it's in none of the books! And Paul tells it to Bono. Because he knows how much Bono loves the Beatles."
Excerpted from an interview with actor Matt Damon in Esquire. I wonder if this story will appear in the new Mark Lewisohn book?
UPDATE: In an email to us, Lewisohn confirms that this alternative meeting is detailed in his book, but that he didn't know about the chocolate. More will be revealed in October when the book comes!
Tuesday, 30 July 2013
Weston Special Edition Newspaper
One incident which occurred during the Beatles' stay at Weston-Super-Mare was the murder of 16-year-old Liverpudlian Barbara Herron at Wolvershill near Banwell. The Beatles actually visited the murdered girl's friend Joan McNulty in hospital, according to a local eyewitness, Ian McEachran.
The Weston Mercury
Monday, 29 July 2013
A Magical History Tour - Beatling around LA
|The Gillymobile
There are a few cities in the world with organized Beatles tours, Liverpool of course, London of course, Hamburg, New York and Los Angeles. In 2005 I had the pleasure of attending a New York Beatles walking tour, guided by Trina Yannicos, and I have attended Richard Porter's London Beatlewalks several times. Liverpool and Hamburg I have mainly explored on my own. You can explore a few Beatles sights in Los Angeles by walking, but most sights are far apart, so the best option is to do a tour by car.
As I was the only participant on Gillian's Beatles tour that day, I had the privilege of being driven around in her own trusty Toyota Camry, having her undivided attention. She started off by asking me about my level of Beatles knowledge, which was a good way both to start to get to know each other, and also helped her with her presentation of the sights she was going to show me. Gillian is a down to earth kinda gal (as you'd expect from a Merseysider), and also works as a Beatles news reporter for 97.1 KLSX and 95.5 KLOS Breakfast with the Beatles, among others.
If you've ever been on a Beatles tour or if you have travelled to see a Beatles sight, you'll know that seeing the places you've previously just read about, transforms your inner vision from the mythical to the down-to-earth. And no, seeing a place on TV doesn't accomplish this.
The Capitol Tower is a building you will have come across quite a few times if you're a Beatles fan. The last Beatles related use of this location was when Paul McCartney finally got his "Hollywood Walk Of Fame" star just outside the building last February, and he also gave a invitation only concert in the building's own studio the same day. In the above video you'll see Ringo Starr and Harry Nilsson make use of the rooftop of the building for the music video of "Only You" back in 1974. Ringo revisited the very same rooftop in 2007 to hoist the "Help!" flag (see video). If you want to see a bit more of it, here's a film from 1958. When I finally came around to see the Capitol Tower for myself, I was amazed over how small it really was.
|Please, no "that's a nice hat" remarks!
|The order is John, George, Ringo, Paul.
The view from a car, notice the statue of Kermit. Of course, Kermit the frog was as wild about the Beatles as we are.
Of course, George also recorded at this studio, which is located at 1416 North La Brea Avenue in Hollywood. The Police filmed their "Every Breath You Take" video here, and in 1985, the USA for Africa hit single and video "We Are the World" was recorded there.
The Beatles played several concerts at the Hollywood Bowl in 1964 and 1965, as commemorated on an official LP and cassette release in 1977. When I visited the hills overlooking Hollywood, I realised that the recording equipment from Capitol records didn't have a long way to travel in order to capture these concerts on tape.
You'll notice the Capitol Records tower in the upper left corner and the Hollywood Bowl at the bottom right.
Of course, I couldn't visit Hollywood without seeing a show at the Hollywood Bowl, so we booked tickets for a Grease singalong at the venue, the day before my Beatles tour with Gillian. Here's a photo taken at that occasion, I took the liberty of replacing the view of the Grease scene on stage with a more appropriate scene for this blog.
During what looked like a bathroom break and a time for something to eat or drink, Gillian stopped at the Farmer's market. Ah, but it was no coincidence, because she showed me a photocopy of a thank you note from the Beatles at a stall which sold freshly made peanut butter:
Although the dubious look of the signatures (Neil Aspinall's, perhaps?) seems to rule out that they signed in person, I'm sure they still meant to thank for the peanut butter. Gillian speculated that this Elvis Presley favourite had yet to make it to British shops back in the day, so this may have been the fabs first encounter with the spread. I've always enjoyed peanut butter myself, and have since the sixties, so it was certainly available here in Norway.
During our trip, Gillian was playing mix tapes (yes, they were actually cassette tapes!) while we were driving, and every time we approached a new sight, miraculously an appropriate song would start to play. She must have spent acres of time accomplishing just the right mix! But this meant that when I heard "Blue Jay Way" on the stereo (not a favourite of Gillian's), I knew what was around the corner.
Her detective work had also provided us with the exact location of the house where George wrote the song, but she made me promise not to bring it further. After all, it's her business secret. There was no fog upon LA that day, but the city certainly presented itself in a haze from this particular point of view.
Another house Gillian showed me, was the very house where the one and only meeting between the Beatles and Elvis Presley took place. And, funnily enough, over at the Hollywood Walk of Fame, Elvis' and the Beatles' stars are placed right next to each other. I doubt that Elvis is very pleased with this, after all, he thought they corrupted the youth, if we should believe these tales.
I won't go into more detail about the tour, suffice to say that we started at 10 am and finished just before 5 pm, so yes - there are certainly a lot of Beatles sights to be seen and this tour is worth every cent. The tour I got was quite extended, regular Beatles tours last 3,5 - 4 hours. If you are planning to visit LA or even if you're an LA resident, you'll want to tag along. Gillian has met a number of Beatles people during her time and also as a news reporter for several radio stations, and she'll share her anecdotes with you. Here are some of the people she's met: Paul & Linda McCartney, all the McCartney children, Ringo Starr, Neil Aspinall, Dhani Harrison, Denny Laine, Henry McCullouch, Laurence Juber, Peter & Gordon, Joey Molland, Barbara Bach, Olivia Harrison, Yoko Ono ... and lots more.
The tours are currently not scheduled regularly, you'll have to book in advance. You can get in touch with Gillian through her website amagicalhistorytour.com or give her a call at 310-582-1120. Email: email@example.com
The highlight for me? After Hollywood Bowl, probably this pool.
Links to other Beatles tours:
London (Richard Porter)
New York City (Susan Ryan)
Liverpool (Jackie Spencer)
Hamburg (Peter Paetzold)
Sunday, 28 July 2013
John Kosh Interview
|From Paul McCartney's recreation of the Abbey Road cover, 1993
Rock Cellar Magazine
Friday, 26 July 2013
Birthday film
|Most of the streets in LA were decorated with this Ringo poster during my stay there
You may have noticed my absense the first three weeks of July. The reason for this was that I spent three weeks vacationing in the USA, mostly in Los Angeles. While there, I visited the Grammy museum to check out their ongoing Ringo exhibition. It was truly wonderful to be able to study some of the historical artifacts up close, like the Abbey Road/Let It Be drum kit, the Sgt Pepper suit and the black and green 1966 stage suit. The museum also had a film theatre where they were showing a 17 minutes long film about Ringo. The ending of that film was a professionally filmed and recorded version of "Birthday", performed by Paul McCartney at Ringo's 70th birthday bash at Radio City Music Hall in New York City. As far as I knew, this was the first time I've seen this film, earlier I had only seen fan films from this event. However, a YouTube search resulted in me finding this video, uploaded on March 5th this year:
Thursday, 25 July 2013
Amazing discovery
The Beatles at The Cavern Club 1962 - Kansas City
Tuesday, 23 July 2013
Paul teams up with Nirvana again
Paul McCartney made rock history on Friday night when he brought out Nirvana's surviving members during the encore of his show at Seattle's Safeco Field. It was only the second time that drummer Dave Grohl and bassist Krist Novoselic (plus touring guitarist Pat Smear) have performed together in Nirvana's hometown since Kurt Cobain's death in 1994, and the first time they've played there in more than 15 years.
The Nirvana bandmates backed McCartney on "Cut Me Some Slack" – the original song they recorded for Grohl's Sound City documentary last year – as well as joining McCartney's band on a handful of Beatles classics, including "Get Back," Little Richard's "Long Tall Sally," "Helter Skelter" and "The End."
More here: Rolling Stone
More video:
Cut Me Some Slack
Get Back
Helter Skelter
Subscribe to: Posts (Atom)

subset: commoncrawl


text:
A Frost and Sullivan Technical Brief
Enterprise communications platforms have undergone a fundamental shift, migrating from traditional, onpremises, TDM-based PBX to highly agile, IP-based unified communications and collaboration platforms. This evolution has not only enhanced the means and efficiency of communications among employees, partners and, most importantly, customers, but has also enabled highly flexible and innovative deployment opportunities. Today, businesses can choose from a number of delivery models, from on-premises solutions deployed within a data center environment to fully hosted unified communications as a service (UCaaS) solutions implemented within public or private clouds.
Converging voice and data communications and collaboration applications on a shared IP-based network affords businesses a wealth of integration and cost-saving opportunities, but this level of convergence requires unique considerations. Specific attention must be paid to the quality of wide area network (WAN) links that connect remote locations to the business and all locations to the outside world. This technical brief outlines the benefits UCaaS can offer businesses and identifies key architecture considerations for deploying cloud-based enterprise communications that ensure the highest levels of service quality and reliability.
Cognitive Publishing Ltd
Magazines That Mean Business
86 Deansgate, Manchester, M3 2ER
phone:0044 (0) 161 833 6320
0044 (0) 161 832 0571
Other brands produced by Cognitive Publishing Ltd
Web Design by Senior


text:
T his federal legislation allows more individuals to obtain health insurance. It expands eligibility for Medi-Cal (free or cost-sharing health care), offers subsidies (tax credits) to low and middle-income people to buy private insurance, and imposes new regulations on the health insurance industry.
As of October 1, 2013, millions of Californians can now sign up for health insurance under this new law.
Listed below are a number of resources that provides information about how you can sign up, what health plans are available, what types of services are provided and where to go to get more information.
Consumer Reports: Cut Cost of Health Insurance 2014
About Covered California (fact sheet)
Covered California: Changes Coming
LA Times Article On ACA, Sept. 2013
Lawfully-Present Immigration Eligibility Categories
Lewis-Burker 2011 Resource Guide (CSWE)


text:
A blessed Lent to all!
0 Members and 1 Guest are viewing this topic.
If you spend long enough on this forum, you'll come away with all sorts of weird, untrue ideas of Orthodox Christianity.
I would suggest most persons in general avoid any question beginning with why.
And FWIW, these are our Fathers too, you know.
This would make a good Hyperdox Herman - Friends non-Orthodox on facebook to spread the GospelBlocks their posts so they can read his but he can't read theirs.
Hello,I am not Orthodox (I'm Eastern Catholic) but I'm just wondering about the Orthodox perspective on this. I read that in the Catholic Church, it was not allowed for Catholics to communicate (I don't mean sharing Communion, but communicating as in having conversations, eating together, etc) with heretics/schismatics/etc though I seem to remember it being alright to do this to help in their salvation (so talking to someone about returning to the Church, for example). There was an excommunication for this. Eventually it got so complicated that the Pope changed the canon on this, and according to Catholic Encyclopedia there is no longer an excommunication on this, although it's always been and still is a sin to aid someone in heresy or to give them support in heresy. I'm a little confused about the history of this so hopefully I got this right.Well I was wondering, if anything similar exists in the Orthodox church. Since I'm Catholic obviously I believe in Catholicism (but I'm not here to argue that) - but according to the Orthodox perspective, - let's say someone was Orthodox and then joined another church, would it be a sin for their Orthodox friends to continue to meet with them, as friends? Is this considered a sin and is there any canons about it?I would greatly appreciate any information, especially from a priest or deacon.Again I'm not here to argue this or any other point, just looking for info thanks!
It's not a sin to hold a conversation with a heretic. If there were no communication, how would they be helped to know the truth? Those who are not well established in faith should probably avoid conversing about it with heretics, lest they become confused. That's about it. Mere communicating is not automatically aiding a heresy.
There is a difference between not communicating with a person who happens to be non-Orthodox, and an Orthodox person who has apostatised from the Church. While I know very few who would actually "shun" such a person, this is something taught quite clearly in Scripture (Titus 3:10) and expressed by many of the Fathers. The reason is to make the person in question realise the severity and gravity of their decision and bring about their repentance and return to the Church. I think such action nowadays is likely to have quite the opposite effect, and so its applicability now would have to be very carefully considered - the letter killeth and all that.
I'm not aware of anyone being forbidden to be friends, or hang out under any circumstance, with apostates. I can think of examples to the contrary however, with recurring apostates that I know of.That said, the Orthodox approach to the canons is seemingly quite different from the Catholic approach.
There is a difference between not communicating with a person who happens to be non-Orthodox, and an Orthodox person who has apostatised from the Church.
Thanks for the replies, well for those interested I got this from St Thomas Aquinas and the "heresy" article in the Catholic Encyclopedia.
Page created in 0.073 seconds with 26 queries.


text:
Profile | Edit
Ameria is a character from the video game Suikoden IV.
Add More Info
Relations | Edit
Appears in | EDIT
Quotes | 0
No quotes have been assigned to this character. Let us know which episode to find quotes in.
Spells and Abilities (+Add)
Comments powered by DISQUS


text:
Table of Contents
This tutorial introduces you to the widget form system by building a simple application that accepts and displays comments.
The comments are listed on the index page and a link at the bottom of the page directs the user to add a comment. To keep things simple, we're going to skip the database and just keep track of our comments in memory using a global comments variable.
The comments form itself requires both a name, an email address and a comment to be entered. If input to one of the fields is missing, the form is redisplayed along with a message next to the appropriate field. We've tossed in a checkbox field to give an example that widgets also handle values of other type than strings, i.e. booleans, integers etc.
Successfully completing a form adds the comment to the global comments variable and displays a success message on the index page.
This tutorial starts with a pre-built project. Please download and unpack the provided archive with the complete example project and read the source code along with the tutorial. For a detailed explanation on how to create a new project, please read the 20 Minute Wiki Tutorial.
If you're not already familiar with the basics of what widgets are, and how they work, you'll probably want to take a look at the widgets overview page.
The single most common use of Widgets in a TurboGears project is in building forms.
Widgets make form creation really easy, because they address all the important aspects of form handling:
For the purpose of this tutorial, we are interested in two main types of widgets: simple form field widgets – text inputs and checkboxes – and compound widgets like the form itself.
Simple form field widgets generally correspond to the default browser inputs but some, like the date picker, have extra smarts to make your user's lives easier. You can get an overview of which widgets are available on your install by checking out the widget browser in the toolbox.
Compound widgets, like forms, usually act as containers for fields. In particular, a forms provides layout (Table or List) for it's fields and is responsible for labels and error display.
There are many other types of standard widgets, and you can create you own custom widgets, but this is a simple widgets tutorial, so we're keeping it simple. For more information about the widgets framework, you can start reading at the general widgets overview.
With the introduction out of the way, let's dive into the code. This is the form field declaration in FormsTutorial/controllers.py:
class CommentFields(widgets.WidgetsList):
"""The WidgetsList defines the fields of the form."""
name = widgets.TextField(validator=validators.NotEmpty())
email = widgets.TextField(validator=validators.Email(not_empty=True),
comment = widgets.TextArea(validator=validators.NotEmpty())
notify = widgets.CheckBox(label="Notify me")
As you can see, the declaration looks quite a bit like a SQLObject class definition. The CommentFields class declares a list of four widgets, all of which are simple widgets corresponding to the similarly named <INPUT> tags in HTML. The first three are required text fields and the email field requires a well-formed email address.
Notice that we have not defined a field widget for the submit button. The TableForm and ListForm widgets take care of this for you by default and you can tweak it using their submit_text argument.
Now the above snippet won't get you a form as is, it's just a list of widgets. To build a form, you pass the list of widgets into a form constructor (both TableForm and ListForm are standard widgets) and get a compound form widget:
comment_form = widgets.TableForm(
Maybe you can guess what the extra action argument is for: it defines the action attribute of the form element in the generated HTML, which means that submissions from the form will go to http://mysite/save and will be handled by the save method of our controller.
If, for some reason, you do want to manage the submit button yourself, derive your own widget form class from TableForm or ListForm and overwrite the submit attribute with your own instance of a widgets.SubmitButton.
If you've run across some widget code samples elsewhere, the above may look a bit unusual. There are, in fact, two different ways to declare forms. This tutorial uses the declarative syntax, but you can pass a standard Python list of widgets directly to the form constructor:
#example only, not part of the tutorial code
example_form = widgets.TableForm(
Widgets declared using a widgets.WidgetList will automatically have their name set to the attribute name but are otherwise exactly as they would be if you created them as a list. When instantiated, the declarative form gets transformed (via some metaclass magic) into a standard Python list, so you can do list-like things before you use the list to create a form:
#example only, not part of the tutorial code
comment_fields2 = CommentFields()
comment_form_2 = widgets.TableForm(
submit_text="Submit Tweaked Form"
So why bother with the declarative setup? The declarative syntax provides more space to hang documentation and some think that it looks nicer. It also makes it easy to reuse a particular list of widgets in multiple forms and pages.
Since TurboGears 1.1, you can also subclass from a WidgetList, and all declared fields in the base class will be inherited, or you can pass a couple of other fields when initializing the list, which will be appended to the already declared fields.
The project structure for this tutorial is intentionally simple, but most developers wind up creating a separate file (think forms.py is like model.py) or even a package to keep their forms organized.
Working our way down controllers.py, our first stop is the add method. This method passes the widget form instance comment_form, which we just covered, to the template add.html:
def add(self, tg_errors=None):
"""Show the comment form."""
if tg_errors:
flash('There was a problem with the form!')
return dict(form=comment_form)
You may notice that templates passed to @expose in this example don't start with "formstutorial". This is the relative import feature for templates. Naming your templates this way simplifies project renaming.
We'll talk about the tg_errors argument later. First, let's have a look how the form widget is used in the template. Here's the body contents of formstutorial/templates/add.html:

Comment form

Yep, that's all there is to it.
The display method of a widget instance emits the HTML code to display the form on your page.
Now that you know the basics of declaring and instantiating forms, let's take a closer look at the possibilities you have when you display the form.
The simplest way to display the form, as we just saw, is to call the forms display method:
It's also possible to call the instance directly and get the same behavior:
For our comment form, this will produce the HTML output similar to the following:
<FORM ACTION="save" NAME="form" METHOD="post">
Name
<INPUT CLASS="textfield" TYPE="text" ID="form_name" NAME="name">
<INPUT TYPE="submit" CLASS="submitbutton">
You can see that the submit button has no value and will therefore be displayed with a language dependant default label because we didn't set the form's submit_text.
If you look at the generated FORM element, you'll also note that its action attribute is set to the value of the action argument, which we specified when we created the form instance.
As a convenience, you can override both the action and submit_text arguments at display time:
${form(action="preview", submit_text='Preview Comment')}
Whether you want to specify action (or submit_text for that matter) when you create the form or when you display it, depends on whether you are reusing the form in another context or not and how closely coupled the form widget and the controller methods handling the form are in your application.
If you want to preset the form field values - for instance to edit already existing data - you pass the form values as the first argument:
${form(data, submit_text='Add Comment')}
You can also explicitly specify it as the value keyword argument:
${form(value=data, submit_text='Add Comment')}
Where data is a dictionary of the form:
data = dict(name='Joe', comment='Hello World', notify=True, ...)
Displaying forms is nice, but it really doesn't help you out that much. Admittedly, some people write entire toolkits to do just this sort of thing (GWT, Pyjamas), but TurboGears widgets offer you more.
Validation ensures that the values you're getting are the values your method is expecting. Sometimes this is critically important, other times it's convenient, but quite a bit of time in web programming is traditionally tied up in displaying a form, processing the form, validating it's values, and – in the event of errors– redisplaying the form with the errors marked. TurboGears widgets were created explicitly to solve this problem.
In practice, you get validation by adding validators to your widget declarations and setting the appropriate decorators on your form handling method. You can get super-fancy and do it other ways if necessary, but we'll take the simple solutions for simple problems approach here.
#repeat, for convenience
class CommentFields(widgets.WidgetsList):
"""The WidgetsList defines the fields of the form."""
name = widgets.TextField(validator=validators.NotEmpty())
email = widgets.TextField(validator=validators.Email(not_empty=True),
comment = widgets.TextArea(validator=validators.NotEmpty())
notify = widgets.CheckBox(label="Notify me")
If you look at the definition of CommentFields repeated above, you'll see that there is a validator for each of the first three fields. These validators are part of the turbogears.validators package, which is a thin wrapper around Ian Bicking's FormEncode project. Since all values in a form are sent as strings, validators will both,
Validators perform the two steps together because the value criteria frequently mean little until type conversion has taken place, or vice versa. In our tutorial, no type conversions were needed. But if, for example, your validator requires a numeric input be greater than 5 but your form input was "10", you have to convert the string "10" to the int 10 before a meaningful comparison can be made.
The first and third fields have a validators.NotEmpty validator, which explicitly states that they are required fields. The second field, with a validators.Email validator, is required as well. We explicitly state this by passing a not_empty=True, but adding a validator to the field generally makes that field required. The empty string, for example, is not a valid email address, so the email validator will fail. You can get validation on non-required fields by passing an if_empty="default value" argument to the validator's constructor.
Turning our attention to the save method:
def save(self, name, email, comment, notify=False):
"""Handle submission from the comment form and save the comment."""
comments.add(name, email, comment)
if notify:
flash('Comment added! You will be notified.')
flash('Comment added!')
Our method itself takes a set of arguments corresponding to the fields in the form. Tracking large numbers of fields is very inconvenient, so it's common to just use keyword arguments instead:
def save(self, **data):
data.get('notify', False)
Using this syntax you get the data as a dictionary and you have to extract the field values from there. The use of .get() above is needed for the notify field, since this is not guaranteed to be included in the data and because there is no validator checking for its presence, while the other fields will be present for sure if there was no validation error.
The form handling strips off the default submit field so that you don't have to deal with it. If you add your own, it won't be stripped.
Finally, the flash method displays a confirmation notice on the next page the user is redirected to, which is the index page with the list of comments.
Let's take another, closer look at the save method. Our interest now lies not in its contents, but rather the decorators. We can see that the method is exposed without a template. It does need to be exposed or CherryPy will raise a 404. The lack of a template is fine because we're going to redirect the user to another (output-providing) method depending on whether the input is valid or not.
The @validate() decorator extracts the various validators from the form, loops through them, and throws an error if problems are found. We're glossing over details, but that's the basic idea.
If @validate() does throw an error, the @error_handler decorator takes care of them. The first argument to @error_handler() is the error handling method. If a validation error occurs, @error_handler will call the error handling method with a tg_errors keyword argument receiving a dictionary of FormEncode validation errors.
In the example, we're re-using add so that the form will be re-displayed if errors occur. Let's have a look at the add method again:
def add(self, tg_errors=None):
if tg_errors:
flash("There was a problem with the form!")
return dict(form=comment_form)
The error handling method, if desired, could look into the tg_errors dictionary to see which fields validation has failed and act accordingly. In practice, most form error handlers simply do what we do here: put up a notification message and display the form showing the validation errors.
How do the errors show up on the form? Magic!
Well, not really magic. The @validate() decorator puts the error dictionary into a request variable. The form checks for that variable at display time and routes errors appropriately if they're present.
In this tutorial you have learned how to create a simple form widget composed of several form fields. You have seen how the widget is passed to the template, displayed and how submissions from the form are handled in the controller. You have also seen simple validators in action that simplify error handling for forms substantially.
This tutorial only covers basic widget usage. If you'd like to know more, explore the widgets overview and the check out the widget browser in the toolbox.
The code for this example is courtesy of Michele Cella, but the individual files in the project have been updated to reflect changes in TurboGears versions over time and were adapted by various authors with respect to style, design etc.


text:
Folliculitis is an inflammation of the hair follicle. It can occur anywhere on your skin or scalp. There are many types of folliculitis.
Folliculitis has many causes. It may be infectious or noninfectious.
Infectious folliculitis is caused by:
- Bacteria
- Fungi
- Viruses
- Parasites
Non-infectious folliculitis may be caused by:
- Shaving
- Irritation from clothing
- Certain medications
- Chemical exposure
- Sun exposure
- Missing nutrients in your diet
Contact dermatitis , poison ivy , acne , or rosacea may also cause folliculitis.
Risk Factors
Factors that may increase your chanced of folliculitis:
- A suppressed immune system
- Exposure to bacterial infection
- Having other skin conditions, especially those that cause a lot of itching
- Shaving against the direction of hair growth
- Use of contaminated hot tubs, poorly maintained swimming pools, or contaminated lakes
- Exposure to oils and chemicals
- Overuse of medications applied to the skin
Folliculitis may cause:
- Itchy, red rash
- Appearance of crusty sores that do not heal
- Pus-filled blisters around the hair follicle
You will be asked about your symptoms and medical history. A physical exam will be done. Diagnosis may be made by looking at your skin. Testing will help your doctor determine the type and cause of the folliculitis. Other tests may be done to rule out specific skin or health conditions.
Tests may include:
- Culture—a swab of an open area to look for infections
- Smear—a sample an open area is smeared onto a glass slide to be looked at under a microscope
- Analysis of affected hair
- Biopsy of affected skin
- Blood tests
In most cases, folliculitis is treated with medication. The type of medication depends on the cause of the folliculitis. Talk with your doctor about the best treatment option for you.
Infectious folliculitis may be treated with:
- Topical or oral antibiotics for bacterial infections
- Topical or oral antifungal medications for fungal infections
- Oral antiviral medications for viral infections
- Topical or oral antiparasitic medications for parasitic infections
Non-infectious folliculitis may be treated with:
- Topical corticosteroids
- Non-steroidal anti-inflammatory drugs (NSAIDs)
To help reduce your chances of folliculitis:
- Be aware of, and avoid exposure to chemicals, especially at work.
- Avoid shaving against direction of hair growth.
- Use proper hygiene and handwashing techniques.
- Clean and maintain pools and hot tubs on a regular basis.
Revision Information
- Reviewer: EBSCO Medical Review Board Marcie L. Sidman, MD
- Review Date: 09/2018 -
- Update Date: 09/25/2014 -


text:
Reviews (4)
Wonderful, Old-Fashioned Pot Holders. . . . .
These pot holders remind me of the kind that we had when I was growing up. They are very well-made, sturdy, and clean up well in a standard washing machine and dryer. I highly recommend them as they are much better than most of today's flimsy pot holders.
excellent value. . . . .
A friend of mine saw these (for nostalgia) and wanted a set- thus my purchase.
The hot pads are fantastic. . . . .
This product meets many interior design standards: re-cycled cloth, which is re-constructed and re-purposed. It is both beautiful and utilitarian. It is also wonderful that an artisan is making a fair living.
Very Charming!. . . . .
I love these adorable pot holders, but have found it frustrating to have to purchase them in packages of three. I would love to be able to pick out my own three and purchase them for the price of $16.00. Isn't there any way this could be made accessible to the customer?


text:
So how many of you are addicted to Pinterest like I am? I'm OBSESSED! If you're not familiar - it's a site where you have a bunch of images that you like. Any site you're on, you can "pin" an image to one of your boards. Then other people see and repin to their boards and blah blah - sharing! It's a timesuck that I love.
While sucking my life away - I've also found a lot of great recipes that I want to try! Most of them are on my Food board. One in particular that jumped out at me was one for Crock Pot Buffalo Chicken. The number of crock pot recipes is astounding and I love it!
This recipe is soooo simple! The thing I love best is that you can use the chicken right from the freezer! I used boneless, skinless chicken thighs because that's what I had (the recipe calls for breasts).
Here's the recipe:
Slow Cooker Buffalo Chicken
- 3 lb. bag of frozen chicken breasts
- 1 bottle Frank's Wings Buffalo Sauce
- 1 packet Ranch Dip Mix
- 2 TBSP butter
- Put frozen chicken, wing sauce, and ranch dip mix into crock pot.
- Cook on low at least 6 to 7 hours
- Using two forks, shred chicken & return to crock pot.
- Add butter.
- Cook on low for an additional hour.
- Enjoy
Here's a shot in the crock pot. So easy! I just filled my crock pot (it's pretty small) with chicken thighs, poured the whole bottle of buffalo sauce on top and then sprinkled the ranch mix on top. Pop the lid on and you're done!
QUICK TIP: I've taken to buying baking potatoes and then when I'm sitting around in the evening - I just throw a couple in the oven for an hour. I saw from the folks at America's Test Kitchen to rub the potato in olive oil and salt and then put it right in the oven (no foil) so the skin gets crispy. It's a great time saver and you can put so much stuff on a baked potato! It helps so much when I'm getting our lunches ready in the morning!
So I had baked potatoes ready and decided to pop some of the buffalo chicken on top. Then I packed sour cream in a separate container for topping. I have to say - this was AMAZING! The recipe provides a lot of sauce in the pot along with the chicken - and the sauce with the baked potato - was so delicious.
It was also good on sandwiches of course - but for me - the potatoes were the best!
I hope you try this one and enjoy - and hey - feel free to share your favorite crock pot recipe in the comments! There will be TWO giveaways on tap this week as well!


text:
Boys Outerwear
Boys Outerwear, Coats and Jackets
Bundle him up and save in boys coats, boys jackets and boys outerwear from Sophia's Style. Our affordable boys outerwear will have him looking good and staying warm all through those cold winter months. We have many boys outerwear styles, colors and sizes to choose from so you're sure to find just what you are looking for. Start shopping and saving today! Don't forget winter accessories for your children! Keep them warm with hats, gloves and scarves.


text:
I also tend to be pretty poor at tracking who said what, unless I'm taking issue with a specific post or someone is doing the same to me.
I still must honestly say that Assud doesn't strike me as a true troll, but rather simply as cynical as I am but lacking my fine and yet loose-cannon command of written rhetoric. That assessment may or may not change, as with all things.
Anyway, aren't you glad I'm finally here? 'The enemy you know' and all that jazz?


text:
PORTSMOUTH — The internationally celebrated author Salman Rushdie will take the stage on Wed., Oct. 10. Rushdie will discuss his new memoir titled JOSEPH ANTON: A Memoir. Following his discussion, he will be interviewed by Virginia Prescott, host of New Hampshire Public Radio's "Word of Mouth," which will air the segment to NHPR listeners.
The book tells the extraordinary tale of Rushdie's years driven underground by an Islamist threat death against him for his work The Satanic Verses, one of 11 novels he has published.
"Rushdie's journey and literature is unique, and we are honored to have this international literary star in our series. Not only are his novels phenomenal, but he has a story of persecution that must be shared. I cannot wait to hear from him and to share his tale with so many," said Patricia Lynch, Executive Director of the Music Hall and Executive Producer of Writers on a New England Stage.
The international event that was one man's personal crisis is the story of this remarkable, long-awaited memoir. On February 14, 1989, Salman Rushdie was telephoned by a BBC journalist and told that he had been "sentenced to death" by the Ayatollah Khomeini. For the first time he heard the word fatwa. His crime was that he had written a novel, The Satanic Verses, which was accused of being "against Islam, the Prophet and the Quran."
So begins the extraordinary story of how a writer was forced underground, moving from house to house, with the constant presence of an armed police protection team. He was asked to choose an alias that the police could call him. He thought of writers he loved and combinations of their first names; then it came to him: Conrad and Chekhov — Joseph Anton.
In his most personal book yet, Rushdie finally discusses the details of what it was like to live during those fatwa years:
— Living for NINE years under the constant threat of being murdered
— The ultimate threat to freedom of speech
— Questioning the worth of becoming the artist he had worked so hard to be, the career he had always wanted, the career he built for himself after leaving a job as a copy writer for a London advertising firm (Yes, Rushdie used to write jingles before becoming a successful novelist!)
-- The personal and professional relationships that fractured under the incredible stress
— The intimate details of four marriages — love, betrayal, guilt, divorce, and the untimely death of his oldest son's mother
— The struggle to be the father he wanted to be to his two sons while living off the grid
— The family and friends who sustained him
— The heroic efforts by some publishers and bookstores to support him, to fight for him
— How the writing of his first children's book for his oldest son brought him out of the darkness, gave him hope to write again after almost giving up
— The financial stress of living on the run, living in friends' houses, renting new ones, constantly moving
— Negotiating with the British and American governments and the seemingly endless amount of bureaucracy involved
— The frustrating, often comic back and forth with his security guards about his every move
In this unimaginable conflict between the personal and political, Salman Rushdie followed the wisdom of one of his literary heroes. It was Joseph Conrad who wrote "I must live till I die." This simple sentence was something that gave Rushdie courage to go on. Rushdie not only survived, but he lived through those horrible years, continuing to write, continuing to fight for freedoms that most of us take for granted. This is a story of freedom lost and regained, of a life changed forever, and of an important fight not just for this one amazing artist but for all of us.
JOSEPH ANTON is exceptionally candid, compelling, provocative, moving, and of vital importance, because what happened to Salman Rushdie was the first act of a drama that is still unfolding somewhere in the world every day.
Salman Rushdie is the author of eleven novels: Grimus, Midnight's Children (which was awarded the Booker Prize in 1981), Shame, The Satanic Verses, Haroun and the Sea of Stories, The Moor's Last Sigh, The Ground Beneath Her Feet, Fury, Shalimar the Clown and The Enchantress of Florence, and Luka and the Fire of Life.
He is also the author of a book of stories, East, West, and three works of non-fiction — Imaginary Homelands, The Jaguar Smile, and Step Across This Line. He is the co-editor of Mirrorwork, an anthology of contemporary Indian writing, and of the 2008 Best American Short Stories anthology. He has adapted Midnight's Children for the stage. It was performed in London and New York by the Royal Shakespeare Company. In 2004, an opera based upon Haroun and the Sea of Stories was premiered by the New York City Opera at Lincoln Center.
A Fellow of the British Royal Society of Literature, Salman Rushdie has received, among other honors, the Whitbread Prize for Best Novel (twice), the Writers' Guild Award, the James Tait Black Prize, the European Union's Aristeion Prize for Literature, Author of the Year Prizes in both Britain and Germany, and the French Prix du Meilleur Livre �tranger. His books have been translated into over forty languages.
Book Clubs and High School Guests of The Music Hall
At each Writers event, The Music Hall hosts local high school students selected by their teachers, who come free of charge to the event and get an opportunity to meet the author. The Music Hall welcomes local book clubs attending on the night to take part in a drawing to be guests at a private backstage book signing/reception with the featured writer. For more information on how to join the Writers on a New England Stage book club list and drawing, email Associate Producer Margaret Talcott at mtalcottthemusichall.org. Interested high school and middle teachers can contact Programming Coordinator Chris Curtis at ccurtisthemusichall.org
Tickets and Signed Books
Tickets are $13 ($11 for members of The Music Hall and NH Public Radio). For each 1-2 tickets sold, the purchase of a book voucher ($30) is required. Vouchers can be redeemed on the night of the event for a signed copy of Rushdie's discussed work, JOSEPH ANTON.
Tickets can be purchased at The Music Hall box office in the Historic Theater, 28 Chestnut St., or over the phone at 603-436-2400. Tickets and vouchers are not available online for Salman Rushdie.
Writers on a NE Stage presents Salman Rushdie
PORTSMOUTH — The internationally celebrated author Salman Rushdie will take the stage on Wed., Oct. 10. Rushdie will discuss his new memoir titled JOSEPH ANTON: A Memoir. Following his discussion, he will be interviewed by Virginia Prescott, host of New Hampshire Public Radio's "Word of Mouth," which will air the segment to NHPR listeners.


text:
Looks like we're pretty light on articles in this section at the moment. The Village is brand new, so we're still working on writing more articles that you can trust, backed by healthcare professionals here at Epworth.
In the meantime, go ahead and start a conversation in the forum, let us know what you think about The Village so far or share your ideas on what content you'd like to see next!
For more information on nutrition, you may find what you're looking for on our blog or over on our website.
Always call 000 in an emergency.


text:
Another year, another F for the US Department of Homeland Security. That's the word from the House Government Reform Committee, which has just issued its most recent scorecard for cybersecurity among government agencies. The DHS received the lowest possible score for the third time in its three-year history, and is joined at the bottom by the Department of Defense. If you're an American, how safe does that make you feel?
A quick look at the complete list of scores reveals that eight of the twenty-four departments flunked cybersecurity, and that many of them are repeat offenders (Energy and Agriculture have both failed for five years running, a record that would make Bart Simpson proud). What's most worrying is that the agencies charged with security and diplomacy (State, Defense, Homeland Security) did so poorly, and it suggests that the government has yet to take cybersecurity seriously.
The sheer size and scope of these agencies no doubt makes it difficult to develop and enforce a comprehensive network security plan. State and Defense have the added burden of needing to support secure networks and PCs around the globe, while DHS is still struggling to integrate its many disparate agencies. Still, it's worth noting that large departments can do well; the Social Security Administration scored an A+.
Some encouragement can be drawn from the fact that dramatic improvement is possible. In 2001, for instance, the Agency for International Development, the Department of Labor, and the Office of Personnel Management all flunked. In 2005, all three scored an A+. Knowing that the Office of Personnel Management is prepared for a cyberdisaster, though, does little to help me sleep at night.
There's some debate about whether the report card score has anything to do with the actual security of department computer systems. The Federal Information Management Security Act requires each department to do a number of things, including complete inventories of all IT equipment, testing for security problems, and developing backup plans should something go wrong. According to Alan Paller, the director of research at the SANS Institute, many of these tasks amount to little more than writing reports—and a government report has never done much to stop a hacker.
"You get a very low score if you haven't finished a whole bunch of reports called Certification & Accreditation Reports," he told Computerworld. "They're 90% documentation of the system. Even the consultants who write these reports have never secured a computer system. They wouldn't know a secure system if they met it on the street."
That may be true, but it still doesn't seem like a healthy sign to have so many important agencies show themselves unable or unwilling to do a better job. Perhaps, as with many large organizations, the issue is one of inertia. Will it take a major computing disaster before the government makes information security more of a priority?


text:
If you've ever wondered what inspired Bernie Madoff's now-famous Ponzi scheme, a new expose suggests that it came naturally to the Queens native.
"Madoff With the Money," out next month from Wiley, retraces the life of the disgraced financier from his childhood in Laurelton, Queens, through high times in Palm Beach and on Wall Street, to his jail cell in a North Carolina prison, according to the Global Investor Bookshop.
"Bernie showed his con-man colors as early as high school, when he held an English class enthralled with an oral book report -- one that he made up on the spot out of whole cloth," Jerry Oppenheimer, the book's author, told the New York Post. "He also robbed Uncle Sam out of two years of Vietnam War-era Army Reserve active duty by developing a case of nerves."
And as no life of crime would be complete without an ailing marriage, Oppenheimer includes many a sordid detail, chronicling payoffs to female employees following alleged affairs.
But, his wife, Ruth, didn't seem to take her her husband's fall from grace too hard. After his arrest she "seemed to have just one concern: whether a $4,000 garment she'd bought in Palm Beach had been altered and shipped," the author told the Post.


text:
The Boeing 737
The Boeing 737 Series is the biggest selling jet airliner ever built. The aircraft size, configuration, economy, range and reliability have made the series a favourite with airlines around the world.
Since the 737 was launched in the 1960s with the 737-100, more than 14,000 orders have been placed. The 737 has carried over 12 billion passengers and travelled over 120 billion kilometres. With around 10,000 737s being delivered and more than 8,000 in service today, the 737 represents more than a quarter of the total worldwide fleet of commercial jet airliners. In fact, on average, about 1,250 737s are in the air at all times and one takes off or lands about every 2 or 3 seconds.
737s fall into three groups:
The Originals: 737-100 and 737-200. Production was from 1971 until 1988.
The Classics: 737-300, 737-400 and 737-500. Production was from 1984 until 2000
Next Generation: 737-600, 737-700, 737-800 and 737-900. Production commenced in 1996 and continues today.
The Next Generation Boeing 737-800 aircraft is the biggest selling model and has up to 189 seats, compared to just 100 on the original 737-100. It has more efficient CFM56-7B turbo fans; a new, more fuel-efficient wing and larger tail surfaces – all factors that have encouraged airlines to update their fleets. The new flight decks feature new six-panel LCD screens, providing more effective, easier-to-read information. The Next Generation 737-800 and 737-900 are the largest members of the Boeing family. They are distinguished by new fuselage lengths and an extended single-class seating range.
Technical Details:
|Power Plants
|2 x CFM56-7B26
|Maximum Thrust:
|116.99kN / 26,300lb
|Typical Cruising Speed:
|Mach 0.785
853km/h (530mph)
|Max Certified Altitude:
|Range with Full Payload:
4,800km (2,990m)
|Max Fuel Capacity:
26,025l (6,875gal)
|Average fuel consumption:
|2,000kgs per hour
|Operating Empty Weight:
|Max Takeoff Weight (MTOW):
|79,015kg / 174,200lb
|Max Landing Weight (MLW):
|65,316kg / 146,300lb
|Max Zero Fuel Weight (MZFW):
|61,688kg / 136,000lb
|Wingspan (with winglets):
|35.8m / 117.5ft
|Overall Length:
|39.5m / 129.6ft
|Vertical Fin Height:
|12.6m / 41.3ft
|Cabin Width:
|3.54m / 11.62ft
|Wing Area:
|124.6m2 / 1,341ft2
|Flight Crew:
|Typical two-class configuration:
|162 seats
|Max single class seating:
|189 seats
|Freight Capacity:
|6,220kg / 13,710lb
|Volumetric Payload:
|21,390kg / 47,100lb


text:
There isn't one now- it has no reference to the future for me, and refers to an imaginary present situation. That doesn't mean that this could never refer to the unlikely future, but context would make things clear. Logic tells us that there has been no past case or the slot in the Guinness Book of Records would have been taken and the requirement would be for more than three metres. All the person is trying to tell you is that there isn't anyone who meets the requirements today.
You are looking at single sentences for a definitive answer to things they cannot provide. We construct meaning in context and not in single sentences in isolation. Grammar doesn't provide us with everything- it gives us pointers and the context will make things clearer.
Student or Learner