My script, cpu_governor, and the associated init.d startup script are here: cpu_governor.tgz. Let me know if you find any bugs. Thanks.

It doesn't seem like we accomplished much on Thursday. A couple of us got a media center driver to take us downtown to do a little shopping and change some money. I finally got batteries that work in my camera and found a small bookstore that had a Hausa-English dictionary. Unfortunately it is not also a English-Hausa dictionary. We also hit the craft stores in the tourist part of town. Some folks had been there on Wednesday so the shop keepers were happy to see us again.

Mike, Luis, and Deily all got assigned to home stays so they're happy to be off seeing the town in a more Nigerian perspective. Unfortunately, Erika and Joe were ill; Joe's been ill quite a bit and is trying to get his return flight moved up so that he'll fly out with all the rest of us rather than staying for an additional three weeks.

A power outage caused some problems with the eGranary Thursday evening. When the generator came on and the machines started up the server complained about a corrupt filesystem. It would be a serious blow if we lost the eGranary, so we're scrounging through the lab to look for a good UPS that will actually keep the machine running for a while in the event of a power failure. This power issue is really pernicious and leads to hidden and not-so-hidden expenses everywhere. Father Michael told us that the center spends N12,000 a day just on diesel to run the generators.

Friday

Friday is a half day here as most offices and shops shut down for the afternoon for Muslim prayers. We ran some errands in a hurry to get last minute items before noon. Tony (who teaches computer classes here and has been our primary IT liaison) and I went to town to get PVC pipe to bury the CAT5 cable connecting the media center with the bookstore/cyber cafe. We also were able to return some coax cable we hadn't used and picked up a couple other odds and ends.

I have a copy of the Ubuntu package repository on my laptop that I'm trying to figure out how to share, but haven't come up with a good storage option for 24GB of packages. I'm going to burn it to DVDs for now so hopefully it can be installed on a hard drive somewhere. One of Linux's great strengths is the ability to install software easily over the Internet, but considering the bandwidth here, that can also be a liability. Having the repository locally should make a huge difference.

The group dug a shallow trench between the buildings here and we ran CAT5 cable through the PVC and buried it. At least that's one project accomplished. We've given up any hope of seeing the computer shipment before we leave on Sunday.

Friday night we were treated to a small party at the Fathers' house. Father Kukah, Father Tony, and Father Michael hosted us and several other priests and members of the community attended along with a couple of the host families who had taken us into their homes.

Saturday

We spent the morning tidying up the computer lab where we had spread out all our hardware and tools. We buried the last few feet of cable and fixed up the connection. The group then walked over to the nearby Internet cafe which was unfortunately closed. The power was off and the cost of running the generator probably outweighed the revenue from customers.

Nicholas was to leave at 3 in the afternoon to drive to Abuja where he would catch his flight to Lagos and then on to Johannesburg en route to Zimbabwe. He had a lot of last minute things to wrap up and we exchanged contact information before he was whisked off.

Meanwhile, Bryan and Joe wanted to try to get some video footage of the town beyond the walls of the social center. Unfortunately, they had not gotten much further than the gate of the compound when they were stopped by a pair of plainclothes secret service members. Bryan and Joe were arrested, put in the back of the car and taken to a nearby station. The social center guards alerted Father Michael and soon Carey, Father Michael, Father Kukah and several others were headed to the station to try to get them out.

Apparently Bryan and Joe were interrogated and suspected of a variety of transgressions including espionage and terrorism. It's not clear to me how critical the situation was, but the Fathers were able to get them released fairly quickly. They even had their tape returned.

The group will be taking a bus to Abuja tomorrow afternoon then catching a flight to Frankfurt. We'll then split up onto our various flights onward. I expect to be back in Minneapolis by Monday evening.

The morning started out slow. I met Mike at the restaurant at about 8:30 where we had eggs and chips and coffee (Nescafe) for breakfast. We hadn't seen anyone else so weren't sure what the plan was when Father Anthony stopped by to say that Father Kukah's chef had prepared breakfast for us. So we proceeded to have a second breakfast: crepes filled with ground fish, bread, spicy scrambled eggs and more coffee. Bryan arrived shortly as he had been interviewing the fathers on video in the media center. Bryan has been video-taping much of the activity for World Computer Exchange.

Since it was Saturday and Nigeria was playing in the Olympics against Cote d'Ivoire in the afternoon the local IT folks weren't planning to be around. Once most of the rest of us had arrived we began finding projects to work on. I did some cable management. Bryan and Carey tried unsuccessfully to revive a coax link between the "cyber cafe" and the media center.

Nigeria wins against Cote d'Ivoire. Yay!

Sunday

No one around, stores closed. There's an amplifier and speakers in the media center computer lab. I used electrical tape to splice together a cord so we could plug our various ipod-like devices into it. Yay, music.

A few of us took a long walk toward downtown. Didn't buy much but got a better sense of our location. Carey took Ben to airport and met Erika who flew in from Orlando to join the group. The last team member, Deily from Costa Rica, had a cancelled flight, but she managed to get an alternate flight arriving Monday. Carey and Erika will be staying in Abuja until she arrives then they'll drive to Kaduna on Tuesday.

Monday

Bryan and I and local IT team member Mike tried again to get the coax cable between the buildings to carry a signal. We finally came to the conclusion that one of the hubs was bad. Luis had brought a spare hub that had a BNC connector so all looked good until we plugged it in forgetting that it was not a dual-voltage device. Smoke and popping noises! No more hub. On to plan D or whatever we're up to now.

Tony, Bryan and I met with a local ISP to discuss the cost of getting Internet access for the center's cyber cafe. The quote for Internet via satellite was N150,000 a month for 128Kb-down/64Kb-up. That's almost $1300! We're going to have to look at other options.

Folks seem to be pretty down. No word on the computer shipment.

Tuesday

Nicholas, Luis, and Mike went to Zaria to visit schools and offices of the archdiocese there. It's about an hour's drive so they'll just be doing a day trip. Apparently there aren't nearly as many schools wanting to setup computer labs as there were in Jos.

Carey, Erika, and Deily arrived from Abuja. Erika and Deily went right to work teaching a group of kids how to use the media center computers. They'd brought a bunch of educational software and seemed to be having a great time.

Bryan and I decided to find out if ethernet over cat5 cable could really handle cover the 300 feet between the buildings. That's just at the official range. And it worked! We set up the eGranary server in its own room, connected the computer lab and the cyber cafe and could browse the eGranary from either location. Excellent. The cat5 is just strung across the field at the moment, so we're hoping the gardener doesn't try to mow the lawn in the next day or two.

The guys returned from Zaria in a good mood, lots of introductions all around. Nigeria wins the semi-final against Belgium. A pretty good day.

Wednesday

We spent the morning trying to tidy up the computer lab machines, resolve some outstanding issues, and get them all configured to use the eGranary. I set up a thin client server, but the machine is too underpowered to be of any real use other than a very slow example. Also, the machines here all have Netware BIOS's and try to network boot using the RPL protocol which LTSP doesn't handle. I don't know how to get them to use PXE or EtherBoot. Bummer.

The power here is totally flaky. Most of the UPS's are on their last legs and often take several attempts to get them to turn on, others beep continuously which renders them annoying enough to be unusable, and there seems to be a charge on the ground circuit. Several of us have had mild, but startling, shocks off the computer cases even when they're turned off.

In the afternoon we took two cars to the central market to wander around and see the sites. The market is a maze of little shops along alleyways, selling all sorts of things from meat and vegetables to electronics, kitchen ware, cloth, and motorcycles. We went to what seemed to be the only craft shop in the market and bought a few traditional Nigerian crafts. I was tempted to buy a python skin, but decided to forego it.

Tonight I'm back at the cyber cafe checking email. I don't have any new photos since my camera is out of batteries.

Since we will be setting up the eGranary digital library here it can provide a lot of information over the network even without access to the wider world so it's important to get all the machines connected again.

Unfortunately a few of the team members with less technical capabilities are at a loss for things to do. They had been expecting to be able to help with setting up the new computers but since the machines are still in customs they feel a bit superfluous here. It's going to be a challenge keeping everyone occupied for the duration of the trip.

Several of the team members in Kaduna had been a bit ill while Mike and I were gone so Father Anthony offered to have special meals prepared for us -- we had previously been eating in the regular restaurant at the Social Center. Hopefully this will help folks adjust to the diet here a little more gradually. There's been some confusion about whether he was offering breakfast as well so on Friday morning we had breakfast twice, once at the restaurant and once at the Father's house.

It's Friday afternoon now and most of the team has split up by their own initiative to work on whatever different projects they think are useful. Mike is learning to cut and crimp CAT5 cables; Nicholas has spent the morning fixing a laptop from the Media Center which had a bad battery connection; Carey, Lewis, and Ben have gone in search of more CAT5 cable and a few other odds and ends; Bryan has been busy video taping as much of the activity as he can. Earlier this morning there was an impromptu class on cable crimping for the local IT team. Joe has been burning Ubuntu CDs for folks and I've been compiling information from the last several days. The power is out, but the computer lab is running off a generator just outside the window. I'll set off to a nearby cyber cafe with Internet access to post this blog in a few minutes.

Yilwe and I spent the morning touring different schools run by the Catholic Archdiocese of Jos and looking at their computer labs. We met with Sister Mary Patrick, the Education Director for the Archdiocese, then started at St. Louis school for girls where Yilwe runs a general purpose computer lab and a Cisco lab teaching the CCNA curriculum. Yilwe says this is the only Cisco program at a secondary school in West Africa, all the others are at the university level. The school is very interested in addressing the issue of gender balance in IT and getting girls into the field early. Unfortunately they are limited by the quantity of computer equipment. These were the only two labs for the school of about 700 students -- a total of about 37 computers. And this was the best of the schools we were to visit.

Aside from the lack of equipment, the major concrete barriers to IT programs here are the poor electricity supply and the high cost of Internet access.

I don't think there has been a day yet since I've been in the country that the power has not gone out for several hours or more. Even when the power is on it often runs at very low voltages. Instead of the expected 220 volts, the lines may provide anywhere from 150 to 250 volts. Accordingly anyone interested in running a computer lab needs both a generator and a collection of voltage regulators.

All the Internet connections I've seen so far have been via satelite even though Nigeria is a member of the SAT-3 consortium which provides undersea cable access to Europe and the rest of the world. Apparently no one has run terrestrial lines to connect the rest of the country to the coastal areas. Satellite connectivity is slow and expensive. Yilwe said that for a 128Kb-up/64Kb-down subscription he paid about N50,000 ($427) per month. In addition, purchasing the satellite dish and modem can run N140,000 ($1200) and up.

On the power front, Yilwe would like to eventually see labs run by solar power and wants to switch to less power-intensive LCD screens as soon as possible. Most monitors are still CRTs here.

Despite these problems, Yilwe says the primary constraint on IT in Nigeria is awareness. He believes that once people realize the possibilities provided by IT access and its necessity for interacting with the rest of the world the demand for solutions will provide the incentive for improvements. He thinks the key is teaching children and young adults to use computers, thus the strong emphasis on computer labs in the archdiocese schools.

Yilwe also has a vision for setting up a Linux academy, teaching students to take the RHCE, Linux+, and other certificates. He's looking for curricula and equipment to get started as well as just getting the information out to raise awareness of the possibilities provided by Linux and other free and open source software projects.

Other things he's excited about are digital libraries like the eGranary from widernet.org and thin client labs running on the Linux Terminal Server Project. There's a great deal of potential and excitement here; it's painful to see the lack of resources for developing these ideas more fully.

After looking at St. Louis school we headed south out of town to visit some schools in more rural areas. We visited the Kuru Trade School and the Spiritual Year Center, also in Kuru. Between the two schools there was one computer. But both had large empty rooms they hoped to turn into computer labs.

Further out of town we went to St. John Vianney Minor Seminary in Barkin Ladi where there were a handful of computers then to St. Joseph's College in Vom with another dozen or so. Heading back into town we stopped at the College of Mary Immaculate which was in the process of building a new library with hopes of including a computer lab.

We swung by the Pastoral Center to pick up Mike who was feeling better by now and continued to a couple schools in town: St. Theresa College and Fatima College.

We ran out of time to reach all the schools so on Thursday morning we visited St. Murumba College and St. Patrick's School which had similar computer needs. It became clear that we could probably send the entire container of 800 computers to Jos if we wanted to fill the need here, without even considering the needs of the other cities of Kaduna, Kafanchan and Zaria.

Before leaving Jos, Mike and I were invited back to the Pastoral Center to meet with Archbishop Ignatius Kaigama then to have tea with Sister Mary Patrick. We were back on the road by noon and had a dry and uneventful drive back to Kaduna.

Abuja is built in an area with some outstanding giant rock formations. Near the National Assembly and right behind the zoo is Aso Rock and on our way out of town we saw Zuma Rock.

After our tour we headed out for Kaduna. The drive was uneventful and the road seemed fairly good. Most of the route is divided highway. In Kaduna we were set up at the Catholic Social Center. The center consists of a few hotel-style buildings, a church, and a restaurant and bar. We each were given a room with bed, TV, and bathroom. The bathrooms seem to be of varying quality with some having better luck with things like hot water, but generally the facilities are quite comfortable.

Next door to the Social Center is a Media Center which houses audio-visual studios and a computer lab for teaching classes. About a hundred yards away from that is a bookstore and a currently-unused cyber cafe.

At the Social Center we met another WCE team member, Obafemi Badajo from Abeokuta. We also met Fr. Kukah, Fr. Michael, Fr. Anthony, and Tony, who teaches computer classes at the Media Center.

Tuesday morning we had the first official WCE meeting with the local IT team and representatives from Jos, Kafanchan and Zaria. Due to the short time frame the Oshogbo and Makurdi projects had been dropped.

We went around the room introducing ourselves then got an update on the status of the computer shipment (still delayed--maybe next week) and tried to come up with a tentative plan of action.

The city representatives described their current setups and what they needed and/or wanted in terms of computers.

After lunch Obafemi took the iniatitive to present a brush-up class on Windows XP for those city representatives who needed it. Meanwhile others of us tried to set up a wireless network using a laptop as an AP -- failing, unfortunately -- and compiling an inventory of the arriving equipment and comparing it to the needs.

One option we discussed was for team members to go out in pairs to the various cities to see the conditions in person and perhaps be better able to make recommendations. For the most part we decided this was unnecessary, but the representative from Jos, Yilwe Dimlong, was very interested in taking folks to see the Jos school situation. Since he had to return to Jos the same afternoon I volunteered to go with him and drafted Mike to come with me.

Driving between cities at night in Nigeria is dangerous due to road conditions and lack of lighting. Often trucks that break down on the road will simply stop where they are without any sort of safety lighting and many of the okadas (motorcycle taxis) have poor or no lighting at all. Since it was already 3:30 when we decided to go to Jos we had to pack and load the car immediately in order to make it to Jos before dark.

Although we left in time, we ran into heavy rain and dark clouds as we came up the escarpment onto the Jos plateau which contributed to some tense moments. The driver was quite good, however, and we arrived at the Catholic Pastoral Center in Jos without incident. We took a route via Kafanchan and Vom which included a shortcut on an unfinished stretch of road.

Wednesday, after successfully getting Internet access and looking around the former Boulder Hill compound, we went back to the guest house then caught a taxi to Hill Station to eat at the Chinese/Lebanese restaurant, Elysar. We enjoyed some excellent felafel and other Lebanese dishes along with some Nigerian Star beer. NEPA was out and the restaurant was running on generator, however the lights went out mid-meal due to a generator fault. We ate for a while by candle light which was quite nice until the power came back on. A taxi ride brought us back to the guest house for the night.

I should describe the taxi situation. My impression is that there is no taxi regulation. It used to be that taxis were all painted yellow and green, but I've only seen a couple old Peugeots that have that coloring. To get around town you can either hail a motorcycle and pay to sit on the back or flag down an unmarked cab. Motorcycle taxis are cheaper and there are hundreds of them, but it looks dangerous so we haven't tried it. With regular cabs you can either share the vehicle or ask for a "drop" which means they take you straight to your destination. There are no meters, you just negotiate a price. Since there were two of us we went for drops; the price is still low--between N150 and N300 for any trip we took--and it's convenient. However, this leads to the odd problem of trying to flag down a regular car that you think maybe looks like a taxi with no passengers. It's not very efficient. I think we got a ride in someone's private car once because the driver didn't charge us anything. In fact I think I may have insulted him by asking the price.

On Thursday, one of Andy Horling's drivers picked us up to drive out to Miango to visit the cemetary where my mother is buried. It was nice to get out of the city for a while. The road to Miango is badly potholed so the drive was slow and traffic was light so we were able to enjoy the scenery without the traffic stress.

Thursday night we enjoyed dinner at Jay and Heidi Tolar's house along with Al and Jackie Persenaire who have now been at Hillcrest for around 30 years.

Friday we walked downtown to visit the EYN (formerly CBM) compound and visit the museum neighborhood to look at the arts and crafts for sale. We also looked for postcards there and at a nearby bookstore, but had no luck.

Friday night we were taken out on the town by our friends Julie and John Orshi. Julie teaches psychology at the University of Jos and John works in public relations for the University. As much as we enjoyed being with members of the Hillcrest community it was nice to see Jos from a more Nigerian perspective. We went to two restaurants, at the first I had semovita with sauce and beef and Emily had rice, fried plantain and chicken. After eating all this, John said "We're not done yet!" and off we went to find a place for grilled fish. The second restaurant was an outside patio near a barbeque where women grilled whole fish. Luckily, there was quite a wait for the fish to be ready so we had time to digest some of the first course before starting on the second. When it came, the fish was presented whole, topped with tomato and onion slices with a side of chips (french fries). Very good.

Saturday morning I felt a little under the weather so we hung out at the guest house then in the early afternoon we ventured downtown to do a little tourist shopping. Emily bought some fabric from a store on Amadu Bello Way, the main commercial street, and we visited a very nice NetCafe which had pastries and cappacino. We tried unsuccessfully to find postcards. All of the bookstores we visited had ornate birthday and wedding cards, but no postcards.

Sunday we attended the chapel service at Hillcrest then ate lunch at La Speciale Restaurant, a new place across from the CRC guest house. While we were walking back from the restaurant it started to downpour and we took refuge under the awning of the Oasis bakery. After waiting for 45 minutes we decided the rain was not going to stop so we hurried back to the guest house sharing our one small umbrella.

Andy Horling's driver picked us up Sunday afternoon and we drove the three-and-some hour drive to the airport at Abuja. Emily checked in for her flight and we waited in the airport until the driver sent by Fr. Kukah arrived to meet me and the rest of the team which was arriving from Frankfurt. Emily caught her flight out and Cary, Bryan, Ben, Mike, and Lewis arrived shortly after that with a great deal of luggage and equipment. We loaded up the bus from the Archdiocese and drove to the Catholic guest house for the night.

This afternoon we came to the former Boulder Hill Hostel compound where there is now an Internet café. We walked around the compound a bit and took pictures before coming into the café to use the network and post these updates. Next we'll be heading downtown to try to get the cellphone situation working.

The rain stopped and the river quickly diminished and everyone returned to their business. We stopped at a couple roadside stands to try to find a SIM card for my phone, but I had forgotten that it would be locked by the US network (t-mobile) so the search was not fruitful. We bought an umbrella for N400 and walked on to Hillcrest. About the only notable visible difference at Hillcrest is the wall topped with coils of razor wire that circles the campus. At the entrance is a gate house and drop-arm barriers manned by several guards in uniform. They each wore a Hillcrest School security patch on their shoulder and look very crisp.

We were just starting to look around when Jay Tolar drove up and gave us a big warm greeting and welcome back. He had reserved a room for us at the Baptist guest house (formerly Boys Baptist Hostel) across the road which his parents, Jack and Barbara are now managing. He gave us a ride over and we confirmed with his mother that we would be there the rest of the week. Following that, Jay drove us to Andy Horlings office where we discussed getting a car and driver to take us out to Miango later in the week and getting a ride back to Abuja on Sunday. Andy had a lot of fond memories of my parents and was happy to visit with us. He then volunteered to take us downtown and help me get a cellphone.

We drove downtown past Hill Station hotel, a Jos landmark, and the museum and zoo complex. We found a road side stand selling cell phones on the new network, Multilinks, for N1750 so I bought one and an additional N200 in minutes. Andy then gave us a ride back to the Cedar Tree where we called it a day.

Unfortunately I've been unable to get the cell phone to dial out successfully so I'll try exchanging it as soon as we make it back downtown again.

The next day (Tuesday) we took a taxi back to the Baptist guest house to drop off our bags, then went back to Hillcrest to wander around and take pictures. It was the day before school was to begin for the semester so many of the teachers and administrators were around getting ready for the students to return. We met Stuart Carlson, the maintenance manager; Al Persenaire, science teacher who remembered me and my parents from years ago; Jason Pointer (sp?) the chaplain, Dele Alabi the computer systems manager; Heidi Tolar, formerly Heidi Gibb, who teaches PE among other subjects; and Tittle Abader (sp?) who works in administration; "Uncle" Sam, who works security; and several others whose names slip my mind. Everyone has been enormously friendly and helpful, Jason even lent us a cell phone to use for a couple days until we could get one ourselves. Dele Alabi also runs an Internet business out of what used to be the girls' hall at Boulder Hill Hostel so we will be going there shortly to try to do email and post these updates.

The Hillcrest campus really has not changed much. We were able to walk around the entire area and go into the auditorium. Everything is well maintained, but photos from today could almost have been taken 20 years ago. One new feature is a campus wide WiFi network that is being built out. There is a broadcasting tower next to the computer lab (what was the fourth grade when I was there) with flat, cell-phone style antenas facing all directions. I didn't have time to ask Dele more about it, but hope to before we leave.

After the tour, Emily and I went back to the guest house, took a nap while it rained again and stayed in for the evening.

Unfortunately, Joe only brought travelers checks and they would not accept them. Apparently only banks or the bureau de change will deal with travelers checks, so I bought some from him for Dollars and then he changed the Dollars for Naira. Also, the money exchangers claimed that $20 bills are less valued than $50s or higher denominations. They wanted to give us only 110 to 1 for the 20's, but we got them up to 115 to 1. So, I'd recommend bringing most of your money to Nigeria in $50 bills.

We found out later that 117 was pretty much the going rate for exchange, so I don't feel bad about not having bargained harder.

Our next stop was a gas station where Christopher fueled the car and the rest of us bought bottled water and batteries. Then we loaded back up for the trip to Jos. We took the road through Keffi which I hear is the short route. The longer route is probably more scenic, but in any case it was beautiful and I was happy to get back on the plateau again after so many years. The weather was beautiful the whole trip (about 2 or 3 hours) and probably dropped a couple degrees as we gained elevation. The countryside is at the height of its incredibly green, lush, rainy season foliage. We came up through the hills past many of the signature rock formations of the plateau, huge boulders stacked on each other, large outcroppings of granite, and flat-topped hills in the distance.

The only problem with the trip was that we were stopped at a police road block where the policeman said they were checking for road-worthiness. He asked for the papers from Christopher, who provided them, but then said that the specific road-worthiness certification and proof of ownership paper was missing. Christopher followed him back to their car where they had a long discussion. Eventually he came back and very apologetically explained that they were asking for a N2500 ($21) fee because of the papers and would we be able to front the money since he did not have it on him. We did so and we were shortly on our way again. Interestingly the only vehicles that were being stopped seemed to be the expensive looking ones while several old clunkers with bumpers about to fall off were waved through. Curious, given the road-worthiness explanation. Well, I'm not saying. I'm just saying.

Coming this route from Abuja brought us through Bukuru and then into Jos. I did not recognize Bukuru at all until I saw the road signs. Both towns have grown enormously and the road between them has pretty much filled in with new growth: residences, businesses, a couple industrial looking buildings. Traffic was very heavy on the road and pretty hectic with big lorries driving slow, taxis and private cars speeding past them, motorcycles riding slower and right along the edge of the road to avoid getting hit, and then pedestrians trying to dodge through traffic to cross the road. Several times we saw cars squeeze a third or fourth lane out of the road and speed into oncoming traffic before pulling over just in time to clear. Given that many of the vehicles, especially the motorcycles, have poor or non-existent tail lights the recommendation against driving at night is well taken.

I did recognize some landmarks driving into town, the Nasco factory, for example, and then NTA and Flat Top hill so I was able to spot the Cedar Tree Guest House and direct Christopher there to drop off Emily and myself. We checked in (N6500 a night for a double - pretty steep, but a nice place) then saw off Christopher and Joe as they headed on for Kaduna.

Aside from the growth in buildings and traffic, the most remarkable difference in appearance here are the walls. It seems that almost every private residence beyond a simple shack has a wall around it. Even many of the businesses are in walled compounds. The simpler places have a plain concrete block wall, more well off ones have walls topped with broken glass or jagged pieces of metal, then others have even more imposing walls topped with coils of razor wire. The front gates to the compounds are solid metal with small sliding peep holes to allow the guard inside to see you before he opens the gate. The walls are very depressing and really change the appearance of the city. What they say about the security situation here is even more depressing. Security, electricity, water have all been privatized by necessity since their appears to be little functioning state apparatus to supply them. Instead of a community you get a series of isolated fortresses attempting to be self-sufficient. Perhaps I'm overstating this, but I found it quite disturbing.

We had a three hour layover in Frankfurt which was time enough to get some breakfast -- coffee, danish, and grilled cheese sandwich. There are an abundance of sausages available in the airport, but it seemed a bit too early for me.

The airport had WiFi for a fee so Joe and I each bought an hour's worth and we all emailed updates. I still have a half hour left to use on the return trip.

The flight from Frankfurt crosses the Alps, the Mediterranean, the immensity of the Sahara before passing right over Nigeria and landing at Malabo, Equatorial Guinea. We were not able to get off the plane in Malabo, but the view from the plane gave the impression of a very small town in a rain-forest covered island surrounded by off-shore oil rigs. When we took off again the sun had just set so we were able to see dozens of gas flares burning red and orange in the dusk.

An hour's flight from Malabo put us into Abuja at about 8:15 local time (UTC +1). The airport in Abuja was strikingly different from my former experience in Kano airport. The airport was clean and spacious and although there was a long line to get through passport control, the process was orderly. Our bags came out on a baggage claim conveyor belt and after a cursory check at customs we were through.

Unfortunately, the bureau de change at the airport was closed for the night so we were unable to change money. We were not able to buy water as we'd planned and if we'd needed a taxi we would have had to negotiate in dollars. Luckily, we shortly connected with Christopher, a driver for the Catholic Arch-Diocese who had been sent to pick us up. A fifteen minute drive from the airport brought us to the Catholic Guest House (abbreviated DRACC, but I don't know what that stands for). The power appeared to be out in the neighborhood as it was completely dark save for the headlights of cars and candles on the tables of a few small snack shops along the road. However the guest house was lit, so it probably has a generator or battery system.

The guest house is a very nice compound reached via a short drive down an incredibly pot-holed dirt road. The compound has several buildings and appears to have many rooms, but it was quiet and we seemed to be among the only guests that night. Rooms had running water, bathrooms, electricity (although it went out a couple times over night), air conditioners, and TVs. After quick showers we went straight to bed to recover from 24 hours of traveling.

Currently ::MP2 is on version 0.0.3 and ::Store is on version 0.0.5. Both of these should still be considered ALPHA software, use it at your own risk. :)

You can find the latest version of ::Store here and the latest version of ::MP2 here.

Please feel free to send me your comments, questions or bug reports. Note that I did not implement a test suite with ::MP2 since I haven't figured out how to do it yet.

Below is the documentation (from the embedded POD). ]]> NAME UMN::CAH::Client::MP2 - A mod_perl2 client implementation of the U of M single sign-on authentication. VERSION This document describes UMN::CAH::Client::MP2 version 0.0.3 SYNOPSIS Recommended: using a persistent object: <perl> use UMN::CAH::Client::MP2; $Global::UMN::CAH::auth_object = UMN::CAH::Client::MP2 ->new( allow_impersonation_by => [ 'cayfo001', ], acl_file => '/home/apache2/default_acl_file', ); </Perl> <Directory /home/apache2/htdocs/restricted/> AuthType Basic PerlAuthenHandler $Global::UMN::CAH::auth_object->handler Require valid-user PerlAuthzHandler $Global::UMN::CAH::auth_object->handler </Directory> Alternative: using a new default object for each request: <Location /restricted_access> AuthType Basic PerlAuthenHandler UMN::CAH::Client::MP2 Require valid-user </Location> DESCRIPTION This is a mod_perl2 module to allow user authentication on the University of Minnesota's Central Authentication Hub (CAH, AKA "Cookieauth") single sign-on system. For more information on the CAH system and other implemenations please visit http://www1.umn.edu/is/cookieauth/. This module handles the mod_perl front-end to the authentication and authorization and relies on UMN::CAH::Client::Store to handle the back-end -- that is, the details of verifying client cookies against the U of M's servers and caching the responses. This module should be considered alpha software. It was developed on Debian and Ubuntu Linux and has only been tested under the Apache2 prefork engine. I would welcome contributions and comments to fix bugs, make the code more portable, and any other general improvements. INTERFACE new $object = UMN::CAH::Client::MP2->new( %config_options ) Class method to create a new MP2 object. The object holds a link to the store and cache, so you should ideally call this in a Perl section of the apache config file. This same object can then be referenced without needing to create a new object again later. Each object is configured at creation. If different parts of your website need different configurations you can create multiple objects as needed. You can just use "UMN::CAH::Client::MP2" as an authentication handler as illustrated in the synopsis, but this will incur the object creation costs for each request and will only allow default configuration. Since there is no default acl_file, this method cannot be used as an authorization handler. The new method accepts named arguments to configure the object * acl_file Full path to file to use for authorization (only relevant if called in the PerlAuthzHandler). See below for the configuration information. Default: undef * allow_any_ip Array of IP addresses. Requests from these clients will not be checked for IP address consistency with the CAH cookie. Default: [] * allow_impersonation_by Array of x500 ID's for clients who will be allowed to impersonate other clients on this website. See below for impersonation details. Default: [] * https_port Port on which this webserver is running https. Any requests handled by the authentication object which are not under https will be redirected to the https port. Default: 443 * auth_server The IP address or DNS name of the CAH server. Default: x500.umn.edu * auth_port The port on which to contact the CAH server. Default: 87 * auth_modulename The X500 module to use for cookie authentication. Default: WEBCOOKIE * login_url The URL to which clients are directed to login to the U. Default: https://www.umn.edu/login * min_level Minimum acceptable authentication level. Default: 30 * timeout_len Authentication timeout time in seconds. This is measured in time since the authentication cookie was originally created. This is not necessarily the same time as when the client first hit this website. Default: 10800 (three hours) * rolling_timeout_len Authentication timeout time in seconds since last activity on this authentication cache. Setting this to zero deactivates this feature. For example is set to 300, the authentication will be timed out if the user is not active on this website at least once every five minutes. Note that there no way to tell if they have been active on other U of M websites so this feature has limited usefulness. Default: 0 (inactive) * share_file Filename to provide to Cache::FastMmap as a cache file. Default: /tmp/UMN_CAH_Client_Store_Cache * enable_stats Passed through to Cache::FastMmap. Default: undef * expire_time Passed through to Cache::FastMmap. Default: undef * cache_size Passed through to Cache::FastMmap. Default: undef * page_size Passed through to Cache::FastMmap. Default: undef * num_pages Passed through to Cache::FastMmap. Default: undef * unlink_on_exit Passed through to Cache::FastMmap. Default: undef handler $object->handler The mod_perl entry point. DIAGNOSTICS TODO CONFIGURATION AND ENVIRONMENT ACL file The ACL file provides a very simple authorization mechanism. The file should be a sequence of lines where each line consists of one of two directives: "allow" or "deny", followed by white space and then either an x500 ID or the symbol "*". The ACL file is read from top to bottom and processing stops at the first line to match the current client's ID. The * will match any ID, so processing will never continue beyond a line with a * ID. If the matching line's directive is allow access is granted, otherwise it is denied. If processing reaches the end of the file without finding a match, access is denied by default. Blank lines are ignored as is anything on a line following the comment character: #. The ACL file is only consulted if UMN::CAH::Client::MP2 is called in the authorization phase (as a PerlAuthzHandler). Impersonation You can allow certain clients to impersonate others on a protected website. If the ID of the authenticated user matches one listed in the "allow_impersonation_by" option then they can choose to set the ID passed on to Apache and other applications to another string. Impersonation is done with a URL query in the form "impersonate=xxxxx". If the current authenticated user has impersonation permissions and the impersonate query is found in the current request then the effective ID associated with this authentication cookie is set to the specified string (xxxxx) and is used instead of the real ID to set Apache's user variable. A query of "impersonate=" (with an empty field after the = ) will reset the effective ID to that of the real user. The effect of this impersonation is limited to the area using the same authentication cache file. It has no effect on any other websites. Note that the authorization phase of UMN::CAH::Client::MP2 looks at the effective ID rather than the real ID and so will be affected by impersonation like any other script running under Apache. DEPENDENCIES Test::More version Carp version UMN::CAH::Client::Store Apache2::RequestRec Apache2::RequestIO Apache2::Const Apache2::URI Apache2::Log Apache2::Connection APR::Request APR::URI ModPerl::Util Apache2::ModSSL INCOMPATIBILITIES None reported. BUGS AND LIMITATIONS Please report any bugs or feature requests to the author. AUTHOR Steven Cayford "cayfo001@umn.edu" LICENCE AND COPYRIGHT Copyright (c) 2008, Steven Cayford "<cayfo001@umn.edu>". All rights reserved. This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. See perlartistic. DISCLAIMER OF WARRANTY BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. ]]> tag:blog.lib.umn.edu,2008:/cayfo001/blogorama//1538.131976 2008-06-20T21:43:22Z 2008-06-23T21:42:11Z

UMN::CAH::Client::Store - A cacheing proxy object for the U of MN's
Central Authentication service.

This document describes UMN::CAH::Client::Store version 0.0.3

 use UMN::CAH::Client::Store;

 my $authhub = UMN::CAH::Client::Store::AuthHub->new();
 my $cookie_ref = $authhub->get_and_verify( 'EncodedCookieToken',
                                            {
                                              ip => '127.0.0.1',
                                            } );

 if ( $cookie_ref->{status} eq 'OK' ) {
   print( "Authenticated as user $cookie_ref->{euid}");
 }
 else {
   my $redirect_url = $authhub->redir_url( 'https://some.host.umn.edu/', $cookie_ref );
 }

UMN::CAH::Client::Store creates a cacheing proxy object to handle the
interface to the University of Minnesota's Central Authentication Hub.
This module uses Cache::FastMmap and Store::AuthHub to handle the
cacheing and the connection to the authentication server.

$object = Store->new( %options )

Returns a new Store object. You may specify the following named options:

 server => x500 server DNS name or IP address (x500.umn.edu by default),
 port => the port number on which to contact the server (87 by default),
 modulename => x500 module name to use (WEBCOOKIE by default),

 login_url    => url to redirect users to for login (default: https://www.umn.edu/login),
 min_level    => minimum authentication level accepted (default: 30),
 timeout_len  => authentication timeout in seconds (default: 10800),
 rolling_timeout_len => timeout since last activity in seconds (default: 0),

 share_file     => this and the following are passed through to Cache::FastMmap,
 enable_stats   =>
 expire_time    =>
 cache_size     =>
 page_size      =>
 num_pages      =>
 unlink_on_exit =>

$object = $store->authhub()

Accessor for the underlying Store::Authhub object created by new().

$object = $store->cache()

Accessor for the underlying Cache::FastMmap object created by new().

$hash_ref = $store->get( 'token' )

Searches for the encoded cookie token in the cache or from the x500
server and returns a reference to a hash of the parsed response along
with a couple of extensions.

The resulting hash will have the following values: 

status => "OK|NO", # from x500 
level => "5|10|20|30|40|50", # from x500 
timestamp => time, #from x500 
ip => "xx.xx.xx.xx", # from x500 
id => "userid", # from x500
token => "encrypted string" # set by Store::AuthHub 
lastactive => time, # set by Store::AuthHub, updated by Store 
euid => "userid", # set by Store::AuthHub, updated by Store

The values for status, level, timestamp, ip, and id will come directly
from the server response. Other values are extensions of this module:
  token: the original encoded token,
  lastactive: the current timestamp updated for every get(),
  euid: a duplicate of the id field (the effective id)

If the status field is "NO" then the other fields will be blank or
undefined.

The "lastactive" field is ONLY updated if the "rolling_timeout_len"
option was specified when the store was created.

$hash_ref = $store->get_and_verify( 'token', {requirements} )

Used to get and decode the token as the get() method and to confirm that
the IP address, authentication level, timeout, and rolling timeout are
all valid.

The requirements argument is a hash reference with optional arguments as
follows: 

ip => 'xx.xx.xx.xx'
ids => [ array of acceptable user ids ]

The hash returned by get_and_verify() will be the same as returned by
get() except that the status field may have the alternate values below:
IP: an IP mismatch LV: the authentication level is below minimum level
(min_level) EX: timeout or rolling timeout has expired ID: the cookie
euid was not in the ids list (if ids list provided)

Empty or undefined requirements are ignored.

$url_string = $store->redir_url( 'callback url', $hash_ref )

A convenience method to get the appropriate url redirection given a
hashed cookie from get_and_verify().

A blank or undef hash_ref or one with "OK" or "NO" status will result in
a simple url redirection, other status codes will result in the
appropriate params added to the url.

$hash_ref = $store->set_euid( 'token', 'id' )

Used for setting the euid in the cache, a blank or undef id resets it to
the real user. The first argument can be either the token or the cookie
hash itself. On success returns the new cookie, on failure returns
undef.

"Error: minimum authentication level must be at least 10"

    According to the CAH documentation, sites should not accept level 5
    authentication so trying to do so will throw an error.

"Error: No token."

    Calling get or get_and_verify without a token throws an error.

"Error: invalid id list"

    Results from attempting to pass something other than an array ref to
    the "ids" requirement in get_and_verify.

"Error: SSL communication failure: %s"

    An error occurred when trying to contact the designated x500 server
    via SSL.

"Error: invalid response from x500 server: %s"

    The response from the server did not fit the pattern expected.

UMN::CAH::Client::Store requires no configuration files or environment
variables.

The cache file will by default be stored in UMN_CAH_Client_Store in the
temporary directory. The module uses File::Spec to attempt to be
OS-neutral, but I've only tested it on Debian so far.

 UMN::CAH::Client::Store::AuthHub
 Cache::FastMmap
 File::Spec;
 Net::SSLeay
 URI::Escape;

None reported.

No bugs have been reported.

Please report any bugs or feature requests to the author.

Steven Cayford "<cayfo001@umn.edu>"

Copyright (c) 2008, Steven Cayford "<cayfo001@umn.edu>". All rights
reserved.

This module is free software; you can redistribute it and/or modify it
under the same terms as Perl itself. See perlartistic.

BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE
ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH
YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL
NECESSARY SERVICING, REPAIR, OR CORRECTION.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE
TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.

The number of people waiting to get in was really impressive. Here's a map of the line as of when we joined it. Google says this is about 1.3 miles long, but it seemed longer and had already been moving for a while before we got there.

View Larger Map

For comparison, here's the line we waited in for Obama's February 2 rally at the Target Center. I think the line last night was thicker, probably about 4 people wide as opposed to 2 people wide in February.

View Larger Map

More pictures on flickr.