Well done to Dennis and his team from Latvia. PaperCut is now available in the Russian language. This brings PaperCut now to 20 languages with a few more on the way. This was our first language using the Cyrillic alphabet. We had to overcome a few issues with the PDF reports, however the process generally went very smoothly. Most of the bugs with dealing with non-latin character sets came out when we did the Chinese translations a few years back.

Welcome to all the new users in Russia, CIS & Baltic States.

Click for larger view

We were amazed a few weeks ago when a customer from Germany emailed to inquire about an upgrade from version 1.0. Wow! We emailed back asking them to confirm. “Are you sure you’re running version 1? That’s almost 10 years old!” Sure enough the customer was correct. They were customer number 47 and purchased and installed PaperCut almost 10 years ago. It’s been running perfect ever since but they needed to re-install and had lost the key. I thought some of our other users may be interested to know more about this story so I emailed Marco and asked him if he’d answer a few questions for our blog. Not only did he oblige, but the team at Landkreis Calw have written us a poem!

This is a good story but also a catch-22 for us! In some ways it’s a testament to the longevity of our programming, but on the other hand, we’d love to see sites upgrade more often

We have a very international customer base covering over 60 countries. It’s always nice to hear stories like this. If you’d like to share your story please email us at support.

This blog post continues to focus on our support quality and builds on the graphs and analysis from my post two weeks ago. This time however, the graphs are not static but updates in real-time! Read on for the exciting details.

Offering good support is a balancing act – a compromise. How much developer time should we allocate to support? Being software developers (a.k.a. Tech Geeks), we’ve always wondered how we can measure this balance. I then had an idea… In the last “Vote for a Feature” survey I decided to add the following question:

PaperCut’s support is done direct by the development team. Should the developers allocate more time to supporting customers, more time to development, or do we have the mix about right?

[a range to select]

It’s a bit of a loaded question and hence the results needs to be taken with a grain of salt, but still is sure to give us some level quantitative feedback (and the sample size is now large enough to pass a significance test, just to bring back bad memories for those of us that did Stats101 .

With over 20,000 organizations running PaperCut, our surveys collects a lot of data. I started crunching the figures so I could email the results around to our development team, but half way through I had an idea. I could do one better. How about a real-time graph for the world to view! Anyway, after a late night playing around with some Google Docs APIs I’ve come up with a solution.

The gauge below represents the current real-time results of the survey data:

• If the gauge is at the top in the green range, we have the mix right.
• If it leans to the right (positive), our users are suggesting that we should spend more effort on new development and a little less on support.
• If it leans to the left (negative), we should spend more effort on support and and a little less on new development.

You’ll need a modern SVG enabled browser (e.g. Firefox) to view.

The gauge above is live. As of 27th of March, it’s at 4.76% suggesting we have the mix right. If you think the gauge should be leaning one way or the other, make sure you log in and express your vote! Anyway, too much time playing… back to adding new features to our print management software as the gauge currently suggests!

We’ve just rolled a new “Vote for a Feature” survey form. This is your chance as a PaperCut user to influence our development priority and ensure your most demanded features are pushed to the top. To vote, log into PaperCut as an admin user, click on the About tab and under Application News, click Vote now and have your say.

The survey results are sent through to the development team in real-time and are discussed at our feature review meetings. Please take a few moments to full it out and let us know what you think!

Rick, our first USA based member of the team started with us late last year. One of our goals was to ensure we had someone during US business hours to help speed up response times for customers in North America. We’ve recently run the stats across our support system and it’s great to see some movement. The graphs summarize our average response times. It’s consistently dropped over the years and much so over the past two months since Rick started. It’s now down to under 4 hours during weekdays. This is a great achievement seeing during this time our customer base has continue to grow at amazing rates!

(click on a thumbnails to view)

I should also point out that this is 4 hours for a quality response – not an email from someone in an outsourced call center letting you know that “Your support issue has been elevated” and you end up getting a real response days or even weeks later. All our support is done by the developers that write the code. This offers a number of advantages to you and to us:

• You get the correct answer first time. No buck passing, no question is too hard.
• We, as developers, benefit from direct contact with our users. This open channel helps us turn your ideas into features faster (or your bugs into fixes faster!).

One of the downsides to this approach however is that trivial support questions get a bit annoying. Us developers love working on the hard problems, especially the ones that force us into source code and debug logs. The trivial RTFM questions get a little frustrating at times! If you’re reading this blog, here are a few tips that would help us out:

• Always check the manual and search the knowledge base for answers. You’ll fine hundreds of common questions answered here.
• Make sure you review the reporting problems KB article and include the information requested in your email. Simple things like the full version number, and/or logs are always a great help.
• Try to put something interesting in the email support request! We love to hear little stories like how PaperCut helps you, what funny things have happened on your network over the years, or even simply what the weather is like in your end of the world! We’ve formed great friendships with many PaperCut users and it’s always fun to talk not just about computers and print management software.

Oh, and if you say you read our blog, you’re bound to get even better support

The developers have taken a few days out this week from programming Java and C/C++ and switched over to HTML and JavaScript. We’ve added two new sections to our website:

A New Tour
The first area is our new product tour. The old tour was getting a little crusty. It did not show off many of the new features we’ve added to PaperCut over the past few years. The new tour is a clean start, a new design and shows off what we feel are PaperCut’s best assets. Tom’s done some great work with CSS and jQuery to implement some interested lightbox effects when you click on the image thumbnails.

The ROI Calculator
The state of the economy is a hot topic at the moment so we thought’s we’d put together a tool to help you work out how much PaperCut will help you save. Unlike a lot of software, PaperCut actually saves you money (That’s a jibe at Microsoft as we all like to bash them from time to time ) The ROI Calculator will guide you through a series of questions and generate a series of charts and statistics to help you understand how much PaperCut will save over a 5 year period (return on investment). As you will all know we’re also all keen on the environmental stance of PaperCut, and the calculator will also project the environmental impact savings. We hope this will give system administrators one more tool to help convince management about PaperCut!

Matt’s done a great job on the ROI Calculator. It’s all implemented in client-side JavaScript. Even the chart generation is done in DHTML with some fancy DOM manipulation.

Next week we’re back on normal coding busy working away on the 9.3 release!

We were quite proud to be nominated as a finalist for the Australian Telstra Business Awards last year and it’s nice to see our software helping some of our customers win awards too. Congratulations to Tim and the team at the University of Iowa for winning an Improving Our Workplace Award for their project to implement PaperCut. To use a quote from Tim:

I just wanted to let you know that PaperCut was a key component in our ITC Print Accounting team winning an IOWA (Improving Our Workplace) Award this past fall. Using the features in your product have allowed us to reduce our printing by about 3% per year vs. an anticipated 10-12% annual increase using our previous print accounting solution. In addition, we have opened up printing from wireless laptops, student dorm rooms, and off-campus locations with the use of release stations and client-based authentication, providing a much more convenient environment for our students, staff, and faculty. We’re looking forward to even more service enhancements with the new features available in PaperCut 9.

There is also a write up in The Daily Iowan. It’s nice to see some of our Environmental Impact figures making their way into people’s minds!

The deployment at University of Iowa is one of many very large deployments of PaperCut that were conducted through ’08. Two other successful projects of note have been implementations at Miami Dade College (the largest college in the US with 260,000+ users!) and the region of Oslo in Norway that have deployed PaperCut on a single clustered server instance supporting almost 200 schools via a WAN. I hope to have some time next week to talk more about these larger projects as we’ve done some really cutting edge tech. work in the areas of clustering and asynchronous I/O to get scalability up to handle deployments of this size.

Oh! I also forgot to mention the team at Nevada State for their successful eco-aware implementation. Thanks to them for their comments about our friendly support too!

We host a number of web services and applications on the servers in here in the PaperCut office. We’ve always planned on hosting these on an isolated server inside a demilitarized zone (DMZ) to ensure public applications are isolated from internal servers. This usually requires separate dedicated servers, however with the recent growth in virtualization technology, we decided to see if we could accomplish the same in a virtual environment. There was not a lot of information out there so I embarked on a project to develop our own. The solution has worked very well over the past 6 months so I’ve decided to open source the configuration and control script so others in the Linux community can benefit. (One of my Friday projects when I’m not working on print accounting software!).

The crux of the script is to host a Qemu or KVM virtual machine on an independent subnet via a tun/tap interface. iptables on the host (Dom0) is used to ensure that connections can not be instigated from the VM in the DMZ to any system in the internal network. They say a picture is worth a thousand words, so here’s a diagram:

The key items are:

• The host (dom0) hosted the VM on a tun/tap interface.
• The VM is on a separate subnet.
• A firewall on dom0 (important) prevents access to the internal network.
• A static route has been added to the router so internal network can “find” the systems in the DMZ.
• Public ports (e.g. port 80) on the router are forwarded into the server in the DMZ.

This strategy will provide an extra layer of protection as a compromise on the server in the DMZ (say hosting your website) will not automatically mean a compromise on your internal network. There are however come caveats to this: It may be possible to “jailbreak” from the VM into the host by exploiting vulnerabilities in the hypervisor/host. For example, some exploits were found in QEMU in 2007.

The control script and its brief setup procedure should work on most modern Linux distributions.

file: dmz-vm-controller

#!/bin/sh
### BEGIN INIT INFO
# Provides:          vm-dmz-controller
# Required-Start:    $local_fs $network
# Required-Stop:     $local_fs $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: VM Management in a DMZ
# Description:       QEMU/KVM VM Management in a semi-secured DMZ.
### END INIT INFO

##############################################################################
#
# VM-DMZ-Controller is a wrapper script written to help with the management
# and setup of a VM running inside a secured demilitarized zone (DMZ).  The
# objective is to ensure the host/vm inside the DMZ are firewalled in a way
# that ensures connections from the DMZ to the internal network are not
# possible.
#
# Brief summary:
#
#   1. Install QEMU or KVM, and socat, iptables and tun/tap tunctl
#      (uml-utilities).
#
#   2. Create non-privileged user on your system called "vm".
#
#   3. Create a sub-directory in the VM user's home directory to host your VM
#      files.
#
#   4. Create your disk images (e.g. qemu-img) in this sub-directory.
#
#   5. Copy this script into the directory and modify configuration section
#      below.
#
#   6. Link in this script into /etc/init.d/ and configure runlevels as
#      appropriate.
#
#   7. Add a static route in your internal network default router so internal
#      systems can connect to the VM.
#
#   8. Start your VM and test.  Confirm that the VM is unable to access your
#      internal network.
#
# See here for details:
# http://www.papercut.com/blog/chris/2008/11/14/using-kvm-to-securely-host-servers-in-a-dmz/
#
#
# Copyright (c) 2008, PaperCut Software International Pty. Ltd.
# http://www.papercut.com/
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above copyright
#       notice, this list of conditions and the following disclaimer in the
#       documentation and/or other materials provided with the distribution.
#     * Neither the name of the  nor the
#       names of its contributors may be used to endorse or promote products
#       derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY PAPERCUT SOFTWARE ''AS IS'' AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL  BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
###############################################################################

###############################################################################
# VM Configuration - modify below as appropriate
###############################################################################

# The name of the VM instance (should be unique if hosting multiple VMs)
#
VM_NAME=external-web-server

# The non-privileged user ID used to run the VM.
#
VM_USER=vm

# The VM kernel module to load (e.g. kvm-intel, kvm-amd, qemu). Leave blank if
# using QEmu as a kernel model is required.
#
VM_MODULE=kvm-intel

# The name of the virtual network tap to bind/host to the DMZ network on.
#
IFNAME=tap0

# The .1 gateway address that denotes the DMZ subnet.
#
DMZ_IP=192.168.100.1

# The subnet range of the internal network (the range to firewall/protect)
#
INTERNAL_SUBNET=192.168.1.0/24

# Your DMZ system may need DNS access provided by your internal network.
# Set this if required. This will leave a hole in the firewall allowing
# DNZ access (UDP source port 53).
#
INTERNAL_DNS_IP=

# The directory with disk images (and pid files, etc.) are hosted
#
VM_DIR=/home/${VM_USER}/${VM_NAME}

MONITORFILE=${VM_DIR}/.${VM_NAME}.monitor
PIDFILE=${VM_DIR}/.${VM_NAME}.pid
LOGFILE=${VM_DIR}/${VM_NAME}.log

# VM Start command-line. No need to define:
#    -pidfile, -net, or -monitor
# as these are all appended as part of this script.
# Add -cdrom and -boot d to boot and install your VM off a CD.
#
VM_START_CMD="kvm \
        -hda disk1.qcow2 \
        -m 384 \
        -vnc :0"

# The maximum time to provide the VM to conduct a graceful shutdown.
#
SHUTDOWN_TIMEOUT=20

###############################################################################
# End Configuration - DO NOT MODIFY BELOW THIS LINE
###############################################################################

start_vm() {

    echo_n "Starting VM ${VM_NAME}..."
    if isrunning; then
        echo "ALREADY RUNNING"
        exit 0
    fi

    setup_networking
    start_firewall

    if [ ! -z "${VM_MODULE}" ]; then
        modprobe "${VM_MODULE}"
    fi
    cd "${VM_DIR}"
    su "${VM_USER}" -c "${VM_START_CMD} \
                -net nic -net tap,ifname=${IFNAME},script=no \

                -pidfile ${PIDFILE} \
                -monitor unix:${MONITORFILE},server,nowait \
                >> ${LOGFILE} 2>&1 &"

    for i in 0 1 2 3; do
        sleep 2
        if isrunning; then
            echo "Started ${VM_NAME} at: `date`" >> ${LOGFILE}
            echo "started."
            exit 0
        else
            echo_n "."
        fi
    done

    echo "ERROR"
    exit 1
}

stop_vm() {

    echo_n "Stopping VM ${VM_NAME}..."
    if isrunning; then
        # Send nice powerdown command
        echo "system_powerdown" | socat - UNIX-CONNECT:${MONITORFILE} \
                >/dev/null
        clean_shutdown=
        for (( i = 0 ; i <= ${SHUTDOWN_TIMEOUT} ; i++ )); do
            sleep 1
            if isrunning; then
                echo_n "."
            else
                clean_shutdown=y
                break;
            fi
        done

        if [ -z "${clean_shutdown}" ]; then
            echo_n "forcing..."
            kill -TERM "${pid}"
            sleep 2
        fi

        if isrunning; then
            echo "problem stopping!"
            exit 1
        fi

        rm ${MONITORFILE}
        rm ${PIDFILE}
        stop_firewall
        stop_networking
    fi
    echo "Stopped ${VM_NAME} at: `date`" >> ${LOGFILE}
    echo "stopped."
}

status() {

    if isrunning; then
        echo "Running (pid: ${pid})."
    else
        echo "Not Running."
    fi
}

forcekill() {

    if isrunning; then
        kill -9 "${pid}"
    else
        echo "Not running!"
    fi
}

isrunning() {

    if [ -r ${PIDFILE} ]; then
        pid=`cat ${PIDFILE} 2>/dev/null`
        if [ ! -z "${pid}" -a -d /proc/${pid} ]; then
            return 0 #Success - running
        else
            return 1 #Failure - not running
        fi
    else
        return 1 #Failure - not running
    fi
}

setup_networking() {

    tunctl -u ${VM_USER} -t ${IFNAME} >/dev/null

    ifconfig ${IFNAME} ${DMZ_IP} netmask 255.255.255.0 up >/dev/null

}

start_firewall() {

    modprobe ip_tables
    modprobe iptable_nat

    echo "1" > /proc/sys/net/ipv4/ip_forward

    #
    # Deny new connections to internal network (forwarded) and Dom0 (input)
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p tcp --syn \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p tcp --syn \
            -j DROP

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p tcp --syn \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p tcp --syn \
            -j DROP

    # Also need to protect the DMZ side of host box.
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p tcp --syn \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p tcp --syn \
            -j DROP

    #
    # Allow DNS UDP packets to DNS server (required if on internal network)
    #
    if [ ! -z "${INTERNAL_DNS_IP}" ]; then
        iptables -A FORWARD -p udp -d $INTERNAL_DNS_IP \
            --dport 53 -i $IFNAME -j ACCEPT
    fi

    #
    # Deny UDP packets to internal network
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p udp \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p udp -j DROP

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p udp \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p udp -j DROP

    # Don't log Windows/Samba name broadcasts as they will occure often
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp --dport 137 -j DROP

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp \
            -m limit --limit 6/h --limit-burst 5 -j LOG

    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p udp -j DROP

    #
    # Deny selected ICMP to internal network
    #
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type echo-request -j DROP
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type redirect -j DROP
    iptables -A FORWARD -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type router-advertisement -j DROP

    iptables -A INPUT  -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type echo-request -j DROP
    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type redirect -j DROP
    iptables -A INPUT -d $INTERNAL_SUBNET -i $IFNAME -p icmp \
            --icmp-type router-advertisement -j DROP

    iptables -A INPUT  -d $DMZ_IP -i $IFNAME -p icmp \
            --icmp-type echo-request -j DROP
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p icmp \
            --icmp-type redirect -j DROP
    iptables -A INPUT -d $DMZ_IP -i $IFNAME -p icmp \
            --icmp-type router-advertisement -j DROP

    #
    # Deny spoofed packets from DMZ
    #
    iptables -A INPUT -s ! ${DMZ_IP}/24 -i $IFNAME -j DROP
    iptables -A FORWARD -s ! ${DMZ_IP}/24 -i $IFNAME -j DROP

}

stop_firewall() {

    #
    # Remove all rules added on the IFNAME interface
    #
    iptables -S | \
            egrep "${IFNAME}" | \
            egrep "^-A " | \
            sed "s/-A //" | \
            while read rulespec; do
                iptables -D ${rulespec}
            done
}

stop_networking() {

    tunctl -d ${IFNAME} >/dev/null

}

# Hack for POSIX echo -n support on all platforms
if [ "X`echo -n`" = "X-n" ]; then
    echo_n() { echo ${1+"$@"}"\c"; }
else
    echo_n() { echo -n ${1+"$@"}; }
fi

#
# Begin Main
#

userid=`id | sed "s/^uid=\([0-9][0-9]*\).*$/\1/"`
if test "${userid}" -ne 0; then
    echo "Error: You must be root to run this program" 1>&2
    exit 1
fi

if [ -z `which iptables` ]; then
    echo "Error: Please install iptables." 1>&2
    exit 1
fi

if [ -z `which socat` ]; then
    echo "Error: Please install socat." 1>&2
    exit 1
fi

if [ -z `which tunctl` ]; then
    echo "Error: Please install tunctl." 1>&2
    exit 1
fi

case "${1}" in
    start)
        start_vm
        ;;

    stop)
        stop_vm
        ;;

    forcekill)
        forcekill
        ;;

    restart)
        stop_vm
        sleep 1
        start_vm
        ;;

    stopfirewall)
        stop_firewall
        ;;

    startfirewall)
        start_firewall
        ;;

    status)
        status
        ;;

    *)
        echo "Usage: vm-dmz-controller start|stop|restart|status" >&2
        echo "Advanced Options: stopfirewall|startfirewall|forcekill" >&2
        exit 1
        ;;
esac