Creating an SSH CA

TODO - Explain the security benefit(s) of using signed ssh keys.

To use signed keys and TrustedUserCAKeys

# As root

mkdir /etc/ssh/ca

# You could use "openssl req ..." to create an x509 key pair

# or use ssh-keygen. 

# Here I am using ssh-keygen (and will password protect the private key)

# As root

ssh-keygen -t rsa -f /etc/ssh/ca/sshCAkey -C "SSH CA Key"

# Optionally enter password. Suggested that you do.

# Now create the file to be used for the TrustedUserCAKeys option

# in /etc/ssh/sshd_config by writing the contents of /etc/ssh/ca/sshCAkey.pub

# into the file.

# As root

cat /etc/ssh/ca/sshCAkey.pub >> /etc/ssh/ca/CAKeyFile

# Now you want to sign a user's key.

# As root

ssh-keygen -s /etc/ssh/ca/sshCAkey \

  -I key_id \

  -n bschuck \

  ~user/.ssh/id_rsa.pub 

 Enter passphrase: 

 Signed user key /home/user/.ssh/id_rsa-cert.pub: id "key_id" serial 0 for user valid forever

# You can optionally use the -z to set a serial number and

# the -V option to set a validity time.

# See man ssh-keygen(1) some of the options may be different for BSD,

# OSX, and Centos/RHEL v Ubuntu/Debian

# -n principals

# -z serial number

# Change ownership and perms

chown user:user /home/user/.ssh/id_rsa-cert.pub

chmod 600 /home/user/.ssh/id_rsa-cert.pub

# Modify your /etc/ssh/sshd_config file.

# Add the line

TrustedUserCAKeys /etc/ssh/ca/CAKeyFile

# Optionally to allow only users with signed keys to use ssh to log in

# Change AuthorizedKeysFile to none

# and change PasswordAuthentication to no

# If an older system needs to connect to a newer system, the

# openssh configuration on the newer system requires this

# in its sshd_config (or create /etc/ssh/sshd_config.d/kex.conf)

# Needed for connections from CentOS 5.x systems

KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,sntrup4591761x25519-sha512@tinyssh.org

I'm Back? Recent Life Events.

Wow... its been a long time since I last posted and a lot has happened in the world!

I could spend pages rehashing the events of the past 6+ years and my opinions and thoughts on them. But I'll spare everyone going over old news. I will however give a brief summary of recent life events.

In August of 2022 my 92 year old father passed away (https://www.legacy.com/us/obituaries/name/theodore-schuck-obituary?id=36294372). He had been suffering from dementia, and my sister and I moved him into an assisted living facility in mid-2021. His health already steadily declining continued. I miss the "old man" and to this day sometimes think of calling him.

Following that, my sister and I had started to take care of various related tasks related to his finances and home when Hurricane Ian struck Punta Gorda. This affected both my dad's home and sister's condo not too far away. First reports were grim, but after family friends were able to both visit the house and gain entry, damage was not as bad as first believed. Still damage, but not an almost total loss as we were first to believe. Unfortunately my sister's condo, again not as bad as first reported, but it was uninhabitable. So, taking care of dad's estate related tasks took a back burner while my sister lived in dad's house while her condo was being repaired.

It was not until earlier this month that my sister was able to move back into her condo. Which means now we get back to focusing on closing out my father's affairs. It has been slow going, but there has been progress. Next major task is getting a general contractor to take a look at what needs to be done on pop's house and start the repairs. The roof, except for the soffits (waiting for materials) was completed already.

In other news, I had my 1989 Harley FXSTS (Springer) made road worthy after being non-operational since 2014! Unfortunately we've had a very wet winter so far here in the SF Bay area, so while I've had it out for a ride a couple time, I have not really been able to enjoy it.

I have also began to think about maybe doing a podcast or vlog. Not that I would stick with a regular schedule, so that may just be whim.

So that's it in a nutshell for now. Back to watching today's NASCAR cup series race in Atlanta.

Hijacking of Minimum Wage

For the past couple years you have all heard or read the term "Living Wage" used alongside discussions and debates on the minimum wage. I am curious, who decided that the minimum wage was meant to be wage that one can live on? As far as I know and remember, that was not the case when I was a young man starting out in the world of employment. In 1978, before I graduated high school, I was flipping burgers at a local chain fast food restaurant. I was making minimum wage at that time, or $2.65 per hour. Also note that this job and many like it  in the time had no other benefits! No paid sick days, no paid vacation days, and no health insurance. When I graduated from high school in 1979 minimum wage was increased to $2.90 per hour. By then I had moved on to a job delivering auto parts for a small independent auto parts store, and was making a decent $5.00 per hour. Still no other benefits, but a decent step above minimum wage. But this isn't about me, it's about minimum wage versus living wage.

In 1979 if you were working full time (40 hours) getting paid minimum wage, you were making just under $120.00 per week. Don't forget, that is before taxes. Not exactly sure what the various tax rates were back then, but after state and federal income tax, FICA, and medicare, you were probably left with about $80.00 (give or take) of take home pay. Do you honestly think that $320 per month was a living wage in 1979?! If you were living on your own you would then have rent, utilities, medical bills, groceries, auto expenses (insurance, gas, maintenance, registration fees), and a host of other miscellaneous expenses. I don't think so. Back in my day, the people my age who were living on their own were either working 60 to 80 hours per week, were getting paid more than minimum wage as they proved to be valuable employees, or both.

So when did minimum wage get hijacked to supposed to mean a living wage? And how did the magic $15.00 per hour figure come about. This Department of Labor chart shows that the 1978/1979 minimum wages are equivalent to about $9.00 per hour in 2012 dollars. That's only 60% of the $15 number we hear tossed about regularly. And hell, in some areas of the country even $15.00 per hour is probably not a living wage. Looking at the chart mentioned you should also pay attention to the first federal minimum wage, a mere $0.25 per hour in 1938. Which is a mere $3.98 in 2012 dollars.

But that's the point. Historically the minimum wage was never meant to be a living wage. Read up on the Fair Labor Standards Act of 1938. The minimum wage is just that, a minimum that employers are directed to pay. For that reason, it is usually the people just entering the work force that are getting paid this minimum. Mostly, it's what an employer will pay someone with no experience, background, etc. Or for jobs that see a lot of turnover, like flipping burgers at a fast food restaurant.

Does this mean I don't believe the minimum wage should be raised at all. No. Looking at the DOL chart again, I believe a minimum wage in the $9.00 to $10.00 range would be a good idea. I just don't believe that it should be construed as a "living wage".

Email Security - Encryption - Part 3

Importing a Certificate from the Web

Overview

You now have the ability to send and receive secure encrypted email messages. You can also send 'signed' email messages, but that is a topic I may cover in a future post. There is a catch. In order to send and receive those encrypted messages, there is a piece of information each party in the conversation has to have from the others. That information or data is their public key. In part 1 of this series I touched on symmetric versus asymmetric encryption. In asymmetric encryption there are two pieces to the key (often referred to as a "key pair"). The first part is what is called your private key. Typically this is also protected with a passphrase. You should never share this part of the key, and some choose to store it on removable media like a flash drive (in the old days your private keys may have been on a floppy disk). The second part of the key is called your public key. This can be shared and there are a few places on the web that these public keys can be uploaded to for easier sharing. Getting someone's public key from one of these repositories is the subject of this post.

Importing a Public Key

If it's not already open, from the Windows Start Menu, start Kleopatra. You should see the certificate you created in part 2 displayed in the "My Certificates" tab.

Kleopatra Main Window

A new installation of Kleopatra will need to be configured with one of the online repositories of PGP (or GnuPG or OpenPGP) certificates. Click the "Settings" menu and select "Configure Kleopatra". The configuration window will open.

Kleopatra Configuration Window

Click on the "New" button on the right hand side of the screen. A line with the default key server will appear in the window.

Kleopatra Directory services (key servers) Window

Click on "OK" and you will return to the main window.

Now that a key server has been defined, we can search for a public key to import to our 'keyring'. In this example we will look up s certificate for one of my email addresses (used for when I suspect I may receive spam when filling out forms on the web).

Select the "File" top menu and then "Lookup Certificates on Server" or press Ctrl-Shift-I. This will bring up the Certificate Lookup Window.

Certificate Lookup Window

In the "Find" field box at the top type "sponge.com" (without the quotes). Then click on the "Search button". You will be presented with a list of possible matches. Select the entry "Bruce Schuck bruce@sponge.com 2002-04-27" and finally click on "Import". You can now close Kleopatra.

Summary

I know that some readers want to get right to it, but I wanted to leave some time between each post for people to install and maybe experiment a little with the GPG4Win application. There are two other  usual ways that public keys can be imported. One is a more manual process that involves getting a person's public key directly, and the other is tied to when a PGP signed email is received from someone you do not yet have a public key for. I think I will cover those methods after I show you how to send an encrypted email using Thunderbird.

Related Posts

• Email Security Encryption Part 1
• Email Security Encryption Part 2

Email Security - Encryption - Part 2

Creating a GnuPG Key

Overview

Part 1 summarized the two common public key technologies (aka PKI for Public Key Infrastructure) used to secure email communications. Here in Part 2 I will take you through the steps to generate your own GnuPG key pair on the Microsoft Windows Operating System. Why GnuPG and not PGP? For the most part the two are interchangeable. Since GnuPG is freely available, I decided to demonstrate it first. One drawback of the GnuPG, is that it does not integrate seamlessly into 64-bit versions of Microsoft Outlook. Because of this, I will first show how to enable Thunderbird to send and receive encrypted email messages.

Installing GnuPG on Windows

Please note that I used Windows 7 Enterprise in this example.

In your browser, navigate to http://gpg4win.org/.

http://gpg4win.org/

Click on "Download Gpg4win". You should be at this page. At the time of this post, the current version is 2.2.5.

http://gpg4win.org/download.html

Now click on the uppermost download button. You will be presented with the dialogue box asking if you want to save the file or run (execute) the file.

Save Dialogue

Select 'Run' and accept the default actions of any dialogue box presented during the installation process. If successful, the last screen displayed should be this.

Gpg4win Wizard Complete

Please unselect the "Show the README file" and then click "Finish". At this time you have successfully installed a Windows version of GnuPG on your computer.

Creating a GnuPG key

The installation of Gpg4win installed the Kleopatra key management tool as one of the components. Navigate through the start menu and launch Kleopatra. The path through the menus should be "Start -> All Programs -> Gpg4win -> Kleopatra".

Kleopatra Main Window

Start the new certificate process by selecting File -> New Certificate from the top menu or by typing Ctrl-N (press Control-Key and 'N' key simultaneously). You will be presented with a dialogue to choose the certificate format.

Certificate Format

Choose "Create a personal OpenPGP pair", and click on Next. On the next screen you will enter details about your certificate.

Certificate Detail Form

Two of the three fields on this form are required. Fill in the Name and EMail fields with your name (usually full name) and email address. You can use the Comment field for any purpose. Some people may choose "Work" or "Home" for this field. For the time being we will not need to be concerned with any of the Advanced Settings. When you have filled in the fields, click on Next.

Certificate Review

On the Review Certificate Parameters screen you can confirm the values of the fields entered on the previous form. If no corrections are necessary, click on Create Key. During the key creation you may be asked to move the mouse pointer or type in random characters. When the key pair is generated, you should the following screen.

Certificate Complete

Congratulations! You have successfully generated an OpenGPG key pair. When you click on Finish, you will be returned to Kleopatra's main screen and see your certificate listed in the window.

Summary

While composing these steps I realized that if you are following these steps you may not know someone that you can send and receive test messages with. So before we move on to configuring an email client (Thunderbird) to utilize GnuPG, I should go over how to import someone's public key to your keyring. There are a few ways to accomplish that, and that will be covered next in Part 3.

Related Posts

• Email Security Encryption Part 1

Email Security - Encryption - Part 1

Email Security and Privacy

Introduction

We have seen communication over the internet expand over the last 20 years. Once it was just the realm of those in academia and science. Today nearly everyone uses the internet regularly to communicate with others. Along with this rise in popularity has been a heightened concern for privacy and security. People (and businesses) want to be able to communicate and not fear hackers or even their own government. From all the clamor we see related to how our content and messages are used by the social media sites, and how various laws affect what the government can access with or without a warrant, you would think that there are no safeguards available to combat perceived or real threats to our privacy. But fortunately, that perception is without merit.

Encryption

The perception is without merit because it is possible to secure your email so that only the intended recipient(s) can view it using encryption. Better news is that this is easier to accomplish than you might believe. There are actually two types of encryption that can be utilized, symmetric and asymmetric encryption. The details of these are beyond the scope of this blog, but for more information please visit http://resources.infosecinstitute.com/symmetric-asymmetric-encryption/. Here we are going to focus on asymmetric encryption and using it to send and receive email securely.

SSL (S/MIME) and PGP (or GnuPG)

There are two main methods to send and receive secure email. Most modern email clients (Outlook, Thunderbird, Evolution, etc) natively support one or both methods. You don't need to understand the technology beneath these two systems, only how they differ with respect to setting up and using your email client.

SSL (S/SMIME)

When an email client uses SSL to secure messages, it is also called S/MIME. This encryption (and electronic signing) is very similar to how web sites using HTTPS are encrypted. The certificates used are commonly purchased from a known vendor of SSL Certificates. Examples of these companies are Thawte, Digicert, and Verisign. A source of free SSL certificates is CAcert, but its root certificates are not usually included in the bundles that come with operating systems and software. If desired (especially for testing), those of you who are more technical could create your own certificates using OpenSSL.

PGP (or GnuPG)

PGP stands for Pretty Good Privacy. First written and released as freeware, it has since become commercialized, now part of Symantec. Some older versions of PGP can be found at http://www.pgpi.org/. The most common current opensource derivative is GnuPG or GNU Privacy Guard. PGP was originally created to securely store messages and files on bulletin board systems (BBS) in 1991.

Summary

We will start getting into the details of using these technologies to secure email communications in part 2 of this series. For now, please take some time to visit some of the links posted above to learn more. Feel free to post comments or questions.

Thank you.

Related Posts

• Email Security - Encryption - Part 2

64 Bit Ubuntu and 32 bit Check Point SSL Network Extender

Recently I decided to change the operating system on my home Linux desktop to Ubuntu. I have been running OpenSuSE for a while since the prevalent OS at my last gig was SLES or SuSE Enterprise Linux (before that I was running Solaris x86). The current LTS version of Ubuntu is 14.04. I saw no reason to install the 32-bit version, so I downloaded and installed the 64-bit OS.

The installation of Ubuntu Desktop is straightforward, but unless I missed something you cannot select what packages and software are included during the initial install.

The VPN we use at work provided through a Check Point appliance. For Mac OSX and Linux operating systems you have to download the installation script from the "Settings" link after logging in to the web portal, or from the Check Point website. Having an older unit, the script installs a 32-bit version of the Check Point SSL Network Extender also simply known as 'snx'.

Everything seems to be simple and easy until you attempt to execute 'snx' (gets installed to /usr/bin/snx). What you see is something like:

$ snx -h
bash: /usr/bin/snx: No such file or directory

An 'ls' command will prove the file does in fact exist, but attempting to execute 'ldd' to see what libraries it may be looking for adds to the mystery.

$ ldd /usr/bin/snx
  not a dynamic executable

I did some digging and found that the default 64-bit install of Ubuntu 14.04 does not include any 32-bit libraries. Using 'apt-get' I installed the 32-bit version of a few of the "standard" libraries. I don't know which one it was, but now the output of 'ldd' listed libraries and which ones were not found. To save you some time here are the libraries I needed to install to get the Check Point SSL Network Extender to work.

• lib32stdc++6
• lib32z1
• lib32objc3
• lib32readline6
• lib32gcc1
• libX11-6:i386
• libpam0g:i386
• libstdc++5:i386 

Easily done with one command:

# apt-get -y install lib32stdc++6 lib32z1 lib32objc3 lib32readline6 lib32gcc1 libX11-6:i386 libpam0g:i386 libstdc++5:i386

It wasn't too hard to figure out, but if this helps a few people save time it was worth the effort to create this post.

Related Links

• Ubuntu - http://www.ubuntu.com/
• Check Point - http://www.checkpoint.com/
• Check Point Remote Access (VPN) Clients

Is it July already?

Once again, quite a long time has elapsed since my last post. A little over half a year since my New Years Day post for 2014. I'd like to say that the reason I haven't posted is that I've been extremely busy and preoccupied with other things, but that is not the case. However the year so far has had some noteworthy events to share with you all.

Since the last post, the one year anniversary of my time here at Echostar/Sling passed. Along with a fairly decent annual review and raise. I am definitely enjoying my time here, and still believe that getting laid off from my Northrop Grumman position was a blessing in disguise.

My one year anniversary at Echostar is noteworthy, but so far the highlight of the year (and perhaps the last couple years) is something that I would never have thought possible a few years back. It pretty much deserves its own post, so I will only touch upon it here. Last month, June, my daughter Reagan came to California for a visit. In her 13 years, this was the first time that I had the opportunity to spend time with just my daughter. I'll expand on her visit in another post, but overall it was a pretty good time.

That said, there is still not much else new. Still putting off getting my hip surgery, and two of the three motorcycles still need repair of some degree. Hell, the Dyna even now seems to be starting to make a little top end noise. At 36k miles, it likely needs a valve adjustment and perhaps a look at the cam chain. But, if I do one thing well, it's procrastinate.

That's about it for now. Hopefully I'll have some time to write about Reagan's visit sooner rather than later. Until then, take care and enjoy the day.

Happy New Year 2014!

Happy New Year!

Once again, it's been quite some time since my last post here. But what can I say, I've been busy, preoccupied, or otherwise distracted. Those are not bad things mind you, just the normal ebb and flow of life.

Looking back, 2013 was a decent year. As the year started I had a sort of verbal confirmation of a job offer, so I wasn't anxious about my employment situation. Then after some administrative items were worked out, I was formally offered the position and started my new job January 28 2013. I've mentioned the new gig in my last posts, and it's been pretty much the same. The challenges and exposure to different technologies continue to be a refreshing change from the last few years at NorthropGrumman/USPS. I was able to visit Echostar's Cheyenne WY data center, and used that trip to visit my land outside of Fort Garland CO. Training is also easier to attend than it was at Northrop Grumman, and I am now a VMware Certified Associate for Data Center Virtualization. It's one of VMware's lesser certtifications, but it's something. I plan to take one or two more classes in the coming year.

Perhaps the one sour note of 2013 is that I continue to be somewhat unmotivated when it comes to getting my non-running motorcycles on the road. It pains me to say that their status still remains unchanged since my last posts. But in a related note, my niece attended the motorcycle safety class and now possesses a motorcycle endorsement on her license. I helped her shop for a bike and she decided on a 2010 Kawasaki 250r Ninja. She is still getting used to riding and hasn't taken it home to her place in San Francisco. That means it is another bike in my garage. Hopefully she'll be comfortable riding it enough to take it home this spring. While on the subject, I recently realized that it will ten years that I've had the Dyna! I picked it up February 14 2004. Lately, there has been a bit of top end noise while I ride it. With thirty thousand miles on the clock, it's probably due for some work. I may be bringing it in for service soon.

But to sum it up, 2013 has passed without much fanfare. No complaints though, and no regrets. It was fair year indeed. Looking forward to see what 2014 brings.

Happy New Year everyone!

Summer 2013

We're about a week into Summer of the year 2013. I wish I had something witty to write, but unfortunately I do not. I also wish I was writing this post because of some exciting revelation or discovery, and again, I do not. As I'm watching the final laps of a NASCAR race postponed from yesterday due to rain, I'm writing this to pass some time. You see, I am somewhat stuck home or close to home for the next 24 hours. I am having a routine medical procedure tomorrow that requires me to have a diet of clear liquids today. I am allowed tea and coffee, and even with sugar. But no creamer or milk. I am also allowed to have Jello, so I have a batch of Lime Jello in the refrigerator. Obviously I am off from work tomorrow. With Thursday and Friday being days off for the Independence Day holiday, this is going to be a short week at the office.

So what else is new? Not very much. The status of the two non-running motorcycles has not changed. I still haven't scheduled having my hip replacement surgery. Actually, the hip hasn't been too bad recently. Sure, there are days when the pain is bad, but overall it has been bearable.

Speaking of the new job, I'm still learning the ins and outs. But I have been able to contribute much more over the past couple months and I am settling in. Definitely enjoying my new gig.

That's about all I have for now. So until next, take care.

Return to Work II

Hello readers. Sorry once again for the somewhat lengthy lapse of time since my last post. I'd like to say that I've just been too busy to take time out to write something, but that would not be truthful.

So I've been at the new job for just over three months. I'm still learning the lay of the land, but I am enjoying it. I am working with a bunch of great people, and getting the opportunity to work with a wide variety of tools, applications, and technologies. Soon, I will get to travel to Cheyenne Wyoming to visit our main data center for a meet and greet with coworkers I only know from email and teleconferences. I've been to Wyoming a few times and I'm looking forward to the trip.

There is not much else to report. The status of all the vehicles are pretty much the same as always. But I did get a new desk for my office at home. Replaced the old computer desk I had when I moved here with a nice L-shaped desk from Staples. I finished the desk last week, and I'm still doing a little rearranging. Being this is May, I booked flights for my annual Thanksgiving week trip to visit dad in Florida. I'm not sure if I will be able to see Reagan or not, but it would be nice to hang with my daughter even if it's just for a few hours.

I know it's not much, but that's about all I have for now. Until next time, enjoy.

Return to Work

In my last post I informed you all that I was no longer employed. Not being too worried about the situation I called it my 'Trial Retirement'. I also told you about three prospects that I had been pursuing. Not too long after that post I was informed that an offer was in the works. Even better was it from the company that I had applied for outside of a recruitment agency! I came close to getting an offer from the number 2 prospect, Cisco, but I was informed that they had rehired a former member of their team.

Apparently though, there was some administrative confusion and an official offer was delayed. But that was a good thing. Still a little unsure, I was able to enjoy the holidays and a few weeks just relaxing and not worrying about searching for a new position since I figured I had one almost in hand. Then, about mid-January I did receive a formal offer for the position. After a background check I was cleared to start. My 'Trial Retirement' officially ended January 28th.

Where did I end up you ask? I'm a Senior System Engineer at EchoStar / Sling Media here in Foster City. That's right, Foster City. My commute is now about two and a half miles. But it's not just the commute I like. As I felt that in the past couple years my talents were wasting away at Northrop Grumman, the work at EchoStar is challenging and engaging. I will have opportunities to learn and utilize new technologies that were the domain of a different team in a different data center at Northrop Grumman. While at the same time, utilizing skills and experience from my past for other duties.

At this point, I am really glad that I didn't accept the first offer that came along just because it was an offer in hand. I also cannot help myself from pointing out that Romans 8:28 comes to mind. I posted that passage on Twitter and Facebook not long after I was laid off from Northrop Grumman. In the end, all things have worked together for good. But I have to say, I was getting used to not using an alarm clock...

Until next time my friends.

Trial Retirement

When I first got the news I was being laid off, I jokingly referred to my unplanned sabbatical as my "trial retirement". One thing I didn't mention in the post "All Things Must Pass", was that I have saved a bit of cash over the years, so I wasn't in a panic about finding something else right away. As a matter of fact, I could probably skate for close to two years without breaking a sweat.

So I first thought that I'd relax for a few weeks, enjoy the time off. There was the long weekend in Las Vegas to help celebrate my sister's birthday, followed by a week in Florida visiting with my dad for Thanksgiving that were coming up. Funny though. On one hand I knew I could relax and not worry. But on the other hand there's that feeling of urgency and that I if I'm not looking for a new job I may miss a really cool opportunity.

I updated my resume and posted it to Dice, Monster, and CareerBuilder. Almost immediately my phone and email were blowing up. On some days, fielding and responding to inquiries was more of a full time job than work ever was! I think it is because it is so interrupt driven. And some recruiters, what a pain in the neck. One particular recruitment agency seemed to be focused on jobs from one particular company. Seems this company had a bunch of similar positions open. But I would get calls and emails from different people at this one agency for these positions. Each time I would be asked to answer the same pre-screening questionnaire, supply the same references, send the same current copy of my resume. Yet, after 10 or 12 times, never even resulted in at least a telephone screening with the company looking to hire. Talk about a waste of time...

The three leads that did go anywhere had nothing to do with that agency. One resulted in a job offer that was withdrawn because they didn't want to wait a few days while I had final interviews with two other companies. The second one is through a recruiter that is definitely much more professional than the one previously mentioned. There was a face to face interview last week, and I am waiting for the final word. Hopefully tomorrow. Monday December 17. The third is a result of me applying for a job online. I have a final interview scheduled there on Tuesday. I would prefer the last because it is a full time gig, but I would be happy with a job offer from either of these last two.

If I don't get a job offer, I think I will take a few weeks off and enjoy my "trial retirement". Send a resume here and there, and respond to inquiries about opportunities that really excite me. At least that's what I want to do. I probably wouldn't feel as burnt out or overwhelmed if not for the recruitment agency that overloaded me with calls and emails for positions at one company that went nowhere. More than one person has told me that when they were in a similar position, they regretted not taking the opportunity to enjoy the time off.

All in all, life is good. I still have money in the bank, a roof over my head, food in my belly, and a couple of toys in the garage. Maybe, I need to finally put my passport to use to really call it a trial retirement.

All Things Must Pass

Let me first admit that I stole the title of this post from George Harrison's 1970 triple album (http://en.wikipedia.org/wiki/All_Things_Must_Pass).

Little did I know when I posted Manage This, that two weeks later I would be unemployed. At least partially due to the stresses I noted from having to wear two different hats. Understandably upset at first, I quickly started to look at this as not a door being shut, but as a door being opened. As Romans 8:28 states, "And we know that all things work together for good to them that love God, to them who are the called according to his purpose.". Over the last few years at Northrop Grumman as a Unix Systems Administrator for the USPS, I felt that my talents were being squandered. I believed that as I remained, I would fall behind on new and exciting technologies. You see, the work at USPS was divided into different teams. Most of the Unix Admins were there to support various applications. But the team that got to learn, test, and implement new and emerging technologies was based out of a data center in Eagan, MN. Here in San Mateo, the Unix Admins were somewhat subservient to the teams in Eagan. We may have used new technologies, but usually only following procedures and policies set by the groups in the Minnesota office. Yes, there was exposure to new tech. But not a large amount of opportunity to experiment and learn. Staying there, I left that technology was going to pass me by and that the only avenue of growth was the managerial ladder. But I like the trenches, I like the technical challenges and solving puzzles.

So here I am, enjoying some time off. Heck, I'm somewhat mildly annoyed that I already have some irons in the fire with a couple of cool opportunities. My phone and email has absolutely lit up the last couple days after updating my profile on two of the well known job sites. But they will have to wait. My sister celebrates a milestone birthday this Friday, and I am heading out of town to help her celebrate. I'm taking a road trip to meet up with her, my niece, and a couple other people. It's been some time since I had the Challenger on a nice long ride, and I'm sure she'll appreciate the chance to stretch her legs here and there on my drive tomorrow. Funny, that reminds me of a little song Don Imus used to play on AM radio back in the day, I think it was called Plastic Jesus.

The last week was just a minor setback, a small bump in the road. As for my time with Northrop Grumman and the USPS, all things must pass.

Manage this

So in 2010 I became a manager at Northrop Grumman. Rather reluctantly I might add. The organization that NG has that supplies talent to the USPS was changing. Instead of regional managers with dozens if not possibly hundreds of reports, they wanted managers that were also still part of the billable talent in the professional services they provided. I applied and accepted the position because I was played. As I found out later, the regional manager considered a candidate that was no way qualified just to ensure I applied for the position. So, here we are.

What was only supposed to be only approving bi-weekly time cards, and annual reviews turned out to be much more. To save time, I really won't go into it here. But it has been much more stress and responsibility than what was advertised. What makes that worse, is that the promotion came with *zero* monetary increase.

I meant to create a post about this about a year ago, but let it slide. But now is time to say something. I have a rather unpleasant task to execute. Even as I write this, I realize I cannot publish it until Monday of next week. This sucks...

The previous paragraphs were written in August 2012. The unpleasant task was having to lay off a friend. I won't go into details, but it definitely wasn't fun.

So here we are a little more than two years later after being made manager. I'm still trying to get used to this dual hat position. It's tricky thing to be a member of the team but at the same time the manager of my fellow team members. But I'm dealing with it. One thing that I think is a factor in why I haven't totally self-destructed is that my leadership changed. The regional manager that was my boss is now banished to the mid-west. My new manager is a guy who was once part of the technical (but in a different facility and state) team. He has a better understanding of the work we do for the USPS, and because of that he understands the challenges. His management style is worlds apart from the other guy and that helps a great deal.

I'm still trying to reconcile things as manager and team member. There is some good in that. I enjoy rewarding people for working hard and and when postal management recognizes effort above and beyond. But the opposite is quite taxing. Especially when accused of being harassing, even if just relaying the observations of the postal management. To revisit the previously mentioned friend I had to lay off. He understood it wasn't personal, and although that helped soften things for me, it still sucked. A current situation is just the opposite. I am being accused singling someone out when I am just citing concerns of the postal customer. Can you say high blood pressure?

But with that, I think this old draft of a post is ready to publish. I'd love hearing feedback from anyone with similar problems.

October Already

Wow! Is it October already? I wish I had some exciting news to share, but things are roughly the same since I last posted. The hip pain continues to get worse, range of motion in my left leg is diminishing. But we should have some fun this month.

My dear sister hits the big six-oh later this month. So we're Vegas bound. My sister is flying out from the east coast, my niece (and her boyfriend?) are flying down from San Francisco (did I mention she moved out here?), my friend Lynn is flying out from Ohio, and I am driving down in the Challenger. No real plans of what we are all doing, but my sister did think that heading to the Vegas drag strip to catch some NHRA action is a good idea! Whatever we all do, it's going to be a blast.

Reagan, my daughter, turns 12 November 1st. Still trying to decide what to get her for her birthday. She wants an iPad, but after an iPod Touch and a Kindle Fire, I'm thinking that more pricey electronic gadgets can wait until she learns a little more responsibility. I need to ask her mom for some ideas. Gotta say, I'm glad that after all the drama of the past, we can talk as friends.

After the long weekend in Las Vegas, there's my annual trip to visit dad for Thanksgiving. Looking forward to that as well. I always enjoy spending time with the old man. I am grateful that my family has always been pretty close. I hear horror stories from a few friends and acquaintances about their families and feel sad for them. The good Lord has blessed me and for that I am thankful.

I do have some other things I want to post, and there a few draft posts that I have been meaning to complete. But for now I just wanted to put something out there since it's been a while.

I'm not a Hipster - Part 2

Like I said, I really cannot get into the habit of posting on a regular basis. But while waiting to head out for dinner, I figured I'm long overdue. Besides, there has been something on my mind that I wanted to share.

It was at the beginning of the year when I posted I'm not a Hipster, the story about my 1984 motorcycle accident and my bad left hip. For the most part, I've been more than happy to procrastinate and continue to put off having the hip replacement surgery. But lately, the words of the orthopedic surgeon that repaired my broken femur after the accident and later diagnosed my bad hip are really starting to hit home. It was sometime in the late 1980s when I was first diagnosed with hip problems and at that time Dr. John Calhoun Killian told me this about getting a hip replacement. He said that I would get along just fine for a while, perhaps needing aspirin now and then. As time progresses, I would probably switch to the stronger OTC pain meds (back in the day ibuprofen was recently available without a prescription). He went on to say that at some point I will then start taking prescription, probably narcotic, pain medications. Finally he said, I will finally get fed up with the pain and discomfort and opt for the surgery. A reason for not just getting the surgery when the issue was first discovered is simple. The replacements wear out, and since I was much younger then, I would likely be on my 2nd or 3rd replacement by now. Well, those who know me have heard me say that the time is coming soon for a while now. It's been about 4 years since I filled my first prescription for Hydrocodone. This time, I'm thinking that it may really be that time.

For years, riding my motorcycle didn't bother or aggravate the hip. As a matter of fact, there were times that I felt a little stiff and cramped getting on the bike, but after a nice ride I felt fine when I got off. That is no longer the case. In the last few weeks or months I've noticed a change in that now riding the motorcycle exacerbates any pain or cramps as well as creates pain when it wasn't there before the ride. My sister told me that one time she was discussing my hip issues with my father and she said I would probably not get the surgery until I couldn't ride. She may have been right. The frequency and level of pain I've been suffering from the past few months is really starting to get to me. Hell, just getting on and off the bike is a chore. I even tried to ride my bicycle a couple weeks ago, and could not for the life of me get my leg over the seat! If I didn't know better, I would bet that I've lost more range of motion in the last 3 or 4 months than I have in the 3 or 4 years prior. Tying the shoelaces on my left sneaker is almost impossible. Where the pain and discomfort used to be something that was easily dismissed and dealt with, it is now front and center almost every day. So I guess, the time really is near. Exactly when, still undetermined. But definitely looming on the horizon.

Forced Remodel

Well it seems I am being mandated by the apartment management to have my kitchen and baths remodeled. Which means by Monday morning, May 14th 2012, I have to remove everything from all the cabinets, shelves, counter tops, and move the contents of the fridge to one they placed in my dining room yesterday. Even the hallway linen and misc closets.

A daunting task normally, let alone when a bad hip starts cramping up after just 15/20 minutes of moving and rearranging. Then the question of where to put everything comes to mind. What a PITA! I tried to put a large dent in the task yesterday evening, and then needed 2 Vicodins and 2 TylenolPMs to get to sleep.

I've been trying to get a little done here and there, but it seems I haven't even put a dent in it. Even now I'm still debating with myself on whether or not I should go out and purchase boxes or storage bins. Yes, the boxes or bins will make it easier to store things for the week, but if items are not in boxes they will be easier to access if I find the need for something stowed away.

Living in a semi-displaced mode for the next week should be another joy. No oven, stove, kitchen sink, etc. I really should have planned to be away for the week. So, what do you think the apartment management is offering as a compensation for the week of being displaced, plus the time spent needing to pack and rearrange things? If you guessed absolutely f'ing nothing, you guessed right. Oh, they did offer to have my carpets cleaned afterwards, but then shouldn't that be expected after a week of workers being in and out of the apartment for a week?!

This is not going to be a good week...

Tithe and Retirement

Biblical scholars, believers, and theologians; tax time has made me think of something related to tithes and offerings. I would be interested in other points of view and thoughts about the subject at hand.

From the time I began to faithfully tithe on a regular basis, I decided that I would base my tithe on gross salary and not net. This relieves me of having to worry about additional tithes if I receive a tax refund, or perhaps reducing my tithe if I had to pay additional taxes. Since I pay my tithes according to my gross salary, I have already tithed against any amount of a tax refund. I may choose to offer more with a tax refund, but my conscience is clear if I do not.

That is all fine for now, but I have started thinking about retirement. If most of my retirement is self-funded, is it the same as my tax refunds? I realize I will have to account for interest, dividends, and amounts matched by employers. But will I have clear conscience in not offering a full tithe in my retirement years? Something to ponder as retirement starts getting closer.

I'm not a hipster

Twenty-eight years ago this coming July 22, I had a serious motorcycle accident. The last vehicle in a chain of three or four that collided while avoiding a car that had entered the Northern State Parkway in an unsafe manner. The bike went into a high-slide when I tried to lay it down, and I slammed into the back bumper of a Buick 225. I will admit, I am partially to blame.

I ended up with a compound fracture of my left femur, and some nerve damage that caused 'foot drop' of my left foot. I was hospitalized for just under six weeks. During that time, things got dicey when a fat embolism made its way to one of my lungs. The surgery to repair my leg, inserting a titanium rod (sometimes called a Kushner Rod) in the femur had to wait until the embolism was cleared up. Combined with an external prosthetic brace, the rod allows one to begin putting weight on the leg immediately after being discharged from the hospital. This reduces or eliminates the muscle atrophy that one would get if the leg was in a cast for a few months. I forget how long I ended up wearing the brace as I progressed from using two crutches, to one crutch, and then to a cane. I used cane regularly for quite a few years, perhaps six or seven, maybe a little more.

A couple years later I returned to the hospital to have the titanium rod removed. I was only in the hospital for a day. I had asked to keep the rod, but I never did get it. Around that same time, the 'foot drop' went away quite suddenly. I had been going for testing, and surgery was suggested to correct the nerve damage. But one day while hanging out with a friend at her job, I noticed that I was tapping my foot to music. With the rod removed and the nerve damage gone, it seemed that the ordeal was completely behind me. Or so I thought...

Not too long after I began to suffer from back pain after walking, running, etc. When it got bad enough to visit the doctor, a leg length discrepancy was discovered. My left leg was now about a half inch or so shorter than my right. X-Rays showed that my left hip was starting to develop arthritis. The doctor theorized that it could have been an unnoticed hairline fracture at the time of the accident. I was measured for a prosthesis (a lift that fits inside my left sneaker) and the back pain did go away. But at that time, the orthopedic doctor told me the progression I should expect. He said I'd be fine for a while, perhaps needing an aspirin or two now and then. After that, I will likely switch to the stronger OTC meds for more frequent and severe bouts of pain (at the time Ibuprofen was the drug that you no longer required a prescription for). He said the next phase would be that I would end up taking perhaps twice the listed dosage on a frequent, if not regular, basis to deal with the hip and leg pain as the hip deteriorates further. After that, prescription pain killers. This is the phase I have been at for the last three years. My regular doctor had tried to prescribe anti-inflammatory (NSAID) drugs like Celebrex, but they barely took the edge off the pain, let alone make it go away. So the last three years, I have been taking Vicodin aka Hydrocodone. Not every day mind you, just when the pain gets past a certain threshold. It gets tricky now and then, deciding whether or not to take the opioid. Some days, I wait too long and end up 'chasing the pain'. When that happens, even taking the max dose of Vicodin does little more than soften the edge of the pain. The last phase as you can guess is that I finally opt for the hip replacement surgery. Why not just get it done years ago you ask? The replacements wear out, and if I were to have had it replaced when first discovered I probably would have had it redone once or twice since then. The doctor years ago suggested I wait until I can't deal with the pain any longer.

And that's almost where I am now. I saw a specialist at Stanford University Hospital a couple times the last two years. The bad news he gave me last time was that my hip is getting near a point where the damage will make the surgery and recovery more difficult. But I am still thinking of the logistics of being out of work for a couple months, getting around immediately following the surgery, and other related issues. Then again, the increased pain has had other effects. I'm less mobile these days, and that's causing a bit of a weight gain issue. Of course the gain in weight makes it more painful to be mobile, which goes back to the beginning of the cycle. When will I get my hip replaced? I'm not sure, but at this point I know that I need to pull the trigger sooner rather than later.