My configuration is an Exchange 2003 server behind a Linux firewall and an Apache 2.2 front end to Exchange. I’m connecting using https on my XV6700 but when trying to sync with the server, I kept encountering “The security certificate on the server is invalid. Contact your Exchange Server administrator or ISP to install a valid certificate on the server. Support Code: 80072f0d”.

I know my certificate was valid because I generated it myself! It turns out that was the problem – I was not a trusted root authority. Sigh. But that is easily remedied!

To resolve this problem all I needed to do was install my self-created CA signing certificate on the Pocket PC / XV6700. Since I created it on my Linux server, I had to convert it into a form the WM5 understands, in this case a DER encoded binary X.509 certificate. This could be done by importing it into Internet Explorer and then exporting in that format or in a simpler one-step process from the command line:

openssl x509 -in ca.crt -out ca.cer -outform DER

Now, just copy the ca.cer file to the PPC and open it in File Explorer. It will ask you if I want to install the certificate issued by . Clicking yes will import the certificate (that can be view in the Certificates control panel under the Root tab).

Once installed, ActiveSync no longer complains about the certificate and merrily performs it job.

Whew. Easy solution but it certainly took a while to recall!

Why not utilize a coupon system over SMS in addition to product placement or promotion to sell products on Internet distributed videos? There are some very bright and creative people out there creating free content for video. Why not entice them to advertise a product and make some money at the same time?

Here’s how it works, using this Starbucks Addict video as an example. Ann (the video’s author) publishes some incredibly witty and clever video that somehow draws thousands or hundreds of thousands of people to watch it. Part of the video advertises Starbucks and there is a coupon offer associated with the video for 10% (or whatever) off.

So far, pretty simple; now to mix in SMS. I saw an article about using your phone as your wallet recently and I put these two ideas together.

Extending the example: to entice both parties to deliver, a single-use coupon code is created that uniquely identifies the offer. A hash is generated that identifies the author of the video, transaction number and expiration date. Of course, the author needs to get a registration key from Starbucks that authorizes the coupon. If the viewer decides they want the coupon, it can be SMS’ed to their phone and stored there. When time comes to use it, the viewer enters the Starbucks and text messages the coupon code to the store which automatically registers the coupon code and credits the video author’s account and also issues the discount for the item. The credit could be a flat fee or a percentange of the item. Everybody wins. The author gets credit for their creative talents, the viewer gets a discount and the product company gets some free advertising. And as a freebie, this method also allows for establishing some excellent metrics by tracking the coupon codes.

This can all be done with existing technology and it would be quite simple to do.

My environment is still the same as the previous posting with the exception of an Apache 2.2 front-end instead of the VPN tunnel. Here’s a link to setting up the Apache server. (NOTE: I’m not experiencing the same problems with a percent in the subject so I have not applied the workaround.)

The problem surfaced as errors during ActiveSync-ing. I would see an error code of 85010014. I discovered the real problems were with Apache returning 502 errors. The error logs were filled with lines of the following form:

[Wed Aug 02 14:58:38 2006] [error] [client 192.168.86.111] proxy: error reading status line from remote server
[Wed Aug 02 14:58:38 2006] [error] [client 192.168.86.111] proxy: Error reading from remote server returned by /Microsoft-Server-ActiveSync

I believe the error has to do with timeouts from HTTP KeepAlives and mod_proxy reading from a closed pipe/handle. I have adjusted the timeouts on both ends and still received the same errors. I even disabled HTTP KeepAlives on the IIS error: that resulted in a whole new problem: error code 85010016. As soon as I re-enabled the HTTP KeepAlives on the IIS error, the 85010016 error went away (no need to restart the IIS server). I've also tried the <a target="_blank" title="[Bug 37770] - proxy: error reading status line" href="http://www.gossamer-threads.com/lists/apache/bugs/314332"><em>SetEnv proxy-nokeepalive 1</em> workaround</a> and that did not solve my problem.

I realized I had a configuration problem when checking netstat results and looking at the packets from Ethereal (now <a target="_blank" title="Wireshark" href="http://www.wireshark.org/">Wireshark</a>). Turns out I had an SSL connection to the apache server but a plain old HTTP (port 80) connection to the IIS server! By adjusting my ProxyPass parameters in httpd.conf to point to https, my 85010014 error has gone away and I no longer see the error messages in my httpd logs.

For reference, my entry in httpd.conf:
<code><VirtualHost *:443>
ServerName owa.backend.server
ServerAdmin hostmaster@backend.server

ErrorLog logs/owa_error_log
CustomLog logs/owa_access_log combined
LogLevel warn

SSLEngine on
SSLProxyEngine on
SSLProtocol +all
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLProxyProtocol SSLv3

SSLCertificateFile /etc/httpd/conf/server.crt
SSLCertificateKeyFile /etc/httpd/conf/server.key

RequestHeader set Front-End-Https "On"
#ProxyPreserveHost On

ProxyPass / https://owa.backend.server/
ProxyPassReverse / https://owa.backend.server/
ProxyPass /rpc https://owa.backend.server/rpc/
ProxyPassReverse /rpc https://owa.backend.server/rpc/
ProxyPass /exchange https://owa.backend.server/exchange/
ProxyPassReverse /exchange https://owa.backend.server/exchange/
ProxyPass /exchweb https://owa.backend.server/exchweb/
ProxyPassReverse /exchweb https://owa.backend.server/exchweb/
ProxyPass /public https://owa.backend.server/public/
ProxyPassReverse /public https://owa.backend.server/public/
ProxyPass /iisadmpwd https://owa.backend.server/iisadmpwd/
ProxyPassReverse /iisadmpwd https://owa.backend.server/iisadmpwd/
ProxyPass /exchange-oma https://owa.backend.server/exchange-oma/
ProxyPassReverse /exchange-oma https://owa.backend.server/exchange-oma/
ProxyPass /Microsoft-Server-ActiveSync https://owa.backend.server/Microsoft-Server-ActiveSync/
ProxyPassReverse /Microsoft-Server-ActiveSync https://owa.backend.server/Microsoft-Server-ActiveSync/

CacheDisable *

<Directory /var/www/>
Order allow,deny
allow from all
RedirectMatch ^/$ /exchange
</Directory>
</VirtualHost>

Players:

• Small Business Server 2003 SP1
• Exchange Server 2003 SP2 (single instance, no front-end/back-end combination)
• ActiveSync 4.1
• Verizon XV6700, Windows Mobile 5.0

Error messages:

• On ActiveSync & XV6700: 0×85010014

Quicks of my configuration:

• Multiple e-mail addresses: rick@domain1.com, rick@domain2.com, rickw@domain3.com …
• My Default e-mail address policy does not match my domain name, but does match my default e-mail address.
• Exchange server is hidden behind Linux firewall and front-ended with sendmail.
• Using a VPN connection to communicate directly to the exchange server from remote.
• I’m not using ISA or other firewall software on the Exchange box.
• The exchange box is the same box as the domain controller.
• This is a single instance Exchange server; there is no front-end/back-end.

Things I’ve read but don’t need to do or worry about:

• Since this is a server-side problem, I don’t think it’s necessary to uninstall/reinstall Outlook and/or ActiveSync.
• I didn’t need to add the MasSync\Parameters SMTPProxy string key to the registry since my default email address policy matches my default email address (Refer to Microsoft Knowledge Base Article 886346).
• Hard-reset of the handheld wasn’t necessary and can’t imagine it would be, unless of course…

Helpful (and probably necessary):

• Delete the mobile device from both ActiveSync on the PC and ActiveSync on WM5 and then re-add it on the PC.
• Configure IIS to support both Kerberos and NTLM authentication. Refer to Microsoft Knowledge Base Article 215383 for details.
• Installed the root certificate on the handheld, although not necessary if not using SSL. Refer to this thread on HowardForums (search for “not trusting your home-brew cert”) for details.
• Don’t worry about certificates is not using SSL.
• Make sure both /Exchange and /Exchange-OMA have the following authentication methods are enabled: Integrated Windows authentication, Basic authentication.
• Create the /Exchange-OMA Virtual Directory. If it already exists, delete it and recreate it according to the instructions provided by Method 2 in the Microsoft Knowledge Base Article 817379. This is the step that ultimately made this work for me.

Issues:

• Getting it to sync over VPN is a bit tricky. To make sure that the VPN is connected on WM5, but the server name in ActiveSync matches the certificate (if using SSL), an exception needs to be added on the Connections control applet (Settings–>Connections–>Connections–>Advanced) to tell WM5 to initiate the VPN connection for hosts ending with your domain, for example: *.yourdomain.com. This allows it to sync using SSL, both OTA (over the air) and through the USB connection.

Extremely useful:

• This Microsoft download: Troubleshooting Microsoft Exchange 2003 ActiveSync. This MS Word document contains a lot of helpful steps to troubleshoot the ActiveSync installation.

Notes:

• I often saw an error in my Application Event viewer (on the exchange server) for Source: Server ActiveSync, Event ID: 3031 about the mailbox server does not allow “Negotiate” authentication to its [/exchange-oma] virtual directory. This led me to configure IIS to support both Kerberos and NTLM authentication (as described above), although after doing so, I continued to see the error message. It finally went away when I recreated the /Exchange-OMA directory.

Next, I’ll configure it to work with an apache front end to eliminate the need for a VPN tunnel.

On my Verizon XV6600, the image is offset to the right (and maybe top) about 8 pixels, leaving a thick white line own the left hand side. I have yet to overcome that (help anyone?)

The other difficulty is in connecting via ssh using usbnet. The biggest tricks are to set a route to the device and, if using a firewall, make certain the appropriate rules are there to that the firewall does not get in the way. The other trick is getting the PDA to see the usb0 network.

Before connecting the device, do a tail -f /var/log/messages on the linux box to see if the PDA connects. When plugging in the USB cable to the linux box from the PDA, you should see something similar to the following in the messages log:

usb 2-2.1: new full speed USB device using uhci_hcd and address 40

(I actually see a few of these with error messages in between (device descriptor read/64, error -71).

If you don’t see anything when connecting, try one of the following:

- Restart the boot procedure with the USB cable plugged in.
- Unload the drivers, plug in the cable and then reload the drivers.

The following will unload the drivers; you must be in a root shell on the PDA.

When I do the rmmod/modprobe, I see the following in my messages log:

Also, lsusb on my linux box yields:

If the usb0 device disappears from the PDA, restart the network with the following command:

Now that the usbnet connection is there, I need to set up the network.
Again, the transcript I used to connect with ssh:

Unfortunately, this doesn’t always work the first time through. You may have to disconnect the USB cable and reconnect. Afterwards, you’ll need to do the ‘netstat -r’ command again. Then you may actually be able to do the ssh!

Finally, if you have a firewall installed, before you can ssh (or anything else), you’ll have to insert some rules. The ones I used are:

Not only does all this assume the IP address 192.168.0.205 on the Linux box and 192.168.0.206 on the PDA, it requires it. The distribution on the PDA downloaded from the link earlier (contained in gpe-ba.tar.bz) sets up the PDA with the 192.168.0.205 address.

Try the following from the ssh connection (assuming you used the -X flag):
root@blueangel:~# gpe-info

You’ll see the following…

Good luck and enjoy!

First, download the files:

haret.exe
zImage-2.6.12
initrd-2.6.12-hh2.gz
startup.txt
autorun.exe
gpe-ba.tar.bz

Next, install according to the commands below. The autorun goes in the 2577 directory, most of the others go in the linux directory and the big gzipped gpe-ba gets untarred on the second partition.

That should be it. Plug it in to your Blueangel device and it should automatically load and boot into Linux. But make certain that you have backed up the contents of your PDA first! Running Linux on it completely wipes out the PDA. You’ll need to install from scratch after resetting.

And, I don’t believe this distribution allows the phone to be charged while using it, so be warned! You will have to reinstall. I’d recommend a full charge before doing this.

Assuming that your linux box can see the card, the tool to format the card is fdisk.
For me, my linux box saw the card as /dev/sdc. You’ll need to figure out which device to use. You can find out by looking at /var/log/messages.

First, you need to delete any existing partitions. Then you’ll need to create two new partitions, the first one being 30MB and FAT16, the second the remainder of the card and a Linux partition (I recommend at least a 64MB SD card). After you create the partitions, and write it out to the card, you create the file systems and the you are good to go.

Here is a transcript of me doing this to a 128MB SD Card – the card is plugged into a USB-HUB Combo Card Reader. I’ve bolded my input. Comments are italicized and should not be entered. Note the following is done as root – be very careful!

to exit tail -f command>

That should be it.
Good luck.

STEP 0. Backup all of your data (including sd card). I use Sprite Backup software.

STEP 1. Download the Kernel, etc.

zImage initrd haret.exe GPE BlueAngel Image startup.txt autorun

STEP 2. Format SD-Card

Become root and create 2 partitions on the SD-Card

The first partition is for the kernel, startup scripts and bootloader. The second is for the GPE image.

• fdisk /dev/sda should do this (it may be under /dev/mmc on your machine, this is mearly an example).

One of 30MB (for kernel and bootloader) and another (or rest of SD) for the GPE image.

Format the Partitions

• mkfs.vfat /dev/sda1
• mkfs.ext3 /dev/sda2 (These two commands may differ for your system, they are only meant as an example)

Now mount those partitions.

• mount -t vfat /dev/sda1 /mnt/sd0
• mount -t ext3 /dev/sda2 /mnt/sd1

STEP 3. Copy kernel, etc onto first partition

Create a new directory in /mnt/sd0 called ‘linux’. Copy zImage, initrd, startup and haret into the ‘linux directory’

Create another directory in /mnt/sd0 called ’2577′.

Copy autorun.exe into ’2577′

STEP 4. Extract GPE into the EXT3 Partition

Change to /mnt/sd1 ‘cd /mnt/sd1′

• Execute tar xjvpf
  /gpe-ba.tar.bz2
• DO NOT, as many intelligent people have done, just copy the archive onto the partition!

STEP 5. Change to /root ‘cd / ‘

• Execute sync
• Execute umount /dev/sda1
• Execute umount /dev/sda2

STEP 6. Now boot linux by inserting the SD-Card into the BlueAngel. DONE!