text:
CHAPEL HILL- UNC's Carolina North project is one step closer to being completed, now that a generator has been installed at the site to convert landfill methane gas into electricity.
"This is kind of a partnership with Orange County," says UNC Director of Energy Service Phil Barner. "Methane is a big greenhouse gas, and it has some value, if there's enough of it, to put in an engine and make electricity. We did a feasibility analysis, and it looked like it had some promise."
The project will use leftover methane gas from the Orange County landfill, which is set to close on June 30. The undertaking is part of a larger plan to eliminate UNC's carbon footprint over the next several decades.
In order to obtain the gas, Barner says his team used a process involving wells.
"We put in a system of wells in both the north and south landfill, we cleaned it up by getting the moisture out of it, and we can flare what we don't use," he says.
Orange County Solid Waste Management Director Gayle Wilson says this project will be particularly useful once Carolina North's buildings are actually constructed.
"At some point in the future, whenever there's a building constructed on the Horace Williams track, that power will be used to power the facilities there."
For now, the electricity is being sold to Duke Energy.
Upon its completion, the Carolina North project will span over 250 acres near the Horace Williams Airport site, two miles away from UNC's main campus; it's slated to be used for both academic and research purposes.
Barner says the generator portion of the project will cost between $1 million and $3 million.


text:
This appendix explains how to configure Identity Synchronization for Windows 6.0 and Pluggable Authentication Methods (PAM) so an LDAP store can provide synchronization capabilities between Solaris and Windows. The information is organized into the following sections:
In this appendix, Windows refers to Windows environments using Active Directory for authentication. Windows NT environments may impose different approaches.
If your enterprise environment contains both Solaris and Windows hosts, you can simplify the administration of the user community if you use Identity Synchronization for Windows to manage the two environments as a single set of users.
Combining PAM and Identity Synchronization for Windows can accomplish the following goals:
Enable an LDAP store to provide synchronization capabilities between Solaris and Windows
For example, enable user information (including passwords) created or modified on one system (Solaris or Windows) to replicate to its counterpart so either system can act on the information.
Use PAM to authenticate Solaris and to manage passwords against an LDAP store
Enable users to change their own passwords (if doing so does not contradict security policy)
Configure your environment to ensure that passwords are never sent over a medium that permits eavesdropping
Solaris implementation of PAM has long-offered the ability to use an LDAP store. However, the inclusion of PAM modules in Solaris 9 has made it possible to use a product such as Identity Synchronization for Windows.
You can patch Solaris 8 to support this functionality using Patch number 108993 for Sparc® or Patch number 108994 for Solaris x86.
PAM comes by default with Solaris 9 and later.
While some Solaris PAM modules are LDAP-aware, other modules do not use LDAP in a way that triggers Identity Synchronization for Windows' interception actions.
For example, when you configure the PAM_UNIX module to use LDAP (using a directive specified in the /etc/nsswitch.conf file), the module never binds (as the user in question) against the LDAP store when authenticating. Instead, the PAM_UNIX module reads the user's LDAP entry, internally compares the password found on the LDAP entry to the password provided, and then PAM_UNIX makes its authentication decision accordingly.
The PAM_UNIX module authentication is done outside the purview of the LDAP store so none of the hooks put into place by Identity Synchronization for Windows will be used. Consequently, passwords will fail to replicate from the LDAP store to Windows.
Specifically, to initiate the synchronization process, Identity Synchronization for Windows requires all authentication systems to bind to the LDAP store. Furthermore, the binding mechanism must present the user's password in a clear manner, such as a simple bind, which rules out the use of SASL and Digest mechanisms. Using Transport Layer Security (TLS) for the connection between PAM and the LDAP store makes the use of simple binds acceptable for security.
The PAM_UNIX module's authentication methods should suffice in environments where passwords never change or where password changes always flow from the LDAP store to Windows. However, you must not use the PAM_UNIX module in environments where passwords change on Windows.
In contrast to the PAM_UNIX module, the PAM_LDAP module binds to the LDAP store using a preformed, "user-centric" DN and a user-provided password when authenticating. This action in particular allows Identity Synchronization for Windows to maintain the synchronization of an entry. As a result, you will use this PAM_LDAP module in conjunction with Identity Synchronization for Windows and existing PAM modules.
The following section explains how to configure PAM and Identity Synchronization for Windows.
In this section, Windows refers to Windows environments using Active Directory for authentication. Windows NT environments might require different approaches.
Use the following steps to configure Identity Synchronization for Windows and PAM for environments in which passwords can change on Windows:
Configure an LDAP repository for PAM (Step 1: Configure an LDAP Repository for PAM)
Install and configure Identity Synchronization for Windows to synchronize the LDAP repository and Windows (Step 2: Configuring Identity Synchronization for Windows
Populate the LDAP repository with user data (Step 3: Populating the LDAP Repository)
Configure a Solaris host to use the LDAP repository (Step 4: Configuring a Solaris Host to Use PAM)
Establish password authentication through the LDAP repository and enable users to change their own passwords (Step 5: Verifying that PAM is Interoperating with the LDAP Store)
Verify that user information (including passwords) flows between environments (Step 6: Demonstrating that User Changes are Flowing to the Reciprocal Environment)
The rest of this section provides detailed information about each step and uses examples to illustrate the process.
This section explains how to configure an Identity Synchronization for Windows - supported LDAP repository for PAM, using the following example information:
The LDAP store is a Directory Server system that is hosted in a Solaris environment.
The host machine's DNS name is LDAPHOST.EXAMPLE.COM.
The machine's IP address is 192.168.220.219 in the test environment.
In this example, the IP address has a concrete value so that when you configure the PAM clients, you can use the repository's IP address to avoid potential conflicts based on how the PAM client machine resolves its DNS queries.
Before you begin, consult the Sun Java System Directory Server Enterprise Edition 6.1 Installation Guide to verify that you are using a supported directory server.
To get PAM to work with Directory Server, edit the /usr/lib/ldap/idsconfig script and change 5 to 6 in the following code:
if [ "${IDS_MAJVER}" != "5" ]; then
Use the following steps to configure an Identity Synchronization for Windows- supported LDAP repository for PAM.
Configure the LDAP store using the Solaris idsconfig command line tool.
The idsconfig tool prompts you for values that are needed to form the Directory Information Tree (DIT) to be contained in the LDAP store. The idsconfig tool will manipulate the requisite LDAP store schema to accommodate the impending user population.
When you configure the test system, the following idsconfig summary screen is displayed:
While executing the idsconfig command line tool, you need to know the values that have to be provided to the various configuration parameters. If you do not know the values, provide the default values that are prompted (other than the configuration parameters 1,2 and 4).
Change the value of the configuration parameters by selecting the configuration number against them.
Select an option from the list of predefined options that can be supplied to the selected parameter.
Evaluate the following key parameters' values:
Domain to serve
Profile name to create
Service Auth Method pam_ldap
If necessary, use the idsconfig tool to change the context of these parameter values so they are appropriate for your deployment scenario. If you are working in a test environment where you can change DNS entries and set machine IP addresses to arbitrary values, you could use the names and addresses provided in this appendix.
Continue with the proxy creation initiated by the idsconfig tool. Provide the appropriate values (default or custom) for the various parameters to complete the configuration.
After idsconfig stores the generated configuration, the idsconfig tool will direct you to create virtual list view (VLV) indexes.
VLV indexes (also called browsing indexes) enable PAM to quickly search for groups, users, and so forth. Refer to the following website for information about creating VLV indexes:
Managing Browsing Indexes in Sun Java System Directory Server Enterprise Edition 6.1 Administration Guide
Pay particular attention to the number of VLV indexes that you are prompted to create. The idsconfig tool will provide a list of VLV indexes that are contextually sensitive to the state in which it finds the LDAP store.
The following figure shows the resulting topology, as seen from the Sun Java System Directory Server console:
When you are finished configuring the LDAP repository for PAM, continue to Step 3: Populating the LDAP Repository.
Now you can begin the process of bridging the LDAP store with the Windows' authentication system. You accomplish this process by installing and configuring Identity Synchronization for Windows against the following two systems:
You can install Identity Synchronization for Windows on the Solaris 8 host (LDAPHOST.EXAMPLE.COM) and then configure the software so that all of the distributed processes required by Identity Synchronization for Windows will run on LDAPHOST.EXAMPLE.COM.
Instructions for installing and configuring Identity Synchronization for Windows are provided in the Sun Java System Directory Server Enterprise Edition 6.1 Installation Guide.
When you finish configuring Identity Synchronization for Windows, continue to Step 3: Populating the LDAP Repository.
After configuring an LDAP repository for PAM, you can push user entries to the LDAP store.
For example, you want to create a new, single user named George Washington that is subordinate to the following entry:
In addition, you want to use an ou=people "container" that is subordinate to the Base DN you provided to idsconfig. You may have to make contextual changes to the Base DN you are going to use.
Use the following steps to populate the LDAP repository:
In the Directory Server Control Center console, select the Entry Management tab and then select the Browse tab, the various entity management controls display in the right pane.
Press New Entry to display the New Entry page.
Enter a value in the Entry Parent DN field to specify the location to save the entity in Directory Server and click Next.
Associate your entity with an object class by selecting an option from the Entry type drop-down menu and then press Next. Based on the object class you associate with your entity, number of different parameters display
Enter the appropriate values and press Next. The summarized information of the entity displays.
Click Finish to save the changes.
Verify that the new user (George Washington) is displayed in the console.
PAM clients can now authenticate against (and change the password for) this entry.
After configuring the LDAP store, you must configure a Solaris system and create a PAM client to test the viability of PAM-based authentication.
To configure a Solaris host and create a PAM client you must
Install and configure a test Solaris system.
Configure the client machine.
Specify new rules for authentication and password management.
To illustrate this process, example instructions are provided in the next three sections.
Install and configure a test Solaris system as an independent, standalone machine.
To simplify this example, consider configuring a machine that is devoid of any naming service directives (such as NIS or NIS+).
Consider using a Solaris 9 x86 4/04 system, which contains patches required for PAM and its associated subsystems.
The following example instructions assume that you installed and configured the Solaris host as described in the previous section.
You must configure a PAM client machine to locate the LDAP host with a repository that the client will use to access (and effectively change) the LDAP store. To configure the PAM client, use the Solaris ldapclient command, which stores the client's configuration information on the local host.
Be sure to make a back-up copy of the /etc/nsswitch.conf file before you run the ldapclient command. Running ldapclient has several side effects— which includes completely replacing the system's /etc/nsswitch.conf file with a copy of the content in /etc/nsswitch.ldap.
The following image illustrates an example ldapclient command:
You should use an IP address for this configuration instead of a DNS name, because a DNS might not available when the PAM system needs it.
It is also important to use a proxy credential set to prevent anonymous authenticators from manipulating data in the LDAP store.
The system provides a set of proxy credentials you can use when manipulating PAM data on the host LDAP store. (These proxy credentials match those created when you used the idsconfig command to initialize the LDAP store.)
The generated configuration stores the proxy's password as an encrypted value, which is done for security purposes.
In addition to generating the requisite LDAP contact information, running ldapclient replaces the contents of the /etc/nsswitch.conf file with a copy of the contents found in /etc/nsswitch.ldap (the /etc/nsswitch.conf file you backed up earlier). Consequently, most (or all) of the directives found in /etc/nsswitch.conf will include the LDAP directive (which means the LDAP store will be consulted when resolving the associated service request).
In this example, the resulting /etc/nsswitch.conf file left on the system by the ldapclient command dropped the DNS directive from the list of used services when resolving hosts. As the example LDAP store may not be populated with the requisite host information needed to supplant DNS, the /etc/nsswitch.conf file is adjusted (which is the only change made to the post ldapclient command version of the /etc/nsswitch.conf file in this example).
You should edit the host's declaration to read as follows:
hosts: files ldap dns
Instead of the following reconfigured value (using ldapclient):
hosts: ldap [NOTFOUND=return] files
It is possible that this adjustment will not address your environment's needs correctly if you are running your DNS from the LDAP store. Be sure to apply this change only if your environment's context depends on it. In addition, continue to compare and contrast the service directives with the effective /etc/nsswitch.conf file to the pre-ldapclient variant to validate that all services are now being directed correctly.
The example instructions provided in this section assume that you installed and configured the Solaris host as described in the Installing and Configuring a Solaris Test System section.
When you configure a Solaris host to use PAM, change the /etc/pam.conf file to incorporate the new rules you want it to use for authentication and password management. (See Introducing Windows NT into the configuration for an example /etc/pam.conf file.)
Before making any changes to the /etc/pam.conf file, be sure you make a backup copy of the original /etc/pam.conf file. Changes made to the /etc/nsswitch.conf and the /etc/pam.conf files can render your PAM client host inaccessible, which means that your configuration is set to deny everyone's (including root) authentication access to the machine.
To recover from this situation:
Edit the pam.conf file in the current terminal/command session.
In a new terminal window, try connecting to the localhost using the rsh or ssh command and then try logging in.
If you fail to authenticate, you can still correct the problem using the open terminal/command window from .
If you are still unable to recover, restore the /etc/nsswitch.conf and /etc/pam.conf files back to their original state.
Using the Solaris sys-unconfig command may not restore your system because this command does not affect the /etc/nsswitch.conf and /etc/pam.conf files.
Repeat the steps 1 and 2 until you achieve the expected system behavior.
The changes you must make to /etc/pam.conf are trivial, but important. They are explained here:
For purposes of authentication, you must edit the file as follows:
Locate any entries in the original /etc/pam.conf file that direct the system to use a rule requiring PAM_UNIX_AUTH, and edit them to accept a binding directive and to pass the server_policy parameter to the PAM_UNIX_AUTH module.
The following figure shows a diff between the original /etc/pam.conf file and the edited file.
Edit the file to add a new rule after the altered rule line. (the /etc/pam.conf file is processed from the top down, the line's order is important here.)
The new rule requires the service to include PAM_LDAP when deciding to accept an authentication request. The use_first_pass parameter tells the PAM_LDAP module that it must accept a password collected by an earlier rule's module (usually satisfied by the PAM_AUTHTOK_GET module).
A use case that deserves special consideration is how PAM treats local user log on. A local user is a user who is permitted by /etc/nsswitch.conf directives to examine files (such as the root account) and is enumerated in the /etc/passwd file. Local users are not necessarily stored in the LDAP store.
Allowing the root user to be listed in the LDAP store would simplify management of an important user account that spans the topology; however, you could make an equally powerful case for systems whose root user must be kept "private" for a given machine.
To accommodate the need to keep an account (such as root) as a local user, it is important to configure PAM in such a way so that it does not access the LDAP back-end store if the user information has been saved in the local files. You can address this situation by specifying the server_policy parameter for the PAM_UNIX_AUTH module in the /etc/pam.conf configuration file.
The only effective change required for password management is to append the server_policy parameter to the PAM_AUTHTOK_STORE module. When you use the server_policy parameter, the module will update passwords for local users (if found) or access the LDAP store accordingly. If the module cannot find a user either locally or in the LDAP store, then the system will provide an appropriate error message.
When you have finished configuring the Solaris host, continue to Step 5: Verifying that PAM is Interoperating with the LDAP Store.
You are now ready to test whether the newly configured Solaris host can operate as a PAM client. However, before trying to log in as the example user, George Washington, you need to "cheat" just a bit.
Note that George's default home directory is /pres/home/gwashington. This directory does not yet exist on your test host nor have you configured the auto_home system on which to mount that file system automatically. You can create the directory manually to avoid any kind of problem.
You should be able to see the PAM system in action immediately (because gwashing is both understood and displayed). The following image shows that the PAM LDAP client system you configured can authenticate as gwashing. In addition, this figure demonstrates that a password change can be accomplished and that the new password will be accepted on a subsequent authentication request.
If you check the LDAP store log (specifically looking for non-search operations) you should see an audit of the LDAP operations done in support of the preceding log-in and password-change test.
Both Windows and the LDAP store (if so configured) use a one-way hash when storing passwords. This configuration prevents true replication of password data between the two systems, but does not prevent the password synchronization.
For an environment that is participating in bidirectional password synchronization, any existing user's entry being tracked in both environments must be in one of the following states:
Case 1 (Case 1): Both Windows and the LDAP store contain current information
Case 2 (Case 2): Windows is current but the LDAP store is outdated or stale
Case 3 (Case 3): Windows is stale but the LDAP store is current
Case 4 (Case 4): Both Windows and the LDAP store are stale
Case 1 is trivial — there is no work to do on either system because the entries are current.
In Case 2, the LDAP store is in a state of waiting. Specifically, the system is waiting for an opportunity to capture the current, correct password for the LDAP store. In this case, a properly configured Identity Synchronization for Windows system marks the corresponding entry in the LDAP store as outdated or stale.
When an Identity Synchronization for Windows - enhanced Directory Server system gets a bind against a stale user, Identity Synchronization for Windows replays the given bind credentials to the configured Windows Active Directory to see if the user-supplied password is acceptable. If Active Directory authenticates the password, Identity Synchronization for Windows modifies the LDAP store so that it now possesses the password. Directory Server may eventually hash the value as part of its password policy and clears the stale status.
This process is known as on-demand synchronization, which results in both systems becoming synchronized with regard to the given entry after a successful bind occurs against the LDAP store.
Case 3 can occur under normal circumstances, but most frequently occurs due to one of the following situations:
When the LDAP store possesses all the entries and Windows is waiting to be populated by Directory Server entries.
This situation requires the most attention to get the system into a synchronized state because existing entries in the LDAP store presumably have one-way, hashed passwords. When Identity Synchronization for Windows tries to migrate data to Windows, there are no usable values to push when propagating the user's password. In this case, Windows will request a password when a user logs in first time.
If multiple users' sign-on to your Windows environment without an effective password is not acceptable, you can address this issue by setting a password programmatically for each entry in question. After Identity Synchronization for Windows reports that the system is synchronizing, you can use LDAP operations to specify the generated passwords on the LDAP store side or the Windows side of your environment.
To complete this process, you must specify a must-change password policy after the user's next log on. This policy facilitates the transformation of an end user's password from an openly known value to a secretly known value.
When an end user changes their password on the LDAP store side and the Identity Synchronization for Windows system is propagating the change through the system (either actively or by scheduling the work).
In this situation, the information on Windows remains stale for just a short time. The Identity Synchronization for Windows components have captured all of the information needed to bring the Windows system into a synchronized state. Identity Synchronization for Windows takes the time only to process the information and then the entry will be synchronized.
This case is a contradiction. If both systems are stale, then how can you ascertain which system contains the authoritative information? Human intervention will be required in this case, and you must decide where to place the true state of an entry into one of the three, previously mentioned cases.
This situation can lead you into a very tedious process as you may be required to examine every user entry
For example, moving the entry from your LDAP store creates Case 3. If you created an new user called George Washington on a Solaris PAM machine, and then use the idsync resync command to push the entry to Windows, you can verify that Identity Synchronization for Windows has also created the entry on Windows in the following section.
From the Windows Start menu, go to Control Panel -> Administrative Tools -> Active Directory User and Computers.
When the Active Directory User and Computers window is displayed, go the Active Directory Users pane (on the right) and select Users.
Right-click the George Washington entry and select Properties from the pop-up menu.
When the George Washington Properties dialog box is displayed, check the Account options section and you can see that the User must change password at next logon check box is enabled, which means George Washington will be required to change his password the next time he logs on.
If you log in as George Washington, you can see that Windows is correctly tracking the entry because the log-in attempt displays the Logon Message dialog box stating, "Your password has expired and must be changed."
Click OK to close the Logon Message dialog box and to display the Change Password dialog box to provide a new password.
Enter and confirm a new password, but do not provide a value for the Old Password field.
This is first time the user has logged on (since being created over protocol), so supplying an old password value will cause an error message and Windows will ask you to enter the new password again.
Click OK to save the new password and close the Change Password dialog box.
If Windows accepts the new password, a message is displayed stating that the new password has been accepted.
At this point, George Washington's entry has moved from Case 3 (where the Windows entry is stale and the LDAP store is current) to Case 2 (where Windows is current and the LDAP store entry is stale).
George Washington's entry will maintain this condition until the next time he binds to the LDAP store. At that time, the entry will move to the Case 1 (where the entry is current on both Windows and the LDAP store).
This appendix does not include the procedure for configuring systems so that communication between systems is always conducted securely to prevent eavesdropping.
Some of the required configuration changes are addressed when you configure Identity Synchronization for Windows. For example, on Windows (for Windows 2000 or later), the Windows's password policies require that all password changes must be made using secured methods. Consequently, simply configuring the system partially addresses the security requirement.
However, it is still possible for eavesdroppers to see the bind attempts when Identity Synchronization for Windows components replay bind credentials. To address this issue, you must configure Identity Synchronization for Windows to communicate securely with its Windows data source by configuring the Identity Synchronization for Windows Connectors to trust certificates offered by the Windows' Active Directory system.
In addition, you must ensure that all clients authenticating to the LDAP store do so over TLS. For PAM clients, you must configure them to trust the LDAP store and ensure that idsconfig specifies TLS:pam_ldap:simple as the only authentication method for the LDAP store.
The root accounts cannot use the passwd command arbitrarily to change an user's password on PAM client hosts. You might consider this restriction to be a limitation, it depends on whether you trust the PAM client administrators or not.
Previously in this appendix, it was stated that the term Windows referred to Windows platforms using Active Directory for authentication. However, the system being discussed in this appendix can use Windows NT in place of (or along with) newer variations of Windows.
Be aware however, Windows NT lacks the ability to use on-demand synchronization normally provided by Identity Synchronization for Windows.
The Identity Synchronization for Windows' on-demand synchronization process must be able to bind to Windows over LDAP, with a set of candidate credentials — an ability that the Windows NT authentication system lacks. When Identity Synchronization for Windows environments are configured with Windows NT they expect password changes to be captured at their source and at the time the change is made. This capture requirement has ramifications when you initially bring up an Identity Synchronization for Windows environment. Specifically, the Identity Synchronization for Windows system needs to see a password change for any entry before the entry is actually synchronized.
Synchronization in an NT environment is similar to the proceeding steps described in Case 3, where you can modify the passwords of all entries in the LDAP store using an LDAP-based utility. As these modifications go through the LDAP store system, Identity Synchronization for Windows forwards the captured passwords to the Windows NT system, and then neither of the two systems would contain stale passwords. However, because you created the passwords by deterministic means, it may be easy to guess these passwords.
With this technique, you can limit potential damage if you use Windows NT's password policy administration to force all users to change their password at their next logon. As each user changes their password, the Identity Synchronization for Windows password DLL installed on the Primary Domain Controller will forward the password change to the LDAP store.
The following /etc/pam.conf file is provided to help you configure and run Identity Synchronization for Windows and PAM.
This /etc/pam.conf file is only an example.
The file's configuration is not appropriate for all situations. Analyze the content thoroughly before using it in a production environment.
# #ident "@(#)pam.conf 1.20 02/01/23 SMI" # # Copyright 1996-2006 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # PAM configuration # # Unless explicitly defined, all services use the modules # defined in the "other" section. # # Modules are defined with relative pathnames, i.e., they are # relative to /usr/lib/security/$ISA. Absolute path names, as # present in this file in previous releases are still acceptable. # # Authentication management # # login service (explicit because of pam_dial_auth) # login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_dial_auth.so.1 login auth binding pam_unix_auth.so.1 server_policy login auth required pam_ldap.so.1 use_first_pass # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth binding pam_unix_auth.so.1 server_policy rlogin auth required pam_ldap.so.1 use_first_pass # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth binding pam_unix_auth.so.1 server_policy rsh auth required pam_ldap.so.1 use_first_pass # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth required pam_ldap.so.1 use_first_pass # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authenctication # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth binding pam_unix_auth.so.1 server_policy other auth required pam_ldap.so.1 use_first_pass # # passwd command (explicit because of a different authentication module) # passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth required pam_ldap.so.1 use_first_pass # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_projects.so.1 cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy # # Support for Kerberos V5 authentication (uncomment to use Kerberos) # #rlogin auth optional pam_krb5.so.1 try_first_pass #login auth optional pam_krb5.so.1 try_first_pass #other auth optional pam_krb5.so.1 try_first_pass #cron account optional pam_krb5.so.1 #other account optional pam_krb5.so.1 #other session optional pam_krb5.so.1 #other password optional pam_krb5.so.1 try_first_pass

subset: commoncrawl


text:
Code Orange Design
No reviews for this business Add a review
- (08) 9284 ####
248 Stirling HwyMap
Claremont WA 6010Click to view map
About Us
Claremont based Code Orange Design are Galleries offering a range of products and services including galleries suppliers and gallery supplies. If you need clarification or wish to understand what we can also do with dobell or private galleries or other products or services then contact us for more information or call to discuss your requirements.
View similar businesses near: Claremont WA
There are no reviews for this business
All Art & Mirrors Installation Services
"We hired All Art &Mirrors to help us with the arrangement and installation of our valuable collection of original artworks, prints, family photos, aboriginal art, framed tapestry, war memorabilia and decorative mirrors. We would like to sincerely thank Alessandro and his team for achieving great results so efficiently. True marks of professionalism!!!
Mari & Paul"
Auscape Prints
"I have lived and worked in the Pilbara for the last 10 years. I am very passionate about the colours of the Pilbara and Bernice captures those colours beautifully in her photos."
Mari Lemes on 20th May 2016
harsp on 2nd May 2010


text:
"You wouldn't believe how desperate Democrats are for a mission."
"You wouldn't believe how desperate Democrats are for a mission."
-Bruce Reed, president of the centrist Democratic Leadership Council -- March 22, 2006
That's what the Democrat leadership has to say about their plan for the future, that is their lack of a plan for the future.
Mr. Reed is co-author of a new book, with Congressman Rahm Emanuel, called "The Plan", which will lay out their Party's plan for the future. The book is due out by Labor Day, it is so far from hitting book shelves that you can't even buy it on Amazon yet.
There are a slew of books coming out from Democrats all promising a plan for the future, at KRP we can't wait to find out what the long awaited plan is.
Want us to know about it?


text:
"Stone Animals" by Kelly Link
"Stone Animals" both employs and parodies the basic elements of suburban psychological realism, the sort of scaffolding John Cheever and so many other writers hung their words and laundry on: a family buying a house and moving into it, a father commuting to a desultory job in the city, a pregnant wife who is uncertain about her marriage, suspicions and allegations of adultery, existentially anxious children, a controlling boss, stressful dinner parties, a lawn.
The details, though, explode it all:
"So what's the house like?" said Henry's boss. She was carefully stretching rubber bands around her rubber-band ball. By now the rubber-band ball was so big she had to get special extra-large rubber bands from the art department. She claimed it helped her think. She had tried knitting for a while, but it turned out that knitting was too utilitarian, too feminine. Making an enormous ball out of rubber bands struck the right note. It was something a man might do.Throughout the story, characters try to find their place, try to align themselves to gender roles and family roles, to job and life, to The Way It's Supposed To Be. But nothing lines up. Nothing can be expected, predicted, prophesied, or counted on. A hundred rabbits appear on the lawn: come to claim their place, or sit in judgment or witness, or steal the children, or sink the house by undermining it with burrows of absurdity. The house is haunted, but not by ghosts, unless it's the ghost of a Brechtian furniture maker, because the haunting here is alienating, a verfremdungseffekt poltergeist that makes belongings no longer belong and strips fetishes of their commodities:
"What's wrong with the TV?"The world of the story is a world of binaries, a world falling apart for lack of grey areas. Catherine and Henry's daughter Tilly divides the yard in half, with one side for herself and one side for her brother, Carleton. She likes to name things and "when the new baby is born, her mother has promised that she can help pick out the real names, although there will only be two real names, a first one and a middle. Tilly doesn't understand why there can only be two." Similarly, everyone seems conscious of what is "male" and what is "female", though there are cracks in the borders -- a group of women get together, for instance, to discuss the quintessentially "male" novel Fight Club. Eventually, everything may fall apart, and the binaries will not hold. Work and home, city and country, husband and wife, daughter and son, boss and worker, awake and asleep, reality and dream, there and not-there; all of it is getting confused. The children can't inherit their parents' patterns, so they start talking to the rabbits. Life just wants to be interstitial. (Is it any wonder that some of the women in the story yearn to write books? As if the borders they desire to cross are ones that can be breached with words.)
"I don't know," Catherine said. "It's working fine. But the kids won't go near it. Isn't that great? It's the same thing as the toothbrush. You'll see when you get home. I mean, it's not just the kids. I was watching the news earlier, and then I had to turn it off. It wasn't the news. It was the TV."
"So it's the downstairs bathroom and the coffee maker and Carleton's toothbrush and now the TV?"
"There's some other stuff as well, since this morning. Your office, apparently. Everything in it -- your desk, your bookshelves, your chair, even the paper clips."
"That's probably a good thing, right? I mean, that way they'll stay out of there."
"I guess," Catherine said. "The thing is, I went in and stood in there for a while and it gave me the creeps, too. So now I can't pick up e-mail. And I had to throw out more soap. And King Spanky doesn't love the alarm clock anymore. He won't come out from under the bed when I set it off."
Tilly, like Alice before her, finds a door with a rabbit behind it, and follows it down some steps to a wonderland unrevealed to us, crying out "Hairbrush! Zeppelin! Torpedo! Marmalade!", perhaps in a desperate cling to vestiges of childhood and innocence, as if nothing will open Sesame Street. Meanwhile, Carleton won't stop attacking the rabbits with a stick. Catherine, like a woman of royalty, or perhaps Mrs. Dalloway, prepares for a dinner party, one to which Henry will, of course, be late. The binaries are breaking apart. The mother seeks solace in pregnant pauses of sociability, the daughter disappears, the son perpetuates pointless violence. Meanwhile, the father comes home to discover himself locked out of his life, so he rallies the rabbit around him and discovers "the others" are waiting with him for the dinner party to end, and for Henry, who wields a phallic spear and rides a fertility symbol, to bounce into the Agincourt that came with the house, . Except we don't know who "the others" are, and we don't know if this is Henry V or Henry VIII.
Summarizing a story as rich, allusive, and ambiguous as "Stone Animals" is always an effort against inevitable nonsense (or, at best, cleverness, which some people may not find preferable to nonsense). The only durable representation of the story is the story itself.
I can't resist praising one other element of the story, though: it's use of point of view. The narrator is essentially omniscient, roving from person to person, perspective to perspective, like Tolstoy or Slacker. Form undermines content: the world of the story may be struggling against binaries, but the narrative itself is a web of singularities, with the whole greater than its parts, because we, the readers, locked in our own singular minds, make the connections, provide the unity, and sense the harmony. While the story may be profoundly unsettling, and the fates of the individual characters may not be happily-ever-after, the ultimate result is optimistic, because we have no obligation to accept the limits of a binary world.


text:
(→Documentation by Example)
|Line 43:
|Line 43:
Error: Nothing to do
Error: Nothing to do
[root@fc17 ~]#
[root@fc17 ~]#
Revision as of 12:08, 2 February 2013
Documentation by Example
Forgive my potential ignorance here - but perhapas the documentation needs to be approaced from the point of view of guiding the first time user: Imagine, if you will - I have just installed my first copy of Fedora. I install a network service. I find it doesn't work. I find it has a firewall. I find it has firewalld. I come here to see how to allow my service. I spend 30 minutes reading and am no closer to an answer. I even sign up to come post here. Most experienced sysadmins would have uninstalled and chucked away firewalld by now. I, have, however, not.
My point is this: It is paramount to have documentation by example. Long tedious explanations of how things work and why is meaningless. Most people just need a list of examples, find the right example - and use it. Or have the whole process automated in the first place.
If I could find the answer, I would post it here. But I haven't. Perhaps theres a forum somewhere where I can go become part of a community and get this to work. But I don't have the time or patience for that right now - a pity, yes.
I can't find a way to configure this firewall. In short, I want to add Synergys support: iptables -I INPUT -p tcp --dport 24800 -j ACCEPT
Here are my attempts:
706 yum install system-config-firewall 707 system-config-firewall 708 yum install firewall-config 710 yum remove system-config-firewall 711 firewall-cmd 712 firewall-cmd STATUS 713 firewall-cmd --state 714 firewall-cmd --port=24800/tcp --service=synergys 715 firewall-cmd --passthrough --port=24800/tcp --service=synergys 717 firewall-cmd --state 718 firewall-cmd --query 719 firewall-cmd --disable 720 firewall-cmd --panic 721 man firewall-cmd 722 history | grep firew
No help whatsoever. So I just run the iptables command - but how long will it work? Do it put it in rc.d? ...
What have I learnt: Yes, s-c-firewall is incompatible with firewalld. firewall-config doesnt exist. Can't find it. --service commandline option isn't a comment field.
[root@fc17 ~]# yum install firewalld-config Loaded plugins: langpacks, presto, refresh-packagekit No package firewalld-config available. Error: Nothing to do [root@fc17 ~]# yum install firewall-config Loaded plugins: langpacks, presto, refresh-packagekit No package firewall-config available. Error: Nothing to do [root@fc17 ~]#
- I fully agree with above. We just had a debate about this in irc. How this page hops directly into details without describing what zones are, how those are related to services and interfaces and how those should be used. After skimming this page through I still don't know and thus cannot apply the details from this page when don't have the big-picture what I'm doing. Same with the provided GUI, it just lists those but zone-concept still remains unclear. That with security is not a very good starting point. Note that I maintain multiple iptables based systems and have history from Cisco, Enterasys, CheckPoint FW1, Stonesoft firewall and many other network security systems. I would change that main article myself if I knew what I would be writing. But I don't, so I wont. Pushing this into production release without introducting people into it wasn't that smart after all. Tuju (talk) 12:08, 2 February 2013 (UTC)


text:
The nature of gardening today is much different than it was a generation ago. More households have two working parents who have less time and inclination to prune regularly and pull every errant weed. Money is tighter, too, not only for most households but for most municipalities.
Homeowners can't spend a lot on chemical fertilizers and herbicides or new trees and shrubs. Likewise, local and state governments can't devote much money or time to maintaining parks and natural areas.
Rick Darke doesn't see anything bleak in this picture; rather he chooses to focus on the opportunities that exist in contemporary gardening.
"There has never been a more interesting or exciting time to be involved in the design of outdoor spaces," says Darke, a University of Delaware alumnus who heads a Pennsylvania-based landscape consulting firm. His books include The American Woodland Garden and The Wild Garden: Expanded Edition.
"There has been a sea change in how we approach our green spaces," adds Darke. "This new trend embraces the dynamic nature of living landscapes and identifies conservation, functionality and viability as primary goals."
Darke will talk about "Design for the Nature of Today's Garden" on Tuesday, April 10, at UD's Townsend Hall. Sponsored by the UD Botanic Gardens, the lecture is a kick-off event for the gardens' spring plant sale, which is open to the public April 27-28.
Darke, who with his wife, Melinda Zoehrer, gardens on 1.5 acres in Landenberg, Pa., points to his own yard to illustrate how his approach to landscape design and stewardship has evolved over the years.
For example, he has become better at choosing the "right plant for the right place." A dozen or so years ago, he planted native sweet bay magnolias in his back yard, which adjoins the White Clay Creek Preserve. Deer from the preserve quickly discovered these magnolias and rubbed the fragrant bark to the point that the trees wouldn't have survived another season. Darke transplanted the magnolias to the front yard, which the deer tend to avoid. Although he solved his problem, he wasted valuable time.
"Melinda and I are busy with work, travel and socializing," says Darke. "We don't have endless time to devote to the garden."
These days, he carefully considers site selection. A smart choice, in his opinion, was a stand of tall, warm-season grasses that he placed on the edge of the property. The grasses serve as a privacy screen while also providing habitat for wildlife.
To save both time and money, Darke lets the wind, water, birds and animals dictate — through seed dispersal — what new plants get added to his yard. He still buys plants but more often he enjoys these seedlings that arrive spontaneously.
"We have a group of nearly 30-foot-tall beeches that originated as seedlings 13 or 14 years ago," notes Darke. "People don't realize how fast a seedling can grow. In six years, a beech seedling can become a 12-foot-tall tree."
Of course, you might not be thrilled with where the wind dropped your new beech tree — perhaps it's growing between flagstone pavers or in front of your prized red-twig dogwood. That's where judicious editing comes in, notes Darke. Feel free to transplant seedlings to different locations in your yard and to give away excess seedlings.
In the Darke and Zoehrer yard, the long list of "free plants" acquired by seed dispersal or self-seeding and sporing include viburnum, beech, sassafras, oaks, silver bells, spicebush, asters, ferns and dogwood.
The economic benefits of utilizing existing vegetation are even greater on large tracts of land. Currently, Darke is consulting on a project that will convert a Pittsburgh brownfield and abandoned steel mill, Carrie Furnace, into a mixed-use residential and commercial development.
"This 400-acre property has thousands of self-sown native sycamores and cottonwood," notes Darke. "Any one of these 20- to 50-foot trees would cost more than $1,000 to buy. The most environmental approach is to allow these trees and other existing plants to form the backbone of the site's new landscape."
UD Botanic Gardens lecture
Darke's lecture will be held at 7 p.m. on Tuesday, April 10. The cost is $15 for the public, $10 for members of the UD Botanic Gardens. For more info go to the UD Botanic Gardens website or call 831-0153.
Article by Margo McDonough
Photos by Rick Darke
This article can also be viewed on UDaily


text:
Win handtied jigs tied by some of our outstanding members.
We will have five winners this month, each one will receive
a dozen handtied jigs.
See Contest section for details.
Not a member? Then join up so you can join in the fun and win!
|Subject / Started by
|Replies / Views
|Last post
|0 Members and 1 Guest are viewing this board.
Now 100% Full
Started by Ed
0 Replies
1034 Views
May 09, 2015, 12:51:00 PM
by Ed
Normal Topic
Hot Topic (More than 15 replies)
Very Hot Topic (More than 25 replies)
Locked Topic
Sticky Topic


text:
About Levanto
Levanto is a larger and more exciting town than the Cinque Terre villages and is a better base for travelers. You can easily drive in and out of Levanto and you are connected to the Cinque Terre villages by train. You can also get to many other Ligurian towns by train.
In Levanto there are more than fifteen high quality restaurants and many shops. Our piazza has a weekly open air market attended by people from far and near. The population of Levanto is about 5,000. As there are only a few hundred rooms available to tourists, Levanto never loses its charm and intimacy, no matter when you choose to visit.
Levanto offers castles, public gardens, and incredible architecture. Historic churches ring their bells to signal the time of day.
There are many outdoor activities available: tennis, scuba diving, surfing, bike rentals, paddle boats. Levanto has sandy beaches and a swimming pool (that overlooks the Mediterranean for sun worshipers). You can go walking or hiking into our magnificent mountains right from the town.
With all that to offer, Levanto still moves slowly and few people are ever in a rush here. It is a charming and fun location for your vacation.
The Cinque Terre


text:
9:30 pm
Lidia's Italy In America "Eastern Seaboard: A Shell of a Good Time" NULL
10:00 pm
Cook's Country from America's Test Kitchen "Fried Chicken and Biscuits" Chris and Bridget visit Princes in Nashville to try their famous Nashville Hot Chicken. They return to the kitchen determined to replicate the top-secret recipe. Then, Jack challenges Chris to a tasting of whole kosher dill pickles. D
10:30 pm
Great American Seafood Cook--Off II Fires blazed and seafood sizzled as New Orleans hosted the sixth annual Great American Seafood Cook-Off in July 2009. During the Iron Chef-style competition, chefs representing 15 states, including coastal Mississippi, Maine and California, as well as Illinois, West Virginia, Kentucky and Idaho, created dishes using seafood from their home state or from local sustainable fisheries. THE GREAT AMERICAN SEAFOOD COOK-OFF contains highlights from this one-day event. D
11:00 pm
Caprial and John's Kitchen: Cooking for Family and Friends "Farmers' Market" Caprial and John bring home treasures from local growers. They showcase their finds in fresh crab cocktail with roasted pepper coulis.G
11:30 pm
Rick Steves' Europe "Basque Country" Rick visits the proud and resilient Basque people's homeland, which is split between France and Spain. From his base in San Sebastian, Rick tours the ancient Basque capital of Gernika, the dazzling Guggenheim Modern in Bilbao, and then crosses into France for more Basque Country charms. From tapa bars to lightning-fast jai alai games, he shares the experiences of Basque culture.G


text:
Thanks to Baz Luhrmann's new movie, readers everywhere are taking a second look at "The Great Gatsby." That includes the Connecticut prison where I conduct a class in literature.
Of course my student-inmates had their own unique take on the book – and it was a view much more pragmatic than romantic.
The character they felt influenced Gatsby the most? Not Daisy Buchanan. She was dismissed as too obvious or too trivial. Instead they favored a character who surfaces only briefly: the gambler and unrefined "reminiscencer" Meyer Wolfsheim.
My students admired Wolfsheim, the character who unabashedly sports "cuff-buttons" made from "the finest specimens of human molars"; a man who resembles a "real life" racketeer, mobster, and high-roller; the figure who fixed the 1919 World Series and undermined the national pastime, so he "could play with the faith of fifty million people, with the single-mindedness of a burglar blowing a safe," and who "saw the opportunity" and was so smart that he was never jailed for the fix.
And while my students gave Wolfsheim his "props," they also allocated some admiration to Gatsby. But what they felt mostly was envy mixed with incredulity – and disdain for his devotion to Daisy. ("Get over it, Slick. Move on, fellow.")
Scholars of the suspicious and the shady, post-graduates in sharp practice and "persuasion," my students took inventory of Gatsby's "rides," his Prince Charming shirts, the draw and excesses of his "shambanginos" – and then, of course, his "crib."
The question that we came back to again and again was: "What made Gatsby great?" Was it the "wheels," the clothes, the parties, the mansion? The extravagance? The aspirations?
The answer, I suggested, comes toward the end of the book via Henry C. Gatz – Jay Gatsby's father.
I've looked up a number of reviews that were published when the book first appeared in May and June of 1925. Henry C. Gatz isn't mentioned at all. And yet he does provide the single bit of documentary evidence of what made Gatsby Gatsby.
We first learn of – and meet – Henry C. Gatz toward the end of the book. He is "a solemn old man" who is genuinely saddened by his son's death but who can't help but marvel at the splendor of his son's life: "His eyes leaked continuously with excitement...."
Fitzgerald describes Gatz's sad pleasure as he takes in (for the first time) his son's acquisitions and surroundings: Gatz "had reached an age where death no longer has the quality of ghastly surprise, and when he looked around him ... and saw the height and splendor of the hall and the great rooms opening out from it into other rooms, his grief began to be mixed with an awed pride."
Gatz sees the splendor as the emblems of a station realized, a life (seemingly) fulfilled. If Jay Gatsby (the former Jimmy Gatz) had lived, he would have become an industrialist, a magnate, a mogul of wide renown and stature. Gatz believes his son would have helped "build up the country." Maybe. Maybe not.
To some extent, my students overlaid their aspirations onto Gatsby's romantic longings, his preoccupations – his obsession and bad judgment. He hadn't been done in by the kinds of bad "bets" that had them doing time. But Gatsby had been done in by mistaken identity. In a way, he had been wrongly accused and unfairly condemned for a crime he didn't commit. The students found that "conviction" to be something that they could understand.
But prior to that "sentencing," Gatsby had been able to close in on his dream. And so we wonder, how did he amass what he was able to amass? How was he able to pay for that waterside mansion and the best cars, clothes, food, and entertainment? By ill-gotten gains? By swindling?
My students acknowledged that for all his generosity, Gatsby was far from virtuous. He was no moral Mahatma. He wasn't among the ethical elite. Here are the multiple-choice "cards" I dealt out to the inmate-students:
Jay Gatsby was great because –
a. he gave the grandest parties with the biggest orchestras, the best music, and the most extravagant fare.
b. he wore spiffy shoes, nifty jackets, and beautiful shirts; and drove a big roadster and lived in an awesome mansion furnished with expensive things and interesting people.
c. he was a man of mystery and power, and he knew how to use his power and mystery.
d. he was an incurable, obsessed, romantic.
e. because of the determination and discipline that he himself chronicled at the age of sixteen.
Closing in on the book's conclusion, we are provided with the answer. Just prior to his son's funeral, Gatz shows Nick "a ragged old copy" of a book ("Hopalong Cassidy") that his son had used to record his personal agenda. On a blank page at the end of the text, sixteen-year-old Jimmy Gatz had set out the game-plan for his transformation into Jay Gatsby, via this schedule:
Rise from bed ………………………….. 6:00 A.M.
Dumbbell exercise and wall-scaling …… 6:15 – 6:30
Study electricity, etc. …………………… 7:15 – 8:15
Work ……………………………………. 8:30 – 4:30
Baseball and sports ……………………… 4:30 – 5:00
Practice elocution, poise and how to attain it ………… 5:00 – 6:00
Study needed inventions ………………… 7:00 – 9:00
Right under this schedule, young Jimmy Gatz had set out his "general resolves": He resolves to no longer waste time at a place that might have been a saloon or a pool hall. He resolves to save at least three dollars every week. He's not going to smoke or chew tobacco. He will bathe every other day. And he will read one improving book or magazine per week and be better to his parents.
Would it have made a difference to my students – now sitting in their prison classroom – if they had read "The Great Gatsby" in their early teens?
A number of them said they were going to pass their copies of the book along to their sons and nephews.
Will 16-year-old Jimmy Gatz's schedule and his general resolves make a difference in their lives? Do you think that Wolfsheim would bet on it?
Joseph H. Cooper teaches ethics and media law at Quinnipiac University. His "Pauses and Moments" columns appear at PsychologyToday.com.


text:
Phil Robertson Says Something Offensive—But It's Not The Thing Everyone's Focusing On
Uhh, I'm confused. Everyone's making a huge stink over what Phil Robertson said about gays. But you know what I don't hear? An exhortation to return sodomy laws, or any comments on gay marriage, or the idea that he chooses to "hate" gays or endorses violence against them.
It's clear he considers homosexuality to be a sin, but I thought this quote was interesting:
"We never, ever judge someone on who's going to heaven, hell. That's the Almighty's job. We just love 'em, give 'em the good news about Jesus—whether they're homosexuals, drunks, terrorists. We let God sort 'em out later, you see what I'm saying?"
Granted, putting gays and terrorists into the same category is a bit offensive, especially to a drunk like myself!
But fundamentally, everything is couched in the desire to save people from—not to punish them for—their sinfulness.
No… Where Robertson goes *REALLY* off the rails is the quote which oddly nobody seems to be focusing on:
"I never, with my eyes, saw the mistreatment of any black person. Not once. Where we lived was all farmers. The blacks worked for the farmers. I hoed cotton with them. I'm with the blacks, because we're white trash. We're going across the field…. They're singing and happy. I never heard one of them, one black person, say, 'I tell you what: These doggone white people'—not a word!… Pre-entitlement, pre-welfare, you say: Were they happy? They were godly; they were happy; no one was singing the blues."
That shows an insensitivity and an ignorance that is a lot more disturbing. That remark is the one sweeping centuries of unequal treatment by the state under the rug.
As an atheist, I think Robertson is wrong about gays. But he seems to be wrong for reasons that any Christian should be wrong—if you truly care about your fellow man, you should be trying to save them from their wickedness. The basis of Christianity—original sin—declares that we are all wicked, all in need of saving. I don't think Robertson would ever claim that his life is so perfect that he doesn't need saving grace.
But the second statement is much more offensive IMHO. That's the one that tries to put a pretty face on centuries of racist discrimination, slavery, and Jim Crow. Yes, Phil, maybe blacks weren't constantly complaining (to you, the white guy) about their mistreatment. Yes, maybe they were seeking solace in God, as those facing tough times have done for millenia. Yes, maybe they tried to focus on the things they could control—their attitude, leading a rich life with family and friends—rather than what they can't control, i.e. the legal apparatus around them.
But that doesn't mean we should act like it didn't happen and it wasn't there. True godliness would be for Robertson to accept that those bad things happened in the past, to remember that Christianity is not a doctrine of separation and of discrimination, and to exhort society to ensure that such mistreatment of our fellow men should never happen again.


text:
The activities were done on two days as part of "USA Magazine Make A Difference Day," which originated in 1992, Fowler said. The magazine "created the day to encourage local groups, churches, civic clubs" to do a day of community service, he said.
The Gilmer church split its work into two days, because not all members involved could participate on one day, Fowler said.
On Oct. 27, about 50 members cleaned and cleared brush and debris from the park at Lake Gilmer, he said.
On Nov. 3, about 60 members painted, resealed, and repaired the wooden play structure at the city park in Ore City, and repainted stripes at the city hall's parking lot, Fowler said.
"They did a beautiful job for us." Describing the workers as the "nicest bunch of people you would meet anywhere," said Ore City Mayor Glenn Breazeale. The mayor said he was having his secretary write them a letter of appreciation.