Thoughts About Paint

Car paint is pretty tough stuff and readily stands up to the range of temperatures and humidities thrown at it by our British weather. The reason that paintwork needs maintenance is because it gets chipped, scratched, and defecated upon by birds (which, if you judge by the effects of their excrement, live on a diet of battery acid and paint strippper). Thus we need to repair damaged paintwork before rust takes a hold on the metal beneath.

Maintaining paintwork would be easy if we were happy to just rub off (note that any wax and dirt should be removed BEFORE you start with the abrasives) the damaged paint, and any rust, and blob on a couple of coats of paint. So why the hell are we so hung up on the idea that a car has to have a super-smooth, high-gloss, paint job that's a really pain in the ass to achieve and even harder to repair? Metallics are even more difficult to patch up, and even more popular!

Of course this is really good for the manufacturers because it means that most people simply won't bother, the car will rot, and the owner will be back to buy a shiny new one a heck of a lot sooner than if maintenance of old one had been easier. Given that maintainability is my number one priority with the ol' bug I'm determined not to go down that route. On the other hand, the rat look isn't to my taste either so I needed an alternative solution. Thus I began to consider things like camouflage and other patterns that would allow me to divide the surface a the car into smaller areas.

To be honest, the Beetle isn't that difficult to divide into small areas. All four wings can be unbolted. Hood, decklid and doors can all be removed or treated seperately. However, as I don't have a garage or suitable shed in which to paint panels and will have to work outside, dealing with areas of this size would still be very difficult. It's also the case that no matter how hard you try to match them, newly painted panels tend to look different to the others.

Having considered lot's of different patterns I've decided upon a cubist inspired (check out Picasso's analytical cubist works) pattern of rectangles and shapes in shades of pinky blue. Here's a mock up that I did on the computer:



I intend to apply the paint with a brush because it will be easier to get the effect that I want and using a variety of shades means that I won't be tied to any particular colour that may prove difficult and/or expensive to obtain at a later date.

Note that the patterns will not hide the shape of the car as much as they do in the mock-up because they'll be following the curves of the surface. I'll also be doing the painting a bit at a time, so the pattern will gradually spread accross the car, rather than trying to do it all at one.

Having come up with a plan for the outside/top of the car, I also needed a plan for the rest and in fact it's the other areas that are more prone to rust. While water runs off the exterior of the car it can get into cavities and get's held onto the underside of the car in a mud poultice. When rust does begin to form, the porous nature of the rust means that it holds moisture thus furthering to rot. Clearly this is something I want to prevent.

Weld-Thru Primer

The first thing I've done is to buy a can of Weld-Thru Zinc Rich Primer Aerosol from Frost and I'll be applying this to all cleaned up metal that I intend to weld.

Hammerite

The next thing is that I've bought tins of smooth black and smooth silver Hammerite paint for use on underbody areas including wheel arches and steering/suspension components. I'll may also be use some other colours under and inside the car before I install carpet and such.

Now I've heard a lot of criticism of Hammerite but it strikes me that most of the problems are caused because people don't use it correctly. Many years ago I used it on with a wrought iron gate and was disappointed to find that the gate started to rust again a couple of months later. It was only afterwards that I realised just how many mistakes I'd made:

Firstly, I cleaned the loose rust off the workpiece. But more than that, I'd cleaned it back to bright shiny metal. I had failed to realised that Hammerite paint is designed to bond to rust. If you're painting bright shiny metal, you should be be using Hammerite Anti-Rust Primer and not the 'normal' Hammerite paint.

Then I shook the tin. This was also a mistake because it introduces air which takes a long time to come out of something as thick as Hammerite. Hammerite, unlike Mr Bond's martinis, should be stirred and NOT shaken.

Then I set about painting by dipping my brush into the tin. Wrong again as this will contaminate the paint in the can as you move the brush from workpiece to can. What you should do is to pour the paint you intend to use into another container and if there is any left over it should be discarded and NOT returned to the tin.

Then I left it to dry overnight and applied a second coat the following day. It seems I really was determined to screw this up because, for it to do it's job, you MUST apply a second coat of Hammerite within four hours of the first such that it does all the chemical bond stuff that it needs to do in order to work. Leave it for more than four hours you're just wasting your time because the second coat won't 'react' with the first coat.

As I say, I've seen a lot of criticism of Hammerite, and the critics generally advocate alternative products that are harder to find and are generally somewhat more expensive. Having done a bit of research, I'm inclined to believe that the main reason that people have any more success with these 'more exotic' products is that they read the instructions and follow them whereas they assume they can use Hammerite like ordinary paint. Hammerite is NOT like ordinary paint and if you treat as such, you will fail to achieve the desired result.

Note that I've chosen to go for the smooth finished stuff (as opposed to the hammered effect) because I want to be able to inspect it for damage on a regular basis and it'll be easier to spot stone chips and the like on a smooth finish.

Dinitrol

While Hammerite should protect the areas where I can apply it with a brush, spraying it into cavities seems a bit hit and miss. On the other hand, products like Waxoyl and Dinitrol are designed for the purpose. These products can also be use to apply a waxy coating the underside of the car.

Bitumen based products are another option for 'undersealing' however the are frowned upon in car restoration circles. In this case I am inclined to agree as it seems that the problem with the bitument based products is that they tend to harden with age and that when they get damaged, water gets behind them, and the metal rots away out of sight behind the coating. Of course the only way to check for this would be by scraping the stuff off, and of course removing something to see whether it's still doing it's job properly is undesireable.

It strikes me that the same is true for the wax based products, many of which are brown or black. How are you supposed to tell if that uneven black/brown surface is still doing it's job or hiding rot? Thus my plan is not to use underbody seal but to paint these areas with Hammerite which I can then inspect and maintain. It has been suggested that I could use 'clear' Waxoyl however I am told that this is really a light brown/yellow colour as opposed to clear and it also presents the additional problem of having to clean it off in order to replain any damage that does go through to the paint. Better methinks to forget it and concentrate on maintaining the paint.

Of course the cavities are a different kettle of fish because I can't see inside heater channels and other seriously enclosed spaces to inspect/maintain them. Thus I figure that the colour of the protective wax is insignificant in these areas. The blurb in the Frost catalogue about Dinitrol Corromax 3125 says "A specially forumulated wax which penetrates rust and dirt preventing further corrosion." That sounds like just the ticket to me, even if it is brown.

Hot Spots

The final consideration is that there are a few places where special paints are needed. Exhausts and engine blocks need paint that will stand the heat and while I have no immediate plans to paint the engine block I do need to do something about the rust on my exhaust pipework. I've also obtained (from Frost) some special paint for painting brake calipers and drums.

Having formulated a plan, all I need to do now, is to get painting.

Urethane Parts for Beetles

Progress with the Beetle is slow but everybody warned me that I'd discover more problems than I could see initially and that it'd take longer than I'd anticipated to do the work; so while the nature of the extra problems and work is a surprise, the discover of it isn't. I'll say more about that in another post (it's about time I posted a progress report) because in this post I wanted to say something about urethane parts.

I'd seen them on sale in a number of places and was tempted by their pretty red colour. Of course I wasn't about go changing everything just because of the colour but when one of the rear bump stops broke off in my hand, such that new brackets and 'rubbers' were added to my shopping list, I thought I might give them a try.

Before diving in however I did a search on the VZi forum and was surprised to see that hardly anybody had a good word for urethane. I started a new thread to try to get to the bottom of it (click here) and based on this, plus a little reading elsewhere, I came to the following conclusions:

Most of the urethane parts for Beetles are for use in places where they will be flexed and/or squashed (as opposed to having mechanical movement against them). These inclide bump stops, suspension bushings and gearbox mounts. My research indicates that urethane parts are harder than their rubber equivalents so while they will hold a gearbox more firmly, they will also transmit more vibration into the car. This seems even more counter productive in the case of bump stops and suspension components where they will transmit more vibration, and shocks in the case of bump stops, to the metal components they are supposed to be cushioning. I've been lead to understand that this has benefits in off-road vehicles like dune buggies (where you're expecting a rough ride anyway) because they will last longer. It would appear however that the additional life of the component is little compensation for the loss of ride comfort and protention of other parts in a road car.

There is one major deviation from the flex/squash use of urethane parts in a Beetle and that is in the form of urethane bushings for the front beam where they are used as replacements for the original metal roller bearings and rubber seals. It seems however that they have only one advantage over the original parts: they're cheaper. They will (apparently) wear out much faster and the only argument that I've seen that held any water was that if you're using them in an off road car where you might anticipate knackering and having to replace bearings on a regular basis because of the way you are using the car as opposed to through normal wear and tear...

Thus I will be replacing my bump stops, and any other relevant bits, with rubber as I've concluded that while urethane parts might be of use on an off road vehicle or one whose primary purpose is to look pretty, they have no place on a road car intended for daily use.

Tightening Security on SSH & Webmin

I haven't finished moving everything over to my new servers yet however I am getting a few opportunities to look into new things and today I made a couple of changes to tighten up security.

In the greater scheme of things I'm not what you'd consider to be a prime target. I'm not mega-corp and I doubt there's anybody out there who hates my guts or wants to get into my systems in the hope of finding secrets. On the other hand, the fact that I am small-fry implies that I probably won't have paid too much attention to security issues and may be an easy target for being turned into a spam relay or similar i.e. the attraction of my server to a cracker is not what they might find on it, but what they might be able to use it for if they can get in.

A few days ago for example I awoke to a Logwatch report that telling me that another server at the farm where mine lives had made 400+ attempts to log into my server using SSH. I emailed tech support and got a reply about 15 minutes later saying that they'd checked it, shut it down, and emailed the owner. Now it's hardly likely that the owner of that server had instigated the attack, however they would be left with the big pain in the ass problem of finding out how their server was hacked and dealing with it. Obviously I want to do everything I reasonably can to make sure the same thing doesn't happen to me.

I am fortunate (by design) that I'm the only person who needs to log into my server. Thus I don't need to worry about other users having inadequate passwords or installing problematic scripts/programs. I have a firewall, and have shut down any services that I don't use (like telnet and ftp), so you might think I'd be happy to sit back an relax. However, as I am the only person who needs to use SSH or Webmin, (pretty powerful tools), I figuered that there were probably a few ways that I could make it harder for anybody to abuse them.

The most important line of defence is of course to have good passwords and if you don't know what I mean by 'good passwords', you need to do some research. If you are 99% sure that you do know: that's not good enough and you still need to do some research. If you are 100% sure then you are being way too arrogant and you still ought to do some research. The things is that this stuff changes and what we thought was a good password 10 years ago is mediocre by today's standards because the knowledge and tools available to the crackers is more powerful. Unless you did it just last week, do a search and read half a dozen current documents about passwords. If you find anything in any of them that you didn't know, read half a dozen more. My own current thinking on the subject can be found here.

Starting with SSH then:

It's fairly normal for my Logwatch reports to show a few hundred (occasionally a few thousand) failed attempts to log in via SSH. These are generally split between a dozen or so IP address (that change on a daily basis so there's little point trying to block the addresses), and several dozen common names. Amongst all the toms, dicks and harrys who don't even exist on my server (but are fairly common user names generally) there are also a good number of attempts to log in as apache, root, mysql, and other names that are pretty much always present on any LAMP server.

A fairly simple but substantial increase in security therefore is to create a user with a really weird name (that looks like a password), give them an equally cryptic password, and make them the only user with access to SSH. While brute force attempts to log in via SSH will regularly try lists of common names, they are highly unlikely to try 'random' collections of characters. You've now made it just as hard for someone to guess a user name as it is for them to guess a password. Of course this also means that when you log in via SSH you have to use the weird user name and su to root before you can do anything. A small price to pay and it also means of course that anybody who did guess your weird username and the weird password now needs to guess your root password too. That's "something blooming difficult" three times in a row and probably equates to something pretty near to impossible.

Of course that doesn't stop the failed attempts from bloating my Logwatch reports (something I'm looking into and will report on later) but it does mean that I can safely ignore them.

Having now made SHH a heck of a lot more secure, my other concern was Webmin. Again, I'm the only person who needs to use it but when I do I go in as root so there's 'only' a password between me any somebody else getting in there.

I did some searching and found this document (amongst others) that had some interesting information about securing Webmin. My setup was already doing things like using it with SSL however I did opt to go into Webmin: Webmin Configuration: Authentication and change the number of failed logins required before a host is blocked and the time for which it is blocked. These were set at 5 and 60 seconds but I reckon anybody who gets their password wrong five times in a row shouldn't be allowed anywhere near a server in the first place. As we're blocking IP addresses (as opposed to users) however we don't want an attacker who's accessing the server via somewhere like Tiscali or AOL causing an IP address that's been temporarily allocated from a pool being blocked for long periods of time either. As I'm the only one who should be using Webmin on my server I changed the values to 2 and 600.