thinking sysadmin

qstat -u aleonard -s z

One More Useful Tool: f.lux

leave a comment

Following on to my previous post about ack and autojump, one more new-to-me tool that I’ve become quite fond of is f.lux. When you find yourself passing up your dual-core hot-rod workstation for your underpowered netbook solely because the netbook has f.lux installed, take it as a sign that the creators of f.lux are on to something.

From the f.lux website: “f.lux makes your computer screen look like the room you’re in, all the time. When the sun sets, it makes your computer look like your indoor lights. In the morning, it makes things look like sunlight again.” For me, the decrease in eye strain is palpable; at night, picking up a mobile phone or even looking at a TV after using a machine with f.lux installed is painful. (Obviously, if you need accurate color representation, you can’t have f.lux on; thankfully, temporarily disabling it is a breeze.)

There are are Windows, OS X and Linux versions available; installation on Ubuntu is made easy through a PPA. Here’s a little Puppet module for Ubuntu Maverick hosts, if Puppet is your thing:

class flux {

  exec { "add f.lux ppa":
    command => "/usr/bin/apt-add-repository ppa:kilian/f.lux",
    creates => "/etc/apt/sources.list.d/kilian-f_lux-maverick.list",
    notify => Exec["apt-get update"],
  }

  package { "fluxgui":
    ensure => present,
    require => Exec["add f.lux ppa"],
  }

}

Written by Andy

January 13th, 2011 at 11:27 am

Posted in Applications

Tagged with ,

Two Useful Tools: ack and autojump

2 comments

A recent answer to a question on Quora – What are some time-saving tips that every Linux user should know? – suggested two tools I’ve found very useful: ack and autojump.
Read the rest of this entry »

Written by Andy

January 8th, 2011 at 3:51 pm

Posted in Applications

Tagged with , , , ,

Using an OpenLDAP Proxy to Work Around Solaris/Active Directory Issues

2 comments

There is a long-standing bug in (Open)Solaris and derivatives (including NexentaStor) that breaks Active Directory interoperability:

Beginning with Windows Server 2003, Active Directory supports VLV searches. Every VLV search request must be accompanied by 2 request controls: the SSS control and the VLV control. However, Active Directory imposes some general criteria on the SSS control:

1. Cannot sort based on more than one sort keys/attributes.
2. Cannot sort based on the “distinguishedName” attribute (presumably Microsoft does not use the “DN” attribute).
3. Cannot sort based on a constructed attribute (presumably an attribute not stored on Active Directory).

Unfortunately, Solaris LDAP clients use 2 sort keys/attributes: “cn” and “uid” in the SSS control. Subsequently, when dumping a container or a naming database, Solaris LDAP clients would receive LDAP_UNAVAILABLE_CRITICAL_EXTENSION.

$ ldaplist passwd
ldaplist: Object not found (LDAP ERROR (12): Unavailable critical extension.)

This issue has been detailed elsewhere, including at utexas.edu. There appear to be at least four solutions:

  1. Wait for the fix from Sun Oracle to reach the light of day: this bug was apparently fixed in SNV 144. (I expect the fix is out in Solaris 11 Express now, but have not tested this myself.)
  2. Apply the hotfix in Microsoft’s KB886683 to your domain controllers, which will disable VLV.
  3. Run separate ADAM instances with VLV disabled, and point your Solaris machines at them instead of directly at your domain controllers. From the blog post linked above, it sounds like the University of Texas chose this route.
  4. Use OpenLDAP as a proxy in front of Active Directory; configure your Solaris machines to use the proxies instead of Active Directory servers. This is the solution detailed in this blog post.

Read the rest of this entry »

Written by Andy

January 6th, 2011 at 6:20 am

New GitHub Repositories: Puppet Modules for Google Chrome and f5vpn-login

leave a comment

I’ve published two small repositories on GitHub:

  • puppet-chrome: A Puppet module to install Google Chrome; and
  • puppet-f5vpn: A Puppet module to install f5vpn, the command line F5 FirePass VPN Client.

Both are licensed under the GPL.

Written by Andy

December 30th, 2010 at 9:48 am

Amazon Route 53 DNS Service Examined

3 comments

Amazon has announced a new authoritative DNS service – Route 53.

Sign up is straightforward – click a few buttons on aws.amazon.com, and a few moments later, you’ll have an email confirming your access to the service. If you dig into the Getting Started Guide, you’ll note that “Part of the sign-up procedure involves receiving a phone call and entering a PIN using the phone keypad,” however, that wasn’t necessary for me. Perhaps it’s only for new AWS accounts?

There is no user interface in the AWS Console although there are indications one is on its way. The Route 53 developer tools are fairly bare-bones at this point – four Perl scripts. Those scripts require relatively uncommon Perl modules, not included in the default Ubuntu (Lucid) repositories, although they are available through CPAN.

However, the third-party Boto Python interface to Amazon Web Services already includes support, and presumably other tools are also rapidly adding support, if they don’t have it already.

Using the Perl tools, I created a zone for an example domain – gearlister.org – and was given four name servers:

ns-1945.awsdns-51.co.uk (205.251.199.153)
ns-39.awsdns-04.com (205.251.192.39)
ns-690.awsdns-22.net (205.251.194.178)
ns-1344.awsdns-40.org (205.251.197.64)

Read the rest of this entry »

Written by Andy

December 6th, 2010 at 1:19 pm

Posted in utility computing

Tagged with , , , ,

Adding Swap to an EC2 Micro Instance

5 comments

EC2 micro instances come with no swap by default – at least every micro instance that I’ve ever launched does, I’m not sure if it’s theoretically possible to launch an instance with swap. The lack of swap is probably a side-effect of the limited memory combined with EBS-only storage and concomitant risk of high EBS charges if you swap heavily.

However, if you’re willing to accept the risk of unexpected high EBS I/O costs, it’s straightforward to add swap:

# /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024
# /sbin/mkswap /var/swap.1
# /sbin/swapon /var/swap.1

Or, if you prefer Puppet:

class swapfile {

  exec { "create swap file":
    command => "/bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024",
    creates => "/var/swap.1",
  }

  exec { "attach swap file":
    command => "/sbin/mkswap /var/swap.1 && /sbin/swapon /var/swap.1",
    require => Exec["create swap file"],
    unless => "/sbin/swapon -s | grep /var/swap.1",
  }

}

Written by Andy

December 3rd, 2010 at 1:57 pm

Posted in utility computing

Tagged with , , , ,

VMware Tools Upgrade on CentOS Enables Host Time Sync (plus fix)

leave a comment

After bringing some CentOS guests from an ESX 3.5 environment to an ESXi 4.1 environment and performing a VMware Tools upgrade, I noticed log messages on the VMs similar to the following:

Nov 12 09:07:18 node01 ntpd[2574]: time reset +175.995101 s

Along with console messages about the cmos clock such as:

time.c can't update cmos clock from 0 to 59

Inspecting the affected VMs, the clock appeared to be losing almost a second each second, despite ntpd being up and running and kernel options set appropriately. Further investigation revealed that “Synchronize guest time with host” had been silently enabled for the guest during the Tools upgrade, contrary to VMware’s Timekeeping best practices.

To be fair, I don’t know how widespread this problem is – it could be particular to CentOS, ESX 3.5 to 4.1 migrations, the fact that the virtual hardware hasn’t yet been upgraded from version 4 to version 7, or even my method of upgrading the tools. However, once you know to look for this issue, the resolution is simple: Disable host time sync. You can do this manually, or, if you use Puppet to manage your Linux VMs, the following manifest snippet will automate this for you (assuming you have a “vmware-tools” Service):

exec { "Disable host time sync":
  onlyif => "/usr/bin/test `/usr/bin/vmware-toolbox-cmd timesync status` = 'Enabled'",
  command => "/usr/bin/vmware-toolbox-cmd timesync disable",
  require => Service["vmware-tools"],
}

Written by Andy

November 12th, 2010 at 10:53 am

Put Down the Saw and Get the Glue: Working Around VMware KB1022751

leave a comment

VMware KB article 1022751 lays out the details of an interesting bug in ESXi 4.0 and 4.1 pretty plainly:

When trying to team NICs using EtherChannel, the network connectivity is disrupted on an ESXi host. This issue occurs because NIC teaming properties do not propagate to the Management Network portgroup in ESXi. When you configure the ESXi host for NIC teaming by setting the Load Balancing to Route based on ip hash, this configuration is not propagated to Management Network portgroup.

(Note that load balancing by IP hash is the only supported option for EtherChannel link aggregation.)

Unfortunately, the KB article’s workaround – there is no patch that I’m aware of – requires network connectivity to the host via the vSphere Client. But what do you do if you’ve just sawed off the branch you’re sitting on network-wise, and can no longer connect with the vSphere client?
Read the rest of this entry »

Written by Andy

September 23rd, 2010 at 2:18 pm

NexentaStor in front of a NetApp FC LUN using MPxIO

leave a comment

  1. Create a Fibre Channel LUN on your NetApp and map it to your NexentaStor machine (I’m using version 3.0.2 in this example). For this example, I’ve created a 10GB LUN on a filer running ONTAP 7.2:
    netapp01> lun show /vol/nexenta01/lun01/lun
            /vol/nexenta01/lun01/lun      10g (10737418240)   (r/w, online, mapped)
    

    There are eight paths from our NetApp to our NexentaStor appliance, so the LUN appears eight times on the “qlc” adapter (lines 9-16 below):

    nmc@nexenta01:/$ lunsync
    Cleanup obsolete (dangling) device links?  Yes
    Re-enumerating LUNs... done.
    
    nmc@nexenta01:/$ show lun
    LUN ID      Device    Type         Size       Volume     Mounted Attach GUID
    c0t0d0      sd0       disk         272.3GB    syspool    no      mega_sas 60024e805102c100118a3fa70ae8937a
    c1t0d0      sd128     cdrom        No Media              no      ata    -
    c2t5*DDDd0  sd6       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c2t5*DDDd0  sd4       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c2t5*DDDd0  sd7       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c2t5*DDDd0  sd5       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c3t5*DDDd0  sd3       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c3t5*DDDd0  sd2       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c3t5*DDDd0  sd8       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    c3t5*DDDd0  sd1       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
    syspo~/swap           zvol         1.0GB      syspool    no
    
  2. Read the rest of this entry »

Written by Andy

May 28th, 2010 at 9:35 am

Installing the F5 FirePass VPN Client on Ubuntu 10.04 AMD64

12 comments

Disclaimer: I am not a FirePass administrator; only an end-user and have no other relationship with F5. There may be better methods to address this issue; please comment if you know of one.

See also: f5vpn-login.py, described here, and brought to my attention by sh4k3sph3r3. A CLI FirePass client is quite likely a better solution than separate browser instances, etc.

Preliminaries: Although the F5 FirePass SSL VPN product supports Linux, as best as I can tell, that support is somewhat limited: My understanding is that they officially claim support for 32-bit installs only, and they do not appear to track new distribution releases particularly aggressively. F5 has also been somewhat slow in supporting new browser versions: They announced support for Firefox 3 on October 6, 2008, nearly four months after its release and with only two months to go before Firefox 2 was end-of-lifed. For Firefox 3.6 support, a comment on the post linked above states that you need to request a special hot fix from F5 (which my site has not applied). There is no Google Chrome support that I am aware of.

Further, F5′s automated client installation tools have unfortunately never worked for me on Linux, even when the architecture and browser are in their support matrix. The manual download instruction links are also broken on the FirePass install I connect to.

Solution: Install a dedicated, 32-bit version of Firefox in a supported version; create a single-purpose Firefox profile for VPN use. Add the FirePass client to that browser and the operating system.
Read the rest of this entry »

Written by Andy

May 20th, 2010 at 11:12 am