thinking sysadmin

Quick notes on configuring LDAP in Fishworks, gleaned from my experience working with the VMware simulator:

As I noted in my “quick walk” post’s comments, I had difficulty getting LDAP working initially on my corporate Active Directory network. The crux for me turned out to be getting the LDAP Schema Definitions correct. Here are the settings that worked correctly for me, authenticating against an AD instance with the schema extended by Microsoft’s Services for Unix add-on (other LDAP schemata will, of course, need different mappings):

USERS
Search descriptor: Don’t leave this blank – according to the Fishworks documentation this “sets the LDAP search descriptor, attribute mappings and object class mappings for users and groups. By default, the search descriptor for users is ou=people,dc=example,dc=com, and for groups is ou=group,dc=example,dc=com” – so what you enter will be site-specific.

Attribute mappings:

• uid=msSFU30Name
• uidNumber=msSFU30UidNumber
• gidNumber=msSFU30GidNumber

Object class mappings:

• posixAccount=User

GROUPS
Search descriptor: Again, don’t leave this blank – enter the appropriate value for your site.

Attribute mappings:

• gidNumber=msSFU30GidNumber
• uniqueMember=msSFU30PosixMember

Object class mappings:

• posixGroup=group

How did I know that the schema definition mappings were the problem? The logs gave it away: Maintenance -> Logs -> System, where I saw messages similar to the following: “libsldap: Status: 0 Mesg: Unable to set value: schema map already existed for ‘User’.”

How did I know that I had the schema definitions working? Share settings that I had created using numeric UIDs and GIDs automatically became mapped to the correct user and group names.

I’ll update this post if I find additional configuration that may be necessary.

A picture is worth a thousand words, right?

That was easy...

Below is a quick walkthrough of my experience booting and installing the Fishworks VMware appliance; my thoughts follow.
Read the rest of this entry »

So I returned from a little five-day weekend to sunny Lake Chelan and the Columbia River to an RSS reader bursting at the seams with new posts. By far the best post was one later deleted:

• Amazon Elastic Block Store goes live! (Yeah, that link’s dead – like I said, it was later deleted.) The RightScale folks appear to have inadvertently published a draft (on 8/8, the day after I left town) of their blog post designed to coincide with the release of Amazon’s Elastic Block Store for EC2. They later deleted it, but Google Reader kindly cached the post for me. I won’t repeat anything in the post, nor would I bank on anything written there – would you gamble anything important on a retracted post about a not-yet-released product? I will add one comment: Will EBS attract attention of the lawsuit kind from NetApp? (I mean that comment only partially in jest – and you’d probably have to have seen the original post to know what I’m talking about.)

• Flash Forward – Jay Kidd, CTO of NetApp blogs that “NetApp is in the process of certifying enterprise-grade SSDs that you can use in our existing storage shelves.” No dates or pricing announced yet, of course, but he does make an excellent point about SSDs in storage arrays: “For the next few years, you won’t be using a lot of flash capacity in your systems, not just because of the costs. At 10x or more the IOP rate of hard disks, it only takes a small number of SSDs in disk slots to saturate the performance of the array controller. It’s like trying to fly a model airplane in your living room – you’ll run into a system performance wall long before you hit capacity limits. This is another reason that flash as cache is economically efficient – it puts the necessarily small amount of very fast storage at a point in the architecture where you can best exploit the performance.” Not unlike how Sun suggests using SSDs with ZFS. (Seen at Blocks and Files.)

• Elektronkind: OpenSolaris 2008.11 – A Preview For The Storage Admin – A look at upcoming storage technologies in OpenSolaris 2008.11, including ZFS, iSCSI, NDMP, COMSTAR, AVS and SAM-QFS. These products really set OpenSolaris apart from Linux distributions, although I wonder how official this list is, and have some doubts about the status of some of the projects. For example, there doesn’t appear to be much activity on the SAM-QFS OpenSolaris project, although maybe I’m just looking in the wrong place. (Seen at c0t0d0s0.org.)
• Ruling: SCO owes Novell $2.54 million from SCO-Sun SVRX deal – Interesting excerpt: “Judge Kimball also reviewed SCO’s agreement with Sun and found that some of the terms exceeded SCO’s licensing authority. Through the agreement, SCO lifted the confidentiality provisions of Sun’s 1994 SVRX deal with Novell even though SCO was not permitted to do so without Novell’s explicit consent. The judge concluded that lifting of the SVRX confidentiality provisions was not incidental to a UnixWare license and was consequently not permissible. This raises some intriguing legal questions about OpenSolaris, which includes SVRX code that we now know SCO clearly had no right to let Sun open.” I wonder if we’ll be hearing more about this in the coming months.
• Interview: IT consumerization and the future of higher ed – Another interesting piece on Ars Technica from today, an interview with Oren Sreebny of the University of Washington, whose best bits obliquely refer to the challenges of miasma computing and information security. Quotes: “Lately we’ve been looking at Google and Microsoft offerings for commodity stuff, and one of the things we deal with in some of our research [departments] is government regulations about ‘exporting munitions.’ So one of the manifestations of those government regulations is that you cannot store your data outside the US if you’re working on some types of government-funded projects. Google has said, ‘We can’t guarantee that anybody’s stuff in particular won’t be in a datacenter that’s located outside the US, so don’t bring that stuff to us,’ which is exactly what I’d be saying if I was them. So we have to figure out, as we start to move in those directions, what we do about that.” Also: “[Separate identity principals for people who are working on sensitive data] is an interesting conversation because, in many ways we’ve spent the last decade trying to integrate people’s identity, and do single-sign-on, and not make them have lots of separate accounts in separate places. And in many ways it really goes against the grain to step back from that, but maybe it’s time to do that.”

There’s nothing like a long summer weekend followed by an on-site consultant to keep you from updating your blog. But on the bright side, I didn’t have to link to the notebook SSDs are dead – no they’re not kerfluffle.

• NetApp finds NAS could mean ‘never accessed storage’ – “According to a USENIX presentation, 90% of data on NetApp’s networked storage systems was untouched over a 3-month period, raising the issue of whether it would be better placed on cheaper storage.” I would find some irony in that cheaper storage being tape.
• zfs un-benchmarking – “Our rationale for testing was to finally get some numbers that we can provide to users/customers about real zfs performance. There is a huge amount of (largely uncontested) information (emanating mainly from Sun and its agents) that zfs is a very fast file system. We want to test this, on real, live hardware, and report. Well, we can’t do the latter due to Sun’s licensing, but we did do the former. Paraphrasing Mark Twain: ‘Rumors of zfs’s performance have been greatly exaggerated.’” When Joe Landman blogs about performance, I take what he has to say seriously, but given the stability problems he notes, I wonder if – as he suggests – that driver issues are a factor here, and we’re not seeing a generic ZFS issue. (Seen at InsideHPC.)
• Self-protecting archive for SharePoint – “A new archiving product from BridgeHead Software automatically moves older, infrequently-accessed SharePoint items to cheaper archive media and cuts down the SharePoint backup burden.” HSM for SharePoint, apparently? Sounds interesting.
• Since NFSv4 is Stateful It Must Be Less Robust, Right? – “The short answer is no.” Interesting summary of how locking works under NFSv4; although I haven’t used NFSv4, this sounds like a massive improvement over previous versions – can I get the time that I spent debugging locking problems on Linux NFS servers back now?
• Storage Opens Up – Sun releases new JBODs and upgrades Thumper’s hardware. Given that I heard rumors of the Thumper expansion shelves (J4500) maybe a year ago, I’m surprised it took them so long to come out. And is it just me, or do the J4200 and J4400 look a little like someone else’s boxes rebranded?

• The Hitz report – Robin Harris at StorageMojo on the Sun-NetApp lawsuit:
  

  NetApp’s biggest misperception is that WAFL is somehow central to the success they are enjoying today. That was true about 10 years ago. Guys, your average F500 CIO today could care less about WAFL.

  NetApp is growing because they offer a compelling value proposition of quality products, relevant services and worldwide support. WAFL certainly supports that, but as NetApp execs note much of their recent success is due to the integration software that NetApp now offers.

  WAFL is a small piece of the picture. Sun could copy it line for line and still not have a quarter of what NetApp offers.

  NetApp faces challenges. Storage commoditization threatens all vendors traditional 60% gross margins. The GX integration is problematic and the bottom line benefit uncertain. EMC’s move into cloud file services is a clever flanking strategy.

  An interesting opinion summed up nicely, I think.

• Saving and Restoring ZFS Snapshots to and from Amazon S3 – A ZFS to S3 workaround for the lack of persistent storage on EC2.

• NetApp Litigation – an update: Sun’s take on the NetApp/Sun lawsuit proceedings. “Over the last two months, the PTO has granted the first five of our reexamination requests, finding in all the cases that multiple ‘SNQP’ [substantial new question of patentability] exist for each patent (one request filed in June is still pending). These include, among others, US Patent Nos. 5,819,292; 6,857,001 and 6,892,211, ‘core patents’ according to NetApp. With regard to one NetApp patent, the ‘001 patent, the PTO has issued a first action rejecting all the claims of this patent. Based on the positive response we received from the PTO, we asked the trial court to stay a portion of the litigation. Obviously, it doesn’t make sense to go through the expense and time of litigating a patent in court if the PTO is likely to find it invalid. The court agreed with our request and at least one NetApp patent has thus far been removed from the litigation.” Dave Hitz’s declaration is also an interesting read; looking forward to seeing the inevitable NetApp blog reply. (Seen at c0t0d0s0.)
• Comcast gets spectrum for WiMAX femtocells, wireless services: “Comcast has announced plans to deploy these Femtocells via its cable internet subscribers. These small and cheap devices will provide wireless access to subscriber’s houses with backhaul going through their Comcast Internet connections.” I had been wondering why Comcast and the other cable ISPs joined Clearwire…

Chuck’s got another, uh, thought-provoking blog post up, More Examples Of Why Server Vendors Just Don’t Get Storage, surely intended to ruffle a few feathers. And he does raise some really good points: Most server vendors need more of an SSD strategy than just making a flash drive an option (it’s how you use it, not that you have it!). And as big a fan as I am of ZFS and Sun’s storage options in general, to win in the “enterprise” (and not just, say, HPC) Sun needs to pull everything together into Solaris (from OpenSolaris) and make it less of a DIY operation.
Read the rest of this entry »

• HP servers to get flash memory I/O boost – It looks like SSDs will become a common option on server hardware; the real issue will be how to adapt your operating system/file system/application to use them optimally.
• BlueArc’s Titanic benchmark holed – A storage vendor using a non-real-world configuration to optimize benchmark results? Really? Say it ain’t so!