Sunday, December 30, 2012

freebsd and dim of the yard!

I installed FreeBSD today with dim: A pure-Python window manager for the X window system. I like the minimalism of them both as well as being able to tag groups of windows. Below are my notes.


  1. Did a default FreeBSD install
  2. Updated to the latest ports
  3. Install only the packages you need:
    pkg_add -r xorg xorg-fonts urwfonts freetype py27-xpyb 
               libXfontcache xdm portupgrade git bash emacs 
               chromium 
    
  4. Configure X
  5. Clone dim from github
  6. Configure a .xession:
    xset m 12/4/8
    xrdb -merge $HOME/.Xdefaults
    xsetroot -solid steelblue
    xterm &
    exec /usr/local/src/dim/bin/dim
    
Make sure you have the latest FreeBSD port of xpyb. The port tree upgrade above should cover you but if you do not have at least 1.3.1 try:
portsnap fetch
portsnap extract
portsnap update
pkg_install -r portupgrade
portupgrade -R py27-xpyb 

Monday, September 10, 2012

nginx to load balance

A co-worker showed me an article on how to Use Nginx for Proxy Services and Software Load Balancing.

Wednesday, July 4, 2012

RHEV & UCS

My organization is using RHEV which is a RedHat supported version of the Apache Licensed oVirt. Video.linux.com has videos teaching the use of the system including an introduction to oVirt architecture. RedHat also has ePub versions of 12 documents including their REST API documentation, which looks very promising for CLI and automation tasks. It has a nice GUI if you can stand IE; Firefox support is coming and the IE requirement is just a remnant of the company they bought to get RHEV, from whom they then released the source. A windows server is no longer required (just Tomcat and PostgreSQL). If you really can't stand a Windows VM you can go all CLI; just accept that behind the scenes it will be passing XML to the server and back.

We're still using Dell servers but are considering Cisco UCS. UCS attracted me because it offers flexibilities that standard servers don't seem to have, in particular the ability the manage physical machines like virtual machines. For example, automatically flash any subset of the servers with a variety of properties including: version x of the firmware, the mac address of the previous server running it so the OS can't tell the difference after a hardware upgrade, and to store and apply machines profiles like software. Also, we already have full Cisco network gear and the cabling for it is much simpler with just two 40G uplinks for a full chassis. Like the XIV and RHEV, it has a platform independent GUI as well as a CLI which is all based on the same XML API. With all of Cisco's talk of vmWare you might think they didn't know RHEV existed but RHEV is fully supported and tested by Cisco. UCS also has plugins for RHEV to integrate management. I can imagine using the similar API in a single script to orchestrate events on my SAN, Server, and Cluster manager and it seems attractive.

Below are some slides from a joint presentation from RedHat and Cisco on RHEV and UCS:



Sunday, July 1, 2012

Galaxy Nexus GSM works with iPhone 3G Mini SIM Card

Two years ago I switched from an iPhone to a Nexus One. When I made the change I simply put my iPhone 3G Mini SIM card in the Nexus One and everything worked and I had 3G speeds. I have recently upgraded to the unlocked GSM version of the Galaxy Nexus and again I did the same SIM card swap. Again everything worked and I seem to have HSPA speeds. Three back to back tests with speedtest.net on the Nexus One had a download speed of about 0.75 Mbps while the download speed on the Galaxy Nexus was about 1.25Mbps. I know there are people out there getting much faster download speeds with the Galaxy Nexus on GSM but I attribute that to my area.

git in pictures

git in pictures

Saturday, June 16, 2012

Security Toys

I learned a little bit about owasp zap and w3af today. Looks like something I'd like to throw at a web.py app that I'm developing.

Thursday, June 7, 2012

Persistent Connections from database on Cisco Firewall

I've posted before about how our Cisco firewall tears down inactive connections and modifying the tcp_keepalive_time on the Linux kernel so as to not loose the connection. Similar options exist on the database side.

If you're running MySQL then update /etc/my.cnf to have:

wait_timeout=900

If you're running an Oracle then update sqlnet.ora to have:
SQLNET.EXPIRE_TIME=10
This option is in $ORACLE_HOME/network/admin/sqlnet.ora.

Sunday, June 3, 2012

Cisco EOL List

I have found a handy list of End-of-Sale and End-of-Life Products from Cisco.
Published with Blogger-droid v1.7.4

Saturday, May 19, 2012

(Searching for program No such file or directory aspell)


After installing GNU Emacs on Mac OS 10.7 and trying to spell check a word with M-$ you might see:
(Searching for program No such file or directory aspell)
Here's a quick fix
  1. install homebrew
  2. brew install aspell --lang=en
  3. Add the following to your .emacs and exec each line (C-x e)
(setenv "PATH" (concat (getenv "PATH") ":/usr/local/bin"))
(setq exec-path (append exec-path '("/usr/local/bin")))
The problem is that OS X doesn't come with a aspell or ispell by default so you can install it with Homebrew. Homebrew installs everything in /usr/local/ but GNU Emacs for OS X doesn't look there; i.e. it's not in its path, thus the two lines above add it to Emacs' path.

Saturday, April 7, 2012

new python toys

My organization has hired a new programmer who's into Python and I've been learning from him. I was always able to use Python to get done whatever I needed to get done but there are plenty of things I didn't know about until he showed me. Here's a quick list:
  • the * and ** operators
  • Generators, though I have not yet used them (ideas)
  • ipython: an interactive python shell (not necessarily IronPython). It's been allowing me explore the language quickly (much quicker to type '?' than google the documentation) and interactively; e.g.
    sh-4.2$ ipython
    Python 2.7.2 (default, Oct 27 2011, 01:40:22) 
    Type "copyright", "credits" or "license" for more information.
    
    IPython 0.12 -- An enhanced Interactive Python.
    ?         -> Introduction and overview of IPython's features.
    %quickref -> Quick reference.
    help      -> Python's own help system.
    object?   -> Details about 'object', use 'object??' for extra details.
    
    In [1]: 1+
      File "", line 1
        1+
          ^
    SyntaxError: invalid syntax
    
    
    In [2]: import ldap.<tab>
    ldap.async       ldap.dn          ldap.ldapobject  ldap.sasl        ldap.thread      
    ldap.cidict      ldap.filter      ldap.modlist     ldap.schema      ldap.threading   
    ldap.controls    ldap.functions   ldap.resiter     ldap.sys         ldap.traceback   
    
    In [2]: import ldap.filter
    
    In [3]: ldap.filter.<tab>
    ldap.filter.escape_filter_chars  ldap.filter.filter_format        
    
    In [3]: ldap.filter.escape_filter_chars?
    Type:       function
    Base Class: 
    String Form:
    Namespace:  Interactive
    File:       /usr/lib64/python2.7/site-packages/ldap/filter.py
    Definition: ldap.filter.escape_filter_chars(assertion_value, escape_mode=0)
    Docstring:
    Replace all special characters found in assertion_value
    by quoted notation.
    
    escape_mode
        If 0 only special chars mentioned in RFC 2254 are escaped.
        If 1 all NON-ASCII chars are escaped.
        If 2 all chars are escaped.
    
    In [4]:
    
    In [4]: ldap.filter.escape_filter_chars??
    Type:       function
    Base Class: 
    String Form:
    Namespace:  Interactive
    File:       /usr/lib64/python2.7/site-packages/ldap/filter.py
    Definition: ldap.filter.escape_filter_chars(assertion_value, escape_mode=0)
    Source:
    def escape_filter_chars(assertion_value,escape_mode=0):
      """
      Replace all special characters found in assertion_value
      by quoted notation.
      
      escape_mode
          If 0 only special chars mentioned in RFC 2254 are escaped.
          If 1 all NON-ASCII chars are escaped.
          If 2 all chars are escaped.
      """
      if escape_mode:
        r = []
        if escape_mode==1:
          for c in assertion_value:
            if c < '0' or c > 'z' or c in "\\*()":
              c = "\\%02x" % ord(c)
            r.append(c)
        elif escape_mode==2:
          for c in assertion_value:
            r.append("\\%02x" % ord(c))
        else:
          raise ValueError('escape_mode must be 0, 1 or 2.')
        s = ''.join(r)
      else:
        s = assertion_value.replace('\\', r'\5c')
        s = s.replace(r'*', r'\2a')
        s = s.replace(r'(', r'\28')
        s = s.replace(r')', r'\29')
        s = s.replace('\x00', r'\00')
      return s
    
    In [5]:
    ...
    In [60]: import string
    
    In [61]: string.<tab>
    string.Formatter        string.capwords         string.ljust            string.rsplit
    string.Template         string.center           string.lower            string.rstrip
    string.ascii_letters    string.count            string.lowercase        string.split
    string.ascii_lowercase  string.digits           string.lstrip           string.splitfields
    string.ascii_uppercase  string.expandtabs       string.maketrans        string.strip
    string.atof             string.find             string.octdigits        string.swapcase
    string.atof_error       string.hexdigits        string.printable        string.translate
    string.atoi             string.index            string.punctuation      string.upper
    string.atoi_error       string.index_error      string.replace          string.uppercase
    string.atol             string.join             string.rfind            string.whitespace
    string.atol_error       string.joinfields       string.rindex           string.zfill
    string.capitalize       string.letters          string.rjust            
    
    In [61]: string.whitespace
    Out[61]: '\t\n\x0b\x0c\r '
    
    In [62]: string.punctuation
    Out[62]: '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~'
    
    In [63]:
    

Thursday, March 29, 2012

Zimbra kills killer feature in favor of "just use vmware"

Long have I looked forward to Zimbra having disaster recovery through server to server sync. It would have made things better in my organization in a DR situation. In lieu of not having this feature we live mirror replicate the Zimbra store server LUNs between data centrers on our XIVs. So our DR strategy is to use our backup store servers on the replicated LUNs. Setting this up would take some time. It would be much better if they were already in the Zimbra cluster all the time and flipping them over to be the master would be a "supported feature" not something a sys admin has to do by configuring another instance of the store server by using the same data.

Zimbra promised me this feature years ago and today they backed out and ask that we just implement this feature by running Zimbra on VMware and buying vCenter Site Recovery Manager. However, we don't want proprietary lock-in reaching down into our virtualization platform so we don't use VMware and instead use KVM. We like Zimbra because it's built with non-proprietary components aside from the active-sync and Outlook connectors which we liked having since lots of people want an Exchange-like interface and we can keep the proprietary code/protocols in their own little bucket.

Zimbra is calling lots of attention to VMware's features as opposed to what a future version of Zimbra was supposed to have:

"This enhancement requests asks to sync an active server to a passive server, we'll never do this. It's a legacy failover model when their are new technology options to provide elastic scaling and (geo)redundancy with stateless application servers and distributed data. It's taken some time for these technologies to progress to the point where they are viable enough for applications like Zimbra that need data consistency and atomic transactions."
Let's look at this more simply. VMware can sync VM objects. Zimbra was supposed to be able to sync Zimbra objects. If you run Zimbra on VMware then you can just use the sync'd VMware objects for DR but if you don't run VMware then it would be nice to have sync'd Zimbra objects. Sycing objects to a recovery site is not legacy. What's changed is the type of objects.

Update: Zimbra re-opened the feature request. I'm glad the community put enough pressure on them.

Monday, March 19, 2012

Thursday, February 9, 2012

iptables be liberal cheatsheet

A while ago I posted about how Cisco firewalls can make certain packets' state look invalid to iptables which causes slow performance because packets would be dropped and had to be retransmitted. This was inspired by a much more interesting post on endpoint.com. Since then I've often had to relax the invalid checks on iptables by setting the following proc values on rhel5 or rhel6:
rhel5
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

rhel6:
/proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal

Wednesday, February 1, 2012

emacs usb foot switch

Found an entry on emacswiki.org about foot switches. I see that xkeys now has a GPL'd SDK. I think it's time to get my feet in on the action...

Tuesday, January 24, 2012

DNS TTL Cheat Sheet

When migrating a DNS from an old server to a new server I lower the TTL 24 hours before so that when I make the change external users get the new site within an hour instead of the old site because the DNS information is cached for 24 hours.

When lowering the TTL I end up having to ask someone or look it up enough that I'm posting this cheat sheet for myself to search in the future. So if a longer TTL is inherited from the top of the zone file and foo.tld inherits that time it would look like the following:

foo                        A       123.456.7.8
To lower it's TTL to one hour I simply insert the time with units (else it's seconds) in between the hostname and the A:
foo        1h              A       123.456.7.8
Then after reloading the zone file query that DNS server for the name:
dig @123.456.2.1 foo.bar.com
and make sure the ANSWER section contains 3600, which is the number of seconds in an hour:
;; ANSWER SECTION:
foo.tld. 3600    IN      A       123.456.7.8

Monday, January 16, 2012

svn2git

Nothingmuch's Migrating from Subversion to Git worked for me for two SVN repos that I'm actively working on.

Quick notes:

yum install git-svn
git svn clone --prefix=svn/ --stdlayout --authors-file=authors.txt 
git svn-abandon-fix-refs
git svn-abandon-cleanup
This makes a clean git repo complete with tags, branches, and history. Now set the "central" repo location :
git remote add origin 
git config branch.master.remote origin
git config branch.master.merge refs/heads/master
finally, push it up to the server :
git push origin master