Some good wireless networking training- free

Aruba makes a nice lightweight access point (LWAP). Centrally managed from a central point. Part of their magic is a GRE tunnel from AP to controller, so the controller can do all kinds of nifty tricks with/to the wireless client packets.

Here is some network training that is has some free options:

Free Wireless Training

Some is Aruba specific (hello mounting Aruba hardware). But the networking fundamentals course is vendor agnostic and has some good information.

Ever wondered why 802.11b clients slow down 802.11g networks, then do the networking fundamentals:

http://www.arubanetworks.com/education/networking_fundamentals.php

It does a review of basic networking, covers wireless and security basics. Self paced in wmv and mov formats.

The other training courses are more Aruba-centric.

Xen Virtualization on CentOS

You can use many tools on Centos 5 to manage virtual servers:

CLI tools: xm, install-sh, virsh
GUI tools: virt-manager

Here are some useful links-

How to install a virtual server (after installing CentOS with the Virtualization packages):
http://wiki.centos.org/HowTos/Xen/InstallingCentOSDomU

That is a command line tutorial. But you could use virt-manager if you have X and Xen. It walks you though all the steps in a much easier way, but it is a good idea to know what is going on behind the scenes. Everything in this tutorial can be done by virt-manager without much hassle.

This is how you install a native virtualization DomU like Windows:

http://wiki.centos.org/HowTos/Xen/InstallingHVMDomU

It also has the way to check your processor extensions.

This one has some basics about keyboard mapping and also has how to deal with SELinux (without turning it off people!):

http://wiki.centos.org/TipsAndTricks/Xen

This article has P2V basics. It gives some insight into what the virt-p2v boot iso (linked in the intro post) does behind the scenes:

http://wiki.centos.org/HowTos/Xen/MoveNative2DomU

And if you had to move something yourself if you had to do it manually.

Free Virtualization Introduction

Xen on Linux is usable out of the box now. If you download CentOS 5.1 (or later I would guess), you can setup virtualization during install.

Virtualization lets you run multiple instances of an operating system and applications on one piece of hardware. You can imagine or read on the net why that would be useful.

Some terms to translate for those familiar with VMWare or Parallels style terminology:

Host OS: VMWare Server (not ESX) uses an operating system (windows or linux) as a host, ESX is the host, and Parallels uses OS X. With Xen virtualization this roughly corresponds to Domain0. Domain0 has unlimited privileges.

Guest OS: You can run windows, linux or other operating systems under VMWare or Parallels. On Xen the guest OS is known as a DomU (domain U), which has direct access to hardware. This domain has limited resources (ram and processors as configured), by default it has no access to hardware.

Paravirtualization vs. fully virtualized-

paravirtualization uses software to allow virtualization. Under CentOS 5, the paravirtualizable guest operating systems are basically linux, linux and linux. Native virtualization uses processor extensions so you need a recent Intel processor that supports or a AMD that supports AMD-V extensions. The extensions aren't very common outside of server class chips (Xeon and Opteron). Here is how to tell if you have the extensions:

egrep '^flags.*(vmx|svm)' /proc/cpuinfo

If you don't have a lines of output with vmx or svm in them, you don't have the extensions.

P2V: Physical to Virtual. How to import physical servers (usually old), to a virtual machine, which can save you time and money and get you out of supporting old and busted servers. There are some pay tools for P2V for Xen and Linux. But here is a pretty good free one:

http://et.redhat.com/~rjones/virt-p2v/

That is it for the intro. More tomorrow with specific examples.

system-config-netboot

Redhat, time for your verbal beating. RHEL3 and 4 I love you. RHEL 5 you are obviously rushed out the door. Proper XEN support starts in 5.1. But the real symptom of the this rush is:

PXE boot.

That is right. The Doc guide used to have directions on PXE boot/network install for RHEL5. It mentioned system-config-netboot (which wasn't in RHEL5). So instead of fixing system-config-netboot somebody went and trashed the doc excising references to system-config-netboot, but not the whole section and not the references to the pxeos tool which is part of the package.

Well if you are lazy like me, and like the tool to setup the /tftpboot directory and not to have to remember anything but the /etc/dhcpd.conf commands:

You can use the system-config-netboot from Fedora 8 (which was kind of a pain to find- thanks to all the mirrors that haven't mirrored FC8 as of this article) right on RHEL 5.1 (for sure, tested, it works).

My favorite property of RHEL is the kickstart/PXE boot ease of deployment. An afternoon or two of fun and you can deploy 1000s or 10,000s of boxes with no trouble. Unless of course you can't get system-config-netboot to setup your PXE environment for you... because it isn't on the distribution.

There is a ticket on bugzilla.redhat.com that says it will be in RHEL5.2. Which will be nice.

Tagged...

Usually avoid this stuff like the plague. But:

Rules:
* Each blogger must post these rules first
* Each blogger must start eight random facts/habits about themselves
* Bloggers tagged need to write about their eight things
* At the end of your blog, choose eight people to get tagged & list their names

I don't have 8 bloggers to tag nor do I have 8 readers. But I'll try.

1) I have to brush my teeth before sports activities, it is half superstition, half habit.

2) I love Apple laptops.

3) Usually when I buy clothes, I buy two or three of the same item.

4) I change jobs when I'm bored with work.

5) Taking tests is fun, especially certification tests. Even if that time between when you press submit and the exam is graded feels like a million years in that 10 seconds.

6) I'm supposed to be walking right now.

7) Shoes. I like shoes and have 9 pairs.

8) I have several serial console cables at reach at all times.

su - on sles 9 doesn't respect limits.

This can end up causing some good security holes.

If you put in a ulimit for higher files for a user named oracle (just an example) in /etc/security/limits.conf:

oracle soft nofile 2048
oracle hard nofile 65535


then run ulimit -a >~limits in cron. Your file limit is 1024 (the default on SLES).

Why? I'll tell you.

Crond does a su - to you user. ON SLES SU - DOESN"T RESPECT THE LIMITS IF THEY ARE HIGHER!!! I haven't tried lower yet.

If you login interactively your limits are fine. If you su - oracle as root, your limits are f-d up (back to the system default 1024).

This doesn't happen on RH/Fedora and as far as I can tell Debian/Ubuntu.

updating one package on sles 9

online_update --url 'my_local_update_server' --force -S patch-10903

or you can do what I do and write script that checks architecture and rpm -ivh http://installserver/sample-i386.rpm from a web server. The script is useable on RH or SLES for onesy twosey patches.

SLES still sucks

but this makes it suck less:

automatic update at your command-

It still doesn't do the right thing with a kernel (it upgrades instead of installs leaving modules broken and your currently running machine in bad need of a reboot), so it is dangerous in some ways.

Just FYI here is the magic:

ssh -n $HOSTNAME "which online_update && online_update -gVu http://servername/YOU/ && online_update -iV"

This executes the command "which online_update" and if that is successful runs online_update to download packages from your You server (yast2 can help you make one, that works) to the local box, then if that is successful online_updates from the packages on the local box. No other combination of switches appears to work update a machine via online_update. SLES needs to download then install.

RHEL/CentOS does the right thing with the kernel and only requires a "which yum && yum -y update" and you can run your own repositories if you use yum, like I do, so it is still better (if you use up2date, that is okay too- but yum does better with the repositories.

The reason I run "which commandname" is to avoid trying to yum a SLES box and online_update a CentOS.

I can feed the script file a list of servers and it will go patch the lot. You can save the output and have a list of patched boxes.

Serial USB on the Mac is a beating

and not a very pleasant one.

http://www.macosxhints.com/article.php?story=20060105104506687&lsrc=osxh

Is the way I finally got it to work again.

I've used the GUC-232A with good success under linux... you don't do anything just configure minicom and go. And adequate success under windows, download driver and go.

But none of the OS X USB serial drivers quite work with the prolific chipset that runs the GUC-232A and the UC-232A I have. So the directions are what I had to do on an intel iMac and a G4 12" powerbook.



Here is the reprint of the material linked just in case:

Download and Install Drivers

1. Go to Prolific's download page and download the latest Mac OS X drivers.

2. Open the Zip File

3. Mount the Disk Image

4. Open the Installer Package and install the drivers

5. Reboot

Change Kernel Extension Property List

1. Plug the GUC232A into any available USB port on your Mac

2. Open the System Profiler, in /Application -> Utilites

3. Click USB in the Contents pane

4. Select the GUC232A in the Device Tree; usually it will be listed under USB-Serial Controller

5. Remember the ProductID and VendorID, or keep the System Profiler window open

6. Open the Terminal, in /Application -> Utilites

7. Use the following command to open the Property List of the Prolific driver:

sudo nano /System/Library/Extensions/ ProlificUsbSerial.kext/Contents/Info.plist

8. Enter your admin password when asked. This is necessary; the ProlificUsbSerial kernel extension is owned by root.

9. Scroll down and find the ProductID and VendorID in the plist file

10. Change the ProductID and VendorID to match your GUC232A's ProductID and VendorID

11. The plist file needs the numbers as integer values, but System Profiler reports the numbers as hex. Use the Calculator to convert the numbers. For example, System Profiler reports the Product ID as 0x2008 and the Vendor ID as 0x0557. The integer value of ProductID is 8200 and the integer value of VendorID is 1367

12. Save the changes (Control-W) and quit (Control-X) nano

Reload Kernel Extension

1. Unplug the GUC232A

2. Use the following command to load the kernel extension:

sudo kextload /System/Library/Extensions/ ProlificUsbSerial.kext/Contents/Info.plist

3. Plug the GUC232A into any available USB port on your Mac

Soft Skills

If you are in business and IT (and you might be if you read this), you need to examine critically the following if you haven't already:

Frederick Brooks: The Mythical Man Month
DiMarco and Lister: Peopleware
W. Edwards Demming: Out of Crisis
Limoncelli and Hogan: The Practice of System and Network Administration

I'm not saying they are all correct or a roadmap to instant success, but everyone has information and experience that needs to be considered and examined.

tar and ssh like peanut butter and jelly

Everybody knows the classic command to make a tar file:

tar -cvf file.tar directory_to_tar

and if you use gnu tar you can improve it with the compress in that step:

tar -zxvf file.tar directory_to_tar
or
tar -jxvf file.tar directory_to_tar

for gzip and bzip respectively...

but did you know:

tar zcvf - /directory_to_tar | ssh hostname "cat > file.tgz"

so you can tar gzip on one end and write the file on the other end of an ssh session?

Huh? Did you?

Yes I know I still owe an automounter deal... I promise it is on the way.

Too busy gardening the Silicon Rust...

automounter is awesome

Ever had an nfs client hang because the server rebooted or hiccupped?

Ever had a web of nfs mounts that won't come up cleanly because there isn't a good order? Like Server A mounts Server B that mounts Server C that mounts Server A (not a good practice, but all too common in crufty environments).

Well automounter can solve some of those problems.

I'll post the technical details tomorrow or the next day.

MySQL stupidity

If you want to be able to troubleshoot mysql:

1) mysqlreport is very cool: http://hackmysql.com. The documentation is awesome and for a quick rush it is fabulous. After you get it installed try having it mail you a tab delimited report: mysqlreport --email user@domain.com --pass --all -tab

2) mytop is also very cool:

3) making sure your indexes fit in RAM is very cool, ls *MYI and sum them up. That amount should be less than physical ram (and less than the key_buffer_size variable from the my.cnf--- you did already check the my.cnf).

4) you can make some changes on the fly, check your variables with show variables; then you can set them with the mysql client

5) make sure your mysql install is logging :roll eyes:

getting rid of standard error

scp foo server: 2>/dev/null


the descriptor 2 is for standard error.

Redirecting 2 to /dev/null makes the standard error go away.

LVM and a rant on bonding and 802.1q

use LVM if you are using a modern linux.

Really. It will make your life easier.

Bonding and 802.1q configuration under linux suck right now. If I get time to experiment, I will figure out the model config. But really Redhat or Suse needs to come out with a configuration tool so you can bond interfaces (and use static or dhcp addresses) and use 802.1q vlan tagging on those interfaces (or non-bonded interfaces).

Cisco 2500 router IOS upgrade

Bucket of pain. The 2500 series routers can have 16Mb of RAM and 16Mb of flash. It stores the OS, called IOS in the flash. The config goes in NVRAM and the boot stuff goes in the boot rom.

I have two routers with two banks of 8Mb flash and it was a mother to upgrade one of them.

The first router upgraded fine with the classic copy tftp: flash: syntax. It erased the old IOS and put the new one on over and away it went (only had to good with the conf reg once 0x2142 to get rid of a config with a password I forgot).

The second one was pain. The two Flash banks showed up seperate, the copy tftp: flash: spat back READ ONLY FILE SYSTEM... so on and so forth.

Here was the fix:

conf 0x2101 (this boots a rom or cut down IOS).
partition 1 16 (make one big 16Mb partition instead of two 8s)
copy tftp flash
conf 0x2102

The 2500 is great for a lab, but don't use one in production. The new ISR routers are quite nice.

Use DNS- it's good enough for the internet

I just fixed a couple boxes that didn't know what localhost was... actually they did, but it was wrong (pointing to their actual IP address, not 127.0.0.1).

Look don't mess with host files. You don't need to. Use DNS.

If you have more than one host, use DNS with Dynamic DHCP. You can reserve IP addresses so that hosts always get the same IP, you can extend lease times, you can put all kinds of things in DNS. But if you update dynamically you will always have the forward and reverse DNS correct (A record and PTR) and you won't have stupid host file troubles like I just had.

Cisco 3005 VPN concentrator resurrection

I found an unused 3005 going through one site's material. Since the current VPN terminates on PCs, I thought I'd get the 3005 going.

While I had the 3005 on the shelf in the lab, I found a problem. The 3005 has a public and private interface. The private interface would intermittently drop physical connection. I inspected the network jack, it looked good, no bent pins. But everytime I'd wiggle the network cable (or even move the middle of the cable), the connection would drop.

So I tore the out of warranty and service 3005 apart (don't do this, it will void your warranty). I checked the posts and solder on the network jack. It looked good, so I put the 3005 back together. While I had it apart I noticed two little silver tabs on the sides inside of the jack where the pins are. I used a very fine screwdriver and bent these two tabs out on both jacks hoping it would tighten the grip on the network cable.

Sure enough it works. I'll try to get a macro picture up soon.

Silly Juniper...

Just got the Juniper ScreenOS Product Documentation CD Version 5.0 June 2004 Rev. B in some brand new NetScreen 50 boxes.

Either the doc CDs aren't revisioned very often or these NS50's move kinda slow... any way,

The disc is CDFS or whatever, but all the directories are 444 permissions on linux and MacOS. You can't change directories to read the PDFs when anything but root. On a linux box, at least you can be root, on a Mac it is really inconveniant. In either case, why would I want to be root when I'm reading PDFs?

Looks like nobody at Juniper uses the doc CD on different architectures. Maybe they only use windows internally or have all the docs on the webserver internally.

mount loop: cd or dvd iso

if you need to use a dvd or cd iso on your linux box just mount it loop. You can even export or serve out (via http) the mount.

mount -o loop /home/fedora/FC3-i386-DVD.iso /home/fedora/pub/mirrors

and that makes gardening a little easier...