Seth's questions

I'm ansibilizing a couple servers for a python application, some of which are CentOS, others are debian.

Is there a convenient way to locate a program that could be installed in various places, without resorting to the example below, and without repeating the same command several times (with different when: clauses)?

For example, on CentOS it's /sbin/nologin, on debian it's /usr/sbin/nologin. I have been trying to find and register the path in a variable, but it seems silly:

- name: Find nologin
  command: ls -1 /usr/sbin/nologin
  ignore_errors: yes
  register: nologin_command

- name: Find nologin 
  command: ls -1 /sbin/nologin
  register: nologin_command
  when: nologin_command.stdout == ""

# nologin_command.stdout will be the path to one or the other

In my particular case, I'm actually trying to find the correct virtualenv_command for the pip module. I have to be specific or I'll get the wrong one (i.e., for Python 2) or a path that doesn't exist.

My systems will have one of pyvenv, pyvenv-3.4, virtualenv, or virtualenv-3.4. At least one will be present, but, depending on the operating system and how python was installed, they are in different places or don't exist at all.

Has anyone experimented with running a virtual RAID0 inside a VM? For example, two virtual disks in a software RAID0 configuration, rather than a single virtual disk.

Specifically, I'm wondering if read performance would increase, or if the overhead of having two virtual disks would negate the effect?

I have a site-to-site VPN set up with two SonicWall's (a TZ170 and a Pro1260). It was suggested to me that turning off encryption (so the VPN is tunneling only) would improve performance. (I'm not concerned with security, because the VPN is running over a trusted line.)

Using FTP and HTTP transfers, I measured my baseline performance at about 130±10 kB/s. The Ipsec (Phase 2) Encryption was set to 3DES, so I set it to "none". However, the effect was opposite -- the performance dropped to 60±30 kB/s, and the transfers stall for about 25 seconds before any data comes down the line. I tried AES-128 and the throughput went UP to 160±5 kB/s. The rated speed of my line is 193 kB/s (it's a T1).

Contrary to what I would think, stronger Ipsec encryption seems to improve throughput. Can anyone explain what might be going on here? Why would no encryption cause poor and highly variable performance, and cause transfers to stall? Why does AES-128 improve performance?

I have a dedicated T1 line that runs between my office and my data center. Both ends have public IP addresses.

On both ends, we have AdTran T1 routers which connect to SonicWall firewalls.

The SonicWalls do a site-to-site VPN and handle the network translation, so the computers on the office network (10.0.100.x) can access the servers in the rack (10.0.103.x).

So the question: can I just add a static route to the SonicWalls so each network can access each other with out the VPN? Are there security problems (such as, someone else adding the appropriate static route and being able to access either the office or the datacenter)? Is there another / better way to do it?

The reason I'm looking at this is because the T1 is already a pretty small pipe, and having the VPN overhead makes connectivity really slow.

--

Clarifications (thanks for the answers so far):

The stumbling block for me is that the T1 has a public IP address. If I set up a route on at the office that says "you can find the gateway for 10.0.103.0 at 200.X.Y.Z", can some dude on the internet also set up the same route and also be able to access my 10.0.103.0 network?

With the VPN, I know it's not possible because there are authorization protocols which prevent outside people from getting in.

Alternatively, I guess the question is "What is the correct way to route between two remote networks over a T1 line?"

The T1 in question has a physical endpoint in my office, and another physical endpoint somewhere at the datacenter, but again, the IP address is public.

I'm not concerned that the telco or datacenter people are sniffing my passwords (if they were, that would sure suck, but that situation is above my paranoia threshold :).

I'd like to automating deployment of test machines (all of which are naturally different). I have a half dozen boxes that need to be able to be brought up and torn down with frequency.

I could install them all with the right drivers, create disk images, then use an imaging tool to re-copy the entire disks, but that would mean a different image for each system, and images don't offer much flexibility. I'd rather quick format the boot partition and copy stuff over in BartPE. Then I'd have the the flexibility to only copy certain things here and there.

So, is there a simple way to copy the right folders on it from an existing installation and make it boot?

Virtualization isn't an option.

I have two networks connected with a site-to-site VPN:

• Network "A" is 10.0.100.0/24 with a Sonicwall TZ-170 at 10.0.100.1
• Network "B" is 10.0.103.0/24 with a Sonicwall Pro1260 at 10.0.103.1
• Everything in "A" can ping everything in "B", and everything in "B" can ping everything in "A"

With one Exception: Nothing from network "A" has access to anything on the "B" sonicwall (no HTTP, HTTPS, SNMP, ICMP, etc.).

Additionally, sonicwall "B" can't ping it's own lan address. I've been over the VPN config, and the NAT and firewall rules on both sonicwalls. Everything seems fine, but clearly I'm missing something.

Anyone have any ideas? So far, the Sonicwall support team hasn't been able to resolve the problem.

Update: Access to the "B" device's LAN IP spontaneously started working last night, exactly when our "A" TZ170 spontaneously rebooted itself. I'm starting to think we have some faulty equipment.