gnarf's questions

I've been running an amavisd-new, spamassassin, postfix setup for a while to help crush spam on our incoming e-mail servers. The setup I'm using is a few years old at this point and its about time to rebuild on new hardware.

I was wondering if there was another approach to tackling this ever-present issue that might yield better results for our large mail system. I have no particular complaints about the current setup, other than the fact that we still are plagued by spam... :)

I'm mostly interested in free solutions, but might be willing to consider a paid software/third party service if the price is right.

Thanks in advance for any suggestions you might have.

Short of rebuilding the whole server from the ground up (which I'm working on anyway), any ideas how to fix this problem on an old debian etch box? Its annoying to not be able to apt-get things...

# apt-get install dpkg
<<snip>>
Preparing to replace dpkg 1.13.25 (using .../archives/dpkg_1.13.26_i386.deb) ...
dpkg: error processing /var/cache/apt/archives/dpkg_1.13.26_i386.deb (--unpack):
 unable to install updated status of `dpkg': No such file or directory
<< hangs here - need to ctrl-c >>


# dpkg -C
The following packages are in a mess due to serious problems during
installation.  They must be reinstalled for them (and any packages
that depend on them) to function properly:
 dpkg                 package maintenance system for Debian

I want to be able to add some requires to a file I setup:

define daemontools::service(
  $ensure = 'running',
  $source
){
  case $ensure {
    'running': { $real_ensure = $source }
    'stopped': { $real_ensure = 'absent' }
    default: { fail("no such ensure for daemontools::service") }
  }

  file{"/etc/service/${name}":
    ensure => $real_ensure,
    require=> Package['daemontools']
  }

  # This is the part that gets confusing
  if $require {
    File["/etc/service/${name}"]{ require +> $require }
  }
}

# in some other class somewhere

daemontools::service{"tinydns": 
  source=>'/var/tinydns', 
  require => [Package['djbdns'],Exec['tinydns_setup']]
}

The LanguageTutorial seems to think this will work, but it only results in the error message: Parameter 'require' is already set on File[/etc/service/tinydns] by daemontools::service

I'm currently starting to redesign our backup server. The machine currently uses rsync and cp -al to keep snapshots of the live servers. It backs up about 10-20 other computers of varying FS structures. There are mail servers, database servers, webservers, even a windows machine or two (using SMB/CIFS to mount, then rsync locally). The current setup involves 4 400MB drives in a RAID 5 setup, with two ext3 partitions (smaller boot/config, larger backup volume) and swap. The backup script launches up to 3 backups at once. During the backup window, doing much of anything (even a simple ps aux) seems to react very slowly on the backup server, and I'm wondering if my problems aren't mostly filesystem related.

Looking at the redesign phase, we have some newer hardware (2TB Caviar drives, i7's, etc) to use. My thoughts so far include: Using RAID 1 on the 2TB drives to get rid of any potential performance issues with RAID 5. I was assuming that I would partition that 2TB drive into a smaller boot/config partition, and then a much larger data section. I'd like the backup process to happen as quickly as possible of course. It leads me to a few questions.

• Will I see better performance if I put the main system and swap partitions on a separate drive from /backup? I could use a 4 drive (2 RAID 1 arrays) setup with a smaller boot/config volume. Will this give me any major advantages?
• Should I use ext4, ReiserFS, XFS, or something else entirely for the backup data partition?
• Is there some other backup method that someone would suggest I research so long as I'm already re organizing my backup server?

I seem to be running into a little bit of a problem understanding how to get this to work. I have a new server I'm building sitting behind the office NAT at work, its reverse dns maps to office.mydomain.com, but I want the machine to be ns2.mydomain.com for the sake of puppet.

nodes.pp snippet:

node 'ns2.mydomain.com' inherits basenode {
  info('ns2.mydomain.com')
}

node 'office.mydomain.com' inherits basenode {
  info('office.mydomain.com')
}

And my 'puppet.conf' on the client:

[main]
#was node_name=ns2.mydomain.com
#was fqdn=ns2.mydomain.com
certname=ns2.mydomain.com
node_name=cert

My syslog on the server reports:

Sep 16 22:59:12 support puppetmasterd[2800]: Host is missing hostname and/or domain: office.mydomain.com
Sep 16 22:59:12 support puppetmasterd[2800]: (Scope(Node[office.mydomain.com])) office.mydomain.com
Sep 16 22:59:12 support puppetmasterd[2800]: Compiled catalog for office.mydomain.com in 0.03 seconds
Sep 16 22:59:12 support puppetmasterd[2800]: Caching catalog for ns2.mydomain.com

How can I make it grab the config for ns2.mydomain.com without doing something like this:

node 'ns2.mydomain.com' inherits basenode {
  info('ns2.mydomain.com')
}

node 'office.mydomain.com' inherits 'ns2.mydomain.com' {
  info('office.mydomain.com')
}

UPDATE: This problem seems to be causing other issues as well. For instance if I info("$fqdn") while the machine is sitting behind office.mydomain.com the fqdn fact is empty, as well as the $operatingsystem. Its almost like the facts aren't being discovered properly. Is there perhaps a NAT issue? Are there any suggestions for tracking down this cause of this problem?

So, I've been playing with puppet for a while now, and I have managed to get my site.pp file setup and working the way I want it to when I run puppet manually against it, and I'm starting to move on to figuring out the client/server issues.

I'm running a little virtual machine on my dev box that is trying to sync with puppetmasterd on my main box but there are problems.

First of all - plugin/fact syncing doesn't seem to be working at all - I've tried opening up more of auth.conf, but I feel I'm getting dangerously close to exposing my configurations to the whole world. The facts for the node just don't seem to exist.

I've tried looking at the official documentation on how to set this up properly, but I get the feeling most of it is written pre 0.25.0. Anyone out there have any ideas for debugging the source of this particular problem?

These are the errors I'm seeing in the error log:

Sep 16 22:12:59 support puppetmasterd[2800]: Not authorized to call search on /file_metadata/facts with {:ignore=>[".svn", "CVS"], :links=>"manage", :recurse=>true}
Sep 16 22:12:59 support puppetmasterd[2800]: Not authorized to call find on /file_metadata/facts
Sep 16 22:13:00 support puppetmasterd[2800]: Host is missing hostname and/or domain: **hostname of my virtual host's NAT gateway**

Sep 16 22:24:43 test puppetd[3841]: Retrieving plugin
Sep 16 22:24:43 test puppetd[3841]: Format s not supported for Puppet::FileServing::Metadata; has not implemented method 'from_s'
Sep 16 22:24:43 test puppetd[3841]: Puppet::Network::Format[json]: false value when expecting true
Sep 16 22:24:43 test puppetd[3841]: Finishing transaction -609701378 with 0 changes
Sep 16 22:24:43 test puppetd[3841]: Fact syncing is deprecated as of 0.25 -- use 'pluginsync' instead
Sep 16 22:24:43 test puppetd[3841]: Retrieving fact
Sep 16 22:24:43 test puppetd[3841]: Format s not supported for Puppet::FileServing::Metadata; has not implemented method 'from_s'
Sep 16 22:24:43 test puppetd[3841]: Puppet::Network::Format[json]: false value when expecting true
Sep 16 22:24:43 test puppetd[3841]: (/File[/var/lib/puppet/facts]) Failed to generate additional resources using 'eval_generate': Error 400 on SERVER: Not authorized to call search on /file_metadata/facts with {:ignore=>[".svn", "CVS"], :links=>"manage", :recurse=>true} 
Sep 16 22:24:43 test puppetd[3841]: Format s not supported for Puppet::FileServing::Metadata; has not implemented method 'from_s'
Sep 16 22:24:43 test puppetd[3841]: Puppet::Network::Format[json]: false value when expecting true
Sep 16 22:24:44 test puppetd[3841]: (/File[/var/lib/puppet/facts]) Failed to retrieve current state of resource: Error 400 on SERVER: Not authorized to call find on /file_metadata/facts  Could not retrieve file metadata for puppet://..fqdn../facts: Error 400 on SERVER: Not authorized to call find on /file_metadata/facts 
Sep 16 22:24:44 test puppetd[3841]: Finishing transaction -610061128 with 0 changes
Sep 16 22:24:45 test puppetd[3841]: Format s not supported for Puppet::Resource::Catalog; has not implemented method 'from_s'
Sep 16 22:24:45 test puppetd[3841]: Puppet::Network::Format[json]: false value when expecting true

puppet.conf on client

[main]
server=**fqdn of puppetmasterd**
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
pluginsync=true
node_name=cert
certname=**fqdn of client**

puppet.conf on server

[main]
logdir=/var/log/puppet
vardir=/var/lib/puppet
ssldir=/var/lib/puppet/ssl
rundir=/var/run/puppet
factpath=$vardir/lib/facter
pluginsync=true

[puppetmasterd]
templatedir=/var/lib/puppet/templates
storeconfigs = true
dbadapter = mysql
dbuser = puppet
dbpassword = **password**
dbserver = localhost
dbsocket = /var/run/mysqld/mysqld.sock

fileserver.conf on server

[files]
  path /etc/puppet/files
  allow *

[modules]
  allow *

[plugins]
  allow *

auth.conf on server

path ~ ^/catalog/([^/]+)$
method find
allow *

path /certificate_revocation_list/ca
method find
allow *

path /report
method save
allow *

path /file_metadata
auth any
allow *

path /file
allow *

path /certificate/ca
auth no
method find
allow *

path /certificate/
auth no
method find
allow *

path /certificate_request
auth no
method find, save
allow *

path /
auth yes
allow *

I've been trying to figure out a way to test if a resource is already defined in another file, and if not create it? A quick example:

  if File[$local_container] {
    alert("Testing - It existed $local_container")
  } else {
    file{ "$local_container":
      ensure => directory,
    }
  }

However - File[$local_container] always seems to evaluate to true. Is there a way to do this?