Bo Jeanes's questions

According to http://net-snmp.sourceforge.net/docs/mibs/ucdavis.html#scalar_notcurrent ssCpuUser, ssCpuSystem, ssCpuIdle, etc are deprecated in favor of the raw variants (ssCpuRawUser, etc).

The former values (which don't cover things like nice, wait, kernel, interrupt, etc) returned a percentage value:

The percentage of CPU time spent processing user-level code, calculated over the last minute.

This object has been deprecated in favour of 'ssCpuRawUser(50)', which can be used to calculate the same metric, but over any desired time period.

The raw values return the "raw" number of ticks the CPU spent:

The number of 'ticks' (typically 1/100s) spent processing user-level code.

On a multi-processor system, the 'ssCpuRaw*' counters are cumulative over all CPUs, so their sum will typically be N*100 (for N processors).

My question is: how do you turn the number of ticks into percentage?

That is, how do you know how many ticks per second (it's typically — which implies not always — 1/100s, which either means 1 every 100 seconds or that a tick represents 1/100th of a second).

I imagine you also need to know how many CPUs there are or you need to fetch all the CPU values to add them all together. I can't seem to find a MIB that gives you an integer value for # of CPUs which makes the former route awkward. The latter route seems unreliable because some of the numbers overlap (sometimes). For example, ssCpuRawWait has the following warning:

This object will not be implemented on hosts where the underlying operating system does not measure this particular CPU metric. This time may also be included within the 'ssCpuRawSystem(52)' counter.

Some help would be appreciated. Everywhere seems to just say that % is deprecated because it can be derived, but I haven't found anywhere that shows the official standard way to perform this derivation.

The second component is that these "ticks" seem to be cumulative instead of over some time period. How do I sample values over some time period?

The ultimate information I want is: % of user, system, idle, nice (and ideally steal, though there doesn't seem to be a standard MIB for this) "currently" (over the last 1-60s would probably be sufficient, with a preference for smaller time spans).

If a client does not execute a command (e.g. with -N) within some timeframe (1-2 seconds) after establishing the SSH connection, I'd like to terminate it from the server.

Unfortunately, ForceCommand and authorized_keys-prefixed commands do not execute either when run with -N, but clients could still conceivably request remote forwards (-R) tying up ports on your server.

I'd like to prevent this scenario but prefixing the keys with no-port-forwarding isn't an option because if they run a command I want to allow port forwarding. In this case my forced command executes and I can do validation to ensure that it is allowed.

Is my only option having some external process monitor sshd instances and check if they have any child processes (e.g. shell or executed command)?

I'm aiming to start up a second sshd instance on a non-privileged port (e.g. 2222) with my own configuration file.

Obviously, the sshd process can't setuid so logging in as users other than the one who is running the sshd daemon is clearly impossible.

However, is it possible to have a working sshd daemon that will work for the currently running user? For my use case, this would be fine.

I tried booting up an sshd instance with my own config file and host key and the sshd process starts up (no complaints about not being root, like some commands), however when I try to connect to that port, the sshd process dies.

$ /usr/sbin/sshd -dD -h .ssh/id_rsa -p 2222 
debug1: sshd version OpenSSH_5.6p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: setgroups() failed: Operation not permitted
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-dD'
debug1: rexec_argv[2]='-h'
debug1: rexec_argv[3]='.ssh/id_rsa'
debug1: rexec_argv[4]='-p'
debug1: rexec_argv[5]='2222'
debug1: Bind to port 2222 on 0.0.0.0.
Server listening on 0.0.0.0 port 2222.
debug1: Bind to port 2222 on ::.
Server listening on :: port 2222.
debug1: fd 6 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 6 out 6 newsock 6 pipe -1 sock 9
debug1: inetd sockets after dupping: 5, 5
Connection from ::1 port 57670
debug1: Client protocol version 2.0; client software version OpenSSH_5.6
debug1: match: OpenSSH_5.6 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: list_hostkey_types: 
No supported key exchange algorithms
debug1: do_cleanup
debug1: do_cleanup
debug1: audit_event: unhandled event 12

The debug1: setgroups() failed: Operation not permitted line obviously sticks out, but it doesn't die until it tries to accept a connection.

(I can't decide between posting this here or on SuperUser but since this is for a sysadmin purpose, this seems like a better fit)

I have a situation where SSH clients will request a port forward using the -R option of SSH. At connection time, I want to be able to log which ports they forwarded.

I plan to do this by forcing a particular command to run (command=my-command in the authorized_keys file, that is) which will do this logging and then run the original command (login or user specified).

The only way I've found to do this so far requires running sudo and feels pretty hacky:

sudo lsof [email protected] -Fn -p12345 | grep "^n" | grep -v '\->' | awk -F: '{print $NF}' | sort | uniq* where 12345 is the process ID of the sshd that is handling this connection (i.e. the parent process of whatever script I run to check it.

Is there anything more elegant (a la the SSH_* environment variables that get set for other connection information) available to me?

_{* For the curious, the first part of the command gets all network ports bound to local interface ([email protected]) and (-a) belonging to process 12345 (-p12345) and formats it for machine readability (-Fn). The -P and -n flags makes it give the raw port numbers and network addresses. The second part (grep "^n") gives me back just the network information. The next part (grep -v '\->') eliminates established connections (thereby leaving "listening" ports). The next part (awk -F: '{print $NF}') uses awk to get the last field separated by ':', giving me the port (I don't use cut here because for an IPv6 connection, the field number might change). The last 2 parts just give me a unique list of ports. I put this explanation here because lsof is a fantastic command to know, and everyone should.}

I want to update/freshen a file in a zip archive with the contents of stdin. So far I haven't been able to find a way to tell the zip command that the contents of stdin correspond to a particular file.

E.g. (the last line is how I'd expect it to work but it doesn't make any changes to the zip file):

~/D/tmp ♪ unzip -l sample.odt # an odt file is actually a zip file
Archive:  sample.odt
  Length     Date   Time    Name
 --------    ----   ----    ----
       39  01-06-10 00:46   mimetype
        0  01-06-10 00:46   Configurations2/statusbar/
        0  01-06-10 00:46   Configurations2/accelerator/current.xml
        0  01-06-10 00:46   Configurations2/floater/
        0  01-06-10 00:46   Configurations2/popupmenu/
        0  01-06-10 00:46   Configurations2/progressbar/
        0  01-06-10 00:46   Configurations2/menubar/
        0  01-06-10 00:46   Configurations2/toolbar/
        0  01-06-10 00:46   Configurations2/images/Bitmaps/
     3374  01-06-10 00:46   content.xml
    11837  01-06-10 00:46   styles.xml
      957  01-06-10 00:46   meta.xml
     1060  01-06-10 00:46   Thumbnails/thumbnail.png
     8086  01-06-10 00:46   settings.xml
     1889  01-06-10 00:46   META-INF/manifest.xml
 --------                   -------
    27242                   15 files
~/D/tmp ♪ unzip -p sample.odt meta.xml > tmp.xml
~/D/tmp ♪ # modify tmp.xml somehow
~/D/tmp ♪ cat tmp.xml | zip sample.odt -u meta.xml

EDIT (Taken from my comment below): I can't just load the file directly into the zip file by referencing the new version because the initial extraction is never being redirected to a file in my actual situation. Instead to a database where it undergoes some text processing in a background queue. It is then substituted back into the document on demand.