pilcrow's questions

Is there a way I can move a secondary IP into its own namespace while keeping the primary IP on the original device?

If I have 10.0.0.1 and 10.0.0.2 on device eth0, but I want 10.0.0.2 to be in its own netns test, the closest I've come to that involves adding a veth pair and a bridge, and moving the eth0 primary IP to the bridge:

  netns: test              netns: default
==============     ===============================
vethB:10.0.0.2 <-> vethA <-> br0:10.0.0.1 <-> eth0

Unfortunately moving the 10.0.0.1 IP off of eth0 will confuse a few opaque legacy applications on the box, so I'd prefer to keep that on eth0.

I've got several systems with an ext3 lv / that work just fine until fsck'd — then they are unrecoverably corrupted.

What hope do I have of repairing these systems, and, separately, what went wrong?

These are all old systems that began as 2.6 centos-ish boxes with several separate ext3 logical volumes: /, /var, and /unused. They were migrated to a modern Linux running kernel 3.4 by installing on the /unused partition and then booting to that new installation. Once running, the old / and /var were lvremove'd, and the new root was renamed and lvextend'ed to absorb the space. From what I've been able to gather, the new root was resize2fs'd live after the lvextend. (This might be the root of the problem.)

They all run fine until an fsck is forced, at which point the fsck complains mightily and renders the system unbootable (panic). Lots of errors like:

Inode 12345 has INDEX_FL flag set but is not a directory
Inode 67890, i_blocks is 1307617, should be 0.
Inode 34567, i_size is 5616670468207675, should be 0.
... and on and on, followed by lots of multiply claimed inodes, sometimes with ...
Error storing directory block information (inode=76543, block=0, num=98765432): Memory allocation failed

For context, the original partitions were created under CentOS' e2fsprogs-1.39-20, the resize2fs'ing under 1.42.9-4, and the current system is at CentOS' older (don't ask) 1.41.12-12.

What is best practice for RPM packaging something that provides a library which in name shadows a system library?

Background: For an RPM-backed Linux system, I am packaging a "self-contained" app foo that wants to live under /opt and supply as many of its own dependencies as it can, so as not to rely on the versions installed on the main system. (foo uses LD_LIBRARY_PATH to avoid system libraries.)

Unfortunately, one of the foo dependencies is a library grunk, whose version is exactly that of the libgrunk.so required for the main system. RPM's automatic Provides: generation then identifies two RPMs as providing this library. (That's not really true — only the system package makes the library available to any program whatsoever, whereas the foo package makes it available only to foo.)

This confounds automatic dependency resolution sometimes. For example, yum might install the wrong package or only one package when two are needed.

Example:

grunk-libs-1.2-3.$arch.rpm              # System Library
  Files:
    %{_libdir}/libgrunk.so.1
    %{_libdir}/libgrunk.so.1.2
  Provides:
    libgrunk.so.1()(%{_arch})

foo-x.y.z-r.$arch.rpm                   # App
   Files:
     /opt/foo
     /opt/foo/bin/...
   Requires:
     libgrunk.so.1()(%{_arch})          # foo needs grunk, but wants its own instance

foo-grunklibs-1.2-1.$arch.rpm           # App Dependency
  Files:
    /opt/foo/libs/libgrunk.so.1
    /opt/foo/libs/libgrunk.so.1.2
  Provides:
    libgrunk.so.1()(%{_arch})           # <-- same as from system "grunk-libs"

I've disabled AutoReqProv for now, but I want to be able to take advantage of RPM's automatic capabilities and dependency generation. I want RPM to know that foo.rpm does require foo-grunklibs.rpm by virtue of the latter's libgrunk.so.1, but also know that the same library from the main system rpm won't suffice.

I think I'm at the limits of conventional use. Is there a packaging technique I can use here to resolve this?

Can rpm be persuaded to import and fetch public keys from an arbitrary pubkey database?

On the same build machine I've got two automated users who each need to verify package signatures from different sources, signed under different keys. If I rpm --import pkg-source1.pub pkg-source2.pub, each user will be able to verify packages intended for the other. I'd rather each user not know about the other's public keyring.

Is there a way I can specify an alternate or supplementary pubkey database on a per-user or per-rpm(8)-invocation basis?

Is there a way to compact a very large directory under EXT2/EXT3 without simply remaking the directory?

I recall that perlfunc cautions that the OS implementations of seekdir and telldir run the risk of directory compaction. which sounds like what I want in this case, but I'm unfamiliar with those semantics in practice.

background: I've a few directories that are themselves many MB in size -- they were overrun with a zillion small files in the past:

$ ls -lh
drwxr-x--- 2 root root 1.3M Oct  5 12:49 big
drwxr-x--- 2 root root 2.3M Oct  5 12:49 this_one_is_empty_now
drwxr-x--- 2 root root 6.1M Oct  5 12:49 yikes

Has anyone written a compatibility wrapper for svlogd to function as a drop-in replacement for multilog?

I'm a fan of UNIX process supervision in the style of daemontools and lately of runit. While runit offers a compatibility mode for many of the daemontools utilities, there is AFAIK no such offering for svlogd. I've got a few systems I'd like to switch over to runit, but I'd rather not modify the .../log/run scripts of every supervised process on those machines.

Thanks.

Scenario:

I've got a network with a few score RPM-based machines, and need to standardize and sometimes en masse update some predictable *NIX configuration files: nsswitch.conf, ntp.conf, ldap.conf, syslog.conf, etc.

(I control what settings I can at boot-time, and veil most network changes with sly A record changes, but sometimes I do need to reach into the machines and turn a knob.)

Now, I can revise existing and introduce new packages into these boxen' RPM repositories, and my thought is to standardize their configuration by introducing "configuration-only" RPMs

Question

The idea of summarily replacing /etc files owned by some other RPM gives me pause, however. Does anyone have practical guidance for this endeavour, particularly recommendations for doing this safely?

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which:

1. Rotates based on size of data written
2. Prunes written files, keeping only the N most recent
3. Does not re-use output filenames
4. Is self-contained
   (Ruling out, e.g., a rotation with external pruning via crond(8)+tmpwatch(8))

Basically I want a multilog or svlogd that groks the pcap record format.

The -W filecount option of tcpdump-4.0.0 "prunes" by recycling old filenames, which violates #3 above, forcing me to consult mtimes to determine recency and providing no guarantees against surprise truncation of the log file.

The -G option introduces strftime(2)-specifier support in output filenames, which would give me at least second-precision in file names, but I can't figure out how to get pruning to work with this scheme.

How can I update WinXP clients' web proxy and default printer settings after a successful OpenVPN connect and VPN'd DHCP negotiation? (And how can I remove those settings upon VPN disconnect?)

I'm sure this is a solved problem -- it's not conceptually too different from automating the non-VPN'd transitions for a laptop going from one network to another -- but my XP knowledge is rather shallow and I couldn't find a recipe for doing this.

How can I rename a local user account from the XP command prompt?

Is there a NET.EXE personality that I've missed? (I also didn't see anything under Useful Commandline Commands on Windows.) Thanks.

Question: How can I disable inet6 AAAA queries for my LDAP server during (LDAP-backed) NSS lookups on a CentOS (RHEL) 5 machine?

Background: I've servers configured to consult ldap://ldap.internal for NSS passwd and group lookups. Every relevant NSS lookup, for example the getpwuid(3) implied by an ls -l which needs to translate UIDs to network user names, performs the following DNS dance before connecting to the ldap server:

AAAA? ldap.internal          -> (no records)
AAAA? ldap.internal.internal -> NXDomain
A?    ldap.internal          -> 192.168.3.89

I'd like to skip the first two queries completely. Configuration:

[server]$ cat /etc/redhat-release 
CentOS release 5.4 (Final)
[server]$ grep ^passwd /etc/nsswitch.conf 
passwd:     files ldap
[server]$ grep ^uri /etc/ldap.conf
uri ldap://ldap.internal/

For what it's worth, IPv6 support is otherwise disabled on these systems:

[server]$ grep off /etc/modprobe.conf
alias ipv6 off
alias net-pf-10 off
[server]$ echo "$(ip a | grep -c inet6) IPv6-enabled interfaces"
0 IPv6-enabled interfaces

I'd like to schedule the forcible logoff of idle XP Home users, who have been "logged off" in the sense that they've been "switched" out of their console sessions, but still have processes running. How can I do this?

I'm aware of qwinsta.exe and logoff.exe. I think I'm close to a solution, but am not familiar enough with Windows scripting to make a coherent batch file nor scheduling (under Unix it'd be as simple as cron, awk, and xargs...).