andreas-h's questions

My work calendar is stored on my employer's Horde server. I also have my own owncloud instance running.

What I would like to do is store also my work calendar on my owncloud instance, and have a script which mirrors this calendar to my Horde account. I know that only I make changes to the calendar on the Horde server, so a one-directional sync from owncloud to Horde would be just fine.

Both owncloud and Horde support CalDAV; Horde in adition has some XMLRPC service. I have root access to the owncloud instance, but for the Horde server, I only have Horde's web login. I'd be grateful for any suggestions on how to do this synchronisation. Unfortunately, I haven't been able to find any solution yet.

In a recent PCIDSS scan at a client of mine, I got aware of Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability (CVE-2004-2320, CVE-2007-3008). The proposed mitigation for Apache is this:

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{REQUEST_METHOD} ^TRACE
  RewriteRule .* - [F]
</IfModule>

How can I achieve the same in Lighttpd?

Your help is greatly appreciated!

I need to get a list of names of files with non-zero size inside a directory. This should be in a shell script, so bash (or a Perl one-liner) would be ideal.

On a system running Gentoo Linux (3.1.6, x86_64), I have two six-core Intel Xeon CPUs (X5675).

cat /proc/cpuinfo correctly shows me 12 processors. However, I don't understand why the processor speed in the model name line differs from the cpu MHz number:

processor   : 11
vendor_id   : GenuineIntel
cpu family  : 6
model       : 44
model name  : Intel(R) Xeon(R) CPU           X5675  @ 3.07GHz
stepping    : 2
cpu MHz     : 1600.000
cache size  : 12288 KB
physical id : 1
siblings    : 6
core id     : 10
cpu cores   : 6
apicid      : 52
initial apicid  : 52
fpu     : yes
fpu_exception   : yes
cpuid level : 11
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm dca sse4_1 sse4_2 popcnt lahf_lm ida arat epb dts tpr_shadow vnmi flexpriority ept vpid
bogomips    : 6133.17
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual
power management:

EDIT: htop shows all processors at 100%, and the load average is 24.66 24.33 24.67. So it seems none of the processors are idling. However, a watch -n5 "cat /proc/cpuinfo | grep MHz" shows that the first six cores are constantly at 3067MHz, while cores 7-12 are always at 1600MHz. I'm puzzled. I'm not sysadmin of these machines, but before I start bugging our sysadmins about this, I wanted to be sure that this is not the behaviour which is to be expected. Is there any way to find out if SpeedStep is enabled without going into the BIOS, i.e. with non-root-priviledges?

EDIT2: as requested, I posted a full output of /proc/cpuinfo here: https://gist.github.com/4683911

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log

Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 07:33:47 xen8 sshd[29826]: pam_unix(sshd:session): session closed for user root
Jan 28 09:45:58 xen8 sshd[14374]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 28 09:47:36 xen8 sshd[14374]: pam_unix(sshd:session): session closed for user root
Jan 29 07:37:48 xen8 sshd[24940]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 07:38:11 xen8 sshd[24940]: pam_unix(sshd:session): session closed for user root
Jan 29 08:35:13 xen8 sshd[25707]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 08:37:06 xen8 sshd[25707]: pam_unix(sshd:session): session closed for user root
Jan 29 16:59:39 xen8 sshd[30725]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 17:00:58 xen8 sshd[30725]: pam_unix(sshd:session): session closed for user root
Jan 29 17:11:17 xen8 sshd[30832]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jan 29 18:11:37 xen8 sshd[30832]: pam_unix(sshd:session): session closed for user root

Via the process id, one should be able to find matching logins/logouts, and then one could calculate the time. But my sed/awk skills are very limited, and maybe there's even a ready-made script/tool for this task out there? Is there an easy way to extract the times a user was logged in? Either in a total (per file), or maybe even with some nice graphics?

I'm not sure if the heading is really coorect. I have a line in my rsnapshot.conf

backup  [email protected]:/mnt/rsnapshot/      srv01/

So rsnapshot creates a directors RSNAPSHOT_ROOT/daily.0/srv01/mnt/rsnapshot and puts the backed-up files there. For me, the /mnt/rsnapshot part is unnecessary; I'd rather have my backed-up files directly in RSNAPSHOT_ROOT/daily.0/srv01/. Is there any way to achieve this?

I'm working on a server with several admin users. Each of them can use sudo to make configuration changes. We're keepeing our /etc directory version-controlled using etckeeper.

However, when I or another admin calls sudo etckeeper commit COMMITMESSAGE, git uses the root user's name and e-mail for the commit message. Setting git config user.name on the etc repository doesn't work in this case, because then each time etckeeper commit is called, the same data will be used.

What I want is the actual user's name and email be present in the etckeeper git repository, so that from the commit log I can track down who did which change.

Any help is greatly appreciated!

I have a Xen host system based on Debian Squeeze, and installed xen-tools. I would like to setup a CentOS domU using xen-create-image. xen-tools already 'knows' of CentOS-5, but I cannot seem to get xen-create-image working correctly. I have trouble finding out the necessary parameters I need to pass to xen-create-image (especially mirror?). And, of course, it would be nicer to use CentOS-6.

So, how do I create a CentOS-6 (or 5) domU on a Debian Squeeze dom0 (both x86_64), preferably using xen-create-image?

Raionale: I want to be able to automatically make backups to a remote machine, which will be encrypted with ecryptfs.

The title says it all:

I set up ecryptfs-utils on my Debian Squeeze box, and set up one user to use it via ecryptfs-setup-private. When I log in via SSH using password authentication, the ~/Private directory automatically gets mounted.

How can I achieve that ~/Private also automatically gets mounted when logging in via SSH using public key authentication? Obviously, the best solution would be if ecryptfs could somehow 'use' the SSH public key to en/decrypt the data (I know that then using the user's password would not be able to en/decrypt the data any more; this would be acceptable). Probably, this will not work. So perhaps somehow call ecryptfs-mount-private via ssh before logging in via public key? Probably, then I would need to somehow pipe the passphrase through the SSH connection, right? So I would need to store it on the source machine's file system. Not nice either. Any other ideas?

I'm planning to develop a web application. All the heavy logic will be done via SOAP webservices; this question is about the frontend which will thus have to communicate with the backend via SOAP. It should be easy to use, make using SOAP services easy, and integrate AJAX functionality in a nice way. I was thinking something in PHP, but am basically open to other suggestions.

Thanks for your suggestions!

we are handling SSL with a pound 2.3 HTTP(S) proxy. Is there any way to force a client's Browser to use SSLv3? I couldn't find anything in the pound documentation ...

Thanks for your insight!

Cheers,

Andreas.

I'd like to compile a recent Linux kernel (2.6.34) for my Ubuntu 10.04 Lucid Lynx AMD64 box, mainly because I'd like to use it as a dom0 kernel with the recent xen4. There's plenty documentation on the web about how to compile a kernel 'Debian style'. But what I think would be nice to start with an 'official' Ubuntu config to be sure not to miss any important things and having to recompile over and over again.

So what I'd like to do is compile 2.6.34, but starting with the 'official' /boot/config-2.6.32-XX from Ubuntu Lucid. The question is: How do I best do that? If I just take the config from 2.6.32, the new features from 2.6.33/34 won't be in the config. So what I'd like to do is somehow the 2.6.34 config with the original 2.6.32 one from Ubuntu. How can I best do that? Does it even make sense? Is there easier ways to achieve what I want?

Thanks for your insight!

A.

PS: I just found a linux-image-2.6.32-bpo.4-xen-amd64 package on backports.org, but no information about it. Would it work as a dom0 kernel on Lucid?

in MySQL5.1, is there a way to make one table accessible by two different names? I'm thinking about somethink like a symlink on linux filesystems.

I know theres the

CREATE VIEW myview AS SELECT * FrOM mytable

thing, but I don't only need to SELECT from both names, but also delete etc ...

You might ask why I want to do this? It's about getting a commercial, closed-source app to work, which is crappily programmed (usually, the table names are all lower-case, but occasionally, they use capitalized names for the same table ...). Oh, that would be another idea: Is there a way to tell MySQL not to care about capitalization of table names (like on Windows filesystems?)? that would also do the trick ...

... found the answer: lower_case_table_names, a variable. Since this is the solution to my problem, but not the answer to my question (which is still interesting), i don't answer my own question yet ...

Thanks for your insight!

A.

I would like to have one central git repository for all my servers' etckeeper .git repos. Here the suggestion was to use a file in /etc/etckeeper/commit.d, which basically looks like this, assuming that a git repo had been set up in somedir on somehost:

#!/bin/sh
cd /etc
git push faruser@farhost:somedir

The problem with this is, that it would be really nice to have all servers in the same repo on the central server. I tried

git push faruser@farhost:somedir/server1

but that failed.

As you can see, I've never worked with git before ... Any ideas on how this can be accomplished is greatly appreciated :)

Cheers,

Andreas

I would like to be able to run automatic apt-get upgrade (once per hour) on our servers (Ubuntu 10.04), so that I don't have to do it manually on all of them (about 15). However, for production machines, that's not a good idea ...

So here's my idea:

Set up a local repository for all 'approved' updates for critical packages. I would then push updated packages from upstream to our local repo after I tested them, and all servers could automatically (apt-cron?) upgrade from this repository.

So my question is this: How do I configure apt on the clients so that they use the local repository only for all packages which exist on the local repository, and the upstream one for all other packages?

Does this actually make sense? Or am I missing something?

Anyways, thanks for your insight!

Andreas.

I'm planning a new infrastructure for our web application. We have two JBossAS5 servers, running in a cluster. Session state will be replicated via JBoss Cache.

In front of that, there should be some cache, to speed up delivery of static elements. However, most of the traffic to our app will be via HTTPS.

So far, I had been thinking of two Varnish caches in front of the JBossASs, each being configured for loadbalancing to the two JBossASs via round-robin. Since Varnish doesn't handle HTTPS, then there would need to be two pound proxies in front of the Varnishs, dealing with the HTTPS. The two pounds would be made high-available with Heartbeat/LinuxHA.

The traffic to www.example.com would then be going through our firewall, from there to the virtual IP of the pounds, from there to the Varnishs, and from there to the JBossASs.

Question 1: Does this make sense? Or is it overly complicated, and the same goal can be reached with simpler methods?

Question 2: If my layout is fine, how do I configure the pound -> Varnish step? Should I a) make the Varnish service high-available through Heartbeat/LinuxHA as well and direct traffic from pound to the virtual IP of the Varnishs, or should I rather b) Configure two independent Varnishs and use load-balancing in pound to address the different Varnishs?

Getting hardware loadbalancing is not an option, unfortunately, because of costs. This is no corporate, but a NGO system, and we're always short on money ... The whole thing is not mission-critical, but I'd like it to be as reliable as possible, because our IT is not always available on short notice (we don't have any full-time IT person employed ...).

Thanks a lot for your insight!

Andreas.

I know the sender address verification in Postfix is a good thing. However, I would like to disable this check for one certain domain from which I get mails but which does not exist in DNS. How can I do that?

for the 5 (physical) servers in our datacenter, I'm looking for a unified virtualization design. All 5 servers do not come with hardware virtualization support (older XEONs). Since we're an NGO on low budget, price does play a key role here.

The number of virtual machines needed varies with the choice we make for our deployment strategy (JBoss/PostgreSQL clusterin, Load-Balancing, etc.) In total, we need about 15, most of them with very low performance needs.

So far, we've made good experiences with XEN (open source), but we don't have any experience with unified management solutions for XEN environments (Ganeti, openQRM, Citrix XENServer, ...).

In case it is important: All servers are running on Linux software RAID1.

So my questions are:

• Is there a considerable performance loss of para-virtualized Linux guests vs. Linux directly running on the hardware (i.e. with no virtualization)? If yes, I think it would be possible to organize the servers in a way that the performance critical applications run on non-virtualized hosts. If I understand openQRM correctly, it would be possible to manage these servers also. What about other solutions?
• Which (free) management solution would you recommend? In particular, would it be possible to manage the whole system using XENServer? If, at a later stage, we should be able to afford new hardware (in particular, a shared storage solution), this solution should be able to support (live?) migration of guests from one host to another.
• I suppose all management solutions need a dedicated, non-virtualized management server? What if this fails? How to come around this reliability-bottleneck?

Thanks a lot for your advice!

we are currently developing a JBoss application. To deploy it, we have a total of four servers (three years old). I am wondering which might be the best to do?

There could be a load balancer (even a load-balancer cluster, for failover) in front of two servers, each holding one JBoss and one PostgreSQl host inside XEN environments.

Does this make sense? Are there other, better options?

Thanks a lot for your advice!

I am running Bacula on a RedHat box. From time to time, the storage daemon bacula-sd stops working and becomes <defunct>.

[root@backup ~]# ps -ef | grep defunct | more
root      4801 29261  0 09:25 pts/5    00:00:00 grep defunct
root      5825     1  0 Oct18 ?        00:00:00 [bacula-sd] <defunct>

My question is, how can I kill this process? Its parent is 1, which is init, as far as I know, and I wouldn't want to kill the init process, would I?

'Normally' killing this process does not work:

[root@backup ~]# kill -0 5825
[root@backup ~]# kill -9 5825

Help is greatly appreciated!

Edit: running

[root@backup ~]# lsof -p 5825

produces the following output:

COMMAND    PID USER   FD   TYPE  DEVICE     SIZE    NODE NAME
bacula-sd 5825 root  cwd    DIR   253,0     4096 3801089 /root
bacula-sd 5825 root  rtd    DIR   253,0     4096       2 /
bacula-sd 5825 root  txt    REG   253,0  2110599  368004 /usr/local/sbin/bacula-sd
bacula-sd 5825 root  mem    REG   253,0    75284  389867 /usr/lib/libz.so.1.2.3
bacula-sd 5825 root  mem    REG   253,0    46680 3604521 /lib/libnss_files-2.5.so
bacula-sd 5825 root  mem    REG   253,0   936908  369115 /usr/lib/libstdc++.so.6.0.8
bacula-sd 5825 root  mem    REG   253,0   125736 3606807 /lib/ld-2.5.so
bacula-sd 5825 root  mem    REG   253,0  1602128 3606885 /lib/libc-2.5.so
bacula-sd 5825 root  mem    REG   253,0   208352 3606892 /lib/libm-2.5.so
bacula-sd 5825 root  mem    REG   253,0   125744 3606887 /lib/libpthread-2.5.so
bacula-sd 5825 root  mem    REG   253,0    25940 3604573 /lib/libacl.so.1.1.0
bacula-sd 5825 root  mem    REG   253,0    15972 3604535 /lib/libattr.so.1.1.0
bacula-sd 5825 root  mem    REG   253,0    46548 3606908 /lib/libgcc_s-4.1.2-20080102.so.1
bacula-sd 5825 root  mem    REG   253,0 56422480  366368 /usr/lib/locale/locale-archive
bacula-sd 5825 root    0r   CHR     1,3             1545 /dev/null
bacula-sd 5825 root    1r   CHR     1,3             1545 /dev/null
bacula-sd 5825 root    2r   CHR     1,3             1545 /dev/null
bacula-sd 5825 root    3u   CHR   9,128             6469 /dev/nst0
bacula-sd 5825 root    4u  IPv4 1023380              TCP backup:bacula-sd (LISTEN)
bacula-sd 5825 root    5u  IPv4 2693268              TCP backup:bacula-sd->backup:53957 (CLOSE_WAIT)
bacula-sd 5825 root    7u  IPv4 3248683              TCP backup:bacula-sd->backup:57629 (CLOSE_WAIT)
bacula-sd 5825 root    8u  IPv4 3250966              TCP backup:bacula-sd->backup:37650 (CLOSE_WAIT)
bacula-sd 5825 root    9u  IPv4 3253908              TCP backup:bacula-sd->backup:37671 (CLOSE_WAIT)