Hanno Fietz's questions

I need to deploy PHP and Python code and the appropriate environment (web server, db server) to remote Windows systems, and I don't know what toolchain would be the equivalent to ssh, scp, bash and the like.

So, basically, what I need to be able to do is the following:

• access remote Windows with the appropriate privileges in a secure manner, like I routinely do with ssh (I don't even know whether that would be a text or graphic interface on Windows).
• remotely install software: Apache or IIS, MySQL or Postgres, Python or PHP
• copy files from remote (the application we're deploying)
• remotely configure the machine to run regular tasks (e. g. checking for updates to the application)
• automate tasks like downloading files from a designated place

The main question is probably how I get onto the machine securely in the first place, and then the rest is general Windows admin knowledge, which probably is too broad a scope to fit into one question.

I have years of experience with maintaining Linux boxes and I have used tools of varying sophistication on those, ranging from plain scping of PHP files to deployment of Java application containers and even full VMs with Vagrant.

On Windows, I'm a complete noob, and I don't even know where to start. I have installed Apache, MySQL , PHP on a desktop machine maybe twice in my life, that's about it.

Bonus points for things that work from a Linux machine at my end, but I could run a VM and do everything from there.

I'm new to IPsec and struggling with a setup that might soon be widely used in our operations (provided I do understand it, eventually...).

A cellular router (blackbox by netModule, from its log messages it seems to be running Linux and OpenSwan) connects a sensor network on customers' sites with our public server. We need to be able to connect into the local network, so I had the cell provider give me a public IP (a dynamic one). The way their setup works, the public IPs only allow IPsec traffic.

I set up OpenSwan on our Ubuntu server (running Jaunty). This is my connection config from /etc/ipsec.conf:

conn gprs-field-devices
    left=my.pub.lic.ip
    [email protected]
    #leftsubnet=192.168.1.129/25
    right=%any
    [email protected]
    #rightsubnet=192.168.1.1/25
    #rightnexthop=%defaultroute
    auto=add

On the router, all I have is the Web UI, in which I made the following settings:

• "Remote endpoint": public IP of server, same as "left" above
• "Local Network Address": 192.168.1.1
• "Local Network Mask": 255.255.255.128
• "Remote Network Address": 192.168.1.129
• "Remote Network Mask": 255.255.255.128

The pluto process on the server is listening for connections on port 500. It can't open a tunnel, obviously, because it doesn't know at which IP the client is.

I set up a passphrase as PSK for @field.econemon.com in /etc/ipsec.secrets and also configured it in the router (which doesn't seem to support certificates).

My problem is, nothing happens. The router just says, IPsec is "down". When I copy-paste the IP into ipsec.conf (for "right="), and ask the server to ipsec auto --up gprs-field-devices, it just hangs until I press Ctrl-C.

Is there anything wrong with my setup? How can I debug this further?

My router gives the following loglines that seem related, but don't tell me anything:

Feb 21 23:08:20 Netbox authpriv.warn pluto[2497]: loading secrets from "/etc/ipsec.secrets"

Feb 21 23:08:20 Netbox authpriv.warn pluto[2497]: loading secrets from "/etc/ipsec.d/hostkey.secrets"

Feb 21 23:08:20 Netbox authpriv.warn pluto[2497]: loading secrets from "/etc/ipsec.d/netbox0.secrets"

Feb 21 23:08:20 Netbox authpriv.warn pluto[2497]: "netbox00" #1: initiating Main Mode

Feb 21 23:08:20 Netbox daemon.err ipsec__plutorun: 104 "netbox00" #1: STATE_MAIN_I1: initiate

Feb 21 23:08:20 Netbox daemon.err ipsec__plutorun: ...could not start conn "netbox00"

Feb 21 23:08:22 Netbox authpriv.warn pluto[2497]: packet from 188.40.57.4:500: ignoring informational payload, type NO_PROPOSAL_CHOSEN

Feb 21 23:08:22 Netbox authpriv.warn pluto[2497]: packet from 188.40.57.4:500: received and ignored informational message

Feb 21 23:08:28 Netbox user.warn parrot.system_controller[762]: IPSECCTRLR: Tunnel 0 is down for 0 seconds

Feb 21 23:08:40 Netbox user.warn parrot.system_controller[762]: IPSECCTRLR: Tunnel 0 is down for 10 seconds

Feb 21 23:08:52 Netbox authpriv.warn pluto[2497]: packet from 188.40.57.4:500: ignoring informational payload, type NO_PROPOSAL_CHOSEN

I'm trying to deploy an embedded system (NISE 110 by Nexcom) based on the Intel EP80579 (Tolapai) chip. Tolapai apparently integrates controllers for Ethernet etc. on a single chip (Intel homepage).

The machine can't get a network connection. Diagnosis as far as I could manage:

Drivers

• drivers from Intel compiled and installed without problems (version 1.0.3-144). Kernel version and Linux distribution (CentOS 5.2, 2.6.18) match the driver's installation instructions.
• drivers are loaded and show up in lsmod (module names are gcu and iegbe)
• interfaces eth0 and eth1 show up in ifconfig

ifconfig

• I can bring up the interfaces with fixed IP
• pinging the interface locally works
• ifconfig shows flag UP but not RUNNING

Link

• ethtool shows "Link detected: no", "Speed: unknown (65536)" and "Duplex: unknown (255)"
• Link LED is on
• on the other side of the cable, ethtool shows "Link detected: yes" and reports a speed of 1000 Mbps, which has allegedly been auto-neogotiated with the problematic device.

Network traffic analysis

• the device does not reply on ARP, ICMP echo or anything else (iptables is down)
• when trying to send ICMP or DHCP requests, they never reach the other end
• activity LED is off on the device, on at the other end.

I tried the following without any effect:

• Different cables (2 straight, one crossed), I get the link LED lit up on each.
• Three different devices on the other end (one PC, one netbook, one router)
• Fixed ARP table entries on both sides
• Connecting both network ports of the machine with each other, won't ping through the cable, but will ping locally. Tried straight and crossed cables for that.

I'm gathering data from field devices, some of which will soon be behind a cellular-to-Ethernet gateway. Some of the devices need to be polled, and since the cellular carrier will usually assign changing IPs, I'm getting a gateway which has a Dynamic DNS client built in.

I would like to have the devices call my own servers instead of a public DynDNS provider. What do I need to know to get started?

I caused a stupid accident in a single-disk ZFS pool, seemingly in the same way as the person in this mailing list thread, i. e., I seem to have overwritten important metadata. Can this be restored from the actual payload, or is there a way to retrieve the payload without the metadata?

Here's what I did, exactly:

• had a ZFS pool running with a single disk on one machine
• wanted to migrate it to a new ZFS pool on another machine
• forgot to zpool export it on the first machine
• when zpool create complained that the device was in use, I thought "No problem, I just took down the host, it's not in use anymore" and did zpool create -f

What I should have done (as I realised after RTFM) is import instead of create on the new host. Now I have a working zfspool, but the filesystems are gone / invisible.

I tried to reimport the device on the old host, and later tried import -D, but, quite obviously, both didn't work.

A production server has a constant stream of incoming data which is delivered over HTTP. To test a new revision of the system, I deploy the new version to a staging server, run tests on it, and when I'm satisfied, I want to try it on the real data, but without affecting the production system.

To achieve that, I would like to copy the incoming HTTP traffic and direct the copy to the staging system. I had previously baked that into the application itself, but I don't want to do that anymore, for a number of reasons. What are my options?

• Are there proxies that do this?
• Are there web servers that do this? The closest I found was Apache's forensic module, but I'm not sure if that's suitable, it clearly has a slightly different goal.
• Or should I do it at the Internet layer?

Of course, the staging server wants to send replies somewhere, just like the production system. And naturally, these replies shouldn't go back to the production system's clients. Simply discarding them at some stage is OK, but it would be great if I could direct them to some logging facility for inspection.

I recently set up a build server that requires a JDK to run (for example, to compile the Java sources). The OpenJDK package in Ubuntu pulls in the OpenJDK JRE as a dependency which, in turn, depends on a large number of packages that are only relevant for graphical environments. For the standard JRE, there's a headless version of the package, but for the JDK, no.

This issue has been discussed in various places before, and one solution that I found and used was this:

$ apt-get --no-install-recommends -d install openjdk-6-jdk
$ dpkg -i --ignore-depends=openjdk-6-jre /path/to/just-downloaded.deb

While this worked, it now leaves my system with a broken dependency tree and apt-get refuses further installs untill I run apt-get -f.

Is there a better solution to this?

I'm developing software for the energy consulting business and in monitoring energy use in datacenters, I've noticed that the typical electric load "pattern" of a datacenter is just a flat line, because all the gear runs 24/7. If you compare this to the actual usage pattern (network load, CPU usage etc), which we did, you regularly have long stretches with little usage but the full capacity available.

These patterns are very predictable in many cases and to save energy, it would be great to turn off part of the equipment (servers, switches, storage) regularly or in low-load conditions. However, I can think of several aspects that would have to be looked at, including

• handling peak loads or sudden spikes
• data consistency among nodes
• long startup (and, possibly, synchronization) times compared to average uptime of a node

There's probably more. Is there software that handles such a scenario and what else should be looked out for? Is this a viable suggestion to make?

For my purposes, a cluster wouldn't necessarily mean to cluster machines on the OS level, identical hosts that receive requests via a load balancer (i. e. application level clustering) would also count. I'm not sure how MySQL cluster or similar work, but I'd probably count those as well.

I'm looking for advice for any operating system.

See also my post on energy efficiency over at Stack Overflow that brought up this question.

In a setup where you use Apache for PHP / Python scripts and lighttpd for static files, but only one listens on the outside IP address and acts as a proxy to the other listening on the loopback interface, which should be which, why, and does it matter?

I use tar to create a snapshot of different parts of the filesystem on my servers and then ftp that snapshot to an offsite location for archiving.

I would like to only start that operation when something has changed. Some of the backups run on all the system's folders that change very infrequently (i. e. when new software is installed or the configurations are modified).

Whenever a change does happen, I want a complete snapshot. I could produce a list of modified files with find, but I really only need to know if that list's length is 0 or greater. Using find is too slow for that.

I am aware that there is incremental backups and I'm already using rsync in conjunction with ZFS for that in other situations. However, here the backup host is an FTP server (so no rsync), I need complete backups (because the backup archive is used as an image to restore or clone servers) and I want compressed output (so tar is handy).

Edit: Note that I'm not looking for incremental backup (I have that), but rather for a fast (that kinda rules out find and the like) and easy way to decide if a full snapshot would be identical to the last one. Maybe my phrasing wasn't so good. I edited the title now.

Possible Duplicate:
hosting your own DNS

Note: I realized belatedly that this is a duplicate of question 23744, which already has good answers. I couldn't close this post for lack of reputation, maybe someone else could step in.

I use hosted servers for my company and although I might opt for colocation of more customized machines in the future, on the whole I'm not too keen on diving too deep into "datacenter business". So generally, I would like to leave the handling of my infrastructure to dedicated pros as much as possible.

Recently, I've been starting to lust for some more flexibility regarding the DNS entries for my domain and have looked into running my own name server(s). It seems to me that running a professional, failsafe name server is a little more effort than I'm willing to commit to just now. Still, I like the idea of having a lot of control over it.

For a more experienced Sysadmin, what are indications to run own name servers? And when using name servers that are professionally maintained, what self-administration options are advisable to look out for?

I own a domain econemon.com. Below is an excerpt from the DNS entry (some records omitted for brevity):

econemon.com.       1800    IN  NS  ns.stratoserver.net.
econemon.com.       1800    IN  NS  ns2.stratoserver.net.
econemon.com.       1800    IN  A   85.214.92.48

These nameservers there are those from my provider, and as far as I understood it, they are the authorative ones for my domain.

Now, when I go ask one of them for the address record of a nonexistent subdomain, it responds with the address for my server, like so:

$ host -t A nosuchdomain.econemon.com ns.stratoserver.net
Using domain server:
Name: ns.stratoserver.net
Address: 81.169.163.40#53
Aliases: 

nosuchdomain.econemon.com has address 85.214.92.48

Which is, of course, exactly what I want in order to have virtual hosts etc. Now, say I added an entry

econemon.com.    IN  NS  ns.econemon.com

and the proper A record for ns.econemon.com to the list, and that nameserver actually had different A records for some subdomains, what would happen?

• would a request for subdomain.econemon.com yield a different address depending on which name server you asked? (I guess it would.)
• if so, this might actually be useful to fall back to a "main server" if my DNS was down, but how do I make the client to use my name server when it's up?
• would this mess up caching on the clients? (Probably.)

(Note: This is related to my other two questions)

I'm trying to set up a DNS to complement the DNS provided by my hoster (see also this related question). Now I don't seem to understand my domain's DNS record, which is this (some entries omitted for brevity):

econemon.com.       1800    IN  NS  ns.stratoserver.net.
econemon.com.       1800    IN  NS  ns2.stratoserver.net.
econemon.com.       1800    IN  A   85.214.92.48

Now, I don't really grok two things, despite reading up on DNS in Wikipedia:

• Why does the nameserver, in addition to the A record, return an NS record pointing to itself? What would that be used for? My understanding was that this record would be delivered by a name server which is not responsible for the domain.
• How exactly does the client use the two NS records? Can I add more, and what is the point?

I have servers hosted at a hosting provider and they also host the DNS records for my domain names. Now I want to add subdomains that are resolved by my own DNS service. So for example:

• the hosting provider's name server knows the IP address for econemon.com
• one of my servers knows the IP address for ftp.econemon.com

Also,

• unknown or undefined subdomains should be routed to the same IP as the parent domain
• on failure of my DNS service, it would be great if the requests all go to the IP address that is associated with econemon.com, but I'm not sure how that should work.

Now, I've read through the Wikipedia articles on DNS to dust off my knowledge, but the part that leaves me confused is: how does a client know which server to ask for the IP address for ftp.econemon.com? Does it get that information from the hoster? If so, do I have to register the subdomain there (and what would I need my name server for then)?

I have Windows XP running in virtual machines connected to my local network for testing purposes. The tests are done remotely. When finished, I want to shut them down remotely, from a Linux box.

ETA: Note that the Windows box runs XP Home, so there are no security / group policies.

For the Linux systems in the same setup, I do:

#> ssh root@linux-vm123 'shutdown -h now';

For the Windows systems, I should be able to do:

#> net rpc SHUTDOWN -I xx.xx.xx.xx -f -U user%pwd

But that gives me the following error:

Could not connect to server xx.xx.xx.xx
The username or password was not correct.
Connection failed: NT_STATUS_LOGON_FAILURE

The user is an administrator and the account has a password set. Do I need to set up anything on the Windows system?

ETA: Is there a way I can test just the login, i. e. without sending a shutdown command that might need other privileges or settings?

I use virtualization with QEMU to test software on different OSs and processor architectures.

I was annoyed by the fact that a guest often clogs one host core completely and stalls, while the other cores are idle. My assumption is that this is because qemu will not start native threads for parallel tasks in the guest. If that's true, what virtualization software handles this smarter? I'm looking for a solution that does not require the guest to be modified (so Xen is not an option).

I was looking at KVM, but have not yet found any definitive answer. I should say that I'm not sure if I have understood the SMP support correctly, does that do anything about how tasks are parallelized on the host?

I have not yet looked into VMWare at all.