Ram Rachum's questions

I suck at system administration, so if I'm getting something basic wrong, please let me know.

Here is something that drives me nuts. At work, we have a big NFS server that serves all the employees of our company. Everyone has a certain number of GBs that they're allowed to write to it. I often get "quota exceeded" errors, because I run some programs that generate a lot of temporary files and then delete them, but before they can delete them they hit the quota.

After talking with our sysadmins, I learned that my quota was already increased to well beyond what I need for these tests, but it seems that I'm spending this quota in places other than my home folder. The sysadmin explained to me that every file in the NFS server which has my username as an owner, counts against my quota.

I wanted to get a list of these files so I could delete a lot of files that I don't need anymore. But he told me that the only way is to do a search of the entire filesystem of the entire company, going through everyone's home folders. i.e., a time-consuming process. He's doing this search right now.

What sounds weird to me is this: When Linux gives me a "quota exceeded" error, it seems to be able to know instantly that I'm going over my quota. Not a time-consuming process. So how come I can't get the list of files that are counted against my quota, without doing a long search?

I have a Linux machine and I want it to show the current IP in the banner that shows before the login prompt is displayed. How can I do that? I considered making a startup script that finds the IP in the MOTD, but found that the MOTD gets displayed only after the person logged in, and I need the message to show before the person logged in.

If it matters, this is CentOS, I think version 6.

I want a Bash one-liner that atomically creates a file if it doesn't exist. That means essentially "if file doesn't exist, create it" but ensuring that no one else manages to create the file in the small space between doing the if and creating the file.

I'm not seeing log entries (at a level of INFO) made by Django in my Heroku logs.

This is my configuration:

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'filters': {
        'require_debug_false': {
            '()': 'django.utils.log.RequireDebugFalse',
        },
        'require_debug_true': {
            '()': 'django.utils.log.RequireDebugTrue',
        },
        'not_development_filter': {
            '()': NotDevelopmentFilter,
        },
    },
    'handlers': {
        'console':{
            'level': 'INFO',
            'class': 'logging.StreamHandler',
        },
        'null': {
            'class': 'django.utils.log.NullHandler',
        },
        'mail_admins': {
            'level': 'ERROR',
            'filters': ['not_development_filter'],
            'class': 'django.utils.log.AdminEmailHandler',
            'include_html': True,
        }
    },
    'loggers': {
        '': {
            'handlers': ['mail_admins', 'console'],
            'level': 'INFO',
        },
        'django': {
            'handlers': ['console'],
        },
        'django.request': {
            'handlers': ['mail_admins'],
            'level': 'ERROR',
            'propagate': False,
        },
        'py.warnings': {
            'handlers': ['console'],
        },
    }
}

I'd like to see the log entries in the Heroku interface. Any idea why I'm not seeing them there?

Every time I use dig I get a vague feeling that I'm not really sure whether it's giving me correct data.

Now I've used it like this:

# dig socialimpactportfolio.com

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> socialimpactportfolio.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35289
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;socialimpactportfolio.com.     IN      A

;; AUTHORITY SECTION:
socialimpactportfolio.com. 1799 IN      SOA     dns1.name-services.com. info.name-services.com. 2002050701 10800 3600 604800 3600

;; Query time: 121 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu May 22 14:01:03 2014
;; MSG SIZE  rcvd: 103

As you can see, there is no ANSWER section, despite the fact that there's a working website on that domain.

Why?

I'd really like a program that simply shows all the DNS records in the most non-confusing manner.

I maintain a few Python-based web apps. I need to be notified immediately when new Python releases are made, especially micro level releases that fix security issues, so I could update my sites to use the new version.

Is there any way to be automatically notified? I looked at python-announce-list but it has notifications for a myriad of open-source projects that I'm not interested in.

I'm setting up an stunnel server on Windows XP, and I get this bug when a client tries to access:

2013.02.14 00:02:16 LOG7[8848:7664]: Service [https] accepted (FD=320) from 107.20.36.147:56160
2013.02.14 00:02:16 LOG7[8848:7664]: Creating a new thread
2013.02.14 00:02:16 LOG7[8848:7664]: New thread created
2013.02.14 00:02:16 LOG7[8848:9792]: Service [https] started
2013.02.14 00:02:16 LOG5[8848:9792]: Service [https] accepted connection from 107.20.36.147:56160
2013.02.14 00:02:16 LOG7[8848:9792]: SSL state (accept): before/accept initialization
2013.02.14 00:02:16 LOG7[8848:9792]: SSL alert (write): fatal: handshake failure
2013.02.14 00:02:16 LOG3[8848:9792]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number
2013.02.14 00:02:16 LOG5[8848:9792]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2013.02.14 00:02:16 LOG7[8848:9792]: Local socket (FD=320) closed
2013.02.14 00:02:16 LOG7[8848:9792]: Service [https] finished (0 left)

Any idea what to do about this? I read online that this might mean that my server is advertising that it can communicate in SSL3 but it in fact can't. If this is true I'd like to know how I can fix this. I'm editing the stunnel.conf file but I have no idea what to change in it to fix this.

UPDATE:

The above error message shows only when the Twilio client (i.e. Twilio's server) tries to access my server. When I try to access my server with one of my computers, the page does show up, but after the contents show up, Chrome shows the page as "loading" for around 30 seconds, at the end of which stunnel gives this message:

transfer: s_poll_wait: TIMEOUTclose exceeded: closing

UPDATE:

Here is the wireshark capture: https://gist.github.com/cool-RR/4963477

Cap file: https://dl.dropbox.com/u/1927707/wireshark.cap

Note that the server runs on port 8088.

UPDATE:

Here is the log from the server (with debug=7):

2013.02.17 17:06:52 LOG7[7636:2092]: No limit detected for the number of clients
2013.02.17 17:06:52 LOG5[7636:2092]: stunnel 4.54 on x86-pc-msvc-1500 platform
2013.02.17 17:06:52 LOG5[7636:2092]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012
2013.02.17 17:06:52 LOG5[7636:2092]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6
2013.02.17 17:06:52 LOG5[7636:2092]: Reading configuration from file stunnel.conf
2013.02.17 17:06:52 LOG5[7636:2092]: FIPS mode is enabled
2013.02.17 17:06:52 LOG7[7636:2092]: Compression not enabled
2013.02.17 17:06:52 LOG7[7636:2092]: Snagged 64 random bytes from C:\Documents and Settings\User/.rnd
2013.02.17 17:06:52 LOG7[7636:2092]: Wrote 1024 new random bytes to C:\Documents and Settings\User/.rnd
2013.02.17 17:06:52 LOG7[7636:2092]: PRNG seeded successfully
2013.02.17 17:06:52 LOG6[7636:2092]: Initializing service [https]
2013.02.17 17:06:52 LOG7[7636:2092]: Certificate: G:\Dropbox\StartSSL\SSL Cert.pem
2013.02.17 17:06:52 LOG7[7636:2092]: Certificate loaded
2013.02.17 17:06:52 LOG7[7636:2092]: Key file: G:\Dropbox\StartSSL\SSL Cert.pem
2013.02.17 17:06:52 LOG7[7636:2092]: Private key loaded
2013.02.17 17:06:52 LOG7[7636:2092]: Could not load DH parameters from G:\Dropbox\StartSSL\SSL Cert.pem
2013.02.17 17:06:52 LOG7[7636:2092]: Using hardcoded DH parameters
2013.02.17 17:06:52 LOG7[7636:2092]: DH initialized with 2048-bit key
2013.02.17 17:06:52 LOG7[7636:2092]: ECDH initialized with curve prime256v1
2013.02.17 17:06:52 LOG7[7636:2092]: SSL options set: 0x03000004
2013.02.17 17:06:52 LOG5[7636:2092]: Configuration successful
2013.02.17 17:06:52 LOG7[7636:2092]: Service [https] (FD=268) bound to 0.0.0.0:8088
2013.02.17 17:07:08 LOG7[7636:2092]: Service [https] accepted (FD=320) from 54.242.25.199:45922
2013.02.17 17:07:08 LOG7[7636:2092]: Creating a new thread
2013.02.17 17:07:08 LOG7[7636:2092]: New thread created
2013.02.17 17:07:08 LOG7[7636:8004]: Service [https] started
2013.02.17 17:07:08 LOG5[7636:8004]: Service [https] accepted connection from 54.242.25.199:45922
2013.02.17 17:07:08 LOG7[7636:8004]: SSL state (accept): before/accept initialization
2013.02.17 17:07:08 LOG7[7636:8004]: SSL alert (write): fatal: handshake failure
2013.02.17 17:07:08 LOG3[7636:8004]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number
2013.02.17 17:07:08 LOG5[7636:8004]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2013.02.17 17:07:08 LOG7[7636:8004]: Local socket (FD=320) closed
2013.02.17 17:07:08 LOG7[7636:8004]: Service [https] finished (0 left)

UPDATE:

Here's my stunnel.conf file.

I read about the Pipe Viewer (pv) Linux utility, and it sounds really useful. I use plenty of Linux tools on Windows, but this one doesn't seem to be part of the msysgit suite that I use.

How can I get a Windows binary of it?

I've created an RSA keypair that I used for SSH, and it includes my email address. (At the end of the public key.)

I've now changed my email address.

Is it possible to change the email address on the key, or is it part of the key and I would have to make a new one?

Can I use Fabric to automatically deploy an app on my server every time I push the code to GitHub? (GitHub has the ability to POST to a URL every time I push.)

If so, how?

I'm sitting in front of a Linux shell. I want to do something like pwd, except I want an absolute answer, i.e. I want any symlinks to be resolved to their true path. How can I do that?

I pressed Ctrl-R to enter into reverse-i-search mode. I stared typing and I couldn't find the command I was looking for. Now I want to exit this search mode. If I press Esc, the last line I viewed will remain on the prompt. I don't want that. I want to go back to a completely clean prompt. How do I do this?

I'm doing:

less -S my_database_dump.sql

In order to see the files with the lines chopped (i.e. line wrapping.) But it's not working, the lines aren't being wrapped and I need to scroll horizontally to see the entire line. What can I do?

I ran this command:

python ./manage.py dumpdata partyapp.InvitationTemplate > partyapp_dump.json

To dump data into the partyapp_dump.json file. But all the data just gets printed on the screen and an empty partyapp_dump.json file is created.

Why could this happen? I tested ls > partyapp_dump.json and that worked perfectly.

I want to run an executable in Linux, and regardless of the exit status that it returns, I want to return a good exit status. (i.e. no error.)

(This is because I'm using sh -ex and I want the script to keep running even if one (specific) command fails.)

I want to run Hudson on EC2 and use Hudson's EC2 plugin to create Hudson slaves to run my tests.

I installed it, but when trying to configure it, I get a lot of errors:

What's going on? How can I solve this?

Amazon has a list of public AMIs:

http://aws.amazon.com/amis

But this list is sorted by date, not popularity, so it's practically useless for finding good AMIs, unless you know in advance what you're looking for. IIUC, There's no way to tell between a super-awesome AMI with thousands of users and a lame AMI that no-one uses.

Is there a popularity-sorted list of AMIs anywhere on the web?

There's something I don't understand. Possibly I have some misunderstanding about how HTTPS works.

I heard that some wireless routers allow the user to access the administration page with HTTPS (which is a good idea because then you can configure securely over wireless.) When this is done, how is the identity of the router established? I mean, from what I understand, normal secure websites (Like https://www.paypal.com/) have a secret private key, so that when the client's computer sees the corresponding public key, he can be sure he's really communicating with PayPal. (Did I get that right up to here?)

But how can a router store a private key? I mean, wouldn't black-hat hardware hackers be able to physically open it up, obtain the private key, and then do a man-in-the-middle attack? (Might not be a practical attack in this scenario, I know.)

I'm sshing into a server and I'm starting a Python script that'll take approx. 24 hours to complete. What if my internet connection dies in the middle? Will that stop the command?

Is there any way to run my long-running command in a way that local disconnects won't affect it and I could continue to see its output after I log in to ssh again?

I'm using the wget program, but I want it not to save the html file I'm downloading. I want it to be discarded after it is received. How do I do that?