Kyle Smith's questions

I have a single DHCP scope for building systems in one site, and another site which doesn't (at least yet) have infrastructure for building systems using cobbler. Eventually I'd like to scale this all out, but for now I want to use the cobbler buildiso command to make CD media that contains a list of all systems/profiles.

I've set the ip-address, network, gateway fields for the system profile, in addition to all the other fields I use for PXE->DHCP setups.

It seems like I'm 80% there as the media is created, but the syslinux.cfg file doesn't seem to correctly populate ksdevice, ip, network, gateway.

My question is what is the correct way to get this configuration to work?

I have a large number of workstations that run RedHat Enterprise Linux 5 and 6. I'd like to deploy our new internal CA (Active Directory) to these machines. I can manually import the certificate into Firefox 10 without any issues, but I can't seem to find where to store the .cer file on the filesystem so that it will be used by FireFox and Google Chrome. Is there a central location for trusted CAs that is used by both of these browsers?

If not, I'd settle for a more-automated way to have FireFox accept my CA.

Stuff I've Tried

• Using the Mozilla-provided certutil - but this seems to only deal with client-side certificates, unless I am mistaken.
• Modifying /etc/pki/tls/ca-bundle.crt included in the ca-certificates package. Firefox does not appear to honor this file.

Our team rolled puppet out to our systems over the last six months. We're managing all sorts of resources, and some of them have sensitive data (database passwords for automated backups, license keys for proprietary software, etc.).

Other teams want to get involved in the development of (or at least be able to see) our modules and manifests. What have other people done to continue to have secure data moving through Puppet, while sharing the modules and manifests with a larger audience?

I'm diving into Puppet in our environment and I'm realizing there are many files I'd like to build that use Puppet Facts and inventory data about our environment.

Is it possible, for example, to assemble an /etc/hosts file based on nodes which include a certain class? Another example would be writing scripts to compare our existing Nagios configuration against the Puppet inventory.

We're in the process of researching a configuration/systems management implementation and we've done quite a lot of demoing of Puppet. Puppet seems to excel at the somewhat simple "ensure this package is installed, this config file exists, and that this service is running."

I can't seem to find a good real world example of managing software that doesn't play so nicely. Some examples:

• IBM DB2 (distributed via tarball with installer, "fixpacks" are similiar)
• Simpana CommVault (uses an installer with an ncurses interface, but will accept an "answer" file if coaxed)
• AccuRev (binary installer, with "answer" file support)
• VMWare Tools (binary installer)

What approach have Puppet users taken to integrate software like this into their environments?

This may be a community wiki, I'm not sure.

Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that releases information to you that you otherwise should not have had access to, for example. By changing these fields are you guilty of "hacking"? If so, should you report the security flaw to the company, or is there a legitimate fear of legal repercussions if you admit your "guilt"?

Clarification as requested: This is all external facing, fully accessible .NET pages that accept variables that can have unintended results when modified.

Second Edit: To be clear this is not a company I work for, but another website on the internet that I have no relationship with.

We have a homegrown config management system and we'd like to add config file versioning to it in a simple way. My first thought was svn (or similiar), but I'm concerned with creating a repo in one location, just to check it out in another location on the same system. In this case we have no use for remote or even multiple checkouts. Is there a software versioning system that lives in one location (metadata+working copy) and will store only deltas? Some of our configuration nodes have large tarballs and binary installers.

I'm in the middle of an snmptrapd/snmptt deployment and I'm updating (via racadm) the configuration of all of my DRACs. All but 3 of them sent me an expected "IPMI Alert Test Configuration" trap (.1.3.6.1.4.1.3183.1.1.0.0).

3 of my (newer, R710, DRAC6) hosts are sending me traps with an OID of .1.3.6.1.4.1.3183.1.1.0.1001. I can't seem to find this documented anywhere and it has me a bit concerned. Has anyone had any experience with this sort of deployment?

EDIT: This looks like a bug. The newer DELL-RAC-MIB defines an OID ending in .1001 as a IPMITestTrap, however the 1001 was appended to the old OID tree and sent on a subset of my servers.

I have a script, written in bash, which runs from cron. One of the first things it does is SSH to a remote host and retrieve a list of files in a directory. Everything works fine when run from the command line, but not from cron.

The section of the script originally looked like this:

FILES=$($SSH_BINARY -i $SSH_KEY $SSH_USER@$REMOTE_HOST "ls $REMOTE_DIRECTORY")
echo "Got files = $FILES"

I added an echo statement above that line (shown below) to prove it wasn't a path or variable issue:

echo "$SSH_BINARY -i $SSH_KEY $SSH_USER@$REMOTE_HOST \"ls $REMOTE_DIRECTORY\""

If I take the resultant output line and run it as the same user cron will (root), it works without issue.

Thinking it may have something to do with assignment to a variable, I modified the FILES= line to read (thus, putting the output directly into my last_run_output file):

$SSH_BINARY -vv -i $SSH_KEY $SSH_USER@$REMOTE_HOST "ls $REMOTE_DIRECTORY"

The cron entry looks like this:

34 * * * * /root/path/to/my/script/get_logs.sh > /root/path/to/last_run_output 2>&1

So, PATH, variable assignment, and permissions issues aside, I started using debug flags in ssh. I ran once from the command line, then from cron, and compared the outputs. Here are some highlights from the diff:

The - side is the unsuccessful attempt, the + side is the successful attempt, run outside of cron.

@@ -87,9 +77,7 @@
 debug1: Remote: X11 forwarding disabled.
 debug1: Remote: Forced command: /home/sshacs/acssshsink netstorageuser
 debug1: Authentication succeeded (publickey).
-debug2: fd 4 setting O_NONBLOCK
 debug2: fd 5 setting O_NONBLOCK
-debug2: fd 6 setting O_NONBLOCK
 debug1: channel 0: new [client-session]
 debug2: channel 0: send open
 debug1: Entering interactive session.

I can't explain why these extra file descriptors are mentioned in debug2 when run from cron, but it appears to be related (notice read<=0 rfd 4 len 0 line below):

@@ -100,20 +88,672 @@
 debug2: callback done
 debug2: channel 0: open confirm rwindow 0 rmax 32768
 debug2: channel 0: rcvd adjust 131072
-debug2: channel 0: read<=0 rfd 4 len 0
-debug2: channel 0: read failed
-debug2: channel 0: close_read
-debug2: channel 0: input open -> drain
-debug2: channel 0: ibuf empty
-debug2: channel 0: send eof
-debug2: channel 0: input drain -> closed
+  [[ Very large output of the ls command ]]
+debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
 debug2: channel 0: rcvd eof
 debug2: channel 0: output open -> drain
 debug2: channel 0: obuf empty
 debug2: channel 0: close_write
 debug2: channel 0: output drain -> closed
-debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
 debug2: channel 0: rcvd close
+debug2: channel 0: close_read
+debug2: channel 0: input open -> closed
 debug2: channel 0: almost dead
 debug2: channel 0: gc: notify user
 debug2: channel 0: gc: user detached

Any ideas are greatly appreciated.

I have been reading about temporary tables and how if you exceed tmp_table_size, it is converted on an on-disk MyISAM table. What I can't find is where that table is stored. I assume it's the MySQL datadir. Can anyone confirm this?