Jon Rhoades's questions

We are purchasing a server to run various Bioinformatics software packages. The main package on our test machine is multi threaded and is totally CPU bound, the IO & RAM are not limiting performance - the CPU runs at 100% whereas the RAM & disk IO are at minimal levels.

We want to ensure that we get the best processor(s) for our workload, but given the rather large list of Intel Xeon's to choose from, how can we select the best one for our needs?

I appreciate that on a fundamental level, "more" = "better", but how can I tell if for instance a faster bus speed makes a bigger difference compared to a large cache or if more cores are better than clock speed.

So is there a way of profiling our software package to figure out what processor to choose. The software in question is a collection of Python scripts, so we can do the profiling on Linux or Windows.

With the sudden onslaught of iOS apps that can use WebDAV for syncing, along with the fact that we are not happy with our user's data being stored in North Carolina (evil IT overlord strikes again) we are looking for a WebDAV solution for iPads & iPhones.

We need:

• Authentication against LDAP (preferred), RADIUS or Samba

• WebDAVing mounting (for want of a better term) of the users home folder on the fileserver, or perhaps a folder within their home folder that is actually a mount to elsewhere.

• File server can be Samba on Ubuntu (preferred), Windows or if we have to, OS X.

We are trying to avoid having the complexity of Sharepoint or Confluance, but it would be great if there was an out of the box system.

The best solution we have come up with is a homemade PHP/Apache mod_dav and mod_rewrite/LDAP construction, but it does give the webserver full root access to the file server, which is proving a bit unpopular!

For reasons to hideous to go into... I'm using Nginx as a webserver and would like it to serve one page for internal users (say on 10.0.0.0/16) and another page to external users on any other IP address.

For example:

• "Internal" PC with an IP of 10.0.0.34 goes to company.com/page.html gets page internal.html

• "External" PC with an IP of 8.8.8.8 goes to company.com/page.html gets page external.html

Being the evil corporate IT overlords we need to block the new OS X App Store. As you may be aware the 10.6.6 update installs the App Store App which allows users to download and install apps without admin privileges.

Some Suggestions:

• Don't update to 10.6.6+

• Use parental controls

• Presumably some OD policy (if you have an OD server which we don't)

• Block the App store by DNS or Proxy

Not updating to 10.6.6+ isn't really a long term solution as it contains security fixes and new Macs will come with it anyway. Blocking the App store at a network level doesn't solve laptop users.

Ideally a simple system preference or editing of a plist that can be pushed out by ARD would be the best solution.

Please note the question isn't should we block the App store, it's how we can block the App store.

As a quick update it seems that is you are not using an account with admin privileges, you may need supply admin credentials for the first time you download an app to install it, which may solve some of the problem. Very different behavior to the normal OS X elevation of privileges which ask admins and non admins alike.

We need to run several MediaWiki Wikis, that need totally separate user accounts, on the one server. What would be the better solution:

1. Use separate source code and use namespaces in the database.
2. Use the same source code along the lines of this, essentially you create a customised localsettings.php file for each site that contains the site specific info and you have a master localsettings.php file that depending on the url send you to the relevant site specific localsettings.php
3. Symlink all of the source code except for localsettings.php and any other relevant files from a master folder.

Obviously it would be nicer to be able to use the same code for every instance, as it will make upgrades a lot easier.

For what it's worth it will be running on Ubuntu server, Apache with a sprinkling on nginx & MySQL

I'm trying to mount an NFS share on our NetApp SAN on Windows 2008 R2 & services for NFS. Using XP I have no problem mounting this share without a username/NIS/pswd file etc, but the new functionality in 2008 seems to insist on either using AD or an NIS server (to "streamline" Services for NFS MS removed user account mapping) see Technet.

1. When I go to map the share using "map network drive" no combination of "root", no username, no password, my username works.
2. Using the command line mount -o anon \\172... :n or mount -o -u:root \\172... :n either gives me a network error 53 or 67 error

Is it possible with 2008 to mount an NFS share without AD or NIS? If so what am I doing wrong?

(Security is taken care off by IP address permissions and VLANs)

We are struggling to print Student's Theses on our HP CLJ CP4025 Printers (It will only let us print 1 at a time & typically they need multiple copies). Supposedly the solution is to install the optional Hard Drive.

My question is:

a) Does a hard drive on the printer make a significant difference?

b) Can we use any old hard drive or do we have to use the rather pricey HP High performance EIO units?

--Edit--

Bit more info - Mac OS X with the latest HP drivers, printing to a CUPS server using a RAW socket. We don't have this issue printing using this setup to our Lanier beasts.

Also printing smaller jobs we can print multiple copies, it's just the huge, jobs where we get the problems

I know this is the wrong way round... but

Is it possible to use AD in front of Samba for our PC clients, so that the user accounts are in Samba/Open LDAP.

Managing our fleet of Windows PC's is becoming more and more difficult with just Samba v3 - until Samba v4 comes along, it would be great if we could leverage Active Directory, but have the accounts stored in Samba/Open LDAP.

Windows PC's are a minority in our organisation & Samaba/Open LDAP are used for just about every service (Zimbra/RADIUS/Intranet/SAN/Printing/...) so it will have to remain the definitive account source. Anyway, it probably can't be done, but I thought I would ask for ideas anyway.

What's the difference between a Layer 2 & Layer 3 switch?

I've always wondered and never needed to know until now.

We are struggling with our users visiting infected or "attack" sites and Phising in general. Most of our machines are protected by an Enterprise anti virus and monitoring solution (McAffe ePO) and we try to get people to use Firefox... But no AV is perfect and we have to endure personal machines as well (albeit on their own 'Plague' VLANs) and would like to do something about Phishing as our users seem intent on disclosing their passwords to the world...

To complicate matters we don't want to implement a block for many many reasons (political, ideological, legal etc) instead we would like to implement something akin to Firefox's "Reported Scam/Phish/Attack Site" - "Get me out of here" or crucially "Let me in anyway", giving the user a choice to still infect themselves if they feel like it (or look at a site incorrectly blacklisted).

The reason we can't just use Firefox is we have a core enterprise app only certified on IE6&7 - thank you Oracle.

Is it possible to implement this type of advisory filtering either using a proxy (in our case Squid) or DNS?

What free options are available for web content filtering? Open Source Filtering of HTTPS Traffic

Were a good start, but they don't address the advisory aspect of the filtering.

The joys of a Samba domain... First off Domain Group policy can't be used until Samba 4 arrives.

We need to setup Software Restriction Policies (SRPs) on most of the computers in our Samba domain and I would dearly like to automate this. (We are moving away from just disabling the Windows installer). The traditional way is to set SRPs using Local Group Policy (LGP) Computer Conf->Windows Settings->SRP but this involves visiting every machine as it can't be set using in NTConfig.pol.

It is possible to attempt to create the SRPs directly in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\{30628f61-eb47-4d87-823b-6683a09eda87}]
"LastModified"=hex(b):40,a2,94,09,b5,5d,ca,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="C:\\location\\subfolder"

SaferFlags DWORD seems to be what turns it on or off, but although this seems to work it does not update the Local Group Policy - SRPs still show as "No SRPs Defined".

Where does the LGP store this setting - is it even in the registry and more importantly - Is there a cleverer way of setting up SRPs?

Due to Samba needing to be at least v3.3 to have Windows 7 clients (see) we need to upgrade our version of Samba running on Ubuntu 8.10 (Intrepid). We are after a proven working package of Samba and can't find on in the normal places - Apt, backports, google etc - we really don't want to compile our own!

Is there a proven package of Samba (3.3 or better) available for Ubuntu 8.10 or are we forced to upgrade to Ubuntu 9.10 - not a light undertaking.

We have set up network accounts for our Snow Leopard Users on several Macs, which work great except for applications that use a local Sqlite database for their preferences/cache. The biggest problem being Acrobat reader which launches and crashes immediately giving an Sqlite error.

A local account on the same machine has none of these problems which leads me to believe that it is due to applications storing their Sqlite in the user's profile folder /Users/JDoe which due to our network account setup is really a Samba share smb://server/users/JDoe.

I'm guessing that the Sqlite driver can't properly lock the file over SMB/CIFS hence the issues.

So can we:

1. Somehow change our Samba share to be more Sqlite friendly?
2. Use Samba Vetoing (or similar) to exclude .sqlite files
3. Use symbolic links so that the .sqlite files in the users profile are actually local files perhaps stored in /Users/Shared
4. Some other far more intelligent solution.

We have just taken delivery of a 'mature' 48 port switch for testing, deployment and general skulduggery. Since we are going to be constantly mucking around with the patching we need a diagram so we know which port is on what VLAN.

Has anybody seen such a template/diagram/key on their internet travels? We were hoping for something a bit more stylish than two rows of 24 in Excel - as befits a classy bit of network kit such as this!

We are just in the final stages of finishing our AV management solution (McAfee ePO) and we are fine tuning our client policies.

How often should we have our client PC's & Macs run a system scan?

I know some people advocate daily scanning, but the anti virus client has real time scanning and with our management system, we immediately pick up disabled, non functioning or out of date AV clients, so is there a need to scan very often?

Furthermore how often should we scan our file server, with our users network drives/profiles - if ever?

We are about to go through the process of updating our users on mass so that they can submit their grants to NHMRC. They are a mix of Endnote 9/X1/X2. The NHMRC specifies X2 and we would like to apply the latest patch the fixes the Y2K10 bug as well!

Endnote's documentation only makes provisions for a manual backup then uninstall of the previous version then install of the new version then apply the patches then run the first run wizard and make the dock shortcut.

Does anybody have a better way to upgrade our 500 or so EndNote users?

We are running a SAMBA "Domain" - is it possible on a Windows server to run WSUS without a "proper" Windows domain and would our SAMBA controlled clients use this server?

We are not so much worried about managing the clients, more caching the updates themselves (approval of the updates would be good too).

I'm looking for resources/suggestions/experience on administering a medium sized network of Macs (300ish) using Open LDAP on Linux rather than using Open or Active Directory.

Would like the following features:

What is the best way to turn a Level 1 help desk person into a systems administrator. Ideally avoiding external training when possible?

We normally focus on how to further ourselves, so to turn it around how can we help someone else?

In our case it's a Windows server environment, but I'd be interested to know Linux views as well.

Now that Microsoft have released Vista & Server 2008 SP2 (see Lifehacker). How long should I wait before installing it on:

1. Stand alone machines
2. PCs on the domain
3. Windows servers
4. "Critical" Servers