Beeelze's questions

Using PowerDNS, we got into an issue with transferring a single domain object (/24) from our primary to our secondary DNS server.

This /24 is part of a larger RIPE block, /22, and is not automatically transferred. The remaining /24 domain objects transfer just fine.

As you can see from below emitted output, the axfr transfer from ns0 to ns1 stops halfway.

beelze@ns1 ~]$ dig @ns0.x.x.x.x -t axfr x.x.x.in-addr.arpa

; <<>> DiG 9.9.4-RedHat-9.9.4-61.el7 <<>> @ns0.comsave.nl -t axfr 
x.x.x.in-addr.arpa
; (1 server found)
;; global options: +cmd
x.x.x.in-addr.arpa. 604800 IN   SOA ns0.x.x.x.nl. 
servicedesk.company.nl. 2019012815 10800 1800 1209600 10800
0.x.x.x.in-addr.arpa. 604800 IN PTR no-reverse-yet.company.nl.
1.x.x.x.in-addr.arpa. 604800 IN PTR no-reverse-yet.company.nl.
10.x.x.x.in-addr.arpa. 604800 IN    PTR no-reverse-yet.company.nl.
[...]
188.x.x.x.in-addr.arpa. 604800 IN   PTR no-reverse-yet.company.nl.
;; communications error to x.x.x.x#53: end of file

A tcpdump on ns0 doesn't show much that helps troubleshooting?

13:56:45.927143 00:0c:29:16:2f:8e > 00:00:5e:00:01:03, ethertype IPv4 (0x0800), 
length 1954: (tos 0x0, ttl 64, id 28824, offset 0, flags [DF], proto TCP (6), 
length 1940) 185.52.208.19.53 > 185.52.208.27.59863: Flags [P.], cksum 0x1a1f 
(incorrect -> 0xf316), seq 2936827176:2936829064, ack 487100677, win 227, options 
 [nop,nop,TS val 582294609 ecr 974940634], length 188828565*- q: AXFR? 
x.x.x.in-addr.arpa. 100/0/1 0.x.x.x.in-addr.arpa. [1w] PTR no-reverse-yet.company.nl., 
1.x.x.x.in-addr.arpa. [1w] PTR no-reverse-yet.company.nl., 
10.x.x.x.in-addr.arpa. [1w] PTR no-reverse-yet.company.nl., 
[...]
188.x.x.x.in-addr.arpa. [1w] PTR no-reverse-yet.company.nl. ar: . OPT UDPsize=1680 (1886)

I've set up Rancid on my Ubuntu 14.04 system for a couple of devices which all work fine except for all devices of type 'foundry' (Brocade). Every hour a cron job executes rancid-run as the rancid user. I tested both the flogin as the clogin binary login scripts.

flogin

This is what I see in every log:

<switch>: End of run not found 0 || 0
<switch> flogin error: Error: TIMEOUT reached
<switch>: missed cmd(s): show version,show flash,show module,write term,show running-config,show chassis
<switch>: End of run not found

My .clogin file seems to be fine:

[email protected]:~$ cat /home/rancid/.cloginrc 
add autoenable * 1
add method * ssh
add user * rancid
add password * Jg278edd.fisd%1y

SSH'ing to the switches the regular way works fine. But running the flogin script manually gives me this:

[email protected]:/var/lib/rancid/bin$ ./flogin -c 'show version' <switch>
s0.nikhef.nl
spawn ssh -c 3des -x -l rancid s0.nikhef.nl
[email protected]'s password: 
[email protected]>
Error: TIMEOUT reached

It takes about 10 seconds to login and after that it seems that it doesn't execute the command I specify after the -c flag. And after another 10-20 seconds it exits after it reached Rancid's TIMEOUT value.

clogin

This script works just fine... (but it doesn't go to exec mode, it ignores autoenable 1)..

[email protected]:/var/lib/rancid/bin$ ./clogin -c 'show version' <switch>
<switch>
spawn ssh -c 3des -x -l rancid <switch>
rancid@<switch>'s password: 
SSH@<switch>>
SSH@<switch>>terminal length 0
Invalid input -> terminal length 0
Type ? for a list
SSH@<switch>>terminal width 132
Invalid input -> terminal width 132
Type ? for a list
SSH@<switch>>show version
 SW: Version 04.2.00b Copyright (c) 1996-2010 Brocade Communications Systems, 
...

SSH@<switch>>exitConnection to <switch> closed by remote host.
Connection to <switch> closed.

So I figured, why not replace flogin's code with clogin's code and all be fine, right? Manual test confirmed that, but doing a rancid-run did not get the configs, but just shows this in the logs:

<switch>: End of run not found 0 || 0
<switch>: missed cmd(s): show chassis,show running-config,write term,show flash,show version,show module
<switch>: End of run not found

What is left to debug?

This is my first question on serverfault so I hope I'm doing this right as I'm usually on Stackoverflow :-)

I have two Ubuntu 14.04 LTS servers, server A and B.

Server A runs the web server where my customer portal runs and where customers can order virtual machines.

Server B is the hypervisor with KVM where images and ultimately virtual machines are created.

I recently created a bash script on server A that:

• gets information from a mysql table with virtual machines that still need to be created and loops through them;
• checks free disk space of server B and if sufficient space then
• creates images with the fallocate program on server B;
• creates the virtual machine with vert-install on server B with the use of previously created image.

All these commands are executed with the use of SSH. This means that for every virtual machine I need to do 3 SSH commands. More if a hypervisor does not have enough disk space left for the creation of images.

This script sort of works fine when there is only 1 customer ordering a virtual machine and when there is only 1 hypervisor. Having multiple customers ordering VM's and having multiple hypervisors will probably break the script. Then I thought of the following solution:

Whenever a customer clicks on the button 'Order VM', a telnet call to a hypervisor + port is done and a daemon listening on that port runs a script, for example:

• Port 7000: create the image
• Port 7001: create the virtual machine

The problem however is my lack of knowledge about this kind of stuff. For example:

• In what language would i write the daemon? PHP is my primary language, but as it is 'the language that dies' it might not be good for writing daemons.
• How can this daemon listen on multiple ports and take the correct action according to which port something comes in?
• Is telnet the correct protocol to use for this kind of process? The daemon would only listen on private addresses in our own network, that means that the security is no problem here. Are there different technologies that suits better?

I have not tried much because I don't know where to start. There is a lot to think about, but I just need a little push in the right direction to get things started. I don't necessarily need example code (it might help of course). I can provide the bash script I have created if needed.