CarpeNoctem's questions

I make use of an .ssh/config file to set my username appropriately based on a given portion of a subdomain, e.g.

Host *widgetshop.com*
   User foobar
   ControlMaster auto
   ControlPath ~/.ssh/socket-%r@%h:%p

Host *
   ControlMaster auto
   ControlPath ~/.ssh/socket-%r@%h:%p

This works if I write:

ssh foo.widgetshop.com

but does not work if I were to write:

ssh foo

which upon search path resolution becomes the same fqdn.

Anyone have a way to expand shortnames before calling ssh, or an alternative approach?

I cloned a VM and the ssl certificate has the old hostname. I need to generate a new ssl certificate.

My question is what method was used by the server to create the initial certificate? Was this done as part of the post-install for an RPM? I'll use openssl if there's not a generation script that can be run. Thanks!

Is it normal to NOT be able to access an external IP from an internal host that lives on the same network as the other internal host that corresponds to the external IP?

For instance: say I'm on an internal network for widget inc and want to access widget.com which is a public IP with NAT to an internal host called widget1.local. Is it normal to not be able to do so?

I want to add a new harddisk to an existing VM and want the best performance possible. The new hard disk will exist on an NFS datastore. Currently I did the following:

• Created new vmdk on NFS datastore
• Created new lvm partition using fdisk
• Create new physical volume, volume group, and logical volume (2TB)
• Created ext3 partition on logical volume

Is there a better way to do this? Should I be doing some vmware-ish file system instead?

How can I monitor the write speed to a tmpfs partition. It does not appear in the output of vmstat or iostat.

I am running several python processes that are writing heavily to tmpfs and contributing to load. The load is high but the CPU, memory, disk IO, etc is all nominal. The load seems to be taking this heavy tmpfs IO into account indirectly somehow. I'd love to know the write speed to have an idea of upper limits per host. I'm running blind any help would be appreciated.

I know some people are using keepalived and heartbeat for active/standby but what action is taken if the haproxy process were to die?

What would be nice is if the virtual IP would switch servers if the haproxy process were to die and/or a networking issue were to occur. We are currently investigating heartbeat and corosync with pacemaker. Can anyone explain their solution to this issue in depth?

UPDATE: Thanks Kyle, see answer and links therein.

Evaluating alternatives to BIND for internal DNS. Would love to integrate DNS into the automated provisioning process using an API. Does anyone know of a FOSS DNS server alternative to BIND that has a API to boot? I use to use MyDNS which performed great but rather not edit the DB directly if a better solution is already out there.

What is an open source load balancer that allows for hash based balancing? I would like to do hash based load balancing of a URL but first remove the user specific arguments from the URL. Basically want to increase Varnish's cache performance by adding URL to node persistence.

Example: example.com/foo/usertoken/bar

Where the hash would be based on: example.com/foo/bar.

• Edited for clarity, bias, and URL modification. *

Any way to force the use of a defined host static route when the IP is on the same subnet and disregards the static route entry?

For instance I have a host host: 192.168.1.2 with subnet 255.255.255.0 and a default of 192.168.1.1

I'd like to communicate with 192.168.1.3 via 192.168.1.102.

I'm evaluating various metric collection systems and appreciate just about everything in Ganglia, except for the less than clean interface. Does anyone know of alternative Ganglia interfaces or additions to the interface that allow custom grouping of hosts a la Cacti's left pane tree view?

Could really use some help with this one! Thanks!

So I need to install the original /etc/pam.d/system-auth-ac file from the authconfig RPM. I attempted to do so by "reinstalling" the authconfig package/rpm like so:

mv /etc/pam.d/system-auth-ac ~/
rpm -e --justdb --nodeps authconfig
yum install authconfig

The files are not re-installed though. What needs to be done to get yum to reinstall the files?

UPDATE:

Did an strace on the yum install and it appears that the file "/etc/pam.d/system-auth-ac" is opened by the rpm install but not written to. Looking further it appears that the file is generated once the authconfig binary is executed.

So now the problem is no longer RPM related. I need to figure out what the default command to authconfig looks like for RH5.6 so I can get a normal system-auth-ac file.

Is there any way to enable/disable APC on a per virtual host basis? I'd rather not use precious apc shared memory on caching my PHPmyAdmin subdomain or lesser used sites. Setup is Nginx, php-fpm, and apc.

From what I've read the filter setting of APC cannot match against full path so I am looking for some other method.

So everyone who uses CentOS knows the default repositories have their limits. I've been using rpmforge for years as a secondary repo. I usually use yum priorities to make sure rpmforge never installs something the base repo can take care of. Recently I came across a need to install EPEL as a tertiary repo. Is EPEL kept more up to date than rpmforge or in any way better? Should I be using that instead of rpmforge?

Just as the title reads: How do I discover what nameserver is the authoritative nameserver for PTR records for a specific IP?

We have outgrown the use of a single server for monitoring our network so we are looking to add another monitoring server. Unfortunately, we were shortsighted when we initially configured the hosts being monitored. We configured the hosts on our network to only allow monitoring from a single IP. To add another IP to all the hosts firewall rules is not logistically possible. I won't go into why but suffice it to say the servers have a mix of owners and cannot be updated at will.

So initially we were thinking of just having an OpenBSD box doing NAT with PF in front of the two servers. We're not thrilled about the additional complexity or, most especially, the single point of failure.

So, can we do some magic to allow both servers to use the same internal IP address without adding another host? Also, the system needs to continue working if either one of these hosts go down. So doing the NAT on one of the two hosts and routing the second server through the first isn't really enough. We basically need failover source NAT in front of the shared IP...without adding two additional boxes.

Looking for a host-based IDS comparable to tripwire. Preferably one that allows centralized management. Right now I use tripwire and though it works management and reporting through a central server would be ideal. I'm looking for recommendations that have actually been used and not just google results. Thanks!

So all the tutorials and documentation for the Linux quota system has left me confused. For each filesystem with quotas enabled/on where is the actual quota information stored? Is it filesystem metadata or is it in a file?

Say user foo creates a new file on /home. How does the kernel determine whether user foo is below their hard limit? Does the kernel have to tally up quota information on that filesystem each time or is it in the superblock or somewhere else?

As far as I understand, the kernel consults the aquota.user file for the actual rules, but where is the current quota usage data stored? Can this be viewed with any tools outside repquota and the like? TIA!!

Update:

Thanks for the help. I had already read that mini-HOWTO. I am pretty clear on the usage of the user space tools. What I was unclear on is whether the usage data was ALSO in the file that stored per-user limits and you answered this with a yes.

From what I can tell, rc.sysinit runs quotacheck and quotaon on startup. The quotacheck program analyzes the filesystem, updates the aquota.* files. It then makes use of quota.h and the quotactl() syscall to inform the kernel of quota info.

From this point forward the kernel hashes that information and increments/decrements quota stats as changes occur. Upon shutdown, the init.d/halt script runs the quotaoff command RIGHT before the filesystems are unmounted. The quotaoff command does not appear to update the aquota.* files with the information the kernel has in memory. I say this because the {a,c,m}times for the aquota.user file are only updated upon a reboot of the system or by manual running the quotacheck command. It appears - as far as I can tell - that the kernel just drops it's up-to-date usage data on the floor at shutdown. This information is never used to update the aquota.* files. They are updated during startup by quotacheck(rc.sysinit). Seems silly to me since that updated info had already been collected by the kernel. So...in conclusion I am still not entirely clear on the methods. ;)

I never really pay block size much attention but obviously there can be benefits to choosing something other than the default. I am looking for a good "best practices" paper on choosing block size. Also, when used on top of LVM is it's performance payoffs or importance negated in any way? TIA

Please, I am not looking for a rehash of what's stated in RedHat's documentation regarding emergency mode. I would like to know what steps are involved from the time grub hands off to the kernel to the time you get a emergency mode login prompt.

I imagine /sbin/init is completely bypassed and therefore rc.sysinit bypassed as well. I don't however know what isn't bypassed or how emergency mode differs (intimately) with init=/bin/sh.

What sort of steps does the kernel take when given the emergency argument at boot time? Thanks!

I am about to configure two Nagios servers with one being a hot-standbye or failover unit. It will periodically check the active Nagios server and will need to steal its IP addresses in the case of failure.

My first instinct it to just script this using bash and cron, which should be fairly trivial. Is there a better utility for taking over another servers IPs? Perhaps one that would allow the previously active server to steal it's IPs back when it comes back online.