Bill Weiss's questions

I purchased the above-mentioned GigaVUE-212 for my test lab from eBay, to determine if I want to use them in production. However, the thing doesn't respond to the default passwords, and I can't figure out how to reset from the console. I do have access to the RedBoot loader, but their documentation is super vague about it.

I'm contacting support as well, and will leave an answer here if they have one for me other than "welp, that's why you don't use eBay", but my hope is someone else has been down this road.

I have a Mac server that I can join clients to using System Preferences -> Users and Groups -> Login Options -> Network Account Server. However, I'd like to do this remotely without having to touch every Mac. I have a local user on each machine that can sudo to root. How can I join the Network Account Server via the shell?

I've seen dsconfigad, but on a machine joined to my account server it doesn't show anything when I do dsconfigad -show, which implies that's the wrong command for me.

I have a Meraki wifi network that's authenticating via RADIUS to an Active Directory. Users log in with their AD username and password via WPA2. That all works. However, when a user changes their AD password (due to expiration, forgotten password, whatever), their Mac doesn't prompt for a new password; instead, it just can't connect to the wifi. To fix this we have to go into Network Preferences -> Advanced -> Wifi -> Preferred Networks, delete the network, then make a new connection. This is kind of clunky, and gets us a helpdesk call every time.

Any ideas on what we could do about this?

I've got a bunch of OS X laptops and desktops in the office that I'd like to back up using the built-in Time Machine. The first cut at this idea, buying a bunch of Time Capsules, seems like a management nightmare. Is there a reasonable way to run a server for a bunch of Time Machine clients?

I've got a Dell 5424 with about 20 machines directly attached to it. I did a ping sweep of my network (and got answers from all 20), then went to the CLI of the switch and did show arp. To my surprise, I only see two arp entries: one for my router, and one for the machine I'm SSHed into to do this work.

What the heck is going on here? It's not that there's another switch in place, these machines are directly connected to the switch. Is my expectation of all those arp entries on my switch mistaken?

If I use ping (machine) from the CLI, that machine's MAC shows up on the port I would expect it to in the arp table. The arp timeout is set to 3600, which seems a bit low to me, but is the default on this switch. The time between my ping sweep and my show arp was way lower than that.

I've got a sad RAID array on a 3ware 9650SE-16ML card. What I can't tell is if I've just suffered a double-disk failure (bummer!) or if I'm reading this wrong. The relavent output of /c0 show all is:

Port   Status           Unit   Size        Blocks        Serial
---------------------------------------------------------------
p0     DEGRADED         u0     931.51 GB   1953525168    5QJ07MAH            
p1     ECC-ERROR        u0     931.51 GB   1953525168    5QJ0DCW9            
p2     OK               u0     931.51 GB   1953525168    5QJ0DW9C            
p3     OK               u0     931.51 GB   1953525168    5QJ0CKXJ            

And the failure is (from show alarms):

Ctl  Date                        Severity  Alarm Message
------------------------------------------------------------------------------
c0   [Sun Nov 20 07:47:23 2011]  INFO      Rebuild started: unit=0
c0   [Sun Nov 20 08:20:12 2011]  ERROR     Drive ECC error reported: port=1, unit=0
c0   [Sun Nov 20 08:20:12 2011]  ERROR     Source drive error occurred: port=1, unit=0
c0   [Sun Nov 20 08:20:12 2011]  ERROR     Rebuild failed: unit=0
c0   [Sun Nov 20 08:20:12 2011]  INFO      Rebuild paused: unit=0

I think that what happened is p0 failed, and then p1 had an ECC error (aka, my data is gone). But... maybe not? It stays at 97% rebuilt, but can't get past this error.

As far as I can tell, a previous admin turned off the periodic verify, which is what got us into this state. This isn't something most people should worry about with their 3Ware RAIDs!

Update

After beating on it for a couple of days, I did the IgnoreECC bit and it rebuilt, but my data is hosed. Bummer.

I've got a hard drive image of an Exchange 2007 machine that had some mail I'd like access to. Is there a tool to pull the email out of the EDBs in a format I can read easily? A PST would be good, or an mbox, whatever.

Let's say I've got an RHEL machine that is running RHEL5.4. I'd like to upgrade it to 5.7 (latest), but the vendor that makes the software sitting on the machine only certifies it to 5.6. How can I upgrade to 5.6 but make sure I don't end up in 5.7 land? I'm sure I'm missing something basic here, but I can't find it.

Same question applies to CentOS, I suppose, so if someone has an answer there I'd try it.

Just like the subject says.

I've got a mess of FC hardware in a rack that I'd like to replace the cabling on. Looking at Monoprice I see that LC/LC cables are really close in price between 10Gb and "normal" ($9.18 for a 1m 10Gb, $8.91 for a 1m "normal"). Is there any reason I shouldn't buy the aqua-colored stuff for future use?

I have a single FC switch here that has a bunch of servers hanging off of it. Currently it is zoned (as per my previous question, Fibre Channel zoning best practices) by WWN, one zone for each pair of (server, disk array).

My question is, is there any reason I shouldn't do this zoning by port instead of WWN? The switch is already labeled with a server name per port, and I don't expect to do any moving of cables. I'm tending toward zoning by port because it allows me to replace an FC card without rezoning. That's not something you need to do often, you say? You're probably right, but I'm in the middle of a period where I have to do it a lot.

If it matters, it's a QLogic switch with QLogic or Brocade FC cards and a NetApp filer.

I'm hoping that this will be useful for more people than just me.

Right now I've got a fibre channel switch, a NetApp filer, and some servers running Oracle. All of the servers can see the same LUNs on the filer, and there's some internal clustering magic to keep them from stomping over each other's disk. The switch is zoned such that each server is in its own zone with the disks it can see. Thus, something like this:

Zone1 = {Oracle1, NetApp1, NetApp2}
Zone2 = {Oracle2, NetApp1, NetApp2}
Zone3 = {Oracle3, NetApp1, NetApp2}

(Those are soft zones based on WWN). My question is, is this the best way to do things, or would be be better to have one zone for all the things that share resources?

Zone1 = {Oracle1, Oracle2, Oracle3, NetApp1, NetApp2}

It seems to me like those are the same thing, but maybe there's something I don't know about? It looks like a little less management overhead to do it this way. Not a lot, but a little.

This seems like a dumb question, but... do I need both nss_ldap and pam_ldap to have my users in LDAP? It seems to me that pam_ldap would take care of pointing everything at the LDAP server as needed, and I don't know what nss_ldap adds for me.

I've got a SVN repository that's served up over HTTPS (via Apache). Well, some requests seem to cause the SVN server to freak out and eat 100% CPU. I say "seem to" because the SVN server goes nuts before Apache logs the connection, so I can't see what URL is being hit. The client is IntelliJ, and as far as I can tell it can't log exactly what it's sending to me.

How the heck do I debug this? I've got an idea of what someone clicks in IntelliJ to make the server go nuts, but I'd really like to see the exact query. Is there some option to Apache to make it log requests before they finish? Or... ?

I'm sure that some of you have dealt with this same problem. I'm hoping that someone has a better answer than what I'm doing now.

So, you've got some users in an LDAP directory, and one day you say "hey! I can authenticate against this thing for SSH!" And it is good.

Then one day you realize you want only certain users to be able to get into a machine. Say, developers should only be able to get into the dev boxes, not prod. You do some googling around and find pam_groupdn which goes in your LDAP config (/etc/ldap.conf) like so:

pam_groupdn CN=developers,OU=groups,DC=yourcompany

And, again, it is good. You make another group for prod, another for QA, etc. Maybe one day you have a second product dev group, so they get their own group. Whatever.

Then one day you've got a server that both developers and QA need to be able to log in to. Uh... It turns out that pam_groupdn doesn't take multiple values. What do you do? Well, if you're not thinking much, you say "oh, I'll just make a developers-and-QA group!".

pam_groupdn CN=developers-and-QA,OU=groups,DC=yourcompany

That's... not good, but it's ok, right?

Then one day you get another developer, and you realize you need to add them to 15 groups because there's developers-and-QA, product1-and-product2, developers-who-have-access-to-prod and so on. Crap.

There's got to be a better way to do this, right? I emailed the developers of pam_ldap, and they said that unfortunately there's no way to make pam_groupdn take multiple values (without hacking around in the code).

Anyone want to share how they manage groups-of-groups in LDAP without resorting to copy/paste?

I'm currently using nagios to do monitoring, including using the check_http options to check for an SSL cert that expires soon, etc. What I'd like to do is include testing for revoked certs for each of the sites that I monitor. Sounds easy, right? Well:

• check_http doesn't seem to check for revoked certs. At least, it didn't beep when it happened recently, which lead to some confusion
• Openssl's verify has -crl_check and -crl_check_all, which would be great, but I care about OSCP more than CRLs (since that's what browsers will care about)
• Openssl has an oscp mode, but it looks like I'd have to do a bunch of work to get the cert in the right place, figure out where the OSCP server is, etc.

I've found a bunch of articles about writing code to do OSCP checking, but there's got to be a nice program that does it, right? What I want is a Nagios check, or something that I could use as one. In my perfect world it would look something like:

check_http_with_oscp -I (IP) -H (hostname) -p 443

Anyone?

I've got Nagios running on a server here (CentOS 5.3 w/ Apache 2.2.3-22.el5.centos) authenticating to my LDAP server, and all works well. However, I'd like to have some IP able to see the Nagios status page without authenticating. Nagios has this option to assign a user to someone who doesn't auth:

authorized_for_read_only=guest
default_user_name=guest

Which sounds right, but that doesn't take care of the Apache authentication. My current apache config looks like:

<Directory "/usr/lib64/nagios/cgi">
   AllowOverride None
   Order allow,deny
   Allow from all
   AuthName "Nagios Access"
   AuthType Basic
   AuthUserFile /etc/nagios/misc/htpasswd.users
   Require valid-user

   AuthBasicProvider file ldap
   AuthzLDAPAuthoritative off
   AuthBasicAuthoritative On
   AuthLDAPGroupAttribute LDAPmember
   AuthLDAPURL (my server stuff)
   Require ldap-group CN=nagios,ou=groups,DC=local
</Directory>

That's working, but I'd like some way to say "this IP over here, he can skip that auth stuff". The Apache Satisfy directive looks like it would work, so I tried this:

<Directory "/usr/lib64/nagios/cgi">
   AllowOverride None
   Order allow,deny
   Allow from (IP)  <---- changed
   Deny from all    <---- changed
   Satisfy any      <---- changed
   AuthName "Nagios Access"
   AuthType Basic
   AuthUserFile /etc/nagios/misc/htpasswd.users
   Require valid-user

   AuthBasicProvider file ldap
   AuthzLDAPAuthoritative off
   AuthBasicAuthoritative On
   AuthLDAPGroupAttribute LDAPmember
   AuthLDAPURL (my server stuff)
   Require ldap-group CN=nagios,ou=groups,DC=local
</Directory>

But it didn't change the behavior of the site. Thoughts? "Works for me"s? Pointers to appropriate upgrade notes saying that I'd get around this problem if I got around to upgrading my server? :)

---- update w/ answer ----

I took out the file-or-LDAP stuff, and satisfy worked for me. I was probably doing something wrong in there, but whatever, it works now. Here's what my final config looks like:

<Directory "/usr/lib64/nagios/cgi">
   Options ExecCGI
   AllowOverride None
   Order allow,deny
   Allow from 192.168.42.213
   Satisfy any
   AuthName "Nagios Access"
   AuthType Basic

   AuthBasicProvider ldap
   AuthzLDAPAuthoritative off
   AuthBasicAuthoritative On
   AuthLDAPGroupAttribute LDAPmember
   AuthLDAPURL (my server stuff)
   Require ldap-group CN=nagios,ou=groups,DC=local
</Directory>

I'm pretty sure we aren't the only site using jumbo frames (~9k), right? Well, for those of you that are doing it as well, what are you doing about virtualization? Namely:

• Xen doesn't support packets over 1500 bytes on bridged interfaces. Assigning a real interface to each VM might work, but is a non-starter for me.
• KVM will do it if I futz around with the source. Otherwise I can get up to 4k packets. Messing with the source isn't something I really want to do (good-bye upstream patches without rebuilding!)
• VMWare doesn't mention it either way. Their VSphere pricing turns me off, but maybe I can just do ESX(,i)?

I'm not using jumbo packets for iSCSI or NFS. I'm really moving a ton of data between nodes, and upping my MTUs has helped with speeds there. My platform is CentOS 5.x, and I'd prefer to stay with that, but I suppose other options are possible? You tell me!

Anyone doing something clever I'm not thinking of?

[Edit]

Why do I want this? Well, my existing machines all use MTUs of 9000, and the place where that happens is in our clustering layer. If I add a new machine that doesn't speak jumbo packets it can't join the cluster, and it doesn't work. So while I would love to revisit the issue of "do we actually need jumbo packets?", that's a much bigger project than just bringing a new machine online. New machines have to be able to talk to the cluster. Right now that means deploying on bare hardware, and that sucks.

This could be an RTFM kind of question. If so, I'll gladly award the answer to whoever gives a link to TFM :)

In my racks, I've got redundancy all over the place. Two sets of switches, two upstream routers, two power paths, dual power supplies in the servers... you know the drill. However, now I'm wondering about dual paths from the servers. Each has two (or more) NICs. What we've done in the past was use LAGs (Cisco-speak: Etherchannel) to provide two links to the same switch. Actually, it's to two switches in a stack (so, one management interface, but two physical boxes). That means that we can survive failure of a cable, or of an interface (on the switch or on the box), or maybe even failure of a switch (if the stacking doesn't drag the other one with it).

Why not keep doing that? We're getting to the point where we need more than one switch stack. This means that, in a failure of a switch stack, we'll cut our reachable machines in half.

Assume that the switch stacks have cross connections with sufficient bandwidth to each other, to the routers, etc. What I'd like is something like Spanning Tree Protocol: run a line from each server to each switch, it picks one to use. If that link goes down, swap to the other one. I'm hoping that this will let us have a whole switch stack fail without problems (after everyone notices to switch over).

If it matters I'm running CentOS. Something that isn't switch specific is ideal, but I'd like to hear about solutions from vendors as well.

Are any of you running ActiveMQ with persistence in a database? Even better, in an Oracle database?

We're wanting to replace our current JMQ uses with ActiveMQ. The plan is to have two machines (one hot, one failover) that share an ActiveMQ queue, so that the failover can pick up where the hot machine left off. In testing with file-based persistence, this works great. However, giving both machines access to some fast file space is tricky, and wherever that is becomes a point of failure. Persisting into our Oracle database seems like the ideal way to go, but it's painfully slow in testing. Other things using the Oracle cluster are doing fine.

Is anyone doing this with acceptable performance? If so, was there a trick to tuning it? Did it "just work" for you? If either of those, would you mind sharing some config snippets or something? Even if you're not using Oracle, I'm sure I can translate the configuration as needed.

Edit: Really? This is the only ActiveMQ question on SF?

Edit 2: I'm talking about either of the first two configurations on this page. Specifically the latter ("JDBC Persistence without Journaling"), but experience with the former would be great.

My employer wants me to get a CCNA certification in the near future. I know the networking basics pretty well, but I don't have any experience with Cisco gear. We're willing to pay for one of the bootcamp-style courses, but I'd like to be able to do some reading about it beforehand.

So, let me know what works/worked for you.

Community wiki, because there's no "right" answer here. However, I feel like it would be a valuable thing to have around, given how many sysadmins end up working with the networking gear.