Hubert Kario's questions

During past month one of my Debian Squeeze (Linux 2.6.32-bpo.5-amd64) machines did lock up twice, hard. No response to ARP, dark console, Caps Lock, Num Lock not working, Magic SysRq ineffective. Changing the kernel to 3.2.0-0.bpo.2-amd64 from backports didn't help either.

Temperature and load monitoring doesn't show any spikes before crash.

How should I diagnose and debug such problem?

Is netconsole my only bet?

EDIT: I've already disabled screen blanking:

#/etc/console-tools/config
BLANK_TIME=0
POWERDOWN_TIME=0

and

setterm -blank 0

on physical console.

UPDATE:

This time it locked, the screen was still showing login prompt. Since last problems I've run a 6h load test with BOINC (Prime 95) test without any problem.

The problem I'm experiencing is quite simple: while the memory used by applications is quite small (~2GB), at the same time Task manager reports that the server has basically all memory in use (16GB). During this it starts swapping, performance goes through floor and latency goes through the roof.

I diagnosed this back to an application that opens many files using mapped memory access (probably in some not-quite-standard way, as it's written in Delphi). RamMap from Sysinternals reports that those 14GB are used for "Mapped File", in Active state. Thing is, this memory is not actively used, those applications are in stand-by mode, with no clients attached. As idle as they can be.

To bring memory usage back to normal levels I just need to use the "Empty→Empty System Working Set" option in RamMap. This fixes the issue of no free memory for as long as there is no new activity (reading from data files, etc.). Then the memory usage goes up and performance goes down again.

The solution would be to write a script to do the same thing RamMap does every few minutes. That's where I'm stuck. I found EmptyWorkingSet WinAPI function and found PowerShell script to run it on all processes in the system, but it does reduce used memory by at most 200-300MB not few GB RamMap is able to.

How to run RamMap Empty System Working Set option regularly?

How to display printer information, such as printer description or printer location using command line tools?

lpstat -t lists printer names, classes and devices for printers, but it doesn't list printer description or location. Is there a way to get this information without using http or GUI interface?

I've extended my hardware RAID device on LSI MegaRAID controller by adding disks to the array. While making Linux notice the block device size change was not straight forward, I've found that one can rescan the device (using echo y > /sys/devices/pci0000:00/0000:00:02.2/0000:03:00.0/host0/target0:2:0/0:2:0:0/rescan in my case, for first logical drive) to fix that.

Unfortunately, I'm stuck at this point.

XenServer 6.0 by default uses GPT not MBR partitions and as such, using fdisk to modify partition table is impossible (the usual tool I've used to extend physical partitions). GPT labels save not only the position of partitions but also size of the disk (by saving the secondary GPT header at last 34, or so, sectors). Probably because of that, the gdisk and sgdisk utilities can't resize the last partition above the old drive limit.

I've tried fdisk (does not work with GPT), sfdisk (does not work with GPT), parted (not installed), cfdisk (not installed).

What tool and commands should I use to extend GPT partitions on system without parted?

I have a XenServer 5.6 Free setup with 5 VMs (Windows and Linux) using about 1.5TB of directly attached storage.

Because our virtualisation needs have grown a bit, we currently are preparing a faster XenServer 6.0 Free machine with more RAM and a more storage. Again, directly attached disks.

How can I migrate the VMs between XenServer machines?

I don't need to keep the machines up and running during migration, but using VM export and import would definitely take too long.

Would making a VM with the same configuration on new host and dd'ing the LVM volume over network be the only quick and least painful solution? Are there any "gotchas" I should look out for when doing something like this? The old machine has an AMD Phenom II, the new has Intel Xeon E5 CPUs.

I have databases from different projects on one server. I can't give all developers administrative (sysadmin) access to the databases. They have to have the permissions needed to create and restore databases. The dbcreator server role works quite nicely for that. In other words, the users that restore the backups have dbcreator but not sysadmin.

Unfortunately, because most of the restored backups don't come from the same server that they are restored on, users that restore the backups immediately lose access to the database that they just have restored.

How can they restore a database so that the user that restored database from backup is automatically added to dbowner database role? What changes are needed in SQL Server to make that possible?

Update: I've tried to add trigger on INSERT to [dbo].[restorehistory], but to add role using the sp_addrolemember requires use [database] to work and this statement is illegal in a trigger. I've also read that triggers on restorehistory don't fire at all after database import (as it's a system table).

With btrfs hitting production in Oracle EL 14th this month (together with working fsck and scrubbing from Linux 3.2) I was thinking of redesigning my current backup solution to utilise it. Note that I'm thinking about doing it for small amounts of data, less than 10TB, that's fairly static (less than 1% changed daily). In short a SMB/SOHO backup solution.

What the backup should do:

1. do a LVM snapshot of ext[234]/XFS/JFS on the production server
2. rsync/transfer changed data to btrfs on backup server
3. snapshot the btrfs filesystem
4. drop old snapshots when free space is running low

Pros:

• All files easily available, no decompression or loop mounting needed
• Past snapshots also easily available...
• ... so I can share them as read-only Samba shares (with shadow copy support)
• Snapshots take minimal amount of space thanks to copy-on-write (snapshot without changes takes literally few KiB on disk)
• High backup consistency: checksums on files, scrubbing of all data and built-in redundancy

Questions:

• Is there some backup solution (in form of Bacula, BackupPC, etc.) that is, or can be easily made, aware of copy-on-write file system?
• Or will I need to use in-home rsync solution?
• What do people with ZFS boxes dedicated for backup do to backup their Linux machines?

I have created a simple package using checkinstall of the Oracle Instantclient client libraries, the package installs without problem and is seen in the system.

Problem is, that checkinstall doesn't create /var/lib/dpkg/info/oracle-instantclient11.2-basic.symbols or /var/lib/dpkg/info/oracle-instantclient11.2-basic.shlibs files so when I try to create another package (with proper build scripts) that depends on oracle-instantclient11.2-basic the build fails with

dpkg-shlibdeps: error: no dependency information found for \
 /usr/lib/libclntsh.so.11.1 (used by \
 debian/libopendbx1-oracle/usr/lib/opendbx/liboraclebackend.so.1.2.0).
dh_shlibdeps: dpkg-shlibdeps \
 -Tdebian/libopendbx1-oracle.substvars \
 debian/libopendbx1-oracle/usr/lib/opendbx/liboraclebackend.so.1.2.0 \
 returned exit code 2
make: *** [binary-arch] Error 9

Is there an easy way to automatically create a package with .symbols or .shlibs files?

Short version:

I have such situation on a Samba share:

$ ls -lha
total 12K
drwxr-xr-x  3 hka  Domain Users 4.0K Jan 11 17:07 .
drwxrwxrwt 19 root root         4.0K Jan 11 17:06 ..
drwxr-xr-x  2 hka  Domain Users 4.0K Jan 11 17:07 dir A
-rw-r--r--  1 hka  Domain Users    0 Jan 11 17:07 file A

How am I able to change this to following using only Windows SMB/CIFS client (using 3rd party applications is OK)

$ ls -lha
total 12K
drwxr-xr-x  3 hka  Domain Users 4.0K Jan 11 17:07 .
drwxrwxrwt 19 root root         4.0K Jan 11 17:06 ..
drwxr-xr-x  2 hka  ntpoweruser  4.0K Jan 11 17:07 dir A
-rw-r--r--  1 hka  ntpoweruser     0 Jan 11 17:07 file A

Rationale and background info

I'm using POSIX ACLs on Samba shares. Together with acl group control for Samba, it allows me to delegate management of permissions to different users based on group membership.

Thing is, when I create a new file on a Samba share, I'm unable to set its primary group (the one that grants permission to change its permissions). It's being set to my primary group (Domain Users) or group set using force group option in smb.conf share definition.

Removing all groups in windows except the one I want to become the new primary group doesn't work. I can change it using chgrp group folder/ as regular user though shell, but it's suboptimal (not all users are *nix users).

Trying to set new owner to group from Windows file permission window makes the Samba to return permission denied with following log entry:

[2012/01/05 21:13:03.349734,  3] smbd/nttrans.c:1899(call_nt_transact_set_security_desc)
  call_nt_transact_set_security_desc: file = projects/project A/New folder, sent 0x1
[2012/01/05 21:13:03.349774,  3] smbd/posix_acls.c:1208(unpack_nt_owners)
  unpack_nt_owners: unable to validate owner sid for S-1-5-21-4526631811-884521863-452487935-11025
[2012/01/05 21:13:03.349804,  3] smbd/error.c:80(error_packet_set)
  error packet at smbd/nttrans.c(1909) cmd=160 (SMBnttrans) NT_STATUS_INVALID_OWNER

The SID is correct and belongs to group I specified in GUI.

What I basically want to do, is to be able to set SGID (setgid) on certain directories from Windows on Samba shares. Reminder: Files and directories created within directory with SGID set inherit the primary group of parent directory.

Environment

I have an environment with few dozen groups which need to access files related to projects they belong to. As the membership of project groups and the groups themselves is changing quite often, I want to delegate setting of permissions to group leaders as much as it is possible. While managing group membership was easy (GOSa privilege delegation took care of this nicely), I'm struggling with file permissions.

Note: the number of groups and other similar hierarchies is large, so creating different shares for each group or hierarchies is unworkable (the amount of possible mount points in Windows is limited, using UNC paths is unfortunately impossible too).

The folders in the share look like this:

/share root
+-- hierarchy 1
+-- hierarchy 2
|   ...
+-- hierarchy 20
+-- projects
    +-- project A
    |   +-- dir A
    |   +-- file
    +-- project B
    +-- ...
    +-- project Z

Samba ACL Group Control

The nice feature of samba (acl group control) allows me to allow members of primary group owning the directory or file to edit its permissions (unlike the regular: owner, root and "admin users" from smb.conf).

So when I have a folder like this (POSIX ACL from getfacl):

# file: project A
# owner: root
# group: proj-a-adm
# flags: -s-
user::rwx
group::rwx
group:Domain\040Users:r-x
group:proj-a:rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:Domain\040Users:r-x
default:group:proj-a:rwx
default:mask::rwx
default:other::---

Members of group proj-a-adm can edit permissions of this directory (and all directories and files created within), while members of proj-a group can modify files themselves, but can't change permissions of those files. Domain Users can only read files within.

Problem

When there is a new project created, a root user needs to run chmod g+s projects/project\ AA on command line.

I can edit permissions of files and folders after a new project was created without a problem using Windows file permissions window, but creation of new project folder requires running a command in the shell which is rather hackish.

I have some problems with stability of Debian guests in my XenServer hosts.

To debug this problem I wanted to use netconsole kernel module, unfortunately, because the Ethernet controller is emulated, it doesn't support polling and in effect netconsole:

[23463.961946] netconsole: local port 6665
[23463.961950] netconsole: local IP 10.10.12.10
[23463.961952] netconsole: interface eth0
[23463.961954] netconsole: remote port 6667
[23463.961956] netconsole: remote IP 10.10.12.1
[23463.961958] netconsole: remote ethernet address ff:ff:ff:ff:ff:ff
[23463.961962] netconsole: eth0 doesn't support polling, aborting.
[23463.961971] netconsole: cleaning up

Are there any alternatives to netconsole not requiring physical access to host? I've got network syslog already configured.

Edit:

How is it possible to log all serial output coming from a particular DomU?

I moved password quality checking in Samba from check password script to PAM, now when pam_passwdqc or pam_cracklib deny password change the user revives a "Access denied" error, not the standard "The password you typed does not meet the password policy yada yada" (still mostly untrue when dictionary checking is involved and there are different rules for different lengths).

How I can force Samba to return a "password does not meet policy" error when PAM denies password change? I already use pam password change = yes

Can I make Samba return more specific error and make Windows to show it? e.g.: your password is too short, your password is based on dictionary word, your password needs to also have characters other than letters.

Currently I have a nice setup using private IPv4 address space and uplinks from two ISPs to the Internet. Thanks to NAT I can just take down one of the interfaces and the Internet access is still there.

I've been thinking how to duplicate this configuration in IPv6. From what I read is that "NAT is dead", I really glad for that, I don't like it (and sometimes outright hate it), but it has its uses.

To put some perspective in: this is a small company, 3 dozen computers in network, we don't have budget for fancy links with SLA and BGP support. So I think that our own IPv6 subnet from RIPE-NCC won't work.

On the other hand, having two independent links is more than useful. Is there a way to do a 1-to-1 NAT in IPv6 (I'm using Linux machine as a router)? How do I do it? Will it allow me to continue using two ISPs (provided that they both support IPv6).

When I get a subnet from my ISP I need to have an IP address facing the Internet (to be able to route packets to my ISP) and a second one facing my LAN. In IPv6 both should be routable. Doesn't this mean I have to get at least 2 subnets from my ISP? Or ISPs are required to provide a /48 subnet not only two /64 subnets? (And dedicate first /64 subnet to intra router communication.) What to do if I get only a single /64 subnet from ISP?

To summarize:

Questions

• Can I do 1-to-1 NAT in IPv6 in Linux? How do I do it?
• Do I need to receive at least two /64 subnets to comfortably set up routing in LAN behind firewall?
• Is there a way to have public addresses in my LAN if I get a single /64 subnet from my ISP?

Is there a way do deploy remotely new CA certificates to Firefox installs?

In other words, has anything changed since this question was answered Installing a CA certificate on multiple Windows machines (IE/Firefox)

I'd like to block incoming TeamViewer connections to my network, but at the same time to allow outgoing TeamViewer connections.

So that users can't connect to their work PCs with TV (circumventing domain authentication) but at the same time could connect to clients PCs to help fix problems.

Is it at all possible?

I want to tune Windows 7 TCP stack for speed in a LAN environment.

Bit of background info: I've got a Citrix XenServer set up with Windows 2008R2, Windows 7 and Debian Lenny with Citrix kernel, Windows machines have Tools installed the iperf server process is running on different host, also Debian Lenny. The servers are otherwise idle, tests were repeated few times to confirm results.

While testing with iperf 2008R2 can achieve around 600-700Mbps with no tuning what so ever but I can't find any guide or set of parameters that will make Windows 7 achieve anything over 150Mbps with no change in TCP window size using -w parameter to iperf.

I tried using netsh autotuining to disabled, experimental, normal and highlyrestricted - no change. Changing congestionprovider doesn't do anything, just as rss and chimney.

Setting all the available settings to same values as on Windows 2008R2 host doesn't help.

To summarize:

• Windows 2008R2 default settings: 600-700Mbps
• Debian, default settings: 600Mbps
• Windows 7 default settings: 120Mbps
• Windows 7 default, iperf -w 65536: 400-500Mbps

While the missing 400Mbps in performance I blame on crappy Realtek NIC in the XenServer host (I can do ~980Mbps from my laptop to the iperf server) it doesn't explain why Windows 7 can't achieve good performance without manually tuning window size at the application level.

So, how to tune Windows 7?

What are the features of graphical terminal servers and technologies available for Linux?

• is it open source/free
• how well does it scale
• management (?)
• what's the network usage, susceptibility to latency
• support for session pause/resume
• what client platforms does it support
• support for sound (playback and record)
• directory/local disk sharing
• local printing
• other cons/pros

This question is supposed to be a community wiki for comparison between the different technologies, but it looks like I don't have enough points to make questions into wikis(?)

I've needed to configure LDAP authentication for Joomla! and the only way to get it to work together (with LDAP group based was by using groupOfUniqueNames, not the posixGroup. In other words, Joomla expects LDAP to follow the RFC2307bis schema.

This beg the question: do other LDAP using applications understand the RFC2307bis schema?

From what I could find, the 4 most important applications do:

• pam_ldap and nss_ldap
• Samba
• Gosa
• phpLDAPAdmin

Besides that, what is the state of general support for this schema (Apache auth, squid, groupware suites, freeradius)?

Any problems with such configuration (rfc2307bis, pam_ldap, nss_ldap and samba)?

I replaced a battery in APC SmartUPS by hot-swapping. While the swap was all right and didn't disturb connected computers, the "Battery failed" LED on the front face kept glowing.

I tried to use apctest from apcups package. Turned off the daemon and run self test (first changing BATTDATE in EEPROM). The test run fine but didn't clear the REPLACEBATT status or the glowing LED.

How to clear the failed battery state without powering the UPS and connected equipment down?

I'm configuring a system in which all IT resources are available through a single user-password pair, be it access to shell on the servers, logging to Samba domain, WiFi, OpenVPN, Mantis, etc. (with access to specific services governed by group membership or user object fields). Because we have personal data in our network, we need to implement password aging, as per the EU Data Protection Directive (or rather the Polish version of it).

The problem is that Samba and POSIX accounts in LDAP use different password hashing and aging information. While synchronizing the passwords themselves is easy (the ldap password sync = Yes in smb.conf), adding password aging to the mix breaks things: Samba doesn't update shadowLastChange. Together with obey pam restrictions = Yes creates a system in which a windows user can't change aged password, but if I don't use it, home directories won't be automatically created. The alternative is to use use LDAP extended operation for password changing, but the smbk5pwd module doesn't set it either. What's worse, the OpenLDAP maintainer won't update it/accept patches as this field is considered deprecated.

So, my question is, what is the best solution? What are the up- and downsides of them?

1. Use LDAP ppolicy and internal LDAP password aging?

   1. How well does it work with NSS, PAM modules, samba, other systems?
   2. Do the NSS and PAM modules need to be configured in special way to use ppolicy, not shadow?
   3. Does GOsa² work with ppolicy?
   4. Are there other administrative tools that can work with ppolicy-enabled LDAP?

2. Hack together a change password script that updates the field in LDAP. (leaving the possibility that the user himself will update the field without changing password)