crb's questions

I have a backup application backed by many databases (one per client) in Microsoft SQL Server, storing files in the database as BLOBs.

We are looking to move this application to Amazon EC2, and want to have 3TB of disk available. The largest EBS volume you can create and attach to an instance is 1TB.

(Assume that the 3TB could be about 500 databases which grow to 6GB each.)

I see two ways of doing this:

• creating a striped RAID volume of these disks
• manually manage the databases, storing ⅓ on each disk

In the case of a RAID volume, the failure of any volume in the stripe would lose all the data. Amazon don't recommend software RAID 1 across EBS volumes, suggesting you manage durability with regular EBS snapshots (as this is handled outside your instance). If you managed the databases manually, then a disk failure would only impact the databases on that volume.

Managing the volumes manually means a lot of administrative overhead.

Is there a method where I can say "these three disks are the primary storage pool for SQL Server" and have it sort it out itself?

When installing a web application where a single user is used to talk to a single database (say MySQL, but this could apply to other RDBMSes also), you often have a sequence of events such as this:

CREATE DATABASE wordpress CHARACTER SET utf8;
GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'localhost' IDENTIFIED BY 'hunter2';

Some guides suggest using a different username to the database name, where others suggest using a different name, such as 'appuser' for the user, and 'app' for the database name.

Are there any obvious technical downsides to using the same name? Is there anywhere you're likely to create confusion by doing this?

Edit: I'm aware that this is questionable security practice, and you should name your databases fhqwhgads and your user flobadob; however, (a) obscurity is a questionable tool, and (b) this is the example every webapp gives in their documentation.

I want to make my network monitoring system send IM alerts, and the IM client of choice at my workplace is Skype.

Is there a command-line driven API, that doesn't require the GUI Skype client, so I can run it on the Linux machines that run my monitoring?

Alternatively, is there a Jabber-to-Skype gateway that would solve this problem?

I have a Postfix instance on an EC2 server which will need to accept mail from the outside world (e.g. port 25 will be mapped to it from a virtual IP.)

I also want to use this server to send mail from my other EC2 machines. As EC2 doesn't map to the concept of a subnet which can be granted relay access, I'm thinking about running Postfix on a second port, and limiting access to that port by security group.

Ultimately I want port 25 to run like normal, and have port 26 accept mail for anyone who is able to connect to it.

Can this be done?

Every time I run puppet, I get this error.

err: /File[/var/lib/puppet/lib]: Failed to retrieve current state of resource: Could not retrieve information from source(s) puppet://puppet/plugins

Given a config like this:

check host web1 address web1
    if failed host web1 port 80 protocol http
    then exec "/usr/local/bin/failover.sh -h web2"

Can I detect if web1 has returned from failed state, and perform a "fail back" action?

If I were just to detect if it was up, then I would be running the failover command every daemon seconds, and I don't want to do that if I don't have to; it would provide needless log entries and alerts.

I would like to be able to do this:

<LocationMatch ^/secret/(.+?)>
  <Limit GET>
    Require group member
  </Limit>
  <LimitExcept GET>
    Require group member
    Require group contributor
  </LimitExcept>
</LocationMatch>

"Require group" lets you suggest lots of groups that are considered with an OR; I require some kind of AND. Satisfy all seems to only influence Require when used with Allow.

Is there a way of controlling group membership with Require/AND?

(I should point out that we are using Atlassian Crowd's Perl module as our group provider, so if it's possible to implement this in the handler, that would work too.)

I would like to have a highly-available MySQL system, with automatic failover, running on Amazon EC2 instances.

The standard approach to solving this is problem Heartbeat + DRBD, but I've found a lot of posts suggesting DRBD doesn't work on EC2, though none saying exactly why. Obviously, a serial heartbeat or distinct network is out of the question in the virtualised environment. It would also be good to have the different servers be in different availability zones, but we're getting into a much harder problem there.

What are peoples' opinion on having a high uptime solution in "the cloud"?

Note: This question was asked before RDS with multi-AZ was announced, which is the nice automatic answer for today's modern IT professional. :)

I have some content that is only available to people who pass a GeoIP lookup and match certain countries. This is done by mod_rewrite and it all works well.

What I would like to do is log failed attempts, to help debug people who should be able to get at this content but cannot. In order to do this at present I need RewriteLogLevel at 4, which means everything on the virtual host is logged, rather than just the stuff I am restricting.

This is the example from the mod_geoip readme:

GeoIPEnable On
GeoIPDBFile /path/to/GeoIP.dat

RewriteEngine on
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^CA$
RewriteRule \.(gif|jpg|png|css)$ - [L] # don't redirect images and stylesheets
RewriteRule ^(.*)$ http://www.canada.com [L] # redirect everything else

I would like to add something like

WriteThisToLog "Denied access to $1 from IP $2 due to calculated country $3"

The variables are all there - is there a directive I can use to write out to the Apache error log?

Edit: I would have put this in the comment to the correct answer, but formatting was important. I've ended up with this:

RewriteRule ^(.*)$ http://www.canada.com [L,E=GEOIP_FAIL:1] # redirect everything else
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" GEOIP_COUNTRY_CODE=%{GEOIP_COUNTRY_CODE}e" geoip_fail_format
CustomLog /var/log/httpd/geoip_fail_log geoip_fail_format env=GEOIP_FAIL

I have a staging server running Postfix, which I want to only set up to deliver mail to example.org. If we are testing a function that sends e-mail, we want to be able to know that we won't accidentally send any test messages out to anyone outside our test domain.

All mail is sent from this server to a smarthost for delivery.

I have set up

relay_domains = example.org
smtpd_recipient_restrictions = reject_unauth_destination

This means the server only relays for example.org by SMTP. However, using mail(1) on the server, it will deliver for all addresses. How can I restrict this to the relay_domains only?

I am trying to install all my Perl modules from RPM (using rpmforge.net), instead of just acquiring them from CPAN.

My ultimate goal is to get Bugzilla 3.4.4 running. It requires CGI.pm 3.21 or later; the perl package on RHEL5 (5.8.8) comes with CGI.pm 3.15, and it doesn't appear that any of the 3rd-party package repositories package it seperately (there is no longer a perl-CGI RPM for Red Hat: since RH9, it appears!)

Is there a recommended solution?

Our ISA server administrator is saying this:

How the ISA cache works is as follows: when the ISA server receives a request to access a website, the first step it takes is check through the cache to see if it can load it locally. As the cache is currently 50Gb in size, the server has to check through this entire cache file before a) directly returning a result to the user or b) passing the request out to the internet to retrieve the web page (and in turn place it in cache). Having to parse this much data is likely to be slowing down the internet access.

Having a smaller cache would be beneficial in that the ISA server can handle requests faster by not having to constantly check the local disk for lengthy (in computer terms) periods of time.

He is advising we reduce our cache file from 50GB to 10GB.

While I agree with his sentiment, surely, this could be taken to extremes: if I don't have any cache file, surely I can skip those horrible slow disks, and just go to the nice fast Internet every time I get a request.

The question therefore: what is the optimal size for an ISA server disk cache file? Does ISA server have a convenient index or hash-table of cached requests such that it doesn't matter how large the cache file is, it will be able to find the offset of any cached content you want, inside that file in O(1) time?

I want to run a mail server (either Postfix or Exim) solely for redirecting mail aliases.

Its entire function will be to process a table of users for a domain (e.g. springfield-nuclear-environmental-squad.info) that looks like this:

lenny: [email protected]
carl: [email protected]
smithers: [email protected]

However, I'd like a nice web interface for this so that the Springfield Nuclear helpdesk can add people without having to have access to a shell on the server.

The simpler the better; I would rather not have to use a database if possible. I could also knock something up myself in LAMP, but would prefer to use an "off-the-shelf", open source, component, if one exists.

I am looking at a farm of RedHat Enterprise Linux (RHEL) 5.3 servers, which all have GNOME and Xorg installed, none of which need them. They were deployed by a 3rd party from a VM template, and I don't know all of their history. What I do know is none of them run an application that actually requires having a full GUI installed. However, it is possible, that some run an application that requires some X libraries (ImageMagick comes to mind).

According to yum grouplist, the 'X Window System' group is not installed, so I can't use yum groupremove here.

Is there a sufficiently low-in-the-dependency-chain package, or packages, that I can remove, which will pull out Gtk, GNOME and Xorg? Alternatively, if it generates a list of packages to remove before starting, we can reinstall the applications we need, which will pull back the X libraries, when we are done.

We have a web site hosting Office documents behind IIS6 Basic authentication.

IE has an authentication token for basic auth, which it presents to download the file. The user clicks "Open", and then Microsoft Office Protocol Discovery does a HTTP OPTIONS request on the directory the file was served from. However, Office does not have the auth token that IE does, so it prompts again for credentials. Hitting Cancel will then show you the file in Office.

As we are not a Sharepoint-like application, and we don't have a way of responding to OPTIONS, I would like to reply to all requests with the OPTIONS method (that are sent with a user-agent of "Microsoft Office Protocol Discovery") with something like an empty 200, as RFC 2616 states:

If no response body is included, the response MUST include a Content-Length field with a field-value of "0".

I am leaning towards an ISAPI filter that responds with 200 - before the Basic authentication happens. Windows auth or anonymous access are not options. Are there any alternatives I am missing?